plugin-scanner 2.0.685__tar.gz → 2.0.686__tar.gz

{plugin_scanner-2.0.685 → plugin_scanner-2.0.686}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.685
+Version: 2.0.686
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.685 → plugin_scanner-2.0.686}/dashboard/src/approval-center-utils.ts

@@ -174,7 +174,23 @@ export function buildMemorySummary(
   return `The last saved decision for ${item.artifact_name} was ${receipt.policy_decision}.`;
 }
 
-export function scopeLabel(scope: string): string {
+export function scopeLabel(scope: string, variant: "review" | "policy" = "review"): string {
+  if (variant === "policy") {
+    switch (scope) {
+      case "artifact":
+        return "Once";
+      case "workspace":
+        return "This project";
+      case "harness":
+        return "This app";
+      case "publisher":
+        return "This source";
+      case "global":
+        return "Every project";
+      default:
+        return scope;
+    }
+  }
   switch (scope) {
     case "artifact":
       return "This retry only";

{plugin_scanner-2.0.685 → plugin_scanner-2.0.686}/dashboard/src/guard-types.ts

@@ -485,6 +485,7 @@ export type GuardPolicyDecision = {
   remembered_command?: string | null;
   remembered_context?: string | null;
   workspace_label?: string | null;
+  source_scope_path?: string | null;
 };
 
 export const GUARD_CLOUD_EXCEPTION_ACK_STATUSES = [

{plugin_scanner-2.0.685 → plugin_scanner-2.0.686}/dashboard/src/policy-cloud-exceptions-list.tsx

@@ -90,7 +90,7 @@ function ExceptionCard({
     >
       <div className="flex flex-wrap items-center gap-2">
         <Badge tone="success">{item.effect}</Badge>
-        <Tag tone="slate">{scopeLabel(item.scope)}</Tag>
+        <Tag tone="slate">{scopeLabel(item.scope, "policy")}</Tag>
         {isCloudExceptionAckFailure(item) ? <Badge tone="warning">Ack issue</Badge> : null}
       </div>
       <p className="mt-2 break-words text-sm font-semibold text-brand-dark">{headline}</p>
@@ -107,7 +107,7 @@ function PendingRequestCard({ item }: { item: GuardCloudExceptionRequestItem })
     <article className="min-w-0 rounded-xl border border-amber-100 bg-amber-50/40 px-3.5 py-3">
       <div className="flex flex-wrap items-center gap-2">
         <Badge tone="warning">Pending</Badge>
-        <Tag tone="slate">{scopeLabel(item.scope)}</Tag>
+        <Tag tone="slate">{scopeLabel(item.scope, "policy")}</Tag>
       </div>
       <p className="mt-2 break-words text-sm font-semibold text-brand-dark">{item.reason}</p>
       <p className="mt-1 break-words text-xs text-slate-600">

{plugin_scanner-2.0.685 → plugin_scanner-2.0.686}/dashboard/src/policy-remembered-rules-right-rail.tsx

@@ -46,7 +46,7 @@ export function PolicyRememberedRulesRightRail({
                 {index + 1}
               </span>
               <div>
-                <p className="text-sm font-medium text-brand-dark">{scopeLabel(step.scope)}</p>
+                <p className="text-sm font-medium text-brand-dark">{scopeLabel(step.scope, "policy")}</p>
                 <p className="text-xs leading-relaxed text-slate-500">{step.detail}</p>
               </div>
             </li>

{plugin_scanner-2.0.685 → plugin_scanner-2.0.686}/dashboard/src/policy-remembered-rules-tab.tsx

