# DEPS — mgf-test-web's bidirectional dependency manifest

> **§1** — what mgf-test-web depends on. **§2** — who depends on it.
> **Per standard DOC-16:** every project ships a `DEPS.md` at repo root.

Last verified: 2026-06-29.

## §1 What mgf-test-web depends on

The **base** carries two `mgf-*` runtime dependencies — the spine and the runner —
and is deliberately **FastAPI-free** so CI can install the warden + `testctl`
without a web stack. The console is an opt-in `[web]` extra.

| Scope | Dependency | Why |
|---|---|---|
| runtime | `mgf-fedres>=0.1,<0.2` | the federation-resources spine — schemas (incl. `test_*`), the version-aware reader, live-NDJSON + run-record I/O, the sync model the authority serializes into |
| runtime | `mgf-test-supervisor>=0.1.3,<0.2` | the tier runner (`mtest`), driven as a library in the warden's child process (the production runner adapter) |
| `web` | `fastapi>=0.110`, `uvicorn>=0.29`, `jinja2>=3.1`, `mgf-brand-web>=0.2,<0.3` | the ProofWarden console (Catalog / Running / History / CI) — the separable presentation layer |
| `standards` | `mgf-common[standards]>=0.47,<0.50` | standards corpus for the federation CLI checks (dev/opt) |
| `dev` | pytest, pytest-cov, pytest-timeout, ruff, mypy | the green gates |

The base imports only the **stdlib warden core** at module-import time: importing
`mgf.test_web` does **not** require `mgf-fedres` or FastAPI — those are reached only
by the surfaces that need them (the spine I/O when serializing run-state; the
runner adapter; the console). `mgf-common` is optional (the `[standards]` extra),
never a hard runtime requirement.

## §2 Who depends on mgf-test-web

| Project | Status | Surfaces used |
|---|---|---|
| _(none yet)_ | — | ProofWarden is an **application leaf** (a CLI + the warden authority + a console); nothing imports it as a library today |

It sits at the leaf of a small sub-stack:
`mgf-brand-web` → `mgf-fedres` → **`mgf-test-web`** (with `mgf-test-supervisor` as
the runner). As a **consumer** of the spine, it re-pins to a new `mgf-fedres` MINOR
only after the spine has published. A future notifications/mobile relay (spec §8)
would consume its `live/` events + run-records, not its Python surface.

## §3 Maintenance

Updated every MINOR release + when a dependency pin moves. A `mgf-fedres`
`schema_version` bump or any wire/state change is walked here (DOC-18) and recorded
in `CHANGELOG.md`.
