fix(manifest): require tomli on Py3.10 and fail loud when missing

[drmikecrypto]

Declare tomli with an environment marker and raise ImportError instead of returning None, so missing parsers no longer look like empty manifests.

Fixes #3283

[graphify-labs]

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Formal verification. No changes could be formally verified in this run.

---

Graphify review — findings

Makes missing tomli on Python <3.11 fail loud instead of silently dropping manifests: _load_toml_module centralizes the tomllib/tomli import and raises ImportError with install guidance when neither is available, and _parse_pyproject/_parse_cargo now propagate that instead of returning None (which was indistinguishable from an empty manifest). Adds tomli>=2.0.1 as a dependency for python_version < '3.11' so it's present by default.

No blocking issues surfaced. 3 lower-confidence candidates did not survive cross-model review.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 1349 functions depend on the 31 functions this change touches.

Health — this change adds coupling hotspots:

• new: extract() — 520 callers, 43 callees
• new: _rebuild_code() — 113 callers, 50 callees
• new: detect() — 108 callers, 15 callees
• new: dispatch_command() — 2 callers, 123 callees
• new: detect_incremental() — 23 callers, 7 callees
• new: _get_extractor() — 26 callers, 6 callees
• new: _is_sensitive() — 36 callers, 4 callees
• new: classify_file() — 43 callers, 3 callees
• …and 13 more — each is listed as a finding

Verification — 1349 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 118 function(s) in the blast radius were not formally verified this run

Formal verification

Could not verify: Could not verify \_parse\_cargo.

The verifier did not have enough to check \_parse\_cargo, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: non-vacuity: domain too small (only 2 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous

Could not verify: Could not verify \_parse\_pyproject.

The verifier did not have enough to check \_parse\_pyproject, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: non-vacuity: domain too small (only 2 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous

· 21 more finding(s) on lines outside this diff (see the check run).