plugin-scanner 2.0.724__tar.gz → 2.0.726__tar.gz

{plugin_scanner-2.0.724 → plugin_scanner-2.0.726}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.724
+Version: 2.0.726
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.724 → plugin_scanner-2.0.726}/dashboard/src/app.tsx

@@ -726,6 +726,7 @@ export function App() {
             onOpenSettings={handleOpenSettings}
             onOpenInbox={handleOpenInbox}
             onRefreshPolicies={handleRefreshPolicies}
+            onNavigate={navigate}
           />
         </Suspense>
       );
@@ -745,6 +746,7 @@ export function App() {
     handleOpenSettings,
     handleOpenInbox,
     handleRefreshPolicies,
+    navigate,
   ]);
 
   return (

{plugin_scanner-2.0.724 → plugin_scanner-2.0.726}/dashboard/src/evidence/evidence-table.tsx

@@ -3,13 +3,14 @@ import type { ReactNode } from "react";
 interface EvidenceTableProps {
   children: ReactNode;
   label: string;
+  tableClassName?: string;
 }
 
-export function EvidenceTable({ children, label }: EvidenceTableProps) {
+export function EvidenceTable({ children, label, tableClassName = "" }: EvidenceTableProps) {
   return (
     <div className="rounded-2xl border border-slate-100 bg-white overflow-hidden shadow-sm">
       <div className="overflow-x-auto">
-        <table className="w-full text-sm" aria-label={label}>
+        <table className={`w-full text-sm ${tableClassName}`} aria-label={label}>
           {children}
         </table>
       </div>

{plugin_scanner-2.0.724 → plugin_scanner-2.0.726}/dashboard/src/policy-remembered-local-rules.tsx

@@ -5,12 +5,14 @@ type PolicyRememberedLocalRulesProps = {
   policies: GuardPolicyDecision[];
   cloudControlsUrl: string | null;
   onClearPolicy?: (policy: GuardPolicyDecision) => void;
+  onNavigate?: (pathname: string) => void;
 };
 
 export function PolicyRememberedLocalRules({
   policies,
   cloudControlsUrl,
   onClearPolicy,
+  onNavigate,
 }: PolicyRememberedLocalRulesProps) {
   return (
     <GroupedPolicySection
@@ -20,6 +22,7 @@ export function PolicyRememberedLocalRules({
       policies={policies}
       cloudControlsUrl={cloudControlsUrl}
       onClearPolicy={onClearPolicy}
+      onNavigate={onNavigate}
       emptyTitle="No local remembered rules yet"
       emptyBody="Approve or block in Inbox and Guard remembers the decision here in plain language."
       defaultOpen

{plugin_scanner-2.0.724 → plugin_scanner-2.0.726}/dashboard/src/policy-remembered-rules-tab.tsx

@@ -23,6 +23,7 @@ type PolicyRememberedRulesTabProps = {
   cloudControlsUrl: string | null;
   onClearPolicy?: (policy: GuardPolicyDecision) => void;
   onOpenCloudExceptions: () => void;
+  onNavigate?: (pathname: string) => void;
 };
 
 export function PolicyRememberedRulesTab({
@@ -31,6 +32,7 @@ export function PolicyRememberedRulesTab({
   cloudControlsUrl,
   onClearPolicy,
   onOpenCloudExceptions,
+  onNavigate,
 }: PolicyRememberedRulesTabProps) {
   const [searchQuery, setSearchQuery] = useState("");
   const [appFilter, setAppFilter] = useState("");
@@ -173,6 +175,7 @@ export function PolicyRememberedRulesTab({
           policies={localRules}
           cloudControlsUrl={cloudControlsUrl}
           onClearPolicy={onClearPolicy}
+          onNavigate={onNavigate}
         />
         <PolicyRememberedCloudRules policies={cloudRules} cloudControlsUrl={cloudControlsUrl} />
       </div>

{plugin_scanner-2.0.724 → plugin_scanner-2.0.726}/dashboard/src/policy-workspace-helpers.test.ts

@@ -4,8 +4,13 @@ import {
   resolvePolicyDisplay,
   resolvePolicyEvidenceHref,
   resolvePolicyMatcherFamily,
+  resolvePolicyRowFolder,
+  resolvePolicyRowFrequency,
+  resolvePolicyRowSubtitle,
+  resolvePolicyRowTitle,
   resolveWorkspaceLabel,
   formatPolicyScopePath,
+  isScannerGeneratedPolicyLabel,
 } from "./policy-workspace-helpers";
 import { scopeLabel } from "./approval-center-utils";
 
