fix(manifest): make the drift recommendation direction-aware

[Lupus]

Closes #241

ops::compute_diff diffs (managed, repo), so a delta's weakens_egress means "promoting izba.yml would weaken egress." Both drift surfaces narrated a single recommendation regardless of which way the delta cut. With the live sandbox enforcing and izba.yml carrying enforce: false, the Manifest tab read:

izba.yml has changes not yet applied. Review below, then Promote.

directly above a red ⚠ weakens egress marker on that same promote — the banner recommending the action the marker warns about. A user who follows it lands back on enforce: false.

What changed

izba diff grows a next: line; the app's flat BANNER_TEXT lookup becomes bannerText(state, deltas) (and bannerClass, so a weakening repo_ahead is no longer neutral-blue above a red marker). When any pending delta weakens egress, both surfaces lead with that fact and point at the managed settings instead.

In repo_ahead the copy says to keep the managed settings rather than to Export — canExport is false in that state, so recommending Export would point at a dead control. diverged with an empty delta list (a divergence claim with nothing to show and no next step) now says exactly that and recommends Export to realign.

Acceptance criteria

AC	Where
Manifest tab no longer recommends disabling enforcement; next step agrees with the ⚠ marker	bannerText; repo_ahead + weakening test also asserts the old copy is absent
izba diff likewise	recommendation(); next_repo_ahead_weakening_does_not_steer_to_promote
Each drift state asserted on both surfaces	4 non-weakening + 3 weakening tests per surface
diverged with identical values recommends nothing that changes anything	DIVERGED_NO_DELTAS / DIVERGED_NO_DELTAS_TEXT + a test each
The two surfaces never contradict each other	machine-enforced — see below
Non-egress drift keeps current semantics	the four original banner strings are byte-unchanged; cpus 2→4 no-regression test
Diff computation unchanged	no edit to manifest::diff, egress_weakens, DriftState, compute_diff, or the review token

AC5 is enforced, not documented

The four weakening strings are declared independently in Rust and TypeScript. A doc comment saying "change both together" is a note an editor can miss while every test on both sides stays green — the exact "a rule with a test and a call site without one" shape this repo keeps hitting.

So shared_recommendation_copy_is_byte_identical_across_surfaces reads app/src/components/ManifestTab.tsx at test time and asserts each Rust const appears verbatim. Verified it actually fails: perturbing one TSX literal (izba.yml → izba.yaml) reds cargo test -p izba-cli, a required gate on both platforms. The TSX literals are kept unsplit (with // prettier-ignore) precisely so a + concatenation cannot hide drift from that check.

Contracts deliberately left byte-frozen

• CLI state: labels — hack/dogfood/gui/gui_oracles.py's _CLI_LABEL_TO_STATE maps those exact strings back to drift states, and dogfood-pt2 carries expect_stdout_re on them. Hence the guidance lands on its own line; a guard test pins the labels and names why.
• The four non-weakening banner strings — asserted by app/e2e/manifest.spec.ts, hack/dogfood/journeys/manifest-gui.json and dogfood-app-guide.md. Confirmed each of those scenarios is genuinely non-weakening: an absent spec.egress normalizes to EgressPolicyConfig::default() (enforce: false), and egress_weakens returns false whenever !from.enforce, so the managed_ahead/diverged journeys (which add a host to the live allow-list) never take the weakening branch.
• No "live" in CLI output — 97af81c4/607fc3c6 removed it because FieldClass::Live renders as a [live] badge in the rows; the new copy says "managed settings".

Dogfood journey correction

manifest-weakens-egress-ack seeds enforce: true then flips izba.yml to enforce: false — a genuinely weakening repo_ahead, and the harness's own oracle for this defect class. Its core: true step pinned the contradiction (Review below, then Promote. and a red ⚠ weakens egress), so it was unsatisfiable after the fix. It now pins the weakening copy.

Verification

All six workspace gates plus the separate app/src-tauri + frontend gate run green locally: cargo test --workspace (1421 + suites, 0 failures), cargo clippy --workspace --all-targets -D warnings, cargo fmt --check, musl izba-init, windows-gnu check + clippy, vitest 514/514, npm run build, npm run lint, and src-tauri fmt/clippy/test (123 passed).

Both halves were written test-first; the failing-before-implementing output is recorded in the working notes.

🤖 Generated with Claude Code

Greptile Summary

The PR makes manifest drift guidance direction-aware so CLI and desktop recommendations do not encourage a promotion that weakens egress.

• Adds state- and delta-aware recommendation copy to the Manifest tab and izba diff.
• Uses destructive styling for weakening repo-ahead drift and handles diverged state with no field deltas.
• Adds unit, end-to-end, cross-surface consistency, and dogfood coverage while preserving existing state labels and non-weakening guidance.

Confidence Score: 5/5

The PR appears safe to merge, with CLI and desktop guidance consistently reflecting whether promotion would weaken egress.

The changed logic only derives recommendation text and styling from existing drift state and weakening flags; repository consumers remain compatible, safety acknowledgments are unchanged, and no actionable defect remains.

Important Files Changed

Filename	Overview
app/src/components/ManifestTab.tsx	Selects banner copy and styling from drift direction while preserving existing controls and promotion safety gates.
crates/izba-cli/src/commands/diff.rs	Adds a direction-aware next: line and comprehensive output-contract tests, including byte consistency with the desktop copy.
app/src/test/manifestTab.test.tsx	Covers all drift states, weakening variants, empty diverged deltas, and banner styling.
app/e2e/manifest.spec.ts	Updates the weakening promotion journey to assert guidance consistent with the warning marker.
hack/dogfood/journeys/manifest-gui.json	Aligns the core weakening-egress journey with the corrected direction-aware recommendation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    D[Manifest diff] --> W{Any delta weakens egress?}
    W -->|Yes| S{Drift state}
    S -->|Repo ahead| K[Keep managed settings; qualify Promote]
    S -->|Managed ahead| E[Recommend Export]
    S -->|Diverged| B[Lead with Export; qualify Promote]
    W -->|No| N{Diverged with no deltas?}
    N -->|Yes| R[Recommend Export to realign]
    N -->|No| O[Use existing state recommendation]
    K --> C[Render matching CLI and desktop copy]
    E --> C
    B --> C
    R --> C
    O --> C

Loading

_{Reviews (1): Last reviewed commit: "fix(manifest): make the drift recommenda..." | Re-trigger Greptile}

Context used (4)

• Knowledge Base — Manifest application and reconciliation
• Knowledge Base — Egress and network policy
• Knowledge Base — CLI workflows
• Knowledge Base — Sandbox management user interface

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
99.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud