From 34566555f85845a4d7e6bf7fe6ad25fe82851a20 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Wed, 13 May 2026 18:32:44 -0400
Subject: [PATCH 01/15] feat(cloud-tests): auditor visibility improvements
 (phases 1-5)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds the depth and audit trail Chris asked for so auditors can trust the
automated checks. Five phases shipped together:

Phase 1 — Quick wins
- Evidence JSON viewer on each finding (sensitive keys redacted via
  evidence-sanitizer.ts — suffix-match strategy preserves booleans/numbers)
- Last-scan metadata strip (47 checks, 41 passed, 6 failed, 3.2s)
- Resource labels on every finding row (IAM User: john, S3 Bucket: …)
- Rename "Security Findings" header + tab to "Scan Results"

Phase 2 — AI check descriptions
- Tier 3 panel (what / pass / fail / why) generated lazily on first expand
- Claude Haiku 4.5 via @ai-sdk/anthropic, cached per (orgId, checkId) with
  source-hash invalidation (regenerates when adapter strings change)
- Server-side strip of compliance control numbers + URLs as a backstop
- GCP/Azure: passthrough from provider catalog (no AI call)

Phase 3 — Per-check sub-grouping
- Findings within a service grouped by normalized checkKey
- "X of Y failing" headers; "Show all results" reveals passing rows
- 100-row display cap per check with "Show more" affordance

Phase 4 — Comments on auditor findings
- CommentsPermissionGuard resolves entityType-specific permission so
  auditors (finding:update, no task:update) can comment on findings
- Comments thread on /overview/findings detail sheet

Phase 5 — Resolution + exceptions history
- FindingException / FindingResolution / FindingRegression tables
- Reconciliation classifies each resolution: platform_fix (RemediationAction
  matched), external_fix, resource_deleted, or exception_marked
- scannedServices column on IntegrationCheckRun prevents false "resolved"
  events on partial scans
- "Mark as exception" modal: required reason (20+ chars), optional reviewer,
  optional auto-review date
- New History tab: summary + resolutions + active exceptions + regressions

Includes 96 new tests (59 api + 37 frontend) and 3 Prisma migrations.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../ai-description.prompt.spec.ts             | 144 +++++++
 .../cloud-security/ai-description.prompt.ts   | 128 ++++++
 .../cloud-security/ai-description.service.ts  |  59 +++
 .../check-definition-provider-passthrough.ts  |  89 ++++
 .../check-definition.service.spec.ts          |  57 +++
 .../check-definition.service.ts               | 239 +++++++++++
 .../cloud-security/check-definition.utils.ts  |  67 +++
 .../cloud-security/cloud-security-audit.ts    |   4 +-
 .../cloud-security-query.legacy.ts            |  89 ++++
 .../cloud-security-query.service.ts           | 256 ++++++------
 .../cloud-security-query.types.ts             |  73 ++++
 .../cloud-security.controller.ts              | 104 +++++
 .../cloud-security/cloud-security.module.ts   |  10 +
 .../cloud-security/cloud-security.service.ts  |  43 +-
 .../cloud-security/dto/mark-exception.dto.ts  |  28 ++
 .../cloud-security/evidence-sanitizer.spec.ts | 219 ++++++++++
 .../src/cloud-security/evidence-sanitizer.ts  |  72 ++++
 .../cloud-security/exception.service.spec.ts  | 232 +++++++++++
 .../src/cloud-security/exception.service.ts   | 211 ++++++++++
 .../api/src/cloud-security/history.service.ts |  66 +++
 .../reconciliation.service.spec.ts            | 280 +++++++++++++
 .../cloud-security/reconciliation.service.ts  | 306 ++++++++++++++
 .../comments-permission.guard.spec.ts         | 200 +++++++++
 .../src/comments/comments-permission.guard.ts | 134 ++++++
 apps/api/src/comments/comments.controller.ts  |   7 +-
 apps/api/src/comments/comments.module.ts      |   8 +-
 .../components/CheckDefinitionPanel.test.tsx  | 110 +++++
 .../components/CheckDefinitionPanel.tsx       |  84 ++++
 .../components/CheckGroupBlock.test.tsx       | 190 +++++++++
 .../components/CheckGroupBlock.tsx            | 138 +++++++
 .../components/CloudTestsSection.tsx          | 384 ++++++++++++++----
 .../components/EvidenceJsonViewer.test.tsx    |  55 +++
 .../components/EvidenceJsonViewer.tsx         |  98 +++++
 .../cloud-tests/components/FindingsTable.tsx  |   2 +-
 .../components/HistoryTab.test.tsx            | 214 ++++++++++
 .../cloud-tests/components/HistoryTab.tsx     | 308 ++++++++++++++
 .../components/MarkExceptionModal.test.tsx    | 151 +++++++
 .../components/MarkExceptionModal.tsx         | 198 +++++++++
 .../cloud-tests/components/ProviderTabs.tsx   |  11 +-
 .../cloud-tests/components/ResultsView.tsx    |   4 +-
 .../components/check-groups.test.ts           | 183 +++++++++
 .../cloud-tests/components/check-groups.ts    | 125 ++++++
 .../app/(app)/[orgId]/cloud-tests/types.ts    |  33 ++
 .../components/FindingDetailSheet.tsx         |  10 +
 .../migration.sql                             |  28 ++
 .../migration.sql                             |   2 +
 .../migration.sql                             | 116 ++++++
 .../db/prisma/schema/check-definition.prisma  |  48 +++
 packages/db/prisma/schema/comment.prisma      |   1 +
 .../db/prisma/schema/finding-history.prisma   | 121 ++++++
 .../prisma/schema/integration-platform.prisma |  13 +
 packages/db/prisma/schema/organization.prisma |   4 +
 52 files changed, 5539 insertions(+), 217 deletions(-)
 create mode 100644 apps/api/src/cloud-security/ai-description.prompt.spec.ts
 create mode 100644 apps/api/src/cloud-security/ai-description.prompt.ts
 create mode 100644 apps/api/src/cloud-security/ai-description.service.ts
 create mode 100644 apps/api/src/cloud-security/check-definition-provider-passthrough.ts
 create mode 100644 apps/api/src/cloud-security/check-definition.service.spec.ts
 create mode 100644 apps/api/src/cloud-security/check-definition.service.ts
 create mode 100644 apps/api/src/cloud-security/check-definition.utils.ts
 create mode 100644 apps/api/src/cloud-security/cloud-security-query.legacy.ts
 create mode 100644 apps/api/src/cloud-security/cloud-security-query.types.ts
 create mode 100644 apps/api/src/cloud-security/dto/mark-exception.dto.ts
 create mode 100644 apps/api/src/cloud-security/evidence-sanitizer.spec.ts
 create mode 100644 apps/api/src/cloud-security/evidence-sanitizer.ts
 create mode 100644 apps/api/src/cloud-security/exception.service.spec.ts
 create mode 100644 apps/api/src/cloud-security/exception.service.ts
 create mode 100644 apps/api/src/cloud-security/history.service.ts
 create mode 100644 apps/api/src/cloud-security/reconciliation.service.spec.ts
 create mode 100644 apps/api/src/cloud-security/reconciliation.service.ts
 create mode 100644 apps/api/src/comments/comments-permission.guard.spec.ts
 create mode 100644 apps/api/src/comments/comments-permission.guard.ts
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckDefinitionPanel.test.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckDefinitionPanel.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckGroupBlock.test.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckGroupBlock.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.test.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.test.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.test.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/check-groups.test.ts
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/check-groups.ts
 create mode 100644 packages/db/prisma/migrations/20260513213400_cloud_tests_check_definition/migration.sql
 create mode 100644 packages/db/prisma/migrations/20260513220233_comment_entity_type_finding/migration.sql
 create mode 100644 packages/db/prisma/migrations/20260513221148_cloud_tests_phase5_history/migration.sql
 create mode 100644 packages/db/prisma/schema/check-definition.prisma
 create mode 100644 packages/db/prisma/schema/finding-history.prisma

diff --git a/apps/api/src/cloud-security/ai-description.prompt.spec.ts b/apps/api/src/cloud-security/ai-description.prompt.spec.ts
new file mode 100644
index 0000000000..28bfd3fe72
--- /dev/null
+++ b/apps/api/src/cloud-security/ai-description.prompt.spec.ts
@@ -0,0 +1,144 @@
+import {
+  buildCheckDescriptionPrompt,
+  checkDescriptionSchema,
+  findForbiddenContent,
+} from './ai-description.prompt';
+
+describe('ai-description.prompt', () => {
+  describe('checkDescriptionSchema', () => {
+    it('accepts a well-formed Tier 3 description', () => {
+      const parsed = checkDescriptionSchema.safeParse({
+        title: 'IAM password policy enforces 14+ character minimum',
+        description:
+          'Verifies that the AWS account password policy requires user passwords to be at least 14 characters long.',
+        passCriteria:
+          'Password policy exists AND MinimumPasswordLength >= 14',
+        failCriteria:
+          'No password policy is configured OR MinimumPasswordLength < 14',
+        whyItMatters:
+          'Short passwords are vulnerable to brute force attacks and credential stuffing.',
+      });
+      expect(parsed.success).toBe(true);
+    });
+
+    it('rejects fields below minimum length', () => {
+      const parsed = checkDescriptionSchema.safeParse({
+        title: '',
+        description: 'short',
+        passCriteria: 'x',
+        failCriteria: 'y',
+        whyItMatters: 'z',
+      });
+      expect(parsed.success).toBe(false);
+    });
+  });
+
+  describe('findForbiddenContent', () => {
+    const baseline = {
+      title: 'IAM password policy enforces 14+ character minimum',
+      description:
+        'Verifies that the AWS account password policy requires user passwords to be at least 14 characters long.',
+      passCriteria:
+        'Password policy exists AND MinimumPasswordLength >= 14',
+      failCriteria:
+        'No password policy is configured OR MinimumPasswordLength < 14',
+      whyItMatters:
+        'Short passwords are vulnerable to brute force attacks and credential stuffing.',
+    };
+
+    it('returns null for clean output', () => {
+      expect(findForbiddenContent(baseline)).toBeNull();
+    });
+
+    it('flags SOC 2 control numbers', () => {
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          whyItMatters:
+            'This check aligns with SOC 2 CC6.1 logical access controls.',
+        }),
+      ).toMatchObject({ field: 'whyItMatters' });
+    });
+
+    it('flags ISO 27001 references', () => {
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          whyItMatters: 'Required by ISO 27001 A.9.4.3.',
+        }),
+      ).toMatchObject({ field: 'whyItMatters' });
+    });
+
+    it('flags HIPAA / NIST framework citations', () => {
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          description: 'HIPAA-aligned password requirement.',
+        }),
+      ).toMatchObject({ field: 'description' });
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          description: 'Maps to NIST AC-2.',
+        }),
+      ).toMatchObject({ field: 'description' });
+    });
+
+    it('flags any URL', () => {
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          whyItMatters: 'See https://docs.aws.amazon.com for more info.',
+        }),
+      ).toMatchObject({ field: 'whyItMatters' });
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          description: 'Reference: www.cisecurity.org/benchmark.',
+        }),
+      ).toMatchObject({ field: 'description' });
+    });
+
+    it('flags CC<number>.<number> control patterns even without "SOC 2"', () => {
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          passCriteria: 'Control reference: CC7.1',
+        }),
+      ).toMatchObject({ field: 'passCriteria' });
+    });
+  });
+
+  describe('buildCheckDescriptionPrompt', () => {
+    it('includes provider, severity, title and description', () => {
+      const prompt = buildCheckDescriptionPrompt({
+        provider: 'aws',
+        serviceName: 'IAM',
+        title: 'IAM user "john" does not have MFA enabled',
+        description: 'User john has no MFA device configured.',
+        severity: 'high',
+        remediation: 'Enable MFA via IAM console.',
+      });
+      expect(prompt).toContain('AWS');
+      expect(prompt).toContain('IAM');
+      expect(prompt).toContain('high');
+      expect(prompt).toContain('john');
+      expect(prompt).toContain('Enable MFA');
+    });
+
+    it('omits null/empty fields cleanly', () => {
+      const prompt = buildCheckDescriptionPrompt({
+        provider: 'aws',
+        serviceName: null,
+        title: 'Untitled finding',
+        description: null,
+        severity: null,
+        remediation: null,
+      });
+      expect(prompt).toContain('Untitled finding');
+      expect(prompt).not.toContain('Service:');
+      expect(prompt).not.toContain('Finding description:');
+      expect(prompt).not.toContain('Suggested remediation:');
+    });
+  });
+});
diff --git a/apps/api/src/cloud-security/ai-description.prompt.ts b/apps/api/src/cloud-security/ai-description.prompt.ts
new file mode 100644
index 0000000000..f487ab37fe
--- /dev/null
+++ b/apps/api/src/cloud-security/ai-description.prompt.ts
@@ -0,0 +1,128 @@
+import { z } from 'zod';
+
+/**
+ * Output shape of the "About this check" panel auditors see when they
+ * expand a finding. Tier 3 = title, description, pass/fail criteria,
+ * rationale. NOTHING ELSE — no compliance control numbers, no external
+ * URLs, no framework claims. Server-side validation strips forbidden
+ * content before persisting to the cache.
+ */
+export const checkDescriptionSchema = z.object({
+  title: z
+    .string()
+    .min(1)
+    .max(160)
+    .describe('Plain-English summary of what this check verifies (~1 sentence).'),
+  description: z
+    .string()
+    .min(20)
+    .max(600)
+    .describe(
+      'What the check actually verifies in plain English (1-3 sentences). No control numbers, no URLs, no framework claims.',
+    ),
+  passCriteria: z
+    .string()
+    .min(10)
+    .max(300)
+    .describe(
+      'The configuration condition that makes this check pass. 1 sentence.',
+    ),
+  failCriteria: z
+    .string()
+    .min(10)
+    .max(300)
+    .describe(
+      'The configuration condition that makes this check fail. 1 sentence.',
+    ),
+  whyItMatters: z
+    .string()
+    .min(20)
+    .max(600)
+    .describe(
+      'Security/risk rationale in plain English. 1-2 sentences. NO compliance citations.',
+    ),
+});
+
+export type CheckDescription = z.infer<typeof checkDescriptionSchema>;
+
+export const CHECK_DESCRIPTION_SYSTEM_PROMPT = `You write audit-friendly explanations of cloud-security checks.
+
+Audience: an external auditor (SOC 2 / ISO 27001) reviewing the customer's environment. They need to TRUST the automation by understanding what each check verifies.
+
+OUTPUT
+- Return only the fields requested by the schema. Nothing else.
+- Tone: neutral, professional, present tense, third person.
+- Plain English. Avoid product jargon when a simpler word works.
+
+HARD RULES (output that violates these is stripped server-side):
+- DO NOT mention any specific compliance control number (no "SOC 2 CC6.1", "ISO 27001 A.9.4.3", "NIST AC-2", "HIPAA \xA7164.312", "CIS 1.8", "PCI 8.2.3", etc.).
+- DO NOT name a compliance framework as if it requires this check (no "required by SOC 2", "ISO mandates", "HIPAA-aligned").
+- DO NOT include any URL or external link.
+- DO NOT invent product features the input doesn't describe.
+
+Style: short, clear, factual.`;
+
+export interface CheckDescriptionInput {
+  provider: 'aws' | 'gcp' | 'azure' | string;
+  serviceName: string | null;
+  title: string;
+  description: string | null;
+  severity: string | null;
+  remediation: string | null;
+}
+
+export function buildCheckDescriptionPrompt(input: CheckDescriptionInput): string {
+  return [
+    `Provider: ${input.provider.toUpperCase()}`,
+    input.serviceName ? `Service: ${input.serviceName}` : null,
+    `Severity: ${input.severity ?? 'unknown'}`,
+    `Finding title: "${input.title}"`,
+    input.description ? `Finding description: "${input.description}"` : null,
+    input.remediation ? `Suggested remediation: "${input.remediation}"` : null,
+    '',
+    'Generate a CheckDefinition for this check. Focus on what the CHECK as a class verifies — not on the specific resource that failed.',
+  ]
+    .filter(Boolean)
+    .join('\n');
+}
+
+/**
+ * Detect content that slipped past the prompt — typical AI hallucinations
+ * we want to keep out of the rendered panel. Returns a list of regex
+ * patterns that should NEVER match in production output.
+ */
+const FORBIDDEN_PATTERNS: readonly RegExp[] = [
+  // Compliance control numbers and framework citations
+  /\bSOC ?2\b/i,
+  /\bISO ?27001\b/i,
+  /\bISO ?27002\b/i,
+  /\bHIPAA\b/i,
+  /\bNIST\b/i,
+  /\bPCI ?DSS\b/i,
+  /\bCIS ?Benchmark\b/i,
+  /\bCC\d+\.\d+\b/i, // SOC 2 control numbers like CC6.1
+  /\bA\.\d+\.\d+(\.\d+)?\b/, // ISO control numbers like A.9.4.3
+  // URLs
+  /https?:\/\//i,
+  /www\./i,
+];
+
+/**
+ * Return the first forbidden pattern that matches any field's value, or
+ * null when output is clean. Used as a server-side backstop to the prompt.
+ */
+export function findForbiddenContent(
+  description: CheckDescription,
+): { field: keyof CheckDescription; pattern: string } | null {
+  for (const [field, value] of Object.entries(description) as [
+    keyof CheckDescription,
+    string,
+  ][]) {
+    for (const pattern of FORBIDDEN_PATTERNS) {
+      if (pattern.test(value)) {
+        return { field, pattern: pattern.source };
+      }
+    }
+  }
+  return null;
+}
diff --git a/apps/api/src/cloud-security/ai-description.service.ts b/apps/api/src/cloud-security/ai-description.service.ts
new file mode 100644
index 0000000000..388c6ce448
--- /dev/null
+++ b/apps/api/src/cloud-security/ai-description.service.ts
@@ -0,0 +1,59 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { generateObject } from 'ai';
+import { anthropic } from '@ai-sdk/anthropic';
+import {
+  CHECK_DESCRIPTION_SYSTEM_PROMPT,
+  buildCheckDescriptionPrompt,
+  checkDescriptionSchema,
+  findForbiddenContent,
+  type CheckDescription,
+  type CheckDescriptionInput,
+} from './ai-description.prompt';
+
+/**
+ * Haiku 4.5 — cheap, fast, plenty good for descriptive text. Locked here
+ * so cache invalidation can detect model upgrades via `modelVersion`.
+ */
+export const DESCRIPTION_MODEL_VERSION = 'claude-haiku-4-5';
+const MODEL = anthropic(DESCRIPTION_MODEL_VERSION);
+
+@Injectable()
+export class AiDescriptionService {
+  private readonly logger = new Logger(AiDescriptionService.name);
+
+  /**
+   * Generate a Tier 3 "About this check" panel from a finding's metadata.
+   * Returns null on any AI failure — callers should surface a graceful
+   * fallback (showing only the existing per-finding description) rather
+   * than throwing.
+   */
+  async generate(input: CheckDescriptionInput): Promise<CheckDescription | null> {
+    try {
+      const { object } = await generateObject({
+        model: MODEL,
+        schema: checkDescriptionSchema,
+        system: CHECK_DESCRIPTION_SYSTEM_PROMPT,
+        prompt: buildCheckDescriptionPrompt(input),
+        temperature: 0,
+      });
+
+      // Server-side backstop: if Haiku slipped past the prompt and emitted
+      // a compliance control number or URL, refuse to cache it. Callers
+      // get null and the UI falls back to existing content.
+      const violation = findForbiddenContent(object);
+      if (violation) {
+        this.logger.warn(
+          `AI description for "${input.title}" rejected: ${violation.field} matched forbidden pattern ${violation.pattern}`,
+        );
+        return null;
+      }
+
+      return object;
+    } catch (err) {
+      this.logger.error(
+        `AI description generation failed for "${input.title}": ${err instanceof Error ? err.message : String(err)}`,
+      );
+      return null;
+    }
+  }
+}
diff --git a/apps/api/src/cloud-security/check-definition-provider-passthrough.ts b/apps/api/src/cloud-security/check-definition-provider-passthrough.ts
new file mode 100644
index 0000000000..1aadc588ed
--- /dev/null
+++ b/apps/api/src/cloud-security/check-definition-provider-passthrough.ts
@@ -0,0 +1,89 @@
+/**
+ * GCP/Azure check descriptions are NOT generated by AI — they're surfaced
+ * directly from the provider's own evidence payload, which already
+ * contains auditor-grade descriptions written by Google / Microsoft.
+ *
+ * This module isolates the per-provider mapping so the main
+ * CheckDefinitionService stays focused on cache + AI orchestration.
+ */
+
+import type { ResolvedCheckDescription } from './check-definition.service';
+
+export interface PassthroughInput {
+  provider: 'gcp' | 'azure' | string;
+  title: string;
+  description: string | null;
+  evidence: Record<string, unknown> | null;
+}
+
+function humanizeCategory(category: string): string {
+  return category
+    .toLowerCase()
+    .replace(/_/g, ' ')
+    .replace(/\b\w/g, (c) => c.toUpperCase());
+}
+
+function fromGcpEvidence(
+  input: PassthroughInput,
+): ResolvedCheckDescription | null {
+  if (!input.evidence) return null;
+  const category =
+    typeof input.evidence.category === 'string'
+      ? input.evidence.category
+      : null;
+  const findingClass =
+    typeof input.evidence.findingClass === 'string'
+      ? input.evidence.findingClass
+      : null;
+  if (!category) return null;
+
+  return {
+    title: input.title,
+    description: input.description ?? humanizeCategory(category),
+    passCriteria: `No ${category
+      .toLowerCase()
+      .replace(/_/g, ' ')} detected by Google Security Command Center.`,
+    failCriteria: input.description
+      ? input.description
+      : `Google Security Command Center flagged this resource under category ${category}.`,
+    whyItMatters: findingClass
+      ? `Google classifies this finding as a "${findingClass}" — addressing it reduces the underlying security risk Google identified.`
+      : 'Findings from Google Security Command Center indicate a security concern Google detected in the customer environment.',
+    source: 'provider',
+  };
+}
+
+function fromAzureEvidence(
+  input: PassthroughInput,
+): ResolvedCheckDescription | null {
+  const alertType =
+    input.evidence && typeof input.evidence.alertType === 'string'
+      ? input.evidence.alertType
+      : input.evidence && typeof input.evidence.serviceName === 'string'
+        ? (input.evidence.serviceName as string)
+        : null;
+
+  return {
+    title: input.title,
+    description:
+      input.description ??
+      'Surfaced from Microsoft Defender for Cloud. Defender flagged this resource as not meeting its recommended secure configuration.',
+    passCriteria:
+      'Microsoft Defender for Cloud reports the resource as healthy.',
+    failCriteria: input.description
+      ? input.description
+      : 'Microsoft Defender for Cloud reports the resource as unhealthy.',
+    whyItMatters: alertType
+      ? `Defender raised this finding under "${alertType}" — addressing it brings the resource in line with Microsoft\'s recommended configuration.`
+      : 'Defender for Cloud findings indicate a deviation from Microsoft-recommended secure configuration in the customer environment.',
+    source: 'provider',
+  };
+}
+
+export function buildProviderPassthroughDescription(
+  input: PassthroughInput,
+): ResolvedCheckDescription | null {
+  if (input.provider === 'gcp') return fromGcpEvidence(input);
+  if (input.provider === 'azure') return fromAzureEvidence(input);
+  return null;
+}
diff --git a/apps/api/src/cloud-security/check-definition.service.spec.ts b/apps/api/src/cloud-security/check-definition.service.spec.ts
new file mode 100644
index 0000000000..c9f45aa777
--- /dev/null
+++ b/apps/api/src/cloud-security/check-definition.service.spec.ts
@@ -0,0 +1,57 @@
+import { normalizeCheckId } from './check-definition.utils';
+
+// We test the pure-function exports here. The full CheckDefinitionService
+// orchestration (db + ai) is covered by integration patterns; this file
+// focuses on the normalization logic that determines cache identity —
+// getting that wrong silently breaks the per-org cache.
+
+describe('normalizeCheckId', () => {
+  it('returns the input unchanged when resourceId is null', () => {
+    expect(normalizeCheckId('iam-no-password-policy', null)).toBe(
+      'iam-no-password-policy',
+    );
+  });
+
+  it('strips a resource-specific suffix matching the resourceId', () => {
+    expect(normalizeCheckId('iam-no-mfa-john', 'john')).toBe('iam-no-mfa');
+    expect(normalizeCheckId('cloudtrail-not-logging-prod-trail', 'prod-trail')).toBe(
+      'cloudtrail-not-logging',
+    );
+  });
+
+  it('returns input unchanged when resourceId is "account-level"', () => {
+    // Fixed-id checks use 'account-level' as a placeholder resourceId.
+    // No suffix to strip.
+    expect(normalizeCheckId('iam-no-password-policy', 'account-level')).toBe(
+      'iam-no-password-policy',
+    );
+  });
+
+  it('handles compound resourceIds by trying each path segment', () => {
+    // e.g. AWS API Gateway uses "${apiId}/${routeKey}" as resourceId.
+    expect(
+      normalizeCheckId('apigw-no-auth-abc123-route-1', 'abc123/route-1'),
+    ).toBe('apigw-no-auth-abc123');
+  });
+
+  it('returns the input unchanged when no suffix can be matched', () => {
+    expect(normalizeCheckId('iam-no-mfa', 'unrelated-resource')).toBe(
+      'iam-no-mfa',
+    );
+  });
+
+  it('preserves uniqueness across DIFFERENT check types for the same resource', () => {
+    // Sanity: two findings on the same resource but different checks should
+    // normalize to different keys so the cache stays correct.
+    expect(normalizeCheckId('iam-no-mfa-john', 'john')).not.toBe(
+      normalizeCheckId('iam-no-access-keys-john', 'john'),
+    );
+  });
+
+  it('produces the same normalized key for two resources of the same check', () => {
+    // The cache benefit: different users, same check → one cache entry.
+    expect(normalizeCheckId('iam-no-mfa-john', 'john')).toBe(
+      normalizeCheckId('iam-no-mfa-alice', 'alice'),
+    );
+  });
+});
diff --git a/apps/api/src/cloud-security/check-definition.service.ts b/apps/api/src/cloud-security/check-definition.service.ts
new file mode 100644
index 0000000000..2ffa636d16
--- /dev/null
+++ b/apps/api/src/cloud-security/check-definition.service.ts
@@ -0,0 +1,239 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { db } from '@db';
+import { AiDescriptionService, DESCRIPTION_MODEL_VERSION } from './ai-description.service';
+import type { CheckDescription } from './ai-description.prompt';
+import { buildProviderPassthroughDescription } from './check-definition-provider-passthrough';
+import { computeSourceHash, normalizeCheckId } from './check-definition.utils';
+
+export { normalizeCheckId };
+
+/**
+ * The CheckDescription returned to clients. `source` lets the UI render a
+ * subtle hint about whether the content was AI-generated (AWS) or
+ * surfaced directly from the cloud provider's own catalog (GCP / Azure).
+ */
+export interface ResolvedCheckDescription extends CheckDescription {
+  source: 'ai' | 'provider';
+}
+
+export interface CheckDescriptionRequest {
+  organizationId: string;
+  /** Normalized, resource-agnostic check identifier — see normalizeCheckId. */
+  checkId: string;
+  provider: 'aws' | 'gcp' | 'azure' | string;
+  serviceName: string | null;
+  /** Per-finding title / description / remediation — the SOURCE we hash. */
+  title: string;
+  description: string | null;
+  severity: string | null;
+  remediation: string | null;
+  /** Raw evidence — used for GCP/Azure passthrough only. */
+  evidence: Record<string, unknown> | null;
+}
+
+
+@Injectable()
+export class CheckDefinitionService {
+  private readonly logger = new Logger(CheckDefinitionService.name);
+
+  constructor(private readonly aiDescription: AiDescriptionService) {}
+
+  /**
+   * Resolve a check description for a finding by its ID. Scoped to the
+   * caller's organization to prevent cross-tenant leaks. Returns null
+   * when the finding doesn't exist or no useful description can be
+   * produced (UI degrades gracefully).
+   */
+  async getForFinding(
+    findingId: string,
+    organizationId: string,
+  ): Promise<ResolvedCheckDescription | null> {
+    const request = await this.resolveFindingToRequest(
+      findingId,
+      organizationId,
+    );
+    if (!request) return null;
+    return this.getOrCreate(request);
+  }
+
+  private async resolveFindingToRequest(
+    findingId: string,
+    organizationId: string,
+  ): Promise<CheckDescriptionRequest | null> {
+    // Try new-platform first (IntegrationCheckResult — id prefix `icx_`).
+    const newResult = await db.integrationCheckResult.findFirst({
+      where: {
+        id: findingId,
+        checkRun: { connection: { organizationId } },
+      },
+      select: {
+        title: true,
+        description: true,
+        severity: true,
+        remediation: true,
+        resourceId: true,
+        evidence: true,
+        checkRun: {
+          select: {
+            checkId: true,
+            connection: { select: { provider: { select: { slug: true } } } },
+          },
+        },
+      },
+    });
+
+    if (newResult) {
+      const evidence =
+        newResult.evidence && typeof newResult.evidence === 'object'
+          ? (newResult.evidence as Record<string, unknown>)
+          : null;
+      const findingKey =
+        evidence && typeof evidence.findingKey === 'string'
+          ? evidence.findingKey
+          : newResult.checkRun.checkId;
+      const serviceName =
+        evidence && typeof evidence.serviceName === 'string'
+          ? evidence.serviceName
+          : evidence && typeof evidence.service === 'string'
+            ? evidence.service
+            : null;
+      return {
+        organizationId,
+        checkId: normalizeCheckId(findingKey, newResult.resourceId),
+        provider: newResult.checkRun.connection.provider.slug,
+        serviceName,
+        title: newResult.title ?? '',
+        description: newResult.description,
+        severity: newResult.severity,
+        remediation: newResult.remediation,
+        evidence,
+      };
+    }
+
+    // Fall back to legacy IntegrationResult (id prefix `itr_`).
+    const legacy = await db.integrationResult.findFirst({
+      where: { id: findingId, organizationId },
+      select: {
+        title: true,
+        description: true,
+        severity: true,
+        remediation: true,
+        resultDetails: true,
+        integration: { select: { integrationId: true } },
+      },
+    });
+
+    if (!legacy) return null;
+
+    const details =
+      legacy.resultDetails && typeof legacy.resultDetails === 'object'
+        ? (legacy.resultDetails as Record<string, unknown>)
+        : null;
+    return {
+      organizationId,
+      // Legacy results have no granular checkKey — use title as the cache key
+      // (low-fidelity but stable across instances).
+      checkId: legacy.title ?? findingId,
+      provider: legacy.integration.integrationId,
+      serviceName: null,
+      title: legacy.title ?? '',
+      description: legacy.description,
+      severity: legacy.severity,
+      remediation: legacy.remediation,
+      evidence: details,
+    };
+  }
+
+  /**
+   * Resolve a check description for a finding.
+   *
+   * - AWS: cached per (orgId, checkId) with source-hash invalidation.
+   *   First-view triggers a Haiku call (~1-2s); all subsequent views and
+   *   all other findings of the same check type hit the cache (~50ms).
+   * - GCP / Azure: derived synchronously from provider evidence — no AI,
+   *   no DB cache. Returns null when evidence doesn't carry enough context.
+   */
+  async getOrCreate(
+    req: CheckDescriptionRequest,
+  ): Promise<ResolvedCheckDescription | null> {
+    if (req.provider === 'gcp' || req.provider === 'azure') {
+      return buildProviderPassthroughDescription({
+        provider: req.provider,
+        title: req.title,
+        description: req.description,
+        evidence: req.evidence,
+      });
+    }
+    return this.fromCacheOrGenerate(req);
+  }
+
+  private async fromCacheOrGenerate(
+    req: CheckDescriptionRequest,
+  ): Promise<ResolvedCheckDescription | null> {
+    const sourceHash = computeSourceHash(req);
+
+    const cached = await db.checkDefinition.findUnique({
+      where: {
+        organizationId_checkId: {
+          organizationId: req.organizationId,
+          checkId: req.checkId,
+        },
+      },
+    });
+
+    if (cached && cached.sourceHash === sourceHash) {
+      return {
+        title: cached.title,
+        description: cached.description,
+        passCriteria: cached.passCriteria,
+        failCriteria: cached.failCriteria,
+        whyItMatters: cached.whyItMatters,
+        source: 'ai',
+      };
+    }
+
+    const generated = await this.aiDescription.generate({
+      provider: req.provider,
+      serviceName: req.serviceName,
+      title: req.title,
+      description: req.description,
+      severity: req.severity,
+      remediation: req.remediation,
+    });
+
+    if (!generated) return null;
+
+    try {
+      await db.checkDefinition.upsert({
+        where: {
+          organizationId_checkId: {
+            organizationId: req.organizationId,
+            checkId: req.checkId,
+          },
+        },
+        create: {
+          organizationId: req.organizationId,
+          checkId: req.checkId,
+          sourceHash,
+          modelVersion: DESCRIPTION_MODEL_VERSION,
+          ...generated,
+        },
+        update: {
+          sourceHash,
+          modelVersion: DESCRIPTION_MODEL_VERSION,
+          generatedAt: new Date(),
+          ...generated,
+        },
+      });
+    } catch (err) {
+      // Persist failure shouldn't break the read path — log and serve the
+      // freshly-generated content anyway.
+      this.logger.warn(
+        `CheckDefinition cache write failed for ${req.checkId}: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+
+    return { ...generated, source: 'ai' };
+  }
+
+}
diff --git a/apps/api/src/cloud-security/check-definition.utils.ts b/apps/api/src/cloud-security/check-definition.utils.ts
new file mode 100644
index 0000000000..5b67ef314e
--- /dev/null
+++ b/apps/api/src/cloud-security/check-definition.utils.ts
@@ -0,0 +1,67 @@
+/**
+ * Pure helpers shared between CheckDefinitionService and its tests.
+ * Kept in a separate file so tests can import them without pulling in
+ * the Prisma client (which throws at import time when DATABASE_URL is
+ * missing in a unit-test env).
+ */
+
+import { createHash } from 'node:crypto';
+import { DESCRIPTION_MODEL_VERSION } from './ai-description.service';
+
+/**
+ * Strip the resource-specific suffix from a finding's `findingKey` so all
+ * resource instances of the same check share a single cache entry.
+ *
+ * Examples:
+ *   ("iam-no-mfa-john", "john")                       -> "iam-no-mfa"
+ *   ("cloudtrail-not-logging-prod-trail", "prod-trail") -> "cloudtrail-not-logging"
+ *   ("iam-no-password-policy", "account-level")       -> "iam-no-password-policy"
+ */
+export function normalizeCheckId(
+  findingKey: string,
+  resourceId: string | null,
+): string {
+  if (!resourceId) return findingKey;
+
+  const suffix = `-${resourceId}`;
+  if (findingKey.endsWith(suffix)) {
+    return findingKey.slice(0, -suffix.length);
+  }
+  // Try each segment of compound resource ids (e.g. "api/route-1" -> ["api", "route-1"]).
+  for (const segment of resourceId.split(/[/.]/)) {
+    if (!segment) continue;
+    const segSuffix = `-${segment}`;
+    if (findingKey.endsWith(segSuffix)) {
+      return findingKey.slice(0, -segSuffix.length);
+    }
+  }
+  return findingKey;
+}
+
+export interface SourceHashInput {
+  provider: string;
+  serviceName: string | null;
+  title: string;
+  description: string | null;
+  severity: string | null;
+  remediation: string | null;
+}
+
+/**
+ * Hash of the inputs that drive Haiku output. When this changes — because
+ * the adapter altered the finding's title/description/severity/remediation
+ * — the cache entry is regenerated on the next view. Includes the model
+ * version so flipping DESCRIPTION_MODEL_VERSION forces a global refresh.
+ */
+export function computeSourceHash(input: SourceHashInput): string {
+  const payload = JSON.stringify({
+    provider: input.provider,
+    serviceName: input.serviceName,
+    title: input.title,
+    description: input.description,
+    severity: input.severity,
+    remediation: input.remediation,
+    model: DESCRIPTION_MODEL_VERSION,
+  });
+  return createHash('sha256').update(payload).digest('hex');
+}
diff --git a/apps/api/src/cloud-security/cloud-security-audit.ts b/apps/api/src/cloud-security/cloud-security-audit.ts
index 75285b6827..9e3f4ea0b9 100644
--- a/apps/api/src/cloud-security/cloud-security-audit.ts
+++ b/apps/api/src/cloud-security/cloud-security-audit.ts
@@ -11,7 +11,9 @@ interface CloudSecurityAuditParams {
     | 'remediation_failed'
     | 'rollback_executed'
     | 'rollback_failed'
-    | 'service_toggled';
+    | 'service_toggled'
+    | 'exception_marked'
+    | 'exception_revoked';
   description: string;
   metadata?: Record<string, unknown>;
 }
diff --git a/apps/api/src/cloud-security/cloud-security-query.legacy.ts b/apps/api/src/cloud-security/cloud-security-query.legacy.ts
new file mode 100644
index 0000000000..e6984cc0c5
--- /dev/null
+++ b/apps/api/src/cloud-security/cloud-security-query.legacy.ts
@@ -0,0 +1,89 @@
+/**
+ * Legacy (pre-integration-platform) cloud security queries.
+ *
+ * Extracted from cloud-security-query.service.ts so the main service stays
+ * under the 300-line cap and so the legacy path can be deleted as a unit
+ * once the legacy Integration / IntegrationResult tables are retired.
+ */
+
+import { db } from '@db';
+import { sanitizeEvidence } from './evidence-sanitizer';
+import type { CloudFinding } from './cloud-security-query.types';
+
+const CLOUD_PROVIDER_SLUGS = ['aws', 'gcp', 'azure'] as const;
+
+/** Scan window for filtering legacy results to latest scan only */
+const SCAN_WINDOW_MS = 10 * 60 * 1000; // 10 minutes
+
+export async function getLegacyFindings(
+  organizationId: string,
+): Promise<CloudFinding[]> {
+  const legacyIntegrations = await db.integration.findMany({
+    where: { organizationId },
+  });
+
+  const activeLegacy = legacyIntegrations.filter((i) =>
+    (CLOUD_PROVIDER_SLUGS as readonly string[]).includes(i.integrationId),
+  );
+
+  const legacyIds = activeLegacy.map((i) => i.id);
+  if (legacyIds.length === 0) return [];
+
+  const lastRunMap = new Map(
+    activeLegacy.filter((i) => i.lastRunAt).map((i) => [i.id, i.lastRunAt!]),
+  );
+
+  const results = await db.integrationResult.findMany({
+    where: { integrationId: { in: legacyIds } },
+    select: {
+      id: true,
+      title: true,
+      description: true,
+      remediation: true,
+      status: true,
+      severity: true,
+      completedAt: true,
+      resultDetails: true,
+      integration: {
+        select: { integrationId: true, id: true, lastRunAt: true },
+      },
+    },
+    orderBy: { completedAt: 'desc' },
+  });
+
+  // Only include results from the most recent scan window per integration.
+  const filtered = results.filter((result) => {
+    const lastRunAt = lastRunMap.get(result.integration.id);
+    if (!lastRunAt) return result.completedAt !== null;
+    if (!result.completedAt) return false;
+
+    const lastRunTime = lastRunAt.getTime();
+    const completedTime = result.completedAt.getTime();
+    return (
+      completedTime <= lastRunTime &&
+      completedTime >= lastRunTime - SCAN_WINDOW_MS
+    );
+  });
+
+  return filtered.map((result) => ({
+    id: result.id,
+    title: result.title,
+    description: result.description,
+    remediation: result.remediation,
+    status: result.status,
+    severity: result.severity,
+    completedAt: result.completedAt,
+    connectionId: result.integration.id,
+    providerSlug: result.integration.integrationId,
+    serviceId: null,
+    findingKey: null,
+    resourceId: null,
+    // Legacy IntegrationResult model has neither resourceType nor checkId
+    resourceType: null,
+    checkId: null,
+    checkKey: null,
+    evidence: sanitizeEvidence(result.resultDetails ?? null),
+    projectDisplayName: null,
+    integration: { integrationId: result.integration.integrationId },
+  }));
+}
diff --git a/apps/api/src/cloud-security/cloud-security-query.service.ts b/apps/api/src/cloud-security/cloud-security-query.service.ts
index 1cdba70c00..2388b5324b 100644
--- a/apps/api/src/cloud-security/cloud-security-query.service.ts
+++ b/apps/api/src/cloud-security/cloud-security-query.service.ts
@@ -1,12 +1,21 @@
 import { Injectable } from '@nestjs/common';
 import { db } from '@db';
 import { getManifest } from '@trycompai/integration-platform';
+import { sanitizeEvidence } from './evidence-sanitizer';
+import { getLegacyFindings } from './cloud-security-query.legacy';
+import { normalizeCheckId } from './check-definition.utils';
+import type {
+  CloudFinding,
+  CloudProvider,
+  CloudProviderLatestRun,
+} from './cloud-security-query.types';
+
+// Re-export so existing imports of CloudProvider/CloudFinding from the service
+// path keep working (the controller imports them).
+export type { CloudFinding, CloudProvider, CloudProviderLatestRun };
 
 const CLOUD_PROVIDER_SLUGS = ['aws', 'gcp', 'azure'] as const;
 
-/** Scan window for filtering legacy results to latest scan only */
-const SCAN_WINDOW_MS = 10 * 60 * 1000; // 10 minutes
-
 /** Extract project ID from a GCP resource path like //iam.googleapis.com/projects/my-proj/... */
 function extractProjectIdFromResource(
   resourceId: string | null,
@@ -16,45 +25,6 @@ function extractProjectIdFromResource(
   return match?.[1] ?? null;
 }
 
-export interface CloudProvider {
-  id: string;
-  integrationId: string;
-  name: string;
-  displayName?: string;
-  organizationId: string;
-  lastRunAt: Date | null;
-  status: string;
-  createdAt: Date;
-  updatedAt: Date;
-  reconnectedAt?: Date;
-  isLegacy: boolean;
-  variables: Record<string, unknown> | null;
-  requiredVariables: string[];
-  accountId?: string;
-  awsType?: string;
-  regions?: string[];
-  tenantId?: string;
-  subscriptionId?: string;
-  supportsMultipleConnections?: boolean;
-}
-
-export interface CloudFinding {
-  id: string;
-  title: string | null;
-  description: string | null;
-  remediation: string | null;
-  status: string | null;
-  severity: string | null;
-  completedAt: Date | null;
-  connectionId: string;
-  providerSlug: string;
-  serviceId: string | null;
-  findingKey: string | null;
-  resourceId: string | null;
-  projectDisplayName: string | null;
-  integration: { integrationId: string };
-}
-
 /** Get required variables from manifest (both manifest-level and check-level) */
 function getRequiredVariables(providerSlug: string): string[] {
   const manifest = getManifest(providerSlug);
@@ -103,6 +73,12 @@ export class CloudSecurityQueryService {
       (CLOUD_PROVIDER_SLUGS as readonly string[]).includes(i.integrationId),
     );
 
+    // Per-connection latest scan summary for new-platform connections — one
+    // query, distinct-by-connection so we get only the most recent run each.
+    const latestRunByConnection = await this.getLatestRunsByConnection(
+      newConnections.map((c) => c.id),
+    );
+
     // Map new connections
     const newProviders: CloudProvider[] = newConnections.map((conn) => {
       const metadata = (conn.metadata || {}) as Record<string, unknown>;
@@ -147,6 +123,7 @@ export class CloudSecurityQueryService {
             : undefined,
         supportsMultipleConnections:
           manifest?.supportsMultipleConnections ?? false,
+        latestRun: latestRunByConnection.get(conn.id) ?? null,
       };
     });
 
@@ -187,21 +164,107 @@ export class CloudSecurityQueryService {
             : undefined,
         supportsMultipleConnections:
           manifest?.supportsMultipleConnections ?? false,
+        latestRun: integration.lastRunAt
+          ? {
+              completedAt: integration.lastRunAt,
+              durationMs: null,
+              totalChecked: null,
+              passedCount: null,
+              failedCount: null,
+              status: 'success',
+            }
+          : null,
       };
     });
 
     return [...newProviders, ...legacyProviders];
   }
 
-  async getFindings(organizationId: string): Promise<CloudFinding[]> {
-    const newFindings = await this.getNewPlatformFindings(organizationId);
-    const legacyFindings = await this.getLegacyFindings(organizationId);
+  async getFindings(
+    organizationId: string,
+    options: { includeExceptions?: boolean } = {},
+  ): Promise<CloudFinding[]> {
+    const [newFindings, legacyFindings] = await Promise.all([
+      this.getNewPlatformFindings(organizationId),
+      getLegacyFindings(organizationId),
+    ]);
 
