# DEPS — mgf-vm-forensics's bidirectional dependency manifest

> **§1** — what mgf-vm-forensics depends on. **§2** — who depends on
> mgf-vm-forensics. Knowing both directions makes deprecation,
> breaking-change blast-radius, and feature-prioritisation tractable.
>
> **Per standard DOC-16** (v2.12): every project ships a `DEPS.md`.
> Replaces the former `USERS.md`.

Last verified: 2026-06-09.

---

## §1 What mgf-vm-forensics depends on

| Dependency | Window | Why | Tier |
|---|---|---|---|
| `mgf-common` | `>=0.41,<0.43` | typed exceptions / bootstrap / observability | runtime (sibling) |
| `mgf-vm-core` | `>=0.1,<0.2` | domain types + `common.{shell,atomic_io}` + `security.isolation` + typed exceptions | runtime (sibling) — ✅ flipped off the retiring `mgf-vm` umbrella on 2026-06-05 (v0.1.4); the umbrella is now DELETED |
| `dpkt` | `>=1.9,<2` | pcap reading + frame iteration; parses attacker-controllable bytes — tight upper bound per SH-05/SH-06 | runtime |
| `yara-python` | optional | IOC analyzer only; `try/except ImportError` pattern, not a declared dep | lazy / optional |

*Federation siblings depended on:* `mgf-common` (cornerstone) and
`mgf-vm` (transitional umbrella, via `[tool.uv.sources]` path source).
The README's "`mgf-vm-core>=0.1,<0.2`" reflects the **post-migration**
target; the live pyproject pins the `mgf-vm` umbrella until Stream A
lands. No dependency on `mgf-vm-sdk` / `mgf-vm-interchange` at present.

---

## §2 Who depends on mgf-vm-forensics

Consumer projects + federation siblings that import this project.
(Inverse of each consumer's `MGF_ADOPTION.md`.)

| Project / sibling | Location | Import sites | Status | Surfaces used |
|---|---|---:|---|---|
| **vm-vmanager-app** | `/home/bassam/PycharmProjects/vm-vmanager-app` | 43 (32 src) | Active — designed-for consumer (CLI + GUI forensics windows) | `case` / `capture` / `analysis` / `archive` / `manifest` / `render` / `reports` |
| **vm-vmanager-app** | `/home/bassam/PycharmProjects/vm-vmanager-app` | 43 | Legacy — predecessor desktop app, pre-split forensics windows | `case` / `capture` / `analysis` / `archive` / `render` |

*Not a consumer:* the `mgf-vm` umbrella still carries the original
`src/mgf/vm/forensics/` tree (the extraction source); those imports are
internal self-references, not downstream adoption.

---

## §3 Maintenance

Updated every MINOR release + when a dependency or consumer changes.
Import-survey methodology:

```sh
grep -rE "(from|import) +mgf\.vm\.forensics" /path/to/each/consumer \
  --include='*.py' | wc -l
```
