# STANDARDS_NOTE — `mgf-common` federation standards and `mgf-vm-forensics`

> **Status.** Target conformance: **L2 — Standard** (per D-H3).
> The per-rule ledger lives in
> [`docs/inprogress/MGF_STANDARDS_CONFORMANCE.md`](docs/inprogress/MGF_STANDARDS_CONFORMANCE.md).

## §1 Why L2

`mgf-vm-forensics` is a **pure-analysis sibling library** —
pcap-in, typed-report-out. L2 is the right bar because:

- **Inputs are attacker-controllable.** The library parses pcap
  bytes that may come from a malicious source. `dpkt`'s upper
  bound + L2's mechanical checks on subprocess/argv (N/A here),
  path traversal (applies to fixture file loading), and exception
  taxonomy keep the surface honest.
- **Reuse beyond vm-vmanager-app is the differentiator.** This library is
  intentionally extractable for use by other forensics tooling.
  L2's typing + `__all__` discipline (AP-01) make it consumable
  without needing to read the source.
- **Memory hygiene matters.** Forensic captures can be very large.
  Iterators not lists; bounded buffers; deterministic cleanup of
  file handles (DP-13).

## §2 Rules that apply non-trivially here

- **DP-13 (deterministic cleanup).** Every `open()` on a pcap file
  is in a context manager. Long-running streaming readers are
  bounded iterators with explicit close.
- **SC-15 (path traversal).** Applies to any user-supplied pcap path
  in case-management workflows. Validate via `Path.resolve()` +
  `is_relative_to()` against allowed case roots.
- **LG-04 (log redaction).** Forensic findings may contain
  attacker-supplied data (DNS names, TLS-SNI hostnames, IP/MAC
  pairs). The redactor's allow-list controls what surfaces in logs;
  the typed report objects carry the unredacted findings for the
  user to render with their own discretion.
- **EH-02 (translate at seam).** `dpkt` raises its own exception
  hierarchy; translate at the analyzer-method boundary to typed
  forensics exceptions (`mgf.vm.exceptions.OperationError` /
  `VManagerError`, the latter aliased to `mgf.common.exceptions.AppError`
  by the `mgf-vm` umbrella).

## §3 What this library does NOT enforce

- **CF-** — N/A. Library, no application config.
- **SC-02 / SC-06 / SC-07** — N/A (no subprocess, no outbound calls).
- **EH-04** — N/A (library, not entry point).

## §4 How this file evolves

Same discipline as the other federation siblings.