@@ -61,8 +61,15 @@ export function PolicyRememberedRulesTab({
         policy.scope,
         policy.action,
         policy.reason,
+        policy.remembered_command,
+        policy.remembered_context,
+        policy.workspace_label,
+        policy.source_scope_path,
+        policy.source_receipt_id,
         display.headline,
-        display.subtitle,
+        display.kindLine,
+        display.pathLine,
+        display.projectLabel,
         harnessDisplayName(policy.harness),
         policyActionLabel(policy.action),
       ]
@@ -104,7 +111,7 @@ export function PolicyRememberedRulesTab({
             <HiMiniMagnifyingGlass className="h-4 w-4 shrink-0 text-slate-400" aria-hidden="true" />
             <input
               type="search"
-              placeholder="Search by app, action, or reason…"
+              placeholder="Search command, project, path, or app…"
               value={searchQuery}
               onChange={handleSearchChange}
               aria-label="Search policies"

{plugin_scanner-2.0.685 → plugin_scanner-2.0.686}/dashboard/src/policy-remembered-rules.test.tsx

@@ -34,7 +34,7 @@ assert(cloudSource.includes("No Guard Cloud rules synced"), "cloud rules empty s
 assert(cloudSource.includes("Connect Guard Cloud"), "cloud rules empty state body");
 assert(!cloudSource.includes("onClearPolicy"), "cloud rules are read-only without remove");
 
-assert(tabSource.includes('placeholder="Search by app, action, or reason…"'), "tab preserves search");
+assert(tabSource.includes('placeholder="Search command, project, path, or app…"'), "tab preserves search");
 assert(tabSource.includes('aria-label="Filter by app"'), "tab preserves app filter");
 assert(tabSource.includes('aria-label="Filter by action type"'), "tab preserves family filter");
 assert(tabSource.includes("PolicyRememberedLocalRules"), "tab mounts local rules section");
@@ -44,7 +44,7 @@ assert(tabSource.includes("PolicyRememberedRulesRightRail"), "tab mounts right r
 assert(railSource.includes("Review scope ladder"), "right rail explains review scope ladder");
 assert(railSource.includes('scope: "artifact"'), "scope ladder includes narrowest scope");
 assert(railSource.includes('scope: "global"'), "scope ladder includes widest scope");
-assert(railSource.includes("scopeLabel(step.scope)"), "scope ladder renders human scope labels");
+assert(railSource.includes('scopeLabel(step.scope, "policy")'), "scope ladder renders policy scope labels");
 assert(railSource.includes("Open Cloud exceptions tab"), "right rail links to Cloud exceptions tab");
 assert(railSource.includes("Remembered rules vs Cloud exceptions"), "right rail explains remembered vs cloud");
 
@@ -52,9 +52,12 @@ assert(workspaceSource.includes("PolicyRememberedRulesTab"), "workspace uses rem
 assert(!workspaceSource.includes("PolicyRememberedRulesHelper"), "workspace no longer uses inline helper");
 assert(!workspaceSource.includes("GroupedPolicySection"), "workspace no longer mounts grouped sections directly");
 
-assert(viewsSource.includes("Remembered action"), "rules table uses mockup-style columns");
+assert(viewsSource.includes("Command"), "rules table uses command column");
+assert(viewsSource.includes('scopeLabel(policy.scope, "policy")'), "rules table uses policy scope labels");
+assert(viewsSource.includes("display.pathLine"), "rules table shows approval path");
+assert(viewsSource.includes("display.projectLabel"), "rules table shows project column");
 assert(viewsSource.includes("resolvePolicyApprovalRecordLabel"), "rules table links approval record by receipt id");
-assert(viewsSource.includes("display.rememberSentence"), "rules table explains remembered behavior");
+assert(!viewsSource.includes("display.rememberSentence"), "rules table omits verbose remember sentence");
 assert(viewsSource.includes("View on cloud"), "cloud rules link to Guard Cloud");
 assert(viewsSource.includes("Remove rule"), "local rules expose remove action");
 assert(viewsSource.includes("!cloudManaged"), "remove action gated to non-cloud rules");

