## Item 1b-2 — L3-Readiness Triage: mgf-* Long-Tail (19 repos)

> **WAVE-2 KICKOFF — verified 2026-06-28.** Ran `mgf-fed app-doctor --standards`
> fleet-wide (the §2.A.1 gate candidate). Result: **22/24 python repos PASS
> (11/11 checks)** — confirming A1 is safe to ship as a CI gate for them. The
> **two that fail are cloud (2 fail) + cloud-provision (1 fail), all `DOC-15`**:
> their conformance ledgers are stubs (cloud 218/262 MUSTs unaccounted, cloud-prov
> 250/262). (cloud also shows a *local-only* AP-13 `__version__` drift — passes in
> CI where the repo is installed.) **So A1 (the highest-leverage L3 action) is
> gated on the cloud + cloud-provision ledger build-out (= remaining-work item
> #5).** Sequence locked: **#5 (build the 2 ledgers) → A1 (ship the app-doctor
> gate + fleet `.woodpecker` regen) → the per-repo LG/SHOULD work.** The ledger
> build-out + per-repo audits are the multi-agent audit methodology (§"The
> methodology") — the Workflow-tool case, pending explicit opt-in.

Scope: 19 long-tail libraries, all self-declared **L2**, triaged for the 1b-2 L3 uplift. Headline: **every repo is 7/8 on runtime gates** — the *only* universally-missing gate is `app_doctor_standards`. The fleet's code cores are strong (mypy `--strict`, import-linter, and `NM-05` no-junk-drawer all clean fleet-wide); the L3 delta is dominated by a handful of *recurring* gaps that are template-fixable once, plus a per-repo **structured-logging (LG)** build-out concentrated in the network/adapter repos.

### 1. Summary table

Sorted near→far, then by effort — reading order ≈ uplift order.

| Repo | Declared | Class | Gates | Live SHOULD gaps | Top MUST risks (n, max sev) | Effort |
|---|---|---|---|---|---|---|
| mgf-sqlalchemy | L2 | near | 7/8 | 1 — PF-06 | 2¹, med | **low** |
| mgf-apiprobe | L2 | near | 7/8 | 1 — PF-06 | 3, med | **low** |
| mgf-tele-core | L2 | near | 7/8 | 0 | 2, med | med |
| mgf-auth | L2 | mid | 7/8 | 0 | 4, med | **low** |
| mgf-vm-sdk | L2 | mid | 7/8 | 1 — PF-06 | 3, med | med |
| mgf-alembic | L2 | mid | 7/8 | 1 — PF-06 | 5, med | med |
| mgf-tele-teltonika | L2 | mid | 7/8 | 1 — PF-06 | 4, med | med |
| mgf-django | L2 | mid | 7/8 | 1 — PF-06 | 5, med | med |
| mgf-livepush | L2 | mid | 7/8 | 1 — PF-06 | 3, med | med |
| mgf-logship | L2 | mid | 7/8 | 2 — PF-06, TM-06 | 4, **HIGH** | med |
| mgf-http | L2 | mid | 7/8 | 1 — PF-06 | 4, med | med |
| mgf-hrb | L2 | mid | 7/8 | 2 — PF-06, PR-02 | 4, med | med |
| mgf-vm-core | L2 | mid | 7/8 | 1 — PF-06 | 4, med | med |
| mgf-cloud-provision | L2 | mid² | 7/8 | 0 | 4, **HIGH×2** | med |
| mgf-vm-forensics | L2 | mid | 7/8 | 1 — PF-06 | 4, med | high |
| mgf-vm-interchange | L2 | far | 7/8 | 1 — PF-06 | 4, **HIGH** | high |
| mgf-vm-libvirt | L2 | far | 7/8 | 2 — PF-06, TM-06 | 4, med | high |
| mgf-vm-firecracker | L2³ | far | 7/8⁴ | 0 | 4, low | high |
| mgf-test-supervisor | L2 | far | 7/8 | 2 — PF-06, TM-06 | 4, med | high |

¹ sqlalchemy lists 4 `must_risk` entries; 2 are verified clean (no risk / no violation) — count shown is genuine findings.
² classified "mid" but structurally a Phase-1a skeleton with the full per-rule audit explicitly deferred — sequenced with the structural wave (4).
³ intentional skeleton (`src/` is `__version__` only); verified below L2 by design.
⁴ `app_doctor_standards` missing in **all 19**; firecracker additionally enforces coverage on the 3.12 job only (3.11/3.13 run plain pytest).

---

### 2. Cross-cutting patterns

#### A. Fix ONCE in the template → one fleet regen
These are the same change to the same file (`templates/woodpecker/.woodpecker.yml` + canonical scaffold). Do them as **one template bump + one regen** (the pipeline already run for REL-13/registry), not 19 times.

