kibi-cli 2.2.0 → 2.4.0

package/dist/cli-json-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-json-command.d.ts","sourceRoot":"","sources":["../src/cli-json-command.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAIpE;AAGD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;KACpC,EAAE,CAAC;CACL,CAAC;AAkDF,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,IAAI,CAAC,CAuGf"}
+{"version":3,"file":"cli-json-command.d.ts","sourceRoot":"","sources":["../src/cli-json-command.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAIpE;AAGD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;KACpC,EAAE,CAAC;CACL,CAAC;AAkDF,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,IAAI,CAAC,CAuGf"}

package/dist/cli-json-command.js

@@ -4,7 +4,7 @@ import { loadInput } from "./cli-input.js";
 import { loadOperationSpec } from "./cli-operation-loader.js";
 import { executeOperation as executeProtocolOperation } from "./cli-protocol.js";
 import { prepareOperationInput } from "./cli-validate.js";
-import { appendCliDiagnosticUsage } from "./public/diagnostic-usage.js";
+import { appendCliDiagnosticUsage, diagnosticEnvOptIn, } from "./public/diagnostic-usage.js";
 import { createCliRuntime } from "./runtime/cli-runtime.js";
 export function writeOptionalStderr(stderr) {
     if (stderr !== undefined) {
@@ -30,7 +30,7 @@ function findInputConflicts(invocation) {
     return [...positionalConflicts, ...optionConflicts];
 }
 function diagnosticModeEnabled(command) {
-    return (process.env.KIBI_CLI_DIAGNOSTIC_MODE === "1" ||
+    return (diagnosticEnvOptIn() ||
         process.argv.includes("--diagnostic-mode") ||
         command.optsWithGlobals().diagnosticMode === true);
 }

package/dist/cli-operation-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-operation-loader.d.ts","sourceRoot":"","sources":["../src/cli-operation-loader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACd,MAAM,8BAA8B,CAAC;AAOtC,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,aAAa,CAAC,CAoFxB"}
+{"version":3,"file":"cli-operation-loader.d.ts","sourceRoot":"","sources":["../src/cli-operation-loader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACd,MAAM,8BAA8B,CAAC;AAOtC,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,aAAa,CAAC,CAyFxB"}

package/dist/cli-operation-loader.js

@@ -74,6 +74,9 @@ export async function loadOperationSpec(name) {
         case "kb_check":
             spec = (await import("./public/operations/specs/check.js")).checkSpec;
             break;
+        case "kb_prepare_impact_review":
+            spec = (await import("./public/operations/specs/impact-review-preparation.js")).prepareImpactReviewSpec;
+            break;
         case "kb_compile_intent":
             spec = (await import("./public/operations/specs/planning.js"))
                 .compileIntentSpec;

package/dist/cli-operation-metadata.d.ts

@@ -55,7 +55,7 @@ export declare const CLI_OPERATION_METADATA: readonly [{
 }, {
     readonly name: "kb_plan_bootstrap";
     readonly cliName: "plan-bootstrap";
-    readonly description: "Generate a deterministic, snapshot-bound kibi.bootstrap-plan.v1 for repository onboarding. Read-only analysis returns evidence, bounded context questions, exact dependency-ordered actions, a canonical plan hash, and no mutation side effects.";
+    readonly description: "Generate a deterministic, snapshot-bound kibi.bootstrap-plan.v1 for repository onboarding. Read-only analysis of the repository plus any declared knowledge sources and cited intent claims returns evidence, bounded context questions, exact dependency-ordered actions, a canonical plan hash, and no mutation side effects.";
 }, {
     readonly name: "kb_validate_upsert";
     readonly cliName: "validate-upsert";
@@ -72,6 +72,10 @@ export declare const CLI_OPERATION_METADATA: readonly [{
     readonly name: "kb_check";
     readonly cliName: "check";
     readonly description: "Run KB validation rules and return violations, quality diagnostics, and typed kibi.migration-plan.v2 actions. Use before or after mutations and after source edits; checks remain read-only and never infer or apply actions from prose suggestions.";
+}, {
+    readonly name: "kb_prepare_impact_review";
+    readonly cliName: "prepare-impact-review";
+    readonly description: "Prepare complete content-bound impact-review authoring inputs from the current staged snapshot or explicitly selected immutable Git commits. Returns strict reviewer schemas and an unauthored template; it does not decide, approve, sign, stage, or prove the review.";
 }, {
     readonly name: "kb_sparql_remote";
     readonly cliName: "sparql-remote";