@@ -58,6 +63,8 @@ assert(display.headline.toLowerCase().includes("package install"), "POL-H6: fall
 const evidenceHref = resolvePolicyEvidenceHref(enrichedPackageRule);
 assert(evidenceHref.includes("selected=receipt-abc123"), "POL-H7: evidence link selects source receipt");
 assert(evidenceHref.includes("search=receipt-abc123"), "POL-H8: evidence link searches receipt id");
+assert(evidenceHref.includes("harness=opencode"), "POL-H8b: evidence link scopes harness filter");
+assert(evidenceHref.includes("view=actions"), "POL-H8c: evidence link opens actions view");
 
 const hashOnlyHref = resolvePolicyEvidenceHref(
   basePolicy({
@@ -67,8 +74,25 @@ const hashOnlyHref = resolvePolicyEvidenceHref(
 assert(hashOnlyHref.includes("search=62de981049ed"), "POL-H9: hash fallback strips sha256 prefix");
 
 assert(
-  resolvePolicyApprovalRecordLabel(enrichedPackageRule) === "receipt-abc123.json",
-  "POL-H10: approval record label uses receipt filename",
+  resolvePolicyApprovalRecordLabel(enrichedPackageRule) === "receipt-abc123",
+  "POL-H10: approval record label uses receipt id",
+);
+
+const scannerLabelRule = basePolicy({
+  remembered_command: "Bash credential-looking output",
+  reason: "Bash credential-looking output",
+  artifact_id: "cursor:project:tool-action:abc123",
+});
+assert(isScannerGeneratedPolicyLabel("Bash credential-looking output"), "POL-H18: scanner labels detected");
+assert(
+  resolvePolicyRowTitle(scannerLabelRule, resolvePolicyDisplay(scannerLabelRule)).toLowerCase().includes("shell"),
+  "POL-H19: scanner labels fall back to action family headline",
+);
+assert(resolvePolicyRowFolder(enrichedPackageRule) === "hol-points-portal", "POL-H20: folder resolves workspace label");
+assert(resolvePolicyRowFrequency(enrichedPackageRule) === "This project", "POL-H21: frequency uses policy scope label");
+assert(
+  resolvePolicyRowSubtitle(enrichedPackageRule, enrichedDisplay)?.includes("This project"),
+  "POL-H22: subtitle includes scope frequency",
 );
 
 assert(

{plugin_scanner-2.0.724 → plugin_scanner-2.0.726}/dashboard/src/policy-workspace-helpers.ts

@@ -18,6 +18,23 @@ const GENERIC_REASONS = [
   "local e2e approval proof",
 ];
 
+const SCANNER_GENERATED_LABEL_MARKERS = [
+  "credential-looking",
+  "credential looking",
+  "secret-looking",
+  "suspicious output",
+  "looking output",
+  "scanner flagged",
+];
+
+export function isScannerGeneratedPolicyLabel(value: string | null | undefined): boolean {
+  if (!value?.trim()) {
+    return true;
+  }
+  const lowered = value.trim().toLowerCase();
+  return SCANNER_GENERATED_LABEL_MARKERS.some((marker) => lowered.includes(marker));
+}
+
 export type PolicyDisplay = {
   headline: string;
   kindLine: string | null;
@@ -219,7 +236,7 @@ function resolveWhatPhrase(policy: GuardPolicyDecision): string {
 
 function resolveKindLine(policy: GuardPolicyDecision): string | null {
   const remembered = policy.remembered_context?.trim();
-  if (remembered) {
+  if (remembered && !isScannerGeneratedPolicyLabel(remembered)) {
     return remembered;
   }
   const family = policy.artifact_id ? extractMatcherFamily(policy.artifact_id) : null;
@@ -252,7 +269,7 @@ export function resolvePolicyDisplay(policy: GuardPolicyDecision): PolicyDisplay
   const pathLine = resolvePathLine(policy);
   const projectLabel = resolveProjectLabel(policy);
 
-  if (rememberedCommand) {
+  if (rememberedCommand && !isScannerGeneratedPolicyLabel(rememberedCommand)) {
     return {
       headline: rememberedCommand,
       kindLine,
@@ -265,7 +282,7 @@ export function resolvePolicyDisplay(policy: GuardPolicyDecision): PolicyDisplay
 
   const actionVerb = resolveActionVerb(policy.action);
 
