# DEPS — mgf-vm-sdk's bidirectional dependency manifest

> **§1** — what mgf-vm-sdk depends on. **§2** — who depends on
> mgf-vm-sdk. Knowing both directions makes deprecation,
> breaking-change blast-radius, and feature-prioritisation tractable.
>
> **Per standard DOC-16** (v2.12): every project ships a `DEPS.md`.
> Replaces the former `USERS.md` (whose roster is now §2 below).

Last verified: 2026-05-28.

---

## §1 What mgf-vm-sdk depends on

| Dependency | Window | Why | Tier |
|---|---|---|---|
| `mgf-common` | `>=0.41,<0.47` | typed exceptions / bootstrap / observability (cornerstone) | runtime |
| `mgf-vm-core` | `>=0.1.8,<0.2` | the VM-domain contracts + types the SDK marshals across both transports | runtime |
| `grpcio` | `>=1.64,<2` | `GrpcTransport` wire client (Phase 1) | `[grpc]` extra (lazy) |
| `grpcio-tools` | `>=1.64,<2` | protobuf/gRPC stub generation (Phase 1) | `[grpc]` extra (lazy) |
| `protobuf` | `>=5.0,<6` | generated message types for the `vmanager.api.v1` wire schema (Phase 1) | `[grpc]` extra (lazy) |

*Federation siblings depended on: `mgf-common` (cornerstone) and
`mgf-vm-core` (the upstream domain/contracts library). The SDK
deliberately does NOT depend on any engine adapter
(`mgf-vm-libvirt`, `mgf-vm-firecracker`) — layering enforced by
`import-linter` (D-H4). The runtime core stays gRPC-free; fleet-mode
deps live behind the `[grpc]` extra (D-A2).*

---

## §2 Who depends on mgf-vm-sdk

Consumer projects + federation siblings that import this project.

| Project / sibling | Location | Import sites | Status | Surfaces used |
|---|---|---:|---|---|
| **`vm-vmanager-app` CLI** | `/home/bassam/PycharmProjects/vm-vmanager-app` | 0 | designed-for (Phase 0 Stream D/E) | `VmManagerClient` + `InProcessTransport` (Local) / `GrpcTransport` (Fleet) |
| **`vm-vmanager-app` GUI** | `/home/bassam/PycharmProjects/vm-vmanager-app` | 0 | designed-for (Phase 0 Stream E) | `VmManagerClient` (marshalled across `QThread`) |
| **External Python tooling** | external | — | future | `VmManagerClient` (the supported integration surface) |

*Status as of 2026-05-28: mgf-vm-sdk is a pre-`0.1.0` skeleton. The
consumers above are **designed-for**, not yet **integrated** — there
are currently **zero** live `mgf.vm.sdk` import sites anywhere in the
federation. `vm-vmanager-app` (dist `vm-vmanager-cli`) today imports
`mgf-vm` directly; the port onto the SDK is the Phase 0 CLI→GUI
migration. No `mgf-vm-*` sibling imports the SDK (they sit upstream
of or beside it: `mgf-vm-core` is a dependency, the engine adapters
are layering-forbidden consumers).*

---

## §3 Maintenance

Updated every MINOR release + when a dependency or consumer changes.
Import-survey methodology:

```sh
grep -rE "(from|import) +mgf\.vm\.sdk" /path/to/each/consumer \
  --include='*.py' | wc -l
```