package/dist/cli-operation-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-operation-metadata.d.ts","sourceRoot":"","sources":["../src/cli-operation-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAKF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+HiB,CAAC;AAMrD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAKtB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAEtB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,aAAa,CAEnE"}
+{"version":3,"file":"cli-operation-metadata.d.ts","sourceRoot":"","sources":["../src/cli-operation-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAKF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqIiB,CAAC;AAMrD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAKtB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAEtB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,aAAa,CAEnE"}

package/dist/cli-operation-metadata.js

@@ -65,7 +65,7 @@ export const CLI_OPERATION_METADATA = [
     {
         name: "kb_plan_bootstrap",
         cliName: "plan-bootstrap",
-        description: "Generate a deterministic, snapshot-bound kibi.bootstrap-plan.v1 for repository onboarding. Read-only analysis returns evidence, bounded context questions, exact dependency-ordered actions, a canonical plan hash, and no mutation side effects.",
+        description: "Generate a deterministic, snapshot-bound kibi.bootstrap-plan.v1 for repository onboarding. Read-only analysis of the repository plus any declared knowledge sources and cited intent claims returns evidence, bounded context questions, exact dependency-ordered actions, a canonical plan hash, and no mutation side effects.",
     },
     {
         name: "kb_validate_upsert",
@@ -87,6 +87,11 @@ export const CLI_OPERATION_METADATA = [
         cliName: "check",
         description: "Run KB validation rules and return violations, quality diagnostics, and typed kibi.migration-plan.v2 actions. Use before or after mutations and after source edits; checks remain read-only and never infer or apply actions from prose suggestions.",
     },
+    {
+        name: "kb_prepare_impact_review",
+        cliName: "prepare-impact-review",
+        description: "Prepare complete content-bound impact-review authoring inputs from the current staged snapshot or explicitly selected immutable Git commits. Returns strict reviewer schemas and an unauthored template; it does not decide, approve, sign, stage, or prove the review.",
+    },
     {
         name: "kb_sparql_remote",
         cliName: "sparql-remote",

package/dist/cli-register-maintenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-maintenance.d.ts","sourceRoot":"","sources":["../src/cli-register-maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2JlE"}
+{"version":3,"file":"cli-register-maintenance.d.ts","sourceRoot":"","sources":["../src/cli-register-maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6KlE"}

package/dist/cli-register-maintenance.js

@@ -68,6 +68,13 @@ export function registerMaintenanceCommands(program) {
         .option("--format <format>", "Output format: json|table", "table")
         .option("--limit <n>", "Limit rendered table rows", "50")
         .action(withExitCode(async (options) => (await import("./commands/usage-remediation.js")).usageRemediationCommand(options)));
+    program
+        .command("merge-driver")
+        .description("Git merge driver: three-way merge .kb/symbols.yaml or a relationship shard by record id")
+        .argument("<base>", "Common ancestor version (%O)")
+        .argument("<current>", "Current version, overwritten with the result (%A)")
+        .argument("<other>", "Other branch's version (%B)")
+        .action(withExitCode(async (base, current, other) => (await import("./commands/merge-driver.js")).mergeDriverCommand(base, current, other)));
     program
         .command("branch")
         .description("Manage branch KBs")

package/dist/cli-register-reporting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-reporting.d.ts","sourceRoot":"","sources":["../src/cli-register-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2LhE"}
+{"version":3,"file":"cli-register-reporting.d.ts","sourceRoot":"","sources":["../src/cli-register-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsMhE"}

package/dist/cli-register-reporting.js

@@ -119,4 +119,8 @@ export function registerReportingCommands(program) {
         }
         return (await import("./commands/check.js")).checkCommand(options);
     }));
+    program
+        .command("check-diff")
+        .description("Run the full protected pull-request impact gate from its trusted GitHub event")
+        .action(withExitCode(async () => (await import("./commands/check-diff.js")).checkDiffCommand()));
 }

package/dist/commands/check-diff.d.ts

@@ -0,0 +1,5 @@
+/** Full, non-interactive aggregate PR gate; all inputs come from a verified event. */
+export declare function checkDiffCommand(workspaceRoot?: string): Promise<{
+    exitCode: number;
+}>;
+//# sourceMappingURL=check-diff.d.ts.map

package/dist/commands/check-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-diff.d.ts","sourceRoot":"","sources":["../../src/commands/check-diff.ts"],"names":[],"mappings":"AAeA,sFAAsF;AACtF,wBAAsB,gBAAgB,CACpC,aAAa,SAAgB,GAC5B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA4E/B"}

package/dist/commands/check-diff.js

@@ -0,0 +1,62 @@
+import { createMaintenanceSourceAnalysisService, fingerprintMaintenanceSourceSet, readSnapshotSourceConfig, } from "../plugins/maintenance-source-analysis.js";
+import { analyzeSourceChanges } from "../plugins/source-change-analysis.js";
+import { captureDiffSnapshot } from "../traceability/git-change-snapshot.js";
+import { evaluateImpactReview, fingerprintImpactEvaluator, } from "../traceability/impact-evaluator.js";
+import { assertTrustedPullRequestBaseline } from "../traceability/impact-pr-diff.js";
+import { canonicalJson } from "../traceability/impact-review.js";
+import { resolveTrustedPullRequestSnapshot } from "../traceability/trusted-pr-event.js";
+/** Full, non-interactive aggregate PR gate; all inputs come from a verified event. */
+export async function checkDiffCommand(workspaceRoot = process.cwd()) {
+    const event = resolveTrustedPullRequestSnapshot(workspaceRoot);
+    const snapshot = captureDiffSnapshot(workspaceRoot, event.mergeBaseCommit, event.headCommit);
+    assertTrustedPullRequestBaseline(snapshot, event);
+    if (snapshot.inventory.length === 0) {
+        const currentEvent = resolveTrustedPullRequestSnapshot(workspaceRoot);
+        if (canonicalJson(currentEvent) !== canonicalJson(event))
+            throw new Error("Verified PR event or Git ancestry changed during impact evaluation");
+        console.log(JSON.stringify({
+            status: "passed",
+            repository: event.repository,
+            targetRef: event.targetRef,
+            targetCommit: event.targetCommit,
+            targetTree: event.targetTree,
+            headCommit: event.headCommit,
+            headTree: event.headTree,
+            mergeBaseCommit: event.mergeBaseCommit,
+            mergeBaseTree: event.mergeBaseTree,
+            scopeFingerprint: null,
+            reviewerAuthority: "none",
+        }));
+        return { exitCode: 0 };
+    }
+    const trustedConfig = readSnapshotSourceConfig(snapshot, event.targetTree);
+    const providerSetFingerprint = fingerprintMaintenanceSourceSet(workspaceRoot, trustedConfig);
+    const sourceService = createMaintenanceSourceAnalysisService(workspaceRoot, trustedConfig);
+    const analyses = await analyzeSourceChanges(snapshot.inventory, sourceService);
+    const result = evaluateImpactReview(snapshot, {
+        providerSetFingerprint,
+        evaluatorFingerprint: fingerprintImpactEvaluator(),
+        analyses,
+    });
+    if (!result.passed)
+        throw new Error(result.diagnostics
+            .map((item) => `${item.code}: ${item.message}`)
+            .join("\n"));
+    const currentEvent = resolveTrustedPullRequestSnapshot(workspaceRoot);
+    if (canonicalJson(currentEvent) !== canonicalJson(event))
+        throw new Error("Verified PR event or Git ancestry changed during impact evaluation");
+    console.log(JSON.stringify({
+        status: "passed",
+        repository: event.repository,
+        targetRef: event.targetRef,
+        targetCommit: event.targetCommit,
+        targetTree: event.targetTree,
+        headCommit: event.headCommit,
+        headTree: event.headTree,
+        mergeBaseCommit: event.mergeBaseCommit,
+        mergeBaseTree: event.mergeBaseTree,
+        scopeFingerprint: result.scopeFingerprint,
+        reviewerAuthority: result.reviewerAuthority,
+    }));
+    return { exitCode: 0 };
+}