plugin_scanner-2.0.686/dashboard/src/policy-strict-config-segmented.tsx

@@ -0,0 +1,128 @@
+import { useCallback } from "react";
+import type { GuardSettings } from "./guard-types";
+import { STRICT_CONFIG_ACTION_OPTIONS } from "./policy-strict-config-utils";
+
+const PRIMARY_STRICT_ACTIONS = [
+  { value: "allow", label: "Allow" },
+  { value: "warn", label: "Warn" },
+  { value: "review", label: "Review" },
+  { value: "block", label: "Block" },
+] as const;
+
+const PRIMARY_STRICT_ACTION_VALUES = new Set<string>(PRIMARY_STRICT_ACTIONS.map((item) => item.value));
+
+type StrictConfigActionSegmentedProps = {
+  label: string;
+  value: string;
+  settingKey: "default_action" | "changed_hash_action" | "new_network_domain_action" | "subprocess_action" | "destructive_shell";
+  onSettingChange: (key: StrictConfigActionSegmentedProps["settingKey"], value: string) => void;
+  disabled?: boolean;
+  help?: string;
+};
+
+export function StrictConfigActionSegmented({
+  label,
+  value,
+  settingKey,
+  onSettingChange,
+  disabled = false,
+  help,
+}: StrictConfigActionSegmentedProps) {
+  const handleSelect = useCallback(
+    (nextValue: string) => {
+      onSettingChange(settingKey, nextValue);
+    },
+    [onSettingChange, settingKey],
+  );
+
+  const showAdvanced = !PRIMARY_STRICT_ACTION_VALUES.has(value);
+
+  return (
+    <div className="space-y-2">
+      <div>
+        <p className="text-sm font-medium text-brand-dark">{label}</p>
+        {help ? <p className="mt-0.5 text-xs text-slate-500">{help}</p> : null}
+      </div>
+      <div
+        className="inline-flex flex-wrap gap-1 rounded-xl border border-slate-200 bg-slate-50/80 p-1"
+        role="group"
+        aria-label={label}
+      >
+        {PRIMARY_STRICT_ACTIONS.map((option) => {
+          const selected = value === option.value;
+          return (
+            <button
+              key={option.value}
+              type="button"
+              disabled={disabled}
+              aria-pressed={selected}
+              onClick={() => handleSelect(option.value)}
+              className={`rounded-lg px-3 py-1.5 text-sm font-medium transition ${
+                selected
+                  ? "bg-white text-brand-dark shadow-sm ring-1 ring-slate-200"
+                  : "text-slate-600 hover:bg-white/70 hover:text-brand-dark disabled:opacity-50"
+              }`}
+            >
+              {option.label}
+            </button>
+          );
+        })}
+      </div>
+      {showAdvanced ? (
+        <label className="block space-y-1">
+          <span className="text-xs font-medium text-slate-500">Advanced fallback</span>
+          <select
+            value={value}
+            disabled={disabled}
+            onChange={(event) => handleSelect(event.target.value)}
+            className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark disabled:cursor-not-allowed disabled:bg-slate-50"
+          >
+            {STRICT_CONFIG_ACTION_OPTIONS.map((option) => (
+              <option key={option.value} value={option.value}>
+                {option.label}
+              </option>
+            ))}
+          </select>
+        </label>
+      ) : null}
+    </div>
+  );
+}
+
+export type StrictConfigSettingKey = StrictConfigActionSegmentedProps["settingKey"];
+
+export function resolveStrictConfigPatch(
+  settings: GuardSettings,
+  key: StrictConfigSettingKey,
+  value: string,
+): Partial<GuardSettings> {
+  if (key === "destructive_shell") {
+    return {
+      risk_actions: {
+        ...settings.risk_actions,
+        destructive_shell: value,
+      },
+    };
+  }
+  return { [key]: value };
+}
+
+export function applyStrictConfigPatch(
+  settings: GuardSettings,
+  key: StrictConfigSettingKey,
+  value: string,
+): GuardSettings {
+  if (key === "destructive_shell") {
+    return {
+      ...settings,
+      risk_actions: {
+        ...settings.risk_actions,
+        destructive_shell: value,
+      },
+    };
+  }
+  return {
+    ...settings,
+    [key]: value,
+  };
+}

{plugin_scanner-2.0.685 → plugin_scanner-2.0.686}/dashboard/src/policy-strict-config-tab.tsx

