feat(policies): surface suppressed violations and finding data on describe API

Spec 061. The CAS-stored PolicyEvaluationBundle preserves every violation
with full structured finding data, but the cpAPI PolicyViolation message
only carried subject+message — assessment context died at the CP→client
proto boundary.

Extends the wire format and the renderer so the audit-trail view is
available on workflow workflow-run describe:

- PolicyViolation: adds bool suppress and a oneof finding mirroring the
  shape on attestation.v1.PolicyEvaluation.Violation.
- PolicyStatusSummary: adds int32 suppressed counter so the UI can render
  a "Suppressed (N)" badge without partitioning client-side.
- v02 renderer: groupEvaluations/renderEvaluation now take an
  includeSuppressed flag — the predicate path keeps PR #3105 semantics
  (filtered, no finding), while the CAS bundle path preserves suppressed
  entries and finding pointers. Gate counters always exclude suppressed.
- ProvenancePredicateV02: adds PolicySuppressedCount alongside the
  existing skipped/passed counters.
- CP service mapper and CLI action layer propagate the new fields.
- policiesTable renders a distinct dim "Suppressed (N):" sub-section per
  evaluation with assessment status/scope pulled from the structured
  finding when available — applies uniformly across attestation status /
  add / workflow workflow-run describe.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 5bd2a917-fb7b-400c-9772-60ba6af6c9af, b66717f5-626e-4c20-8d33-59c129b5885d

Author: migmartri

app/cli/cmd/workflow_workflow_run_describe.go

@@ -26,6 +26,7 @@ import (
 
 	"github.com/chainloop-dev/chainloop/app/cli/cmd/output"
 	"github.com/chainloop-dev/chainloop/app/cli/pkg/action"
+	attv1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
 	"github.com/jedib0t/go-pretty/v6/table"
 	"github.com/jedib0t/go-pretty/v6/text"
@@ -253,14 +254,17 @@ func policiesTable(evs []*action.PolicyEvaluation, mt table.Writer, debugMode bo
 	for _, ev := range evs {
 		msg := ""
 
-		// Suppressed violations stay in the CAS-stored bundle for audit but
-		// don't surface here — the terminal output mirrors what the gate counts.
-		violations := make([]string, 0, len(ev.Violations))
+		// Partition: active violations count toward the gate; suppressed
+		// entries are kept in the CAS bundle for audit and shown separately
+		// so operators can see policy decisions without losing context.
+		var active []string
+		var suppressed []*action.PolicyViolation
 		for _, v := range ev.Violations {
 			if v.Suppress {
+				suppressed = append(suppressed, v)
 				continue
 			}
-			violations = append(violations, v.Message)
+			active = append(active, v.Message)
 		}
 
 		switch {
@@ -274,22 +278,26 @@ func policiesTable(evs []*action.PolicyEvaluation, mt table.Writer, debugMode bo
 			default:
 				msg = text.Colors{text.FgHiYellow}.Sprint("the policy was skipped in all execution paths")
 			}
-		case len(violations) == 0:
+		case len(active) == 0:
 			msg = text.Colors{text.FgHiGreen}.Sprint("Ok")
 		default:
 			color := text.Colors{text.FgHiRed}
 			var prefix = ""
 			// For multiple violations, we want to indent the list
-			if len(violations) > 1 {
+			if len(active) > 1 {
 				prefix = "\n  - "
 			}
 
 			// Color the violations text before joining
-			for i, v := range violations {
-				violations[i] = color.Sprint(v)
+			for i, v := range active {
+				active[i] = color.Sprint(v)
 			}
 
-			msg = prefix + strings.Join(violations, prefix)
+			msg = prefix + strings.Join(active, prefix)
+		}
+
+		if s := renderSuppressed(suppressed); s != "" {
+			msg = msg + "\n" + s
 		}
 
 		name := ev.Name
@@ -300,6 +308,72 @@ func policiesTable(evs []*action.PolicyEvaluation, mt table.Writer, debugMode bo
 	}
 }
 
