# `mgf-vm-forensics` — scope policy

## §1 In scope (SP-01)
- pcap/network analysis (top-talkers, DNS, TLS-SNI, HTTP) via dpkt; filesystem/timeline/IOC analysis;
  case management + artifact store; archive (tar.gz) packaging; injected-callable capture seams.

The boundary: **offline forensic analysis of VM artifacts + captures, behind injected I/O seams.**

## §2 Out of scope (SP-02) — with reasons
| Not here | Why | Where instead |
|---|---|---|
| Live VM control / the engine | analysis, not control | `mgf-vm-core` / the adapters |
| A GUI / case-review UI | library | the consuming app |
| Real-time IDS/alerting | offline forensics | a SIEM |
| Malware detonation / sandboxing | out of charter | a dedicated sandbox |
| The capture *binaries* (tcpdump/qemu-nbd) | injected/host-provided | the host + injected fns |

## §3 Scope-creep gate (SP-03)
A PR MUST answer: (1) is it offline analysis / case / capture-seam (else out)? (2) does it keep
untrusted-input parsing bounded + privileged ops in the capture layer (import-linter)? (3) consumer demand?

## §4 Adjacent scope (SP-04)
Adjacent: more protocol analyzers, a YARA-rule pack loader, a report renderer. Promote on a documented demand signal.

## §5 Alternatives for out-of-scope needs (SP-05)
Live control → `mgf-vm-core`/adapters; GUI → the app; alerting → a SIEM; detonation → a sandbox.

## §6 Revisiting scope (SP-06)
Revisited at every **MAJOR** boundary; re-affirms the offline-analysis / bounded-untrusted-input / injected-seam invariants.


## Boundary — verified ownership (generated)

> Generated from the fleet-wide import matrix — the **verified** ownership boundary (who is the SOLE importer of each third-party dep across the whole federation). Regenerate with `fleet_ownership_audit.py --inject`; CI-gated against code drift by `--check`. **Do not hand-edit the block below.**

<!-- BEGIN BOUNDARY (generated by mgf-standard/scripts/fleet_ownership_audit.py --inject; do not hand-edit) -->
- **Owns (sole third-party importer, fleet-verified):** `dpkt`, `yara`
- **Federation deps (imports):** `mgf.common`, `mgf.vm`
<!-- END BOUNDARY -->