@@ -8,10 +8,15 @@ import {
   fingerprintLocalPolicySettings,
   resolveStrictFileWriteAction,
   simulateStrictPolicyOutcome,
-  STRICT_CONFIG_ACTION_OPTIONS,
   STRICT_POLICY_LAYER_OPTIONS,
   STRICT_POLICY_EVALUATION_ORDER,
 } from "./policy-strict-config-utils";
+import {
+  applyStrictConfigPatch,
+  resolveStrictConfigPatch,
+  StrictConfigActionSegmented,
+  type StrictConfigSettingKey,
+} from "./policy-strict-config-segmented";
 import { resolveCloudPolicyBundleCopy } from "./policy-workspace-helpers";
 
 type PolicyStrictConfigTabProps = {
@@ -22,64 +27,6 @@ type PolicyStrictConfigTabProps = {
 
 type LoadState = "loading" | "ready" | "error";
 
-type StrictConfigSettingKey =
-  | "default_action"
-  | "changed_hash_action"
-  | "new_network_domain_action"
-  | "subprocess_action"
-  | "destructive_shell";
-
-type StrictConfigSelectOption = {
-  value: string;
-  label: string;
-};
-
-type StrictConfigSelectProps = {
-  label: string;
-  value: string;
-  settingKey: StrictConfigSettingKey;
-  onSettingChange: (key: StrictConfigSettingKey, value: string) => void;
-  options?: readonly StrictConfigSelectOption[];
-  disabled?: boolean;
-  help?: string;
-};
-
-function StrictConfigSelect({
-  label,
-  value,
-  settingKey,
-  onSettingChange,
-  options = STRICT_CONFIG_ACTION_OPTIONS,
-  disabled = false,
-  help,
-}: StrictConfigSelectProps) {
-  const handleChange = useCallback(
-    (event: ChangeEvent<HTMLSelectElement>) => {
-      onSettingChange(settingKey, event.target.value);
-    },
-    [onSettingChange, settingKey],
-  );
-
-  return (
-    <label className="block space-y-1.5">
-      <span className="text-sm font-medium text-brand-dark">{label}</span>
-      {help ? <span className="block text-xs text-slate-500">{help}</span> : null}
-      <select
-        value={value}
-        onChange={handleChange}
-        disabled={disabled}
-        className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark disabled:cursor-not-allowed disabled:bg-slate-50"
-      >
-        {options.map((option) => (
-          <option key={option.value} value={option.value}>
-            {option.label}
-          </option>
-        ))}
-      </select>
-    </label>
-  );
-}
-
 type SimLayerSelectProps = {
   label: string;
   value: "allow" | "block" | "none";
@@ -181,33 +128,13 @@ export function PolicyStrictConfigTab({
       return;
     }
     const previousSettings = settings;
-    const updatedSettings: GuardSettings =
-      key === "destructive_shell"
-        ? {
-            ...settings,
-            risk_actions: {
-              ...settings.risk_actions,
-              destructive_shell: value,
-            },
-          }
-        : {
-            ...settings,
-            [key]: value,
-          };
+    const updatedSettings = applyStrictConfigPatch(settings, key, value);
 
     setSettings(updatedSettings);
     setSavingKey(key);
     setSaveError(null);
 
-    const nextSettings: Partial<GuardSettings> =
-      key === "destructive_shell"
-        ? {
-            risk_actions: {
-              ...settings.risk_actions,
-              destructive_shell: value,
-            },
-          }
-        : { [key]: value };
+    const nextSettings = resolveStrictConfigPatch(settings, key, value);
 
     try {
       const payload = await updateSettings(nextSettings);
@@ -260,80 +187,85 @@ export function PolicyStrictConfigTab({
   const controlsDisabled = savingKey !== null;
 