-    return [...newFindings, ...legacyFindings].sort((a, b) => {
+    const combined = [...newFindings, ...legacyFindings].sort((a, b) => {
       const dateA = a.completedAt ? new Date(a.completedAt).getTime() : 0;
       const dateB = b.completedAt ? new Date(b.completedAt).getTime() : 0;
       return dateB - dateA;
     });
+
+    if (options.includeExceptions) return combined;
+
+    // Filter out findings under an active (non-revoked, non-expired)
+    // FindingException. Looked up in one query keyed by org so the cost
+    // stays constant regardless of finding count.
+    const activeExceptionKeys = await this.loadActiveExceptionKeys(organizationId);
+    if (activeExceptionKeys.size === 0) return combined;
+
+    return combined.filter((finding) => {
+      if (!finding.checkKey || !finding.resourceId) return true;
+      const key = `${finding.connectionId}::${finding.checkKey}::${finding.resourceId}`;
+      return !activeExceptionKeys.has(key);
+    });
+  }
+
+  /**
+   * Return the set of (connectionId, checkId, resourceId) tuples that have
+   * an active exception in this org. One DB query per getFindings call.
+   */
+  private async loadActiveExceptionKeys(
+    organizationId: string,
+  ): Promise<Set<string>> {
+    const active = await db.findingException.findMany({
+      where: {
+        organizationId,
+        revokedAt: null,
+        OR: [{ expiresAt: null }, { expiresAt: { gt: new Date() } }],
+      },
+      select: { connectionId: true, checkId: true, resourceId: true },
+    });
+    return new Set(
+      active.map((e) => `${e.connectionId}::${e.checkId}::${e.resourceId}`),
+    );
+  }
+
+  private async getLatestRunsByConnection(
+    connectionIds: string[],
+  ): Promise<Map<string, CloudProviderLatestRun>> {
+    if (connectionIds.length === 0) return new Map();
+
+    const runs = await db.integrationCheckRun.findMany({
+      where: {
+        connectionId: { in: connectionIds },
+        status: { in: ['success', 'failed'] },
+      },
+      orderBy: { completedAt: 'desc' },
+      distinct: ['connectionId'],
+      select: {
+        connectionId: true,
+        completedAt: true,
+        durationMs: true,
+        totalChecked: true,
+        passedCount: true,
+        failedCount: true,
+        status: true,
+      },
+    });
+
+    const map = new Map<string, CloudProviderLatestRun>();
+    for (const run of runs) {
+      map.set(run.connectionId, {
+        completedAt: run.completedAt,
+        durationMs: run.durationMs,
+        totalChecked: run.totalChecked,
+        passedCount: run.passedCount,
+        failedCount: run.failedCount,
+        status: run.status,
+      });
+    }
+    return map;
   }
 
   private async getNewPlatformFindings(
@@ -242,7 +305,12 @@ export class CloudSecurityQueryService {
       },
       orderBy: { completedAt: 'desc' },
       distinct: ['connectionId'],
-      select: { id: true, connectionId: true, status: true },
+      select: {
+        id: true,
+        connectionId: true,
+        status: true,
+        checkId: true,
+      },
     });
 
     const latestRunIds = latestRuns.map((r) => r.id);
@@ -263,6 +331,7 @@ export class CloudSecurityQueryService {
         passed: true,
         evidence: true,
         resourceId: true,
+        resourceType: true,
       },
       orderBy: { collectedAt: 'desc' },
     });
@@ -272,7 +341,14 @@ export class CloudSecurityQueryService {
       const slug = checkRun
         ? connectionToSlug[checkRun.connectionId] || 'unknown'
         : 'unknown';
-      const evidence = (result.evidence ?? {}) as Record<string, unknown>;
+      const rawEvidence = (result.evidence ?? {}) as Record<string, unknown>;
+      // Read service/finding hints from raw evidence BEFORE sanitization — these
+      // are non-sensitive metadata fields the UI groups and filters by.
+      const serviceId = (rawEvidence.serviceId as string) ?? null;
+      const findingKey = (rawEvidence.findingKey as string) ?? null;
+      const projectDisplayNameFromEvidence = rawEvidence.projectDisplayName as
+        | string
+        | undefined;
       return {
         id: result.id,
         title: result.title,
@@ -283,14 +359,19 @@ export class CloudSecurityQueryService {
         completedAt: result.collectedAt,
         connectionId: checkRun?.connectionId ?? '',
         providerSlug: slug,
-        serviceId: (evidence.serviceId as string) ?? null,
-        findingKey: (evidence.findingKey as string) ?? null,
+        serviceId,
+        findingKey,
         resourceId: result.resourceId ?? null,
+        resourceType: result.resourceType ?? null,
+        checkId: checkRun?.checkId ?? null,
+        checkKey: findingKey
+          ? normalizeCheckId(findingKey, result.resourceId)
+          : null,
+        evidence: sanitizeEvidence(result.evidence ?? null),
         projectDisplayName: (() => {
-          const fromEvidence = evidence.projectDisplayName as
-            | string
-            | undefined;
-          if (fromEvidence) return fromEvidence;
+          if (projectDisplayNameFromEvidence) {
+            return projectDisplayNameFromEvidence;
+          }
           const projectId = extractProjectIdFromResource(result.resourceId);
           if (!projectId) return null;
           return projectNameMap.get(projectId) ?? projectId;
@@ -299,71 +380,4 @@ export class CloudSecurityQueryService {
       };
     });
   }
-
-  private async getLegacyFindings(
-    organizationId: string,
-  ): Promise<CloudFinding[]> {
-    const legacyIntegrations = await db.integration.findMany({
-      where: { organizationId },
-    });
-
-    const activeLegacy = legacyIntegrations.filter((i) =>
-      (CLOUD_PROVIDER_SLUGS as readonly string[]).includes(i.integrationId),
-    );
-
-    const legacyIds = activeLegacy.map((i) => i.id);
-    if (legacyIds.length === 0) return [];
-
-    const lastRunMap = new Map(
-      activeLegacy.filter((i) => i.lastRunAt).map((i) => [i.id, i.lastRunAt!]),
-    );
-
-    const results = await db.integrationResult.findMany({
-      where: { integrationId: { in: legacyIds } },
-      select: {
-        id: true,
-        title: true,
-        description: true,
-        remediation: true,
-        status: true,
-        severity: true,
-        completedAt: true,
-        integration: {
-          select: { integrationId: true, id: true, lastRunAt: true },
-        },
-      },
-      orderBy: { completedAt: 'desc' },
-    });
-
-    // Filter to only include results from the most recent scan
-    const filtered = results.filter((result) => {
-      const lastRunAt = lastRunMap.get(result.integration.id);
-      if (!lastRunAt) return result.completedAt !== null;
-      if (!result.completedAt) return false;
-
-      const lastRunTime = lastRunAt.getTime();
-      const completedTime = result.completedAt.getTime();
-      return (
-        completedTime <= lastRunTime &&
-        completedTime >= lastRunTime - SCAN_WINDOW_MS
-      );
-    });
-
-    return filtered.map((result) => ({
-      id: result.id,
-      title: result.title,
-      description: result.description,
-      remediation: result.remediation,
-      status: result.status,
-      severity: result.severity,
-      completedAt: result.completedAt,
-      connectionId: result.integration.id,
-      providerSlug: result.integration.integrationId,
-      serviceId: null,
-      findingKey: null,
-      resourceId: null,
-      projectDisplayName: null,
-      integration: { integrationId: result.integration.integrationId },
-    }));
-  }
 }
diff --git a/apps/api/src/cloud-security/cloud-security-query.types.ts b/apps/api/src/cloud-security/cloud-security-query.types.ts
new file mode 100644
index 0000000000..bdd5daf6e0
--- /dev/null
+++ b/apps/api/src/cloud-security/cloud-security-query.types.ts
@@ -0,0 +1,73 @@
+/**
+ * Public response shapes for /v1/cloud-security/providers and /findings.
+ * Extracted from cloud-security-query.service.ts to keep that file under the
+ * 300-line cap. The service and legacy helpers both import from here.
+ */
+
+/**
+ * Summary of the most recent successful (or failed) scan for a connection.
+ * Surfaced on the providers payload so the UI can show "47 checks evaluated,
+ * 41 passed, 6 failed, ran 12s ago, duration 3.2s" without a second fetch.
+ *
+ * Legacy connections only populate `completedAt` (and `status: 'success'`)
+ * because per-run counts are not stored in the legacy Integration model.
+ */
+export interface CloudProviderLatestRun {
+  completedAt: Date | null;
+  durationMs: number | null;
+  totalChecked: number | null;
+  passedCount: number | null;
+  failedCount: number | null;
+  status: string;
+}
+
+export interface CloudProvider {
+  id: string;
+  integrationId: string;
+  name: string;
+  displayName?: string;
+  organizationId: string;
+  lastRunAt: Date | null;
+  status: string;
+  createdAt: Date;
+  updatedAt: Date;
+  reconnectedAt?: Date;
+  isLegacy: boolean;
+  variables: Record<string, unknown> | null;
+  requiredVariables: string[];
+  accountId?: string;
+  awsType?: string;
+  regions?: string[];
+  tenantId?: string;
+  subscriptionId?: string;
+  supportsMultipleConnections?: boolean;
+  latestRun: CloudProviderLatestRun | null;
+}
+
+export interface CloudFinding {
+  id: string;
+  title: string | null;
+  description: string | null;
+  remediation: string | null;
+  status: string | null;
+  severity: string | null;
+  completedAt: Date | null;
+  connectionId: string;
+  providerSlug: string;
+  serviceId: string | null;
+  findingKey: string | null;
+  resourceId: string | null;
+  resourceType: string | null;
+  /** Run-level checkId (e.g. "aws-security-scan") — coarse, identifies the scan kind. */
+  checkId: string | null;
+  /**
+   * Normalized per-check identifier (e.g. "iam-no-mfa"), shared by every
+   * resource instance of the same logical check. Used by the UI to group
+   * findings into check sub-groups and by Phase 2 caching.
+   */
+  checkKey: string | null;
+  /** Sanitized provider payload — sensitive keys redacted by evidence-sanitizer. */
+  evidence: unknown;
+  projectDisplayName: string | null;
+  integration: { integrationId: string };
+}
diff --git a/apps/api/src/cloud-security/cloud-security.controller.ts b/apps/api/src/cloud-security/cloud-security.controller.ts
index e2ba7e4b55..8189f11929 100644
--- a/apps/api/src/cloud-security/cloud-security.controller.ts
+++ b/apps/api/src/cloud-security/cloud-security.controller.ts
@@ -24,6 +24,10 @@ import {
 } from './cloud-security.service';
 import { CloudSecurityQueryService } from './cloud-security-query.service';
 import { CloudSecurityLegacyService } from './cloud-security-legacy.service';
+import { CheckDefinitionService } from './check-definition.service';
+import { CloudExceptionService } from './exception.service';
+import { CloudHistoryService } from './history.service';
+import { MarkExceptionDto } from './dto/mark-exception.dto';
 import { logCloudSecurityActivity } from './cloud-security-audit';
 import { CloudSecurityActivityService } from './cloud-security-activity.service';
 import {
@@ -44,6 +48,9 @@ export class CloudSecurityController {
     private readonly activityService: CloudSecurityActivityService,
     private readonly gcpSecurityService: GCPSecurityService,
     private readonly azureSecurityService: AzureSecurityService,
+    private readonly checkDefinitionService: CheckDefinitionService,
+    private readonly exceptionService: CloudExceptionService,
+    private readonly historyService: CloudHistoryService,
   ) {}
 
   @Get('activity')
@@ -96,6 +103,103 @@ export class CloudSecurityController {
     return { data: findings, count: findings.length };
   }
 
+  @Post('findings/:findingId/exception')
+  @UseGuards(HybridAuthGuard, PermissionGuard)
+  @RequirePermission('integration', 'update')
+  @ApiOperation({
+    summary:
+      'Mark a finding as an exception so it no longer appears in the active Scan Results list',
+  })
+  async markFindingAsException(
+    @Param('findingId') findingId: string,
+    @Body() body: MarkExceptionDto,
+    @OrganizationId() organizationId: string,
+    @Req() req: { userId?: string },
+  ) {
+    if (!req.userId) {
+      throw new HttpException(
+        'Marking an exception requires session authentication.',
+        HttpStatus.UNAUTHORIZED,
+      );
+    }
+    const result = await this.exceptionService.markAsException({
+      findingId,
+      organizationId,
+      userId: req.userId,
+      reason: body.reason,
+      reviewedBy: body.reviewedBy ?? null,
+      expiresAt: body.expiresAt ? new Date(body.expiresAt) : null,
+    });
+    return { data: result };
+  }
+
+  @Delete('exceptions/:exceptionId')
+  @UseGuards(HybridAuthGuard, PermissionGuard)
+  @RequirePermission('integration', 'update')
+  @ApiOperation({ summary: 'Revoke an exception, reopening the finding' })
+  async revokeException(
+    @Param('exceptionId') exceptionId: string,
+    @OrganizationId() organizationId: string,
+    @Req() req: { userId?: string },
+  ) {
+    if (!req.userId) {
+      throw new HttpException(
+        'Revoking an exception requires session authentication.',
+        HttpStatus.UNAUTHORIZED,
+      );
+    }
+    await this.exceptionService.revokeException({
+      exceptionId,
+      organizationId,
+      userId: req.userId,
+    });
+    return { success: true };
+  }
+
+  @Get('history')
+  @SkipThrottle()
+  @UseGuards(HybridAuthGuard, PermissionGuard)
+  @RequirePermission('integration', 'read')
+  @ApiOperation({
+    summary:
+      'List resolution, exception, and regression history for a connection',
+  })
+  async getHistory(
+    @Query('connectionId') connectionId: string,
+    @OrganizationId() organizationId: string,
+  ) {
+    if (!connectionId) {
+      throw new HttpException(
+        'connectionId query parameter is required',
+        HttpStatus.BAD_REQUEST,
+      );
+    }
+    const history = await this.historyService.getHistory({
+      organizationId,
+      connectionId,
+    });
+    return { data: history };
+  }
+
+  @Get('findings/:findingId/check-definition')
+  @SkipThrottle()
+  @UseGuards(HybridAuthGuard, PermissionGuard)
+  @RequirePermission('integration', 'read')
+  @ApiOperation({
+    summary:
+      'Resolve the "About this check" description for a finding (AI-cached for AWS; provider-derived for GCP/Azure)',
+  })
+  async getCheckDefinition(
+    @Param('findingId') findingId: string,
+    @OrganizationId() organizationId: string,
+  ) {
+    const definition = await this.checkDefinitionService.getForFinding(
+      findingId,
+      organizationId,
+    );
+    return { data: definition };
+  }
+
   @Post('scan/:connectionId')
   @UseGuards(HybridAuthGuard, PermissionGuard)
   @RequirePermission('integration', 'update')
diff --git a/apps/api/src/cloud-security/cloud-security.module.ts b/apps/api/src/cloud-security/cloud-security.module.ts
index 3db256d943..52618413eb 100644
--- a/apps/api/src/cloud-security/cloud-security.module.ts
+++ b/apps/api/src/cloud-security/cloud-security.module.ts
@@ -11,6 +11,11 @@ import { RemediationService } from './remediation.service';
 import { GcpRemediationService } from './gcp-remediation.service';
 import { AzureRemediationService } from './azure-remediation.service';
 import { AiRemediationService } from './ai-remediation.service';
+import { AiDescriptionService } from './ai-description.service';
+import { CheckDefinitionService } from './check-definition.service';
+import { CloudExceptionService } from './exception.service';
+import { CloudHistoryService } from './history.service';
+import { CloudReconciliationService } from './reconciliation.service';
 import { CloudSecurityActivityService } from './cloud-security-activity.service';
 import { IntegrationPlatformModule } from '../integration-platform/integration-platform.module';
 import { AuthModule } from '../auth/auth.module';
@@ -30,6 +35,11 @@ import { AuthModule } from '../auth/auth.module';
     GcpRemediationService,
     AzureRemediationService,
     AiRemediationService,
+    AiDescriptionService,
+    CheckDefinitionService,
+    CloudExceptionService,
+    CloudReconciliationService,
+    CloudHistoryService,
   ],
   exports: [CloudSecurityService],
 })
diff --git a/apps/api/src/cloud-security/cloud-security.service.ts b/apps/api/src/cloud-security/cloud-security.service.ts
index 07f94d4389..c815a3fabb 100644
--- a/apps/api/src/cloud-security/cloud-security.service.ts
+++ b/apps/api/src/cloud-security/cloud-security.service.ts
@@ -8,6 +8,7 @@ import { GCPSecurityService } from './providers/gcp-security.service';
 import { AWSSecurityService } from './providers/aws-security.service';
 import { AzureSecurityService } from './providers/azure-security.service';
 import { AWS_SERVICE_TASK_MAPPINGS } from './aws-task-mappings';
+import { CloudReconciliationService } from './reconciliation.service';
 
 export interface SecurityFinding {
   id: string;
@@ -46,6 +47,7 @@ export class CloudSecurityService {
     private readonly gcpService: GCPSecurityService,
     private readonly awsService: AWSSecurityService,
     private readonly azureService: AzureSecurityService,
+    private readonly reconciliation: CloudReconciliationService,
   ) {}
 
   async scan(
@@ -276,7 +278,22 @@ export class CloudSecurityService {
       }
 
       // Store findings in database
-      await this.storeFindings(connectionId, providerSlug, findings);
+      const currentRunId = await this.storeFindings(
+        connectionId,
+        providerSlug,
+        findings,
+      );
+
+      // Reconcile against the prior scan to record resolutions and regressions.
+      // Failures must NOT fail the scan — log and continue so customers always
+      // see fresh findings even if the audit trail step hits an edge case.
+      try {
+        await this.reconciliation.reconcile({ currentRunId });
+      } catch (err) {
+        this.logger.error(
+          `Reconciliation failed for run ${currentRunId}: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
 
       // Auto-satisfy evidence tasks based on passing scan results (AWS only)
       if (providerSlug === 'aws') {
@@ -556,12 +573,27 @@ export class CloudSecurityService {
     connectionId: string,
     provider: string,
     findings: SecurityFinding[],
-  ): Promise<void> {
+  ): Promise<string> {
     const passedCount = findings.filter((f) => f.passed).length;
     const failedCount = findings.filter((f) => !f.passed).length;
 
+    // Derive successfully-scanned service IDs from finding evidence. Used by
+    // Phase 5 reconciliation to avoid false "resolved" events when a service
+    // wasn't actually scanned this run.
+    const scannedServices = Array.from(
+      new Set(
+        findings
+          .map((f) => {
+            const evidence = f.evidence as Record<string, unknown> | undefined;
+            const serviceId = evidence?.serviceId;
+            return typeof serviceId === 'string' ? serviceId : null;
+          })
+          .filter((id): id is string => Boolean(id)),
+      ),
+    );
+
     // Use a transaction to ensure atomicity - both run and results are created together
-    await db.$transaction(async (tx) => {
+    const runId = await db.$transaction(async (tx) => {
       // Create a scan run record
       const scanRun = await tx.integrationCheckRun.create({
         data: {
@@ -574,6 +606,7 @@ export class CloudSecurityService {
           totalChecked: findings.length,
           passedCount,
           failedCount,
+          scannedServices,
         },
       });
 
@@ -594,7 +627,11 @@ export class CloudSecurityService {
           })),
         });
       }
+
+      return scanRun.id;
     });
+
+    return runId;
   }
 
   /**
diff --git a/apps/api/src/cloud-security/dto/mark-exception.dto.ts b/apps/api/src/cloud-security/dto/mark-exception.dto.ts
new file mode 100644
index 0000000000..8b7bdbfd90
--- /dev/null
+++ b/apps/api/src/cloud-security/dto/mark-exception.dto.ts
@@ -0,0 +1,28 @@
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { IsDateString, IsOptional, IsString, MinLength } from 'class-validator';
+
+export class MarkExceptionDto {
+  @ApiProperty({
+    description: 'Documentation for why this finding does not apply or is being accepted. Minimum 20 characters.',
+    example: 'Bucket hosts intentionally public marketing assets; writes restricted to the marketing IAM role.',
+  })
+  @IsString()
+  @MinLength(20, { message: 'Reason must be at least 20 characters.' })
+  reason!: string;
+
+  @ApiPropertyOptional({
+    description: 'Free-text reviewer or approval reference.',
+    example: 'Approved by CISO 2026-Q1',
+  })
+  @IsOptional()
+  @IsString()
+  reviewedBy?: string;
+
+  @ApiPropertyOptional({
+    description: 'ISO date when this exception should auto-expire. Null/missing = never.',
+    example: '2026-08-13',
+  })
+  @IsOptional()
+  @IsDateString()
+  expiresAt?: string;
+}
diff --git a/apps/api/src/cloud-security/evidence-sanitizer.spec.ts b/apps/api/src/cloud-security/evidence-sanitizer.spec.ts
new file mode 100644
index 0000000000..3c8ba64fd9
--- /dev/null
+++ b/apps/api/src/cloud-security/evidence-sanitizer.spec.ts
@@ -0,0 +1,219 @@
+import { REDACTED_VALUE, sanitizeEvidence } from './evidence-sanitizer';
+
+describe('evidence-sanitizer', () => {
+  describe('top-level sensitive keys', () => {
+    it('redacts string values under sensitive keys', () => {
+      expect(sanitizeEvidence({ password: 'mySecret' })).toEqual({
+        password: REDACTED_VALUE,
+      });
+    });
+
+    it('matches case-insensitively', () => {
+      expect(
+        sanitizeEvidence({ Password: 'x', PASSWORD: 'y', PassWord: 'z' }),
+      ).toEqual({
+        Password: REDACTED_VALUE,
+        PASSWORD: REDACTED_VALUE,
+        PassWord: REDACTED_VALUE,
+      });
+    });
+
+    it('redacts every configured sensitive suffix pattern', () => {
+      const input: Record<string, string> = {
+        password: 'a',
+        userPassword: 'a2',
+        secret: 'b',
+        clientSecret: 'b2',
+        token: 'c',
+        accessToken: 'c2',
+        refreshToken: 'c3',
+        bearerToken: 'c4',
+        credential: 'd',
+        credentials: 'd2',
+        awsCredentials: 'd3',
+        privateKey: 'e',
+        publicKey: 'e2',
+        accessKey: 'f',
+        accessKeyId: 'f2',
+        secretAccessKey: 'f3',
+        apiKey: 'g',
+        signingKey: 'h',
+        sessionId: 'i',
+        sessionToken: 'i2',
+        bearer: 'j',
+        authorization: 'k',
+        cookie: 'l',
+      };
+      const result = sanitizeEvidence(input) as Record<string, unknown>;
+      for (const key of Object.keys(input)) {
+        expect(result[key]).toBe(REDACTED_VALUE);
+      }
+    });
+
+    it('leaves non-sensitive keys unchanged', () => {
+      expect(
+        sanitizeEvidence({
+          bucketName: 'logs-archive',
+          region: 'us-east-1',
+          accountId: '123456789012',
+        }),
+      ).toEqual({
+        bucketName: 'logs-archive',
+        region: 'us-east-1',
+        accountId: '123456789012',
+      });
+    });
+
+    it('does NOT redact keys that merely contain a sensitive word as a prefix or middle', () => {
+      // suffix-match means these stay visible — they are config info, not secrets
+      expect(
+        sanitizeEvidence({
+          passwordPolicy: { minimumLength: 14 },
+          requirePassword: true,
+          tokenLifetime: 3600,
+          secretsCount: 5,
+        }),
+      ).toEqual({
+        passwordPolicy: { minimumLength: 14 },
+        requirePassword: true,
+        tokenLifetime: 3600,
+        secretsCount: 5,
+      });
+    });
+
+    it('does NOT redact booleans or numbers even when key is sensitive', () => {
+      // preserving non-string config like `requirePassword: true` is important
+      // for auditors — the FACT that a flag is set is not itself a secret
+      expect(
+        sanitizeEvidence({
+          requireSecret: false,
+          tokenCount: 3,
+        }),
+      ).toEqual({
+        requireSecret: false,
+        tokenCount: 3,
+      });
+    });
+  });
+
+  describe('nested objects', () => {
+    it('redacts sensitive keys deep in the tree', () => {
+      expect(
+        sanitizeEvidence({
+          bucket: {
+            name: 'my-bucket',
+            config: { accessKey: 'AKIA1234' },
+          },
+        }),
+      ).toEqual({
+        bucket: {
+          name: 'my-bucket',
+          config: { accessKey: REDACTED_VALUE },
+        },
+      });
+    });
+
+    it('redacts whole nested object when its key is sensitive', () => {
+      expect(
+        sanitizeEvidence({
+          bucket: {
+            name: 'logs',
+            credentials: { accessKeyId: 'AKIA', secretAccessKey: 'sk' },
+          },
+        }),
+      ).toEqual({
+        bucket: {
+          name: 'logs',
+          credentials: REDACTED_VALUE,
+        },
+      });
+    });
+  });
+
+  describe('arrays', () => {
+    it('sanitizes objects inside arrays', () => {
+      expect(
+        sanitizeEvidence({
+          users: [
+            { name: 'john', token: 'abc' },
+            { name: 'alice', token: 'def' },
+          ],
+        }),
+      ).toEqual({
+        users: [
+          { name: 'john', token: REDACTED_VALUE },
+          { name: 'alice', token: REDACTED_VALUE },
+        ],
+      });
+    });
+
+    it('preserves arrays of primitives', () => {
+      expect(
+        sanitizeEvidence({ regions: ['us-east-1', 'eu-west-1'] }),
+      ).toEqual({
+        regions: ['us-east-1', 'eu-west-1'],
+      });
+    });
+
+    it('handles a top-level array', () => {
+      expect(sanitizeEvidence([{ token: 'a' }, { name: 'b' }])).toEqual([
+        { token: REDACTED_VALUE },
+        { name: 'b' },
+      ]);
+    });
+  });
+
+  describe('non-object inputs', () => {
+    it('returns null/undefined unchanged', () => {
+      expect(sanitizeEvidence(null)).toBeNull();
+      expect(sanitizeEvidence(undefined)).toBeUndefined();
+    });
+
+    it('returns primitives unchanged', () => {
+      expect(sanitizeEvidence('hello')).toBe('hello');
+      expect(sanitizeEvidence(42)).toBe(42);
+      expect(sanitizeEvidence(true)).toBe(true);
+      expect(sanitizeEvidence(false)).toBe(false);
+    });
+  });
+
+  describe('purity', () => {
+    it('does not mutate the input', () => {
+      const input = {
+        bucketName: 'logs',
+        accessKey: 'AKIA',
+        nested: { token: 'xyz' },
+      };
+      const snapshot = JSON.stringify(input);
+      sanitizeEvidence(input);
+      expect(JSON.stringify(input)).toBe(snapshot);
+    });
+  });
+
+  describe('realistic AWS payload', () => {
+    it('keeps policy structure visible and redacts only credentials', () => {
+      const input = {
+        accountId: '123456789012',
+        passwordPolicy: {
+          minimumPasswordLength: 8,
+          requireSymbols: true,
+          requireUppercaseCharacters: false,
+        },
+        region: 'us-east-1',
+        accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+        secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+      };
+      expect(sanitizeEvidence(input)).toEqual({
+        accountId: '123456789012',
+        passwordPolicy: {
+          minimumPasswordLength: 8,
+          requireSymbols: true,
+          requireUppercaseCharacters: false,
+        },
+        region: 'us-east-1',
+        accessKeyId: REDACTED_VALUE,
+        secretAccessKey: REDACTED_VALUE,
+      });
+    });
+  });
+});
diff --git a/apps/api/src/cloud-security/evidence-sanitizer.ts b/apps/api/src/cloud-security/evidence-sanitizer.ts
new file mode 100644
index 0000000000..0e119746df
--- /dev/null
+++ b/apps/api/src/cloud-security/evidence-sanitizer.ts
@@ -0,0 +1,72 @@
+/**
+ * Redacts sensitive values inside cloud-test evidence payloads before they
+ * are rendered to a user.
+ *
+ * Matching strategy — case-insensitive suffix match on the KEY name. A key
+ * is considered sensitive when its lowercase form ends with one of the
+ * SENSITIVE_SUFFIXES. This deliberately differs from substring matching:
+ * `passwordPolicy` and `requirePassword` keep their structure visible
+ * because their suffix is `policy`/`Password` respectively — only literal
+ * `password`, `userPassword`, etc. get redacted.
+ *
+ * Redaction rule — only string and nested-object values are redacted.
+ * Booleans and numbers under a sensitive key are preserved (e.g. config
+ * flags like `requirePassword: true` should stay visible to auditors).
+ *
+ * Add new entries to SENSITIVE_SUFFIXES as new sensitive field names are
+ * observed in real provider payloads. Removing an entry is a security
+ * regression — review carefully.
+ */
+
+export const REDACTED_VALUE = '[REDACTED]';
+
+const SENSITIVE_SUFFIXES: readonly string[] = [
+  'password',
+  'secret',
+  'token',
+  'credential',
+  'credentials',
+  'privatekey',
+  'publickey',
+  'accesskey',
+  'accesskeyid',
+  'secretaccesskey',
+  'apikey',
+  'signingkey',
+  'sessionid',
+  'sessiontoken',
+  'bearer',
+  'authorization',
+  'cookie',
+];
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function keyIsSensitive(key: string): boolean {
+  const normalized = key.toLowerCase();
+  return SENSITIVE_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
+}
+
+/**
+ * Recursively walks a JSON-like value and replaces values under sensitive
+ * keys with REDACTED_VALUE. Structure (keys, arrays, primitive types) is
+ * preserved so callers and auditors can still see what fields exist.
+ *
+ * Pure — does not mutate the input.
+ */
+export function sanitizeEvidence(value: unknown): unknown {
+  if (value === null || value === undefined) return value;
+  if (Array.isArray(value)) return value.map(sanitizeEvidence);
+  if (!isRecord(value)) return value;
+
+  const result: Record<string, unknown> = {};
+  for (const key of Object.keys(value)) {
+    const child = value[key];
+    const shouldRedact =
+      keyIsSensitive(key) && (typeof child === 'string' || isRecord(child));
+    result[key] = shouldRedact ? REDACTED_VALUE : sanitizeEvidence(child);
+  }
+  return result;
+}
diff --git a/apps/api/src/cloud-security/exception.service.spec.ts b/apps/api/src/cloud-security/exception.service.spec.ts
new file mode 100644
index 0000000000..2a033eba7a
--- /dev/null
+++ b/apps/api/src/cloud-security/exception.service.spec.ts
@@ -0,0 +1,232 @@
+import { BadRequestException, NotFoundException } from '@nestjs/common';
+
+// Mock @db so the Prisma client doesn't try to connect at import time, and
+// so we can assert on what `markAsException` writes.
+const dbMock = {
+  integrationCheckResult: { findFirst: jest.fn() },
+  findingException: {
+    findFirst: jest.fn(),
+    create: jest.fn(),
+    update: jest.fn(),
+  },
+  auditLog: { create: jest.fn() },
+};
+
+jest.mock('@db', () => ({ db: dbMock }));
+
+// Mock the audit logger so we can assert on it without exercising the real
+// DB call inside.
+const auditLogMock = jest.fn().mockResolvedValue(undefined);
+jest.mock('./cloud-security-audit', () => ({
+  logCloudSecurityActivity: auditLogMock,
+}));
+
+import { CloudExceptionService } from './exception.service';
+
+function buildService() {
+  return new CloudExceptionService();
+}
+
+function withFinding(opts: {
+  findingKey: string;
+  resourceId: string;
+  connectionId: string;
+}) {
+  dbMock.integrationCheckResult.findFirst.mockResolvedValueOnce({
+    resourceId: opts.resourceId,
+    evidence: { findingKey: opts.findingKey },
+    checkRun: { connectionId: opts.connectionId },
+  });
+}
+
+describe('CloudExceptionService.markAsException', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    dbMock.findingException.findFirst.mockReset();
+    dbMock.findingException.create.mockReset();
+    dbMock.findingException.update.mockReset();
+  });
+
+  it('rejects reasons shorter than 20 characters', async () => {
+    await expect(
+      buildService().markAsException({
+        findingId: 'icx_x',
+        organizationId: 'org_1',
+        userId: 'usr_1',
+        reason: 'too short',
+      }),
+    ).rejects.toThrow(BadRequestException);
+  });
+
+  it('rejects past expiration dates', async () => {
+    await expect(
+      buildService().markAsException({
+        findingId: 'icx_x',
+        organizationId: 'org_1',
+        userId: 'usr_1',
+        reason: 'A perfectly normal documented reason for exception.',
+        expiresAt: new Date(Date.now() - 1000),
+      }),
+    ).rejects.toThrow(BadRequestException);
+  });
+
+  it('creates a new exception when none exists for this finding', async () => {
+    withFinding({
+      findingKey: 'iam-no-mfa-john',
+      resourceId: 'john',
+      connectionId: 'icn_aws',
+    });
+    dbMock.findingException.findFirst.mockResolvedValueOnce(null);
+    dbMock.findingException.create.mockResolvedValueOnce({ id: 'fex_new' });
+
+    const result = await buildService().markAsException({
+      findingId: 'icx_1',
+      organizationId: 'org_1',
+      userId: 'usr_1',
+      reason: 'Public marketing bucket — intentional. Bucket policy locked.',
+    });
+
+    expect(result.id).toBe('fex_new');
+    expect(dbMock.findingException.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          organizationId: 'org_1',
+          connectionId: 'icn_aws',
+          checkId: 'iam-no-mfa', // normalized from finding key
+          resourceId: 'john',
+          markedById: 'usr_1',
+        }),
+      }),
+    );
+    expect(auditLogMock).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'exception_marked' }),
+    );
+  });
+
+  it('updates an existing active exception instead of creating a duplicate', async () => {
+    withFinding({
+      findingKey: 'iam-no-mfa-alice',
+      resourceId: 'alice',
+      connectionId: 'icn_aws',
+    });
+    dbMock.findingException.findFirst.mockResolvedValueOnce({ id: 'fex_old' });
+    dbMock.findingException.update.mockResolvedValueOnce({ id: 'fex_old' });
+
+    const result = await buildService().markAsException({
+      findingId: 'icx_2',
+      organizationId: 'org_1',
+      userId: 'usr_1',
+      reason: 'Updated reason now exceeds the twenty char minimum length.',
+    });
+
+    expect(result.id).toBe('fex_old');
+    expect(dbMock.findingException.update).toHaveBeenCalled();
+    expect(dbMock.findingException.create).not.toHaveBeenCalled();
+  });
+
+  it('rejects findings that lack a stable check/resource identity', async () => {
+    dbMock.integrationCheckResult.findFirst.mockResolvedValueOnce({
+      resourceId: null,
+      evidence: null,
+      checkRun: { connectionId: 'icn_aws' },
+    });
+    await expect(
+      buildService().markAsException({
+        findingId: 'icx_x',
+        organizationId: 'org_1',
+        userId: 'usr_1',
+        reason: 'A perfectly long, well-documented reason here for tests.',
+      }),
+    ).rejects.toThrow(BadRequestException);
+  });
+});
+
+describe('CloudExceptionService.revokeException', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    dbMock.findingException.findFirst.mockReset();
+    dbMock.findingException.update.mockReset();
+  });
+
+  it('throws NotFoundException when the exception does not exist', async () => {
+    dbMock.findingException.findFirst.mockResolvedValueOnce(null);
+    await expect(
+      buildService().revokeException({
+        exceptionId: 'fex_missing',
+        organizationId: 'org_1',
+        userId: 'usr_1',
+      }),
+    ).rejects.toThrow(NotFoundException);
+  });
+
+  it('refuses to revoke an already-revoked exception', async () => {
+    dbMock.findingException.findFirst.mockResolvedValueOnce({
+      id: 'fex_1',
+      connectionId: 'icn_aws',
+      checkId: 'iam-no-mfa',
+      resourceId: 'john',
+      revokedAt: new Date(),
+    });
+    await expect(
+      buildService().revokeException({
+        exceptionId: 'fex_1',
+        organizationId: 'org_1',
+        userId: 'usr_1',
+      }),
+    ).rejects.toThrow(BadRequestException);
+  });
+
+  it('writes revokedAt + revokedById and an audit log entry on success', async () => {
+    dbMock.findingException.findFirst.mockResolvedValueOnce({
+      id: 'fex_1',
+      connectionId: 'icn_aws',
+      checkId: 'iam-no-mfa',
+      resourceId: 'john',
+      revokedAt: null,
+    });
+    dbMock.findingException.update.mockResolvedValueOnce({ id: 'fex_1' });
+
+    await buildService().revokeException({
+      exceptionId: 'fex_1',
+      organizationId: 'org_1',
+      userId: 'usr_1',
+    });
+
+    expect(dbMock.findingException.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ revokedById: 'usr_1' }),
+      }),
+    );
+    expect(auditLogMock).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'exception_revoked' }),
+    );
+  });
+});
+
+describe('CloudExceptionService.isExceptionActive', () => {
+  beforeEach(() => {
+    dbMock.findingException.findFirst.mockReset();
+  });
+
+  it('returns true when a non-revoked, non-expired exception exists', async () => {
+    dbMock.findingException.findFirst.mockResolvedValueOnce({ id: 'fex_1' });
+    const active = await buildService().isExceptionActive({
+      organizationId: 'org_1',
+      connectionId: 'icn_aws',
+      checkId: 'iam-no-mfa',
+      resourceId: 'john',
+    });
+    expect(active).toBe(true);
+  });
+
+  it('returns false when none match', async () => {
+    dbMock.findingException.findFirst.mockResolvedValueOnce(null);
+    const active = await buildService().isExceptionActive({
+      organizationId: 'org_1',
+      connectionId: 'icn_aws',
+      checkId: 'iam-no-mfa',
+      resourceId: 'john',
+    });
+    expect(active).toBe(false);
+  });
+});
diff --git a/apps/api/src/cloud-security/exception.service.ts b/apps/api/src/cloud-security/exception.service.ts
new file mode 100644
index 0000000000..9fd3238e48
--- /dev/null
+++ b/apps/api/src/cloud-security/exception.service.ts
@@ -0,0 +1,211 @@
+import {
+  BadRequestException,
+  ForbiddenException,
+  Injectable,
+  Logger,
+  NotFoundException,
+} from '@nestjs/common';
+import { db } from '@db';
+import { logCloudSecurityActivity } from './cloud-security-audit';
+import { normalizeCheckId } from './check-definition.utils';
+
+/** Minimum chars for an exception reason — meant to discourage low-effort
+ * reasons like "ok" or "test". Auditors rely on this field as the
+ * documentation for why the finding isn't being fixed. */
+export const MIN_EXCEPTION_REASON_LENGTH = 20;
+
+export interface MarkExceptionInput {
+  findingId: string;
+  organizationId: string;
+  userId: string;
+  reason: string;
+  reviewedBy?: string | null;
+  expiresAt?: Date | null;
+}
+
+@Injectable()
+export class CloudExceptionService {
+  private readonly logger = new Logger(CloudExceptionService.name);
+
+  /**
+   * Mark a finding as an exception. Idempotent per (orgId, connectionId,
+   * checkId, resourceId) — re-marking the same finding while an active
+   * exception exists is treated as an update of the existing exception.
+   */
+  async markAsException(input: MarkExceptionInput): Promise<{ id: string }> {
+    if (input.reason.trim().length < MIN_EXCEPTION_REASON_LENGTH) {
+      throw new BadRequestException(
+        `Exception reason must be at least ${MIN_EXCEPTION_REASON_LENGTH} characters.`,
+      );
+    }
+    if (input.expiresAt && input.expiresAt.getTime() < Date.now()) {
+      throw new BadRequestException(
+        'Exception expiration date must be in the future.',
+      );
+    }
+
+    const lookup = await this.resolveFindingForException(
+      input.findingId,
+      input.organizationId,
+    );
+
+    // Reuse an active exception if one already exists for this finding —
+    // mark-then-edit avoids duplicate rows under the same (org, conn, check,
+    // resource) tuple.
+    const existing = await db.findingException.findFirst({
+      where: {
+        organizationId: input.organizationId,
+        connectionId: lookup.connectionId,
+        checkId: lookup.checkId,
+        resourceId: lookup.resourceId,
+        revokedAt: null,
+      },
+    });
+
+    let exceptionId: string;
+    if (existing) {
+      const updated = await db.findingException.update({
+        where: { id: existing.id },
+        data: {
+          reason: input.reason.trim(),
+          reviewedBy: input.reviewedBy ?? null,
+          expiresAt: input.expiresAt ?? null,
+        },
+      });
+      exceptionId = updated.id;
+    } else {
+      const created = await db.findingException.create({
+        data: {
+          organizationId: input.organizationId,
+          connectionId: lookup.connectionId,
+          checkId: lookup.checkId,
+          resourceId: lookup.resourceId,
+          reason: input.reason.trim(),
+          reviewedBy: input.reviewedBy ?? null,
+          expiresAt: input.expiresAt ?? null,
+          markedById: input.userId,
+        },
+      });
+      exceptionId = created.id;
+    }
+
+    await logCloudSecurityActivity({
+      organizationId: input.organizationId,
+      userId: input.userId,
+      connectionId: lookup.connectionId,
+      action: 'exception_marked',
+      description: `Marked finding ${lookup.checkId}:${lookup.resourceId} as exception — ${input.reason.slice(0, 80)}${input.reason.length > 80 ? '…' : ''}`,
+      metadata: {
+        findingId: input.findingId,
+        exceptionId,
+        checkId: lookup.checkId,
+        resourceId: lookup.resourceId,
+        expiresAt: input.expiresAt?.toISOString() ?? null,
+      },
+    });
+
+    return { id: exceptionId };
+  }
+
+  async revokeException(params: {
+    exceptionId: string;
+    organizationId: string;
+    userId: string;
+  }): Promise<void> {
+    const existing = await db.findingException.findFirst({
+      where: { id: params.exceptionId, organizationId: params.organizationId },
+    });
+    if (!existing) throw new NotFoundException('Exception not found');
+    if (existing.revokedAt) {
+      throw new BadRequestException('Exception is already revoked.');
+    }
+
+    await db.findingException.update({
+      where: { id: params.exceptionId },
+      data: { revokedAt: new Date(), revokedById: params.userId },
+    });
+
+    await logCloudSecurityActivity({
+      organizationId: params.organizationId,
+      userId: params.userId,
+      connectionId: existing.connectionId,
+      action: 'exception_revoked',
+      description: `Revoked exception on ${existing.checkId}:${existing.resourceId}.`,
+      metadata: {
+        exceptionId: params.exceptionId,
+        checkId: existing.checkId,
+        resourceId: existing.resourceId,
+      },
+    });
+  }
+
+  /**
+   * Active = exists for this (org, connection, check, resource), not
+   * revoked, and (no expiration OR expiration in the future).
+   * Used by getFindings to filter and by reconciliation to detect
+   * `exception_marked` resolutions.
+   */
+  async isExceptionActive(params: {
+    organizationId: string;
+    connectionId: string;
+    checkId: string;
+    resourceId: string;
+  }): Promise<boolean> {
+    const exception = await db.findingException.findFirst({
+      where: {
+        organizationId: params.organizationId,
+        connectionId: params.connectionId,
+        checkId: params.checkId,
+        resourceId: params.resourceId,
+        revokedAt: null,
+        OR: [{ expiresAt: null }, { expiresAt: { gt: new Date() } }],
+      },
+      select: { id: true },
+    });
+    return Boolean(exception);
+  }
+
+  /**
+   * Resolve a finding ID into the (connectionId, checkId, resourceId)
+   * tuple that exception storage is keyed by. Forbids cross-tenant access.
+   */
+  private async resolveFindingForException(
+    findingId: string,
+    organizationId: string,
+  ): Promise<{ connectionId: string; checkId: string; resourceId: string }> {
+    const result = await db.integrationCheckResult.findFirst({
+      where: {
+        id: findingId,
+        checkRun: { connection: { organizationId } },
+      },
+      select: {
+        resourceId: true,
+        evidence: true,
+        checkRun: { select: { connectionId: true } },
+      },
+    });
+
+    if (!result) {
+      throw new ForbiddenException(
+        'Finding not found, or it does not belong to your organization.',
+      );
+    }
+
+    const evidence = result.evidence as Record<string, unknown> | null;
+    const rawFindingKey =
+      evidence && typeof evidence.findingKey === 'string'
+        ? evidence.findingKey
+        : null;
+    if (!rawFindingKey || !result.resourceId) {
+      throw new BadRequestException(
+        'This finding cannot be marked as an exception — it lacks a stable check/resource identity.',
+      );
+    }
+
+    return {
+      connectionId: result.checkRun.connectionId,
+      checkId: normalizeCheckId(rawFindingKey, result.resourceId),
+      resourceId: result.resourceId,
+    };
+  }
+}
diff --git a/apps/api/src/cloud-security/history.service.ts b/apps/api/src/cloud-security/history.service.ts
new file mode 100644
index 0000000000..1a27060c56
--- /dev/null
+++ b/apps/api/src/cloud-security/history.service.ts
@@ -0,0 +1,66 @@
+import { Injectable } from '@nestjs/common';
+import { db } from '@db';
+
+/**
+ * Aggregates Phase 5 audit-trail data (resolutions, active exceptions,
+ * regressions) for a single connection into one payload for the History tab.
+ */
+@Injectable()
+export class CloudHistoryService {
+  async getHistory(params: {
+    organizationId: string;
+    connectionId: string;
+  }) {
+    const [resolutions, exceptions, regressions] = await Promise.all([
+      db.findingResolution.findMany({
+        where: {
+          organizationId: params.organizationId,
+          connectionId: params.connectionId,
+        },
+        orderBy: { resolvedAt: 'desc' },
+        take: 200,
+      }),
+      db.findingException.findMany({
+        where: {
+          organizationId: params.organizationId,
+          connectionId: params.connectionId,
+          revokedAt: null,
+          OR: [{ expiresAt: null }, { expiresAt: { gt: new Date() } }],
+        },
+        orderBy: { markedAt: 'desc' },
+        take: 100,
+      }),
+      db.findingRegression.findMany({
+        where: {
+          organizationId: params.organizationId,
+          connectionId: params.connectionId,
+        },
+        orderBy: { regressedAt: 'desc' },
+        take: 100,
+      }),
+    ]);
+
+    return {
+      summary: {
+        resolutions: resolutions.length,
+        platformFixes: resolutions.filter(
+          (r) => r.resolutionMethod === 'platform_fix',
+        ).length,
+        externalFixes: resolutions.filter(
+          (r) => r.resolutionMethod === 'external_fix',
+        ).length,
+        resourceDeleted: resolutions.filter(
+          (r) => r.resolutionMethod === 'resource_deleted',
+        ).length,
+        exceptionMarked: resolutions.filter(
+          (r) => r.resolutionMethod === 'exception_marked',
+        ).length,
+        activeExceptions: exceptions.length,
+        regressions: regressions.length,
+      },
+      resolutions,
+      exceptions,
+      regressions,
+    };
+  }
+}
diff --git a/apps/api/src/cloud-security/reconciliation.service.spec.ts b/apps/api/src/cloud-security/reconciliation.service.spec.ts
new file mode 100644
index 0000000000..41d56e9037
--- /dev/null
+++ b/apps/api/src/cloud-security/reconciliation.service.spec.ts
@@ -0,0 +1,280 @@
+// Reconciliation walks the IntegrationCheckRun pairs and writes
+// FindingResolution + FindingRegression rows. These tests exercise the
+// branching logic via a Prisma mock — no real DB needed.
+
+const dbMock = {
+  integrationCheckRun: {
+    findUnique: jest.fn(),
+    findFirst: jest.fn(),
+  },
+  findingResolution: {
+    findFirst: jest.fn(),
+    create: jest.fn(),
+  },
+  findingRegression: {
+    create: jest.fn(),
+  },
+  remediationAction: {
+    findFirst: jest.fn(),
+  },
+};
+
+jest.mock('@db', () => ({
+  db: dbMock,
+  FindingResolutionMethod: {
+    platform_fix: 'platform_fix',
+    external_fix: 'external_fix',
+    resource_deleted: 'resource_deleted',
+    exception_marked: 'exception_marked',
+  },
+}));
+
+import { CloudReconciliationService } from './reconciliation.service';
+import type { CloudExceptionService } from './exception.service';
+
+// Hand-rolled stub for the exception service — the reconciliation only calls
+// isExceptionActive on it.
+function makeExceptionsStub(active = false): CloudExceptionService {
+  return {
+    isExceptionActive: jest.fn().mockResolvedValue(active),
+  } as unknown as CloudExceptionService;
+}
+
+const PRIOR_RUN_TIME = new Date('2026-05-01T00:00:00Z');
+const CURRENT_RUN_TIME = new Date('2026-05-13T00:00:00Z');
+
+function makeResult(opts: {
+  findingKey: string;
+  resourceId: string;
+  passed: boolean;
+  resourceType?: string;
+  serviceId?: string;
+}) {
+  return {
+    passed: opts.passed,
+    resourceId: opts.resourceId,
+    resourceType: opts.resourceType ?? 'AwsIamUser',
+    evidence: {
+      findingKey: opts.findingKey,
+      serviceId: opts.serviceId ?? 'iam',
+    },
+  };
+}
+
+function setupRuns(opts: {
+  currentResults: ReturnType<typeof makeResult>[];
+  priorResults: ReturnType<typeof makeResult>[];
+  scannedServices?: string[];
+}) {
+  dbMock.integrationCheckRun.findUnique.mockResolvedValueOnce({
+    id: 'icr_current',
+    connectionId: 'icn_aws',
+    status: 'success',
+    startedAt: CURRENT_RUN_TIME,
+    completedAt: CURRENT_RUN_TIME,
+    scannedServices: opts.scannedServices ?? [],
+    connection: { organizationId: 'org_1' },
+    results: opts.currentResults,
+  });
+  dbMock.integrationCheckRun.findFirst.mockResolvedValueOnce({
+    id: 'icr_prior',
+    completedAt: PRIOR_RUN_TIME,
+    results: opts.priorResults,
+  });
+}
+
+describe('CloudReconciliationService.reconcile', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    dbMock.findingResolution.findFirst.mockResolvedValue(null);
+    dbMock.findingRegression.create.mockResolvedValue({ id: 'freg_x' });
+    dbMock.findingResolution.create.mockResolvedValue({ id: 'fres_x' });
+    dbMock.remediationAction.findFirst.mockResolvedValue(null);
+  });
+
+  it('skips reconciliation when current run is not successful', async () => {
+    dbMock.integrationCheckRun.findUnique.mockResolvedValueOnce({
+      id: 'icr_current',
+      status: 'failed',
+      connection: { organizationId: 'org_1' },
+      results: [],
+    });
+    const service = new CloudReconciliationService(makeExceptionsStub());
+    const result = await service.reconcile({ currentRunId: 'icr_current' });
+    expect(result).toEqual({ resolutions: 0, regressions: 0, skipped: true });
+  });
+
+  it('is idempotent — skips if FindingResolution rows already exist for this run', async () => {
+    dbMock.integrationCheckRun.findUnique.mockResolvedValueOnce({
+      id: 'icr_current',
+      status: 'success',
+      connection: { organizationId: 'org_1' },
+      results: [],
+      scannedServices: [],
+    });
+    dbMock.findingResolution.findFirst.mockResolvedValueOnce({ id: 'fres_existing' });
+
+    const service = new CloudReconciliationService(makeExceptionsStub());
+    const result = await service.reconcile({ currentRunId: 'icr_current' });
+    expect(result.skipped).toBe(true);
+    expect(dbMock.findingResolution.create).not.toHaveBeenCalled();
+  });
+
+  it('returns 0/0 on first scan (no prior run)', async () => {
+    dbMock.integrationCheckRun.findUnique.mockResolvedValueOnce({
+      id: 'icr_current',
+      status: 'success',
+      connection: { organizationId: 'org_1' },
+      results: [],
+      scannedServices: [],
+    });
+    dbMock.integrationCheckRun.findFirst.mockResolvedValueOnce(null);
+
+    const service = new CloudReconciliationService(makeExceptionsStub());
+    const result = await service.reconcile({ currentRunId: 'icr_current' });
+    expect(result).toEqual({ resolutions: 0, regressions: 0, skipped: false });
+  });
+
+  it('records resource_deleted when a prior failure is missing from the current run', async () => {
+    setupRuns({
+      currentResults: [],
+      priorResults: [
+        makeResult({ findingKey: 'iam-no-mfa-john', resourceId: 'john', passed: false }),
+      ],
+    });
+
+    const service = new CloudReconciliationService(makeExceptionsStub());
+    const result = await service.reconcile({ currentRunId: 'icr_current' });
+
+    expect(result.resolutions).toBe(1);
+    expect(dbMock.findingResolution.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          resolutionMethod: 'resource_deleted',
+          checkId: 'iam-no-mfa',
+          resourceId: 'john',
+        }),
+      }),
+    );
+  });
+
+  it('records external_fix when a prior failure is now passing and no RemediationAction matches', async () => {
+    setupRuns({
+      currentResults: [
+        makeResult({ findingKey: 'iam-no-mfa-john', resourceId: 'john', passed: true }),
+      ],
+      priorResults: [
+        makeResult({ findingKey: 'iam-no-mfa-john', resourceId: 'john', passed: false }),
+      ],
+    });
+
+    const service = new CloudReconciliationService(makeExceptionsStub());
+    await service.reconcile({ currentRunId: 'icr_current' });
+
+    expect(dbMock.findingResolution.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ resolutionMethod: 'external_fix' }),
+      }),
+    );
+  });
+
+  it('records platform_fix when a successful RemediationAction lands between scans', async () => {
+    setupRuns({
+      currentResults: [
+        makeResult({ findingKey: 'iam-no-mfa-john', resourceId: 'john', passed: true }),
+      ],
+      priorResults: [
+        makeResult({ findingKey: 'iam-no-mfa-john', resourceId: 'john', passed: false }),
+      ],
+    });
+    dbMock.remediationAction.findFirst.mockResolvedValueOnce({
+      id: 'rma_1',
+      initiatedById: 'usr_42',
+    });
+
+    const service = new CloudReconciliationService(makeExceptionsStub());
+    await service.reconcile({ currentRunId: 'icr_current' });
+
+    expect(dbMock.findingResolution.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          resolutionMethod: 'platform_fix',
+          remediationActionId: 'rma_1',
+          resolvedById: 'usr_42',
+        }),
+      }),
+    );
+  });
+
+  it('records exception_marked when the user marked an exception between scans', async () => {
+    setupRuns({
+      currentResults: [],
+      priorResults: [
+        makeResult({ findingKey: 'iam-no-mfa-john', resourceId: 'john', passed: false }),
+      ],
+    });
+
+    const service = new CloudReconciliationService(makeExceptionsStub(true));
+    await service.reconcile({ currentRunId: 'icr_current' });
+
+    expect(dbMock.findingResolution.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ resolutionMethod: 'exception_marked' }),
+      }),
+    );
+  });
+
+  it('does NOT mark resolved when the prior finding\'s service was not in scannedServices (partial scan)', async () => {
+    setupRuns({
+      currentResults: [], // partial scan — IAM service didn't run this time
+      priorResults: [
+        makeResult({
+          findingKey: 'iam-no-mfa-john',
+          resourceId: 'john',
+          passed: false,
+          serviceId: 'iam',
+        }),
+      ],
+      scannedServices: ['s3'], // only S3 ran this time
+    });
+
+    const service = new CloudReconciliationService(makeExceptionsStub());
+    const result = await service.reconcile({ currentRunId: 'icr_current' });
+
+    expect(result.resolutions).toBe(0);
+    expect(dbMock.findingResolution.create).not.toHaveBeenCalled();
+  });
+
+  it('records a regression when a previously-resolved finding fails again', async () => {
+    setupRuns({
+      currentResults: [
+        makeResult({ findingKey: 'iam-no-mfa-john', resourceId: 'john', passed: false }),
+      ],
+      priorResults: [
+        // prior was passing — i.e. fix held, now broken again
+        makeResult({ findingKey: 'iam-no-mfa-john', resourceId: 'john', passed: true }),
+      ],
+    });
+    dbMock.findingResolution.findFirst
+      .mockResolvedValueOnce(null) // idempotency probe
+      .mockResolvedValueOnce({
+        // last-resolved lookup
+        id: 'fres_old',
+        resolvedAt: PRIOR_RUN_TIME,
+      });
+
+    const service = new CloudReconciliationService(makeExceptionsStub());
+    const result = await service.reconcile({ currentRunId: 'icr_current' });
+
+    expect(result.regressions).toBe(1);
+    expect(dbMock.findingRegression.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          checkId: 'iam-no-mfa',
+          resourceId: 'john',
+          previousResolutionId: 'fres_old',
+        }),
+      }),
+    );
+  });
+});
diff --git a/apps/api/src/cloud-security/reconciliation.service.ts b/apps/api/src/cloud-security/reconciliation.service.ts
new file mode 100644
index 0000000000..e2b1a356d6
--- /dev/null
+++ b/apps/api/src/cloud-security/reconciliation.service.ts
@@ -0,0 +1,306 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { db, FindingResolutionMethod } from '@db';
+import { normalizeCheckId } from './check-definition.utils';
+import { CloudExceptionService } from './exception.service';
+
+interface NormalizedResult {
+  findingKey: string;
+  resourceId: string;
+  resourceType: string | null;
+  serviceId: string | null;
+  passed: boolean;
+}
+
+/**
+ * Reconciles the most-recent terminal-state IntegrationCheckRun for a
+ * connection against its prior run, writing FindingResolution and
+ * FindingRegression rows. Idempotent per `currentRunId` — re-running on
+ * the same run is a no-op (existing rows scoped to that run are
+ * detected and skipped).
+ *
+ * Edge cases handled:
+ *  - First scan: no prior run → nothing to reconcile.
+ *  - Partial scan: if a service isn't in `scannedServices`, prior
+ *    findings for that service are NOT marked resolved — they're carried
+ *    forward as unknown.
+ *  - Resource renamed: appears as old-resolved + new-failure. v1 limitation
+ *    (documented in plan); v2 would track underlying ARN.
+ */
+@Injectable()
+export class CloudReconciliationService {
+  private readonly logger = new Logger(CloudReconciliationService.name);
+
+  constructor(private readonly exceptions: CloudExceptionService) {}
+
+  async reconcile(params: { currentRunId: string }): Promise<{
+    resolutions: number;
+    regressions: number;
+    skipped: boolean;
+  }> {
+    const currentRun = await db.integrationCheckRun.findUnique({
+      where: { id: params.currentRunId },
+      select: {
+        id: true,
+        connectionId: true,
+        completedAt: true,
+        startedAt: true,
+        status: true,
+        scannedServices: true,
+        connection: { select: { organizationId: true } },
+        results: {
+          select: {
+            passed: true,
+            resourceId: true,
+            resourceType: true,
+            evidence: true,
+          },
+        },
+      },
+    });
+
+    if (!currentRun || currentRun.status !== 'success') {
+      // Don't reconcile against an incomplete scan — incorrect "resolved"
+      // events would mislead auditors. Only successful scans produce truth.
+      return { resolutions: 0, regressions: 0, skipped: true };
+    }
+
+    // Idempotency guard — if reconciliation already wrote rows for this run,
+    // skip silently.
+    const alreadyDone = await db.findingResolution.findFirst({
+      where: { detectedInRunId: currentRun.id },
+      select: { id: true },
+    });
+    if (alreadyDone) {
+      return { resolutions: 0, regressions: 0, skipped: true };
+    }
+
+    const priorRun = await db.integrationCheckRun.findFirst({
+      where: {
+        connectionId: currentRun.connectionId,
+        id: { not: currentRun.id },
+        status: 'success',
+        completedAt: { lt: currentRun.completedAt ?? currentRun.startedAt ?? new Date() },
+      },
+      orderBy: { completedAt: 'desc' },
+      select: {
+        id: true,
+        completedAt: true,
+        results: {
+          select: {
+            passed: true,
+            resourceId: true,
+            resourceType: true,
+            evidence: true,
+          },
+        },
+      },
+    });
+
+    if (!priorRun) {
+      // First scan — nothing to reconcile against.
+      return { resolutions: 0, regressions: 0, skipped: false };
+    }
+
+    const organizationId = currentRun.connection.organizationId;
+    const scannedServices = new Set(currentRun.scannedServices ?? []);
+    const treatPartialScan = scannedServices.size > 0; // empty = scan didn't track services; treat as "all scanned"
+
+    const currentMap = indexResults(currentRun.results);
+    const priorMap = indexResults(priorRun.results);
+
+    let resolutions = 0;
+    let regressions = 0;
+
+    // Resolutions: prior failed → current absent or passed.
+    for (const [key, prior] of priorMap.entries()) {
+      if (!prior.passed === false) continue; // only interested in prior failures
+      if (prior.passed) continue;
+
+      const current = currentMap.get(key);
+      if (current && !current.passed) continue; // still failing
+
+      const checkKey = normalizeCheckId(prior.findingKey, prior.resourceId);
+
+      if (treatPartialScan && prior.serviceId && !scannedServices.has(prior.serviceId)) {
+        // Service wasn't scanned this run — carry forward, don't resolve.
+        continue;
+      }
+
+      const method = await this.determineResolutionMethod({
+        organizationId,
+        connectionId: currentRun.connectionId,
+        priorRunCompletedAt: priorRun.completedAt,
+        currentRunStartedAt:
+          currentRun.startedAt ?? currentRun.completedAt ?? new Date(),
+        checkKey,
+        resourceId: prior.resourceId,
+        currentExists: Boolean(current),
+      });
+
+      const daysOpen =
+        priorRun.completedAt && currentRun.completedAt
+          ? daysBetween(priorRun.completedAt, currentRun.completedAt)
+          : null;
+
+      await db.findingResolution.create({
+        data: {
+          organizationId,
+          connectionId: currentRun.connectionId,
+          checkId: checkKey,
+          resourceId: prior.resourceId,
+          resourceType: prior.resourceType,
+          resolvedAt: currentRun.completedAt ?? new Date(),
+          resolutionMethod: method.method,
+          resolvedById: method.resolvedById ?? null,
+          remediationActionId: method.remediationActionId ?? null,
+          resolvedFromRunId: priorRun.id,
+          detectedInRunId: currentRun.id,
+          daysOpen,
+        },
+      });
+      resolutions += 1;
+    }
+
+    // Regressions: previously-resolved (checkKey, resourceId) failing again
+    // in current run. Look back across ALL prior resolutions for this
+    // connection — not just the immediate-prior run.
+    for (const [key, current] of currentMap.entries()) {
+      if (current.passed) continue;
+      const checkKey = normalizeCheckId(current.findingKey, current.resourceId);
+
+      const lastResolution = await db.findingResolution.findFirst({
+        where: {
+          connectionId: currentRun.connectionId,
+          checkId: checkKey,
+          resourceId: current.resourceId,
+        },
+        orderBy: { resolvedAt: 'desc' },
+        select: { id: true, resolvedAt: true },
+      });
+      if (!lastResolution) continue;
+
+      // If this same (checkKey, resourceId) was failing in priorRun too, it's
+      // a still-failing finding, not a regression.
+      if (priorMap.get(key) && !priorMap.get(key)!.passed) continue;
+
+      const daysClean = currentRun.completedAt
+        ? daysBetween(lastResolution.resolvedAt, currentRun.completedAt)
+        : null;
+
+      await db.findingRegression.create({
+        data: {
+          organizationId,
+          connectionId: currentRun.connectionId,
+          checkId: checkKey,
+          resourceId: current.resourceId,
+          previouslyResolvedAt: lastResolution.resolvedAt,
+          previousResolutionId: lastResolution.id,
+          regressedAt: currentRun.completedAt ?? new Date(),
+          detectedInRunId: currentRun.id,
+          daysClean,
+        },
+      });
+      regressions += 1;
+    }
+
+    this.logger.log(
+      `Reconciled run ${currentRun.id}: ${resolutions} resolved, ${regressions} regressed`,
+    );
+    return { resolutions, regressions, skipped: false };
+  }
+
+  private async determineResolutionMethod(input: {
+    organizationId: string;
+    connectionId: string;
+    priorRunCompletedAt: Date | null;
+    currentRunStartedAt: Date;
+    checkKey: string;
+    resourceId: string;
+    currentExists: boolean;
+  }): Promise<{
+    method: FindingResolutionMethod;
+    resolvedById?: string;
+    remediationActionId?: string;
+  }> {
+    // 1) Did the user mark it as an exception between scans?
+    const exceptionActive = await this.exceptions.isExceptionActive({
+      organizationId: input.organizationId,
+      connectionId: input.connectionId,
+      checkId: input.checkKey,
+      resourceId: input.resourceId,
+    });
+    if (exceptionActive) return { method: 'exception_marked' };
+
+    // 2) Did our Fix button apply a successful remediation between scans?
+    if (input.priorRunCompletedAt) {
+      const fix = await db.remediationAction.findFirst({
+        where: {
+          connectionId: input.connectionId,
+          resourceId: input.resourceId,
+          status: 'success',
+          createdAt: {
+            gte: input.priorRunCompletedAt,
+            lte: input.currentRunStartedAt,
+          },
+        },
+        orderBy: { createdAt: 'desc' },
+        select: { id: true, initiatedById: true },
+      });
+      if (fix) {
+        return {
+          method: 'platform_fix',
+          remediationActionId: fix.id,
+          resolvedById: fix.initiatedById ?? undefined,
+        };
+      }
+    }
+
+    // 3) Resource missing entirely from current results → deleted.
+    if (!input.currentExists) return { method: 'resource_deleted' };
+
+    // 4) Otherwise — customer fixed it outside our platform.
+    return { method: 'external_fix' };
+  }
+}
+
+function indexResults(
+  results: Array<{
+    passed: boolean;
+    resourceId: string | null;
+    resourceType: string | null;
+    evidence: unknown;
+  }>,
+): Map<string, NormalizedResult> {
+  const map = new Map<string, NormalizedResult>();
+  for (const r of results) {
+    if (!r.resourceId) continue;
+    const evidence =
+      r.evidence && typeof r.evidence === 'object'
+        ? (r.evidence as Record<string, unknown>)
+        : null;
+    const findingKey =
+      evidence && typeof evidence.findingKey === 'string'
+        ? evidence.findingKey
+        : null;
+    if (!findingKey) continue;
+    const serviceId =
+      evidence && typeof evidence.serviceId === 'string'
+        ? evidence.serviceId
+        : null;
+    const checkKey = normalizeCheckId(findingKey, r.resourceId);
+    const compositeKey = `${checkKey}::${r.resourceId}`;
+    map.set(compositeKey, {
+      findingKey,
+      resourceId: r.resourceId,
+      resourceType: r.resourceType,
+      serviceId,
+      passed: r.passed,
+    });
+  }
+  return map;
+}
+
+function daysBetween(a: Date, b: Date): number {
+  const ms = b.getTime() - a.getTime();
+  return Math.max(0, Math.floor(ms / (24 * 60 * 60 * 1000)));
+}
diff --git a/apps/api/src/comments/comments-permission.guard.spec.ts b/apps/api/src/comments/comments-permission.guard.spec.ts
new file mode 100644
index 0000000000..99284221b5
--- /dev/null
+++ b/apps/api/src/comments/comments-permission.guard.spec.ts
@@ -0,0 +1,200 @@
+import type { ExecutionContext } from '@nestjs/common';
+import { ForbiddenException } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+
+// Mock @db before importing the guard so the Prisma client doesn't try to
+// initialize against a real DATABASE_URL in this unit-test env.
+jest.mock('@db', () => ({
+  CommentEntityType: {
+    task: 'task',
+    vendor: 'vendor',
+    risk: 'risk',
+    policy: 'policy',
+    finding: 'finding',
+  },
+}));
+
+// Mock the permission.guard module so we don't pull better-auth's init chain
+// (the guard only borrows the PERMISSIONS_KEY constant + RequiredPermission
+// type — both safe to redefine here).
+jest.mock('../auth/permission.guard', () => ({
+  PERMISSIONS_KEY: 'permissions',
+}));
+
+jest.mock('../auth/auth.server', () => ({
+  auth: { api: { hasPermission: jest.fn() } },
+}));
+
+import { CommentsPermissionGuard } from './comments-permission.guard';
+import { auth } from '../auth/auth.server';
+
+type MockRequest = {
+  method: string;
+  query?: Record<string, unknown>;
+  body?: Record<string, unknown>;
+  headers: Record<string, string>;
+  isApiKey?: boolean;
+  isServiceToken?: boolean;
+  isPlatformAdmin?: boolean;
+};
+
+function makeContext(request: MockRequest): ExecutionContext {
+  return {
+    getHandler: () => ({}),
+    getClass: () => ({}),
+    switchToHttp: () => ({
+      getRequest: () => request,
+      getResponse: () => ({}),
+      getNext: () => ({}),
+    }),
+  } as unknown as ExecutionContext;
+}
+
+const hasPermissionMock = auth.api.hasPermission as unknown as jest.Mock;
+
+function reflectorWith(resource: string, action: string): Reflector {
+  const reflector = new Reflector();
+  jest
+    .spyOn(reflector, 'getAllAndOverride')
+    .mockReturnValue([{ resource, actions: [action] }]);
+  return reflector;
+}
+
+describe('CommentsPermissionGuard', () => {
+  beforeEach(() => {
+    hasPermissionMock.mockReset();
+  });
+
+  it('resolves entityType from POST body and checks finding:update when finding', async () => {
+    hasPermissionMock.mockResolvedValueOnce({ success: true });
+    const guard = new CommentsPermissionGuard(
+      reflectorWith('task', 'update'),
+    );
+    const context = makeContext({
+      method: 'POST',
+      body: { entityType: 'finding' },
+      headers: { cookie: 'session=abc' },
+    });
+    await expect(guard.canActivate(context)).resolves.toBe(true);
+    expect(hasPermissionMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        body: expect.objectContaining({
+          permissions: { finding: ['update'] },
+        }),
+      }),
+    );
+  });
+
+  it('resolves entityType from GET query and checks finding:read when finding', async () => {
+    hasPermissionMock.mockResolvedValueOnce({ success: true });
+    const guard = new CommentsPermissionGuard(reflectorWith('task', 'read'));
+    const context = makeContext({
+      method: 'GET',
+      query: { entityType: 'finding' },
+      headers: { cookie: 'session=abc' },
+    });
+    await expect(guard.canActivate(context)).resolves.toBe(true);
+    expect(hasPermissionMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        body: expect.objectContaining({
+          permissions: { finding: ['read'] },
+        }),
+      }),
+    );
+  });
+
+  it('falls back to the metadata resource when entityType is missing (PUT)', async () => {
+    hasPermissionMock.mockResolvedValueOnce({ success: true });
+    const guard = new CommentsPermissionGuard(
+      reflectorWith('task', 'update'),
+    );
+    const context = makeContext({
+      method: 'PUT',
+      body: { content: 'edit' },
+      headers: { cookie: 'session=abc' },
+    });
+    await expect(guard.canActivate(context)).resolves.toBe(true);
+    expect(hasPermissionMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        body: expect.objectContaining({
+          permissions: { task: ['update'] },
+        }),
+      }),
+    );
+  });
+
+  it('falls back to the metadata resource for unknown entityType values', async () => {
+    hasPermissionMock.mockResolvedValueOnce({ success: true });
+    const guard = new CommentsPermissionGuard(
+      reflectorWith('task', 'update'),
+    );
+    const context = makeContext({
+      method: 'POST',
+      body: { entityType: 'not-an-entity' },
+      headers: { cookie: 'session=abc' },
+    });
+    await guard.canActivate(context);
+    expect(hasPermissionMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        body: expect.objectContaining({
+          permissions: { task: ['update'] },
+        }),
+      }),
+    );
+  });
+
+  it('throws ForbiddenException when better-auth rejects', async () => {
+    hasPermissionMock.mockResolvedValueOnce({ success: false });
+    const guard = new CommentsPermissionGuard(
+      reflectorWith('task', 'update'),
+    );
+    const context = makeContext({
+      method: 'POST',
+      body: { entityType: 'finding' },
+      headers: { cookie: 'session=abc' },
+    });
+    await expect(guard.canActivate(context)).rejects.toThrow(
+      ForbiddenException,
+    );
+  });
+
+  it('returns true without invoking better-auth for API keys (handled by scope check upstream)', async () => {
+    const guard = new CommentsPermissionGuard(
+      reflectorWith('task', 'update'),
+    );
+    const context = makeContext({
+      method: 'POST',
+      body: { entityType: 'finding' },
+      headers: {},
+      isApiKey: true,
+    });
+    await expect(guard.canActivate(context)).resolves.toBe(true);
+    expect(hasPermissionMock).not.toHaveBeenCalled();
+  });
+
+  it('returns true without invoking better-auth for platform admins', async () => {
+    const guard = new CommentsPermissionGuard(
+      reflectorWith('task', 'update'),
+    );
+    const context = makeContext({
+      method: 'POST',
+      body: { entityType: 'finding' },
+      headers: {},
+      isPlatformAdmin: true,
+    });
+    await expect(guard.canActivate(context)).resolves.toBe(true);
+    expect(hasPermissionMock).not.toHaveBeenCalled();
+  });
+
+  it('returns true when no @RequirePermission metadata is set (endpoint opted out)', async () => {
+    const reflector = new Reflector();
+    jest.spyOn(reflector, 'getAllAndOverride').mockReturnValue(undefined);
+    const guard = new CommentsPermissionGuard(reflector);
+    const context = makeContext({
+      method: 'POST',
+      body: { entityType: 'finding' },
+      headers: {},
+    });
+    await expect(guard.canActivate(context)).resolves.toBe(true);
+  });
+});
diff --git a/apps/api/src/comments/comments-permission.guard.ts b/apps/api/src/comments/comments-permission.guard.ts
new file mode 100644
index 0000000000..3b6d375649
--- /dev/null
+++ b/apps/api/src/comments/comments-permission.guard.ts
@@ -0,0 +1,134 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+  Logger,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { CommentEntityType } from '@db';
+import type { Request } from 'express';
+import { auth } from '../auth/auth.server';
+import {
+  PERMISSIONS_KEY,
+  type RequiredPermission,
+} from '../auth/permission.guard';
+import type { AuthenticatedRequest } from '../auth/types';
+
+/**
+ * Local request shape — combines the express-side fields we need
+ * (`query`, `body`, `method`) with the project-wide AuthenticatedRequest
+ * augmentations. The project's `AuthenticatedRequest` extends the global
+ * fetch-API `Request` (no query/body), so we re-augment it here.
+ */
+type GuardedRequest = AuthenticatedRequest & Request;
+
+/**
+ * Comment endpoints support multiple entity types (task / policy / vendor /
+ * risk / finding). The required permission is therefore dynamic — read by
+ * `${entityType}:${action}` rather than the hardcoded `task:${action}` the
+ * default PermissionGuard would enforce.
+ *
+ * Why it's needed: auditors hold `finding:update` but NOT `task:update`,
+ * yet the only way to collaborate on a finding is to comment on it. The
+ * vanilla guard would block them at the door.
+ *
+ * Implementation strategy:
+ *   1. Read `@RequirePermission` metadata for the FALLBACK action (kept
+ *      intact so AuditLogInterceptor still derives the right resource/
+ *      action for its log line — close enough for audit trail purposes).
+ *   2. Resolve the actual entityType from the request:
+ *      - GET  → query string (`?entityType=finding`)
+ *      - POST → request body (`{ entityType: "finding" }`)
+ *      - PUT  / DELETE → fall back to the metadata's resource (commentId
+ *        is opaque; resolving entityType would need a DB lookup which
+ *        Phase 4 v1 explicitly defers — author-only editing keeps the
+ *        existing task-permission gate in practice).
+ *   3. Call better-auth's `hasPermission` with the resolved permission.
+ */
+@Injectable()
+export class CommentsPermissionGuard implements CanActivate {
+  private readonly logger = new Logger(CommentsPermissionGuard.name);
+
+  constructor(private readonly reflector: Reflector) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const required = this.reflector.getAllAndOverride<RequiredPermission[]>(
+      PERMISSIONS_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+
+    if (!required || required.length === 0) return true;
+
+    const request = context.switchToHttp().getRequest<GuardedRequest>();
+
+    // API keys and service tokens use the existing fallback behaviour from
+    // the standard PermissionGuard — no entity-type-aware logic needed.
+    // Defer to scope checks against the literal metadata.
+    if (request.isApiKey || request.isServiceToken || request.isPlatformAdmin) {
+      return true;
+    }
+
+    const fallback = required[0];
+    const action = fallback.actions[0];
+    const resource = this.resolveEntityResource(request, fallback.resource);
+
+    const permissions: Record<string, string[]> = { [resource]: [action] };
+
+    const allowed = await this.checkPermission(request, permissions);
+    if (!allowed) {
+      this.logger.warn(
+        `[CommentsPermissionGuard] Denied ${request.method} ${request.url}. Required: ${resource}:${action}`,
+      );
+      throw new ForbiddenException('Access denied');
+    }
+    return true;
+  }
+
+  private resolveEntityResource(
+    request: GuardedRequest,
+    fallback: string,
+  ): string {
+    const method = request.method?.toUpperCase();
+    let candidate: unknown;
+    if (method === 'GET') {
+      candidate = (request.query as Record<string, unknown> | undefined)
+        ?.entityType;
+    } else if (method === 'POST') {
+      candidate = (request.body as Record<string, unknown> | undefined)
+        ?.entityType;
+    }
+
+    if (typeof candidate !== 'string') return fallback;
+    // Trust only enum values — anything else falls back to the metadata.
+    return (Object.values(CommentEntityType) as string[]).includes(candidate)
+      ? candidate
+      : fallback;
+  }
+
+  /**
+   * Mirrors the cookie/header forwarding pattern of the standard
+   * PermissionGuard so role-based and custom-role permissions both work.
+   * Kept private and inline rather than extracted to a shared utility —
+   * Phase 4 introduces only this one extra caller.
+   */
+  private async checkPermission(
+    request: GuardedRequest,
+    permissions: Record<string, string[]>,
+  ): Promise<boolean> {
+    const headers = new Headers();
+    const authHeader = request.headers['authorization'] as string;
+    if (authHeader) headers.set('authorization', authHeader);
+    const cookieHeader = request.headers['cookie'] as string;
+    if (cookieHeader) headers.set('cookie', cookieHeader);
+
+    if (!authHeader && !cookieHeader) return false;
+
+    // Spell the union-typed body out so zod 4 inside better-auth doesn't
+    // reject the missing `permission` discriminator. Same gotcha as the
+    // standard PermissionGuard.
+    const body = { permissions, permission: undefined };
+    const result = await auth.api.hasPermission({ headers, body });
+    return result.success === true;
+  }
+}
diff --git a/apps/api/src/comments/comments.controller.ts b/apps/api/src/comments/comments.controller.ts
index 7329aa6341..006b92bcb9 100644
--- a/apps/api/src/comments/comments.controller.ts
+++ b/apps/api/src/comments/comments.controller.ts
@@ -22,9 +22,9 @@ import {
 } from '@nestjs/swagger';
 import { AuthContext, OrganizationId } from '../auth/auth-context.decorator';
 import { HybridAuthGuard } from '../auth/hybrid-auth.guard';
-import { PermissionGuard } from '../auth/permission.guard';
 import { RequirePermission } from '../auth/require-permission.decorator';
 import type { AuthContext as AuthContextType } from '../auth/types';
+import { CommentsPermissionGuard } from './comments-permission.guard';
 import { CommentsService } from './comments.service';
 import { CommentResponseDto } from './dto/comment-responses.dto';
 import { CreateCommentDto } from './dto/create-comment.dto';
@@ -33,7 +33,10 @@ import { UpdateCommentDto } from './dto/update-comment.dto';
 
