plugin-scanner 2.0.723__tar.gz → 2.0.724__tar.gz

{plugin_scanner-2.0.723 → plugin_scanner-2.0.724}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.723
+Version: 2.0.724
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.723 → plugin_scanner-2.0.724}/dashboard/src/audit-run-progress.tsx

@@ -1,7 +1,7 @@
 import { HiMiniArrowPath, HiMiniCheckCircle } from "react-icons/hi2";
 import type { AuditRunPhase } from "./use-supply-chain-audit-session";
 
-type AuditRunProgressProps = {
+type AuditProgressProps = {
   phase: AuditRunPhase;
   running: boolean;
 };
@@ -11,8 +11,8 @@ type StepState = "pending" | "active" | "done";
 const STEPS: Array<{ id: AuditRunPhase; label: string }> = [
   { id: "preparing", label: "Prepare workspace" },
   { id: "scanning", label: "Scan manifests and lockfiles" },
-  { id: "evaluating", label: "Evaluate packages" },
-  { id: "finalizing", label: "Build findings" },
+  { id: "evaluating", label: "Evaluate packages against Guard intel" },
+  { id: "finalizing", label: "Prepare results" },
 ];
 
 function stepState(stepId: AuditRunPhase, phase: AuditRunPhase, running: boolean): StepState {
@@ -54,18 +54,38 @@ function stepBubbleClass(state: StepState): string {
   return "border border-slate-200 bg-white text-slate-400";
 }
 
-export function AuditRunProgress({ phase, running }: AuditRunProgressProps) {
-  if (!running && phase === "idle") {
+export function AuditProgressStepList({ phase, running }: AuditProgressProps) {
+  return (
+    <ol className="space-y-2" aria-live="polite" aria-busy={running} data-testid="audit-run-progress">
+      {STEPS.map((step, index) => {
+        const state = stepState(step.id, phase, running);
+        return (
+          <li key={step.id} className={`flex items-center gap-2 text-sm ${stepTextClass(state)}`}>
+            <span
+              className={`inline-flex h-5 w-5 shrink-0 items-center justify-center rounded-full text-[10px] font-semibold ${stepBubbleClass(state)}`}
+              aria-hidden="true"
+            >
+              {state === "done" ? "✓" : index + 1}
+            </span>
+            {step.label}
+          </li>
+        );
+      })}
+    </ol>
+  );
+}
+
+export function auditProgressActive(phase: AuditRunPhase, running: boolean): boolean {
+  return running || phase !== "idle";
+}
+
+export function AuditRunProgress({ phase, running }: AuditProgressProps) {
+  if (!auditProgressActive(phase, running)) {
     return null;
   }
 
   return (
-    <section
-      className="rounded-2xl border border-brand-blue/15 bg-brand-blue/[0.03] px-4 py-4"
-      aria-live="polite"
-      aria-busy={running}
-      data-testid="audit-run-progress"
-    >
+    <section className="rounded-2xl border border-brand-blue/15 bg-brand-blue/[0.03] px-4 py-4">
       <div className="flex items-center gap-2">
         {running ? (
           <HiMiniArrowPath className="h-4 w-4 shrink-0 animate-spin text-brand-blue" aria-hidden="true" />
@@ -76,25 +96,9 @@ export function AuditRunProgress({ phase, running }: AuditRunProgressProps) {
           {running ? "Workspace audit in progress" : "Workspace audit complete"}
         </p>
       </div>
-      <ol className="mt-4 space-y-2">
-        {STEPS.map((step, index) => {
-          const state = stepState(step.id, phase, running);
-          return (
-            <li
-              key={step.id}
-              className={`flex items-center gap-2 text-sm ${stepTextClass(state)}`}
-            >
-              <span
-                className={`inline-flex h-5 w-5 shrink-0 items-center justify-center rounded-full text-[10px] font-semibold ${stepBubbleClass(state)}`}
-                aria-hidden="true"
-              >
-                {state === "done" ? "✓" : index + 1}
-              </span>
-              {step.label}
-            </li>
-          );
-        })}
-      </ol>
+      <div className="mt-4">
+        <AuditProgressStepList phase={phase} running={running} />
+      </div>
     </section>
   );
 }

{plugin_scanner-2.0.723 → plugin_scanner-2.0.724}/dashboard/src/audit-workspace.tsx