package/dist/commands/check-generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-generated.d.ts","sourceRoot":"","sources":["../../src/commands/check-generated.ts"],"names":[],"mappings":"AA2HA,2EAA2E;AAE3E,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GACL,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAwH/B"}
+{"version":3,"file":"check-generated.d.ts","sourceRoot":"","sources":["../../src/commands/check-generated.ts"],"names":[],"mappings":"AAgIA,2EAA2E;AAE3E,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GACL,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgK/B"}

package/dist/commands/check-generated.js

@@ -3,6 +3,11 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import * as path from "node:path";
 import { load as parseYAML } from "js-yaml";
+import { enrichSymbolCoordinates } from "../extractors/symbols-coordinator.js";
+import { createMaintenanceSourceAnalysisService, fingerprintMaintenanceSourceSet, readSnapshotSourceConfig, } from "../plugins/maintenance-source-analysis.js";
+import { captureStagedSnapshot } from "../traceability/git-change-snapshot.js";
+import { fingerprintImpactEvaluator } from "../traceability/impact-evaluator.js";
+import { createReviewedDecoratorCoordinateVerifier } from "../traceability/reviewed-coordinate-refresh.js";
 import { refreshManifestCoordinates } from "./sync/manifest.js";
 const MANIFESTS = [".kb/symbols.yaml", ".kb/symbol-coordinates.yaml"];
 const MAX_GIT_OUTPUT = 256 * 1024 * 1024;
@@ -17,9 +22,6 @@ function git(args, input) {
     }
     return result.stdout;
 }
-function indexTree() {
-    return git(["write-tree"]).toString("utf8").trim();
-}
 function treeBlobs(tree) {
     const entries = git(["ls-tree", "-r", "-z", "--full-tree", tree]);
     const blobs = new Map();
@@ -100,7 +102,16 @@ function sourcePaths(symbols) {
 export async function checkGeneratedManifests(options = {}) {
     let snapshotDir;
     try {
-        const tree = indexTree();
+        const snapshot = captureStagedSnapshot(process.cwd());
+        const tree = snapshot.headTree;
+        const assertUnchanged = () => {
+            try {
+                snapshot.assertUnchanged();
+            }
+            catch (error) {
+                throw new Error("Git index changed during generated-manifest analysis (or HEAD changed); retry the commit", { cause: error });
+            }
+        };
         const { blobs, nonRegularPaths } = treeBlobs(tree);
         const symbolsOid = blobs.get(MANIFESTS[0]);
         if (!symbolsOid)
@@ -113,8 +124,7 @@ export async function checkGeneratedManifests(options = {}) {
         // Plain sync does not publish coordinate artifacts for a freshly
         // initialized, empty symbols manifest. The first commit must remain usable.
         if (symbolCount === 0) {
-            if (indexTree() !== tree)
-                throw new Error("Git index changed during generated-manifest analysis; retry the commit");
+            assertUnchanged();
             console.log("kibi: staged symbols manifest is empty; no coordinates to refresh.");
             return { exitCode: 0 };
         }
@@ -123,18 +133,14 @@ export async function checkGeneratedManifests(options = {}) {
         if (nonRegular)
             throw new Error(`Staged symbol source is not a regular file: ${nonRegular}`);
         if (options.changedOnly) {
-            const changed = new Set(git(["diff", "--cached", "--name-only", "--no-renames", "-z"])
-                .toString("utf8")
-                .split("\0")
-                .filter(Boolean));
-            if (![...MANIFESTS, ...sources].some((file) => changed.has(file))) {
-                if (indexTree() !== tree)
-                    throw new Error("Git index changed during generated-manifest analysis; retry the commit");
+            const changed = new Set(snapshot.inventory.map((file) => file.path));
+            if (![...MANIFESTS, ...sources, "package.json"].some((file) => changed.has(file))) {
+                assertUnchanged();
                 console.log("kibi: no staged symbol sources or generated manifests changed.");
                 return { exitCode: 0 };
             }
         }
-        const files = [...MANIFESTS, ...sources];
+        const files = [...MANIFESTS, ...sources, "package.json"];
         const objectIds = [
             ...new Set(files
                 .map((file) => blobs.get(file))
@@ -153,13 +159,31 @@ export async function checkGeneratedManifests(options = {}) {
                 throw new Error(`Could not read staged blob for ${file}`);
             writeFileSync(target, bytes);
         }
