# `mgf-vm-core` — scope policy

> Scope policy (family **SP**) — what belongs in the pure VM-domain core.

## §1 In scope (SP-01)
- the VM **state machine** + lifecycle, **VmSpec** + the frozen domain types/IDs
- the **contracts/ports Protocols** (Hypervisor/Storage/Device/Network/Metrics/... backends) — the I/O seam
- **configurators** (cpu/display/firmware/memory/network/passthrough) that build domain specs
- **fakes** (in-memory backend doubles) + the **conformance suite**
- pure-Python **common helpers** (safe_tar, atomic_io, shell, xml, yaml, observer, cancellation)

The boundary: **the pure, engine-free domain core every vm-* adapter + the SDK build on.**

## §2 Out of scope (SP-02) — with reasons
| Not here | Why | Where instead |
|---|---|---|
| Hypervisor/engine I/O (libvirt/qemu/firecracker) | the purity contract forbids it | `mgf-vm-libvirt` / `mgf-vm-firecracker` |
| The client SDK / transport | sits above the domain | `mgf-vm-sdk` |
| The vmanager server / control plane | consumes the core | `vm-vmanager-app` |
| A CLI or GUI | this is a domain library | the apps |
| Network sockets / SSH / subprocess engines | engine I/O | the adapters |

## §3 Scope-creep gate (SP-03)
A PR adding a module/type MUST answer: (1) is it pure domain (no engine I/O — does it pass the
import-linter purity contract)? (2) does it fit the state-machine/contracts/configurator/fakes model?
(3) consumer demand? Any "no/unclear" blocks it.

## §4 Adjacent scope (SP-04)
Adjacent: new backend Protocols (e.g. SnapshotBackend), new configurators. Promote on a documented
consumer-demand signal (an adapter or the SDK needing it), never speculatively.

## §5 Alternatives for out-of-scope needs (SP-05)
Engine I/O → the vm-* adapters; transport → `mgf-vm-sdk`; server → `vm-vmanager-app`; CLI/GUI → the apps.

## §6 Revisiting scope (SP-06)
Revisited at every **MAJOR** boundary (0.x → 1.0 and later majors) — the only place a previously-IN
item may be removed; re-affirms the purity / engine-free / contracts-are-the-seam invariants.


## Boundary — verified ownership (generated)

> Generated from the fleet-wide import matrix — the **verified** ownership boundary (who is the SOLE importer of each third-party dep across the whole federation). Regenerate with `fleet_ownership_audit.py --inject`; CI-gated against code drift by `--check`. **Do not hand-edit the block below.**

<!-- BEGIN BOUNDARY (generated by mgf-standard/scripts/fleet_ownership_audit.py --inject; do not hand-edit) -->
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** `mgf.common`, `mgf.vm`
<!-- END BOUNDARY -->