@@ -25,7 +25,6 @@ import type { GuardApprovalGatePublicConfig, GuardReceipt, GuardRuntimeSnapshot
 import { useResolvedApprovalGate } from "./use-resolved-approval-gate";
 import { resolveManagerCoverageStatus } from "./supply-chain-protection-stats";
 import { PackageWorkbenchPanel } from "./package-workbench-panel";
-import { AuditRunProgress } from "./audit-run-progress";
 import type { SupplyChainAuditSession } from "./use-supply-chain-audit-session";
 
 export type AuditSeverity = "critical" | "high" | "medium" | "low" | "info";
@@ -559,13 +558,13 @@ export function AuditWorkspace({ snapshot, receipts, approvalGate, auditSession
 
   return (
     <div className="space-y-6">
-      <AuditRunProgress phase={auditSession.auditPhase} running={auditSession.auditRunning} />
-
       <PackageWorkbenchPanel
         auditConnectGate={auditSession.auditConnectGate}
         auditError={auditSession.auditError}
         auditSnapshot={auditSession.auditSnapshot}
         auditRunning={auditSession.auditRunning}
+        auditPhase={auditSession.auditPhase}
+        cloudState={snapshot.cloud_state}
         onRunAudit={auditSession.handleRunAudit}
       />
 

{plugin_scanner-2.0.723 → plugin_scanner-2.0.724}/dashboard/src/guard-types.ts

@@ -803,6 +803,7 @@ export type SupplyChainAuditSnapshot = {
   source: string | null;
   decision: SupplyChainAuditDecision;
   inventory: SupplyChainAuditInventory;
+  packages: SupplyChainAuditFinding[];
   findings: SupplyChainAuditFinding[];
   manifestPaths: string[];
   lockfilePaths: string[];

{plugin_scanner-2.0.723 → plugin_scanner-2.0.724}/dashboard/src/package-workbench-panel.tsx

@@ -3,6 +3,7 @@ import type { ChangeEvent, ReactNode } from "react";
 import {
   HiMiniArrowDown,
   HiMiniArrowUp,
+  HiMiniArrowPath,
   HiMiniBugAnt,
   HiMiniChevronLeft,
   HiMiniChevronRight,
@@ -13,6 +14,8 @@ import {
 import { SectionLabel, Tag, ActionButton, EmptyState, IconActionButton } from "./approval-center-primitives";
 import { formatRelativeTime } from "./approval-center-utils";
 import { GuardModalLayer } from "./guard-modal-layer";
+import { AuditProgressStepList, auditProgressActive } from "./audit-run-progress";
+import type { AuditRunPhase } from "./use-supply-chain-audit-session";
 import type {
   PackageWorkbenchFilters,
   PackageWorkbenchSortKey,
@@ -31,12 +34,16 @@ import type { AuditConnectGateViewState } from "./supply-chain-firewall-panel";
 
 const WORKBENCH_PAGE_SIZE = 25;
 
+type PackageViewMode = "all" | "review";
+
 type PackageWorkbenchPanelProps = {
   auditConnectGate?: AuditConnectGateViewState | null;
   auditError?: string | null;
   auditSnapshot: SupplyChainAuditSnapshot | null;
   onRunAudit?: () => void;
   auditRunning?: boolean;
+  auditPhase?: AuditRunPhase;
+  cloudState?: string | null;
 };
 
 const decisionTone = (
@@ -91,9 +98,36 @@ function humanizeReasonMessage(code: string, message: string): string {
 type WorkbenchHeaderProps = {
   auditSnapshot: SupplyChainAuditSnapshot;
   flaggedCount: number;
+  packageCount: number;
+  cloudState?: string | null;
 };
 
