# Item 2 — per-library verified boundary statements

> Auto-generated by `scripts/fleet_ownership_audit.py` from the import matrix — **regenerable, not hand-asserted**. 'Owns (sole importer)' means the third-party module is imported by **only** this repo across the whole federation. The same stanza is injected into each repo's `SCOPE.md` (`--inject`) and drift-gated (`--check`).


### `mgf-alembic`
- **Owns (sole third-party importer, fleet-verified):** `alembic`
- **Shared third-party (intentional, boundary-checked):** `sqlalchemy` (+mgf-fastapi, mgf-sqlalchemy)
- **Federation deps (imports):** `mgf.alembic`, `mgf.common`

### `mgf-apiprobe`
- **Owns (sole third-party importer, fleet-verified):** `jsonpath_ng`
- **Shared third-party (intentional, boundary-checked):** `httpx` (+mgf-http, mgf-logship)
- **Federation deps (imports):** `mgf.apiprobe`, `mgf.common`

### `mgf-auth`
- **Owns (sole third-party importer, fleet-verified):** `jwt`
- **Federation deps (imports):** `mgf.auth`, `mgf.common`

### `mgf-brand-web`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** — (none; leaf/cornerstone)

### `mgf-cloud`
- **Owns (sole third-party importer, fleet-verified):** `keystoneauth1`, `openstack`, `paramiko`
- **Shared third-party (intentional, boundary-checked):** `fastapi` (+mgf-cloud-web, mgf-fastapi, mgf-fed-web, mgf-livepush, mgf-logship, mgf-test-web), `uvicorn` (+mgf-cloud-web, mgf-fastapi, mgf-fed-web, mgf-test-web)
- **Federation deps (imports):** `mgf.cloud`, `mgf.common`, `mgf.fastapi`

### `mgf-cloud-provision`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** `mgf.cloud`, `mgf.cloud_provision`, `mgf.common`

### `mgf-cloud-web`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Shared third-party (intentional, boundary-checked):** `fastapi` (+mgf-cloud, mgf-fastapi, mgf-fed-web, mgf-livepush, mgf-logship, mgf-test-web), `uvicorn` (+mgf-cloud, mgf-fastapi, mgf-fed-web, mgf-test-web)
- **Federation deps (imports):** `mgf.brand_web`, `mgf.cloud`, `mgf.cloud_web`, `mgf.common`, `mgf.fastapi`

### `mgf-common`
- **Owns (sole third-party importer, fleet-verified):** `cryptography`, `keyring`, `sentry_sdk`, `systemd`
- **Federation deps (imports):** `mgf.common`

### `mgf-django`
- **Owns (sole third-party importer, fleet-verified):** `django`
- **Federation deps (imports):** `mgf.common`, `mgf.django`

### `mgf-fastapi`
- **Owns (sole third-party importer, fleet-verified):** `starlette`
- **Shared third-party (intentional, boundary-checked):** `fastapi` (+mgf-cloud, mgf-cloud-web, mgf-fed-web, mgf-livepush, mgf-logship, mgf-test-web), `sqlalchemy` (+mgf-alembic, mgf-sqlalchemy), `uvicorn` (+mgf-cloud, mgf-cloud-web, mgf-fed-web, mgf-test-web)
- **Federation deps (imports):** `mgf.common`, `mgf.fastapi`, `mgf.livepush`, `mgf.sqlalchemy`

### `mgf-fed`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** `mgf`, `mgf.cloud`, `mgf.common`, `mgf.fed`, `mgf.logship`, `mgf.standard`, `mgf.test_supervisor`

### `mgf-fed-web`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Shared third-party (intentional, boundary-checked):** `fastapi` (+mgf-cloud, mgf-cloud-web, mgf-fastapi, mgf-livepush, mgf-logship, mgf-test-web), `uvicorn` (+mgf-cloud, mgf-cloud-web, mgf-fastapi, mgf-test-web)
- **Federation deps (imports):** `mgf.brand_web`, `mgf.fedres`

### `mgf-fedres`
- **Owns (sole third-party importer, fleet-verified):** `jsonschema`, `referencing`
- **Federation deps (imports):** — (none; leaf/cornerstone)

### `mgf-hrb`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** `mgf.common`, `mgf.hrb`

### `mgf-http`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Shared third-party (intentional, boundary-checked):** `httpx` (+mgf-apiprobe, mgf-logship)
- **Federation deps (imports):** `mgf.common`, `mgf.http`

### `mgf-livepush`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Shared third-party (intentional, boundary-checked):** `fastapi` (+mgf-cloud, mgf-cloud-web, mgf-fastapi, mgf-fed-web, mgf-logship, mgf-test-web)
- **Federation deps (imports):** `mgf.common`, `mgf.livepush`

### `mgf-logship`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Shared third-party (intentional, boundary-checked):** `fastapi` (+mgf-cloud, mgf-cloud-web, mgf-fastapi, mgf-fed-web, mgf-livepush, mgf-test-web), `httpx` (+mgf-apiprobe, mgf-http)
- **Federation deps (imports):** `mgf.common`, `mgf.logship`

### `mgf-sqlalchemy`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Shared third-party (intentional, boundary-checked):** `sqlalchemy` (+mgf-alembic, mgf-fastapi)
- **Federation deps (imports):** `mgf.sqlalchemy`

### `mgf-standard`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** — (none; leaf/cornerstone)

### `mgf-tele-core`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** `mgf.common`, `mgf.tele`

### `mgf-tele-teltonika`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** `mgf.tele`

### `mgf-test-supervisor`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** `mgf.common`, `mgf.test_supervisor`

### `mgf-test-web`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Shared third-party (intentional, boundary-checked):** `fastapi` (+mgf-cloud, mgf-cloud-web, mgf-fastapi, mgf-fed-web, mgf-livepush, mgf-logship), `uvicorn` (+mgf-cloud, mgf-cloud-web, mgf-fastapi, mgf-fed-web)
- **Federation deps (imports):** `mgf.brand_web`, `mgf.fedres`, `mgf.test_supervisor`

### `mgf-vm-core`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** `mgf.common`, `mgf.vm`

### `mgf-vm-firecracker`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** — (none; leaf/cornerstone)

### `mgf-vm-forensics`
- **Owns (sole third-party importer, fleet-verified):** `dpkt`, `yara`
- **Federation deps (imports):** `mgf.common`, `mgf.vm`

### `mgf-vm-interchange`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Shared third-party (intentional, boundary-checked):** `defusedxml` (+mgf-vm-libvirt)
- **Federation deps (imports):** `mgf.common`, `mgf.vm`

### `mgf-vm-libvirt`
- **Owns (sole third-party importer, fleet-verified):** `libvirt`
- **Shared third-party (intentional, boundary-checked):** `defusedxml` (+mgf-vm-interchange)
- **Federation deps (imports):** `mgf.common`, `mgf.vm`

### `mgf-vm-sdk`
- **Owns (sole third-party importer, fleet-verified):** — (no exclusive third-party dep; domain/seam owner)
- **Federation deps (imports):** `mgf.vm`