   return (
-    <div className="space-y-4">
-      <div className={`rounded-2xl border p-5 ${isStrict ? "border-brand-green/20 bg-brand-green/[0.04]" : "border-slate-200 bg-slate-50/40"}`}>
-        <div className="mb-2 flex flex-wrap items-center gap-2">
-          <SectionLabel>Strict mode</SectionLabel>
-          <Tag tone={isStrict ? "green" : "slate"}>{isStrict ? "Enabled" : "Disabled"}</Tag>
-        </div>
-        <p className="text-sm text-brand-dark/75">
-          Strict config tunes local fallback enforcement only. Authentication, MFA, and general Guard settings stay in
-          Settings.
-        </p>
-        {!isStrict && onOpenSettings ? (
-          <div className="mt-3">
-            <ActionButton variant="secondary" onClick={onOpenSettings}>
-              Enable strict mode in Settings
-            </ActionButton>
+    <div className="grid gap-4 lg:grid-cols-[minmax(0,1fr)_280px] lg:items-start">
+      <div className="space-y-4">
+        <div
+          className={`rounded-2xl border p-5 ${isStrict ? "border-brand-green/20 bg-brand-green/[0.04]" : "border-slate-200 bg-slate-50/40"}`}
+        >
+          <div className="mb-2 flex flex-wrap items-center gap-2">
+            <SectionLabel>Strict mode</SectionLabel>
+            <Tag tone={isStrict ? "green" : "slate"}>{isStrict ? "Enabled" : "Disabled"}</Tag>
           </div>
-        ) : null}
-      </div>
+          <p className="text-sm text-brand-dark/75">
+            Strict config tunes local fallback enforcement only. Authentication, MFA, and general Guard settings stay in
+            Settings.
+          </p>
+          {!isStrict && onOpenSettings ? (
+            <div className="mt-3">
+              <ActionButton variant="secondary" onClick={onOpenSettings}>
+                Enable strict mode in Settings
+              </ActionButton>
+            </div>
+          ) : null}
+        </div>
 
-      <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
-        <SectionLabel>Local policy state</SectionLabel>
-        <dl className="mt-3 grid gap-3 text-sm sm:grid-cols-2">
-          <div>
-            <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Local policy hash</dt>
-            <dd className="mt-1 font-mono text-xs text-brand-dark">{localPolicyHash}</dd>
-          </div>
-          <div>
-            <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Config file</dt>
-            <dd className="mt-1 break-all text-brand-dark">{configPath ?? "Unavailable"}</dd>
-          </div>
-          <div>
-            <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Daemon last reload</dt>
-            <dd className="mt-1 text-brand-dark">
-              {snapshot.runtime_state?.started_at
-                ? formatRelativeTime(snapshot.runtime_state.started_at)
-                : "Unavailable"}
-            </dd>
-          </div>
-          <div>
-            <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Daemon heartbeat</dt>
-            <dd className="mt-1 text-brand-dark">
-              {snapshot.runtime_state?.last_heartbeat_at
-                ? formatRelativeTime(snapshot.runtime_state.last_heartbeat_at)
-                : "Unavailable"}
-            </dd>
-          </div>
-        </dl>
-        {cloudBundleCopy ? (
-          <div className="mt-4 rounded-xl border border-slate-100 bg-slate-50/80 p-3">
-            <p className="text-xs font-medium uppercase tracking-wide text-slate-500">Signed Cloud bundle ack</p>
-            <p className="mt-1 text-sm font-medium text-brand-dark">{cloudBundleCopy.label}</p>
-            <p className="mt-1 text-sm text-slate-600">{cloudBundleCopy.detail}</p>
-            {snapshot.cloud_policy_bundle_hash ? (
-              <p className="mt-2 break-all font-mono text-[11px] text-slate-500">{snapshot.cloud_policy_bundle_hash}</p>
-            ) : null}
-            <p className="mt-2 text-xs text-slate-500">
-              Cloud exceptions apply through signed bundle acknowledgement on this device.
+        <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+          <SectionLabel>Local policy state</SectionLabel>
+          <dl className="mt-3 grid gap-3 text-sm sm:grid-cols-2">
+            <div>
+              <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Local policy hash</dt>
+              <dd className="mt-1 font-mono text-xs text-brand-dark">{localPolicyHash}</dd>
+            </div>
+            <div>
+              <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Config file</dt>
+              <dd className="mt-1 break-all text-brand-dark">{configPath ?? "Unavailable"}</dd>
+            </div>
+            <div>
+              <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Daemon last reload</dt>
+              <dd className="mt-1 text-brand-dark">
+                {snapshot.runtime_state?.started_at
+                  ? formatRelativeTime(snapshot.runtime_state.started_at)
+                  : "Unavailable"}
+              </dd>
+            </div>
+            <div>
+              <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Daemon heartbeat</dt>
+              <dd className="mt-1 text-brand-dark">
+                {snapshot.runtime_state?.last_heartbeat_at
+                  ? formatRelativeTime(snapshot.runtime_state.last_heartbeat_at)
+                  : "Unavailable"}
+              </dd>
+            </div>
+          </dl>
+          {cloudBundleCopy ? (
+            <div className="mt-4 rounded-xl border border-slate-100 bg-slate-50/80 p-3">
+              <p className="text-xs font-medium uppercase tracking-wide text-slate-500">Signed Cloud bundle ack</p>
+              <p className="mt-1 text-sm font-medium text-brand-dark">{cloudBundleCopy.label}</p>
+              <p className="mt-1 text-sm text-slate-600">{cloudBundleCopy.detail}</p>
+              {snapshot.cloud_policy_bundle_hash ? (
+                <p className="mt-2 break-all font-mono text-[11px] text-slate-500">
+                  {snapshot.cloud_policy_bundle_hash}
+                </p>
+              ) : null}
+              <p className="mt-2 text-xs text-slate-500">
+                Cloud exceptions apply through signed bundle acknowledgement on this device.
+              </p>
+            </div>
+          ) : (
+            <p className="mt-4 text-sm text-slate-600">
+              No signed Cloud policy bundle is synced yet. Cloud exceptions still require bundle acknowledgement before
+              they apply locally.
             </p>
-          </div>
-        ) : (
-          <p className="mt-4 text-sm text-slate-600">
-            No signed Cloud policy bundle is synced yet. Cloud exceptions still require bundle acknowledgement before
-            they apply locally.
-          </p>
-        )}
-      </div>
+          )}
+        </div>
 
-      <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
-        <SectionLabel>Local fallback controls</SectionLabel>
+        <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+          <SectionLabel>Local fallback controls</SectionLabel>
         <p className="mt-2 text-sm text-slate-600">
           These controls apply when no remembered rule, Cloud policy, or Cloud exception matches.
         </p>
-        <div className="mt-4 grid gap-4 md:grid-cols-2">
-          <StrictConfigSelect
+        <div className="mt-4 grid gap-5 md:grid-cols-2">
+          <StrictConfigActionSegmented
             label="Default action"
             help="First-time actions with no prior decision."
             value={settings.default_action}
@@ -341,28 +273,28 @@ export function PolicyStrictConfigTab({
             onSettingChange={handleStrictConfigChange}
             disabled={controlsDisabled}
           />
-          <StrictConfigSelect
+          <StrictConfigActionSegmented
             label="Changed tool hash action"
             value={settings.changed_hash_action}
             settingKey="changed_hash_action"
             onSettingChange={handleStrictConfigChange}
             disabled={controlsDisabled}
           />
-          <StrictConfigSelect
+          <StrictConfigActionSegmented
             label="New network domain action"
             value={settings.new_network_domain_action}
             settingKey="new_network_domain_action"
             onSettingChange={handleStrictConfigChange}
             disabled={controlsDisabled}
           />
-          <StrictConfigSelect
+          <StrictConfigActionSegmented
             label="Subprocess action"
             value={settings.subprocess_action}
             settingKey="subprocess_action"
             onSettingChange={handleStrictConfigChange}
             disabled={controlsDisabled}
           />
-          <StrictConfigSelect
+          <StrictConfigActionSegmented
             label="Destructive file write action"
             help="Backed by the destructive shell risk control."
             value={fileWriteAction}
@@ -390,45 +322,48 @@ export function PolicyStrictConfigTab({
           </div>
         ) : null}
       </div>
-
-      <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
-        <SectionLabel>Evaluation order</SectionLabel>
-        <ol className="mt-3 space-y-2 text-sm text-brand-dark/80">
-          {STRICT_POLICY_EVALUATION_ORDER.map((step, index) => (
-            <li key={step} className="flex gap-2">
-              <span className="font-semibold text-brand-blue">{index + 1}.</span>
-              <span>{step}</span>
-            </li>
-          ))}
-        </ol>
       </div>
 