-function WorkbenchHeader({ auditSnapshot, flaggedCount }: WorkbenchHeaderProps) {
+function cloudIntelLabel(cloudState: string | null | undefined, source: string | null): string {
+  if (cloudState === "local_only") {
+    return "Local intel only";
+  }
+  if (source !== null && source.length > 0) {
+    return `${source} intel`;
+  }
+  return "Guard Cloud";
+}
+
+function cloudIntelTone(cloudState: string | null | undefined): "attention" | "green" | "info" {
+  if (cloudState === "local_only") {
+    return "attention";
+  }
+  if (cloudState === "paired_active") {
+    return "green";
+  }
+  return "info";
+}
+
+function WorkbenchHeader({
+  auditSnapshot,
+  flaggedCount,
+  packageCount,
+  cloudState,
+}: WorkbenchHeaderProps) {
   const manifestSummary =
     auditSnapshot.manifestPaths.length > 0
       ? `${auditSnapshot.manifestPaths.length} manifest${auditSnapshot.manifestPaths.length === 1 ? "" : "s"}`
@@ -108,22 +142,21 @@ function WorkbenchHeader({ auditSnapshot, flaggedCount }: WorkbenchHeaderProps)
     <div className="space-y-1">
       <div className="flex flex-wrap items-center gap-2 text-xs text-slate-500">
         <Tag tone={decisionTone(auditSnapshot.decision)}>{auditSnapshot.decision}</Tag>
+        <Tag tone={cloudIntelTone(cloudState)}>{cloudIntelLabel(cloudState, auditSnapshot.source)}</Tag>
         <span>
           {auditSnapshot.inventory.totalPackages} package
           {auditSnapshot.inventory.totalPackages === 1 ? "" : "s"} indexed
         </span>
         <span aria-hidden="true">·</span>
+        <span>
+          {packageCount} in table
+        </span>
+        <span aria-hidden="true">·</span>
         <span>
           {flaggedCount} need review
         </span>
         <span aria-hidden="true">·</span>
         <span>Last audit {formatRelativeTime(auditSnapshot.generatedAt)}</span>
-        {auditSnapshot.source !== null && (
-          <>
-            <span aria-hidden="true">·</span>
-            <span className="capitalize">{auditSnapshot.source} intel</span>
-          </>
-        )}
       </div>
       {scanSummary.length > 0 ? (
         <p className="text-[11px] text-slate-400">Scanned {scanSummary} across this workspace.</p>
@@ -438,9 +471,6 @@ function EcosystemChip({ ecosystem, active, onSelect }: EcosystemChipProps) {
 
 type WorkbenchEmptyStateProps = {
   auditConnectGate?: AuditConnectGateViewState | null;
-  auditError?: string | null;
-  onRunAudit?: () => void;
-  auditRunning?: boolean;
 };
 
 function WorkbenchAuditErrorBanner({ message }: { message: string }) {
@@ -460,7 +490,7 @@ function WorkbenchAuditErrorBanner({ message }: { message: string }) {
   );
 }
 
-function WorkbenchEmptyState({ auditConnectGate, auditError, onRunAudit, auditRunning }: WorkbenchEmptyStateProps) {
+function WorkbenchEmptyState({ auditConnectGate }: WorkbenchEmptyStateProps) {
   if (auditConnectGate !== null && auditConnectGate !== undefined) {
     return (
       <ConnectFlowCard
@@ -478,32 +508,34 @@ function WorkbenchEmptyState({ auditConnectGate, auditError, onRunAudit, auditRu
   }
 
   return (
-    <>
-      {auditError ? <WorkbenchAuditErrorBanner message={auditError} /> : null}
-      <EmptyState
-        title="No workspace audit yet"
-        body="Run a package audit to index dependencies and surface flagged packages here."
-        tone="teach"
-        action={
-          onRunAudit !== undefined ? (
-            <ActionButton variant="outline" onClick={onRunAudit} disabled={auditRunning} aria-busy={auditRunning}>
-              <HiMiniBugAnt className="mr-1.5 h-4 w-4" aria-hidden="true" />
-              Run audit
-            </ActionButton>
-          ) : undefined
-        }
-      />
-    </>
+    <EmptyState
+      title="No workspace audit yet"
+      body="Run a workspace audit to index dependencies across npm, pnpm, PyPI, and other ecosystems found in this project."
+      tone="teach"
+    />
   );
 }
 