 @ApiTags('Comments')
 @Controller({ path: 'comments', version: '1' })
-@UseGuards(HybridAuthGuard, PermissionGuard)
+// CommentsPermissionGuard replaces the standard PermissionGuard so that
+// permission checks scale by entityType (task/finding/policy/vendor/risk)
+// rather than always gating on `task:*`. See comments-permission.guard.ts.
+@UseGuards(HybridAuthGuard, CommentsPermissionGuard)
 @ApiSecurity('apikey')
 export class CommentsController {
   constructor(private readonly commentsService: CommentsService) {}
diff --git a/apps/api/src/comments/comments.module.ts b/apps/api/src/comments/comments.module.ts
index 763eb7379f..0c29ceff68 100644
--- a/apps/api/src/comments/comments.module.ts
+++ b/apps/api/src/comments/comments.module.ts
@@ -2,6 +2,7 @@ import { Module } from '@nestjs/common';
 import { AttachmentsModule } from '../attachments/attachments.module';
 import { AuthModule } from '../auth/auth.module';
 import { CommentsController } from './comments.controller';
+import { CommentsPermissionGuard } from './comments-permission.guard';
 import { CommentsService } from './comments.service';
 import { CommentMentionNotifierService } from './comment-mention-notifier.service';
 import { NovuService } from '../notifications/novu.service';
@@ -9,7 +10,12 @@ import { NovuService } from '../notifications/novu.service';
 @Module({
   imports: [AuthModule, AttachmentsModule], // Import AuthModule for HybridAuthGuard dependencies
   controllers: [CommentsController],
-  providers: [CommentsService, CommentMentionNotifierService, NovuService],
+  providers: [
+    CommentsService,
+    CommentsPermissionGuard,
+    CommentMentionNotifierService,
+    NovuService,
+  ],
   exports: [CommentsService],
 })
 export class CommentsModule {}
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckDefinitionPanel.test.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckDefinitionPanel.test.tsx
new file mode 100644
index 0000000000..59047da4e2
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckDefinitionPanel.test.tsx
@@ -0,0 +1,110 @@
+import { render, screen } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+type SwrShape = {
+  data: { data: unknown } | undefined;
+  error: unknown;
+  isLoading: boolean;
+};
+
+const mockUseSWR = vi.fn<() => SwrShape>();
+
+vi.mock('@/hooks/use-api', () => ({
+  useApi: () => ({
+    useSWR: (_url: string) => mockUseSWR(),
+  }),
+}));
+
+import { CheckDefinitionPanel } from './CheckDefinitionPanel';
+
+describe('CheckDefinitionPanel', () => {
+  beforeEach(() => {
+    mockUseSWR.mockReset();
+  });
+
+  it('renders a loading skeleton while the fetch is in flight', () => {
+    mockUseSWR.mockReturnValue({
+      data: undefined,
+      error: null,
+      isLoading: true,
+    });
+    render(<CheckDefinitionPanel findingId="icx_abc" />);
+    expect(
+      screen.getByText(/Generating check description/i),
+    ).toBeInTheDocument();
+  });
+
+  it('renders all Tier 3 fields when the AI/provider responds successfully', () => {
+    mockUseSWR.mockReturnValue({
+      data: {
+        data: {
+          data: {
+            title: 'IAM password policy enforces 14+ character minimum',
+            description:
+              'Verifies that the AWS account password policy requires user passwords to be at least 14 characters long.',
+            passCriteria:
+              'Password policy exists AND MinimumPasswordLength >= 14',
+            failCriteria:
+              'No password policy OR MinimumPasswordLength < 14',
+            whyItMatters:
+              'Short passwords are vulnerable to brute force attacks.',
+            source: 'ai',
+          },
+        },
+      },
+      error: null,
+      isLoading: false,
+    });
+    render(<CheckDefinitionPanel findingId="icx_abc" />);
+    expect(screen.getByText('About this check')).toBeInTheDocument();
+    expect(screen.getByText('What it checks')).toBeInTheDocument();
+    expect(screen.getByText('Pass criteria')).toBeInTheDocument();
+    expect(screen.getByText('Fail criteria')).toBeInTheDocument();
+    expect(screen.getByText('Why it matters')).toBeInTheDocument();
+    expect(
+      screen.getByText(/at least 14 characters long/i),
+    ).toBeInTheDocument();
+  });
+
+  it('renders nothing when fetch errors (graceful degrade)', () => {
+    mockUseSWR.mockReturnValue({
+      data: undefined,
+      error: new Error('500'),
+      isLoading: false,
+    });
+    const { container } = render(<CheckDefinitionPanel findingId="icx_abc" />);
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('renders nothing when AI returned null (e.g. legacy with no description)', () => {
+    mockUseSWR.mockReturnValue({
+      data: { data: { data: null } },
+      error: null,
+      isLoading: false,
+    });
+    const { container } = render(<CheckDefinitionPanel findingId="icx_abc" />);
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('shows a "From provider catalog" badge for GCP/Azure-sourced descriptions', () => {
+    mockUseSWR.mockReturnValue({
+      data: {
+        data: {
+          data: {
+            title: 'Cloud Storage bucket is publicly accessible',
+            description: 'Surfaced from Google Security Command Center.',
+            passCriteria: 'No public ACLs detected.',
+            failCriteria: 'Bucket has public ACL grants.',
+            whyItMatters: 'Public buckets risk data exposure.',
+            source: 'provider',
+          },
+        },
+      },
+      error: null,
+      isLoading: false,
+    });
+    render(<CheckDefinitionPanel findingId="icx_abc" />);
+    expect(screen.getByText('About this check')).toBeInTheDocument();
+    expect(screen.getByText(/From provider catalog/i)).toBeInTheDocument();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckDefinitionPanel.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckDefinitionPanel.tsx
new file mode 100644
index 0000000000..11179f5358
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckDefinitionPanel.tsx
@@ -0,0 +1,84 @@
+'use client';
+
+import { useApi } from '@/hooks/use-api';
+import { Loader2 } from 'lucide-react';
+
+interface CheckDefinitionPanelProps {
+  findingId: string;
+}
+
+interface CheckDefinition {
+  title: string;
+  description: string;
+  passCriteria: string;
+  failCriteria: string;
+  whyItMatters: string;
+  source: 'ai' | 'provider';
+}
+
+/**
+ * Renders the "About this check" panel inside an expanded finding row.
+ *
+ * Fetches a Tier 3 description lazily from
+ * /v1/cloud-security/findings/:id/check-definition. The first request
+ * for an AWS check triggers a Haiku call server-side (~1-2s). Subsequent
+ * requests for the same check in the same org hit the DB cache (~50ms).
+ * GCP/Azure findings resolve synchronously from provider evidence.
+ *
+ * Renders null on error or empty response so the existing finding
+ * description / remediation always remain visible — auditor trust takes
+ * precedence over completeness.
+ */
+export function CheckDefinitionPanel({ findingId }: CheckDefinitionPanelProps) {
+  const api = useApi();
+  const { data, error, isLoading } = api.useSWR<{
+    data: CheckDefinition | null;
+  }>(`/v1/cloud-security/findings/${findingId}/check-definition`, {
+    revalidateOnFocus: false,
+    // Browser-side dedupe — same finding clicked twice in a session = one fetch.
+    dedupingInterval: 5 * 60 * 1000,
+  });
+
+  if (isLoading) return <CheckDefinitionSkeleton />;
+  const definition = data?.data?.data ?? null;
+  if (error || !definition) return null;
+
+  return (
+    <div className="rounded-md border bg-background">
+      <div className="flex items-center justify-between border-b px-3 py-2">
+        <h4 className="text-xs font-medium">About this check</h4>
+        {definition.source === 'provider' && (
+          <span className="text-[10px] text-muted-foreground">
+            From provider catalog
+          </span>
+        )}
+      </div>
+      <dl className="space-y-2.5 px-3 py-3 text-xs">
+        <DefinitionField label="What it checks" value={definition.description} />
+        <DefinitionField label="Pass criteria" value={definition.passCriteria} />
+        <DefinitionField label="Fail criteria" value={definition.failCriteria} />
+        <DefinitionField label="Why it matters" value={definition.whyItMatters} />
+      </dl>
+    </div>
+  );
+}
+
+function CheckDefinitionSkeleton() {
+  return (
+    <div className="rounded-md border bg-background px-3 py-2.5">
+      <div className="flex items-center gap-2 text-xs text-muted-foreground">
+        <Loader2 className="h-3 w-3 animate-spin" />
+        Generating check description...
+      </div>
+    </div>
+  );
+}
+
+function DefinitionField({ label, value }: { label: string; value: string }) {
+  return (
+    <div>
+      <dt className="text-foreground font-medium">{label}</dt>
+      <dd className="text-muted-foreground mt-0.5 leading-relaxed">{value}</dd>
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckGroupBlock.test.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckGroupBlock.test.tsx
new file mode 100644
index 0000000000..b21e2e1072
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckGroupBlock.test.tsx
@@ -0,0 +1,190 @@
+import { render, screen, fireEvent } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+import type { Finding } from '../types';
+import type { CheckGroup } from './check-groups';
+import { CheckGroupBlock } from './CheckGroupBlock';
+
+function makeFinding(overrides: Partial<Finding>): Finding {
+  return {
+    id: `icx_${Math.random().toString(36).slice(2, 8)}`,
+    title: 'A finding',
+    description: null,
+    remediation: null,
+    status: 'failed',
+    severity: 'medium',
+    serviceId: 'iam',
+    findingKey: null,
+    resourceId: null,
+    resourceType: null,
+    checkId: null,
+    checkKey: 'iam-test',
+    evidence: null,
+    projectDisplayName: null,
+    completedAt: null,
+    connectionId: 'icn_test',
+    providerSlug: 'aws',
+    integration: { integrationId: 'aws' },
+    ...overrides,
+  };
+}
+
+function makeGroup(overrides: Partial<CheckGroup> = {}): CheckGroup {
+  const failed = overrides.failed ?? [
+    makeFinding({ id: 'f1', status: 'failed', resourceId: 'r1' }),
+  ];
+  const passed = overrides.passed ?? [];
+  return {
+    checkKey: 'iam-test',
+    checkTitle: 'IAM users have MFA enabled',
+    failed,
+    passed,
+    all: [...failed, ...passed],
+    severity: 'high',
+    ...overrides,
+  };
+}
+
+describe('CheckGroupBlock', () => {
+  it('renders the check title and failing/total count', () => {
+    const group = makeGroup({
+      failed: [
+        makeFinding({ id: 'f1', status: 'failed' }),
+        makeFinding({ id: 'f2', status: 'failed' }),
+      ],
+      passed: [
+        makeFinding({ id: 'p1', status: 'passed' }),
+        makeFinding({ id: 'p2', status: 'passed' }),
+        makeFinding({ id: 'p3', status: 'passed' }),
+      ],
+    });
+    render(
+      <CheckGroupBlock
+        group={group}
+        severityFilter={null}
+        renderRow={(f) => <div data-testid={`row-${f.id}`}>{f.id}</div>}
+      />,
+    );
+    expect(screen.getByText('IAM users have MFA enabled')).toBeInTheDocument();
+    expect(screen.getByText(/2 of 5 failing/i)).toBeInTheDocument();
+  });
+
+  it('renders only failing rows by default', () => {
+    const group = makeGroup({
+      failed: [makeFinding({ id: 'f1', status: 'failed' })],
+      passed: [
+        makeFinding({ id: 'p1', status: 'passed' }),
+        makeFinding({ id: 'p2', status: 'passed' }),
+      ],
+    });
+    render(
+      <CheckGroupBlock
+        group={group}
+        severityFilter={null}
+        renderRow={(f) => <div data-testid={`row-${f.id}`}>{f.id}</div>}
+      />,
+    );
+    expect(screen.getByTestId('row-f1')).toBeInTheDocument();
+    expect(screen.queryByTestId('row-p1')).not.toBeInTheDocument();
+    expect(screen.queryByTestId('row-p2')).not.toBeInTheDocument();
+  });
+
+  it('reveals passing rows when "Show all" is clicked', () => {
+    const group = makeGroup({
+      failed: [makeFinding({ id: 'f1', status: 'failed' })],
+      passed: [
+        makeFinding({ id: 'p1', status: 'passed' }),
+        makeFinding({ id: 'p2', status: 'passed' }),
+      ],
+    });
+    render(
+      <CheckGroupBlock
+        group={group}
+        severityFilter={null}
+        renderRow={(f) => <div data-testid={`row-${f.id}`}>{f.id}</div>}
+      />,
+    );
+    fireEvent.click(screen.getByRole('button', { name: /show all 3 results/i }));
+    expect(screen.getByTestId('row-f1')).toBeInTheDocument();
+    expect(screen.getByTestId('row-p1')).toBeInTheDocument();
+    expect(screen.getByTestId('row-p2')).toBeInTheDocument();
+  });
+
+  it('renders compact all-passing line when no failures and no severity filter', () => {
+    const group = makeGroup({
+      failed: [],
+      passed: [
+        makeFinding({ id: 'p1', status: 'passed' }),
+        makeFinding({ id: 'p2', status: 'passed' }),
+      ],
+    });
+    render(
+      <CheckGroupBlock
+        group={group}
+        severityFilter={null}
+        renderRow={(f) => <div data-testid={`row-${f.id}`}>{f.id}</div>}
+      />,
+    );
+    expect(screen.getByText(/all 2 passing/i)).toBeInTheDocument();
+    expect(screen.queryByTestId('row-p1')).not.toBeInTheDocument();
+  });
+
+  it('hides the check entirely when severity filter is active and there is no failure', () => {
+    const group = makeGroup({
+      failed: [],
+      passed: [makeFinding({ id: 'p1', status: 'passed' })],
+    });
+    const { container } = render(
+      <CheckGroupBlock
+        group={group}
+        severityFilter="critical"
+        renderRow={(f) => <div data-testid={`row-${f.id}`}>{f.id}</div>}
+      />,
+    );
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('filters failing rows by active severity filter', () => {
+    const group = makeGroup({
+      failed: [
+        makeFinding({ id: 'f1', status: 'failed', severity: 'critical' }),
+        makeFinding({ id: 'f2', status: 'failed', severity: 'medium' }),
+      ],
+      passed: [],
+    });
+    render(
+      <CheckGroupBlock
+        group={group}
+        severityFilter="critical"
+        renderRow={(f) => <div data-testid={`row-${f.id}`}>{f.id}</div>}
+      />,
+    );
+    expect(screen.getByTestId('row-f1')).toBeInTheDocument();
+    expect(screen.queryByTestId('row-f2')).not.toBeInTheDocument();
+  });
+
+  it('caps rendered rows at 100 and shows a Show-more affordance', () => {
+    // 150 failing rows — only 100 should render initially.
+    const failed = Array.from({ length: 150 }, (_, i) =>
+      makeFinding({ id: `f${i}`, status: 'failed', resourceId: `r${i}` }),
+    );
+    const group = makeGroup({ failed, passed: [] });
+    render(
+      <CheckGroupBlock
+        group={group}
+        severityFilter={null}
+        renderRow={(f) => <div data-testid={`row-${f.id}`}>{f.id}</div>}
+      />,
+    );
+    // 100 rows rendered, 50 hidden behind a "Show more" button.
+    expect(screen.getByTestId('row-f0')).toBeInTheDocument();
+    expect(screen.getByTestId('row-f99')).toBeInTheDocument();
+    expect(screen.queryByTestId('row-f100')).not.toBeInTheDocument();
+    const showMore = screen.getByRole('button', {
+      name: /show 50 more results/i,
+    });
+    expect(showMore).toBeInTheDocument();
+    fireEvent.click(showMore);
+    expect(screen.getByTestId('row-f100')).toBeInTheDocument();
+    expect(screen.getByTestId('row-f149')).toBeInTheDocument();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckGroupBlock.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckGroupBlock.tsx
new file mode 100644
index 0000000000..ecdebad4a3
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CheckGroupBlock.tsx
@@ -0,0 +1,138 @@
+'use client';
+
+import { Badge } from '@trycompai/ui/badge';
+import { ChevronDown, ChevronRight, ShieldCheck } from 'lucide-react';
+import { useMemo, useState } from 'react';
+import type { Finding } from '../types';
+import type { CheckGroup } from './check-groups';
+
+/**
+ * Per-check display cap. If a single check produces more failing rows
+ * than this we render the first N and surface a "Show all N" affordance
+ * — keeps the browser responsive on the rare account with hundreds of
+ * resources of a single kind.
+ */
+const PER_CHECK_DISPLAY_LIMIT = 100;
+
+const SEVERITY_DOTS: Record<string, string> = {
+  critical: 'bg-red-500',
+  high: 'bg-orange-500',
+  medium: 'bg-yellow-500',
+  low: 'bg-blue-500',
+  info: 'bg-gray-400',
+};
+
+export interface CheckGroupBlockProps {
+  group: CheckGroup;
+  /** Active severity filter from the parent — used to filter failing rows. */
+  severityFilter: string | null;
+  /** Renders the per-finding row (FindingRow lives in the parent file). */
+  renderRow: (finding: Finding) => React.ReactNode;
+}
+
+export function CheckGroupBlock({
+  group,
+  severityFilter,
+  renderRow,
+}: CheckGroupBlockProps) {
+  const [showAll, setShowAll] = useState(false);
+  const [revealedMore, setRevealedMore] = useState(false);
+
+  // Apply severity filter to the failing rows shown by default.
+  const visibleFailing = useMemo(() => {
+    if (!severityFilter) return group.failed;
+    return group.failed.filter(
+      (f) => f.severity?.toLowerCase() === severityFilter,
+    );
+  }, [group.failed, severityFilter]);
+
+  // When user toggles "Show all results" we render every instance (passed +
+  // failed). Severity filter is intentionally ignored in this mode because
+  // the user is explicitly asking for a full audit list.
+  const fullList = group.all;
+  const rendered = showAll ? fullList : visibleFailing;
+  const displayCap = revealedMore ? Infinity : PER_CHECK_DISPLAY_LIMIT;
+  const visibleRows = rendered.slice(0, displayCap);
+  const hiddenRowsCount = Math.max(0, rendered.length - visibleRows.length);
+
+  // Compact line for checks with no failures (and no severity filter).
+  if (group.failed.length === 0 && !showAll) {
+    if (severityFilter) return null;
+    return (
+      <div className="flex items-center gap-2 px-4 py-2 text-xs text-primary">
+        <ShieldCheck className="h-3 w-3" />
+        <span className="font-medium">{group.checkTitle}</span>
+        <span className="text-muted-foreground">
+          — all {group.all.length} passing
+        </span>
+        {group.all.length > 0 && (
+          <button
+            type="button"
+            onClick={() => setShowAll(true)}
+            className="ml-auto text-[10px] font-medium text-primary hover:underline"
+          >
+            Show resources
+          </button>
+        )}
+      </div>
+    );
+  }
+
+  return (
+    <div>
+      <div className="flex items-center gap-2 border-b bg-muted/30 px-4 py-2">
+        <span
+          className={`h-1.5 w-1.5 shrink-0 rounded-full ${
+            SEVERITY_DOTS[group.severity] ?? SEVERITY_DOTS.info
+          }`}
+        />
+        <span className="text-xs font-medium truncate flex-1">
+          {group.checkTitle}
+        </span>
+        <span className="text-[10px] text-muted-foreground">
+          {group.failed.length} of {group.all.length} failing
+        </span>
+        {group.all.length > group.failed.length && (
+          <button
+            type="button"
+            onClick={() => setShowAll((prev) => !prev)}
+            className="inline-flex items-center gap-1 rounded-full border bg-background px-2 py-0.5 text-[10px] font-medium text-muted-foreground hover:bg-muted"
+            aria-pressed={showAll}
+          >
+            {showAll ? (
+              <>
+                <ChevronDown className="h-2.5 w-2.5" />
+                Hide passing
+              </>
+            ) : (
+              <>
+                <ChevronRight className="h-2.5 w-2.5" />
+                Show all {group.all.length} results
+              </>
+            )}
+          </button>
+        )}
+      </div>
+      {visibleRows.length === 0 && severityFilter && (
+        <div className="px-4 py-3 text-xs text-muted-foreground">
+          No {severityFilter}-severity failures for this check.
+        </div>
+      )}
+      {visibleRows.map((finding) => (
+        <div key={finding.id}>{renderRow(finding)}</div>
+      ))}
+      {hiddenRowsCount > 0 && !revealedMore && (
+        <button
+          type="button"
+          onClick={() => setRevealedMore(true)}
+          className="flex w-full items-center justify-center gap-1.5 px-4 py-2 text-xs text-primary hover:bg-muted/40"
+        >
+          <ChevronDown className="h-3 w-3" />
+          Show {hiddenRowsCount} more results
+        </button>
+      )}
+    </div>
+  );
+}
+
+export { PER_CHECK_DISPLAY_LIMIT };
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
index 414469f937..829521d988 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
@@ -1,6 +1,7 @@
 'use client';
 
 import { useApi } from '@/hooks/use-api';
+import { usePermissions } from '@/hooks/use-permissions';
 import {
   getAwsCloudShellUrl,
   getAwsRemediationScript,
@@ -41,7 +42,12 @@ import { GcpSetupGuide } from './GcpSetupGuide';
 import { RemediationDialog } from './RemediationDialog';
 import { ScheduledScanPopover } from './ScheduledScanPopover';
 
-import type { Finding } from '../types';
+import type { Finding, ProviderLatestRun } from '../types';
+import { CheckDefinitionPanel } from './CheckDefinitionPanel';
+import { CheckGroupBlock } from './CheckGroupBlock';
+import { buildCheckGroups } from './check-groups';
+import { EvidenceJsonViewer } from './EvidenceJsonViewer';
+import { MarkExceptionModal } from './MarkExceptionModal';
 
 interface RemediationCapabilities {
   enabled: boolean;
@@ -63,6 +69,8 @@ interface CloudTestsSectionProps {
   orgId: string;
   /** When the last scan completed — null means never scanned */
   lastRunAt?: Date | null;
+  /** Latest scan summary (counts, duration). null for legacy or never-scanned. */
+  latestRun?: ProviderLatestRun | null;
   /** Connection variables (e.g., GCP org ID) */
   variables?: Record<string, unknown>;
   awsType?: string;
@@ -155,6 +163,7 @@ const SERVICE_NAMES: Record<string, string> = {
 interface ServiceGroup {
   serviceId: string;
   name: string;
+  /** ALL findings for this service (passed + failed), already filtered by search query. */
   findings: Finding[];
   passed: number;
   failed: number;
@@ -166,6 +175,7 @@ export function CloudTestsSection({
   onScanComplete,
   orgId,
   lastRunAt,
+  latestRun,
   variables,
   awsType,
 }: CloudTestsSectionProps) {
@@ -198,6 +208,13 @@ export function CloudTestsSection({
     description?: string;
   } | null>(null);
   const [showSetupDialog, setShowSetupDialog] = useState(false);
+  const { hasPermission } = usePermissions();
+  const canMarkException = hasPermission('integration', 'update');
+  const [exceptionTarget, setExceptionTarget] = useState<{
+    findingId: string;
+    findingTitle: string;
+    resourceLabel: string | null;
+  } | null>(null);
 
   const findingsResponse = api.useSWR<{ data: Finding[]; count: number }>(
     '/v1/cloud-security/findings',
@@ -290,7 +307,9 @@ export function CloudTestsSection({
   const failedFindings = findings.filter((f) => f.status === 'failed' || f.status === 'FAILED');
   const passedFindings = findings.filter((f) => f.status === 'passed' || f.status === 'success');
 
-  // Group findings by serviceId
+  // Group findings by serviceId. `findings` on the resulting group holds the
+  // full set (passed + failed) matching the search query — per-check sub-
+  // grouping and the severity filter are applied at render time.
   const serviceGroups = useMemo(() => {
     const q = searchQuery.toLowerCase().trim();
     const groupMap = new Map<string, Finding[]>();
@@ -306,35 +325,48 @@ export function CloudTestsSection({
       const serviceName = SERVICE_NAMES[serviceId] ?? serviceId;
       const serviceMatches = q ? serviceName.toLowerCase().includes(q) : true;
 
-      const failed = groupFindings.filter((f) => f.status === 'failed' || f.status === 'FAILED');
-      const passed = groupFindings.filter((f) => f.status === 'passed' || f.status === 'success');
-
-      let filteredFailed = severityFilter
-        ? failed.filter((f) => f.severity?.toLowerCase() === severityFilter)
-        : failed;
+      // If search query exists and service name doesn't match, filter findings
+      // by title/description/findingKey. Otherwise include all findings.
+      const matching =
+        q && !serviceMatches
+          ? groupFindings.filter(
+              (f) =>
+                f.title?.toLowerCase().includes(q) ||
+                f.description?.toLowerCase().includes(q) ||
+                f.findingKey?.toLowerCase().includes(q),
+            )
+          : groupFindings;
+
+      const failed = matching.filter(
+        (f) => f.status === 'failed' || f.status === 'FAILED',
+      );
+      const passed = matching.filter(
+        (f) => f.status === 'passed' || f.status === 'success',
+      );
 
-      // If search query exists and service name doesn't match, filter findings by title
-      if (q && !serviceMatches) {
-        filteredFailed = filteredFailed.filter(
-          (f) =>
-            f.title?.toLowerCase().includes(q) ||
-            f.description?.toLowerCase().includes(q) ||
-            f.findingKey?.toLowerCase().includes(q),
+      // With severity filter active, hide services that have no matching
+      // failures. Without filters, keep services that have any findings.
+      if (severityFilter) {
+        const hasMatching = failed.some(
+          (f) => f.severity?.toLowerCase() === severityFilter,
         );
+        if (!hasMatching) continue;
+      } else if (q && failed.length === 0 && passed.length === 0) {
+        continue;
       }
 
       groups.push({
         serviceId,
         name: serviceName,
-        findings: filteredFailed,
+        findings: matching,
         passed: passed.length,
         failed: failed.length,
       });
     }
 
-    return groups
-      .filter((g) => g.findings.length > 0 || (!severityFilter && !q && g.passed > 0))
-      .sort((a, b) => b.failed - a.failed || a.name.localeCompare(b.name));
+    return groups.sort(
+      (a, b) => b.failed - a.failed || a.name.localeCompare(b.name),
+    );
   }, [findings, severityFilter, searchQuery]);
 
   // Split into baseline (security fundamentals) vs service-specific
@@ -479,9 +511,9 @@ export function CloudTestsSection({
       {/* Header with scan button */}
       <div className="flex items-center justify-between">
         <div>
-          <h3 className="text-sm font-medium">Security Findings</h3>
+          <h3 className="text-sm font-medium">Scan Results</h3>
           <p className="text-muted-foreground text-xs mt-0.5">
-            {findings.length} total findings for this account
+            {findings.length} total results for this account
           </p>
         </div>
         <div className="flex items-center gap-2">
@@ -497,6 +529,9 @@ export function CloudTestsSection({
         </div>
       </div>
 
+      {/* Last scan metadata strip — surfaces what's already in IntegrationCheckRun */}
+      <LastScanStrip latestRun={latestRun ?? null} fallbackLastRunAt={lastRunAt ?? null} />
+
       {/* Selected projects indicator (GCP) */}
       {providerSlug === 'gcp' &&
         (() => {
@@ -673,7 +708,7 @@ export function CloudTestsSection({
           <Search className="h-3 w-3 shrink-0 text-muted-foreground/40" />
           <input
             type="text"
-            placeholder="Search findings..."
+            placeholder="Search results..."
             value={searchQuery}
             onChange={(e) => setSearchQuery(e.target.value)}
             className="min-w-0 flex-1 bg-transparent text-xs outline-none placeholder:text-muted-foreground/40"
@@ -752,36 +787,43 @@ export function CloudTestsSection({
                 </button>
                 {isGroupExpanded && (
                   <div className="divide-y border-t">
-                    {group.findings.length > 0 ? (
-                      group.findings.map((finding) => {
-                        const match = canFixFinding(finding);
-                        return (
-                          <FindingRow
-                            key={finding.id}
-                            finding={finding}
-                            expanded={expandedIds.has(finding.id)}
-                            onToggle={() => toggleExpanded(finding.id)}
-                            remediationKey={match?.key ?? null}
-                            remediationEnabled={match?.enabled ?? false}
-                            capabilitiesLoaded={capabilitiesLoaded}
-                            onFix={(key) =>
-                              setRemediationTarget({
-                                connectionId: finding.connectionId,
-                                checkResultId: finding.id,
-                                remediationKey: key,
-                                findingTitle: finding.title ?? 'Finding',
-                              })
-                            }
-                            onSetup={() => setShowSetupDialog(true)}
-                          />
-                        );
-                      })
-                    ) : (
-                      <div className="flex items-center gap-2 px-4 py-3 text-xs text-primary">
-                        <ShieldCheck className="h-3.5 w-3.5" />
-                        All {group.passed} checks passed
-                      </div>
-                    )}
+                    {buildCheckGroups(group.findings).map((checkGroup) => (
+                      <CheckGroupBlock
+                        key={checkGroup.checkKey}
+                        group={checkGroup}
+                        severityFilter={severityFilter}
+                        renderRow={(finding) => {
+                          const match = canFixFinding(finding);
+                          return (
+                            <FindingRow
+                              finding={finding}
+                              expanded={expandedIds.has(finding.id)}
+                              onToggle={() => toggleExpanded(finding.id)}
+                              remediationKey={match?.key ?? null}
+                              remediationEnabled={match?.enabled ?? false}
+                              capabilitiesLoaded={capabilitiesLoaded}
+                              onFix={(key) =>
+                                setRemediationTarget({
+                                  connectionId: finding.connectionId,
+                                  checkResultId: finding.id,
+                                  remediationKey: key,
+                                  findingTitle: finding.title ?? 'Finding',
+                                })
+                              }
+                              onSetup={() => setShowSetupDialog(true)}
+                              canMarkException={canMarkException}
+                              onMarkException={() =>
+                                setExceptionTarget({
+                                  findingId: finding.id,
+                                  findingTitle: finding.title ?? 'Finding',
+                                  resourceLabel: formatResourceLabel(finding),
+                                })
+                              }
+                            />
+                          );
+                        }}
+                      />
+                    ))}
                   </div>
                 )}
               </div>
@@ -847,36 +889,43 @@ export function CloudTestsSection({
                 </button>
                 {isGroupExpanded && (
                   <div className="divide-y border-t">
-                    {group.findings.length > 0 ? (
-                      group.findings.map((finding) => {
-                        const match = canFixFinding(finding);
-                        return (
-                          <FindingRow
-                            key={finding.id}
-                            finding={finding}
-                            expanded={expandedIds.has(finding.id)}
-                            onToggle={() => toggleExpanded(finding.id)}
-                            remediationKey={match?.key ?? null}
-                            remediationEnabled={match?.enabled ?? false}
-                            capabilitiesLoaded={capabilitiesLoaded}
-                            onFix={(key) =>
-                              setRemediationTarget({
-                                connectionId: finding.connectionId,
-                                checkResultId: finding.id,
-                                remediationKey: key,
-                                findingTitle: finding.title ?? 'Finding',
-                              })
-                            }
-                            onSetup={() => setShowSetupDialog(true)}
-                          />
-                        );
-                      })
-                    ) : (
-                      <div className="flex items-center gap-2 px-4 py-3 text-xs text-primary">
-                        <ShieldCheck className="h-3.5 w-3.5" />
-                        All {group.passed} checks passed
-                      </div>
-                    )}
+                    {buildCheckGroups(group.findings).map((checkGroup) => (
+                      <CheckGroupBlock
+                        key={checkGroup.checkKey}
+                        group={checkGroup}
+                        severityFilter={severityFilter}
+                        renderRow={(finding) => {
+                          const match = canFixFinding(finding);
+                          return (
+                            <FindingRow
+                              finding={finding}
+                              expanded={expandedIds.has(finding.id)}
+                              onToggle={() => toggleExpanded(finding.id)}
+                              remediationKey={match?.key ?? null}
+                              remediationEnabled={match?.enabled ?? false}
+                              capabilitiesLoaded={capabilitiesLoaded}
+                              onFix={(key) =>
+                                setRemediationTarget({
+                                  connectionId: finding.connectionId,
+                                  checkResultId: finding.id,
+                                  remediationKey: key,
+                                  findingTitle: finding.title ?? 'Finding',
+                                })
+                              }
+                              onSetup={() => setShowSetupDialog(true)}
+                              canMarkException={canMarkException}
+                              onMarkException={() =>
+                                setExceptionTarget({
+                                  findingId: finding.id,
+                                  findingTitle: finding.title ?? 'Finding',
+                                  resourceLabel: formatResourceLabel(finding),
+                                })
+                              }
+                            />
+                          );
+                        }}
+                      />
+                    ))}
                   </div>
                 )}
               </div>
@@ -890,7 +939,7 @@ export function CloudTestsSection({
         <div className="flex flex-col items-center justify-center rounded-xl border-2 border-dashed py-8">
           <Search className="text-muted-foreground/30 mb-2 h-8 w-8" />
           <p className="text-muted-foreground text-sm font-medium">
-            No findings matching &quot;{searchQuery}&quot;
+            No results matching &quot;{searchQuery}&quot;
           </p>
           <button
             type="button"
@@ -1060,6 +1109,20 @@ export function CloudTestsSection({
           loadCapabilities();
         }}
       />
+
+      <MarkExceptionModal
+        open={Boolean(exceptionTarget)}
+        onOpenChange={(open) => {
+          if (!open) setExceptionTarget(null);
+        }}
+        findingId={exceptionTarget?.findingId ?? null}
+        findingTitle={exceptionTarget?.findingTitle ?? ''}
+        resourceLabel={exceptionTarget?.resourceLabel ?? null}
+        onMarked={() => {
+          findingsResponse.mutate();
+          setExceptionTarget(null);
+        }}
+      />
     </div>
   );
 }
@@ -1090,6 +1153,70 @@ function StatCard({
   );
 }
 
+function formatRelativeTime(date: Date): string {
+  const diff = Date.now() - date.getTime();
+  const seconds = Math.floor(diff / 1000);
+  if (seconds < 5) return 'just now';
+  if (seconds < 60) return `${seconds}s ago`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  const days = Math.floor(hours / 24);
+  if (days === 1) return 'yesterday';
+  if (days < 7) return `${days}d ago`;
+  return date.toLocaleDateString();
+}
+
+function formatDuration(ms: number): string {
+  if (ms < 1000) return `${ms}ms`;
+  const seconds = ms / 1000;
+  if (seconds < 60) return `${seconds.toFixed(1)}s`;
+  const totalSeconds = Math.floor(seconds);
+  const m = Math.floor(totalSeconds / 60);
+  const s = totalSeconds % 60;
+  return s === 0 ? `${m}m` : `${m}m ${s}s`;
+}
+
+function LastScanStrip({
+  latestRun,
+  fallbackLastRunAt,
+}: {
+  latestRun: ProviderLatestRun | null;
+  fallbackLastRunAt: Date | null;
+}) {
+  const completedRaw = latestRun?.completedAt ?? fallbackLastRunAt;
+  if (!completedRaw) return null;
+
+  const completedAt =
+    completedRaw instanceof Date ? completedRaw : new Date(completedRaw);
+  if (Number.isNaN(completedAt.getTime())) return null;
+
+  const parts: string[] = [`Ran ${formatRelativeTime(completedAt)}`];
+
+  if (latestRun) {
+    if (latestRun.totalChecked !== null) {
+      const noun = latestRun.totalChecked === 1 ? 'check' : 'checks';
+      parts.push(`${latestRun.totalChecked} ${noun} evaluated`);
+    }
+    if (latestRun.passedCount !== null) {
+      parts.push(`${latestRun.passedCount} passed`);
+    }
+    if (latestRun.failedCount !== null) {
+      parts.push(`${latestRun.failedCount} failed`);
+    }
+    if (latestRun.durationMs !== null && latestRun.durationMs > 0) {
+      parts.push(`Duration ${formatDuration(latestRun.durationMs)}`);
+    }
+  }
+
+  return (
+    <div className="rounded-md border bg-muted/20 px-3 py-2 text-[11px] text-muted-foreground">
+      {parts.join(' • ')}
+    </div>
+  );
+}
+
 function RemediationSetupDialog({
   open,
   onOpenChange,
@@ -1257,6 +1384,59 @@ function RemediationSetupDialog({
   );
 }
 
+/**
+ * Format a resource label for a finding row, e.g. "IAM User: john" or
+ * just "sg-abc123" when type is unknown. Returns null when there's
+ * nothing meaningful to show.
+ */
+function formatResourceLabel(finding: Finding): string | null {
+  const id = finding.resourceId;
+  const type = finding.resourceType;
+  if (!id && !type) return null;
+  if (id && type) return `${type}: ${id}`;
+  return id ?? type ?? null;
+}
+
+function EvidenceSection({ evidence }: { evidence: unknown }) {
+  const [open, setOpen] = useState(false);
+
+  // Don't render the section when evidence is null, undefined, or an empty
+  // container — keeps the expanded state focused.
+  if (evidence === null || evidence === undefined) return null;
+  if (typeof evidence === 'object') {
+    const isEmpty = Array.isArray(evidence)
+      ? evidence.length === 0
+      : Object.keys(evidence as Record<string, unknown>).length === 0;
+    if (isEmpty) return null;
+  }
+
+  return (
+    <div className="rounded-md border bg-background">
+      <button
+        type="button"
+        onClick={() => setOpen((prev) => !prev)}
+        className="flex w-full items-center gap-1.5 px-3 py-2 text-left text-xs font-medium hover:bg-muted/30"
+        aria-expanded={open}
+      >
+        {open ? (
+          <ChevronDown className="h-3 w-3" />
+        ) : (
+          <ChevronRight className="h-3 w-3" />
+        )}
+        Evidence
+        <span className="ml-auto text-[10px] font-normal text-muted-foreground">
+          Sensitive values redacted
+        </span>
+      </button>
+      {open && (
+        <div className="border-t p-3">
+          <EvidenceJsonViewer evidence={evidence} />
+        </div>
+      )}
+    </div>
+  );
+}
+
 function FindingRow({
   finding,
   expanded,
@@ -1266,6 +1446,8 @@ function FindingRow({
   capabilitiesLoaded,
   onFix,
   onSetup,
+  onMarkException,
+  canMarkException,
 }: {
   finding: Finding;
   expanded: boolean;
@@ -1275,9 +1457,12 @@ function FindingRow({
   capabilitiesLoaded: boolean;
   onFix: (key: string) => void;
   onSetup: () => void;
+  onMarkException?: () => void;
+  canMarkException: boolean;
 }) {
   const severity = finding.severity?.toLowerCase() ?? 'info';
   const styles = SEVERITY_STYLES[severity] ?? SEVERITY_STYLES.info;
+  const resourceLabel = formatResourceLabel(finding);
 
   const handleFixClick = (e: React.MouseEvent) => {
     e.stopPropagation();
@@ -1339,7 +1524,14 @@ function FindingRow({
           {expanded ? <ChevronDown className="h-4 w-4" /> : <ChevronRight className="h-4 w-4" />}
         </span>
         <span className={`h-2 w-2 shrink-0 rounded-full ${styles.dot}`} />
-        <span className="min-w-0 flex-1 truncate">{finding.title ?? 'Untitled finding'}</span>
+        <div className="min-w-0 flex-1">
+          <div className="truncate">{finding.title ?? 'Untitled finding'}</div>
+          {resourceLabel && (
+            <div className="truncate text-[10px] text-muted-foreground/70 mt-0.5">
+              {resourceLabel}
+            </div>
+          )}
+        </div>
         {finding.projectDisplayName && (
           <span className="shrink-0 rounded bg-muted px-1.5 py-0.5 text-[10px] text-muted-foreground">
             {finding.projectDisplayName}
@@ -1348,6 +1540,21 @@ function FindingRow({
         <span onClick={(e) => e.stopPropagation()} onKeyDown={(e) => e.stopPropagation()}>
           {renderFixButton()}
         </span>
+        {canMarkException &&
+          onMarkException &&
+          (finding.status === 'failed' || finding.status === 'FAILED') && (
+            <button
+              type="button"
+              onClick={(e) => {
+                e.stopPropagation();
+                onMarkException();
+              }}
+              className="shrink-0 inline-flex items-center gap-1 rounded-full border bg-background px-2.5 py-0.5 text-[10px] font-medium text-muted-foreground transition-colors hover:bg-muted"
+              title="Mark this finding as an exception"
+            >
+              Mark as exception
+            </button>
+          )}
         <Badge
           variant="outline"
           className={`shrink-0 w-14 justify-center text-[10px] ${styles.badge}`}
@@ -1357,9 +1564,16 @@ function FindingRow({
       </div>
       {expanded && (
         <div className="space-y-3 border-t bg-muted/20 px-12 py-4 text-sm">
+          <CheckDefinitionPanel findingId={finding.id} />
           {finding.description && (
-            <p className="text-muted-foreground text-xs leading-relaxed">{finding.description}</p>
+            <div className="rounded-md border bg-background p-3">
+              <p className="mb-1 text-xs font-medium">This account&apos;s result</p>
+              <p className="text-muted-foreground text-xs leading-relaxed">
+                {finding.description}
+              </p>
+            </div>
           )}
+          <EvidenceSection evidence={finding.evidence} />
           {finding.remediation && (
             <div className="rounded-md border bg-background p-3">
               <p className="mb-1 text-xs font-medium">Remediation</p>
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.test.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.test.tsx
new file mode 100644
index 0000000000..a074448812
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.test.tsx
@@ -0,0 +1,55 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+
+// Mock @uiw/react-json-view to avoid pulling its bundle into jsdom tests.
+// We only need to verify our wrapper renders + the wrapping behavior.
+vi.mock('@uiw/react-json-view', () => ({
+  default: ({ value }: { value: unknown }) => (
+    <pre data-testid="json-view">{JSON.stringify(value)}</pre>
+  ),
+}));
+
+import { EvidenceJsonViewer } from './EvidenceJsonViewer';
+
+describe('EvidenceJsonViewer', () => {
+  it('renders the empty state when evidence is null', () => {
+    render(<EvidenceJsonViewer evidence={null} />);
+    expect(
+      screen.getByText(/No evidence collected for this finding\./i),
+    ).toBeInTheDocument();
+  });
+
+  it('renders the empty state when evidence is an empty object', () => {
+    render(<EvidenceJsonViewer evidence={{}} />);
+    expect(
+      screen.getByText(/No evidence collected for this finding\./i),
+    ).toBeInTheDocument();
+  });
+
+  it('renders the JSON view when evidence has content', () => {
+    render(
+      <EvidenceJsonViewer
+        evidence={{ bucketName: 'logs-archive', isPublic: true }}
+      />,
+    );
+    const view = screen.getByTestId('json-view');
+    expect(view.textContent).toContain('logs-archive');
+    expect(view.textContent).toContain('true');
+  });
+
+  it('wraps primitive evidence values under a "value" key', () => {
+    render(<EvidenceJsonViewer evidence={'just a string'} />);
+    const view = screen.getByTestId('json-view');
+    expect(view.textContent).toContain('just a string');
+    expect(view.textContent).toContain('value');
+  });
+
+  it('renders a Copy button', () => {
+    render(<EvidenceJsonViewer evidence={{ a: 1 }} />);
+    expect(
+      screen.getByRole('button', {
+        name: /Copy evidence JSON to clipboard/i,
+      }),
+    ).toBeInTheDocument();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.tsx
new file mode 100644
index 0000000000..29bc9439c9
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.tsx
@@ -0,0 +1,98 @@
+'use client';
+
+import JsonView from '@uiw/react-json-view';
+import { Check, Copy } from 'lucide-react';
+import { useCallback, useMemo, useState } from 'react';
+
+interface EvidenceJsonViewerProps {
+  /** Sanitized evidence payload (server-side sanitizer redacts sensitive keys). */
+  evidence: unknown;
+}
+
+const isEmpty = (value: unknown): boolean => {
+  if (value === null || value === undefined) return true;
+  if (typeof value !== 'object') return false;
+  if (Array.isArray(value)) return value.length === 0;
+  return Object.keys(value as Record<string, unknown>).length === 0;
+};
+
+/**
+ * Read-only JSON viewer for cloud-test evidence. Sensitive keys are already
+ * redacted server-side by evidence-sanitizer.ts before they reach this
+ * component — this is render only.
+ */
+export function EvidenceJsonViewer({ evidence }: EvidenceJsonViewerProps) {
+  const [copied, setCopied] = useState(false);
+
+  const display = useMemo(() => {
+    // `@uiw/react-json-view` expects an object/array at the root. Wrap primitives
+    // so we never pass a plain string/number/null into the tree view.
+    if (evidence === null || evidence === undefined) return null;
+    if (typeof evidence === 'object') return evidence;
+    return { value: evidence };
+  }, [evidence]);
+
+  const jsonString = useMemo(() => {
+    if (display === null) return '';
+    try {
+      return JSON.stringify(display, null, 2);
+    } catch {
+      return '';
+    }
+  }, [display]);
+
+  const handleCopy = useCallback(async () => {
+    if (!jsonString) return;
+    try {
+      await navigator.clipboard.writeText(jsonString);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 1500);
+    } catch {
+      // Clipboard unavailable — silently no-op rather than throw.
+    }
+  }, [jsonString]);
+
+  if (isEmpty(evidence)) {
+    return (
+      <div className="rounded-md border bg-muted/40 p-3 text-xs text-muted-foreground">
+        No evidence collected for this finding.
+      </div>
+    );
+  }
+
+  return (
+    <div className="group relative rounded-md border bg-muted/40 p-3">
+      <button
+        type="button"
+        onClick={handleCopy}
+        className="absolute right-2 top-2 inline-flex items-center gap-1 rounded-md border border-border/50 bg-background/80 px-1.5 py-1 text-[10px] font-medium text-muted-foreground opacity-0 transition-opacity hover:bg-background group-hover:opacity-100"
+        aria-label="Copy evidence JSON to clipboard"
+      >
+        {copied ? (
+          <>
+            <Check className="h-2.5 w-2.5" />
+            Copied
+          </>
+        ) : (
+          <>
+            <Copy className="h-2.5 w-2.5" />
+            Copy
+          </>
+        )}
+      </button>
+      <div className="overflow-auto">
+        <JsonView
+          value={display ?? {}}
+          collapsed={2}
+          displayDataTypes={false}
+          enableClipboard={false}
+          style={{
+            backgroundColor: 'transparent',
+            fontFamily: 'ui-monospace, SFMono-Regular, Menlo, monospace',
+            fontSize: '11px',
+          }}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/FindingsTable.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/FindingsTable.tsx
index 543e42c3ee..85fae82e3b 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/FindingsTable.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/FindingsTable.tsx
@@ -63,7 +63,7 @@ export function FindingsTable({ findings }: FindingsTableProps) {
   if (findings.length === 0) {
     return (
       <div className="rounded-xs border p-12 text-center">
-        <p className="text-muted-foreground text-lg">No findings available</p>
+        <p className="text-muted-foreground text-lg">No results available</p>
       </div>
     );
   }
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.test.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.test.tsx
new file mode 100644
index 0000000000..61bee6932e
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.test.tsx
@@ -0,0 +1,214 @@
+import { render, screen, fireEvent } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+type SwrShape = {
+  data: { data: unknown } | undefined;
+  error: unknown;
+  isLoading: boolean;
+  mutate: () => Promise<unknown> | unknown;
+};
+
+const swrMock = vi.fn<() => SwrShape>();
+const deleteMock = vi.fn();
+const hasPermissionMock = vi.fn().mockReturnValue(true);
+
+vi.mock('@/hooks/use-api', () => ({
+  useApi: () => ({
+    useSWR: (_url: string) => swrMock(),
+    delete: (url: string) => deleteMock(url),
+  }),
+}));
+
+vi.mock('@/hooks/use-permissions', () => ({
+  usePermissions: () => ({
+    permissions: {},
+    hasPermission: hasPermissionMock,
+  }),
+}));
+
+vi.mock('sonner', () => ({
+  toast: { success: vi.fn(), error: vi.fn() },
+}));
+
+vi.mock('@trycompai/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+  }: {
+    children: React.ReactNode;
+    onClick?: () => void;
+  }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+}));
+
+import { HistoryTab } from './HistoryTab';
+
+const baselinePayload = {
+  summary: {
+    resolutions: 3,
+    platformFixes: 1,
+    externalFixes: 1,
+    resourceDeleted: 1,
+    exceptionMarked: 0,
+    activeExceptions: 1,
+    regressions: 1,
+  },
+  resolutions: [
+    {
+      id: 'fres_1',
+      checkId: 'iam-no-mfa',
+      resourceId: 'john',
+      resourceType: 'AwsIamUser',
+      resolvedAt: '2026-05-12T10:00:00Z',
+      resolutionMethod: 'platform_fix',
+      daysOpen: 4,
+    },
+    {
+      id: 'fres_2',
+      checkId: 's3-public',
+      resourceId: 'old-backups',
+      resourceType: 'S3Bucket',
+      resolvedAt: '2026-05-10T10:00:00Z',
+      resolutionMethod: 'external_fix',
+      daysOpen: 23,
+    },
+    {
+      id: 'fres_3',
+      checkId: 'ec2-open-ssh',
+      resourceId: 'sg-abc',
+      resourceType: 'SecurityGroup',
+      resolvedAt: '2026-05-08T10:00:00Z',
+      resolutionMethod: 'resource_deleted',
+      daysOpen: 5,
+    },
+  ],
+  exceptions: [
+    {
+      id: 'fex_1',
+      checkId: 's3-public',
+      resourceId: 'marketing-assets',
+      reason: 'Public marketing bucket — intentional.',
+      reviewedBy: 'CISO 2026-Q1',
+      expiresAt: '2026-08-13T00:00:00Z',
+      markedAt: '2026-05-13T10:00:00Z',
+    },
+  ],
+  regressions: [
+    {
+      id: 'freg_1',
+      checkId: 'rds-not-encrypted',
+      resourceId: 'prod-db-2',
+      previouslyResolvedAt: '2026-03-10T10:00:00Z',
+      regressedAt: '2026-04-15T10:00:00Z',
+      daysClean: 36,
+    },
+  ],
+};
+
+describe('HistoryTab', () => {
+  beforeEach(() => {
+    swrMock.mockReset();
+    deleteMock.mockReset();
+    hasPermissionMock.mockReturnValue(true);
+  });
+
+  it('renders a loading state while the request is in flight', () => {
+    swrMock.mockReturnValue({
+      data: undefined,
+      error: null,
+      isLoading: true,
+      mutate: () => undefined,
+    });
+    render(<HistoryTab connectionId="icn_aws" />);
+    expect(screen.getByText(/Loading history/i)).toBeInTheDocument();
+  });
+
+  it('renders an empty state when there are no resolutions, exceptions, or regressions', () => {
+    swrMock.mockReturnValue({
+      data: {
+        data: {
+          data: {
+            summary: {
+              resolutions: 0,
+              platformFixes: 0,
+              externalFixes: 0,
+              resourceDeleted: 0,
+              exceptionMarked: 0,
+              activeExceptions: 0,
+              regressions: 0,
+            },
+            resolutions: [],
+            exceptions: [],
+            regressions: [],
+          },
+        },
+      },
+      error: null,
+      isLoading: false,
+      mutate: () => undefined,
+    });
+    render(<HistoryTab connectionId="icn_aws" />);
+    expect(screen.getByText(/No audit history yet/i)).toBeInTheDocument();
+  });
+
+  it('renders all three sections with sample data', () => {
+    swrMock.mockReturnValue({
+      data: { data: { data: baselinePayload } },
+      error: null,
+      isLoading: false,
+      mutate: () => undefined,
+    });
+    render(<HistoryTab connectionId="icn_aws" />);
+    // "Resolutions" and "Active exceptions" appear in both summary + section header —
+    // getAllByText proves both are rendered.
+    expect(screen.getAllByText(/Resolutions/).length).toBeGreaterThan(0);
+    expect(screen.getAllByText(/Active exceptions/).length).toBeGreaterThan(0);
+    expect(screen.getAllByText(/Regressions/).length).toBeGreaterThan(0);
+    expect(screen.getByText('Fixed via platform')).toBeInTheDocument();
+    expect(screen.getByText('Fixed externally')).toBeInTheDocument();
+    expect(screen.getByText('Resource deleted')).toBeInTheDocument();
+    expect(
+      screen.getByText(/Public marketing bucket/i),
+    ).toBeInTheDocument();
+    expect(screen.getByText(/CISO 2026-Q1/i)).toBeInTheDocument();
+  });
+
+  it('calls DELETE /exceptions/:id and refreshes when "Remove exception" is clicked', async () => {
+    const mutate = vi.fn();
+    swrMock.mockReturnValue({
+      data: { data: { data: baselinePayload } },
+      error: null,
+      isLoading: false,
+      mutate,
+    });
+    deleteMock.mockResolvedValueOnce({ error: null });
+
+    render(<HistoryTab connectionId="icn_aws" />);
+    fireEvent.click(
+      screen.getByRole('button', { name: /Remove exception/i }),
+    );
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(deleteMock).toHaveBeenCalledWith(
+      '/v1/cloud-security/exceptions/fex_1',
+    );
+    expect(mutate).toHaveBeenCalled();
+  });
+
+  it('hides the "Remove exception" button for users without integration:update', () => {
+    hasPermissionMock.mockReturnValue(false);
+    swrMock.mockReturnValue({
+      data: { data: { data: baselinePayload } },
+      error: null,
+      isLoading: false,
+      mutate: () => undefined,
+    });
+    render(<HistoryTab connectionId="icn_aws" />);
+    expect(
+      screen.queryByRole('button', { name: /Remove exception/i }),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.tsx
new file mode 100644
index 0000000000..2cc2846d22
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.tsx
@@ -0,0 +1,308 @@
+'use client';
+
+import { useApi } from '@/hooks/use-api';
+import { usePermissions } from '@/hooks/use-permissions';
+import { Button } from '@trycompai/ui/button';
+import { Loader2, ShieldCheck, RotateCcw, X } from 'lucide-react';
+import { toast } from 'sonner';
+
+interface ResolutionRow {
+  id: string;
+  checkId: string;
+  resourceId: string;
+  resourceType: string | null;
+  resolvedAt: string;
+  resolutionMethod:
+    | 'platform_fix'
+    | 'external_fix'
+    | 'resource_deleted'
+    | 'exception_marked';
+  daysOpen: number | null;
+}
+
+interface ExceptionRow {
+  id: string;
+  checkId: string;
+  resourceId: string;
+  reason: string;
+  reviewedBy: string | null;
+  expiresAt: string | null;
+  markedAt: string;
+}
+
+interface RegressionRow {
+  id: string;
+  checkId: string;
+  resourceId: string;
+  previouslyResolvedAt: string;
+  regressedAt: string;
+  daysClean: number | null;
+}
+
+interface HistoryPayload {
+  summary: {
+    resolutions: number;
+    platformFixes: number;
+    externalFixes: number;
+    resourceDeleted: number;
+    exceptionMarked: number;
+    activeExceptions: number;
+    regressions: number;
+  };
+  resolutions: ResolutionRow[];
+  exceptions: ExceptionRow[];
+  regressions: RegressionRow[];
+}
+
+const RESOLUTION_METHOD_LABEL: Record<
+  ResolutionRow['resolutionMethod'],
+  string
+> = {
+  platform_fix: 'Fixed via platform',
+  external_fix: 'Fixed externally',
+  resource_deleted: 'Resource deleted',
+  exception_marked: 'Marked as exception',
+};
+
+export interface HistoryTabProps {
+  connectionId: string;
+}
+
+/**
+ * Renders the audit trail for a connection — resolutions, active
+ * exceptions, and regressions. Pulls from
+ * GET /v1/cloud-security/history?connectionId=...
+ */
+export function HistoryTab({ connectionId }: HistoryTabProps) {
+  const api = useApi();
+  const { hasPermission } = usePermissions();
+  const canRevoke = hasPermission('integration', 'update');
+
+  const { data, error, isLoading, mutate } = api.useSWR<{
+    data: HistoryPayload;
+  }>(`/v1/cloud-security/history?connectionId=${connectionId}`, {
+    revalidateOnFocus: false,
+  });
+
+  const handleRevoke = async (exceptionId: string) => {
+    const response = await api.delete(
+      `/v1/cloud-security/exceptions/${exceptionId}`,
+    );
+    if (response.error) {
+      toast.error(
+        typeof response.error === 'string'
+          ? response.error
+          : 'Could not revoke exception',
+      );
+      return;
+    }
+    toast.success('Exception revoked');
+    mutate();
+  };
+
+  if (isLoading) {
+    return (
+      <div className="flex items-center justify-center gap-2 rounded-lg border bg-muted/20 py-12 text-xs text-muted-foreground">
+        <Loader2 className="h-4 w-4 animate-spin" />
+        Loading history…
+      </div>
+    );
+  }
+  if (error || !data?.data?.data) {
+    return (
+      <div className="rounded-lg border bg-muted/20 py-12 text-center text-xs text-muted-foreground">
+        Could not load history for this connection.
+      </div>
+    );
+  }
+
+  const payload = data.data.data;
+  const isEmpty =
+    payload.resolutions.length === 0 &&
+    payload.exceptions.length === 0 &&
+    payload.regressions.length === 0;
+
+  if (isEmpty) {
+    return (
+      <div className="flex flex-col items-center justify-center rounded-lg border-2 border-dashed py-12 text-center">
+        <ShieldCheck className="mb-3 h-7 w-7 text-muted-foreground/30" />
+        <p className="text-sm font-medium">No audit history yet</p>
+        <p className="mt-1 text-xs text-muted-foreground">
+          Resolutions, exceptions, and regressions are recorded automatically
+          on each scan.
+        </p>
+      </div>
+    );
+  }
+
+  return (
+    <div className="space-y-6">
+      <SummaryCard summary={payload.summary} />
+      {payload.resolutions.length > 0 && (
+        <Section
+          title="Resolutions"
+          count={payload.resolutions.length}
+          subtitle={`${payload.summary.platformFixes} platform · ${payload.summary.externalFixes} external · ${payload.summary.resourceDeleted} deleted · ${payload.summary.exceptionMarked} exception`}
+        >
+          {payload.resolutions.map((row) => (
+            <ResolutionRowView key={row.id} row={row} />
+          ))}
+        </Section>
+      )}
+      {payload.exceptions.length > 0 && (
+        <Section
+          title="Active exceptions"
+          count={payload.exceptions.length}
+          subtitle="Findings the customer has documented as accepted or not applicable."
+        >
+          {payload.exceptions.map((row) => (
+            <ExceptionRowView
+              key={row.id}
+              row={row}
+              canRevoke={canRevoke}
+              onRevoke={() => handleRevoke(row.id)}
+            />
+          ))}
+        </Section>
+      )}
+      {payload.regressions.length > 0 && (
+        <Section
+          title="Regressions"
+          count={payload.regressions.length}
+          subtitle="Findings that were previously resolved and are failing again."
+        >
+          {payload.regressions.map((row) => (
+            <RegressionRowView key={row.id} row={row} />
+          ))}
+        </Section>
+      )}
+    </div>
+  );
+}
+
+function SummaryCard({ summary }: { summary: HistoryPayload['summary'] }) {
+  return (
+    <div className="grid grid-cols-3 gap-3 rounded-lg border bg-muted/20 p-3 text-xs">
+      <div>
+        <p className="text-muted-foreground">Resolved</p>
+        <p className="mt-0.5 text-lg font-semibold tabular-nums">
+          {summary.resolutions}
+        </p>
+      </div>
+      <div>
+        <p className="text-muted-foreground">Active exceptions</p>
+        <p className="mt-0.5 text-lg font-semibold tabular-nums">
+          {summary.activeExceptions}
+        </p>
+      </div>
+      <div>
+        <p className="text-muted-foreground">Regressions</p>
+        <p className="mt-0.5 text-lg font-semibold tabular-nums text-orange-600 dark:text-orange-400">
+          {summary.regressions}
+        </p>
+      </div>
+    </div>
+  );
+}
+
+function Section({
+  title,
+  subtitle,
+  count,
+  children,
+}: {
+  title: string;
+  subtitle: string;
+  count: number;
+  children: React.ReactNode;
+}) {
+  return (
+    <div className="rounded-lg border">
+      <div className="border-b bg-muted/20 px-4 py-2">
+        <p className="text-xs font-medium">
+          {title} <span className="text-muted-foreground">({count})</span>
+        </p>
+        <p className="mt-0.5 text-[10px] text-muted-foreground">{subtitle}</p>
+      </div>
+      <div className="divide-y">{children}</div>
+    </div>
+  );
+}
+
+function ResolutionRowView({ row }: { row: ResolutionRow }) {
+  return (
+    <div className="space-y-1 px-4 py-3 text-xs">
+      <div className="flex items-center gap-2">
+        <ShieldCheck className="h-3.5 w-3.5 text-primary shrink-0" />
+        <span className="font-medium">
+          {row.checkId} · {row.resourceType ? `${row.resourceType}: ` : ''}
+          {row.resourceId}
+        </span>
+        <span className="ml-auto text-[10px] text-muted-foreground">
+          {RESOLUTION_METHOD_LABEL[row.resolutionMethod]}
+        </span>
+      </div>
+      <p className="text-[10px] text-muted-foreground pl-5.5">
+        Resolved {new Date(row.resolvedAt).toLocaleString()}
+        {row.daysOpen !== null ? ` — was open ${row.daysOpen}d` : ''}
+      </p>
+    </div>
+  );
+}
+
+function ExceptionRowView({
+  row,
+  canRevoke,
+  onRevoke,
+}: {
+  row: ExceptionRow;
+  canRevoke: boolean;
+  onRevoke: () => void;
+}) {
+  return (
+    <div className="space-y-2 px-4 py-3 text-xs">
+      <div className="flex items-center gap-2">
+        <span className="font-medium">
+          {row.checkId} · {row.resourceId}
+        </span>
+        {canRevoke && (
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={onRevoke}
+            className="ml-auto"
+          >
+            <X className="mr-1 h-3 w-3" />
+            Remove exception
+          </Button>
+        )}
+      </div>
+      <p className="leading-relaxed text-muted-foreground">{row.reason}</p>
+      <div className="flex flex-wrap items-center gap-x-3 gap-y-1 text-[10px] text-muted-foreground">
+        <span>Marked {new Date(row.markedAt).toLocaleDateString()}</span>
+        {row.reviewedBy && <span>· Reviewed by: {row.reviewedBy}</span>}
+        {row.expiresAt && (
+          <span>· Auto-review: {new Date(row.expiresAt).toLocaleDateString()}</span>
+        )}
+      </div>
+    </div>
+  );
+}
+
+function RegressionRowView({ row }: { row: RegressionRow }) {
+  return (
+    <div className="space-y-1 px-4 py-3 text-xs">
+      <div className="flex items-center gap-2">
+        <RotateCcw className="h-3.5 w-3.5 text-orange-500 shrink-0" />
+        <span className="font-medium">
+          {row.checkId} · {row.resourceId}
+        </span>
+      </div>
+      <p className="text-[10px] text-muted-foreground pl-5.5">
+        Was clean {row.daysClean ?? '?'}d (previously resolved{' '}
+        {new Date(row.previouslyResolvedAt).toLocaleDateString()}). Failing
+        again as of {new Date(row.regressedAt).toLocaleString()}.
+      </p>
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.test.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.test.tsx
new file mode 100644
index 0000000000..7c2419456f
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.test.tsx
@@ -0,0 +1,151 @@
+import { render, screen, fireEvent } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const postMock = vi.fn();
+vi.mock('@/hooks/use-api', () => ({
+  useApi: () => ({ post: postMock }),
+}));
+
+vi.mock('sonner', () => ({
+  toast: { success: vi.fn(), error: vi.fn() },
+}));
+
+// Stub the dialog wrapper so we don't pull a real portal in jsdom. Render
+// children inline when `open`.
+vi.mock('@trycompai/ui/dialog', () => {
+  const Pass = ({ children }: { children: React.ReactNode }) => <>{children}</>;
+  return {
+    Dialog: ({
+      open,
+      children,
+    }: {
+      open: boolean;
+      children: React.ReactNode;
+    }) => (open ? <div>{children}</div> : null),
+    DialogContent: Pass,
+    DialogDescription: Pass,
+    DialogHeader: Pass,
+    DialogTitle: Pass,
+  };
+});
+
+vi.mock('@trycompai/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+  }: {
+    children: React.ReactNode;
+    disabled?: boolean;
+    onClick?: () => void;
+  }) => (
+    <button type="button" disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}));
+
+import { MarkExceptionModal } from './MarkExceptionModal';
+
+describe('MarkExceptionModal', () => {
+  beforeEach(() => {
+    postMock.mockReset();
+  });
+
+  it('renders the finding title and resource label', () => {
+    render(
+      <MarkExceptionModal
+        open
+        onOpenChange={() => {}}
+        findingId="icx_1"
+        findingTitle="IAM password policy < 14 characters"
+        resourceLabel="IAM Account: 123456789012"
+      />,
+    );
+    expect(
+      screen.getByText('IAM password policy < 14 characters'),
+    ).toBeInTheDocument();
+    expect(screen.getByText('IAM Account: 123456789012')).toBeInTheDocument();
+  });
+
+  it('keeps the submit button disabled until reason reaches min length', () => {
+    render(
+      <MarkExceptionModal
+        open
+        onOpenChange={() => {}}
+        findingId="icx_1"
+        findingTitle="X"
+      />,
+    );
+    const submit = screen.getByRole('button', { name: /^Mark as exception$/ });
+    expect(submit).toBeDisabled();
+
+    fireEvent.change(screen.getByLabelText(/Reason for exception/i), {
+      target: { value: 'too short' },
+    });
+    expect(submit).toBeDisabled();
+
+    fireEvent.change(screen.getByLabelText(/Reason for exception/i), {
+      target: {
+        value: 'This is a long enough documented reason for the exception.',
+      },
+    });
+    expect(submit).not.toBeDisabled();
+  });
+
+  it('submits to the exception endpoint and invokes onMarked on success', async () => {
+    postMock.mockResolvedValueOnce({ error: null, data: { data: { id: 'fex_1' } } });
+    const onMarked = vi.fn();
+    render(
+      <MarkExceptionModal
+        open
+        onOpenChange={() => {}}
+        findingId="icx_1"
+        findingTitle="X"
+        onMarked={onMarked}
+      />,
+    );
+    fireEvent.change(screen.getByLabelText(/Reason for exception/i), {
+      target: {
+        value: 'This is a long enough documented reason for the exception.',
+      },
+    });
+    fireEvent.click(
+      screen.getByRole('button', { name: /^Mark as exception$/ }),
+    );
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(postMock).toHaveBeenCalledWith(
+      '/v1/cloud-security/findings/icx_1/exception',
+      expect.objectContaining({
+        reason: 'This is a long enough documented reason for the exception.',
+      }),
+    );
+    expect(onMarked).toHaveBeenCalled();
+  });
+
+  it('does not invoke onMarked when the API responds with an error', async () => {
+    postMock.mockResolvedValueOnce({ error: 'Forbidden' });
+    const onMarked = vi.fn();
+    render(
+      <MarkExceptionModal
+        open
+        onOpenChange={() => {}}
+        findingId="icx_1"
+        findingTitle="X"
+        onMarked={onMarked}
+      />,
+    );
+    fireEvent.change(screen.getByLabelText(/Reason for exception/i), {
+      target: {
+        value: 'This is a long enough documented reason for the exception.',
+      },
+    });
+    fireEvent.click(
+      screen.getByRole('button', { name: /^Mark as exception$/ }),
+    );
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(onMarked).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.tsx
new file mode 100644
index 0000000000..d5896d26c8
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.tsx
@@ -0,0 +1,198 @@
+'use client';
+
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from '@trycompai/ui/dialog';
+import { Button } from '@trycompai/ui/button';
+import { useApi } from '@/hooks/use-api';
+import { Loader2 } from 'lucide-react';
+import { useState } from 'react';
+import { toast } from 'sonner';
+
+const MIN_REASON_LENGTH = 20;
+
+export interface MarkExceptionModalProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  findingId: string | null;
+  findingTitle: string;
+  resourceLabel?: string | null;
+  onMarked?: () => void;
+}
+
+/**
+ * Modal that captures the reason + optional reviewer + optional expiration
+ * date for marking a finding as an exception. Talks to POST
+ * /v1/cloud-security/findings/:id/exception. Calls onMarked() on success
+ * so the parent can refresh its findings list.
+ */
+export function MarkExceptionModal({
+  open,
+  onOpenChange,
+  findingId,
+  findingTitle,
+  resourceLabel,
+  onMarked,
+}: MarkExceptionModalProps) {
+  const api = useApi();
+  const [reason, setReason] = useState('');
+  const [reviewedBy, setReviewedBy] = useState('');
+  const [expiresAt, setExpiresAt] = useState('');
+  const [submitting, setSubmitting] = useState(false);
+
+  const reasonTooShort = reason.trim().length < MIN_REASON_LENGTH;
+
+  const handleSubmit = async () => {
+    if (!findingId || reasonTooShort) return;
+    setSubmitting(true);
+    const response = await api.post(
+      `/v1/cloud-security/findings/${findingId}/exception`,
+      {
+        reason: reason.trim(),
+        reviewedBy: reviewedBy.trim() || undefined,
+        expiresAt: expiresAt || undefined,
+      },
+    );
+    setSubmitting(false);
+
+    if (response.error) {
+      const message =
+        typeof response.error === 'string'
+          ? response.error
+          : 'Could not mark exception — please try again.';
+      toast.error(message);
+      return;
+    }
+
+    toast.success('Marked as exception');
+    setReason('');
+    setReviewedBy('');
+    setExpiresAt('');
+    onMarked?.();
+    onOpenChange(false);
+  };
+
+  const handleClose = (next: boolean) => {
+    if (!next) {
+      setReason('');
+      setReviewedBy('');
+      setExpiresAt('');
+    }
+    onOpenChange(next);
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={handleClose}>
+      <DialogContent className="max-w-lg">
+        <DialogHeader>
+          <DialogTitle>Mark this finding as an exception?</DialogTitle>
+          <DialogDescription>
+            Exceptions are recorded in the audit trail. Auditors will see this
+            exception and the reason you provide.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-3 py-2">
+          <div className="rounded-md border bg-muted/30 p-3 text-xs">
+            <p className="font-medium">{findingTitle}</p>
+            {resourceLabel && (
+              <p className="text-muted-foreground mt-0.5">{resourceLabel}</p>
+            )}
+          </div>
+
+          <div>
+            <label
+              htmlFor="exception-reason"
+              className="block text-xs font-medium mb-1"
+            >
+              Reason for exception (required) *
+            </label>
+            <textarea
+              id="exception-reason"
+              rows={4}
+              value={reason}
+              onChange={(e) => setReason(e.target.value)}
+              placeholder="e.g. This bucket hosts our public marketing assets. Public read access is intentional."
+              className="w-full rounded-md border bg-background px-3 py-2 text-xs focus:outline-none focus:ring-2 focus:ring-primary/30"
+            />
+            <p
+              className={`mt-1 text-[10px] ${
+                reasonTooShort
+                  ? 'text-muted-foreground'
+                  : 'text-primary'
+              }`}
+            >
+              {reason.trim().length}/{MIN_REASON_LENGTH}+ characters
+              {reasonTooShort && ' — please be specific'}
+            </p>
+          </div>
+
+          <div>
+            <label
+              htmlFor="exception-reviewer"
+              className="block text-xs font-medium mb-1"
+            >
+              Reviewed by (optional)
+            </label>
+            <input
+              id="exception-reviewer"
+              type="text"
+              value={reviewedBy}
+              onChange={(e) => setReviewedBy(e.target.value)}
+              placeholder='e.g. "Approved by CISO 2026-Q1"'
+              className="w-full rounded-md border bg-background px-3 py-2 text-xs focus:outline-none focus:ring-2 focus:ring-primary/30"
+            />
+          </div>
+
+          <div>
+            <label
+              htmlFor="exception-expires"
+              className="block text-xs font-medium mb-1"
+            >
+              Auto-review on (optional)
+            </label>
+            <input
+              id="exception-expires"
+              type="date"
+              value={expiresAt}
+              onChange={(e) => setExpiresAt(e.target.value)}
+              min={new Date(Date.now() + 24 * 60 * 60 * 1000)
+                .toISOString()
+                .slice(0, 10)}
+              className="w-full rounded-md border bg-background px-3 py-2 text-xs focus:outline-none focus:ring-2 focus:ring-primary/30"
+            />
+            <p className="text-muted-foreground mt-1 text-[10px]">
+              Leave empty for never. If set, the finding reappears in Scan
+              Results on the first scan after this date.
+            </p>
+          </div>
+        </div>
+
+        <div className="flex items-center justify-end gap-2 border-t pt-3">
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => handleClose(false)}
+            disabled={submitting}
+          >
+            Cancel
+          </Button>
+          <Button
+            size="sm"
+            onClick={handleSubmit}
+            disabled={reasonTooShort || submitting || !findingId}
+          >
+            {submitting ? (
+              <Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />
+            ) : null}
+            Mark as exception
+          </Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ProviderTabs.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ProviderTabs.tsx
index 8bde66b771..cb10ab1d93 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ProviderTabs.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ProviderTabs.tsx
@@ -9,6 +9,7 @@ import type { Finding, Provider } from '../types';
 import { ActivitySection } from '@/app/(app)/[orgId]/integrations/[slug]/components/ActivitySection';
 import { RemediationHistorySection } from '@/app/(app)/[orgId]/integrations/[slug]/components/RemediationHistorySection';
 import { CloudTestsSection } from './CloudTestsSection';
+import { HistoryTab } from './HistoryTab';
 import { ResultsView } from './ResultsView';
 import { ServicesGrid } from './ServicesGrid';
 
@@ -146,7 +147,8 @@ function CloudConnectionContent({
   return (
     <Tabs defaultValue="findings">
       <TabsList variant="underline">
-        <TabsTrigger value="findings">Findings</TabsTrigger>
+        <TabsTrigger value="findings">Scan Results</TabsTrigger>
+        <TabsTrigger value="history">History</TabsTrigger>
         <TabsTrigger value="activity">Activity</TabsTrigger>
         <TabsTrigger value="remediations">Remediations</TabsTrigger>
         <TabsTrigger value="services">
@@ -161,6 +163,7 @@ function CloudConnectionContent({
             connectionId={connection.id}
             orgId={orgId}
             lastRunAt={connection.lastRunAt}
+            latestRun={connection.latestRun ?? null}
             variables={connection.variables ?? undefined}
             awsType={connection.awsType}
             onScanComplete={onScanComplete}
@@ -168,6 +171,12 @@ function CloudConnectionContent({
         </div>
       </TabsContent>
 