-  if (reason && !isGenericReason(reason)) {
+  if (reason && !isGenericReason(reason) && !isScannerGeneratedPolicyLabel(reason)) {
     return {
       headline: reason,
       kindLine,
@@ -288,20 +305,58 @@ export function resolvePolicyDisplay(policy: GuardPolicyDecision): PolicyDisplay
   };
 }
 
+export function resolvePolicyRowFrequency(policy: GuardPolicyDecision): string {
+  return scopeLabel(policy.scope, "policy");
+}
+
+export function resolvePolicyRowFolder(policy: GuardPolicyDecision): string | null {
+  const pathLine = formatPolicyScopePath(policy.source_scope_path);
+  if (pathLine) {
+    return pathLine;
+  }
+  const label = policy.workspace_label?.trim();
+  if (label) {
+    return label;
+  }
+  const workspace = policy.workspace?.trim();
+  if (!workspace || workspace.startsWith("workspace:")) {
+    return null;
+  }
+  return formatPolicyScopePath(workspace) ?? resolveWorkspaceLabel(workspace);
+}
+
+export function resolvePolicyRowSubtitle(policy: GuardPolicyDecision, display: PolicyDisplay): string | null {
+  const parts: string[] = [];
+  const folder = resolvePolicyRowFolder(policy);
+  if (folder) {
+    parts.push(folder);
+  }
+  parts.push(resolvePolicyRowFrequency(policy));
+  if (display.kindLine && !parts.includes(display.kindLine)) {
+    parts.unshift(display.kindLine);
+  }
+  return parts.length > 0 ? parts.join(" · ") : null;
+}
+
 export function resolvePolicyRowTitle(policy: GuardPolicyDecision, display: PolicyDisplay): string {
   const rememberedCommand = policy.remembered_command?.trim();
-  if (rememberedCommand) {
+  if (rememberedCommand && !isScannerGeneratedPolicyLabel(rememberedCommand)) {
     return rememberedCommand;
   }
 
+  const reason = policy.reason?.trim();
+  if (reason && !isGenericReason(reason) && !isScannerGeneratedPolicyLabel(reason)) {
+    return reason;
+  }
+
   const artifactId = policy.artifact_id?.trim();
-  if (artifactId && !artifactId.startsWith("family:")) {
+  if (artifactId && !artifactId.startsWith("family:") && !artifactId.includes(":")) {
     const slashIndex = artifactId.lastIndexOf("/");
     const candidate =
       slashIndex >= 0 && slashIndex < artifactId.length - 1
         ? artifactId.slice(slashIndex + 1)
         : artifactId;
-    if (candidate.length <= 64) {
+    if (candidate.length <= 64 && !isScannerGeneratedPolicyLabel(candidate)) {
       return candidate;
     }
   }
@@ -347,6 +402,10 @@ export function resolvePolicyEvidenceSearchTerm(policy: GuardPolicyDecision): st
 
 export function resolvePolicyEvidenceHref(policy: GuardPolicyDecision): string {
   const params = new URLSearchParams();
+  params.set("view", "actions");
+  if (policy.harness?.trim()) {
+    params.set("harness", policy.harness.trim());
+  }
   const receiptId = policy.source_receipt_id?.trim();
   if (receiptId) {
     params.set("selected", receiptId);
@@ -364,11 +423,14 @@ export function resolvePolicyEvidenceHref(policy: GuardPolicyDecision): string {
 export function resolvePolicyApprovalRecordLabel(policy: GuardPolicyDecision): string {
   const receiptId = policy.source_receipt_id?.trim();
   if (receiptId) {
-    return `${receiptId}.json`;
+    if (receiptId.length <= 24) {
+      return receiptId;
+    }
+    return `${receiptId.slice(0, 10)}…${receiptId.slice(-8)}`;
   }
   const hash = policy.artifact_hash?.replace(/^sha256:/i, "").slice(0, 8);
   if (hash) {
-    return `receipt_${hash}.json`;
+    return `hash ${hash}`;
   }
   return "View in Evidence";
 }

{plugin_scanner-2.0.724 → plugin_scanner-2.0.726}/dashboard/src/policy-workspace-page.tsx