+function ecosystemSummary(packages: SupplyChainAuditFinding[]): Array<{ ecosystem: string; count: number }> {
+  const counts = new Map<string, number>();
+  for (const pkg of packages) {
+    counts.set(pkg.ecosystem, (counts.get(pkg.ecosystem) ?? 0) + 1);
+  }
+  return [...counts.entries()]
+    .map(([ecosystem, count]) => ({ ecosystem, count }))
+    .sort((left, right) => right.count - left.count || left.ecosystem.localeCompare(right.ecosystem));
+}
+
 export function PackageWorkbenchPanel({
   auditConnectGate = null,
   auditError = null,
   auditSnapshot,
   onRunAudit,
   auditRunning = false,
+  auditPhase = "idle",
+  cloudState = null,
 }: PackageWorkbenchPanelProps) {
+  const [viewMode, setViewMode] = useState<PackageViewMode>("all");
   const [filters, setFilters] = useState<PackageWorkbenchFilters>({
     ecosystem: "all",
     decision: "all",
@@ -519,10 +551,15 @@ export function PackageWorkbenchPanel({
   const [page, setPage] = useState(0);
 
   const findings = auditSnapshot?.findings ?? [];
-  const ecosystems = useMemo(() => packageWorkbenchEcosystems(findings), [findings]);
+  const packages = auditSnapshot?.packages ?? [];
+  const tableSource = viewMode === "review" ? findings : packages;
+  const progressActive = auditProgressActive(auditPhase, auditRunning);
+  const showResults = auditSnapshot !== null && !progressActive && (auditConnectGate === null || auditConnectGate === undefined);
+  const ecosystems = useMemo(() => packageWorkbenchEcosystems(tableSource), [tableSource]);
+  const ecosystemBreakdown = useMemo(() => ecosystemSummary(packages), [packages]);
   const filteredFindings = useMemo(
-    () => filterPackageWorkbenchFindings(findings, filters),
-    [findings, filters],
+    () => filterPackageWorkbenchFindings(tableSource, filters),
+    [tableSource, filters],
   );
   const sortedFindings = useMemo(() => {
     const sorted = sortPackageWorkbenchFindings(filteredFindings, sortKey);
@@ -592,91 +629,175 @@ export function PackageWorkbenchPanel({
     setSelectedId("");
   }, []);
 
+  const handleViewAll = useCallback(() => {
+    setViewMode("all");
+    setPage(0);
+    setSelectedId("");
+  }, []);
+
+  const handleViewReview = useCallback(() => {
+    setViewMode("review");
+    setPage(0);
+    setSelectedId("");
+  }, []);
+
+  const handleRunAudit = useCallback(() => {
+    onRunAudit?.();
+  }, [onRunAudit]);
+
+  const headerTitle = progressActive ? "Auditing workspace" : "Workspace audit";
+  const headerBody = progressActive
+    ? "Guard is scanning manifests, lockfiles, and package intel for this workspace."
+    : "Browse indexed packages, filter by ecosystem, and open any row for advisory detail.";
+
   return (
-    <div className="rounded-2xl border border-slate-100 bg-white shadow-sm">
+    <div className="rounded-2xl border border-slate-100 bg-white shadow-sm" data-testid="workspace-audit-panel">
       <div className="border-b border-slate-100 px-4 py-3">
-        <SectionLabel>Audit findings</SectionLabel>
-        <p className="mt-0.5 text-sm text-slate-500">
-          Packages that need review from the latest workspace audit. Filter, sort, and open a finding for detail.
-        </p>
-        {auditSnapshot !== null && (
+        <div className="flex flex-wrap items-start justify-between gap-3">
+          <div className="min-w-0">
+            <SectionLabel>{headerTitle}</SectionLabel>
+            <p className="mt-0.5 text-sm text-slate-500">{headerBody}</p>
+          </div>
+          {onRunAudit !== undefined ? (
+            <ActionButton
+              variant="outline"
+              onClick={handleRunAudit}
+              disabled={auditRunning}
+              aria-busy={auditRunning}
+            >
+              {auditRunning ? (
+                <HiMiniArrowPath className="mr-1.5 h-4 w-4 animate-spin" aria-hidden="true" />
+              ) : (
+                <HiMiniBugAnt className="mr-1.5 h-4 w-4" aria-hidden="true" />
+              )}
+              {auditSnapshot === null ? "Run audit" : "Run audit again"}
+            </ActionButton>
+          ) : null}
+        </div>
+        {auditSnapshot !== null && showResults ? (
           <div className="mt-2">
-            <WorkbenchHeader auditSnapshot={auditSnapshot} flaggedCount={findings.length} />
+            <WorkbenchHeader
+              auditSnapshot={auditSnapshot}
+              flaggedCount={findings.length}
+              packageCount={packages.length}
+              cloudState={cloudState}
+            />
           </div>
-        )}
+        ) : null}
       </div>
 