+// renderSuppressed formats a "Suppressed (N)" sub-section listing entries the
+// policy excluded from the gate. Each line shows the violation message plus,
+// when a structured finding with an assessment is available, the
+// precedence-resolved status and scope (e.g. "NOT_AFFECTED, PROJECT") so
+// operators can audit suppression decisions without downloading the bundle.
+func renderSuppressed(suppressed []*action.PolicyViolation) string {
+	if len(suppressed) == 0 {
+		return ""
+	}
+	dim := text.Colors{text.FgHiYellow}
+	lines := make([]string, 0, len(suppressed))
+	for _, v := range suppressed {
+		line := v.Message
+		if a := suppressedAssessment(v); a != "" {
+			line = fmt.Sprintf("%s — %s", line, a)
+		}
+		lines = append(lines, "  - "+line)
+	}
+	header := dim.Sprintf("Suppressed (%d):", len(suppressed))
+	return header + "\n" + dim.Sprint(strings.Join(lines, "\n"))
+}
+
+// suppressedAssessment extracts the effective assessment status and scope
+// from whichever structured finding is attached to the violation, if any.
+// Returns the empty string when no assessment is available (unstructured
+// policy, or finding without an assessment annotation).
+func suppressedAssessment(v *action.PolicyViolation) string {
+	switch {
+	case v.Vulnerability != nil && v.Vulnerability.Assessment != nil:
+		return prettyAssessment(v.Vulnerability.Assessment.GetEffectiveStatus(), assessmentScopes(v.Vulnerability.Assessment.GetAssessments()))
+	case v.Sast != nil && v.Sast.Assessment != nil:
+		return prettyAssessment(v.Sast.Assessment.GetEffectiveStatus(), assessmentScopes(v.Sast.Assessment.GetAssessments()))
+	case v.LicenseViolation != nil && v.LicenseViolation.Assessment != nil:
+		return prettyAssessment(v.LicenseViolation.Assessment.GetEffectiveStatus(), assessmentScopes(v.LicenseViolation.Assessment.GetAssessments()))
+	}
+	return ""
+}
+
+func prettyAssessment(status string, scopes []string) string {
+	s := strings.TrimPrefix(status, "ASSESSMENT_STATUS_")
+	if s == "" {
+		return ""
+	}
+	if len(scopes) == 0 {
+		return s
+	}
+	return fmt.Sprintf("%s, %s scope", s, strings.Join(scopes, "/"))
+}
+
+func assessmentScopes(in []*attv1.PolicyAssessment) []string {
+	scopes := make([]string, 0, len(in))
+	seen := make(map[string]struct{}, len(in))
+	for _, a := range in {
+		scope := strings.TrimPrefix(a.GetScope(), "ASSESSMENT_SCOPE_")
+		if scope == "" {
+			continue
+		}
+		if _, dup := seen[scope]; dup {
+			continue
+		}
+		seen[scope] = struct{}{}
+		scopes = append(scopes, scope)
+	}
+	return scopes
+}
+
 func encodeAttestationOutput(run *action.WorkflowRunItemFull, writer io.Writer) error {
 	// Try to encode as a table or json
 	err := output.EncodeOutput(flagOutputFormat, run, workflowRunDescribeTableOutput)

app/cli/pkg/action/attestation_status.go

@@ -366,11 +366,20 @@ func policyEvaluationStateToActionForStatus(in *v1.PolicyEvaluation) *PolicyEval
 
 	violations := make([]*PolicyViolation, 0, len(in.Violations))
 	for _, v := range in.Violations {
-		violations = append(violations, &PolicyViolation{
+		out := &PolicyViolation{
 			Subject:  v.Subject,
 			Message:  v.Message,
 			Suppress: v.GetSuppress(),
-		})
+		}
+		switch f := v.GetFinding().(type) {
+		case *v1.PolicyEvaluation_Violation_Vulnerability:
+			out.Vulnerability = f.Vulnerability
+		case *v1.PolicyEvaluation_Violation_Sast:
+			out.Sast = f.Sast
+		case *v1.PolicyEvaluation_Violation_LicenseViolation:
+			out.LicenseViolation = f.LicenseViolation
+		}
+		violations = append(violations, out)
 	}
 
 	return &PolicyEvaluation{

app/cli/pkg/action/workflow_run_describe.go

@@ -26,6 +26,7 @@ import (
 	"unicode/utf8"
 
 	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
+	attv1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/verifier"
 	intoto "github.com/in-toto/attestation/go/v1"
@@ -119,6 +120,12 @@ type PolicyViolation struct {
 	// keeping it in the CAS-stored bundle (audit trail preserved). Set by
 	// the policy author via the rego "suppress" key.
 	Suppress bool `json:"suppress,omitempty"`
+	// Structured finding data from the policy, present when the policy
+	// declared finding_type. Mirrors the oneof on the wire — exactly one
+	// pointer is set per violation, or none for unstructured policies.
+	Vulnerability    *attv1.PolicyVulnerabilityFinding    `json:"vulnerability,omitempty"`
+	Sast             *attv1.PolicySASTFinding             `json:"sast,omitempty"`
+	LicenseViolation *attv1.PolicyLicenseViolationFinding `json:"license_violation,omitempty"`
 }
 
 type PolicyReference struct {
@@ -296,10 +303,20 @@ func policyEvaluationPBToAction(in *pb.PolicyEvaluation) *PolicyEvaluation {
 	}
 	violations := make([]*PolicyViolation, 0, len(in.Violations))
 	for _, v := range in.Violations {
-		violations = append(violations, &PolicyViolation{
-			Subject: v.Subject,
-			Message: v.Message,
-		})
+		out := &PolicyViolation{
+			Subject:  v.Subject,
+			Message:  v.Message,
+			Suppress: v.GetSuppress(),
+		}
+		switch f := v.GetFinding().(type) {
+		case *pb.PolicyViolation_Vulnerability:
+			out.Vulnerability = f.Vulnerability
+		case *pb.PolicyViolation_Sast:
+			out.Sast = f.Sast
+		case *pb.PolicyViolation_LicenseViolation:
+			out.LicenseViolation = f.LicenseViolation
+		}
+		violations = append(violations, out)
 	}
 	return &PolicyEvaluation{
 		Name:            in.Name,