@@ -20,6 +20,7 @@ export function PolicyWorkspacePage(props: {
   onOpenSettings: () => void;
   onOpenInbox: () => void;
   onRefreshPolicies: () => void;
+  onNavigate?: (pathname: string) => void;
 }) {
   const [activeView, setActiveView] = useState<PolicyPageView>("rules");
   const [reloading, setReloading] = useState(false);
@@ -77,6 +78,7 @@ export function PolicyWorkspacePage(props: {
           onExceptionRequestOpenChange={setExceptionRequestOpen}
           onReloadPolicy={handleReloadPolicy}
           reloadingPolicy={reloading}
+          onNavigate={props.onNavigate}
         />
       </Suspense>
     </div>

{plugin_scanner-2.0.724 → plugin_scanner-2.0.726}/dashboard/src/policy-workspace-views.tsx

@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useState, type MouseEvent } from "react";
 import {
   HiMiniTrash,
   HiMiniCloudArrowUp,
@@ -10,18 +10,31 @@ import {
   HiMiniGlobeAlt,
   HiMiniLockClosed,
   HiMiniShieldCheck,
+  HiMiniNoSymbol,
+  HiMiniCheckCircle,
 } from "react-icons/hi2";
-import { Badge, Tag, EmptyState } from "./approval-center-primitives";
-import { harnessDisplayName, formatRelativeTime, policyActionLabel, scopeLabel } from "./approval-center-utils";
+import { Tag, EmptyState } from "./approval-center-primitives";
+import { harnessDisplayName, formatRelativeTime, scopeLabel, policyActionLabel } from "./approval-center-utils";
 import { guardAwareHref } from "./guard-api";
 import type { GuardPolicyDecision } from "./guard-types";
+import {
+  EvidenceTable,
+  EvidenceTableBody,
+  EvidenceTableCell,
+  EvidenceTableHead,
+  EvidenceTableHeader,
+  EvidenceTableRow,
+} from "./evidence/evidence-table";
 import {
   isCloudManagedPolicy,
   resolvePolicyApprovalRecordLabel,
   resolvePolicyDisplay,
   resolvePolicyEvidenceHref,
   resolvePolicyMatcherFamily,
+  resolvePolicyRowFolder,
+  resolvePolicyRowFrequency,
   resolvePolicyRowSourceLabel,
+  resolvePolicyRowSubtitle,
   resolvePolicyRowTitle,
 } from "./policy-workspace-helpers";
 
@@ -29,24 +42,30 @@ export type PolicySortKey = "app" | "updated";
 export type PolicySortState = { key: PolicySortKey; direction: "asc" | "desc" } | null;
 
 const PAGE_SIZE = 5;
+const TABLE_MIN_WIDTH_CLASS = "min-w-[980px]";
 
-const RULE_GRID_CLASS =
-  "grid grid-cols-[minmax(0,1fr)] items-center gap-x-3 gap-y-2 border-b border-slate-100 px-4 py-3 last:border-0 hover:bg-slate-50/80 md:grid-cols-[40px_72px_minmax(200px,1.4fr)_88px_96px_88px_104px_minmax(120px,1fr)_72px]";
-
-const RULE_HEADER_CLASS =
-  "hidden border-b border-slate-100 bg-slate-50/80 px-4 py-2.5 text-[10px] font-semibold uppercase tracking-wider text-slate-500 md:grid md:grid-cols-[40px_72px_minmax(200px,1.4fr)_88px_96px_88px_104px_minmax(120px,1fr)_72px] md:gap-x-3";
-
-function resolveActionTone(action: string): "success" | "destructive" | "warning" | "default" {
+function PolicyActionBadge({ action }: { action: string }) {
   if (action === "allow") {
-    return "success";
+    return (
+      <span className="inline-flex items-center gap-1 rounded-full border border-emerald-300 bg-emerald-50 px-2.5 py-0.5 text-xs font-semibold text-emerald-800">
+        <HiMiniCheckCircle className="h-3.5 w-3.5" aria-hidden="true" />
+        Allow
+      </span>
+    );
   }
   if (action === "block") {
-    return "destructive";
-  }
-  if (action === "warn" || action === "require-reapproval") {
-    return "warning";
+    return (
+      <span className="inline-flex items-center gap-1 rounded-full border border-rose-300 bg-rose-50 px-2.5 py-0.5 text-xs font-semibold text-rose-800">
+        <HiMiniNoSymbol className="h-3.5 w-3.5" aria-hidden="true" />
+        Block
+      </span>
+    );
   }
-  return "default";
+  return (
+    <span className="inline-flex items-center gap-1 rounded-full border border-amber-300 bg-amber-50 px-2.5 py-0.5 text-xs font-semibold text-amber-900">
+      {policyActionLabel(action)}
+    </span>
+  );
 }
 
 function resolveFamilyIcon(family: string | null) {
@@ -65,14 +84,47 @@ function resolveFamilyIcon(family: string | null) {
   return HiMiniShieldCheck;
 }
 
