# DEPS — mgf-fedres's bidirectional dependency manifest

> **§1** — what mgf-fedres depends on. **§2** — who depends on it.
> **Per standard DOC-16:** every project ships a `DEPS.md` at repo root.

Last verified: 2026-06-29.

## §1 What mgf-fedres depends on

The spine is kept **minimal + headless** (no web framework) so the warden and CI
can reuse the core without pulling FastAPI. The single runtime dependency is the
schema validator.

| Scope | Dependency | Why |
|---|---|---|
| runtime | `jsonschema>=4.18` | validates the wire/state contract; brings `referencing` (cross-file `$ref` resolution) transitively |
| `standards` | `mgf-common[standards]>=0.47,<0.50` | standards corpus for the federation CLI checks (dev/opt) |
| `dev` | pytest, pytest-cov, pytest-timeout, ruff, mypy, mgf-test-supervisor, mgf-standard | the green gates + the tier runner + the standards corpus |

No `mgf-*` runtime dependency: the spine sits **above** `mgf-common` in spirit
(it inherits the standards) but does not import it at runtime. `mgf-common` is
optional (the `[standards]` extra), never a hard runtime requirement.

## §2 Who depends on mgf-fedres

| Project | Status | Surfaces used |
|---|---|---|
| `mgf-fed-web` | **planned** (Phase B) | reader + schemas + sync engine + `SourceProvider` + live NDJSON — composes + displays `generated/` |
| `mgf-test-web` / ProofWarden | **planned** (Phase C) | schemas (incl. `test_*`) + run-record writer + live wire + the sync model; the warden reuses the headless core |

It is the shared leaf of a small sub-stack:
`mgf-brand-web` → **`mgf-fedres`** → { `mgf-fed-web`, `mgf-test-web` }. As the
spine, it must be published before either web can pin it.

## §3 Maintenance

Updated every MINOR release + when a consumer adopts it. A `schema_version` bump
or any change to the wire/state contract walks both consumers (DOC-18) and is
recorded in `CHANGELOG.md`.