+      <TabsContent value="history">
+        <div className="pt-4">
+          <HistoryTab connectionId={connection.id} />
+        </div>
+      </TabsContent>
+
       <TabsContent value="activity">
         <div className="pt-5">
           <ActivitySection connectionId={connection.id} />
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ResultsView.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ResultsView.tsx
index 06a486e294..60407902a2 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ResultsView.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ResultsView.tsx
@@ -197,12 +197,12 @@ export function ResultsView({
         <FindingsTable findings={sortedFindings} />
       ) : findings.length > 0 ? (
         <div className="text-muted-foreground rounded-xs border p-12 text-center">
-          <p className="text-lg">No findings match the selected filters</p>
+          <p className="text-lg">No results match the selected filters</p>
           <p className="mt-2 text-sm">Try adjusting your filters</p>
         </div>
       ) : (
         <div className="rounded-lg border-2 border-dashed p-12 text-center">
-          <p className="text-muted-foreground text-lg">No findings yet</p>
+          <p className="text-muted-foreground text-lg">No results yet</p>
           <p className="text-muted-foreground mt-2 text-sm">
             Click "Run Scan" above to check for security issues
           </p>
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/check-groups.test.ts b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/check-groups.test.ts
new file mode 100644
index 0000000000..c588df6881
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/check-groups.test.ts
@@ -0,0 +1,183 @@
+import { describe, expect, it } from 'vitest';
+import { buildCheckGroups, deriveCheckTitle } from './check-groups';
+import type { Finding } from '../types';
+
+function makeFinding(overrides: Partial<Finding>): Finding {
+  return {
+    id: 'icx_test',
+    title: 'A finding',
+    description: null,
+    remediation: null,
+    status: 'failed',
+    severity: 'medium',
+    serviceId: 'iam',
+    findingKey: null,
+    resourceId: null,
+    resourceType: null,
+    checkId: null,
+    checkKey: null,
+    evidence: null,
+    projectDisplayName: null,
+    completedAt: null,
+    connectionId: 'icn_test',
+    providerSlug: 'aws',
+    integration: { integrationId: 'aws' },
+    ...overrides,
+  };
+}
+
+describe('deriveCheckTitle', () => {
+  it('strips a quoted resourceId from the title', () => {
+    const f = makeFinding({
+      title: 'IAM user "john" does not have MFA enabled',
+      resourceId: 'john',
+    });
+    expect(deriveCheckTitle(f)).toBe('IAM user does not have MFA enabled');
+  });
+
+  it('strips an unquoted resourceId from the title', () => {
+    const f = makeFinding({
+      title: 'CloudTrail trail prod-trail is not logging',
+      resourceId: 'prod-trail',
+    });
+    expect(deriveCheckTitle(f)).toBe('CloudTrail trail is not logging');
+  });
+
+  it('returns the title unchanged for fixed-id checks (resourceId = account-level)', () => {
+    const f = makeFinding({
+      title: 'IAM password policy minimum length is below 14 characters',
+      resourceId: 'account-level',
+    });
+    expect(deriveCheckTitle(f)).toBe(
+      'IAM password policy minimum length is below 14 characters',
+    );
+  });
+
+  it('returns the title unchanged when resourceId is not present in title', () => {
+    const f = makeFinding({
+      title: 'S3 bucket has public access enabled',
+      resourceId: 'logs-archive',
+    });
+    expect(deriveCheckTitle(f)).toBe('S3 bucket has public access enabled');
+  });
+
+  it('falls back to checkKey or default when title is missing', () => {
+    expect(deriveCheckTitle(makeFinding({ title: null, checkKey: 'iam-no-mfa' }))).toBe(
+      'iam-no-mfa',
+    );
+    expect(deriveCheckTitle(makeFinding({ title: null, checkKey: null }))).toBe(
+      'Untitled check',
+    );
+  });
+});
+
+describe('buildCheckGroups', () => {
+  it('returns an empty array for empty input', () => {
+    expect(buildCheckGroups([])).toEqual([]);
+  });
+
+  it('groups findings by checkKey', () => {
+    const findings = [
+      makeFinding({
+        id: 'a',
+        checkKey: 'iam-no-mfa',
+        title: 'IAM user "john" does not have MFA',
+        resourceId: 'john',
+        status: 'failed',
+        severity: 'high',
+      }),
+      makeFinding({
+        id: 'b',
+        checkKey: 'iam-no-mfa',
+        title: 'IAM user "alice" does not have MFA',
+        resourceId: 'alice',
+        status: 'failed',
+        severity: 'high',
+      }),
+      makeFinding({
+        id: 'c',
+        checkKey: 'iam-no-mfa',
+        title: 'IAM user "bob" has MFA',
+        resourceId: 'bob',
+        status: 'passed',
+        severity: 'info',
+      }),
+    ];
+    const groups = buildCheckGroups(findings);
+    expect(groups).toHaveLength(1);
+    expect(groups[0].checkKey).toBe('iam-no-mfa');
+    expect(groups[0].failed).toHaveLength(2);
+    expect(groups[0].passed).toHaveLength(1);
+    expect(groups[0].all).toHaveLength(3);
+  });
+
+  it('produces one group per check kind', () => {
+    const findings = [
+      makeFinding({
+        id: 'a',
+        checkKey: 'iam-no-mfa',
+        status: 'failed',
+      }),
+      makeFinding({
+        id: 'b',
+        checkKey: 'iam-weak-password-length',
+        status: 'failed',
+      }),
+    ];
+    expect(buildCheckGroups(findings)).toHaveLength(2);
+  });
+
+  it('orders groups by highest severity first (failures lead)', () => {
+    const findings = [
+      makeFinding({
+        id: 'a',
+        checkKey: 'check-medium',
+        status: 'failed',
+        severity: 'medium',
+      }),
+      makeFinding({
+        id: 'b',
+        checkKey: 'check-critical',
+        status: 'failed',
+        severity: 'critical',
+      }),
+      makeFinding({
+        id: 'c',
+        checkKey: 'check-allpass',
+        status: 'passed',
+        severity: 'info',
+      }),
+    ];
+    const groups = buildCheckGroups(findings);
+    expect(groups.map((g) => g.checkKey)).toEqual([
+      'check-critical',
+      'check-medium',
+      'check-allpass',
+    ]);
+  });
+
+  it('falls back to title-as-key when checkKey is missing (legacy findings)', () => {
+    const findings = [
+      makeFinding({ id: 'a', checkKey: null, title: 'Legacy finding' }),
+      makeFinding({ id: 'b', checkKey: null, title: 'Legacy finding' }),
+      makeFinding({ id: 'c', checkKey: null, title: 'Different legacy' }),
+    ];
+    const groups = buildCheckGroups(findings);
+    expect(groups).toHaveLength(2);
+  });
+
+  it('marks all-passing groups with severity info', () => {
+    const findings = [
+      makeFinding({
+        id: 'a',
+        checkKey: 'check-all-pass',
+        status: 'passed',
+        severity: 'info',
+      }),
+    ];
+    const groups = buildCheckGroups(findings);
+    expect(groups[0].severity).toBe('info');
+    expect(groups[0].failed).toHaveLength(0);
+    expect(groups[0].passed).toHaveLength(1);
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/check-groups.ts b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/check-groups.ts
new file mode 100644
index 0000000000..bb135f20af
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/check-groups.ts
@@ -0,0 +1,125 @@
+/**
+ * Pure helpers for grouping findings by check within a service. Kept in
+ * its own file (no React imports) so the logic can be unit-tested without
+ * spinning up jsdom.
+ */
+
+import type { Finding } from '../types';
+
+export interface CheckGroup {
+  /** Stable identifier — matches Finding.checkKey, used as React key. */
+  checkKey: string;
+  /** Display title with resource-specific tokens stripped. */
+  checkTitle: string;
+  /** All findings for this check (both passed and failed) in input order. */
+  all: Finding[];
+  /** Failing findings only. */
+  failed: Finding[];
+  /** Passing findings only. */
+  passed: Finding[];
+  /** Severity displayed in the sub-header — highest among failures, info if none. */
+  severity: string;
+}
+
+const SEVERITY_RANK: Record<string, number> = {
+  critical: 5,
+  high: 4,
+  medium: 3,
+  low: 2,
+  info: 1,
+};
+
+/**
+ * Derive a check-level title from a representative finding by stripping
+ * the resource-specific portion. Used as the sub-group header text.
+ *
+ * Heuristics applied in order:
+ *   1. If `resourceId` is wrapped in quotes in the title (`"john"`), drop the quoted segment.
+ *   2. Otherwise, drop the literal resourceId substring.
+ *   3. If neither matches, fall back to the title unchanged.
+ *
+ * Always collapses any resulting double-spaces.
+ */
+export function deriveCheckTitle(finding: Finding): string {
+  const raw = finding.title?.trim();
+  if (!raw) return finding.checkKey ?? 'Untitled check';
+
+  const resourceId = finding.resourceId;
+  if (!resourceId || resourceId === 'account-level') return raw;
+
+  let cleaned = raw;
+  const quoted = `"${resourceId}"`;
+  if (cleaned.includes(quoted)) {
+    cleaned = cleaned.replace(quoted, '').trim();
+  } else if (cleaned.includes(resourceId)) {
+    cleaned = cleaned.replace(resourceId, '').trim();
+  } else {
+    return raw;
+  }
+
+  return cleaned.replace(/\s{2,}/g, ' ').replace(/\s+([,.])/g, '$1');
+}
+
+/**
+ * Group an array of findings into per-check sub-groups. Each group carries
+ * the failed/passed split and a derived check-level title.
+ *
+ * Order: groups with failures first (sorted by highest severity), then
+ * all-passing groups alphabetically.
+ */
+export function buildCheckGroups(findings: Finding[]): CheckGroup[] {
+  if (findings.length === 0) return [];
+
+  const byKey = new Map<string, Finding[]>();
+  for (const finding of findings) {
+    // Fall back to title-as-key for legacy findings with no checkKey — keeps
+    // them grouped sensibly enough.
+    const key = finding.checkKey ?? finding.title ?? finding.id;
+    const bucket = byKey.get(key) ?? [];
+    bucket.push(finding);
+    byKey.set(key, bucket);
+  }
+
+  const groups: CheckGroup[] = [];
+  for (const [checkKey, bucket] of byKey) {
+    const failed = bucket.filter(
+      (f) => f.status === 'failed' || f.status === 'FAILED',
+    );
+    const passed = bucket.filter(
+      (f) => f.status === 'passed' || f.status === 'success',
+    );
+    const representative = failed[0] ?? bucket[0];
+    const severity =
+      failed.length === 0
+        ? 'info'
+        : failed.reduce((highest, f) => {
+            const sev = (f.severity ?? 'info').toLowerCase();
+            return (SEVERITY_RANK[sev] ?? 0) > (SEVERITY_RANK[highest] ?? 0)
+              ? sev
+              : highest;
+          }, 'info');
+
+    groups.push({
+      checkKey,
+      checkTitle: deriveCheckTitle(representative),
+      all: bucket,
+      failed,
+      passed,
+      severity,
+    });
+  }
+
+  return groups.sort((a, b) => {
+    // Failures first.
+    if (a.failed.length > 0 && b.failed.length === 0) return -1;
+    if (a.failed.length === 0 && b.failed.length > 0) return 1;
+    // Among failures, highest severity first.
+    if (a.failed.length > 0 && b.failed.length > 0) {
+      const sevDiff =
+        (SEVERITY_RANK[b.severity] ?? 0) - (SEVERITY_RANK[a.severity] ?? 0);
+      if (sevDiff !== 0) return sevDiff;
+    }
+    // Otherwise alphabetical for stability.
+    return a.checkTitle.localeCompare(b.checkTitle);
+  });
+}
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/types.ts b/apps/app/src/app/(app)/[orgId]/cloud-tests/types.ts
index 7429a456c2..ad5ace4821 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/types.ts
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/types.ts
@@ -8,6 +8,21 @@ export interface Finding {
   serviceId: string | null;
   findingKey: string | null;
   resourceId: string | null;
+  /** Provider-side resource classification, e.g. "AwsIamUser", "S3Bucket". */
+  resourceType: string | null;
+  /** Run-level checkId (e.g. "aws-security-scan") — coarse. */
+  checkId: string | null;
+  /**
+   * Normalized per-check identifier (e.g. "iam-no-mfa") shared across all
+   * resource instances of the same logical check. Used to group findings
+   * into check sub-groups in the UI.
+   */
+  checkKey: string | null;
+  /**
+   * Sanitized provider payload — sensitive keys are redacted server-side
+   * by evidence-sanitizer before this is sent to the client.
+   */
+  evidence: unknown;
   projectDisplayName: string | null;
   completedAt: Date | null;
   connectionId: string;
@@ -17,6 +32,23 @@ export interface Finding {
   };
 }
 
+/**
+ * Summary of the most recent scan run for a provider connection. Surfaced
+ * directly on the providers payload so the UI can render run metadata
+ * (count, duration, pass/fail breakdown) without a second fetch.
+ *
+ * Legacy connections only populate `completedAt` — per-run counters are
+ * not stored in the legacy Integration model.
+ */
+export interface ProviderLatestRun {
+  completedAt: Date | null;
+  durationMs: number | null;
+  totalChecked: number | null;
+  passedCount: number | null;
+  failedCount: number | null;
+  status: string;
+}
+
 export interface Provider {
   id: string;
   integrationId: string;
@@ -37,6 +69,7 @@ export interface Provider {
   tenantId?: string;
   subscriptionId?: string;
   supportsMultipleConnections?: boolean;
+  latestRun?: ProviderLatestRun | null;
 }
 export type FailedIntegration = {
   id: string;
diff --git a/apps/app/src/app/(app)/[orgId]/overview/components/FindingDetailSheet.tsx b/apps/app/src/app/(app)/[orgId]/overview/components/FindingDetailSheet.tsx
index d8a009940d..79c7f1c2ac 100644
--- a/apps/app/src/app/(app)/[orgId]/overview/components/FindingDetailSheet.tsx
+++ b/apps/app/src/app/(app)/[orgId]/overview/components/FindingDetailSheet.tsx
@@ -12,6 +12,7 @@ import {
 function capitalize(s: string) {
   return s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
 }
+import { Comments } from '@/components/comments/Comments';
 import { usePermissions } from '@/hooks/use-permissions';
 import { useSession } from '@/utils/auth-client';
 import { FindingSeverity, FindingStatus } from '@db';
@@ -409,6 +410,15 @@ export function FindingDetailSheet({
               </HStack>
             </HStack>
 
+            <Stack gap="xs">
+              <Text size="sm" weight="medium">
+                Comments
+              </Text>
+              {finding ? (
+                <Comments entityId={finding.id} entityType="finding" />
+              ) : null}
+            </Stack>
+
             <Stack gap="xs">
               <Text size="sm" weight="medium">
                 Activity
diff --git a/packages/db/prisma/migrations/20260513213400_cloud_tests_check_definition/migration.sql b/packages/db/prisma/migrations/20260513213400_cloud_tests_check_definition/migration.sql
new file mode 100644
index 0000000000..27773690ef
--- /dev/null
+++ b/packages/db/prisma/migrations/20260513213400_cloud_tests_check_definition/migration.sql
@@ -0,0 +1,28 @@
+-- CreateTable
+CREATE TABLE "CheckDefinition" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('chd'::text),
+    "organizationId" TEXT NOT NULL,
+    "checkId" TEXT NOT NULL,
+    "sourceHash" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "description" TEXT NOT NULL,
+    "passCriteria" TEXT NOT NULL,
+    "failCriteria" TEXT NOT NULL,
+    "whyItMatters" TEXT NOT NULL,
+    "modelVersion" TEXT NOT NULL,
+    "generatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "CheckDefinition_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "CheckDefinition_organizationId_idx" ON "CheckDefinition"("organizationId");
+
+-- CreateIndex
+CREATE INDEX "CheckDefinition_checkId_idx" ON "CheckDefinition"("checkId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "CheckDefinition_organizationId_checkId_key" ON "CheckDefinition"("organizationId", "checkId");
+
+-- AddForeignKey
+ALTER TABLE "CheckDefinition" ADD CONSTRAINT "CheckDefinition_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/migrations/20260513220233_comment_entity_type_finding/migration.sql b/packages/db/prisma/migrations/20260513220233_comment_entity_type_finding/migration.sql
new file mode 100644
index 0000000000..cb81b52507
--- /dev/null
+++ b/packages/db/prisma/migrations/20260513220233_comment_entity_type_finding/migration.sql
@@ -0,0 +1,2 @@
+-- AlterEnum
+ALTER TYPE "CommentEntityType" ADD VALUE 'finding';
diff --git a/packages/db/prisma/migrations/20260513221148_cloud_tests_phase5_history/migration.sql b/packages/db/prisma/migrations/20260513221148_cloud_tests_phase5_history/migration.sql
new file mode 100644
index 0000000000..d21b8ac3b9
--- /dev/null
+++ b/packages/db/prisma/migrations/20260513221148_cloud_tests_phase5_history/migration.sql
@@ -0,0 +1,116 @@
+-- CreateEnum
+CREATE TYPE "FindingResolutionMethod" AS ENUM ('platform_fix', 'external_fix', 'resource_deleted', 'exception_marked');
+
+-- AlterTable
+ALTER TABLE "IntegrationCheckRun" ADD COLUMN     "failedServices" TEXT[] DEFAULT ARRAY[]::TEXT[],
+ADD COLUMN     "scannedServices" TEXT[] DEFAULT ARRAY[]::TEXT[];
+
+-- CreateTable
+CREATE TABLE "FindingException" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('fex'::text),
+    "organizationId" TEXT NOT NULL,
+    "connectionId" TEXT NOT NULL,
+    "checkId" TEXT NOT NULL,
+    "resourceId" TEXT NOT NULL,
+    "reason" TEXT NOT NULL,
+    "reviewedBy" TEXT,
+    "expiresAt" TIMESTAMP(3),
+    "markedById" TEXT NOT NULL,
+    "markedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "revokedAt" TIMESTAMP(3),
+    "revokedById" TEXT,
+
+    CONSTRAINT "FindingException_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "FindingResolution" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('fres'::text),
+    "organizationId" TEXT NOT NULL,
+    "connectionId" TEXT NOT NULL,
+    "checkId" TEXT NOT NULL,
+    "resourceId" TEXT NOT NULL,
+    "resourceType" TEXT,
+    "resolvedAt" TIMESTAMP(3) NOT NULL,
+    "resolutionMethod" "FindingResolutionMethod" NOT NULL,
+    "resolvedById" TEXT,
+    "remediationActionId" TEXT,
+    "resolvedFromRunId" TEXT NOT NULL,
+    "detectedInRunId" TEXT NOT NULL,
+    "daysOpen" INTEGER,
+
+    CONSTRAINT "FindingResolution_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "FindingRegression" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('freg'::text),
+    "organizationId" TEXT NOT NULL,
+    "connectionId" TEXT NOT NULL,
+    "checkId" TEXT NOT NULL,
+    "resourceId" TEXT NOT NULL,
+    "previouslyResolvedAt" TIMESTAMP(3) NOT NULL,
+    "previousResolutionId" TEXT,
+    "regressedAt" TIMESTAMP(3) NOT NULL,
+    "detectedInRunId" TEXT NOT NULL,
+    "daysClean" INTEGER,
+
+    CONSTRAINT "FindingRegression_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "FindingException_organizationId_idx" ON "FindingException"("organizationId");
+
+-- CreateIndex
+CREATE INDEX "FindingException_connectionId_idx" ON "FindingException"("connectionId");
+
+-- CreateIndex
+CREATE INDEX "FindingException_checkId_resourceId_idx" ON "FindingException"("checkId", "resourceId");
+
+-- CreateIndex
+CREATE INDEX "FindingException_expiresAt_idx" ON "FindingException"("expiresAt");
+
+-- CreateIndex
+CREATE INDEX "FindingResolution_organizationId_idx" ON "FindingResolution"("organizationId");
+
+-- CreateIndex
+CREATE INDEX "FindingResolution_connectionId_idx" ON "FindingResolution"("connectionId");
+
+-- CreateIndex
+CREATE INDEX "FindingResolution_resolvedAt_idx" ON "FindingResolution"("resolvedAt");
+
+-- CreateIndex
+CREATE INDEX "FindingResolution_resolutionMethod_idx" ON "FindingResolution"("resolutionMethod");
+
+-- CreateIndex
+CREATE INDEX "FindingResolution_checkId_resourceId_idx" ON "FindingResolution"("checkId", "resourceId");
+
+-- CreateIndex
+CREATE INDEX "FindingRegression_organizationId_idx" ON "FindingRegression"("organizationId");
+
+-- CreateIndex
+CREATE INDEX "FindingRegression_connectionId_idx" ON "FindingRegression"("connectionId");
+
+-- CreateIndex
+CREATE INDEX "FindingRegression_regressedAt_idx" ON "FindingRegression"("regressedAt");
+
+-- CreateIndex
+CREATE INDEX "FindingRegression_checkId_resourceId_idx" ON "FindingRegression"("checkId", "resourceId");
+
+-- AddForeignKey
+ALTER TABLE "FindingException" ADD CONSTRAINT "FindingException_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FindingException" ADD CONSTRAINT "FindingException_connectionId_fkey" FOREIGN KEY ("connectionId") REFERENCES "IntegrationConnection"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FindingResolution" ADD CONSTRAINT "FindingResolution_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FindingResolution" ADD CONSTRAINT "FindingResolution_connectionId_fkey" FOREIGN KEY ("connectionId") REFERENCES "IntegrationConnection"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FindingRegression" ADD CONSTRAINT "FindingRegression_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FindingRegression" ADD CONSTRAINT "FindingRegression_connectionId_fkey" FOREIGN KEY ("connectionId") REFERENCES "IntegrationConnection"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/schema/check-definition.prisma b/packages/db/prisma/schema/check-definition.prisma
new file mode 100644
index 0000000000..541c58c0ae
--- /dev/null
+++ b/packages/db/prisma/schema/check-definition.prisma
@@ -0,0 +1,48 @@
+/// Cached "About this check" content shown to auditors when they expand a
+/// finding in the cloud-tests UI.
+///
+/// Generation strategy:
+/// - AWS: lazily generated by Claude Haiku 4.5 from the relevant adapter
+///   code snippet on first user view. Cached forever per (orgId, checkId)
+///   until `sourceHash` no longer matches the current adapter code, at
+///   which point the next view regenerates.
+/// - GCP / Azure: not stored here. The API endpoint derives a definition
+///   from the provider's evidence payload (Google SCC / Microsoft Defender
+///   already supply descriptions) without an AI call.
+///
+/// Safety: content NEVER includes compliance control numbers, external
+/// URLs, or framework claims. The Haiku prompt explicitly forbids them and
+/// the API service strips them server-side. See ai-description.service.ts.
+model CheckDefinition {
+  id             String       @id @default(dbgenerated("generate_prefixed_cuid('chd'::text)"))
+  organizationId String
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  /// Normalized per-check identifier — e.g. "iam-weak-password-length".
+  /// Stripped of any resource-specific suffix before lookup.
+  checkId String
+
+  /// SHA-256 of the adapter source snippet that produced this finding.
+  /// If the current snippet's hash differs, the cache entry is stale and
+  /// the next read regenerates content.
+  sourceHash String
+
+  /// Plain-English summary used as the panel title.
+  title String
+  /// What the check actually verifies (1-3 sentences).
+  description String
+  /// Conditions under which the check passes.
+  passCriteria String
+  /// Conditions under which the check fails.
+  failCriteria String
+  /// Why this check matters from a security / risk perspective.
+  whyItMatters String
+
+  /// e.g. "claude-haiku-4-5" — flip the constant in code to invalidate all.
+  modelVersion String
+  generatedAt  DateTime @default(now())
+
+  @@unique([organizationId, checkId])
+  @@index([organizationId])
+  @@index([checkId])
+}
diff --git a/packages/db/prisma/schema/comment.prisma b/packages/db/prisma/schema/comment.prisma
index e00cb1d5cd..b0c440f69d 100644
--- a/packages/db/prisma/schema/comment.prisma
+++ b/packages/db/prisma/schema/comment.prisma
@@ -24,4 +24,5 @@ enum CommentEntityType {
   vendor
   risk
   policy
+  finding
 }
diff --git a/packages/db/prisma/schema/finding-history.prisma b/packages/db/prisma/schema/finding-history.prisma
new file mode 100644
index 0000000000..9d145329ce
--- /dev/null
+++ b/packages/db/prisma/schema/finding-history.prisma
@@ -0,0 +1,121 @@
+// Cloud-tests audit trail models — record what was fixed, what is
+// intentionally accepted (exceptions), and what regressed. Surfaces in the
+// History tab so auditors can see the journey, not just current state.
+
+/// A customer-declared exception saying "this finding does not apply / is
+/// intentional / risk accepted, with this reason". Removes the finding
+/// from the active list until revoked or expired.
+///
+/// Required reason captures the documentation an auditor needs. Optional
+/// `reviewedBy` (free text — name or process) and `expiresAt` (auto-review
+/// date) give the customer a way to keep exceptions honest.
+model FindingException {
+  id             String       @id @default(dbgenerated("generate_prefixed_cuid('fex'::text)"))
+  organizationId String
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  connectionId String
+  connection   IntegrationConnection @relation(fields: [connectionId], references: [id], onDelete: Cascade)
+
+  /// Normalized check identifier (e.g. "iam-no-mfa") — matches CloudFinding.checkKey.
+  checkId String
+  /// Per-resource (e.g. user name, bucket name) — same source as CloudFinding.resourceId.
+  resourceId String
+
+  /// Required, min ~20 chars enforced at the service layer.
+  reason String
+  /// Optional free-text — e.g. "approved by CISO 2026-Q1".
+  reviewedBy String?
+  /// Optional. null = never expires. If set, getFindings re-introduces the
+  /// finding to the active list on the first scan after this date.
+  expiresAt DateTime?
+
+  markedById String
+  markedAt   DateTime @default(now())
+
+  /// Set when the exception is revoked manually (separate from natural expiry).
+  revokedAt   DateTime?
+  revokedById String?
+
+  @@index([organizationId])
+  @@index([connectionId])
+  @@index([checkId, resourceId])
+  @@index([expiresAt])
+}
+
+/// One row per "finding stopped failing" event — written by reconciliation
+/// after each scan. The `resolutionMethod` distinguishes a platform fix
+/// (we did it via the AI Fix button) from external (customer fixed in the
+/// provider console), resource deletion, or an exception being marked.
+model FindingResolution {
+  id             String       @id @default(dbgenerated("generate_prefixed_cuid('fres'::text)"))
+  organizationId String
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  connectionId String
+  connection   IntegrationConnection @relation(fields: [connectionId], references: [id], onDelete: Cascade)
+
+  /// Identity of the resolved finding (matches CloudFinding.checkKey + resourceId).
+  checkId      String
+  resourceId   String
+  resourceType String?
+
+  resolvedAt       DateTime
+  resolutionMethod FindingResolutionMethod
+  /// Only set for `platform_fix`. Identifies the user who clicked Fix.
+  resolvedById        String?
+  /// Only set for `platform_fix`. Links to the successful RemediationAction.
+  remediationActionId String?
+
+  /// Run-id pair lets the UI link "the prior scan that was failing" to
+  /// "the current scan that's clean", reproducible from the audit log.
+  resolvedFromRunId String
+  detectedInRunId   String
+  /// How long the finding was open before being resolved.
+  daysOpen Int?
+
+  @@index([organizationId])
+  @@index([connectionId])
+  @@index([resolvedAt])
+  @@index([resolutionMethod])
+  @@index([checkId, resourceId])
+}
+
+enum FindingResolutionMethod {
+  /// Resolved by our Fix button — RemediationAction shows what was applied.
+  platform_fix
+  /// Resolved outside the platform (customer fixed in the AWS console, etc.).
+  external_fix
+  /// Resource no longer exists in the provider — finding is moot.
+  resource_deleted
+  /// User marked this finding as an exception. Filtered, not actually fixed.
+  exception_marked
+}
+
+/// A finding that was previously resolved but is now failing again. The
+/// History tab uses this to surface "fix didn't stick" patterns to auditors.
+model FindingRegression {
+  id             String       @id @default(dbgenerated("generate_prefixed_cuid('freg'::text)"))
+  organizationId String
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  connectionId String
+  connection   IntegrationConnection @relation(fields: [connectionId], references: [id], onDelete: Cascade)
+
+  checkId    String
+  resourceId String
+
+  previouslyResolvedAt DateTime
+  /// Optional FK to the FindingResolution that introduced the prior fix.
+  previousResolutionId String?
+
+  regressedAt     DateTime
+  detectedInRunId String
+  /// Days between the last resolution and this regression.
+  daysClean Int?
+
+  @@index([organizationId])
+  @@index([connectionId])
+  @@index([regressedAt])
+  @@index([checkId, resourceId])
+}
diff --git a/packages/db/prisma/schema/integration-platform.prisma b/packages/db/prisma/schema/integration-platform.prisma
index 98cd949e9e..bbef9ee94d 100644
--- a/packages/db/prisma/schema/integration-platform.prisma
+++ b/packages/db/prisma/schema/integration-platform.prisma
@@ -75,6 +75,9 @@ model IntegrationConnection {
   syncLogs           IntegrationSyncLog[]
   remediationActions RemediationAction[]
   remediationBatches RemediationBatch[]
+  findingExceptions  FindingException[]
+  findingResolutions FindingResolution[]
+  findingRegressions FindingRegression[]
 
   @@index([organizationId])
   @@index([providerId])
@@ -333,6 +336,16 @@ model IntegrationCheckRun {
   /// Full execution logs (JSON array)
   logs Json?
 
+  /// Service IDs (e.g. "s3", "iam") successfully scanned in this run.
+  /// Used by reconciliation to distinguish a passing finding from a
+  /// service that simply wasn't re-scanned (e.g. rate limit, transient
+  /// API failure) — prevents false "resolved" events on partial scans.
+  scannedServices String[] @default([])
+
+  /// Service IDs that errored out mid-scan. Findings under these services
+  /// are NOT considered for resolution detection on this run.
+  failedServices String[] @default([])
+
   createdAt DateTime @default(now())
 
   /// Results from this check run
diff --git a/packages/db/prisma/schema/organization.prisma b/packages/db/prisma/schema/organization.prisma
index 04e9bc24cd..eb7e416eca 100644
--- a/packages/db/prisma/schema/organization.prisma
+++ b/packages/db/prisma/schema/organization.prisma
@@ -61,6 +61,10 @@ model Organization {
   integrationConnections IntegrationConnection[]
   integrationOAuthApps   IntegrationOAuthApp[]
   integrationSyncLogs    IntegrationSyncLog[]
+  checkDefinitions       CheckDefinition[]
+  findingExceptions      FindingException[]
+  findingResolutions     FindingResolution[]
+  findingRegressions     FindingRegression[]
 
   // Pentest credits — wallet of run-credits an org can spend.
   // Source of credits (trial / future Stripe subscription / top-up)

From c05da233efe41a10baaeeb556a60c4ca51c927b9 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Wed, 13 May 2026 18:52:16 -0400
Subject: [PATCH 02/15] fix(cloud-tests): address cubic review findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Real bugs flagged by cubic on PR #2838:

- comments-permission.guard.ts: API key / service-token requests were
  granted without any scope check (authorization bypass). Now mirrors the
  standard PermissionGuard's API-key + service-token enforcement, but
  with the dynamic `${entityType}:${action}` scope so finding-permission
  scopes work end-to-end.
- evidence-sanitizer.ts: snake_case credential keys (`access_key_id`,
  `secret_access_key`) and arrays under sensitive keys (e.g. `tokens: [...]`)
  bypassed redaction. Now normalizes case-separators before matching and
  redacts string/object elements of arrays under sensitive keys. Added
  plural variants (tokens / secrets / cookies / accessKeys / signingKeys
  / sessionTokens / publicKeys / privateKeys / apiKeys / passwords).
- exception.service.ts: concurrent markAsException could create duplicate
  active exceptions. New `@@unique([orgId, connectionId, checkId, resourceId])`
  constraint + Prisma upsert guarantees a single row per finding atomically.
  Re-marking after revoke clears `revokedAt` on the same row; full history
  still lives in AuditLog.
- reconciliation.service.ts: idempotency probe only checked FindingResolution
  — a run that produced only regressions could be re-reconciled and write
  duplicate regression rows. Now checks both tables.
- ai-description.prompt.ts: forbidden-content backstop missed bare control
  citations like "CIS 1.8" / "PCI 8.2.3" / "NIST AC-2" / "HIPAA 164.312".
  Added a broader regex catching `(FRAMEWORK) [LETTERS]?[- ]?N(.N)*`.

Smaller cleanups also flagged:

- MarkExceptionModal / cloud-security.controller: date-only exception
  expiry was parsed as UTC midnight, expiring exceptions ~8h before the
  user-selected local date. Frontend now computes `min` from local date,
  backend now expands bare `YYYY-MM-DD` to end-of-day UTC.
- EvidenceJsonViewer copy button: added focus-visible styles so keyboard
  users can see the focused control.
- exception.service.spec.ts: revocation test now asserts revokedAt is a
  Date in the expected window (caught the missing assertion).

Skipped from cubic's list: cloud-security-query.legacy.ts filter — that
code is pre-existing and was not introduced by this PR.

Test counts after fixes: 105 (was 96). 4 Prisma migrations now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../ai-description.prompt.spec.ts             | 28 ++++++++
 .../cloud-security/ai-description.prompt.ts   | 11 ++-
 .../cloud-security.controller.ts              | 26 ++++++-
 .../cloud-security/evidence-sanitizer.spec.ts | 51 ++++++++++++++
 .../src/cloud-security/evidence-sanitizer.ts  | 46 +++++++++++--
 .../cloud-security/exception.service.spec.ts  | 58 +++++++++-------
 .../src/cloud-security/exception.service.ts   | 59 ++++++++--------
 .../reconciliation.service.spec.ts            | 21 ++++++
 .../cloud-security/reconciliation.service.ts  | 20 ++++--
 .../comments-permission.guard.spec.ts         | 67 ++++++++++++++++++-
 .../src/comments/comments-permission.guard.ts | 53 ++++++++++++---
 .../components/EvidenceJsonViewer.tsx         |  2 +-
 .../components/MarkExceptionModal.tsx         | 21 +++++-
 .../migration.sql                             |  3 +
 .../db/prisma/schema/finding-history.prisma   |  7 +-
 15 files changed, 390 insertions(+), 83 deletions(-)
 create mode 100644 packages/db/prisma/migrations/20260513225000_finding_exception_unique/migration.sql

diff --git a/apps/api/src/cloud-security/ai-description.prompt.spec.ts b/apps/api/src/cloud-security/ai-description.prompt.spec.ts
index 28bfd3fe72..c5872ec485 100644
--- a/apps/api/src/cloud-security/ai-description.prompt.spec.ts
+++ b/apps/api/src/cloud-security/ai-description.prompt.spec.ts
@@ -107,8 +107,36 @@ describe('ai-description.prompt', () => {
         }),
       ).toMatchObject({ field: 'passCriteria' });
     });
+
+    it('flags bare CIS/PCI/NIST/HIPAA control numbers (e.g. "CIS 1.8")', () => {
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          whyItMatters: 'Aligns with CIS 1.8 best practices.',
+        }),
+      ).toMatchObject({ field: 'whyItMatters' });
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          whyItMatters: 'Required by PCI 8.2.3.',
+        }),
+      ).toMatchObject({ field: 'whyItMatters' });
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          whyItMatters: 'See also: NIST AC-2.',
+        }),
+      ).toMatchObject({ field: 'whyItMatters' });
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          whyItMatters: 'Maps to HIPAA 164.312.',
+        }),
+      ).toMatchObject({ field: 'whyItMatters' });
+    });
   });
 
+
   describe('buildCheckDescriptionPrompt', () => {
     it('includes provider, severity, title and description', () => {
       const prompt = buildCheckDescriptionPrompt({
diff --git a/apps/api/src/cloud-security/ai-description.prompt.ts b/apps/api/src/cloud-security/ai-description.prompt.ts
index f487ab37fe..d07d424081 100644
--- a/apps/api/src/cloud-security/ai-description.prompt.ts
+++ b/apps/api/src/cloud-security/ai-description.prompt.ts
@@ -92,7 +92,7 @@ export function buildCheckDescriptionPrompt(input: CheckDescriptionInput): strin
  * patterns that should NEVER match in production output.
  */
 const FORBIDDEN_PATTERNS: readonly RegExp[] = [
-  // Compliance control numbers and framework citations
+  // Compliance framework names (full)
   /\bSOC ?2\b/i,
   /\bISO ?27001\b/i,
   /\bISO ?27002\b/i,
@@ -100,8 +100,13 @@ const FORBIDDEN_PATTERNS: readonly RegExp[] = [
   /\bNIST\b/i,
   /\bPCI ?DSS\b/i,
   /\bCIS ?Benchmark\b/i,
-  /\bCC\d+\.\d+\b/i, // SOC 2 control numbers like CC6.1
-  /\bA\.\d+\.\d+(\.\d+)?\b/, // ISO control numbers like A.9.4.3
+  // Bare control-number citations following any of the known framework
+  // prefixes — catches "CIS 1.8", "PCI 8.2.3", "NIST AC-2",
+  // "HIPAA 164.312" even without the full framework name re-mentioned.
+  /\b(CIS|PCI|NIST|HIPAA|HITRUST|FedRAMP) ?[A-Z]*[- ]?\d+(\.\d+){0,3}\b/i,
+  // SOC 2 / ISO control-number formats
+  /\bCC\d+\.\d+\b/i,
+  /\bA\.\d+\.\d+(\.\d+)?\b/,
   // URLs
   /https?:\/\//i,
   /www\./i,
diff --git a/apps/api/src/cloud-security/cloud-security.controller.ts b/apps/api/src/cloud-security/cloud-security.controller.ts
index 8189f11929..183b237bd3 100644
--- a/apps/api/src/cloud-security/cloud-security.controller.ts
+++ b/apps/api/src/cloud-security/cloud-security.controller.ts
@@ -128,7 +128,7 @@ export class CloudSecurityController {
       userId: req.userId,
       reason: body.reason,
       reviewedBy: body.reviewedBy ?? null,
-      expiresAt: body.expiresAt ? new Date(body.expiresAt) : null,
+      expiresAt: parseExceptionExpiry(body.expiresAt),
     });
     return { data: result };
   }
@@ -969,3 +969,27 @@ export class CloudSecurityController {
     return { success: true };
   }
 }
+
+/**
+ * Convert a user-supplied exception expiry into a Date, treating bare
+ * date strings ("YYYY-MM-DD") as end-of-day UTC so the exception persists
+ * through the user's chosen calendar day in any reasonable time zone.
+ *
+ * Without this, `new Date("2026-08-13")` is parsed as `2026-08-13T00:00:00Z`,
+ * which is the START of Aug 13 UTC — already in the past by late evening
+ * Aug 12 in US Pacific, expiring the exception ~8h before the user expected.
+ */
+function parseExceptionExpiry(input: string | undefined): Date | null {
+  if (!input) return null;
+  // Bare YYYY-MM-DD → end of that day in UTC (close enough to "end of day
+  // anywhere on Earth" without per-user-TZ tracking).
+  const bareDate = /^(\d{4})-(\d{2})-(\d{2})$/.exec(input);
+  if (bareDate) {
+    const [, y, m, d] = bareDate;
+    return new Date(Date.UTC(+y, +m - 1, +d, 23, 59, 59, 999));
+  }
+  // Full ISO timestamp — trust it as-is.
+  const parsed = new Date(input);
+  if (Number.isNaN(parsed.getTime())) return null;
+  return parsed;
+}
diff --git a/apps/api/src/cloud-security/evidence-sanitizer.spec.ts b/apps/api/src/cloud-security/evidence-sanitizer.spec.ts
index 3c8ba64fd9..0e0ab502fd 100644
--- a/apps/api/src/cloud-security/evidence-sanitizer.spec.ts
+++ b/apps/api/src/cloud-security/evidence-sanitizer.spec.ts
@@ -18,6 +18,32 @@ describe('evidence-sanitizer', () => {
       });
     });
 
+    it('redacts snake_case credential keys (e.g. AWS-style access_key_id)', () => {
+      expect(
+        sanitizeEvidence({
+          access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+          secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+          session_token: 'IQoJb3JpZ2luX2VjEHMa...',
+        }),
+      ).toEqual({
+        access_key_id: REDACTED_VALUE,
+        secret_access_key: REDACTED_VALUE,
+        session_token: REDACTED_VALUE,
+      });
+    });
+
+    it('redacts kebab-case and dotted credential keys (e.g. x-api-key)', () => {
+      expect(
+        sanitizeEvidence({
+          'x-api-key': 'sk-abc',
+          'auth.token': 'bearer-xyz',
+        }),
+      ).toEqual({
+        'x-api-key': REDACTED_VALUE,
+        'auth.token': REDACTED_VALUE,
+      });
+    });
+
     it('redacts every configured sensitive suffix pattern', () => {
       const input: Record<string, string> = {
         password: 'a',
@@ -155,6 +181,31 @@ describe('evidence-sanitizer', () => {
       });
     });
 
+    it('redacts string elements of an array under a sensitive key', () => {
+      expect(
+        sanitizeEvidence({
+          tokens: ['t1', 't2', 't3'],
+          numericMix: 'should stay visible',
+        }),
+      ).toEqual({
+        tokens: [REDACTED_VALUE, REDACTED_VALUE, REDACTED_VALUE],
+        numericMix: 'should stay visible',
+      });
+    });
+
+    it('redacts object elements of an array under a sensitive key', () => {
+      expect(
+        sanitizeEvidence({
+          credentials: [
+            { user: 'john', secret: 'x' },
+            { user: 'alice', secret: 'y' },
+          ],
+        }),
+      ).toEqual({
+        credentials: [REDACTED_VALUE, REDACTED_VALUE],
+      });
+    });
+
     it('handles a top-level array', () => {
       expect(sanitizeEvidence([{ token: 'a' }, { name: 'b' }])).toEqual([
         { token: REDACTED_VALUE },
diff --git a/apps/api/src/cloud-security/evidence-sanitizer.ts b/apps/api/src/cloud-security/evidence-sanitizer.ts
index 0e119746df..3a88acb658 100644
--- a/apps/api/src/cloud-security/evidence-sanitizer.ts
+++ b/apps/api/src/cloud-security/evidence-sanitizer.ts
@@ -21,23 +21,35 @@
 export const REDACTED_VALUE = '[REDACTED]';
 
 const SENSITIVE_SUFFIXES: readonly string[] = [
+  // singular + plural pairs — plurals can appear in arrays
+  // (e.g. `tokens: [...]`, `secrets: [...]`)
   'password',
+  'passwords',
   'secret',
+  'secrets',
   'token',
+  'tokens',
   'credential',
   'credentials',
   'privatekey',
+  'privatekeys',
   'publickey',
+  'publickeys',
   'accesskey',
+  'accesskeys',
   'accesskeyid',
   'secretaccesskey',
   'apikey',
+  'apikeys',
   'signingkey',
+  'signingkeys',
   'sessionid',
   'sessiontoken',
+  'sessiontokens',
   'bearer',
   'authorization',
   'cookie',
+  'cookies',
 ];
 
 function isRecord(value: unknown): value is Record<string, unknown> {
@@ -45,10 +57,26 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 function keyIsSensitive(key: string): boolean {
-  const normalized = key.toLowerCase();
+  // Strip underscores, hyphens, dots, and whitespace so suffix matching
+  // catches snake_case (`access_key_id`), kebab-case (`access-key-id`),
+  // and human-formatted (`access key id`) variants alongside camelCase.
+  const normalized = key.toLowerCase().replace(/[\s._-]/g, '');
   return SENSITIVE_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
 }
 
+/**
+ * Replace every string element of an array with REDACTED. Arrays under
+ * sensitive keys (e.g. `tokens: ["t1","t2"]`, `accessKeys: [{...}]`) need
+ * their values scrubbed but their length preserved.
+ */
+function redactArray(value: unknown[]): unknown[] {
+  return value.map((item) => {
+    if (typeof item === 'string') return REDACTED_VALUE;
+    if (isRecord(item)) return REDACTED_VALUE;
+    return item;
+  });
+}
+
 /**
  * Recursively walks a JSON-like value and replaces values under sensitive
  * keys with REDACTED_VALUE. Structure (keys, arrays, primitive types) is
@@ -64,9 +92,19 @@ export function sanitizeEvidence(value: unknown): unknown {
   const result: Record<string, unknown> = {};
   for (const key of Object.keys(value)) {
     const child = value[key];
-    const shouldRedact =
-      keyIsSensitive(key) && (typeof child === 'string' || isRecord(child));
-    result[key] = shouldRedact ? REDACTED_VALUE : sanitizeEvidence(child);
+    if (keyIsSensitive(key)) {
+      if (typeof child === 'string' || isRecord(child)) {
+        result[key] = REDACTED_VALUE;
+      } else if (Array.isArray(child)) {
+        result[key] = redactArray(child);
+      } else {
+        // Booleans / numbers under a sensitive key stay visible — they're
+        // typically config flags (e.g. `requirePassword: true`).
+        result[key] = child;
+      }
+    } else {
+      result[key] = sanitizeEvidence(child);
+    }
   }
   return result;
 }
diff --git a/apps/api/src/cloud-security/exception.service.spec.ts b/apps/api/src/cloud-security/exception.service.spec.ts
index 2a033eba7a..573503fd15 100644
--- a/apps/api/src/cloud-security/exception.service.spec.ts
+++ b/apps/api/src/cloud-security/exception.service.spec.ts
@@ -8,6 +8,7 @@ const dbMock = {
     findFirst: jest.fn(),
     create: jest.fn(),
     update: jest.fn(),
+    upsert: jest.fn(),
   },
   auditLog: { create: jest.fn() },
 };
@@ -45,6 +46,7 @@ describe('CloudExceptionService.markAsException', () => {
     dbMock.findingException.findFirst.mockReset();
     dbMock.findingException.create.mockReset();
     dbMock.findingException.update.mockReset();
+    dbMock.findingException.upsert.mockReset();
   });
 
   it('rejects reasons shorter than 20 characters', async () => {
@@ -70,14 +72,13 @@ describe('CloudExceptionService.markAsException', () => {
     ).rejects.toThrow(BadRequestException);
   });
 
-  it('creates a new exception when none exists for this finding', async () => {
+  it('upserts atomically — the unique constraint prevents concurrent duplicates', async () => {
     withFinding({
       findingKey: 'iam-no-mfa-john',
       resourceId: 'john',
       connectionId: 'icn_aws',
     });
-    dbMock.findingException.findFirst.mockResolvedValueOnce(null);
-    dbMock.findingException.create.mockResolvedValueOnce({ id: 'fex_new' });
+    dbMock.findingException.upsert.mockResolvedValueOnce({ id: 'fex_new' });
 
     const result = await buildService().markAsException({
       findingId: 'icx_1',
@@ -87,15 +88,16 @@ describe('CloudExceptionService.markAsException', () => {
     });
 
     expect(result.id).toBe('fex_new');
-    expect(dbMock.findingException.create).toHaveBeenCalledWith(
+    expect(dbMock.findingException.upsert).toHaveBeenCalledWith(
       expect.objectContaining({
-        data: expect.objectContaining({
-          organizationId: 'org_1',
-          connectionId: 'icn_aws',
-          checkId: 'iam-no-mfa', // normalized from finding key
-          resourceId: 'john',
-          markedById: 'usr_1',
-        }),
+        where: {
+          organizationId_connectionId_checkId_resourceId: {
+            organizationId: 'org_1',
+            connectionId: 'icn_aws',
+            checkId: 'iam-no-mfa', // normalized from finding key
+            resourceId: 'john',
+          },
+        },
       }),
     );
     expect(auditLogMock).toHaveBeenCalledWith(
@@ -103,25 +105,29 @@ describe('CloudExceptionService.markAsException', () => {
     );
   });
 
-  it('updates an existing active exception instead of creating a duplicate', async () => {
+  it('upsert update branch clears prior revocation and refreshes markedById/At', async () => {
     withFinding({
       findingKey: 'iam-no-mfa-alice',
       resourceId: 'alice',
       connectionId: 'icn_aws',
     });
-    dbMock.findingException.findFirst.mockResolvedValueOnce({ id: 'fex_old' });
-    dbMock.findingException.update.mockResolvedValueOnce({ id: 'fex_old' });
+    dbMock.findingException.upsert.mockResolvedValueOnce({ id: 'fex_old' });
 
-    const result = await buildService().markAsException({
+    await buildService().markAsException({
       findingId: 'icx_2',
       organizationId: 'org_1',
-      userId: 'usr_1',
+      userId: 'usr_2',
       reason: 'Updated reason now exceeds the twenty char minimum length.',
     });
 
-    expect(result.id).toBe('fex_old');
-    expect(dbMock.findingException.update).toHaveBeenCalled();
-    expect(dbMock.findingException.create).not.toHaveBeenCalled();
+    const call = dbMock.findingException.upsert.mock.calls[0][0];
+    expect(call.update).toEqual(
+      expect.objectContaining({
+        revokedAt: null,
+        revokedById: null,
+        markedById: 'usr_2',
+      }),
+    );
   });
 
   it('rejects findings that lack a stable check/resource identity', async () => {
@@ -186,17 +192,21 @@ describe('CloudExceptionService.revokeException', () => {
     });
     dbMock.findingException.update.mockResolvedValueOnce({ id: 'fex_1' });
 
+    const before = Date.now();
     await buildService().revokeException({
       exceptionId: 'fex_1',
       organizationId: 'org_1',
       userId: 'usr_1',
     });
+    const after = Date.now();
 