+function PolicyEvidenceLink({
+  policy,
+  onNavigate,
+}: {
+  policy: GuardPolicyDecision;
+  onNavigate?: (pathname: string) => void;
+}) {
+  const href = resolvePolicyEvidenceHref(policy);
+  const label = resolvePolicyApprovalRecordLabel(policy);
+  const handleClick = useCallback(
+    (event: MouseEvent<HTMLAnchorElement>) => {
+      if (!onNavigate) {
+        return;
+      }
+      event.preventDefault();
+      onNavigate(href);
+    },
+    [href, onNavigate],
+  );
+
+  return (
+    <a
+      href={guardAwareHref(href)}
+      onClick={handleClick}
+      className="inline-flex max-w-full items-center gap-1 font-mono text-xs font-medium text-brand-blue hover:underline"
+      title={`Open receipt ${policy.source_receipt_id ?? label} in Evidence`}
+    >
+      {label}
+    </a>
+  );
+}
+
 type PolicyRuleRowProps = {
   policy: GuardPolicyDecision;
   cloudControlsUrl: string | null;
   onClear?: (policy: GuardPolicyDecision) => void;
+  onNavigate?: (pathname: string) => void;
   cloudVariant?: boolean;
 };
 
-function PolicyRuleRow({ policy, cloudControlsUrl, onClear, cloudVariant = false }: PolicyRuleRowProps) {
+function PolicyRuleRow({ policy, cloudControlsUrl, onClear, onNavigate, cloudVariant = false }: PolicyRuleRowProps) {
   const handleClear = useCallback(() => onClear?.(policy), [onClear, policy]);
   const cloudManaged = cloudVariant || isCloudManagedPolicy(policy.source);
   const display = resolvePolicyDisplay(policy);
@@ -80,59 +132,61 @@ function PolicyRuleRow({ policy, cloudControlsUrl, onClear, cloudVariant = false
   const family = resolvePolicyMatcherFamily(policy);
   const Icon = resolveFamilyIcon(family);
   const title = resolvePolicyRowTitle(policy, display);
+  const subtitle = resolvePolicyRowSubtitle(policy, display);
+  const folder = resolvePolicyRowFolder(policy);
+  const frequency = resolvePolicyRowFrequency(policy);
   const scopeTag = scopeLabel(policy.scope, "policy");
 
   return (
-    <article className={RULE_GRID_CLASS} role="listitem">
-      <div className="hidden items-center justify-center md:flex">
+    <EvidenceTableRow>
+      <EvidenceTableCell className="w-10">
         <span className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-slate-100 text-slate-500">
           <Icon className="h-4 w-4" aria-hidden="true" />
         </span>
-      </div>
+      </EvidenceTableCell>
 
-      <div className="flex items-center gap-2 md:col-start-2">
-        <span className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-slate-100 text-slate-500 md:hidden">
-          <Icon className="h-4 w-4" aria-hidden="true" />
-        </span>
-        <Badge tone={resolveActionTone(policy.action)}>{policyActionLabel(policy.action)}</Badge>
-      </div>
-
-      <div className="min-w-0 md:col-start-3">
-        <p className="text-sm font-semibold leading-snug text-brand-dark">{title}</p>
-        {display.kindLine ? <p className="mt-0.5 text-xs text-slate-500">{display.kindLine}</p> : null}
-        <div className="mt-2 flex flex-wrap gap-3 text-xs text-slate-600 md:hidden">
-          <span>{resolvePolicyRowSourceLabel(policy)}</span>
-          <span>{scopeTag}</span>
-          <span>{harnessDisplayName(policy.harness)}</span>
+      <EvidenceTableCell className="w-[88px] whitespace-nowrap">
+        <PolicyActionBadge action={policy.action} />
+      </EvidenceTableCell>
+
+      <EvidenceTableCell className="min-w-[240px] max-w-[360px]">
+        <p className="font-semibold leading-snug text-brand-dark">{title}</p>
+        {subtitle ? <p className="mt-1 text-xs leading-relaxed text-slate-500">{subtitle}</p> : null}
+        <div className="mt-2 space-y-1 text-xs text-slate-600 lg:hidden">
+          <p>
+            <span className="font-medium text-slate-700">Folder:</span> {folder ?? "Not recorded"}
+          </p>
+          <p>
+            <span className="font-medium text-slate-700">Frequency:</span> {frequency}
+          </p>
+          <p>
+            <span className="font-medium text-slate-700">App:</span> {harnessDisplayName(policy.harness)}
+          </p>
         </div>
-      </div>
+      </EvidenceTableCell>
 
-      <div className="hidden text-sm text-brand-dark md:col-start-4 md:block">
-        {cloudManaged ? <Tag tone="blue">{resolvePolicyRowSourceLabel(policy)}</Tag> : resolvePolicyRowSourceLabel(policy)}
-      </div>
+      <EvidenceTableCell className="hidden w-[96px] lg:table-cell">
+        {cloudManaged ? (
+          <Tag tone="blue">{resolvePolicyRowSourceLabel(policy)}</Tag>
+        ) : (
+          <span className="text-sm text-brand-dark">{resolvePolicyRowSourceLabel(policy)}</span>
+        )}
+      </EvidenceTableCell>
 
-      <div className="hidden md:col-start-5 md:block">
+      <EvidenceTableCell className="hidden w-[104px] lg:table-cell">
         <Tag tone="blue">{scopeTag}</Tag>
-      </div>
+      </EvidenceTableCell>
 
-      <div className="hidden text-sm md:col-start-6 md:block">
+      <EvidenceTableCell className="hidden w-[96px] lg:table-cell">
         <span className="font-medium text-brand-blue">{harnessDisplayName(policy.harness)}</span>
-      </div>
+      </EvidenceTableCell>
 
-      <div className="hidden whitespace-nowrap text-xs text-slate-500 md:col-start-7 md:block">
+      <EvidenceTableCell className="hidden w-[104px] whitespace-nowrap text-xs text-slate-500 lg:table-cell">
         {policy.updated_at ? formatRelativeTime(policy.updated_at) : "—"}
-      </div>
+      </EvidenceTableCell>
 
-      <div className="hidden min-w-0 md:col-start-8 md:block">
-        {!cloudManaged ? (
-          <a
-            href={guardAwareHref(resolvePolicyEvidenceHref(policy))}
-            className="max-w-full truncate font-mono text-xs font-medium text-brand-blue hover:underline"
-            title={resolvePolicyApprovalRecordLabel(policy)}
-          >
-            {resolvePolicyApprovalRecordLabel(policy)}
-          </a>
-        ) : null}
+      <EvidenceTableCell className="hidden min-w-[120px] lg:table-cell">
+        {!cloudManaged ? <PolicyEvidenceLink policy={policy} onNavigate={onNavigate} /> : null}
         {cloudManaged && cloudControlsUrl ? (
           <a
             href={cloudControlsUrl}
@@ -144,9 +198,9 @@ function PolicyRuleRow({ policy, cloudControlsUrl, onClear, cloudVariant = false
             View on cloud
           </a>
         ) : null}
-      </div>
+      </EvidenceTableCell>
 
-      <div className="hidden items-center justify-end md:col-start-9 md:flex">
+      <EvidenceTableCell className="hidden w-[88px] text-right lg:table-cell">
         {cloudManaged ? (
           <span className="inline-flex items-center gap-1 text-xs font-medium text-slate-500" title="Read-only Cloud policy">
             <HiMiniLockClosed className="h-3.5 w-3.5" aria-hidden="true" />
@@ -160,11 +214,11 @@ function PolicyRuleRow({ policy, cloudControlsUrl, onClear, cloudVariant = false
             className="inline-flex items-center gap-1 text-xs font-medium text-slate-500 hover:text-red-600"
           >
             <HiMiniTrash className="h-3.5 w-3.5" aria-hidden="true" />
-            Remove rule
+            Remove
           </button>
         ) : null}
-      </div>
-    </article>
+      </EvidenceTableCell>
+    </EvidenceTableRow>
   );
 }
 
