fix(dashboard): quiet the "no provenance" column noise

engine/web/src/admission/signing.jsx

@@ -191,18 +191,34 @@ function SigningRow({ r, strength: repoStrength }) {
           )}
         </td>
         <td class="cell cell-provenance" data-provenance={prov.token}>
-          <span class={`gate-chip prov-${prov.token}`}>
-            <span class="glyph" aria-hidden="true">
-              {prov.glyph}
-            </span>
-            <span class="gate-word">{prov.word}</span>
-          </span>
-          {provInfo ? (
-            <span class="provenance-by t-micro" title={provInfo["builder-full"]}>
-              {" \u{00B7} "}
-              {provInfo["builder-short"]}
+          {r.provenance === "absent" ? (
+            // Almost no image ships a SLSA build-provenance attestation, so an "absent" chip would
+            // shout "no provenance" on nearly every row — pure noise. The calm default reads as a
+            // quiet muted dash (mirroring the no-signer cell); the loud chip is kept only for the
+            // meaningful states (verified / unverifiable / checking). The expandable detail still
+            // explains the absence for anyone who looks.
+            <span
+              class="t-micro muted"
+              title="no SLSA build-provenance attestation for this image — calm, not an alarm"
+            >
+              {"\u{2014}"}
             </span>
-          ) : null}
+          ) : (
+            <>
+              <span class={`gate-chip prov-${prov.token}`}>
+                <span class="glyph" aria-hidden="true">
+                  {prov.glyph}
+                </span>
+                <span class="gate-word">{prov.word}</span>
+              </span>
+              {provInfo ? (
+                <span class="provenance-by t-micro" title={provInfo["builder-full"]}>
+                  {" \u{00B7} "}
+                  {provInfo["builder-short"]}
+                </span>
+              ) : null}
+            </>
+          )}
         </td>
         <td class="cell cell-baseline">
           {repoStrength === "unknown" ? (

engine/web/test/admission.test.jsx

@@ -85,6 +85,44 @@ describe("Admission honesty", () => {
   });
 });
 
+describe("Provenance column is quiet by default", () => {
+  // Almost no image ships a SLSA attestation, so an "absent" chip on every row is pure noise — the
+  // calm default reads as a muted dash, never the loud "no provenance" chip.
+  it("renders an ABSENT-provenance image as a muted dash, not the no-provenance chip", () => {
+    const { container } = render(
+      <AdmissionView
+        view={admissionView({ signing: [signingRepo("registry/app", [signingRow("img-a", { provenance: "absent" })])] })}
+      />,
+    );
+    const cell = container.querySelector('tr[data-signing="img-a"] .cell-provenance');
+    expect(cell).toBeTruthy();
+    expect(cell.getAttribute("data-provenance")).toBe("absent"); // still honestly tagged
+    expect(cell.querySelector(".gate-chip")).toBeNull(); // but no loud chip
+    expect(cell.textContent).not.toContain("no provenance");
+    expect(cell.textContent).toContain("—"); // a quiet dash
+  });
+
+  it("still renders the loud chip for a VERIFIED build provenance", () => {
+    const { container } = render(
+      <AdmissionView
+        view={admissionView({
+          signing: [
+            signingRepo("registry/app", [
+              signingRow("img-a", {
+                provenance: "verified",
+                "provenance-info": { "builder-short": "org/repo", "builder-full": "https://github.com/org/repo/.github/workflows/x.yml" },
+              }),
+            ]),
+          ],
+        })}
+      />,
+    );
+    const cell = container.querySelector('tr[data-signing="img-a"] .cell-provenance');
+    expect(cell.querySelector(".gate-chip.prov-verified")).toBeTruthy();
+    expect(cell.textContent).toContain("org/repo");
+  });
+});
+
 describe("Admission escaping", () => {
   it("renders an XSS subject/image/signer identity as inert text", () => {
     window.__pwned = undefined;