-    expect(dbMock.findingException.update).toHaveBeenCalledWith(
-      expect.objectContaining({
-        data: expect.objectContaining({ revokedById: 'usr_1' }),
-      }),
-    );
+    expect(dbMock.findingException.update).toHaveBeenCalled();
+    const call = dbMock.findingException.update.mock.calls[0][0];
+    expect(call.data.revokedById).toBe('usr_1');
+    // revokedAt must be a Date set during this call window.
+    expect(call.data.revokedAt).toBeInstanceOf(Date);
+    expect(call.data.revokedAt.getTime()).toBeGreaterThanOrEqual(before);
+    expect(call.data.revokedAt.getTime()).toBeLessThanOrEqual(after);
     expect(auditLogMock).toHaveBeenCalledWith(
       expect.objectContaining({ action: 'exception_revoked' }),
     );
diff --git a/apps/api/src/cloud-security/exception.service.ts b/apps/api/src/cloud-security/exception.service.ts
index 9fd3238e48..a89fb83bc7 100644
--- a/apps/api/src/cloud-security/exception.service.ts
+++ b/apps/api/src/cloud-security/exception.service.ts
@@ -49,45 +49,42 @@ export class CloudExceptionService {
       input.organizationId,
     );
 
-    // Reuse an active exception if one already exists for this finding —
-    // mark-then-edit avoids duplicate rows under the same (org, conn, check,
-    // resource) tuple.
-    const existing = await db.findingException.findFirst({
+    // Atomic upsert against the (orgId, connectionId, checkId, resourceId)
+    // unique constraint — guarantees a single row per finding even under
+    // concurrent mark-as-exception requests. The unique constraint allows
+    // re-marking after a revoke to clear `revokedAt` on the same row; the
+    // full mark/revoke history still lives in AuditLog.
+    const upserted = await db.findingException.upsert({
       where: {
+        organizationId_connectionId_checkId_resourceId: {
+          organizationId: input.organizationId,
+          connectionId: lookup.connectionId,
+          checkId: lookup.checkId,
+          resourceId: lookup.resourceId,
+        },
+      },
+      create: {
         organizationId: input.organizationId,
         connectionId: lookup.connectionId,
         checkId: lookup.checkId,
         resourceId: lookup.resourceId,
+        reason: input.reason.trim(),
+        reviewedBy: input.reviewedBy ?? null,
+        expiresAt: input.expiresAt ?? null,
+        markedById: input.userId,
+      },
+      update: {
+        reason: input.reason.trim(),
+        reviewedBy: input.reviewedBy ?? null,
+        expiresAt: input.expiresAt ?? null,
+        // Clear revocation when re-marking — same row, refreshed metadata.
         revokedAt: null,
+        revokedById: null,
+        markedById: input.userId,
+        markedAt: new Date(),
       },
     });
-
-    let exceptionId: string;
-    if (existing) {
-      const updated = await db.findingException.update({
-        where: { id: existing.id },
-        data: {
-          reason: input.reason.trim(),
-          reviewedBy: input.reviewedBy ?? null,
-          expiresAt: input.expiresAt ?? null,
-        },
-      });
-      exceptionId = updated.id;
-    } else {
-      const created = await db.findingException.create({
-        data: {
-          organizationId: input.organizationId,
-          connectionId: lookup.connectionId,
-          checkId: lookup.checkId,
-          resourceId: lookup.resourceId,
-          reason: input.reason.trim(),
-          reviewedBy: input.reviewedBy ?? null,
-          expiresAt: input.expiresAt ?? null,
-          markedById: input.userId,
-        },
-      });
-      exceptionId = created.id;
-    }
+    const exceptionId = upserted.id;
 
     await logCloudSecurityActivity({
       organizationId: input.organizationId,
diff --git a/apps/api/src/cloud-security/reconciliation.service.spec.ts b/apps/api/src/cloud-security/reconciliation.service.spec.ts
index 41d56e9037..a63c6fab28 100644
--- a/apps/api/src/cloud-security/reconciliation.service.spec.ts
+++ b/apps/api/src/cloud-security/reconciliation.service.spec.ts
@@ -13,6 +13,7 @@ const dbMock = {
   },
   findingRegression: {
     create: jest.fn(),
+    findFirst: jest.fn(),
   },
   remediationAction: {
     findFirst: jest.fn(),
@@ -87,6 +88,7 @@ describe('CloudReconciliationService.reconcile', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     dbMock.findingResolution.findFirst.mockResolvedValue(null);
+    dbMock.findingRegression.findFirst.mockResolvedValue(null);
     dbMock.findingRegression.create.mockResolvedValue({ id: 'freg_x' });
     dbMock.findingResolution.create.mockResolvedValue({ id: 'fres_x' });
     dbMock.remediationAction.findFirst.mockResolvedValue(null);
@@ -120,6 +122,25 @@ describe('CloudReconciliationService.reconcile', () => {
     expect(dbMock.findingResolution.create).not.toHaveBeenCalled();
   });
 
+  it('is idempotent for runs that produced only regressions (no resolutions)', async () => {
+    // Regression-only runs would otherwise re-execute reconciliation and
+    // duplicate FindingRegression rows.
+    dbMock.integrationCheckRun.findUnique.mockResolvedValueOnce({
+      id: 'icr_current',
+      status: 'success',
+      connection: { organizationId: 'org_1' },
+      results: [],
+      scannedServices: [],
+    });
+    dbMock.findingResolution.findFirst.mockResolvedValueOnce(null);
+    dbMock.findingRegression.findFirst.mockResolvedValueOnce({ id: 'freg_existing' });
+
+    const service = new CloudReconciliationService(makeExceptionsStub());
+    const result = await service.reconcile({ currentRunId: 'icr_current' });
+    expect(result.skipped).toBe(true);
+    expect(dbMock.findingRegression.create).not.toHaveBeenCalled();
+  });
+
   it('returns 0/0 on first scan (no prior run)', async () => {
     dbMock.integrationCheckRun.findUnique.mockResolvedValueOnce({
       id: 'icr_current',
diff --git a/apps/api/src/cloud-security/reconciliation.service.ts b/apps/api/src/cloud-security/reconciliation.service.ts
index e2b1a356d6..bf3d81d7dc 100644
--- a/apps/api/src/cloud-security/reconciliation.service.ts
+++ b/apps/api/src/cloud-security/reconciliation.service.ts
@@ -65,12 +65,20 @@ export class CloudReconciliationService {
     }
 
     // Idempotency guard — if reconciliation already wrote rows for this run,
-    // skip silently.
-    const alreadyDone = await db.findingResolution.findFirst({
-      where: { detectedInRunId: currentRun.id },
-      select: { id: true },
-    });
-    if (alreadyDone) {
+    // skip silently. Check BOTH resolutions and regressions: a run that
+    // produced only regressions (no resolutions) would otherwise be
+    // re-reconciled and duplicate the regression rows.
+    const [priorResolution, priorRegression] = await Promise.all([
+      db.findingResolution.findFirst({
+        where: { detectedInRunId: currentRun.id },
+        select: { id: true },
+      }),
+      db.findingRegression.findFirst({
+        where: { detectedInRunId: currentRun.id },
+        select: { id: true },
+      }),
+    ]);
+    if (priorResolution || priorRegression) {
       return { resolutions: 0, regressions: 0, skipped: true };
     }
 
diff --git a/apps/api/src/comments/comments-permission.guard.spec.ts b/apps/api/src/comments/comments-permission.guard.spec.ts
index 99284221b5..533b8887c5 100644
--- a/apps/api/src/comments/comments-permission.guard.spec.ts
+++ b/apps/api/src/comments/comments-permission.guard.spec.ts
@@ -21,6 +21,12 @@ jest.mock('../auth/permission.guard', () => ({
   PERMISSIONS_KEY: 'permissions',
 }));
 
+const resolveServiceByNameMock = jest.fn();
+jest.mock('../auth/service-token.config', () => ({
+  resolveServiceByName: (...args: unknown[]) =>
+    resolveServiceByNameMock(...args),
+}));
+
 jest.mock('../auth/auth.server', () => ({
   auth: { api: { hasPermission: jest.fn() } },
 }));
@@ -158,7 +164,7 @@ describe('CommentsPermissionGuard', () => {
     );
   });
 
-  it('returns true without invoking better-auth for API keys (handled by scope check upstream)', async () => {
+  it('allows API keys whose scopes include the resolved permission', async () => {
     const guard = new CommentsPermissionGuard(
       reflectorWith('task', 'update'),
     );
@@ -168,10 +174,69 @@ describe('CommentsPermissionGuard', () => {
       headers: {},
       isApiKey: true,
     });
+    // Inject explicit scope set on the request — entityType=finding requires
+    // `finding:update`, NOT `task:update`.
+    (context.switchToHttp().getRequest() as { apiKeyScopes: string[] }).apiKeyScopes =
+      ['finding:update'];
     await expect(guard.canActivate(context)).resolves.toBe(true);
     expect(hasPermissionMock).not.toHaveBeenCalled();
   });
 
+  it('rejects API keys whose scopes do not include the resolved permission (no bypass)', async () => {
+    const guard = new CommentsPermissionGuard(
+      reflectorWith('task', 'update'),
+    );
+    const context = makeContext({
+      method: 'POST',
+      body: { entityType: 'finding' },
+      headers: {},
+      isApiKey: true,
+    });
+    (context.switchToHttp().getRequest() as { apiKeyScopes: string[] }).apiKeyScopes =
+      ['task:update']; // wrong scope
+    await expect(guard.canActivate(context)).rejects.toThrow(
+      ForbiddenException,
+    );
+  });
+
+  it('rejects service tokens whose allowlist lacks the resolved permission', async () => {
+    resolveServiceByNameMock.mockReturnValueOnce({
+      permissions: ['task:update'],
+    });
+    const guard = new CommentsPermissionGuard(
+      reflectorWith('task', 'update'),
+    );
+    const context = makeContext({
+      method: 'POST',
+      body: { entityType: 'finding' },
+      headers: {},
+      isServiceToken: true,
+    });
+    (context.switchToHttp().getRequest() as { serviceName: string }).serviceName =
+      'svc-test';
+    await expect(guard.canActivate(context)).rejects.toThrow(
+      ForbiddenException,
+    );
+  });
+
+  it('allows service tokens whose allowlist includes the resolved permission', async () => {
+    resolveServiceByNameMock.mockReturnValueOnce({
+      permissions: ['finding:update'],
+    });
+    const guard = new CommentsPermissionGuard(
+      reflectorWith('task', 'update'),
+    );
+    const context = makeContext({
+      method: 'POST',
+      body: { entityType: 'finding' },
+      headers: {},
+      isServiceToken: true,
+    });
+    (context.switchToHttp().getRequest() as { serviceName: string }).serviceName =
+      'svc-test';
+    await expect(guard.canActivate(context)).resolves.toBe(true);
+  });
+
   it('returns true without invoking better-auth for platform admins', async () => {
     const guard = new CommentsPermissionGuard(
       reflectorWith('task', 'update'),
diff --git a/apps/api/src/comments/comments-permission.guard.ts b/apps/api/src/comments/comments-permission.guard.ts
index 3b6d375649..96da4bb6e6 100644
--- a/apps/api/src/comments/comments-permission.guard.ts
+++ b/apps/api/src/comments/comments-permission.guard.ts
@@ -13,6 +13,7 @@ import {
   PERMISSIONS_KEY,
   type RequiredPermission,
 } from '../auth/permission.guard';
+import { resolveServiceByName } from '../auth/service-token.config';
 import type { AuthenticatedRequest } from '../auth/types';
 
 /**
@@ -62,23 +63,59 @@ export class CommentsPermissionGuard implements CanActivate {
 
     const request = context.switchToHttp().getRequest<GuardedRequest>();
 
-    // API keys and service tokens use the existing fallback behaviour from
-    // the standard PermissionGuard — no entity-type-aware logic needed.
-    // Defer to scope checks against the literal metadata.
-    if (request.isApiKey || request.isServiceToken || request.isPlatformAdmin) {
-      return true;
-    }
+    if (request.isPlatformAdmin) return true;
 
     const fallback = required[0];
     const action = fallback.actions[0];
     const resource = this.resolveEntityResource(request, fallback.resource);
+    const requiredScope = `${resource}:${action}`;
 
-    const permissions: Record<string, string[]> = { [resource]: [action] };
+    // API keys: scope must explicitly include `${resource}:${action}`.
+    // Mirrors PermissionGuard's API-key handling so the dynamic-resource
+    // resolution doesn't accidentally bypass scope enforcement.
+    if (request.isApiKey) {
+      const scopes = request.apiKeyScopes;
+      if (!scopes || scopes.length === 0) {
+        // Legacy keys: same deprecation behavior as the standard guard —
+        // allow until April 20 2026, deny after.
+        const deprecationDate = new Date('2026-04-20T00:00:00Z');
+        if (new Date() >= deprecationDate) {
+          this.logger.warn(
+            `[CommentsPermissionGuard] Legacy API key with empty scopes BLOCKED on ${request.method} ${request.url}.`,
+          );
+          throw new ForbiddenException(
+            'This API key is no longer supported. Please regenerate your API key with explicit scopes.',
+          );
+        }
+        return true;
+      }
+      if (!scopes.includes(requiredScope)) {
+        this.logger.warn(
+          `[CommentsPermissionGuard] API key lacks scope ${requiredScope}`,
+        );
+        throw new ForbiddenException('API key lacks required permission scope');
+      }
+      return true;
+    }
 
+    // Service tokens: same scope check against the token's allowlist.
+    if (request.isServiceToken) {
+      const service = resolveServiceByName(request.serviceName);
+      if (!service) throw new ForbiddenException('Unknown service');
+      if (!service.permissions.includes(requiredScope)) {
+        this.logger.warn(
+          `[CommentsPermissionGuard] Service "${request.serviceName}" lacks ${requiredScope}`,
+        );
+        throw new ForbiddenException('Service token lacks required permission');
+      }
+      return true;
+    }
+
+    const permissions: Record<string, string[]> = { [resource]: [action] };
     const allowed = await this.checkPermission(request, permissions);
     if (!allowed) {
       this.logger.warn(
-        `[CommentsPermissionGuard] Denied ${request.method} ${request.url}. Required: ${resource}:${action}`,
+        `[CommentsPermissionGuard] Denied ${request.method} ${request.url}. Required: ${requiredScope}`,
       );
       throw new ForbiddenException('Access denied');
     }
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.tsx
index 29bc9439c9..4b17162cf2 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/EvidenceJsonViewer.tsx
@@ -65,7 +65,7 @@ export function EvidenceJsonViewer({ evidence }: EvidenceJsonViewerProps) {
       <button
         type="button"
         onClick={handleCopy}
-        className="absolute right-2 top-2 inline-flex items-center gap-1 rounded-md border border-border/50 bg-background/80 px-1.5 py-1 text-[10px] font-medium text-muted-foreground opacity-0 transition-opacity hover:bg-background group-hover:opacity-100"
+        className="absolute right-2 top-2 inline-flex items-center gap-1 rounded-md border border-border/50 bg-background/80 px-1.5 py-1 text-[10px] font-medium text-muted-foreground opacity-0 transition-opacity hover:bg-background group-hover:opacity-100 focus-visible:opacity-100 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-primary/40"
         aria-label="Copy evidence JSON to clipboard"
       >
         {copied ? (
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.tsx
index d5896d26c8..4064147f2b 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/MarkExceptionModal.tsx
@@ -15,6 +15,23 @@ import { toast } from 'sonner';
 
 const MIN_REASON_LENGTH = 20;
 
+/**
+ * Tomorrow's date in the user's LOCAL time zone, formatted as YYYY-MM-DD.
+ *
+ * Avoids the UTC-midnight bug where `new Date().toISOString().slice(0, 10)`
+ * computes the next day in UTC instead of locally — for a user in
+ * UTC-8 picking at 9pm local, the UTC-derived minimum would already be
+ * "tomorrow" UTC and incorrectly block valid local-tomorrow selections.
+ */
+function tomorrowLocalDateString(): string {
+  const tomorrow = new Date();
+  tomorrow.setDate(tomorrow.getDate() + 1);
+  const yyyy = tomorrow.getFullYear();
+  const mm = String(tomorrow.getMonth() + 1).padStart(2, '0');
+  const dd = String(tomorrow.getDate()).padStart(2, '0');
+  return `${yyyy}-${mm}-${dd}`;
+}
+
 export interface MarkExceptionModalProps {
   open: boolean;
   onOpenChange: (open: boolean) => void;
@@ -160,9 +177,7 @@ export function MarkExceptionModal({
               type="date"
               value={expiresAt}
               onChange={(e) => setExpiresAt(e.target.value)}
-              min={new Date(Date.now() + 24 * 60 * 60 * 1000)
-                .toISOString()
-                .slice(0, 10)}
+              min={tomorrowLocalDateString()}
               className="w-full rounded-md border bg-background px-3 py-2 text-xs focus:outline-none focus:ring-2 focus:ring-primary/30"
             />
             <p className="text-muted-foreground mt-1 text-[10px]">
diff --git a/packages/db/prisma/migrations/20260513225000_finding_exception_unique/migration.sql b/packages/db/prisma/migrations/20260513225000_finding_exception_unique/migration.sql
new file mode 100644
index 0000000000..68413d4e7e
--- /dev/null
+++ b/packages/db/prisma/migrations/20260513225000_finding_exception_unique/migration.sql
@@ -0,0 +1,3 @@
+-- CreateIndex
+CREATE UNIQUE INDEX "FindingException_organizationId_connectionId_checkId_resourceId_key"
+  ON "FindingException"("organizationId", "connectionId", "checkId", "resourceId");
diff --git a/packages/db/prisma/schema/finding-history.prisma b/packages/db/prisma/schema/finding-history.prisma
index 9d145329ce..d92927ed75 100644
--- a/packages/db/prisma/schema/finding-history.prisma
+++ b/packages/db/prisma/schema/finding-history.prisma
@@ -37,9 +37,14 @@ model FindingException {
   revokedAt   DateTime?
   revokedById String?
 
+  /// At most one row per (org, connection, check, resource). Re-marking
+  /// after revoke updates the same row (revokedAt cleared, fields refreshed)
+  /// so the audit history lives in AuditLog rather than duplicate FindingException
+  /// rows. Guarantees DB-level dedupe under concurrent mark-as-exception.
+  @@unique([organizationId, connectionId, checkId, resourceId])
+
   @@index([organizationId])
   @@index([connectionId])
-  @@index([checkId, resourceId])
   @@index([expiresAt])
 }
 

From d52294eb67b6c86b57fa83ac6e59bce18d2d6a89 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Wed, 13 May 2026 19:03:05 -0400
Subject: [PATCH 03/15] fix(cloud-tests): legacy result-filter robustness +
 Prisma migration cleanup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two related follow-ups to the cubic review:

1. Legacy result filter (cubic finding #6 — earlier deferred as pre-existing,
   now fixed since the cwd is right here):

   `getLegacyFindings` used `completedAt <= lastRunAt && completedAt >=
   lastRunAt - 10min` to keep only the most-recent scan's IntegrationResult
   rows. This silently hid the newest legacy failures whenever a scan wrote
   results but did NOT advance `Integration.lastRunAt` (a known consistency
   gap on the legacy path).

   Extracted the filter as a pure `filterToLatestScanResults` helper that
   takes the LATER of `lastRunAt` and the per-integration max result
   `completedAt` as the reference point. Robust against either signal
   being stale. Added 8 unit tests (per-integration scoping, fallback when
   lastRunAt is null, window exclusion, mixed-age data, future-date edge).

2. Prisma migration cleanup:

   The previous `finding_exception_unique` migration was created manually
   (via raw SQL file) because `prisma migrate dev` requires a TTY and
   couldn't run from this environment. `prisma migrate diff` flagged two
   small drift issues afterwards:
     - the manual `CREATE UNIQUE INDEX` left an orphan
       `FindingException_checkId_resourceId_idx` (now subsumed by the
       four-column unique key — should be dropped)
     - the index name didn't match what Prisma's @@unique directive
       expects (truncated differently at the 63-char Postgres limit)

   New migration `finding_exception_index_cleanup`:
     - drops the orphan idx
     - renames the unique index to Prisma's expected name
       (`<Model>_<col1>_<col2>..._key`)

   `prisma migrate status` reports the schema is up to date and
   `prisma migrate diff --from-config-datasource ... --to-schema ...`
   returns an empty migration — drift resolved.

Test counts: 113 (was 105 — added 8 legacy-filter tests).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../cloud-security-query.legacy.spec.ts       | 126 ++++++++++++++++++
 .../cloud-security-query.legacy.ts            |  77 +++++++++--
 .../migration.sql                             |  13 ++
 3 files changed, 203 insertions(+), 13 deletions(-)
 create mode 100644 apps/api/src/cloud-security/cloud-security-query.legacy.spec.ts
 create mode 100644 packages/db/prisma/migrations/20260513231500_finding_exception_index_cleanup/migration.sql

diff --git a/apps/api/src/cloud-security/cloud-security-query.legacy.spec.ts b/apps/api/src/cloud-security/cloud-security-query.legacy.spec.ts
new file mode 100644
index 0000000000..e100c811c8
--- /dev/null
+++ b/apps/api/src/cloud-security/cloud-security-query.legacy.spec.ts
@@ -0,0 +1,126 @@
+// Pure-function tests for the legacy-result filter — exercise the
+// missed-lastRunAt-advance recovery path without spinning up Prisma.
+
+// The legacy module imports @db at module load. Mock it (we only need
+// the pure exports here).
+jest.mock('@db', () => ({}));
+jest.mock('./evidence-sanitizer', () => ({
+  sanitizeEvidence: (v: unknown) => v,
+}));
+
+import {
+  filterToLatestScanResults,
+  SCAN_WINDOW_MS,
+} from './cloud-security-query.legacy';
+
+const SCAN_WINDOW_MIN = SCAN_WINDOW_MS / 60_000;
+
+function ms(daysAgo: number, minutesAgoExtra = 0): Date {
+  return new Date(
+    Date.now() - daysAgo * 86_400_000 - minutesAgoExtra * 60_000,
+  );
+}
+
+describe('filterToLatestScanResults', () => {
+  it('includes a result whose completedAt is at lastRunAt', () => {
+    const lastRunAt = ms(0);
+    const result = { integrationId: 'int_1', completedAt: lastRunAt };
+    expect(
+      filterToLatestScanResults([result], new Map([['int_1', lastRunAt]])),
+    ).toEqual([result]);
+  });
+
+  it('keeps results from the latest scan when lastRunAt has NOT advanced — the bug fix', () => {
+    // Scenario: scan ran 5 min ago, wrote IntegrationResult rows with
+    // completedAt=now-5min, but Integration.lastRunAt is still set to its
+    // old value (24h ago). Pre-fix: those new results would be dropped.
+    const oldLastRunAt = ms(1); // 24h ago
+    const newResultTime = ms(0, 5); // 5 minutes ago
+    const result = { integrationId: 'int_1', completedAt: newResultTime };
+    expect(
+      filterToLatestScanResults([result], new Map([['int_1', oldLastRunAt]])),
+    ).toEqual([result]);
+  });
+
+  it('excludes results outside the scan window of the latest signal', () => {
+    const lastRunAt = ms(0);
+    const oldResult = {
+      integrationId: 'int_1',
+      completedAt: ms(0, SCAN_WINDOW_MIN + 5),
+    };
+    expect(
+      filterToLatestScanResults([oldResult], new Map([['int_1', lastRunAt]])),
+    ).toEqual([]);
+  });
+
+  it('uses the max result completedAt as fallback when lastRunAt is missing', () => {
+    const newest = ms(0);
+    const inWindow = { integrationId: 'int_1', completedAt: ms(0, 5) };
+    const tooOld = {
+      integrationId: 'int_1',
+      completedAt: ms(0, SCAN_WINDOW_MIN + 10),
+    };
+    const newestRow = { integrationId: 'int_1', completedAt: newest };
+    expect(
+      filterToLatestScanResults(
+        [tooOld, inWindow, newestRow],
+        new Map(), // empty lastRunMap → fall back to results
+      ),
+    ).toEqual([inWindow, newestRow]);
+  });
+
+  it('handles per-integration scoping correctly (one integration\'s scan window does not leak into another)', () => {
+    const intALastRun = ms(0);
+    const intBLastRun = ms(7); // a week ago — separate cadence
+    const fromA = { integrationId: 'int_A', completedAt: ms(0, 3) };
+    const fromB = { integrationId: 'int_B', completedAt: ms(7, 3) };
+    // A result that's "fresh" for B but way outside A's window:
+    const staleForA = { integrationId: 'int_A', completedAt: ms(7, 3) };
+    const lastRunMap = new Map([
+      ['int_A', intALastRun],
+      ['int_B', intBLastRun],
+    ]);
+    const filtered = filterToLatestScanResults(
+      [fromA, fromB, staleForA],
+      lastRunMap,
+    );
+    expect(filtered).toEqual([fromA, fromB]);
+  });
+
+  it('excludes rows with null completedAt', () => {
+    expect(
+      filterToLatestScanResults(
+        [{ integrationId: 'int_1', completedAt: null }],
+        new Map([['int_1', ms(0)]]),
+      ),
+    ).toEqual([]);
+  });
+
+  it('returns an empty array when neither lastRunAt nor any completedAt is available', () => {
+    expect(
+      filterToLatestScanResults(
+        [{ integrationId: 'int_1', completedAt: null }],
+        new Map(),
+      ),
+    ).toEqual([]);
+  });
+
+  it('does NOT include results whose completedAt is far in the future of the reference', () => {
+    // Sanity: results from a future scan window aren't pulled forward.
+    const lastRunAt = ms(0);
+    const futureResult = {
+      integrationId: 'int_1',
+      completedAt: new Date(Date.now() + 86_400_000), // tomorrow
+    };
+    // The max-fallback would pick the future result as the reference, then
+    // include results within window of THAT future point — and the future
+    // result itself is in that window. We accept this since adversarial
+    // future-dated data is not a realistic scenario for this legacy path.
+    // Just lock in the documented behavior so it doesn't change silently.
+    const out = filterToLatestScanResults(
+      [futureResult],
+      new Map([['int_1', lastRunAt]]),
+    );
+    expect(out).toEqual([futureResult]);
+  });
+});
diff --git a/apps/api/src/cloud-security/cloud-security-query.legacy.ts b/apps/api/src/cloud-security/cloud-security-query.legacy.ts
index e6984cc0c5..c495bd6241 100644
--- a/apps/api/src/cloud-security/cloud-security-query.legacy.ts
+++ b/apps/api/src/cloud-security/cloud-security-query.legacy.ts
@@ -13,7 +13,62 @@ import type { CloudFinding } from './cloud-security-query.types';
 const CLOUD_PROVIDER_SLUGS = ['aws', 'gcp', 'azure'] as const;
 
 /** Scan window for filtering legacy results to latest scan only */
-const SCAN_WINDOW_MS = 10 * 60 * 1000; // 10 minutes
+export const SCAN_WINDOW_MS = 10 * 60 * 1000; // 10 minutes
+
+interface LatestScanResult {
+  integrationId: string;
+  completedAt: Date | null;
+}
+
+/**
+ * Keep only the legacy IntegrationResult rows that belong to each
+ * integration's most-recent scan.
+ *
+ * The naive `completedAt <= lastRunAt` filter silently hides results when
+ * a scan writes IntegrationResult rows but does NOT advance
+ * Integration.lastRunAt (a known consistency gap on the legacy path).
+ *
+ * Robust strategy: per integration, treat the LATER of `lastRunAt` and
+ * the maximum result `completedAt` as the "effective" last-run time, and
+ * keep all results within SCAN_WINDOW_MS of that reference. Falls back
+ * to either signal alone when the other is missing.
+ *
+ * Exported for unit-testing — the function is pure and takes its inputs
+ * explicitly so the test suite doesn't have to mock Prisma.
+ */
+export function filterToLatestScanResults<T extends LatestScanResult>(
+  results: T[],
+  lastRunMap: Map<string, Date>,
+): T[] {
+  // Per-integration maximum result completedAt — the only authoritative
+  // signal that survives a missing-lastRunAt-advance bug.
+  const maxCompletedMsByIntegration = new Map<string, number>();
+  for (const r of results) {
+    if (!r.completedAt) continue;
+    const t = r.completedAt.getTime();
+    const current = maxCompletedMsByIntegration.get(r.integrationId);
+    if (current === undefined || t > current) {
+      maxCompletedMsByIntegration.set(r.integrationId, t);
+    }
+  }
+
+  return results.filter((r) => {
+    if (!r.completedAt) return false;
+    const lastRunMs = lastRunMap.get(r.integrationId)?.getTime();
+    const maxResultMs = maxCompletedMsByIntegration.get(r.integrationId);
+    // Use whichever signal is later — handles both directions of skew.
+    const referenceMs =
+      lastRunMs !== undefined && maxResultMs !== undefined
+        ? Math.max(lastRunMs, maxResultMs)
+        : (lastRunMs ?? maxResultMs);
+    if (referenceMs === undefined) return false;
+    const completedMs = r.completedAt.getTime();
+    return (
+      completedMs <= referenceMs &&
+      completedMs >= referenceMs - SCAN_WINDOW_MS
+    );
+  });
+}
 
 export async function getLegacyFindings(
   organizationId: string,
@@ -52,18 +107,14 @@ export async function getLegacyFindings(
   });
 
   // Only include results from the most recent scan window per integration.
-  const filtered = results.filter((result) => {
-    const lastRunAt = lastRunMap.get(result.integration.id);
-    if (!lastRunAt) return result.completedAt !== null;
-    if (!result.completedAt) return false;
-
-    const lastRunTime = lastRunAt.getTime();
-    const completedTime = result.completedAt.getTime();
-    return (
-      completedTime <= lastRunTime &&
-      completedTime >= lastRunTime - SCAN_WINDOW_MS
-    );
-  });
+  // Uses the LATER of `lastRunAt` and the per-integration max result
+  // completedAt as the reference, so a missed `lastRunAt` advance doesn't
+  // hide the newest legacy failures.
+  const resultsForFilter = results.map((r) => ({
+    ...r,
+    integrationId: r.integration.id,
+  }));
+  const filtered = filterToLatestScanResults(resultsForFilter, lastRunMap);
 
   return filtered.map((result) => ({
     id: result.id,
diff --git a/packages/db/prisma/migrations/20260513231500_finding_exception_index_cleanup/migration.sql b/packages/db/prisma/migrations/20260513231500_finding_exception_index_cleanup/migration.sql
new file mode 100644
index 0000000000..a8e476930c
--- /dev/null
+++ b/packages/db/prisma/migrations/20260513231500_finding_exception_index_cleanup/migration.sql
@@ -0,0 +1,13 @@
+-- Drop the now-redundant non-unique index on (checkId, resourceId).
+-- The unique constraint added by the previous migration already serves as
+-- an index on those columns (as a prefix of the four-column unique key).
+DROP INDEX IF EXISTS "FindingException_checkId_resourceId_idx";
+
+-- Rename the manually-created unique index to match Prisma's naming
+-- convention. Prisma uses `<Model>_<col1>_<col2>..._key`, truncated to
+-- 63 chars (Postgres NAMEDATALEN limit). The previous migration used
+-- `CREATE UNIQUE INDEX` with a longer name that Postgres truncated
+-- differently, leaving the DB out of sync with what `prisma migrate dev`
+-- would generate from the @@unique directive.
+ALTER INDEX "FindingException_organizationId_connectionId_checkId_resourceId"
+  RENAME TO "FindingException_organizationId_connectionId_checkId_resour_key";

From a9b574d90007391f770c412e8b20b8b5d6455e34 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Wed, 13 May 2026 19:12:00 -0400
Subject: [PATCH 04/15] chore(cloud-tests): replace two manual migrations with
 one prisma-generated one
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

You were right — the two manually-written migrations from prior commits
(`finding_exception_unique` + `finding_exception_index_cleanup`) should
be collapsed into a single migration generated the normal way.

What I did:
- Rolled back the worktree DB to the pre-manual state (dropped the
  manual unique index, restored the original `_checkId_resourceId_idx`,
  removed the two migration rows from `_prisma_migrations`)
- Deleted both manual migration directories
- Ran `prisma migrate dev` properly (used `expect(1)` to handle Prisma's
  interactive `Are you sure?` prompt — the CLI refuses to proceed
  non-interactively when adding a unique constraint that could fail on
  pre-existing duplicates)
- Prisma generated `20260513231103_finding_exception_unique` with the
  exact SQL it would normally produce: DROP the now-redundant idx and
  CREATE UNIQUE INDEX with the conventional truncated name

End state: one clean migration instead of two manuals.
`prisma migrate status` → up to date.
`prisma migrate diff --from-config-datasource ... --to-schema ...`
returns `This is an empty migration.` → zero drift.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../migration.sql                                   |  3 ---
 .../migration.sql                                   | 11 +++++++++++
 .../migration.sql                                   | 13 -------------
 3 files changed, 11 insertions(+), 16 deletions(-)
 delete mode 100644 packages/db/prisma/migrations/20260513225000_finding_exception_unique/migration.sql
 create mode 100644 packages/db/prisma/migrations/20260513231103_finding_exception_unique/migration.sql
 delete mode 100644 packages/db/prisma/migrations/20260513231500_finding_exception_index_cleanup/migration.sql

diff --git a/packages/db/prisma/migrations/20260513225000_finding_exception_unique/migration.sql b/packages/db/prisma/migrations/20260513225000_finding_exception_unique/migration.sql
deleted file mode 100644
index 68413d4e7e..0000000000
--- a/packages/db/prisma/migrations/20260513225000_finding_exception_unique/migration.sql
+++ /dev/null
@@ -1,3 +0,0 @@
--- CreateIndex
-CREATE UNIQUE INDEX "FindingException_organizationId_connectionId_checkId_resourceId_key"
-  ON "FindingException"("organizationId", "connectionId", "checkId", "resourceId");
diff --git a/packages/db/prisma/migrations/20260513231103_finding_exception_unique/migration.sql b/packages/db/prisma/migrations/20260513231103_finding_exception_unique/migration.sql
new file mode 100644
index 0000000000..46c61a7588
--- /dev/null
+++ b/packages/db/prisma/migrations/20260513231103_finding_exception_unique/migration.sql
@@ -0,0 +1,11 @@
+/*
+  Warnings:
+
+  - A unique constraint covering the columns `[organizationId,connectionId,checkId,resourceId]` on the table `FindingException` will be added. If there are existing duplicate values, this will fail.
+
+*/
+-- DropIndex
+DROP INDEX "FindingException_checkId_resourceId_idx";
+
+-- CreateIndex
+CREATE UNIQUE INDEX "FindingException_organizationId_connectionId_checkId_resour_key" ON "FindingException"("organizationId", "connectionId", "checkId", "resourceId");
diff --git a/packages/db/prisma/migrations/20260513231500_finding_exception_index_cleanup/migration.sql b/packages/db/prisma/migrations/20260513231500_finding_exception_index_cleanup/migration.sql
deleted file mode 100644
index a8e476930c..0000000000
--- a/packages/db/prisma/migrations/20260513231500_finding_exception_index_cleanup/migration.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- Drop the now-redundant non-unique index on (checkId, resourceId).
--- The unique constraint added by the previous migration already serves as
--- an index on those columns (as a prefix of the four-column unique key).
-DROP INDEX IF EXISTS "FindingException_checkId_resourceId_idx";
-
--- Rename the manually-created unique index to match Prisma's naming
--- convention. Prisma uses `<Model>_<col1>_<col2>..._key`, truncated to
--- 63 chars (Postgres NAMEDATALEN limit). The previous migration used
--- `CREATE UNIQUE INDEX` with a longer name that Postgres truncated
--- differently, leaving the DB out of sync with what `prisma migrate dev`
--- would generate from the @@unique directive.
-ALTER INDEX "FindingException_organizationId_connectionId_checkId_resourceId"
-  RENAME TO "FindingException_organizationId_connectionId_checkId_resour_key";

From 12411c7e64bf94552c5f3d4f896fc5f0ad6d2e86 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Wed, 13 May 2026 19:18:29 -0400
Subject: [PATCH 05/15] fix(cloud-tests): nested arrays in sanitizer + strict
 date-only expiry validation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two more cubic findings, both real:

1. evidence-sanitizer.ts (P1): `redactArray` handled string and object
   elements but not nested arrays — they fell through `return item`
   unchanged. Payloads like `{ secrets: [["s1","s2"], ["s3"]] }` would
   leak the inner strings. Now recursively redacts.

2. exception-expiry parsing (P2): bare `YYYY-MM-DD` strings like
   "2026-02-30" passed straight into `new Date(Date.UTC(2026, 1, 30))`,
   which silently rolled forward to March 2 — an exception meant to
   expire Feb 30 would actually expire days later than the user expected.
   Extracted to `exception-expiry.utils.ts` with strict component
   validation that throws BadRequestException for non-existent calendar
   dates (Feb 30, month 13, day 0, Feb 29 in non-leap years, etc.).

Test counts: 122 (was 113 — added 1 nested-array sanitizer test + 8
expiry tests).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../cloud-security.controller.ts              | 25 +------
 .../cloud-security/evidence-sanitizer.spec.ts | 18 +++++
 .../src/cloud-security/evidence-sanitizer.ts  | 12 +++-
 .../exception-expiry.utils.spec.ts            | 69 +++++++++++++++++++
 .../cloud-security/exception-expiry.utils.ts  | 53 ++++++++++++++
 5 files changed, 150 insertions(+), 27 deletions(-)
 create mode 100644 apps/api/src/cloud-security/exception-expiry.utils.spec.ts
 create mode 100644 apps/api/src/cloud-security/exception-expiry.utils.ts

diff --git a/apps/api/src/cloud-security/cloud-security.controller.ts b/apps/api/src/cloud-security/cloud-security.controller.ts
index 183b237bd3..862b9ec649 100644
--- a/apps/api/src/cloud-security/cloud-security.controller.ts
+++ b/apps/api/src/cloud-security/cloud-security.controller.ts
@@ -27,6 +27,7 @@ import { CloudSecurityLegacyService } from './cloud-security-legacy.service';
 import { CheckDefinitionService } from './check-definition.service';
 import { CloudExceptionService } from './exception.service';
 import { CloudHistoryService } from './history.service';
+import { parseExceptionExpiry } from './exception-expiry.utils';
 import { MarkExceptionDto } from './dto/mark-exception.dto';
 import { logCloudSecurityActivity } from './cloud-security-audit';
 import { CloudSecurityActivityService } from './cloud-security-activity.service';
@@ -969,27 +970,3 @@ export class CloudSecurityController {
     return { success: true };
   }
 }
-
-/**
- * Convert a user-supplied exception expiry into a Date, treating bare
- * date strings ("YYYY-MM-DD") as end-of-day UTC so the exception persists
- * through the user's chosen calendar day in any reasonable time zone.
- *
- * Without this, `new Date("2026-08-13")` is parsed as `2026-08-13T00:00:00Z`,
- * which is the START of Aug 13 UTC — already in the past by late evening
- * Aug 12 in US Pacific, expiring the exception ~8h before the user expected.
- */
-function parseExceptionExpiry(input: string | undefined): Date | null {
-  if (!input) return null;
-  // Bare YYYY-MM-DD → end of that day in UTC (close enough to "end of day
-  // anywhere on Earth" without per-user-TZ tracking).
-  const bareDate = /^(\d{4})-(\d{2})-(\d{2})$/.exec(input);
-  if (bareDate) {
-    const [, y, m, d] = bareDate;
-    return new Date(Date.UTC(+y, +m - 1, +d, 23, 59, 59, 999));
-  }
-  // Full ISO timestamp — trust it as-is.
-  const parsed = new Date(input);
-  if (Number.isNaN(parsed.getTime())) return null;
-  return parsed;
-}
diff --git a/apps/api/src/cloud-security/evidence-sanitizer.spec.ts b/apps/api/src/cloud-security/evidence-sanitizer.spec.ts
index 0e0ab502fd..bf3088e00e 100644
--- a/apps/api/src/cloud-security/evidence-sanitizer.spec.ts
+++ b/apps/api/src/cloud-security/evidence-sanitizer.spec.ts
@@ -206,6 +206,24 @@ describe('evidence-sanitizer', () => {
       });
     });
 
+    it('recursively redacts nested arrays under a sensitive key', () => {
+      // Without recursion, the inner arrays would pass through with their
+      // secret strings intact — a real leak path.
+      expect(
+        sanitizeEvidence({
+          secrets: [
+            ['s1', 's2'],
+            ['s3', { nested: 'x' }],
+          ],
+        }),
+      ).toEqual({
+        secrets: [
+          [REDACTED_VALUE, REDACTED_VALUE],
+          [REDACTED_VALUE, REDACTED_VALUE],
+        ],
+      });
+    });
+
     it('handles a top-level array', () => {
       expect(sanitizeEvidence([{ token: 'a' }, { name: 'b' }])).toEqual([
         { token: REDACTED_VALUE },
diff --git a/apps/api/src/cloud-security/evidence-sanitizer.ts b/apps/api/src/cloud-security/evidence-sanitizer.ts
index 3a88acb658..060719aef6 100644
--- a/apps/api/src/cloud-security/evidence-sanitizer.ts
+++ b/apps/api/src/cloud-security/evidence-sanitizer.ts
@@ -65,14 +65,20 @@ function keyIsSensitive(key: string): boolean {
 }
 
 /**
- * Replace every string element of an array with REDACTED. Arrays under
- * sensitive keys (e.g. `tokens: ["t1","t2"]`, `accessKeys: [{...}]`) need
- * their values scrubbed but their length preserved.
+ * Replace every string / object / nested-array element of an array with
+ * REDACTED. Arrays under sensitive keys (e.g. `tokens: ["t1","t2"]`,
+ * `accessKeys: [{...}]`, or even `secrets: [["a","b"], ["c"]]`) need their
+ * values scrubbed but their length preserved. Booleans and numbers stay
+ * visible to match how the parent record handles them under sensitive
+ * keys.
  */
 function redactArray(value: unknown[]): unknown[] {
   return value.map((item) => {
     if (typeof item === 'string') return REDACTED_VALUE;
     if (isRecord(item)) return REDACTED_VALUE;
+    // Recurse into nested arrays so secrets inside `[[...], [...]]` are
+    // scrubbed too — without this, nested arrays passed through unchanged.
+    if (Array.isArray(item)) return redactArray(item);
     return item;
   });
 }
diff --git a/apps/api/src/cloud-security/exception-expiry.utils.spec.ts b/apps/api/src/cloud-security/exception-expiry.utils.spec.ts
new file mode 100644
index 0000000000..b72abc90da
--- /dev/null
+++ b/apps/api/src/cloud-security/exception-expiry.utils.spec.ts
@@ -0,0 +1,69 @@
+import { BadRequestException } from '@nestjs/common';
+import { parseExceptionExpiry } from './exception-expiry.utils';
+
+describe('parseExceptionExpiry', () => {
+  it('returns null for null/undefined/empty input', () => {
+    expect(parseExceptionExpiry(null)).toBeNull();
+    expect(parseExceptionExpiry(undefined)).toBeNull();
+    expect(parseExceptionExpiry('')).toBeNull();
+  });
+
+  it('expands a bare YYYY-MM-DD to end of that day in UTC', () => {
+    const d = parseExceptionExpiry('2026-08-13');
+    expect(d).toEqual(new Date(Date.UTC(2026, 7, 13, 23, 59, 59, 999)));
+  });
+
+  it('passes through a full ISO timestamp unchanged', () => {
+    const d = parseExceptionExpiry('2026-08-13T14:30:00.000Z');
+    expect(d).toEqual(new Date('2026-08-13T14:30:00.000Z'));
+  });
+
+  it('rejects YYYY-MM-DD with invalid calendar dates (no silent rollover)', () => {
+    // Feb 30 doesn't exist — JavaScript's Date constructor would roll it
+    // forward to March 2. We must reject so the user gets an error instead
+    // of an exception expiring a couple days later than they meant.
+    expect(() => parseExceptionExpiry('2026-02-30')).toThrow(
+      BadRequestException,
+    );
+    // Month 13 also impossible.
+    expect(() => parseExceptionExpiry('2026-13-01')).toThrow(
+      BadRequestException,
+    );
+    // Day 32.
+    expect(() => parseExceptionExpiry('2026-01-32')).toThrow(
+      BadRequestException,
+    );
+    // Day 0.
+    expect(() => parseExceptionExpiry('2026-01-00')).toThrow(
+      BadRequestException,
+    );
+  });
+
+  it('accepts leap-day dates that are valid', () => {
+    // 2024 was a leap year — Feb 29 is real.
+    expect(parseExceptionExpiry('2024-02-29')).toEqual(
+      new Date(Date.UTC(2024, 1, 29, 23, 59, 59, 999)),
+    );
+  });
+
+  it('rejects leap-day dates in non-leap years', () => {
+    // 2026 is NOT a leap year. Feb 29 doesn't exist.
+    expect(() => parseExceptionExpiry('2026-02-29')).toThrow(
+      BadRequestException,
+    );
+  });
+
+  it('rejects truly unparseable strings', () => {
+    expect(() => parseExceptionExpiry('not a date')).toThrow(
+      BadRequestException,
+    );
+    expect(() => parseExceptionExpiry('xyz')).toThrow(BadRequestException);
+  });
+
+  it('accepts non-canonical-but-parseable date forms via the fallback', () => {
+    // Slash-separated form is non-canonical but `new Date()` parses it on
+    // most engines — we don't reject these. Calendar validation only kicks
+    // in for bare `YYYY-MM-DD` (the canonical form the picker emits).
+    expect(parseExceptionExpiry('2026/08/13')).not.toBeNull();
+  });
+});
diff --git a/apps/api/src/cloud-security/exception-expiry.utils.ts b/apps/api/src/cloud-security/exception-expiry.utils.ts
new file mode 100644
index 0000000000..7dc5d1d928
--- /dev/null
+++ b/apps/api/src/cloud-security/exception-expiry.utils.ts
@@ -0,0 +1,53 @@
+import { BadRequestException } from '@nestjs/common';
+
+/**
+ * Convert a user-supplied exception expiry into a Date.
+ *
+ * - `null` / `undefined` / empty string → null (no expiry).
+ * - Bare `YYYY-MM-DD` → end of that calendar day in UTC, so the
+ *   exception persists through the user's chosen calendar day in any
+ *   reasonable time zone. Naive `new Date("2026-08-13")` would parse as
+ *   the START of Aug 13 UTC — already in the past by late evening Aug 12
+ *   in US Pacific, expiring the exception ~8h before the user expected.
+ * - Full ISO timestamp → used as-is.
+ *
+ * Throws BadRequestException for:
+ * - Format that's neither bare-date nor parseable as ISO
+ * - Bare-date with invalid calendar components (e.g. `2026-02-30`)
+ *   — JavaScript's Date constructor silently rolls these over to a later
+ *   day, which would surprise the user.
+ */
+export function parseExceptionExpiry(
+  input: string | null | undefined,
+): Date | null {
+  if (!input) return null;
+
+  const bareDate = /^(\d{4})-(\d{2})-(\d{2})$/.exec(input);
+  if (bareDate) {
+    const [, yStr, mStr, dStr] = bareDate;
+    const y = Number(yStr);
+    const m = Number(mStr);
+    const d = Number(dStr);
+    // Reject impossible calendar dates BEFORE constructing the Date —
+    // otherwise Feb 30 silently becomes Mar 2, etc.
+    const candidate = new Date(Date.UTC(y, m - 1, d));
+    if (
+      candidate.getUTCFullYear() !== y ||
+      candidate.getUTCMonth() !== m - 1 ||
+      candidate.getUTCDate() !== d
+    ) {
+      throw new BadRequestException(
+        'expiresAt must be a valid calendar date.',
+      );
+    }
+    return new Date(Date.UTC(y, m - 1, d, 23, 59, 59, 999));
+  }
+
+  const parsed = new Date(input);
+  if (Number.isNaN(parsed.getTime())) {
+    throw new BadRequestException(
+      'expiresAt must be a valid ISO date or YYYY-MM-DD calendar date.',
+    );
+  }
+  return parsed;
+}

From 01295d71a6854fbb96ff7187cccefb9b9aca2ab8 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 15 May 2026 13:28:06 -0400
Subject: [PATCH 06/15] refactor(cloud-tests): remove redundant last-scan strip
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The strip showed `Ran Xd ago • N checks evaluated • N passed • N failed`
above the three stat cards. The cards already convey the counts, and
the connection-detail line above the tab already shows `Last scan: …`,
so the strip was double-rendering most of its information.

It could also show numbers that didn't match the cards when an org has
multiple connections of the same provider — the strip's `latestRun`
came from this connection's IntegrationCheckRun, while the cards count
findings from `providerSlug === X OR connectionId === Y` (a pre-existing
OR filter in CloudTestsSection that aggregates across provider
siblings). Confusing for users testing multi-connection orgs.

Removes:
- `<LastScanStrip />` render call
- LastScanStrip component and its formatRelativeTime / formatDuration
  helpers (only used by the strip)
- `latestRun` prop on CloudTestsSection + the `latestRun` pass-through
  in ProviderTabs

Keeps the backend `latestRun` field on the providers API response and
the `ProviderLatestRun` type — both are still emitted (cheap, harmless)
in case a future view wants this data without re-plumbing the API.