+        const sourceAnalysisService = createMaintenanceSourceAnalysisService(process.cwd(), readSnapshotSourceConfig(snapshot));
+        let verifyReviewedCoordinates;
+        const verifyPythonDecoratorCoordinates = async (sourcePath, analysis) => {
+            if (verifyReviewedCoordinates === undefined) {
+                const trustedSourceConfig = readSnapshotSourceConfig(snapshot, snapshot.baseTree);
+                const trustedService = createMaintenanceSourceAnalysisService(process.cwd(), trustedSourceConfig);
+                verifyReviewedCoordinates = createReviewedDecoratorCoordinateVerifier(snapshot, trustedService, {
+                    providerSetFingerprint: fingerprintMaintenanceSourceSet(process.cwd(), trustedSourceConfig),
+                    evaluatorFingerprint: fingerprintImpactEvaluator(),
+                });
+            }
+            await verifyReviewedCoordinates(sourcePath, analysis);
+        };
         await refreshManifestCoordinates(path.join(snapshotDir, MANIFESTS[0]), snapshotDir, {
             refreshSymbolCoordinates: true,
             quiet: true,
+            enrichSymbolCoordinates: (entries, root) => enrichSymbolCoordinates(entries, root, {
+                sourceAnalysisService,
+                allowPythonDecoratorCoordinates: true,
+                verifyPythonDecoratorCoordinates,
+            }),
         });
-        const snapshot = snapshotDir;
+        const materializedRoot = snapshotDir;
         const drift = MANIFESTS.filter((file) => {
-            const generatedPath = path.join(snapshot, file);
+            const generatedPath = path.join(materializedRoot, file);
             const expected = existsSync(generatedPath)
                 ? readFileSync(generatedPath)
                 : undefined;
@@ -171,8 +195,7 @@ export async function checkGeneratedManifests(options = {}) {
         });
         // An index mutation invalidates every comparison, even if the manifests
         // themselves were untouched. Git will commit the later index state.
-        if (indexTree() !== tree)
-            throw new Error("Git index changed during generated-manifest analysis; retry the commit");
+        assertUnchanged();
         if (drift.length > 0) {
             console.error(`kibi: generated manifest drift in staged snapshot: ${drift.join(", ")}`);
             console.error("Run kibi sync --refresh-symbol-coordinates, review the diff, then stage only the intended hunks with git add -p (or git add <path> when the whole file is intended).");

package/dist/commands/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAiE7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B;AAifD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,EACtC,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC5B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAC3B,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAMpB;AAGD,wBAAsB,YAAY,CAChC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA4b/B;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAoDtB;AAID,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBnB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,aAAa,EACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AACD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAgEtB;AAID,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAmGtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,SAAS,EAAE,CAAC,CAyCtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAgDtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA0BtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA+BtB"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAwE7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B;AA8gBD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,EACtC,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC5B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAC3B,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAMpB;AAGD,wBAAsB,YAAY,CAChC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAomB/B;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAoDtB;AAID,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBnB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,aAAa,EACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AACD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAgEtB;AAID,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAmGtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,SAAS,EAAE,CAAC,CAyCtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAgDtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA0BtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA+BtB"}