refactor(policies): simplify suppress renderer per /simplify review

- Drop renderEvaluation's (active, suppressed int) returns and count from
  p.Violations in groupEvaluations. Single-purpose return signature.
- assessmentScopes: replace map dedup with slices.Contains (typical N=1-2).
- Trim narrative/spec comments on the new Suppressed/SuppressedCount fields
  and on groupEvaluations/renderEvaluation — keep only the WHY (gate-counter
  invariance across modes); proto field names speak for themselves.
- msg += idiom in policiesTable.

No behavior change; all 2408 unit tests still pass.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 5bd2a917-fb7b-400c-9772-60ba6af6c9af, b66717f5-626e-4c20-8d33-59c129b5885d

Author: migmartri

app/cli/cmd/workflow_workflow_run_describe.go

@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"slices"
 	"strings"
 	"time"
 
@@ -254,9 +255,6 @@ func policiesTable(evs []*action.PolicyEvaluation, mt table.Writer, debugMode bo
 	for _, ev := range evs {
 		msg := ""
 
-		// Partition: active violations count toward the gate; suppressed
-		// entries are kept in the CAS bundle for audit and shown separately
-		// so operators can see policy decisions without losing context.
 		var active []string
 		var suppressed []*action.PolicyViolation
 		for _, v := range ev.Violations {
@@ -297,7 +295,7 @@ func policiesTable(evs []*action.PolicyEvaluation, mt table.Writer, debugMode bo
 		}
 
 		if s := renderSuppressed(suppressed); s != "" {
-			msg = msg + "\n" + s
+			msg += "\n" + s
 		}
 
 		name := ev.Name
@@ -308,11 +306,6 @@ func policiesTable(evs []*action.PolicyEvaluation, mt table.Writer, debugMode bo
 	}
 }
 
-// renderSuppressed formats a "Suppressed (N)" sub-section listing entries the
-// policy excluded from the gate. Each line shows the violation message plus,
-// when a structured finding with an assessment is available, the
-// precedence-resolved status and scope (e.g. "NOT_AFFECTED, PROJECT") so
-// operators can audit suppression decisions without downloading the bundle.
 func renderSuppressed(suppressed []*action.PolicyViolation) string {
 	if len(suppressed) == 0 {
 		return ""
@@ -330,10 +323,6 @@ func renderSuppressed(suppressed []*action.PolicyViolation) string {
 	return header + "\n" + dim.Sprint(strings.Join(lines, "\n"))
 }
 
-// suppressedAssessment extracts the effective assessment status and scope
-// from whichever structured finding is attached to the violation, if any.
-// Returns the empty string when no assessment is available (unstructured
-// policy, or finding without an assessment annotation).
 func suppressedAssessment(v *action.PolicyViolation) string {
 	switch {
 	case v.Vulnerability != nil && v.Vulnerability.Assessment != nil:
@@ -359,16 +348,11 @@ func prettyAssessment(status string, scopes []string) string {
 
 func assessmentScopes(in []*attv1.PolicyAssessment) []string {
 	scopes := make([]string, 0, len(in))
-	seen := make(map[string]struct{}, len(in))
 	for _, a := range in {
 		scope := strings.TrimPrefix(a.GetScope(), "ASSESSMENT_SCOPE_")
-		if scope == "" {
+		if scope == "" || slices.Contains(scopes, scope) {
 			continue
 		}
-		if _, dup := seen[scope]; dup {
-			continue
-		}
-		seen[scope] = struct{}{}
 		scopes = append(scopes, scope)
 	}
 	return scopes

app/cli/pkg/action/workflow_run_describe.go

@@ -114,15 +114,11 @@ type PolicyEvaluation struct {
 }
 
 type PolicyViolation struct {
-	Subject string `json:"subject"`
-	Message string `json:"message"`
-	// Suppress, when true, excludes this entry from the gate count while
-	// keeping it in the CAS-stored bundle (audit trail preserved). Set by
-	// the policy author via the rego "suppress" key.
-	Suppress bool `json:"suppress,omitempty"`
-	// Structured finding data from the policy, present when the policy
-	// declared finding_type. Mirrors the oneof on the wire — exactly one
-	// pointer is set per violation, or none for unstructured policies.
+	Subject  string `json:"subject"`
+	Message  string `json:"message"`
+	Suppress bool   `json:"suppress,omitempty"`
+	// Mirrors the oneof on the wire — exactly one pointer is set per
+	// violation, or none for unstructured policies.
 	Vulnerability    *attv1.PolicyVulnerabilityFinding    `json:"vulnerability,omitempty"`
 	Sast             *attv1.PolicySASTFinding             `json:"sast,omitempty"`
 	LicenseViolation *attv1.PolicyLicenseViolationFinding `json:"license_violation,omitempty"`

app/controlplane/api/controlplane/v1/response_messages.pb.go

@@ -148,10 +148,8 @@ message PolicyStatusSummary {
   // the contract using the ENFORCED blocking strategy. Independent of status:
   // a PASSED run can still have has_gates=true.
   bool has_gates = 6;
-  // Total number of violations across all evaluations that were suppressed
-  // by the policy. Suppressed entries are excluded from violated/has_gates
-  // accounting but kept in the CAS audit trail. UI can show a "Suppressed (N)"
-  // badge without partitioning the violations client-side.
+  // Number of suppressed violations across all evaluations. Excluded
+  // from violated; kept in the CAS audit trail.
   int32 suppressed = 7;
 }
 
@@ -260,14 +258,11 @@ message PolicyEvaluation {
 message PolicyViolation {
   string subject = 1;
   string message = 2;
-  // Whether this violation was excluded from the policy gate. Suppressed
-  // entries are part of the audit trail but did not contribute to
-  // PolicyEvaluationStatus.summary.violated or has_gated_violations.
+  // Whether this violation was excluded from the policy gate (still kept
+  // in the CAS audit trail).
   bool suppress = 3;
-  // Structured finding data from the policy. Populated when the policy
-  // declared finding_type and emitted a structured rather than string
-  // violation. Mirrors the oneof on
-  // attestation.v1.PolicyEvaluation.Violation in the CAS-stored bundle.
+  // Structured finding mirroring attestation.v1.PolicyEvaluation.Violation.
+  // Populated when the policy declares finding_type.
   oneof finding {
     attestation.v1.PolicyVulnerabilityFinding vulnerability = 4;
     attestation.v1.PolicySASTFinding sast = 5;

app/controlplane/api/controlplane/v1/response_messages.proto

@@ -68,9 +68,7 @@ type PolicyEvaluationStatus struct {
 	SkippedCount int
 	// Number of evaluations that passed: neither skipped nor with violations.
 	PassedCount int
-	// Total number of violations across all evaluations that were suppressed
-	// by the policy. Excluded from ViolationsCount / HasViolations accounting
-	// but surfaced separately so the UI can render a "Suppressed (N)" badge.
+	// Number of suppressed violations across all evaluations.
 	SuppressedCount int
 }