The only piece of unique info lost is the scan duration (~3.2s style),
which wasn't surfaced anywhere else. If we want it back, a tighter
"Duration X" pill near the Scan button is a follow-up — separate from
the redundancy fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../components/CloudTestsSection.tsx          | 71 +------------------
 .../cloud-tests/components/ProviderTabs.tsx   |  1 -
 2 files changed, 1 insertion(+), 71 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
index 829521d988..107ffc30ea 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
@@ -42,7 +42,7 @@ import { GcpSetupGuide } from './GcpSetupGuide';
 import { RemediationDialog } from './RemediationDialog';
 import { ScheduledScanPopover } from './ScheduledScanPopover';
 
-import type { Finding, ProviderLatestRun } from '../types';
+import type { Finding } from '../types';
 import { CheckDefinitionPanel } from './CheckDefinitionPanel';
 import { CheckGroupBlock } from './CheckGroupBlock';
 import { buildCheckGroups } from './check-groups';
@@ -69,8 +69,6 @@ interface CloudTestsSectionProps {
   orgId: string;
   /** When the last scan completed — null means never scanned */
   lastRunAt?: Date | null;
-  /** Latest scan summary (counts, duration). null for legacy or never-scanned. */
-  latestRun?: ProviderLatestRun | null;
   /** Connection variables (e.g., GCP org ID) */
   variables?: Record<string, unknown>;
   awsType?: string;
@@ -175,7 +173,6 @@ export function CloudTestsSection({
   onScanComplete,
   orgId,
   lastRunAt,
-  latestRun,
   variables,
   awsType,
 }: CloudTestsSectionProps) {
@@ -529,8 +526,6 @@ export function CloudTestsSection({
         </div>
       </div>
 
-      {/* Last scan metadata strip — surfaces what's already in IntegrationCheckRun */}
-      <LastScanStrip latestRun={latestRun ?? null} fallbackLastRunAt={lastRunAt ?? null} />
 
       {/* Selected projects indicator (GCP) */}
       {providerSlug === 'gcp' &&
@@ -1153,70 +1148,6 @@ function StatCard({
   );
 }
 
-function formatRelativeTime(date: Date): string {
-  const diff = Date.now() - date.getTime();
-  const seconds = Math.floor(diff / 1000);
-  if (seconds < 5) return 'just now';
-  if (seconds < 60) return `${seconds}s ago`;
-  const minutes = Math.floor(seconds / 60);
-  if (minutes < 60) return `${minutes}m ago`;
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24) return `${hours}h ago`;
-  const days = Math.floor(hours / 24);
-  if (days === 1) return 'yesterday';
-  if (days < 7) return `${days}d ago`;
-  return date.toLocaleDateString();
-}
-
-function formatDuration(ms: number): string {
-  if (ms < 1000) return `${ms}ms`;
-  const seconds = ms / 1000;
-  if (seconds < 60) return `${seconds.toFixed(1)}s`;
-  const totalSeconds = Math.floor(seconds);
-  const m = Math.floor(totalSeconds / 60);
-  const s = totalSeconds % 60;
-  return s === 0 ? `${m}m` : `${m}m ${s}s`;
-}
-
-function LastScanStrip({
-  latestRun,
-  fallbackLastRunAt,
-}: {
-  latestRun: ProviderLatestRun | null;
-  fallbackLastRunAt: Date | null;
-}) {
-  const completedRaw = latestRun?.completedAt ?? fallbackLastRunAt;
-  if (!completedRaw) return null;
-
-  const completedAt =
-    completedRaw instanceof Date ? completedRaw : new Date(completedRaw);
-  if (Number.isNaN(completedAt.getTime())) return null;
-
-  const parts: string[] = [`Ran ${formatRelativeTime(completedAt)}`];
-
-  if (latestRun) {
-    if (latestRun.totalChecked !== null) {
-      const noun = latestRun.totalChecked === 1 ? 'check' : 'checks';
-      parts.push(`${latestRun.totalChecked} ${noun} evaluated`);
-    }
-    if (latestRun.passedCount !== null) {
-      parts.push(`${latestRun.passedCount} passed`);
-    }
-    if (latestRun.failedCount !== null) {
-      parts.push(`${latestRun.failedCount} failed`);
-    }
-    if (latestRun.durationMs !== null && latestRun.durationMs > 0) {
-      parts.push(`Duration ${formatDuration(latestRun.durationMs)}`);
-    }
-  }
-
-  return (
-    <div className="rounded-md border bg-muted/20 px-3 py-2 text-[11px] text-muted-foreground">
-      {parts.join(' • ')}
-    </div>
-  );
-}
-
 function RemediationSetupDialog({
   open,
   onOpenChange,
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ProviderTabs.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ProviderTabs.tsx
index cb10ab1d93..516da323d1 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ProviderTabs.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/ProviderTabs.tsx
@@ -163,7 +163,6 @@ function CloudConnectionContent({
             connectionId={connection.id}
             orgId={orgId}
             lastRunAt={connection.lastRunAt}
-            latestRun={connection.latestRun ?? null}
             variables={connection.variables ?? undefined}
             awsType={connection.awsType}
             onScanComplete={onScanComplete}

From 80232bc9e966c4b754c650d06fcfa5ed7262543b Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 15 May 2026 13:55:13 -0400
Subject: [PATCH 07/15] refactor(cloud-tests): move "Mark as exception" into
 expanded finding view
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shape mismatch between the primary Fix pill (accent-filled, with
icon) and the Mark-as-exception button (rectangular, outlined) made
every failing row look visually noisy. Worse, both competing for the
same right-side action area pushed the severity badge around.

Marking a finding as an exception is meant to be a DELIBERATE action —
the user must provide a written reason that an auditor will read. So
forcing them to expand the row first (read the title, the description,
the evidence, the remediation) before they can mark it accepted is
actually better auditor-experience UX, not worse.

- Removes the row-level "Mark as exception" button
- Adds it to the bottom of the expanded panel, right-aligned, separated
  by a divider so it reads as a discrete final action
- All the modal wiring stays exactly the same — same canMarkException
  gate (`integration:update` permission), same onMarkException
  callback, same MarkExceptionModal opens

Row right side is now just [Fix] [severity-badge] — clean and
consistent.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../components/CloudTestsSection.tsx          | 31 ++++++++++---------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
index 107ffc30ea..f7d46574a7 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
@@ -1471,21 +1471,6 @@ function FindingRow({
         <span onClick={(e) => e.stopPropagation()} onKeyDown={(e) => e.stopPropagation()}>
           {renderFixButton()}
         </span>
-        {canMarkException &&
-          onMarkException &&
-          (finding.status === 'failed' || finding.status === 'FAILED') && (
-            <button
-              type="button"
-              onClick={(e) => {
-                e.stopPropagation();
-                onMarkException();
-              }}
-              className="shrink-0 inline-flex items-center gap-1 rounded-full border bg-background px-2.5 py-0.5 text-[10px] font-medium text-muted-foreground transition-colors hover:bg-muted"
-              title="Mark this finding as an exception"
-            >
-              Mark as exception
-            </button>
-          )}
         <Badge
           variant="outline"
           className={`shrink-0 w-14 justify-center text-[10px] ${styles.badge}`}
@@ -1511,6 +1496,22 @@ function FindingRow({
               <p className="text-muted-foreground text-xs leading-relaxed">{finding.remediation}</p>
             </div>
           )}
+          {canMarkException &&
+            onMarkException &&
+            (finding.status === 'failed' || finding.status === 'FAILED') && (
+              <div className="flex justify-end border-t pt-3">
+                <button
+                  type="button"
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    onMarkException();
+                  }}
+                  className="rounded-md border bg-background px-3 py-1.5 text-xs font-medium text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
+                >
+                  Mark as exception
+                </button>
+              </div>
+            )}
         </div>
       )}
     </div>

From 11d717fa2b9fdf0797e0845c70482e734ae62e2b Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 15 May 2026 14:13:28 -0400
Subject: [PATCH 08/15] fix(cloud-tests): teach AI fix-plan to describe
 create-from-scratch remediations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For findings like "No CloudTrail trails configured" or "No GuardDuty
detector", the AI fix-plan dialog rendered CURRENT and PROPOSED as
empty {} boxes — the user couldn't see what the fix was about to create.

Root cause: the SYSTEM_PROMPT for fix plans tells the model to populate
currentState/proposedState ONLY with fields from the scan evidence, and
to "show absence as false or null". For mutate-existing-resource
remediations that worked fine. But for create-from-scratch remediations
the evidence has nothing to describe (the resource doesn't exist), so
the model returned `{}` for both — collapsing to an empty diff.

Adds a new "CREATE-FROM-SCRATCH REMEDIATIONS" section to the prompt
that:

- Requires currentState to include `"exists": false` (plus other known
  absence facts) so the user sees that nothing is there today.
- Requires proposedState to describe the resource that WILL be created
  using the same values the model is putting into its fixSteps
  (CreateTrail name, multi-region flag, log validation, bucket name,
  etc.) — concrete, not abstract.
- Explicitly forbids returning empty objects for both. At minimum the
  model must emit `{ exists: false }` / `{ exists: true }` so the
  user sees a readable false→true diff.

No schema change — `currentState`/`proposedState` are already
`z.record(z.string(), z.unknown())`. No UI change either — the existing
StateBlock renders whatever JSON the AI returns. The fix is purely on
the prompt side.

Other findings likely affected by the same pattern (now improved):
"No multi-region CloudTrail", "No AWS Config recorder", "No GuardDuty
detector", "No CloudWatch log group for X", "No S3 bucket configured
as the log target", etc.

Reported by sales via Tofik — empty CURRENT/PROPOSED boxes on the
"No CloudTrail trails configured" Auto-Remediate dialog.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../src/cloud-security/ai-remediation.prompt.ts  | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/apps/api/src/cloud-security/ai-remediation.prompt.ts b/apps/api/src/cloud-security/ai-remediation.prompt.ts
index a471be0eda..1902dd0a23 100644
--- a/apps/api/src/cloud-security/ai-remediation.prompt.ts
+++ b/apps/api/src/cloud-security/ai-remediation.prompt.ts
@@ -277,7 +277,21 @@ A human will ALWAYS review your plan before execution. Be precise and correct.
   - Example: { "versioning": "Enabled" }
   - Example: { "metricFilterExists": true, "filterName": "cis-4.8-s3-bucket-policy-changes", "alarmExists": true, "alarmName": "cis-4.8-s3-bucket-policy-changes" }
 - Both must use the SAME keys so the user can compare side by side
-- Do NOT include fields you don't know the value of`;
+- Do NOT include fields you don't know the value of
+
+## CREATE-FROM-SCRATCH REMEDIATIONS
+Some fixes create a resource that doesn't exist yet — e.g. "No CloudTrail trails configured", "No AWS Config recorder", "No GuardDuty detector", "No S3 bucket for log storage". For these:
+- currentState MUST include "exists: false" so the user sees that nothing is there today.
+  - Add other known-from-evidence absence facts when relevant.
+  - Example: { "exists": false }
+  - Example: { "exists": false, "trailsCount": 0 }
+- proposedState MUST describe the resource that will be created, in concrete terms.
+  - Use the fixSteps you generated as the source of truth — the values you'll pass to CreateTrail / CreateBucket / etc. go here.
+  - Include "exists: true" plus the key configuration the user is being asked to accept.
+  - Example: { "exists": true, "trailName": "compai-cloudtrail", "multiRegion": true, "logFileValidation": true, "s3Bucket": "compai-cloudtrail-logs-<accountId>" }
+  - Example: { "exists": true, "detectorEnabled": true, "findingPublishingFrequency": "FIFTEEN_MINUTES" }
+- Both blocks STILL must share the same keys so the user can see "false → true" diffs at a glance.
+- NEVER leave both currentState and proposedState empty. An empty diff is unreadable for the user — if you cannot describe the resource concretely, at minimum return { "exists": false } / { "exists": true }.`;
 
 export function buildFixPlanPrompt(finding: {
   title: string;

From 8111faf787087bbb967e3ec3fe6a9c897186efbf Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 15 May 2026 15:47:14 -0400
Subject: [PATCH 09/15] fix(cloud-tests): deterministic backstop for empty
 CURRENT/PROPOSED in fix-plan dialog
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous prompt change asked the AI to emit `{ exists: false }` /
`{ exists: true, ... }` for create-from-scratch findings, but the model
doesn't reliably follow it — Tofik still sees `{} → {}` in the
Auto-Remediate Finding dialog for "No CloudTrail trails configured"
even with the new prompt in place.

Server-side backstop: after `generateFixPlan` and `refineFixPlan`
return, if BOTH currentState and proposedState are empty, fill them in
deterministically. `currentState` becomes `{ exists: false }`.
`proposedState` becomes `{ exists: true }` or, when the plan's fixSteps
include any `Create*Command` ops, `{ exists: true, willCreate:
["service:Resource", ...] }` derived from those steps. Never depends on
the model.

Only kicks in when BOTH sides are empty — verify-only plans that
legitimately have one side blank are untouched. Mutate-existing plans
(IAM, S3 versioning, etc.) already have rich state, so they're
untouched too. Risk of regression on the working cases: zero.

Includes ai-remediation.service.spec.ts (4 tests):
- CloudTrail-style with Create* steps → currentState { exists: false },
  proposedState { exists: true, willCreate: ["cloudtrail:Trail",
  "s3:Bucket"] }
- Plan with no Create* steps → proposedState falls back to `{ exists:
  true }` without a willCreate list
- Plan with non-empty currentState → untouched
- Plan with one side empty → untouched (legitimate verify-only)

The prompt change from 11d717fa2 stays in — it's still useful when the
model does follow it (richer output than the backstop). This fix
guarantees a readable diff regardless of model behavior.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../ai-remediation.service.spec.ts            | 144 ++++++++++++++++++
 .../cloud-security/ai-remediation.service.ts  |  48 +++++-
 2 files changed, 189 insertions(+), 3 deletions(-)
 create mode 100644 apps/api/src/cloud-security/ai-remediation.service.spec.ts

diff --git a/apps/api/src/cloud-security/ai-remediation.service.spec.ts b/apps/api/src/cloud-security/ai-remediation.service.spec.ts
new file mode 100644
index 0000000000..748b3e3940
--- /dev/null
+++ b/apps/api/src/cloud-security/ai-remediation.service.spec.ts
@@ -0,0 +1,144 @@
+// Mock @db before importing the service so the Prisma client doesn't try
+// to connect at import time in this unit-test env.
+jest.mock('@db', () => ({}));
+jest.mock('@ai-sdk/anthropic', () => ({
+  anthropic: () => null,
+}));
+jest.mock('ai', () => ({
+  generateObject: jest.fn(),
+}));
+
+import type { FixPlan } from './ai-remediation.prompt';
+import { AiRemediationService } from './ai-remediation.service';
+
+// `enrichEmptyState` isn't exported — exercise it through the service's
+// public methods by mocking generateObject to return a known-empty plan.
+import { generateObject } from 'ai';
+
+function basePlan(overrides: Partial<FixPlan> = {}): FixPlan {
+  return {
+    canAutoFix: true,
+    risk: 'low',
+    description: 'desc',
+    currentState: {},
+    proposedState: {},
+    requiredPermissions: [],
+    readSteps: [],
+    fixSteps: [],
+    rollbackSteps: [],
+    rollbackSupported: false,
+    requiresAcknowledgment: false,
+    ...overrides,
+  } as FixPlan;
+}
+
+describe('AiRemediationService.generateFixPlan empty-state backstop', () => {
+  const generateObjectMock = generateObject as unknown as jest.Mock;
+
+  beforeEach(() => {
+    generateObjectMock.mockReset();
+  });
+
+  it('fills empty state with { exists: false } / { exists: true } when AI returns both empty', async () => {
+    generateObjectMock.mockResolvedValueOnce({
+      object: basePlan({
+        fixSteps: [
+          { service: 'cloudtrail', command: 'CreateTrailCommand', params: {} },
+          { service: 's3', command: 'CreateBucketCommand', params: {} },
+          { service: 'cloudtrail', command: 'StartLoggingCommand', params: {} },
+        ],
+      }),
+    });
+
+    const service = new AiRemediationService();
+    const plan = await service.generateFixPlan({
+      title: 'No CloudTrail trails configured',
+      description: 'No CloudTrail trails exist.',
+      severity: 'critical',
+      resourceType: 'AwsAccount',
+      resourceId: 'account-level',
+      remediation: 'Create a multi-region trail.',
+      findingKey: 'cloudtrail-no-trails',
+      evidence: { awsAccountId: '123', service: 'CloudTrail' },
+    });
+
+    expect(plan.currentState).toEqual({ exists: false });
+    expect(plan.proposedState).toEqual({
+      exists: true,
+      willCreate: ['cloudtrail:Trail', 's3:Bucket'],
+    });
+  });
+
+  it('falls back to { exists: true } without willCreate when no Create* steps are present', async () => {
+    generateObjectMock.mockResolvedValueOnce({
+      object: basePlan({
+        fixSteps: [
+          { service: 'iam', command: 'UpdateAccountPasswordPolicyCommand', params: {} },
+        ],
+      }),
+    });
+
+    const service = new AiRemediationService();
+    const plan = await service.generateFixPlan({
+      title: 'Weak password policy',
+      description: null,
+      severity: null,
+      resourceType: 'AwsIamPolicy',
+      resourceId: 'account-level',
+      remediation: null,
+      findingKey: 'iam-weak-password',
+      evidence: {},
+    });
+
+    expect(plan.currentState).toEqual({ exists: false });
+    expect(plan.proposedState).toEqual({ exists: true });
+  });
+
+  it('leaves a plan untouched when currentState is non-empty', async () => {
+    generateObjectMock.mockResolvedValueOnce({
+      object: basePlan({
+        currentState: { versioning: 'Disabled' },
+        proposedState: { versioning: 'Enabled' },
+      }),
+    });
+
+    const service = new AiRemediationService();
+    const plan = await service.generateFixPlan({
+      title: 'S3 versioning disabled',
+      description: null,
+      severity: null,
+      resourceType: 'S3Bucket',
+      resourceId: 'logs-archive',
+      remediation: null,
+      findingKey: 's3-versioning-disabled',
+      evidence: {},
+    });
+
+    expect(plan.currentState).toEqual({ versioning: 'Disabled' });
+    expect(plan.proposedState).toEqual({ versioning: 'Enabled' });
+  });
+
+  it('leaves a plan alone when only one side is empty (legitimate verify-only case)', async () => {
+    generateObjectMock.mockResolvedValueOnce({
+      object: basePlan({
+        currentState: { someField: 'X' },
+        proposedState: {},
+      }),
+    });
+
+    const service = new AiRemediationService();
+    const plan = await service.generateFixPlan({
+      title: 't',
+      description: null,
+      severity: null,
+      resourceType: 'X',
+      resourceId: 'y',
+      remediation: null,
+      findingKey: 'fk',
+      evidence: {},
+    });
+
+    expect(plan.currentState).toEqual({ someField: 'X' });
+    expect(plan.proposedState).toEqual({});
+  });
+});
diff --git a/apps/api/src/cloud-security/ai-remediation.service.ts b/apps/api/src/cloud-security/ai-remediation.service.ts
index b3549e06ff..775b4592ff 100644
--- a/apps/api/src/cloud-security/ai-remediation.service.ts
+++ b/apps/api/src/cloud-security/ai-remediation.service.ts
@@ -57,7 +57,7 @@ export class AiRemediationService {
       this.logger.log(
         `AI plan for ${finding.findingKey}: canAutoFix=${object.canAutoFix}, risk=${object.risk}`,
       );
-      return object;
+      return enrichEmptyState(object);
     } catch (err) {
       this.logger.error(
         `AI plan failed: ${err instanceof Error ? err.message : String(err)}`,
@@ -99,13 +99,13 @@ Generate the complete fix plan with EXACT values from the real AWS state.`,
       });
 
       this.logger.log(`AI refined plan for ${params.finding.findingKey}`);
-      return object;
+      return enrichEmptyState(object);
     } catch (err) {
       this.logger.error(
         `AI refine failed: ${err instanceof Error ? err.message : String(err)}`,
       );
       // Fall back to original plan
-      return params.originalPlan;
+      return enrichEmptyState(params.originalPlan);
     }
   }
 
@@ -444,3 +444,45 @@ Generate the complete fix plan with EXACT values from the real Azure state.`,
     };
   }
 }
+
+/**
+ * Deterministic backstop: if the AI returns BOTH currentState and
+ * proposedState as empty (which is what was rendering as `{} → {}` in the
+ * Auto-Remediate dialog for "No CloudTrail trails configured" and similar
+ * create-from-scratch findings), fill in a basic `{ exists: false }` →
+ * `{ exists: true, willCreate: [...] }` derived from the plan's Create*
+ * fix steps. Guarantees the user sees a meaningful diff regardless of
+ * model behavior.
+ *
+ * Only kicks in when BOTH states are empty — verify-only plans that
+ * legitimately have one side blank are untouched.
+ */
+function enrichEmptyState(plan: FixPlan): FixPlan {
+  const currentEmpty = isEmptyState(plan.currentState);
+  const proposedEmpty = isEmptyState(plan.proposedState);
+  if (!currentEmpty || !proposedEmpty) return plan;
+
+  const willCreate: string[] = [];
+  for (const step of plan.fixSteps ?? []) {
+    const command = typeof step?.command === 'string' ? step.command : '';
+    if (!command.startsWith('Create')) continue;
+    const resource = command.replace(/Command$/, '').replace(/^Create/, '');
+    const label = step.service ? `${step.service}:${resource}` : resource;
+    if (!willCreate.includes(label)) willCreate.push(label);
+  }
+
+  return {
+    ...plan,
+    currentState: { exists: false },
+    proposedState:
+      willCreate.length > 0
+        ? { exists: true, willCreate }
+        : { exists: true },
+  };
+}
+
+function isEmptyState(
+  state: Record<string, unknown> | null | undefined,
+): boolean {
+  return !state || Object.keys(state).length === 0;
+}

From 9faf03637cb1ec4f30f2c371fc8bd3cb533c2028 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 15 May 2026 17:01:18 -0400
Subject: [PATCH 10/15] fix(cloud-tests): differentiate check-definition fields
 + structured remediation rendering

GCP/Azure passthrough was using the SCC `description` for both
"description" and "fail criteria", causing the same paragraph to
appear under multiple labels in the expanded finding view. Each of
the four fields (description, passCriteria, failCriteria,
whyItMatters) now derives a distinct sentence from the machine-
readable category code.

Remediation was rendered as a single paragraph that included the
reference URL and compliance metadata inline. A new
`parseRemediation` helper splits the API-concatenated string back
into `{ steps, referenceUrl, compliance[] }`, and a new
`RemediationSection` component renders steps as readable text, the
reference as a link, and frameworks as chips.

Also tightened the visual hierarchy of the expanded view so the
"about this check" card, the per-account failure, the evidence
viewer, and the remediation card each have a distinct treatment
instead of looking like five identical white boxes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 ...ck-definition-provider-passthrough.spec.ts | 140 ++++++++++++++++++
 .../check-definition-provider-passthrough.ts  |  36 ++---
 .../components/CloudTestsSection.tsx          |  16 +-
 .../cloud-tests/components/FindingsTable.tsx  |  23 +--
 .../components/RemediationSection.tsx         |  90 +++++++++++
 .../components/remediation-parser.test.ts     | 127 ++++++++++++++++
 .../components/remediation-parser.ts          | 110 ++++++++++++++
 7 files changed, 495 insertions(+), 47 deletions(-)
 create mode 100644 apps/api/src/cloud-security/check-definition-provider-passthrough.spec.ts
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/RemediationSection.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.test.ts
 create mode 100644 apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.ts

diff --git a/apps/api/src/cloud-security/check-definition-provider-passthrough.spec.ts b/apps/api/src/cloud-security/check-definition-provider-passthrough.spec.ts
new file mode 100644
index 0000000000..48f6645e3d
--- /dev/null
+++ b/apps/api/src/cloud-security/check-definition-provider-passthrough.spec.ts
@@ -0,0 +1,140 @@
+import { buildProviderPassthroughDescription } from './check-definition-provider-passthrough';
+
+describe('buildProviderPassthroughDescription', () => {
+  describe('GCP', () => {
+    it('produces four distinct sentences for the four check-definition fields', () => {
+      const result = buildProviderPassthroughDescription({
+        provider: 'gcp',
+        title: 'Public IP Address',
+        description:
+          'A Compute Engine instance has a public IP address attached.',
+        evidence: {
+          category: 'PUBLIC_IP_ADDRESS',
+          findingClass: 'VULNERABILITY',
+        },
+      });
+
+      expect(result).not.toBeNull();
+      // Each of the four fields must read differently — auditors should
+      // never see the same paragraph repeated under different labels.
+      const fields = [
+        result!.description,
+        result!.passCriteria,
+        result!.failCriteria,
+        result!.whyItMatters,
+      ];
+      const uniqueFields = new Set(fields);
+      expect(uniqueFields.size).toBe(4);
+    });
+
+    it('derives content from the machine-readable category, not the per-finding description', () => {
+      const description =
+        'A Compute Engine instance has a public IP address attached.';
+      const result = buildProviderPassthroughDescription({
+        provider: 'gcp',
+        title: 'Public IP Address',
+        description,
+        evidence: {
+          category: 'PUBLIC_IP_ADDRESS',
+          findingClass: 'VULNERABILITY',
+        },
+      });
+
+      // The four header fields must NOT contain the per-finding description
+      // verbatim — that text belongs to "This account's result", not the
+      // generic check definition.
+      expect(result!.description).not.toContain(description);
+      expect(result!.failCriteria).not.toContain(description);
+
+      // But the humanized category must appear so the reader knows what
+      // SCC is checking for.
+      expect(result!.description).toContain('Public Ip Address');
+      expect(result!.passCriteria).toContain('Public Ip Address');
+      expect(result!.failCriteria).toContain('Public Ip Address');
+    });
+
+    it('returns null when evidence is missing', () => {
+      const result = buildProviderPassthroughDescription({
+        provider: 'gcp',
+        title: 't',
+        description: 'd',
+        evidence: null,
+      });
+      expect(result).toBeNull();
+    });
+
+    it('returns null when category is missing from evidence', () => {
+      const result = buildProviderPassthroughDescription({
+        provider: 'gcp',
+        title: 't',
+        description: 'd',
+        evidence: { findingClass: 'VULNERABILITY' },
+      });
+      expect(result).toBeNull();
+    });
+
+    it('uses a generic whyItMatters when findingClass is missing', () => {
+      const result = buildProviderPassthroughDescription({
+        provider: 'gcp',
+        title: 't',
+        description: 'd',
+        evidence: { category: 'WEAK_PASSWORD_POLICY' },
+      });
+      expect(result!.whyItMatters).toBeTruthy();
+      expect(result!.whyItMatters).toContain('Weak Password Policy');
+    });
+  });
+
+  describe('Azure', () => {
+    it('produces four distinct sentences for the four check-definition fields', () => {
+      const result = buildProviderPassthroughDescription({
+        provider: 'azure',
+        title: 'Storage account allows public access',
+        description: 'The storage account allows anonymous read access.',
+        evidence: { alertType: 'Anonymous_Blob_Access' },
+      });
+
+      expect(result).not.toBeNull();
+      const fields = [
+        result!.description,
+        result!.passCriteria,
+        result!.failCriteria,
+        result!.whyItMatters,
+      ];
+      expect(new Set(fields).size).toBe(4);
+    });
+
+    it('handles Azure findings without alertType by falling back to serviceName', () => {
+      const result = buildProviderPassthroughDescription({
+        provider: 'azure',
+        title: 't',
+        description: 'd',
+        evidence: { serviceName: 'Defender for Storage' },
+      });
+      expect(result).not.toBeNull();
+      expect(result!.description).toContain('Defender for Storage');
+    });
+
+    it('produces a description even when evidence is null (Defender baseline)', () => {
+      const result = buildProviderPassthroughDescription({
+        provider: 'azure',
+        title: 't',
+        description: 'd',
+        evidence: null,
+      });
+      expect(result).not.toBeNull();
+      // Generic Defender phrasing — no alertType available.
+      expect(result!.description).toContain('Microsoft Defender for Cloud');
+    });
+  });
+
+  it('returns null for unknown provider', () => {
+    const result = buildProviderPassthroughDescription({
+      provider: 'aws',
+      title: 't',
+      description: 'd',
+      evidence: {},
+    });
+    expect(result).toBeNull();
+  });
+});
diff --git a/apps/api/src/cloud-security/check-definition-provider-passthrough.ts b/apps/api/src/cloud-security/check-definition-provider-passthrough.ts
index 1aadc588ed..a91b99eae8 100644
--- a/apps/api/src/cloud-security/check-definition-provider-passthrough.ts
+++ b/apps/api/src/cloud-security/check-definition-provider-passthrough.ts
@@ -37,18 +37,21 @@ function fromGcpEvidence(
       : null;
   if (!category) return null;
 
+  const humanCategory = humanizeCategory(category);
+
+  // Each of the four fields needs a genuinely different sentence — auditors
+  // shouldn't see the same paragraph three times under different labels.
+  // Derived from the category code (stable, machine-readable), not from
+  // SCC's per-finding `description` (which is generic category info that
+  // duplicates across fields when used naively).
   return {
     title: input.title,
-    description: input.description ?? humanizeCategory(category),
-    passCriteria: `No ${category
-      .toLowerCase()
-      .replace(/_/g, ' ')} detected by Google Security Command Center.`,
-    failCriteria: input.description
-      ? input.description
-      : `Google Security Command Center flagged this resource under category ${category}.`,
+    description: `This check surfaces findings from Google Security Command Center under the "${humanCategory}" detector. SCC continuously evaluates your projects against Google's security baseline and flags resources matching the ${category} pattern.`,
+    passCriteria: `Google Security Command Center reports no active "${humanCategory}" findings for this project.`,
+    failCriteria: `Google Security Command Center detected a resource matching the "${humanCategory}" criteria in this project.`,
     whyItMatters: findingClass
-      ? `Google classifies this finding as a "${findingClass}" — addressing it reduces the underlying security risk Google identified.`
-      : 'Findings from Google Security Command Center indicate a security concern Google detected in the customer environment.',
+      ? `Google classifies this finding as a ${findingClass.toLowerCase()} — addressing it reduces the underlying security risk Google identified for the ${humanCategory} category.`
+      : `Findings under the ${humanCategory} category indicate a security concern Google detected in the customer environment.`,
     source: 'provider',
   };
 }
@@ -63,18 +66,15 @@ function fromAzureEvidence(
         ? (input.evidence.serviceName as string)
         : null;
 
+  const subject = alertType ?? 'this configuration';
+
   return {
     title: input.title,
-    description:
-      input.description ??
-      'Surfaced from Microsoft Defender for Cloud. Defender flagged this resource as not meeting its recommended secure configuration.',
-    passCriteria:
-      'Microsoft Defender for Cloud reports the resource as healthy.',
-    failCriteria: input.description
-      ? input.description
-      : 'Microsoft Defender for Cloud reports the resource as unhealthy.',
+    description: `This check surfaces findings from Microsoft Defender for Cloud${alertType ? ` under the "${alertType}" assessment` : ''}. Defender continuously evaluates the subscription against Microsoft's secure-configuration baseline and flags resources that diverge from the recommended state.`,
+    passCriteria: `Microsoft Defender for Cloud reports ${subject} as healthy on this subscription.`,
+    failCriteria: `Microsoft Defender for Cloud reports ${subject} as unhealthy on this resource.`,
     whyItMatters: alertType
-      ? `Defender raised this finding under "${alertType}" — addressing it brings the resource in line with Microsoft\'s recommended configuration.`
+      ? `Defender raised this finding under "${alertType}" — addressing it brings the resource in line with Microsoft's recommended configuration.`
       : 'Defender for Cloud findings indicate a deviation from Microsoft-recommended secure configuration in the customer environment.',
     source: 'provider',
   };
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
index f7d46574a7..c1fb3e2c05 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
@@ -48,6 +48,7 @@ import { CheckGroupBlock } from './CheckGroupBlock';
 import { buildCheckGroups } from './check-groups';
 import { EvidenceJsonViewer } from './EvidenceJsonViewer';
 import { MarkExceptionModal } from './MarkExceptionModal';
+import { RemediationSection } from './RemediationSection';
 
 interface RemediationCapabilities {
   enabled: boolean;
@@ -1482,20 +1483,17 @@ function FindingRow({
         <div className="space-y-3 border-t bg-muted/20 px-12 py-4 text-sm">
           <CheckDefinitionPanel findingId={finding.id} />
           {finding.description && (
-            <div className="rounded-md border bg-background p-3">
-              <p className="mb-1 text-xs font-medium">This account&apos;s result</p>
-              <p className="text-muted-foreground text-xs leading-relaxed">
+            <div className="rounded-md border-l-2 border-l-destructive/40 border-y border-r bg-background">
+              <div className="border-b px-3 py-2">
+                <h4 className="text-xs font-medium">This account&apos;s result</h4>
+              </div>
+              <p className="text-muted-foreground px-3 py-2.5 text-xs leading-relaxed">
                 {finding.description}
               </p>
             </div>
           )}
           <EvidenceSection evidence={finding.evidence} />
-          {finding.remediation && (
-            <div className="rounded-md border bg-background p-3">
-              <p className="mb-1 text-xs font-medium">Remediation</p>
-              <p className="text-muted-foreground text-xs leading-relaxed">{finding.remediation}</p>
-            </div>
-          )}
+          {finding.remediation && <RemediationSection remediation={finding.remediation} />}
           {canMarkException &&
             onMarkException &&
             (finding.status === 'failed' || finding.status === 'FAILED') && (
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/FindingsTable.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/FindingsTable.tsx
index 85fae82e3b..1050c5093e 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/FindingsTable.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/FindingsTable.tsx
@@ -13,6 +13,8 @@ import {
 import { ChevronDown, ChevronRight } from 'lucide-react';
 import { Fragment, useState } from 'react';
 
+import { RemediationSection } from './RemediationSection';
+
 interface Finding {
   id: string;
   title: string | null;
@@ -127,26 +129,7 @@ export function FindingsTable({ findings }: FindingsTableProps) {
                         </div>
                       )}
                       {finding.remediation && (
-                        <div>
-                          <h4 className="mb-2 font-semibold">Remediation</h4>
-                          <div className="text-muted-foreground text-sm">
-                            {finding.remediation.split(/\b(https?:\/\/\S+)\b/).map((part, i) => {
-                              return /^https?:\/\/\S+$/.test(part) ? (
-                                <a
-                                  key={i}
-                                  href={part}
-                                  target="_blank"
-                                  rel="noopener noreferrer"
-                                  className="text-primary hover:underline"
-                                >
-                                  {part}
-                                </a>
-                              ) : (
-                                <span key={i}>{part}</span>
-                              );
-                            })}
-                          </div>
-                        </div>
+                        <RemediationSection remediation={finding.remediation} />
                       )}
                     </div>
                   </TableCell>
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/RemediationSection.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/RemediationSection.tsx
new file mode 100644
index 0000000000..2cfec0bb04
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/RemediationSection.tsx
@@ -0,0 +1,90 @@
+'use client';
+
+import { ExternalLink, Wrench } from 'lucide-react';
+
+import { parseRemediation } from './remediation-parser';
+
+interface RemediationSectionProps {
+  remediation: string;
+}
+
+/**
+ * Renders a finding's remediation guidance as structured pieces:
+ *   - the actual fix steps as readable text
+ *   - an optional "Reference" link to the provider's documentation
+ *   - compliance framework chips
+ *
+ * For GCP findings the API concatenates these into a single string;
+ * `parseRemediation` splits them back apart. AWS / Azure remediations
+ * render as plain step text with no metadata chips.
+ */
+export function RemediationSection({ remediation }: RemediationSectionProps) {
+  const parsed = parseRemediation(remediation);
+  if (!parsed.steps && !parsed.referenceUrl && parsed.compliance.length === 0) {
+    return null;
+  }
+
+  return (
+    <div className="rounded-md border border-primary/15 bg-primary/[0.02]">
+      <div className="flex items-center gap-1.5 border-b border-primary/10 px-3 py-2">
+        <Wrench className="h-3 w-3 text-primary/70" />
+        <h4 className="text-xs font-medium">Remediation</h4>
+      </div>
+      <div className="space-y-2.5 px-3 py-3 text-xs">
+        {parsed.steps && (
+          <p className="text-foreground/80 leading-relaxed whitespace-pre-line">
+            {parsed.steps}
+          </p>
+        )}
+        {parsed.referenceUrl && (
+          <a
+            href={parsed.referenceUrl}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="inline-flex items-center gap-1 text-primary hover:underline"
+          >
+            <ExternalLink className="h-3 w-3" />
+            Reference documentation
+          </a>
+        )}
+        {parsed.compliance.length > 0 && (
+          <div>
+            <p className="mb-1 text-[10px] uppercase tracking-wide text-muted-foreground">
+              Compliance
+            </p>
+            <div className="flex flex-wrap gap-1">
+              {parsed.compliance.map((framework, idx) => (
+                <ComplianceChip key={`${framework.standard}-${idx}`} framework={framework} />
+              ))}
+            </div>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}
+
+function ComplianceChip({
+  framework,
+}: {
+  framework: {
+    standard: string;
+    version: string | null;
+    ids: string[];
+  };
+}) {
+  const label = framework.version
+    ? `${framework.standard.toUpperCase()} ${framework.version}`
+    : framework.standard.toUpperCase();
+  const detail = framework.ids.join(', ');
+
+  return (
+    <span
+      className="inline-flex items-center gap-1 rounded border bg-background px-1.5 py-0.5 text-[10px]"
+      title={detail || undefined}
+    >
+      <span className="font-medium text-foreground/80">{label}</span>
+      {detail && <span className="text-muted-foreground">{detail}</span>}
+    </span>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.test.ts b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.test.ts
new file mode 100644
index 0000000000..5ffa9f2c7a
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.test.ts
@@ -0,0 +1,127 @@
+import { describe, expect, it } from 'vitest';
+import { parseRemediation } from './remediation-parser';
+
+describe('parseRemediation', () => {
+  it('parses a full GCP remediation with nextSteps + reference + compliance', () => {
+    const input =
+      'Set the appropriate value for the enableNetworkPolicy field. See https://cloud.google.com/docs.\n\n' +
+      'More info: https://cloud.google.com/security-command-center/docs/cluster\n\n' +
+      'Compliance: cis 1.0 (5.6.7); pci 3.2.1 (1.2.1, 1.3.1); nist 800-53 (SC-7)';
+
+    const parsed = parseRemediation(input);
+
+    expect(parsed.steps).toBe(
+      'Set the appropriate value for the enableNetworkPolicy field. See https://cloud.google.com/docs.',
+    );
+    expect(parsed.referenceUrl).toBe(
+      'https://cloud.google.com/security-command-center/docs/cluster',
+    );
+    expect(parsed.compliance).toEqual([
+      { standard: 'cis', version: '1.0', ids: ['5.6.7'] },
+      { standard: 'pci', version: '3.2.1', ids: ['1.2.1', '1.3.1'] },
+      { standard: 'nist', version: '800-53', ids: ['SC-7'] },
+    ]);
+  });
+
+  it('returns AWS-style remediation (single paragraph) verbatim as steps', () => {
+    const input =
+      "Use s3:PutBucketEncryptionCommand with Bucket set to 'my-bucket' " +
+      "and ServerSideEncryptionConfiguration containing SSEAlgorithm 'AES256'.";
+
+    const parsed = parseRemediation(input);
+
+    expect(parsed.steps).toBe(input);
+    expect(parsed.referenceUrl).toBeNull();
+    expect(parsed.compliance).toEqual([]);
+  });
+
+  it('handles GCP findings that have only nextSteps (no reference, no compliance)', () => {
+    const input = 'Review the IAM policy and remove primitive role grants.';
+
+    const parsed = parseRemediation(input);
+
+    expect(parsed.steps).toBe(input);
+    expect(parsed.referenceUrl).toBeNull();
+    expect(parsed.compliance).toEqual([]);
+  });
+
+  it('handles a reference URL without compliance section', () => {
+    const input =
+      'Enable Cloud Audit Logs for the project.\n\n' +
+      'More info: https://cloud.google.com/audit-logs';
+
+    const parsed = parseRemediation(input);
+
+    expect(parsed.steps).toBe('Enable Cloud Audit Logs for the project.');
+    expect(parsed.referenceUrl).toBe('https://cloud.google.com/audit-logs');
+    expect(parsed.compliance).toEqual([]);
+  });
+
+  it('handles compliance frameworks with multiple IDs each', () => {
+    const input =
+      'Fix the issue.\n\nCompliance: cis 1.0 (1.1, 1.2, 1.3); pci 3.2.1 (2.1.1, 2.2.2)';
+
+    const parsed = parseRemediation(input);
+
+    expect(parsed.steps).toBe('Fix the issue.');
+    expect(parsed.compliance).toEqual([
+      { standard: 'cis', version: '1.0', ids: ['1.1', '1.2', '1.3'] },
+      { standard: 'pci', version: '3.2.1', ids: ['2.1.1', '2.2.2'] },
+    ]);
+  });
+
+  it('keeps multi-paragraph steps intact when no metadata sections are present', () => {
+    const input = 'First do this.\n\nThen do that.\n\nFinally verify.';
+
+    const parsed = parseRemediation(input);
+
+    expect(parsed.steps).toBe(input);
+    expect(parsed.referenceUrl).toBeNull();
+    expect(parsed.compliance).toEqual([]);
+  });
+
+  it('handles malformed compliance entries by surfacing the raw label', () => {
+    const input = 'Fix it.\n\nCompliance: weird-format-no-parens; cis 1.0 (5.1)';
+
+    const parsed = parseRemediation(input);
+
+    expect(parsed.compliance).toEqual([
+      { standard: 'weird-format-no-parens', version: null, ids: [] },
+      { standard: 'cis', version: '1.0', ids: ['5.1'] },
+    ]);
+  });
+
+  it('ignores empty "More info: " line so the UI does not render a broken link', () => {
+    const input = 'Do something.\n\nMore info: ';
+
+    const parsed = parseRemediation(input);
+
+    expect(parsed.steps).toBe('Do something.');
+    expect(parsed.referenceUrl).toBeNull();
+  });
+
+  it('preserves Azure remediation steps joined by newlines', () => {
+    // Azure remediation steps come as `array.join('\n')`, not '\n\n'.
+    const input =
+      '1. Open Microsoft Defender for Cloud.\n2. Click Resolve.\n3. Apply the recommended fix.';
+
+    const parsed = parseRemediation(input);
+
+    expect(parsed.steps).toBe(input);
+    expect(parsed.referenceUrl).toBeNull();
+    expect(parsed.compliance).toEqual([]);
+  });
+
+  it('trims whitespace around sections without losing content', () => {
+    const input =
+      '  Steps text.   \n\n  More info: https://example.com  \n\n  Compliance: cis 1.0 (1.1)  ';
+
+    const parsed = parseRemediation(input);
+
+    expect(parsed.steps).toBe('Steps text.');
+    expect(parsed.referenceUrl).toBe('https://example.com');
+    expect(parsed.compliance).toEqual([
+      { standard: 'cis', version: '1.0', ids: ['1.1'] },
+    ]);
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.ts b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.ts
new file mode 100644
index 0000000000..9a2687317f
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.ts
@@ -0,0 +1,110 @@
+/**
+ * GCP findings produce a remediation string with embedded sections —
+ * a "More info: <url>" line and a "Compliance: <frameworks>" line are
+ * appended to the raw SCC `nextSteps` text by the API. Rendering that
+ * concatenated string verbatim looks like a wall of metadata. This
+ * parser splits the string back into structured pieces so the UI can
+ * present steps, reference link, and compliance frameworks distinctly.
+ *
+ * AWS / Azure remediations have no embedded sections — the parser
+ * returns the input verbatim as `steps` with empty/null metadata.
+ */
+
+export interface ComplianceFramework {
+  standard: string;
+  version: string | null;
+  ids: string[];
+}
+
+export interface ParsedRemediation {
+  steps: string;
+  referenceUrl: string | null;
+  compliance: ComplianceFramework[];
+}
+
+// Use prefixes without trailing whitespace so we match even after the
+// section has been trimmed (an empty URL renders as "More info:" with
+// no trailing space).
+const COMPLIANCE_PREFIX = 'Compliance:';
+const REFERENCE_PREFIX = 'More info:';
+
+/**
+ * Parses a remediation string built by the API into structured pieces.
+ *
+ * Input shape (GCP):
+ *   "<nextSteps>\n\nMore info: <url>\n\nCompliance: cis 1.0 (5.6.7); pci 3.2.1 (1.2.1)"
+ * The sections are appended in fixed order by `GCPSecurityService.buildRemediation`.
+ * Either section is optional (older findings may omit one).
+ */
+export function parseRemediation(input: string): ParsedRemediation {
+  const sections = input.split('\n\n').map((s) => s.trim());
+
+  const stepLines: string[] = [];
+  let referenceUrl: string | null = null;
+  let complianceLine: string | null = null;
+
+  for (const section of sections) {
+    if (section.startsWith(REFERENCE_PREFIX)) {
+      const candidate = section.slice(REFERENCE_PREFIX.length).trim();
+      if (candidate.length > 0) {
+        referenceUrl = candidate;
+      }
+      continue;
+    }
+    if (section.startsWith(COMPLIANCE_PREFIX)) {
+      complianceLine = section.slice(COMPLIANCE_PREFIX.length).trim();
+      continue;
+    }
+    if (section.length > 0) {
+      stepLines.push(section);
+    }
+  }
+
+  return {
+    steps: stepLines.join('\n\n'),
+    referenceUrl,
+    compliance: complianceLine ? parseComplianceLine(complianceLine) : [],
+  };
+}
+
+/**
+ * Parses a line like:
+ *   "cis 1.0 (5.6.7); pci 3.2.1 (1.2.1, 1.3.1); nist 800-53 (SC-7)"
+ *
+ * The format mirrors the join performed in
+ * `GCPSecurityService.buildRemediation`:
+ *   parts.push(`Compliance: ${standards.join('; ')}`)
+ *   where each `standard` = `${c.standard} ${c.version} (${c.ids.join(', ')})`.
+ *
+ * Falls back gracefully on unexpected input — a malformed entry becomes
+ * a framework with only `standard` populated, never throws.
+ */
+function parseComplianceLine(line: string): ComplianceFramework[] {
+  const entries = line.split(/;\s*/).filter((p) => p.length > 0);
+  const frameworks: ComplianceFramework[] = [];
+
+  for (const entry of entries) {
+    const match = entry.match(/^(.+?)\s+(\S+?)\s*\(([^)]+)\)\s*$/);
+    if (match) {
+      const [, standard, version, idsRaw] = match;
+      frameworks.push({
+        standard: standard.trim(),
+        version: version.trim(),
+        ids: idsRaw
+          .split(/,\s*/)
+          .map((s) => s.trim())
+          .filter((s) => s.length > 0),
+      });
+      continue;
+    }
+    // No version/ids in parens — surface the raw label so we don't drop
+    // a compliance reference we don't fully understand.
+    frameworks.push({
+      standard: entry.trim(),
+      version: null,
+      ids: [],
+    });
+  }
+
+  return frameworks;
+}

From 79bfb0f328ad41ec4f30c442a7a35aadeb0d6e00 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 15 May 2026 17:15:15 -0400
Subject: [PATCH 11/15] fix(cloud-tests): address cubic review on
 RemediationSection and enrichEmptyState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P1 — RemediationSection now validates the reference URL scheme before
assigning it to an href. `parseRemediation` extracts the URL from
provider-supplied text (today: SCC's externalUri); a new `safeHttpUrl`
helper only honors http(s) URLs and rejects javascript:, data:, vbscript:,
file:, and protocol-relative URLs. The link is hidden when validation
fails so we never render an unsafe href.

P2 — enrichEmptyState was firing for every {}/{} plan, including
update-style remediations (e.g. UpdateAccountPasswordPolicyCommand),
fabricating `currentState: { exists: false } → proposedState: { exists: true }`
which told the UI "we'll create this resource" when the truth was
"we'll update the existing one". The backstop now only enriches when
at least one `Create*` command is present in fixSteps. Update-style
plans are left untouched.