-      {auditSnapshot === null && (
-        <div className="px-4 py-6">
-          <WorkbenchEmptyState
-            auditConnectGate={auditConnectGate}
-            auditError={auditError}
-            onRunAudit={onRunAudit}
-            auditRunning={auditRunning}
-          />
-        </div>
-      )}
-      {auditSnapshot !== null && findings.length === 0 && (
-        <div className="px-4 py-6">
+      <div className="px-4 py-4 space-y-4">
+        {auditConnectGate !== null && auditConnectGate !== undefined ? (
+          <WorkbenchEmptyState auditConnectGate={auditConnectGate} />
+        ) : (
+          <>
+            {auditError ? <WorkbenchAuditErrorBanner message={auditError} /> : null}
+
+            {progressActive ? (
+              <div className="rounded-xl border border-brand-blue/15 bg-brand-blue/[0.03] px-4 py-4">
+                <AuditProgressStepList phase={auditPhase} running={auditRunning} />
+              </div>
+            ) : null}
+
+            {auditSnapshot === null && !progressActive ? (
+              <WorkbenchEmptyState auditConnectGate={null} />
+            ) : null}
+
+        {showResults && auditSnapshot !== null && packages.length === 0 && auditSnapshot.inventory.totalPackages > 0 ? (
           <EmptyState
-            title="No flagged packages"
-            body="The latest workspace audit completed without packages that need review."
+            title="Package list not loaded"
+            body="This audit indexed packages, but the detailed list was not stored yet. Run audit again to load the full inventory table."
             tone="teach"
           />
-        </div>
-      )}
-      {auditSnapshot !== null && findings.length > 0 && (
-        <div className="space-y-4 px-4 py-4">
-          <WorkbenchControls
-            filters={filters}
-            ecosystems={ecosystems}
-            sortKey={sortKey}
-            sortDirection={sortDirection}
-            onSearchChange={handleSearchChange}
-            onEcosystemChange={handleEcosystemChange}
-            onDecisionChange={handleDecisionChange}
-            onSeverityChange={handleSeverityChange}
-            onSortChange={handleSortChange}
-          />
-          <WorkbenchPagination
-            page={safePage}
-            pageCount={pageCount}
-            total={sortedFindings.length}
-            onPageChange={handlePageChange}
+        ) : null}
+
+        {showResults && auditSnapshot !== null && packages.length === 0 && auditSnapshot.inventory.totalPackages === 0 ? (
+          <EmptyState
+            title="No packages indexed"
+            body="The latest workspace audit completed, but no supported package manifests or lockfiles were found."
+            tone="teach"
           />
-          {sortedFindings.length === 0 ? (
-            <p className="py-6 text-center text-sm text-slate-500">No packages match the current filters.</p>
-          ) : (
-            <div
-              className="overflow-hidden rounded-xl border border-slate-100"
-              role="table"
-              aria-label="Package audit findings"
-            >
+        ) : null}
+
+        {showResults && packages.length > 0 ? (
+          <>
+            <div className="flex flex-wrap gap-2">
+              {ecosystemBreakdown.map((entry) => (
+                <Tag key={entry.ecosystem} tone="default">
+                  {entry.ecosystem} · {entry.count}
+                </Tag>
+              ))}
+            </div>
+            <div className="flex flex-wrap gap-2">
+              <FilterChip label={`All packages (${packages.length})`} active={viewMode === "all"} onSelect={handleViewAll} />
+              <FilterChip
+                label={`Needs review (${findings.length})`}
+                active={viewMode === "review"}
+                onSelect={handleViewReview}
+              />
+            </div>
+            {cloudState === "local_only" ? (
+              <p className="text-xs leading-relaxed text-slate-500">
+                This device is using local intel only. Connect Guard Cloud and sync supply-chain intel for live CVE and malware coverage.
+              </p>
+            ) : null}
+            <WorkbenchControls
+              filters={filters}
+              ecosystems={ecosystems}
+              sortKey={sortKey}
+              sortDirection={sortDirection}
+              onSearchChange={handleSearchChange}
+              onEcosystemChange={handleEcosystemChange}
+              onDecisionChange={handleDecisionChange}
+              onSeverityChange={handleSeverityChange}
+              onSortChange={handleSortChange}
+            />
+            <WorkbenchPagination
+              page={safePage}
+              pageCount={pageCount}
+              total={sortedFindings.length}
+              onPageChange={handlePageChange}
+            />
+            {sortedFindings.length === 0 ? (
+              <p className="py-6 text-center text-sm text-slate-500">
+                {viewMode === "review" && findings.length === 0
+                  ? "No packages need review in this audit."
+                  : "No packages match the current filters."}
+              </p>
+            ) : (
               <div
-                className="sticky top-0 z-[1] hidden border-b border-slate-100 bg-slate-50 px-4 py-2 sm:grid sm:grid-cols-[minmax(0,1fr)_auto] sm:gap-3"
-                role="row"
+                className="overflow-hidden rounded-xl border border-slate-100"
+                role="table"
+                aria-label={viewMode === "review" ? "Packages needing review" : "Indexed packages"}
               >
-                <span className="text-[10px] font-semibold uppercase tracking-[0.18em] text-slate-400" role="columnheader">
-                  Package
-                </span>
-                <span className="text-[10px] font-semibold uppercase tracking-[0.18em] text-slate-400" role="columnheader">
-                  Decision · Severity
-                </span>
-              </div>
-              <div className="max-h-[min(60vh,32rem)] overflow-y-auto overscroll-y-contain" role="rowgroup">
-                {pagedFindings.map((finding) => (
-                  <FindingRow
-                    key={finding.id}
-                    finding={finding}
-                    selected={selectedId === finding.id}
-                    onSelect={handleSelectFinding}
-                  />
-                ))}
+                <div
+                  className="sticky top-0 z-[1] hidden border-b border-slate-100 bg-slate-50 px-4 py-2 sm:grid sm:grid-cols-[minmax(0,1fr)_auto] sm:gap-3"
+                  role="row"
+                >
+                  <span className="text-[10px] font-semibold uppercase tracking-[0.18em] text-slate-400" role="columnheader">
+                    Package
+                  </span>
+                  <span className="text-[10px] font-semibold uppercase tracking-[0.18em] text-slate-400" role="columnheader">
+                    Decision · Severity
+                  </span>
+                </div>
+                <div className="max-h-[min(60vh,32rem)] overflow-y-auto overscroll-y-contain" role="rowgroup">
+                  {pagedFindings.map((finding) => (
+                    <FindingRow
+                      key={finding.id}
+                      finding={finding}
+                      selected={selectedId === finding.id}
+                      onSelect={handleSelectFinding}
+                    />
+                  ))}
+                </div>
               </div>
-            </div>
-          )}
-        </div>
-      )}
+            )}
+          </>
+        ) : null}
+          </>
+        )}
+      </div>
       {selectedFinding !== null ? (
         <GuardModalLayer
           ariaLabel={`Finding detail for ${selectedFinding.packageName}`}