@@ -172,6 +226,7 @@ type PolicyRuleTableProps = {
   policies: GuardPolicyDecision[];
   cloudControlsUrl: string | null;
   onClearPolicy?: (policy: GuardPolicyDecision) => void;
+  onNavigate?: (pathname: string) => void;
   emptyTitle: string;
   emptyBody: string;
   cloudVariant?: boolean;
@@ -183,6 +238,7 @@ export function PolicyRuleTable({
   policies,
   cloudControlsUrl,
   onClearPolicy,
+  onNavigate,
   emptyTitle,
   emptyBody,
   cloudVariant = false,
@@ -219,30 +275,38 @@ export function PolicyRuleTable({
 
   return (
     <div className="space-y-3">
-      <div className="overflow-x-auto rounded-2xl border border-slate-100 bg-white shadow-sm">
-        <div className={RULE_HEADER_CLASS} aria-hidden="true">
-          <span />
-          <span>Action</span>
-          <span>Rule description</span>
-          <span>Source</span>
-          <span>Scope</span>
-          <span>{cloudVariant ? "Applies to" : "Harness"}</span>
-          <span>Last updated</span>
-          <span>{cloudVariant ? "Policy" : "Approval record"}</span>
-          <span className="text-right">{cloudVariant ? "" : "Actions"}</span>
-        </div>
-        <div role="list">
-          {visiblePolicies.map((policy) => (
-            <PolicyRuleRow
-              key={`${policy.harness}-${policy.scope}-${policy.artifact_id ?? policy.publisher ?? "global"}-${policy.updated_at ?? ""}-${policy.source}`}
-              policy={policy}
-              cloudControlsUrl={cloudControlsUrl}
-              onClear={onClearPolicy}
-              cloudVariant={cloudVariant}
-            />
-          ))}
-        </div>
-      </div>
+      <EvidenceTable label={cloudVariant ? "Cloud policy rules" : "Remembered policy rules"} tableClassName={TABLE_MIN_WIDTH_CLASS}>
+          <EvidenceTableHead>
+            <EvidenceTableHeader className="w-10" />
+            <EvidenceTableHeader>Action</EvidenceTableHeader>
+            <EvidenceTableHeader>Rule</EvidenceTableHeader>
+            <EvidenceTableHeader className="hidden lg:table-cell">Source</EvidenceTableHeader>
+            <EvidenceTableHeader className="hidden lg:table-cell">Scope</EvidenceTableHeader>
+            <EvidenceTableHeader className="hidden lg:table-cell">
+              {cloudVariant ? "Applies to" : "App"}
+            </EvidenceTableHeader>
+            <EvidenceTableHeader className="hidden lg:table-cell">Updated</EvidenceTableHeader>
+            <EvidenceTableHeader className="hidden lg:table-cell">
+              {cloudVariant ? "Policy" : "Approval record"}
+            </EvidenceTableHeader>
+            <EvidenceTableHeader className="hidden text-right lg:table-cell">
+              {cloudVariant ? "" : "Actions"}
+            </EvidenceTableHeader>
+          </EvidenceTableHead>
+          <EvidenceTableBody>
+            {visiblePolicies.map((policy) => (
+              <PolicyRuleRow
+                key={`${policy.harness}-${policy.scope}-${policy.artifact_id ?? policy.publisher ?? "global"}-${policy.updated_at ?? ""}-${policy.source}`}
+                policy={policy}
+                cloudControlsUrl={cloudControlsUrl}
+                onClear={onClearPolicy}
+                onNavigate={onNavigate}
+                cloudVariant={cloudVariant}
+              />
+            ))}
+          </EvidenceTableBody>
+      </EvidenceTable>
+
       {hasMore && viewAllLabel ? (
         <div className="flex justify-center pt-1">
           <button
@@ -275,6 +339,7 @@ type GroupedPolicySectionProps = {
   policies: GuardPolicyDecision[];
   cloudControlsUrl: string | null;
   onClearPolicy?: (policy: GuardPolicyDecision) => void;
+  onNavigate?: (pathname: string) => void;
   emptyTitle: string;
   emptyBody: string;
   defaultOpen?: boolean;
@@ -289,6 +354,7 @@ export function GroupedPolicySection({
   policies,
   cloudControlsUrl,
   onClearPolicy,
+  onNavigate,
   emptyTitle,
   emptyBody,
   defaultOpen = true,
@@ -341,6 +407,7 @@ export function GroupedPolicySection({
           policies={policies}
           cloudControlsUrl={cloudControlsUrl}
           onClearPolicy={onClearPolicy}
+          onNavigate={onNavigate}
           emptyTitle={emptyTitle}
           emptyBody={emptyBody}
           cloudVariant={cloudVariant}