# `mgf-cloud-web` — scope policy

> `mgf-cloud-web`'s **scope policy** (family **SP**) — what belongs in this
> cloud console. A proposed addition is in scope only if it passes the §3 gate.

## §1 In scope (SP-01)

A **local, single-user web GUI** over the `mgf-cloud` library:

- **View + manage** the IaaS primitives `mgf-cloud` exposes — VMs, volumes,
  floating IPs, security groups, keypairs, object storage — and a cost-estimate
  dashboard, all through a browser at `127.0.0.1:8787`.
- **A thin, server-rendered front-end** — FastAPI + Jinja templates + the Magogi
  brand-web kit (`web/static/brand/`). The app owns the routes, templates, and
  brand assets; nothing else.
- **Brand styling** — consumed from the shared
  [`mgf-brand-web`](https://codeberg.org/magogi-admin/mgf-brand-web) package
  (mounted at `/static/brand`); only app-specific styling (`web/static/app.css`)
  and the vendored htmx live here.

The boundary: **a brand-styled browser surface over `mgf-cloud`.** All provider
logic, cost rates, models, and credential resolution live in `mgf-cloud`; this
app calls them and renders the result.

## §2 Out of scope (SP-02) — with reasons

| Not here | Why | Where instead |
|---|---|---|
| Provider / OpenStack logic, cost rates, models | owned by the library this app fronts | `mgf-cloud` |
| Credential reading / storage | delegated to the library's resolver | `mgf-cloud` (`config.load`) |
| Multi-user **hosted** service + authn/authz | v1 is localhost, single-operator (see SECURITY.md) | (future, on demand) |
| Non-cloud surfaces (other internal tools) | this app is the cloud console only | their own sibling, reusing the brand-web kit |
| A JS SPA / client framework | server-rendered Jinja is sufficient for a local tool | — |

## §3 Scope-creep gate (SP-03)

A PR adding a module/template MUST answer: (1) is it presentation of a surface
`mgf-cloud` already exposes (else it belongs in `mgf-cloud`, not here)? (2) does
it keep the app a **thin consumer** — no provider/credential logic leaking in?
(3) does it stay a **local single-user** tool (no auth/multi-user creep without a
documented decision + the SECURITY.md scope change)? Any "no/unclear" blocks it.

## §4 Adjacent scope (SP-04)

Adjacent (not yet in): extracting the brand-web kit into a shared
`mgf-brand-web`; a hosted/multi-user mode with auth; live-refresh interactivity
(htmx). Promote adjacent → in only on a documented demand signal.

## §5 Alternatives for out-of-scope needs (SP-05)

Provider features → add them in `mgf-cloud` (file a request in its `FEEDBACK.md`),
then surface them here; hosted multi-user UI → (future); other internal tools →
a new sibling that reuses this app's brand-web kit.

## §6 Revisiting scope (SP-06)

Revisited at every **MAJOR** boundary; a major bump re-justifies the surface
against §1/§2 and re-affirms the thin-consumer / local-single-user invariants.