{plugin_scanner-2.0.723 → plugin_scanner-2.0.724}/dashboard/src/scsr-phase10-package-workbench.test.ts

@@ -58,7 +58,8 @@ const auditPayload = {
 
 const snapshot = normalizeSupplyChainAuditSnapshot(auditPayload, "receipt-audit-1");
 assert(snapshot !== null, "SCSR166: audit payload normalizes into workbench snapshot");
-assert(snapshot!.findings.length === 3, "SCSR167: all evaluated packages surface as findings");
+assert(snapshot!.packages.length === 3, "SCSR167: all evaluated packages surface in inventory");
+assert(snapshot!.findings.length === 2, "SCSR167-B: actionable findings exclude clean monitor packages");
 assert(snapshot!.inventory.totalPackages === 3, "SCSR168: inventory totals normalize");
 
 const sorted = sortPackageWorkbenchFindings(snapshot!.findings, "severity");
@@ -186,7 +187,8 @@ const receipt: GuardReceipt = {
 
 const derived = derivePackageWorkbenchFromReceipts([receipt]);
 assert(derived !== null, "SCSR174: latest audit receipt hydrates workbench snapshot");
-assert(derived!.findings.length === 3, "SCSR175: receipt package_findings hydrate findings table");
+assert(derived!.packages.length === 3, "SCSR175: receipt package_findings hydrate full inventory");
+assert(derived!.findings.length === 2, "SCSR175-B: receipt findings stay actionable-only");
 
 assert(
   normalizeSupplyChainAuditSnapshot({ generated_at: "2026-06-09T12:00:00.000Z" }) === null,