Tests:
- 10 new safeHttpUrl tests (parser test file)
- Updated the existing backstop test that asserted the wrong behavior
- Added `purpose` to fix-step test data to satisfy the strict schema

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../ai-remediation.service.spec.ts            | 19 ++++---
 .../cloud-security/ai-remediation.service.ts  | 12 +++--
 .../components/RemediationSection.tsx         | 10 ++--
 .../components/remediation-parser.test.ts     | 50 ++++++++++++++++++-
 .../components/remediation-parser.ts          | 22 ++++++++
 5 files changed, 97 insertions(+), 16 deletions(-)

diff --git a/apps/api/src/cloud-security/ai-remediation.service.spec.ts b/apps/api/src/cloud-security/ai-remediation.service.spec.ts
index 748b3e3940..f4c821b3eb 100644
--- a/apps/api/src/cloud-security/ai-remediation.service.spec.ts
+++ b/apps/api/src/cloud-security/ai-remediation.service.spec.ts
@@ -43,9 +43,9 @@ describe('AiRemediationService.generateFixPlan empty-state backstop', () => {
     generateObjectMock.mockResolvedValueOnce({
       object: basePlan({
         fixSteps: [
-          { service: 'cloudtrail', command: 'CreateTrailCommand', params: {} },
-          { service: 's3', command: 'CreateBucketCommand', params: {} },
-          { service: 'cloudtrail', command: 'StartLoggingCommand', params: {} },
+          { service: 'cloudtrail', command: 'CreateTrailCommand', params: {}, purpose: 'Create trail' },
+          { service: 's3', command: 'CreateBucketCommand', params: {}, purpose: 'Create bucket' },
+          { service: 'cloudtrail', command: 'StartLoggingCommand', params: {}, purpose: 'Start logging' },
         ],
       }),
     });
@@ -69,11 +69,16 @@ describe('AiRemediationService.generateFixPlan empty-state backstop', () => {
     });
   });
 
-  it('falls back to { exists: true } without willCreate when no Create* steps are present', async () => {
+  it('leaves both states empty when AI returns {}/{} for an update-style plan (no Create* commands)', async () => {
+    // Previously this test asserted the backstop fabricated
+    // `{ exists: false }` / `{ exists: true }` even for updates, which
+    // misrepresented the diff in the UI ("we'll create it" when the truth
+    // was "we'll update the existing one"). The backstop now only fires
+    // when at least one `Create*` command is present.
     generateObjectMock.mockResolvedValueOnce({
       object: basePlan({
         fixSteps: [
-          { service: 'iam', command: 'UpdateAccountPasswordPolicyCommand', params: {} },
+          { service: 'iam', command: 'UpdateAccountPasswordPolicyCommand', params: {}, purpose: 'Update password policy' },
         ],
       }),
     });
@@ -90,8 +95,8 @@ describe('AiRemediationService.generateFixPlan empty-state backstop', () => {
       evidence: {},
     });
 
-    expect(plan.currentState).toEqual({ exists: false });
-    expect(plan.proposedState).toEqual({ exists: true });
+    expect(plan.currentState).toEqual({});
+    expect(plan.proposedState).toEqual({});
   });
 
   it('leaves a plan untouched when currentState is non-empty', async () => {
diff --git a/apps/api/src/cloud-security/ai-remediation.service.ts b/apps/api/src/cloud-security/ai-remediation.service.ts
index 775b4592ff..be81aa9424 100644
--- a/apps/api/src/cloud-security/ai-remediation.service.ts
+++ b/apps/api/src/cloud-security/ai-remediation.service.ts
@@ -471,13 +471,17 @@ function enrichEmptyState(plan: FixPlan): FixPlan {
     if (!willCreate.includes(label)) willCreate.push(label);
   }
 
+  // Only enrich when we have actual `Create*` commands — otherwise we'd
+  // fabricate "exists: false → exists: true" for updates/reads (e.g.
+  // UpdateAccountPasswordPolicy), which misrepresents the diff in the UI.
+  // For non-create remediations we leave the AI's (admittedly empty) output
+  // alone rather than inventing state.
+  if (willCreate.length === 0) return plan;
+
   return {
     ...plan,
     currentState: { exists: false },
-    proposedState:
-      willCreate.length > 0
-        ? { exists: true, willCreate }
-        : { exists: true },
+    proposedState: { exists: true, willCreate },
   };
 }
 
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/RemediationSection.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/RemediationSection.tsx
index 2cfec0bb04..7e9e64c6b9 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/RemediationSection.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/RemediationSection.tsx
@@ -2,7 +2,7 @@
 
 import { ExternalLink, Wrench } from 'lucide-react';
 
-import { parseRemediation } from './remediation-parser';
+import { parseRemediation, safeHttpUrl } from './remediation-parser';
 
 interface RemediationSectionProps {
   remediation: string;
@@ -20,7 +20,9 @@ interface RemediationSectionProps {
  */
 export function RemediationSection({ remediation }: RemediationSectionProps) {
   const parsed = parseRemediation(remediation);
-  if (!parsed.steps && !parsed.referenceUrl && parsed.compliance.length === 0) {
+  // Only honor `http(s)` schemes — never assign `javascript:` / `data:` to href.
+  const safeReferenceUrl = safeHttpUrl(parsed.referenceUrl);
+  if (!parsed.steps && !safeReferenceUrl && parsed.compliance.length === 0) {
     return null;
   }
 
@@ -36,9 +38,9 @@ export function RemediationSection({ remediation }: RemediationSectionProps) {
             {parsed.steps}
           </p>
         )}
-        {parsed.referenceUrl && (
+        {safeReferenceUrl && (
           <a
-            href={parsed.referenceUrl}
+            href={safeReferenceUrl}
             target="_blank"
             rel="noopener noreferrer"
             className="inline-flex items-center gap-1 text-primary hover:underline"
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.test.ts b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.test.ts
index 5ffa9f2c7a..2649618864 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.test.ts
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { parseRemediation } from './remediation-parser';
+import { parseRemediation, safeHttpUrl } from './remediation-parser';
 
 describe('parseRemediation', () => {
   it('parses a full GCP remediation with nextSteps + reference + compliance', () => {
@@ -125,3 +125,51 @@ describe('parseRemediation', () => {
     ]);
   });
 });
+
+describe('safeHttpUrl', () => {
+  it('returns http URLs unchanged', () => {
+    expect(safeHttpUrl('http://example.com/path')).toBe('http://example.com/path');
+  });
+
+  it('returns https URLs unchanged', () => {
+    expect(safeHttpUrl('https://cloud.google.com/docs')).toBe(
+      'https://cloud.google.com/docs',
+    );
+  });
+
+  it('rejects javascript: URLs', () => {
+    expect(safeHttpUrl('javascript:alert(1)')).toBeNull();
+  });
+
+  it('rejects data: URLs', () => {
+    expect(safeHttpUrl('data:text/html,<script>alert(1)</script>')).toBeNull();
+  });
+
+  it('rejects vbscript: URLs', () => {
+    expect(safeHttpUrl('vbscript:msgbox(1)')).toBeNull();
+  });
+
+  it('rejects file: URLs', () => {
+    expect(safeHttpUrl('file:///etc/passwd')).toBeNull();
+  });
+
+  it('rejects relative URLs (no protocol)', () => {
+    expect(safeHttpUrl('//evil.example/path')).toBeNull();
+    expect(safeHttpUrl('/relative/path')).toBeNull();
+  });
+
+  it('rejects malformed URLs', () => {
+    expect(safeHttpUrl('not a url at all')).toBeNull();
+    expect(safeHttpUrl('')).toBeNull();
+  });
+
+  it('rejects null input', () => {
+    expect(safeHttpUrl(null)).toBeNull();
+  });
+
+  it('case-insensitively rejects upper-case JAVASCRIPT:', () => {
+    // `new URL` normalizes the protocol to lowercase, so we still match the
+    // safe-list correctly even if attacker uses unusual casing.
+    expect(safeHttpUrl('JavaScript:alert(1)')).toBeNull();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.ts b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.ts
index 9a2687317f..cf466feeb0 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.ts
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/remediation-parser.ts
@@ -22,6 +22,28 @@ export interface ParsedRemediation {
   compliance: ComplianceFramework[];
 }
 
+/**
+ * Returns the URL only if it parses as an absolute http/https URL.
+ * Returns `null` for `javascript:`, `data:`, `vbscript:`, relative URLs,
+ * or anything malformed — so callers can safely assign the result to an
+ * `href` attribute without enabling script-URL execution.
+ *
+ * Today's source for remediation URLs is Google SCC's `externalUri`
+ * field, but the parser is generic — defense in depth applies.
+ */
+export function safeHttpUrl(url: string | null): string | null {
+  if (!url) return null;
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
+      return parsed.toString();
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 // Use prefixes without trailing whitespace so we match even after the
 // section has been trimmed (an empty URL renders as "More info:" with
 // no trailing space).

From 0e193c2ff5b187496554a38d20268edd92b4bab4 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 15 May 2026 17:45:01 -0400
Subject: [PATCH 12/15] fix(cloud-tests): address cubic round 4 findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Eight real issues from cubic's review on 79bfb0f32. Two findings about
Jest hoisting (exception/reconciliation specs) skipped — those are
babel-jest's rule but the project uses ts-jest, where the pattern works
and all 145 tests currently pass.

P3 — "All passed" badge unreachable
  CloudTestsSection.tsx used `group.findings.length > 0` for hasFailures,
  but `findings` is the merged failed+passed set, so groups with only
  passing checks were never recognized. Use `group.failed > 0` instead.

P2 — Dangling FK on FindingRegression.previousResolutionId
  Schema documented it as an FK but didn't declare a relation. Added
  `@relation(..., onDelete: SetNull)` plus a back-relation on
  FindingResolution.regressions, with a Prisma-generated migration that
  adds the constraint.

P2 — DTO accepted whitespace-only exception reasons
  @MinLength(20) counts spaces. Added @Matches(/(?:\\S.*?){20}/s) so
  twenty literal spaces no longer satisfy the contract.

P2 — Placeholder leak in fix-plan prompt
  CREATE-FROM-SCRATCH example used `<accountId>` while the prompt
  forbids placeholders. Replaced with a concrete account ID + region
  pair so the model has a clean reference.

P2 — exception-expiry fallback was too permissive
  `new Date(input)` accepted locale-specific strings like
  "January 1, 2026" and "2026/08/13", bypassing the documented
  ISO 8601 contract. Added a strict ISO 8601 regex check ahead of the
  Date constructor; spec updated to assert the new strict behavior.

P2 — History tab silently truncated rows
  Service capped resolutions/exceptions/regressions at 200/100 with no
  totals. Now returns true counts from separate `count()` queries plus
  a `truncated` flag per category; HistoryTab renders "shown of total"
  when truncation is active so auditors don't see misleading numbers.

P2 — CommentsPermissionGuard missing try/catch around checkPermission
  Standard PermissionGuard wraps the call so network/auth-service
  failures convert to ForbiddenException('Unable to verify permissions')
  rather than leaking 500s. Mirrored that here.

P2 — platform_fix attribution scope too broad
  Reconciliation looked up RemediationActions by connection + resource
  alone, so a fix for check A on a resource was mis-attributed to
  check B on the same resource. Plumbed `priorCheckResultId` through
  indexResults → determineResolutionMethod and now filter by the
  specific `checkResultId` instead. Spec updated to populate `id` on
  test results.

Test counts: 145 API tests + 20 parser tests pass; the single failing
suite (remediation.controller.spec.ts) is the pre-existing Postgres
TLS environmental issue, unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../cloud-security/ai-remediation.prompt.ts   |  2 +-
 .../cloud-security/dto/mark-exception.dto.ts  |  9 +-
 .../exception-expiry.utils.spec.ts            | 24 ++++-
 .../cloud-security/exception-expiry.utils.ts  | 10 ++
 .../api/src/cloud-security/history.service.ts | 94 +++++++++++++------
 .../reconciliation.service.spec.ts            |  3 +
 .../cloud-security/reconciliation.service.ts  | 16 +++-
 .../src/comments/comments-permission.guard.ts | 23 +++--
 .../components/CloudTestsSection.tsx          | 10 +-
 .../cloud-tests/components/HistoryTab.tsx     | 31 +++++-
 .../migration.sql                             |  2 +
 .../db/prisma/schema/finding-history.prisma   |  6 ++
 12 files changed, 179 insertions(+), 51 deletions(-)
 create mode 100644 packages/db/prisma/migrations/20260515214156_finding_regression_resolution_fk/migration.sql

diff --git a/apps/api/src/cloud-security/ai-remediation.prompt.ts b/apps/api/src/cloud-security/ai-remediation.prompt.ts
index 1902dd0a23..d4bd3d1eaf 100644
--- a/apps/api/src/cloud-security/ai-remediation.prompt.ts
+++ b/apps/api/src/cloud-security/ai-remediation.prompt.ts
@@ -288,7 +288,7 @@ Some fixes create a resource that doesn't exist yet — e.g. "No CloudTrail trai
 - proposedState MUST describe the resource that will be created, in concrete terms.
   - Use the fixSteps you generated as the source of truth — the values you'll pass to CreateTrail / CreateBucket / etc. go here.
   - Include "exists: true" plus the key configuration the user is being asked to accept.
-  - Example: { "exists": true, "trailName": "compai-cloudtrail", "multiRegion": true, "logFileValidation": true, "s3Bucket": "compai-cloudtrail-logs-<accountId>" }
+  - Example: { "exists": true, "trailName": "compai-cloudtrail", "multiRegion": true, "logFileValidation": true, "s3Bucket": "compai-cloudtrail-logs-013388577167-us-east-1" } — use the concrete AWS account ID and region from evidence, never a placeholder
   - Example: { "exists": true, "detectorEnabled": true, "findingPublishingFrequency": "FIFTEEN_MINUTES" }
 - Both blocks STILL must share the same keys so the user can see "false → true" diffs at a glance.
 - NEVER leave both currentState and proposedState empty. An empty diff is unreadable for the user — if you cannot describe the resource concretely, at minimum return { "exists": false } / { "exists": true }.`;
diff --git a/apps/api/src/cloud-security/dto/mark-exception.dto.ts b/apps/api/src/cloud-security/dto/mark-exception.dto.ts
index 8b7bdbfd90..3cf47ebfd3 100644
--- a/apps/api/src/cloud-security/dto/mark-exception.dto.ts
+++ b/apps/api/src/cloud-security/dto/mark-exception.dto.ts
@@ -1,13 +1,18 @@
 import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
-import { IsDateString, IsOptional, IsString, MinLength } from 'class-validator';
+import { IsDateString, IsOptional, IsString, Matches, MinLength } from 'class-validator';
 
 export class MarkExceptionDto {
   @ApiProperty({
-    description: 'Documentation for why this finding does not apply or is being accepted. Minimum 20 characters.',
+    description: 'Documentation for why this finding does not apply or is being accepted. Minimum 20 non-whitespace characters.',
     example: 'Bucket hosts intentionally public marketing assets; writes restricted to the marketing IAM role.',
   })
   @IsString()
   @MinLength(20, { message: 'Reason must be at least 20 characters.' })
+  // @MinLength alone counts whitespace, so 20 spaces would pass. Require
+  // at least 20 non-whitespace characters anywhere in the string.
+  @Matches(/(?:\S.*?){20}/s, {
+    message: 'Reason must contain at least 20 non-whitespace characters.',
+  })
   reason!: string;
 
   @ApiPropertyOptional({
diff --git a/apps/api/src/cloud-security/exception-expiry.utils.spec.ts b/apps/api/src/cloud-security/exception-expiry.utils.spec.ts
index b72abc90da..0de0204322 100644
--- a/apps/api/src/cloud-security/exception-expiry.utils.spec.ts
+++ b/apps/api/src/cloud-security/exception-expiry.utils.spec.ts
@@ -60,10 +60,24 @@ describe('parseExceptionExpiry', () => {
     expect(() => parseExceptionExpiry('xyz')).toThrow(BadRequestException);
   });
 
-  it('accepts non-canonical-but-parseable date forms via the fallback', () => {
-    // Slash-separated form is non-canonical but `new Date()` parses it on
-    // most engines — we don't reject these. Calendar validation only kicks
-    // in for bare `YYYY-MM-DD` (the canonical form the picker emits).
-    expect(parseExceptionExpiry('2026/08/13')).not.toBeNull();
+  it('rejects non-ISO date forms even when `new Date()` would parse them', () => {
+    // Defense in depth — the documented contract is "YYYY-MM-DD" OR strict
+    // ISO 8601. Locale-specific forms (slash-separated, "January 1, 2026")
+    // are parseable by JS Date but outside the contract, so we reject them.
+    expect(() => parseExceptionExpiry('2026/08/13')).toThrow(
+      BadRequestException,
+    );
+    expect(() => parseExceptionExpiry('January 1, 2026')).toThrow(
+      BadRequestException,
+    );
+    expect(() => parseExceptionExpiry('Aug 13, 2026')).toThrow(
+      BadRequestException,
+    );
+  });
+
+  it('accepts strict ISO 8601 timestamps via the fallback', () => {
+    expect(parseExceptionExpiry('2026-08-13T23:59:59Z')).not.toBeNull();
+    expect(parseExceptionExpiry('2026-08-13T23:59:59.999Z')).not.toBeNull();
+    expect(parseExceptionExpiry('2026-08-13T23:59:59+02:00')).not.toBeNull();
   });
 });
diff --git a/apps/api/src/cloud-security/exception-expiry.utils.ts b/apps/api/src/cloud-security/exception-expiry.utils.ts
index 7dc5d1d928..d3d9334dbb 100644
--- a/apps/api/src/cloud-security/exception-expiry.utils.ts
+++ b/apps/api/src/cloud-security/exception-expiry.utils.ts
@@ -43,6 +43,16 @@ export function parseExceptionExpiry(
     return new Date(Date.UTC(y, m - 1, d, 23, 59, 59, 999));
   }
 
+  // Reject anything that isn't strict ISO 8601 — `new Date()` happily parses
+  // locale-specific strings like "January 1, 2026" and "2026/08/13", which
+  // would silently bypass the documented contract.
+  const ISO_8601 =
+    /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?(\.\d+)?(Z|[+-]\d{2}:?\d{2})?$/;
+  if (!ISO_8601.test(input)) {
+    throw new BadRequestException(
+      'expiresAt must be a valid ISO date or YYYY-MM-DD calendar date.',
+    );
+  }
   const parsed = new Date(input);
   if (Number.isNaN(parsed.getTime())) {
     throw new BadRequestException(
diff --git a/apps/api/src/cloud-security/history.service.ts b/apps/api/src/cloud-security/history.service.ts
index 1a27060c56..10748d5ed4 100644
--- a/apps/api/src/cloud-security/history.service.ts
+++ b/apps/api/src/cloud-security/history.service.ts
@@ -11,56 +11,90 @@ export class CloudHistoryService {
     organizationId: string;
     connectionId: string;
   }) {
-    const [resolutions, exceptions, regressions] = await Promise.all([
+    // Cap rows returned to keep payload bounded; pull true totals from
+    // separate count queries so the UI can show "showing 200 of 432"
+    // instead of pretending the truncated set is the full picture.
+    const resolutionsWhere = {
+      organizationId: params.organizationId,
+      connectionId: params.connectionId,
+    };
+    const exceptionsWhere = {
+      organizationId: params.organizationId,
+      connectionId: params.connectionId,
+      revokedAt: null,
+      OR: [
+        { expiresAt: null },
+        { expiresAt: { gt: new Date() } },
+      ] as Array<{ expiresAt: null } | { expiresAt: { gt: Date } }>,
+    };
+    const regressionsWhere = {
+      organizationId: params.organizationId,
+      connectionId: params.connectionId,
+    };
+
+    const [
+      resolutions,
+      resolutionsTotal,
+      exceptions,
+      exceptionsTotal,
+      regressions,
+      regressionsTotal,
+      platformFixes,
+      externalFixes,
+      resourceDeleted,
+      exceptionMarked,
+    ] = await Promise.all([
       db.findingResolution.findMany({
-        where: {
-          organizationId: params.organizationId,
-          connectionId: params.connectionId,
-        },
+        where: resolutionsWhere,
         orderBy: { resolvedAt: 'desc' },
         take: 200,
       }),
+      db.findingResolution.count({ where: resolutionsWhere }),
       db.findingException.findMany({
-        where: {
-          organizationId: params.organizationId,
-          connectionId: params.connectionId,
-          revokedAt: null,
-          OR: [{ expiresAt: null }, { expiresAt: { gt: new Date() } }],
-        },
+        where: exceptionsWhere,
         orderBy: { markedAt: 'desc' },
         take: 100,
       }),
+      db.findingException.count({ where: exceptionsWhere }),
       db.findingRegression.findMany({
-        where: {
-          organizationId: params.organizationId,
-          connectionId: params.connectionId,
-        },
+        where: regressionsWhere,
         orderBy: { regressedAt: 'desc' },
         take: 100,
       }),
+      db.findingRegression.count({ where: regressionsWhere }),
+      db.findingResolution.count({
+        where: { ...resolutionsWhere, resolutionMethod: 'platform_fix' },
+      }),
+      db.findingResolution.count({
+        where: { ...resolutionsWhere, resolutionMethod: 'external_fix' },
+      }),
+      db.findingResolution.count({
+        where: { ...resolutionsWhere, resolutionMethod: 'resource_deleted' },
+      }),
+      db.findingResolution.count({
+        where: { ...resolutionsWhere, resolutionMethod: 'exception_marked' },
+      }),
     ]);
 
     return {
       summary: {
-        resolutions: resolutions.length,
-        platformFixes: resolutions.filter(
-          (r) => r.resolutionMethod === 'platform_fix',
-        ).length,
-        externalFixes: resolutions.filter(
-          (r) => r.resolutionMethod === 'external_fix',
-        ).length,
-        resourceDeleted: resolutions.filter(
-          (r) => r.resolutionMethod === 'resource_deleted',
-        ).length,
-        exceptionMarked: resolutions.filter(
-          (r) => r.resolutionMethod === 'exception_marked',
-        ).length,
-        activeExceptions: exceptions.length,
-        regressions: regressions.length,
+        resolutions: resolutionsTotal,
+        platformFixes,
+        externalFixes,
+        resourceDeleted,
+        exceptionMarked,
+        activeExceptions: exceptionsTotal,
+        regressions: regressionsTotal,
       },
       resolutions,
       exceptions,
       regressions,
+      // Lets the UI surface "Showing 200 of 432" when truncation is active.
+      truncated: {
+        resolutions: resolutionsTotal > resolutions.length,
+        exceptions: exceptionsTotal > exceptions.length,
+        regressions: regressionsTotal > regressions.length,
+      },
     };
   }
 }
diff --git a/apps/api/src/cloud-security/reconciliation.service.spec.ts b/apps/api/src/cloud-security/reconciliation.service.spec.ts
index a63c6fab28..75c91616e6 100644
--- a/apps/api/src/cloud-security/reconciliation.service.spec.ts
+++ b/apps/api/src/cloud-security/reconciliation.service.spec.ts
@@ -44,14 +44,17 @@ function makeExceptionsStub(active = false): CloudExceptionService {
 const PRIOR_RUN_TIME = new Date('2026-05-01T00:00:00Z');
 const CURRENT_RUN_TIME = new Date('2026-05-13T00:00:00Z');
 
+let resultIdCounter = 0;
 function makeResult(opts: {
   findingKey: string;
   resourceId: string;
   passed: boolean;
   resourceType?: string;
   serviceId?: string;
+  id?: string;
 }) {
   return {
+    id: opts.id ?? `icrr_${++resultIdCounter}`,
     passed: opts.passed,
     resourceId: opts.resourceId,
     resourceType: opts.resourceType ?? 'AwsIamUser',
diff --git a/apps/api/src/cloud-security/reconciliation.service.ts b/apps/api/src/cloud-security/reconciliation.service.ts
index bf3d81d7dc..342ef86532 100644
--- a/apps/api/src/cloud-security/reconciliation.service.ts
+++ b/apps/api/src/cloud-security/reconciliation.service.ts
@@ -4,6 +4,7 @@ import { normalizeCheckId } from './check-definition.utils';
 import { CloudExceptionService } from './exception.service';
 
 interface NormalizedResult {
+  id: string;
   findingKey: string;
   resourceId: string;
   resourceType: string | null;
@@ -49,6 +50,7 @@ export class CloudReconciliationService {
         connection: { select: { organizationId: true } },
         results: {
           select: {
+            id: true,
             passed: true,
             resourceId: true,
             resourceType: true,
@@ -95,6 +97,7 @@ export class CloudReconciliationService {
         completedAt: true,
         results: {
           select: {
+            id: true,
             passed: true,
             resourceId: true,
             resourceType: true,
@@ -143,6 +146,10 @@ export class CloudReconciliationService {
         checkKey,
         resourceId: prior.resourceId,
         currentExists: Boolean(current),
+        // Scope the platform_fix lookup to THIS specific check — without it,
+        // an unrelated fix on the same resource gets mis-attributed as
+        // having resolved this check.
+        priorCheckResultId: prior.id,
       });
 
       const daysOpen =
@@ -225,6 +232,7 @@ export class CloudReconciliationService {
     checkKey: string;
     resourceId: string;
     currentExists: boolean;
+    priorCheckResultId: string;
   }): Promise<{
     method: FindingResolutionMethod;
     resolvedById?: string;
@@ -240,11 +248,15 @@ export class CloudReconciliationService {
     if (exceptionActive) return { method: 'exception_marked' };
 
     // 2) Did our Fix button apply a successful remediation between scans?
+    //    Scope by `checkResultId` so a fix for check A on resource X doesn't
+    //    get attributed to check B on the same resource. RemediationAction
+    //    is created with the prior run's checkResultId, so matching against
+    //    `prior.id` ties the fix to THIS check, not any check on the resource.
     if (input.priorRunCompletedAt) {
       const fix = await db.remediationAction.findFirst({
         where: {
           connectionId: input.connectionId,
-          resourceId: input.resourceId,
+          checkResultId: input.priorCheckResultId,
           status: 'success',
           createdAt: {
             gte: input.priorRunCompletedAt,
@@ -273,6 +285,7 @@ export class CloudReconciliationService {
 
 function indexResults(
   results: Array<{
+    id: string;
     passed: boolean;
     resourceId: string | null;
     resourceType: string | null;
@@ -298,6 +311,7 @@ function indexResults(
     const checkKey = normalizeCheckId(findingKey, r.resourceId);
     const compositeKey = `${checkKey}::${r.resourceId}`;
     map.set(compositeKey, {
+      id: r.id,
       findingKey,
       resourceId: r.resourceId,
       resourceType: r.resourceType,
diff --git a/apps/api/src/comments/comments-permission.guard.ts b/apps/api/src/comments/comments-permission.guard.ts
index 96da4bb6e6..3981cdf6f5 100644
--- a/apps/api/src/comments/comments-permission.guard.ts
+++ b/apps/api/src/comments/comments-permission.guard.ts
@@ -112,14 +112,25 @@ export class CommentsPermissionGuard implements CanActivate {
     }
 
     const permissions: Record<string, string[]> = { [resource]: [action] };
-    const allowed = await this.checkPermission(request, permissions);
-    if (!allowed) {
-      this.logger.warn(
-        `[CommentsPermissionGuard] Denied ${request.method} ${request.url}. Required: ${requiredScope}`,
+    // Mirror standard PermissionGuard's try/catch — without it, network or
+    // auth-service errors surface as 500s, potentially leaking internals.
+    try {
+      const allowed = await this.checkPermission(request, permissions);
+      if (!allowed) {
+        this.logger.warn(
+          `[CommentsPermissionGuard] Denied ${request.method} ${request.url}. Required: ${requiredScope}`,
+        );
+        throw new ForbiddenException('Access denied');
+      }
+      return true;
+    } catch (error) {
+      if (error instanceof ForbiddenException) throw error;
+      this.logger.error(
+        `[CommentsPermissionGuard] Error checking permissions for ${request.method} ${request.url}:`,
+        error,
       );
-      throw new ForbiddenException('Access denied');
+      throw new ForbiddenException('Unable to verify permissions');
     }
-    return true;
   }
 
   private resolveEntityResource(
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
index c1fb3e2c05..24af1346aa 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
@@ -726,7 +726,10 @@ export function CloudTestsSection({
         <div className="space-y-3">
           {regularGroups.map((group) => {
             const isGroupExpanded = expandedGroups.has(group.serviceId);
-            const hasFailures = group.findings.length > 0;
+            // "All passed" should render for groups with only passing checks
+            // — `group.findings` is the merged failed+passed set, so we'd
+            // mis-read empty-of-failures groups as having failures otherwise.
+            const hasFailures = group.failed > 0;
 
             return (
               <div key={group.serviceId} className="rounded-lg border">
@@ -843,7 +846,10 @@ export function CloudTestsSection({
           </p>
           {baselineGroups.map((group) => {
             const isGroupExpanded = expandedGroups.has(group.serviceId);
-            const hasFailures = group.findings.length > 0;
+            // "All passed" should render for groups with only passing checks
+            // — `group.findings` is the merged failed+passed set, so we'd
+            // mis-read empty-of-failures groups as having failures otherwise.
+            const hasFailures = group.failed > 0;
 
             return (
               <div key={group.serviceId} className="rounded-lg border">
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.tsx
index 2cc2846d22..a556a25e2e 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/HistoryTab.tsx
@@ -52,6 +52,13 @@ interface HistoryPayload {
   resolutions: ResolutionRow[];
   exceptions: ExceptionRow[];
   regressions: RegressionRow[];
+  // Server may cap rows at 200/100; this signals the UI to show
+  // "showing N of M" when the response is partial.
+  truncated?: {
+    resolutions: boolean;
+    exceptions: boolean;
+    regressions: boolean;
+  };
 }
 
 const RESOLUTION_METHOD_LABEL: Record<
@@ -135,13 +142,21 @@ export function HistoryTab({ connectionId }: HistoryTabProps) {
     );
   }
 
+  const truncated = payload.truncated;
+  const sectionCount = (total: number, shown: number, isTruncated: boolean) =>
+    isTruncated ? `${shown} of ${total}` : `${total}`;
+
   return (
     <div className="space-y-6">
       <SummaryCard summary={payload.summary} />
       {payload.resolutions.length > 0 && (
         <Section
           title="Resolutions"
-          count={payload.resolutions.length}
+          count={sectionCount(
+            payload.summary.resolutions,
+            payload.resolutions.length,
+            truncated?.resolutions ?? false,
+          )}
           subtitle={`${payload.summary.platformFixes} platform · ${payload.summary.externalFixes} external · ${payload.summary.resourceDeleted} deleted · ${payload.summary.exceptionMarked} exception`}
         >
           {payload.resolutions.map((row) => (
@@ -152,7 +167,11 @@ export function HistoryTab({ connectionId }: HistoryTabProps) {
       {payload.exceptions.length > 0 && (
         <Section
           title="Active exceptions"
-          count={payload.exceptions.length}
+          count={sectionCount(
+            payload.summary.activeExceptions,
+            payload.exceptions.length,
+            truncated?.exceptions ?? false,
+          )}
           subtitle="Findings the customer has documented as accepted or not applicable."
         >
           {payload.exceptions.map((row) => (
@@ -168,7 +187,11 @@ export function HistoryTab({ connectionId }: HistoryTabProps) {
       {payload.regressions.length > 0 && (
         <Section
           title="Regressions"
-          count={payload.regressions.length}
+          count={sectionCount(
+            payload.summary.regressions,
+            payload.regressions.length,
+            truncated?.regressions ?? false,
+          )}
           subtitle="Findings that were previously resolved and are failing again."
         >
           {payload.regressions.map((row) => (
@@ -213,7 +236,7 @@ function Section({
 }: {
   title: string;
   subtitle: string;
-  count: number;
+  count: number | string;
   children: React.ReactNode;
 }) {
   return (
diff --git a/packages/db/prisma/migrations/20260515214156_finding_regression_resolution_fk/migration.sql b/packages/db/prisma/migrations/20260515214156_finding_regression_resolution_fk/migration.sql
new file mode 100644
index 0000000000..bdb8e35c68
--- /dev/null
+++ b/packages/db/prisma/migrations/20260515214156_finding_regression_resolution_fk/migration.sql
@@ -0,0 +1,2 @@
+-- AddForeignKey
+ALTER TABLE "FindingRegression" ADD CONSTRAINT "FindingRegression_previousResolutionId_fkey" FOREIGN KEY ("previousResolutionId") REFERENCES "FindingResolution"("id") ON DELETE SET NULL ON UPDATE CASCADE;
diff --git a/packages/db/prisma/schema/finding-history.prisma b/packages/db/prisma/schema/finding-history.prisma
index d92927ed75..a33d7acf53 100644
--- a/packages/db/prisma/schema/finding-history.prisma
+++ b/packages/db/prisma/schema/finding-history.prisma
@@ -79,6 +79,9 @@ model FindingResolution {
   /// How long the finding was open before being resolved.
   daysOpen Int?
 
+  /// Back-relation: regressions that reference this as the prior fix.
+  regressions FindingRegression[]
+
   @@index([organizationId])
   @@index([connectionId])
   @@index([resolvedAt])
@@ -112,7 +115,10 @@ model FindingRegression {
 
   previouslyResolvedAt DateTime
   /// Optional FK to the FindingResolution that introduced the prior fix.
+  /// `onDelete: SetNull` so deleting a resolution leaves the regression
+  /// intact but clears the dangling reference.
   previousResolutionId String?
+  previousResolution   FindingResolution? @relation(fields: [previousResolutionId], references: [id], onDelete: SetNull)
 
   regressedAt     DateTime
   detectedInRunId String

From 6988e37e7ad65ca6b662782cc4a7631a40995c9e Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 15 May 2026 18:15:38 -0400
Subject: [PATCH 13/15] fix(background-check): persist exemption reason +
 justification on member
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Confirm exemption" was failing for every customer with a "Failed to
confirm exemption" toast. Root cause:

  apps/api/src/main.ts sets `forbidNonWhitelisted: true` on the global
  ValidationPipe. The V1 frontend sends `backgroundCheckExempt` together
  with `backgroundCheckExemptReason` + `backgroundCheckExemptJustification`,
  but the latter two were never declared on UpdatePeopleDto — so the
  PATCH /v1/people/:id request was rejected with 400 before the service
  ever ran.

This fix:

1. Adds nullable columns `backgroundCheckExemptReason` (varchar) and
   `backgroundCheckExemptJustification` (text) to the Member model
   (named prisma migrate dev migration — not hand-written SQL).
2. Whitelists both fields on UpdatePeopleDto as optional strings with
   sensible length caps (100 / 2000 chars).
3. Persists both fields on member.update; clears them to null when
   backgroundCheckExempt is set to false so a future re-exemption starts
   from a clean state. Audit log retains the prior values from the
   original exempt-true request via AuditLogInterceptor.
4. Adds 4 unit tests in member-queries.spec.ts covering: persist on
   exempt=true, clear on exempt=false, clear overrides incoming stale
   reason on exempt=false, untouched when patch omits exempt.

Pre-existing typecheck failures in unrelated specs and a pre-existing
people.service.spec runtime error were verified to also occur on the
baseline (origin/main) before this change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 apps/api/src/people/dto/update-people.dto.ts  | 23 +++++
 .../src/people/utils/member-queries.spec.ts   | 90 +++++++++++++++++++
 apps/api/src/people/utils/member-queries.ts   | 10 +++
 .../migration.sql                             |  3 +
 packages/db/prisma/schema/auth.prisma         |  2 +
 5 files changed, 128 insertions(+)
 create mode 100644 apps/api/src/people/utils/member-queries.spec.ts
 create mode 100644 packages/db/prisma/migrations/20260515221108_add_background_check_exemption_reason_justification/migration.sql

diff --git a/apps/api/src/people/dto/update-people.dto.ts b/apps/api/src/people/dto/update-people.dto.ts
index 951118b401..8987919ea8 100644
--- a/apps/api/src/people/dto/update-people.dto.ts
+++ b/apps/api/src/people/dto/update-people.dto.ts
@@ -5,6 +5,7 @@ import {
   IsString,
   IsEmail,
   IsDateString,
+  MaxLength,
 } from 'class-validator';
 import { CreatePeopleDto } from './create-people.dto';
 
@@ -54,4 +55,26 @@ export class UpdatePeopleDto extends PartialType(CreatePeopleDto) {
   @IsOptional()
   @IsBoolean()
   backgroundCheckExempt?: boolean;
+
+  @ApiProperty({
+    description:
+      'Reason code for the exemption (e.g. "contractor_with_vendor_check", "other"). Persisted alongside backgroundCheckExempt and cleared when the member becomes non-exempt.',
+    example: 'other',
+    required: false,
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(100)
+  backgroundCheckExemptReason?: string;
+
+  @ApiProperty({
+    description:
+      'Free-text justification for the exemption, attached to the audit log. Cleared when the member becomes non-exempt.',
+    example: 'Contractor with existing background check on file from staffing agency.',
+    required: false,
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(2000)
+  backgroundCheckExemptJustification?: string;
 }
diff --git a/apps/api/src/people/utils/member-queries.spec.ts b/apps/api/src/people/utils/member-queries.spec.ts
new file mode 100644
index 0000000000..90f53ba7a3
--- /dev/null
+++ b/apps/api/src/people/utils/member-queries.spec.ts
@@ -0,0 +1,90 @@
+import { MemberQueries } from './member-queries';
+
+jest.mock('@db', () => ({
+  db: {
+    member: {
+      update: jest.fn(),
+    },
+    user: {
+      update: jest.fn(),
+    },
+  },
+}));
+
+import { db } from '@db';
+
+const mockedDb = db as jest.Mocked<typeof db>;
+
+describe('MemberQueries.updateMember — background-check exemption fields', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (mockedDb.member.update as jest.Mock).mockResolvedValue({ id: 'mem_1' });
+  });
+
+  it('persists reason and justification when backgroundCheckExempt is true', async () => {
+    await MemberQueries.updateMember('mem_1', 'org_1', {
+      backgroundCheckExempt: true,
+      backgroundCheckExemptReason: 'other',
+      backgroundCheckExemptJustification: 'Founder',
+    });
+
+    expect(mockedDb.member.update).toHaveBeenCalledTimes(1);
+    expect(mockedDb.member.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: 'mem_1', organizationId: 'org_1' },
+        data: expect.objectContaining({
+          backgroundCheckExempt: true,
+          backgroundCheckExemptReason: 'other',
+          backgroundCheckExemptJustification: 'Founder',
+        }),
+      }),
+    );
+  });
+
+  it('clears reason and justification when backgroundCheckExempt is set to false', async () => {
+    await MemberQueries.updateMember('mem_1', 'org_1', {
+      backgroundCheckExempt: false,
+    });
+
+    expect(mockedDb.member.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          backgroundCheckExempt: false,
+          backgroundCheckExemptReason: null,
+          backgroundCheckExemptJustification: null,
+        }),
+      }),
+    );
+  });
+
+  it('overrides incoming reason/justification when un-exempting', async () => {
+    // Defensive: if a client sends contradictory data, false wins —
+    // an un-exempt request must not retain stale reason text.
+    await MemberQueries.updateMember('mem_1', 'org_1', {
+      backgroundCheckExempt: false,
+      backgroundCheckExemptReason: 'stale_reason',
+      backgroundCheckExemptJustification: 'stale text',
+    });
+
+    expect(mockedDb.member.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          backgroundCheckExempt: false,
+          backgroundCheckExemptReason: null,
+          backgroundCheckExemptJustification: null,
+        }),
+      }),
+    );
+  });
+
+  it('does not touch reason or justification when the patch omits backgroundCheckExempt', async () => {
+    await MemberQueries.updateMember('mem_1', 'org_1', {
+      jobTitle: 'Engineer',
+    });
+
+    expect(mockedDb.member.update).toHaveBeenCalledTimes(1);
+    const call = (mockedDb.member.update as jest.Mock).mock.calls[0][0];
+    expect(call.data).not.toHaveProperty('backgroundCheckExemptReason');
+    expect(call.data).not.toHaveProperty('backgroundCheckExemptJustification');
+  });
+});
diff --git a/apps/api/src/people/utils/member-queries.ts b/apps/api/src/people/utils/member-queries.ts
index 05ced2524c..da7ecc92fa 100644
--- a/apps/api/src/people/utils/member-queries.ts
+++ b/apps/api/src/people/utils/member-queries.ts
@@ -21,6 +21,8 @@ export class MemberQueries {
     isActive: true,
     deactivated: true,
     backgroundCheckExempt: true,
+    backgroundCheckExemptReason: true,
+    backgroundCheckExemptJustification: true,
     fleetDmLabelId: true,
     user: {
       select: {
@@ -128,6 +130,14 @@ export class MemberQueries {
       updatePayload.fleetDmLabelId = null;
     }
 
+    // Un-exempting clears reason + justification so a future re-exemption
+    // starts from a clean state. The audit log retains the prior values
+    // from the original exempt-true request.
+    if (updatePayload.backgroundCheckExempt === false) {
+      updatePayload.backgroundCheckExemptReason = null;
+      updatePayload.backgroundCheckExemptJustification = null;
+    }
+
     const hasUserUpdates = name !== undefined || email !== undefined;
     const hasMemberUpdates = Object.keys(updatePayload).length > 0;
 
diff --git a/packages/db/prisma/migrations/20260515221108_add_background_check_exemption_reason_justification/migration.sql b/packages/db/prisma/migrations/20260515221108_add_background_check_exemption_reason_justification/migration.sql
new file mode 100644
index 0000000000..a1f9e91e38
--- /dev/null
+++ b/packages/db/prisma/migrations/20260515221108_add_background_check_exemption_reason_justification/migration.sql
@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "Member" ADD COLUMN     "backgroundCheckExemptJustification" TEXT,
+ADD COLUMN     "backgroundCheckExemptReason" TEXT;
diff --git a/packages/db/prisma/schema/auth.prisma b/packages/db/prisma/schema/auth.prisma
index 801083b868..956015bd93 100644
--- a/packages/db/prisma/schema/auth.prisma
+++ b/packages/db/prisma/schema/auth.prisma
@@ -119,6 +119,8 @@ model Member {
   isActive                        Boolean                           @default(true)
   deactivated                     Boolean                           @default(false)
   backgroundCheckExempt           Boolean                           @default(false)
+  backgroundCheckExemptReason     String?
+  backgroundCheckExemptJustification String?                        @db.Text
   externalUserId                  String?
   externalUserSource              String?
   employeeTrainingVideoCompletion EmployeeTrainingVideoCompletion[]

From ada894dbbfbbadf5fb57d96a804d03ab695a302d Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 15 May 2026 18:28:50 -0400
Subject: [PATCH 14/15] fix(app): add new exemption fields to createMockMember
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Prisma schema change in this branch added two non-optional (nullable)
columns to Member — backgroundCheckExemptReason + backgroundCheckExemptJustification.
The strict-typed test mock createMockMember returns Member, so the mock
had to include both keys or the spread of overrides would surface them
as undefined and fail the Vercel build:

  Type 'undefined' is not assignable to type 'string | null'.

Initializing both to null in the default mock matches the DB default.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 apps/app/src/test-utils/mocks/auth.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/apps/app/src/test-utils/mocks/auth.ts b/apps/app/src/test-utils/mocks/auth.ts
index 135b192afc..0a3a89c5d4 100644
--- a/apps/app/src/test-utils/mocks/auth.ts
+++ b/apps/app/src/test-utils/mocks/auth.ts
@@ -83,6 +83,8 @@ export const createMockMember = (overrides?: Partial<Member>): Member => ({
   externalUserId: null,
   externalUserSource: null,
   backgroundCheckExempt: false,
+  backgroundCheckExemptReason: null,
+  backgroundCheckExemptJustification: null,
   ...overrides,
 });
 

From 33042e79918196f8c4e585844649622329e6f041 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 15 May 2026 18:49:39 -0400
Subject: [PATCH 15/15] fix(cloud-tests): address cubic findings on production
 deploy PR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four real issues caught by cubic on the main→release deploy review.
The two Jest-hoisting findings (exception/reconciliation specs) were
skipped — that rule is babel-jest only, project uses ts-jest, all
tests pass in CI.

P1 — "Fix All" could target passing findings
  Service groups store the merged failed+passed set, and
  `canFixFinding` returns a key for any finding with a `findingKey`
  regardless of status. The batch dialog was happily including
  already-passing checks in the remediation target list. Now filter
  by `status === 'failed'` before consulting canFixFinding.

P2 — exception-expiry accepted timezone-less timestamps
  ISO 8601 regex made the timezone offset optional, so
  `2026-08-13T23:59:59` passed validation but `new Date()` parsed
  it in server-local time — same input, different expiry on
  UTC vs Pacific hosts. Made the offset required; updated the
  spec to assert both acceptance (with offset) and rejection
  (without offset).

P2 — dead `!prior.passed === false` in reconciliation
  The line evaluated identically to the very next `if (prior.passed)
  continue`. Removed; behavior unchanged, clarity restored.

P2 — ISO control-number regex was case-sensitive
  `/\bA\.\d+\.\d+(\.\d+)?\b/` had no /i flag, so lowercase
  variants like "a.5.1.2" would slip past the forbidden-content
  guard. Added /i and a regression test.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../ai-description.prompt.spec.ts              | 17 +++++++++++++++++
 .../cloud-security/ai-description.prompt.ts    |  5 +++--
 .../exception-expiry.utils.spec.ts             | 18 +++++++++++++++++-
 .../cloud-security/exception-expiry.utils.ts   |  8 +++++---
 .../cloud-security/reconciliation.service.ts   |  3 +--
 .../components/CloudTestsSection.tsx           |  5 +++++
 6 files changed, 48 insertions(+), 8 deletions(-)

diff --git a/apps/api/src/cloud-security/ai-description.prompt.spec.ts b/apps/api/src/cloud-security/ai-description.prompt.spec.ts
index c5872ec485..9684acdac8 100644
--- a/apps/api/src/cloud-security/ai-description.prompt.spec.ts
+++ b/apps/api/src/cloud-security/ai-description.prompt.spec.ts
@@ -69,6 +69,23 @@ describe('ai-description.prompt', () => {
       ).toMatchObject({ field: 'whyItMatters' });
     });
 
+    it('flags ISO 27001 control numbers in lowercase variants (a.5.1)', () => {
+      // The regex must be case-insensitive — auditors won't accept the
+      // model getting around the gate by lowercasing a citation.
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          whyItMatters: 'Maps to a.9.4.3.',
+        }),
+      ).toMatchObject({ field: 'whyItMatters' });
+      expect(
+        findForbiddenContent({
+          ...baseline,
+          description: 'Control a.5.1.2 enforces this.',
+        }),
+      ).toMatchObject({ field: 'description' });
+    });
+
     it('flags HIPAA / NIST framework citations', () => {
       expect(
         findForbiddenContent({
diff --git a/apps/api/src/cloud-security/ai-description.prompt.ts b/apps/api/src/cloud-security/ai-description.prompt.ts
index d07d424081..0e5424d75c 100644
--- a/apps/api/src/cloud-security/ai-description.prompt.ts
+++ b/apps/api/src/cloud-security/ai-description.prompt.ts
@@ -104,9 +104,10 @@ const FORBIDDEN_PATTERNS: readonly RegExp[] = [
   // prefixes — catches "CIS 1.8", "PCI 8.2.3", "NIST AC-2",
   // "HIPAA 164.312" even without the full framework name re-mentioned.
   /\b(CIS|PCI|NIST|HIPAA|HITRUST|FedRAMP) ?[A-Z]*[- ]?\d+(\.\d+){0,3}\b/i,
-  // SOC 2 / ISO control-number formats
+  // SOC 2 / ISO control-number formats — case-insensitive so lowercase
+  // variants (e.g. "a.5.1.2") are blocked too.
   /\bCC\d+\.\d+\b/i,
-  /\bA\.\d+\.\d+(\.\d+)?\b/,
+  /\bA\.\d+\.\d+(\.\d+)?\b/i,
   // URLs
   /https?:\/\//i,
   /www\./i,
diff --git a/apps/api/src/cloud-security/exception-expiry.utils.spec.ts b/apps/api/src/cloud-security/exception-expiry.utils.spec.ts
index 0de0204322..5d3bdfaa04 100644
--- a/apps/api/src/cloud-security/exception-expiry.utils.spec.ts
+++ b/apps/api/src/cloud-security/exception-expiry.utils.spec.ts
@@ -75,9 +75,25 @@ describe('parseExceptionExpiry', () => {
     );
   });
 
-  it('accepts strict ISO 8601 timestamps via the fallback', () => {
+  it('accepts strict ISO 8601 timestamps with an explicit timezone offset', () => {
     expect(parseExceptionExpiry('2026-08-13T23:59:59Z')).not.toBeNull();
     expect(parseExceptionExpiry('2026-08-13T23:59:59.999Z')).not.toBeNull();
     expect(parseExceptionExpiry('2026-08-13T23:59:59+02:00')).not.toBeNull();
+    expect(parseExceptionExpiry('2026-08-13T23:59:59-07:00')).not.toBeNull();
+  });
+
+  it('rejects timestamps without an explicit timezone offset', () => {
+    // No `Z`, no `+02:00` etc. — `new Date()` would parse these in server
+    // local time, giving inconsistent expiries across environments. Force
+    // the caller to commit to a timezone explicitly.
+    expect(() => parseExceptionExpiry('2026-08-13T23:59:59')).toThrow(
+      BadRequestException,
+    );
+    expect(() => parseExceptionExpiry('2026-08-13T23:59')).toThrow(
+      BadRequestException,
+    );
+    expect(() =>
+      parseExceptionExpiry('2026-08-13T23:59:59.999'),
+    ).toThrow(BadRequestException);
   });
 });
diff --git a/apps/api/src/cloud-security/exception-expiry.utils.ts b/apps/api/src/cloud-security/exception-expiry.utils.ts
index d3d9334dbb..52e8945923 100644
--- a/apps/api/src/cloud-security/exception-expiry.utils.ts
+++ b/apps/api/src/cloud-security/exception-expiry.utils.ts
@@ -45,12 +45,14 @@ export function parseExceptionExpiry(
 
   // Reject anything that isn't strict ISO 8601 — `new Date()` happily parses
   // locale-specific strings like "January 1, 2026" and "2026/08/13", which
-  // would silently bypass the documented contract.
+  // would silently bypass the documented contract. The timezone offset is
+  // REQUIRED — without it, `new Date("2026-08-13T23:59:59")` is parsed in
+  // server-local time, giving different expiries on UTC vs Pacific hosts.
   const ISO_8601 =
-    /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?(\.\d+)?(Z|[+-]\d{2}:?\d{2})?$/;
+    /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?(\.\d+)?(Z|[+-]\d{2}:?\d{2})$/;
   if (!ISO_8601.test(input)) {
     throw new BadRequestException(
-      'expiresAt must be a valid ISO date or YYYY-MM-DD calendar date.',
+      'expiresAt must be a YYYY-MM-DD calendar date or an ISO 8601 timestamp with an explicit timezone offset (e.g. "2026-08-13T23:59:59Z").',
     );
   }
   const parsed = new Date(input);
diff --git a/apps/api/src/cloud-security/reconciliation.service.ts b/apps/api/src/cloud-security/reconciliation.service.ts
index 342ef86532..70c0e8370c 100644
--- a/apps/api/src/cloud-security/reconciliation.service.ts
+++ b/apps/api/src/cloud-security/reconciliation.service.ts
@@ -124,8 +124,7 @@ export class CloudReconciliationService {
 
     // Resolutions: prior failed → current absent or passed.
     for (const [key, prior] of priorMap.entries()) {
-      if (!prior.passed === false) continue; // only interested in prior failures
-      if (prior.passed) continue;
+      if (prior.passed) continue; // only interested in prior failures
 
       const current = currentMap.get(key);
       if (current && !current.passed) continue; // still failing
diff --git a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
index 24af1346aa..294edc8c14 100644
--- a/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
+++ b/apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx
@@ -455,7 +455,12 @@ export function CloudTestsSection({
     if (!batchServiceId) return null;
     const group = serviceGroups.find((g) => g.serviceId === batchServiceId);
     if (!group) return null;
+    // `group.findings` is the merged failed+passed set — restrict the batch
+    // to failing findings only. `canFixFinding` doesn't gate on status, so
+    // without this filter a passing check could be targeted by "Fix All".
     const fixable = group.findings.filter((f) => {
+      const isFailed = f.status === 'failed' || f.status === 'FAILED';
+      if (!isFailed) return false;
       const match = canFixFinding(f);
       return match?.key && match.enabled;
     });