-      <div className="rounded-2xl border border-brand-blue/10 bg-brand-blue/[0.03] p-5 shadow-sm">
-        <SectionLabel>Policy simulator</SectionLabel>
-        <p className="mt-2 text-sm text-slate-600">
-          Preview which layer wins for a hypothetical action without changing live policy.
-        </p>
-        <div className="mt-4 grid gap-3 md:grid-cols-3">
-          <SimLayerSelect label="Remembered rule" value={simRemembered} onChange={handleSimRememberedChange} />
-          <SimLayerSelect label="Cloud policy" value={simCloudPolicy} onChange={handleSimCloudPolicyChange} />
-          <label className="flex items-center gap-2 rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark">
-            <input type="checkbox" checked={simCloudException} onChange={handleSimCloudExceptionChange} />
-            Active Cloud exception
-          </label>
+      <aside className="space-y-4 lg:sticky lg:top-4">
+        <div className="rounded-2xl border border-slate-200 bg-white p-4 shadow-sm">
+          <SectionLabel>Evaluation order</SectionLabel>
+          <ol className="mt-3 space-y-2 text-sm text-brand-dark/80">
+            {STRICT_POLICY_EVALUATION_ORDER.map((step, index) => (
+              <li key={step} className="flex gap-2">
+                <span className="font-semibold text-brand-blue">{index + 1}.</span>
+                <span>{step}</span>
+              </li>
+            ))}
+          </ol>
         </div>
-        {simulation ? (
-          <div className="mt-4 rounded-xl border border-slate-100 bg-white p-4">
-            <p className="text-sm font-medium text-brand-dark">
-              Outcome: {policyActionLabel(simulation.outcome)} ({simulation.winningStep})
-            </p>
-            <ul className="mt-2 space-y-1 text-xs text-slate-600">
-              {simulation.path.map((step) => (
-                <li key={step}>{step}</li>
-              ))}
-            </ul>
+
+        <div className="rounded-2xl border border-brand-blue/10 bg-brand-blue/[0.03] p-4 shadow-sm">
+          <SectionLabel>Policy simulator</SectionLabel>
+          <p className="mt-2 text-sm text-slate-600">
+            Preview which layer wins for a hypothetical action without changing live policy.
+          </p>
+          <div className="mt-4 space-y-3">
+            <SimLayerSelect label="Remembered rule" value={simRemembered} onChange={handleSimRememberedChange} />
+            <SimLayerSelect label="Cloud policy" value={simCloudPolicy} onChange={handleSimCloudPolicyChange} />
+            <label className="flex items-center gap-2 rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark">
+              <input type="checkbox" checked={simCloudException} onChange={handleSimCloudExceptionChange} />
+              Active Cloud exception
+            </label>
           </div>
-        ) : null}
-      </div>
+          {simulation ? (
+            <div className="mt-4 rounded-xl border border-slate-100 bg-white p-4">
+              <p className="text-sm font-medium text-brand-dark">
+                Outcome: {policyActionLabel(simulation.outcome)} ({simulation.winningStep})
+              </p>
+              <ul className="mt-2 space-y-1 text-xs text-slate-600">
+                {simulation.path.map((step) => (
+                  <li key={step}>{step}</li>
+                ))}
+              </ul>
+            </div>
+          ) : null}
+        </div>
+      </aside>
     </div>
   );
 }