1. **`app_doctor_standards` gate — missing 19/19.** Add a single `mgf-fed app-doctor --standards` step. Pure additive, **safe to ship now**, no prerequisites. (See §4 — this is also the standing guard for pattern E.)
2. **WF-11: CI installs via `pip install -e .[dev]` from version ranges, not the committed `uv.lock`** — explicitly open in ≥9 repos (sqlalchemy, apiprobe, auth, django, livepush, logship, http, tele-teltonika, vm-core) and almost certainly the others. Flip the install step to `uv sync --frozen`. **GATED:** the known *devpi backfill gap* (missing historical mgf-* versions) means `uv sync --frozen` will fail in CI for any repo whose lock pins a missing version — resolve the backfill first, or this breaks CI fleet-wide.
3. **`mgf-test-supervisor` wired only as a dev-dep, never invoked in CI (TS-22..28)** — raw pytest across the matrix in ≥10 repos. Promote django's `supervisor-self-check` + `supervisor-tier-0` pattern to the canonical template and extend it across the full 3.11/3.12/3.13 matrix. **GATED:** the supervisor must first ship perf schema ≥1.1.0 + the `mgf.test_supervisor.perf` module (see pattern F).
4. **`PUBLIC_API.md` template gap drives PF-06 (15/19).** Add a *Complexity / Memory-class* column to the canonical `PUBLIC_API.md` template + one line of guidance. Turns PF-06 from a per-repo design question into a fill-in-the-blank.
5. **firecracker coverage gate inconsistency** — coverage enforced on one matrix job only; a template consistency fix.

#### B. Scriptable doc sweep (one pass, fleet-wide — not Woodpecker)
6. **Stale `mgf-common` dependency-pin prose** (`>=0.38,<0.39` or `>=0.30,<0.31` vs actual `>=0.41,<0.49`) in README / PUBLIC_API.md / conformance headers — the REL-13 pin-walk never propagated to prose. Predictable string, ≥10 repos (vm-core, vm-firecracker, vm-libvirt, alembic, sqlalchemy, hrb, …). Scripted sed sweep.
7. **Conformance-tracker version header frozen N releases behind `pyproject.toml`** — present in essentially all 19 (logship 3 behind, test-supervisor 4 behind, tele-core 6 behind). The header bump is mechanical; the *verified-standing reconciliation* (README "L2" vs tracker "below L2") is the per-repo part this triage feeds.
8. **`.gitleaks.toml` copy-paste drift** (title "mgf-common", dead allowlist paths) in cloud-provision + test-supervisor. **Low severity / known cosmetic** — per the gitleaks-scaffold decision, do **not** "fix" the template title (it drifts 23 repos); leave or script the dead allowlist lines only.

#### C. Per-repo engineering — but share a helper (the real L3 work)
9. **Structured-logging (LG) build-out — the dominant MUST blocker.** Three vm-* adapters emit **zero** log records (vm-sdk 10 modules, vm-interchange 5, vm-libvirt 17); the network/web/tele/auth set has partial logging missing the MUST shape (LG-09 `extra={}` not concatenation, LG-11 operation start/end with stable `operation=` name, LG-15/16 EVENTS.md + WHAT/WHY/HOW). Affects ~12 repos. **Not template-fixable**, but build a shared `mgf-common` operation-boundary logging helper + an `EVENTS.md` scaffold *once*, then wire per-repo.
10. **SC-17 audit records at security/subprocess boundaries** (no `audit=true` INFO) — vm-core, vm-forensics, vm-libvirt, logship, auth.
11. **SC body-caps (`max_bytes`) on unbounded I/O** — logship request body (**HIGH**), apiprobe response body (med), forensics pcap error-list (med), libvirt qemu-img buffer (low). Same fix shape → centralize a guard.

#### D. Recurring SHOULD gaps
- **PF-06 — 15/19** (only vm-firecracker, tele-core, auth, cloud-provision are N/A). Closed by template fix #4 + one annotation pass per repo.
- **TM-06 — 3/19** (logship, vm-libvirt, test-supervisor): timestamp emitted as ISO-8601 string/`datetime` instead of `time.time_ns()` int. Identical fix shape.
- **PR-02 — 1** (hrb): CLI still ships inside the SDK alongside hrb-app's Qt GUI.

#### E. Recurring MUST risk — DOC drift (≈19/19)
Stale pins (B6), stale tracker version/level (B7), and overclaimed README level are the single most common MUST risk in the fleet. **The fix is structural:** the `app_doctor_standards` gate (A1) is precisely the automated guard that catches this class going forward — which is why A1 is the highest-leverage action.

#### F. Cross-wave prerequisites (critical path)
- **test-supervisor must ship `mgf.test_supervisor.perf` + schema ≥1.1.0** → blocks TS-28 closure in **sqlalchemy & alembic** (sqlalchemy reports `ModuleNotFoundError` today). A *slice* of Wave-4's supervisor work is a **Wave-1 prerequisite** — pull it forward.
- **vm-core Protocol stabilization** → unblocks firecracker's ~40 deferred MUSTs.
- **devpi backfill** → unblocks the WF-11 template flip (A2) everywhere.

#### G. Must-fix-now (independent of wave sequencing)
- **mgf-cloud-provision** — SSL verification disabled (`CERT_NONE`) in `examples/agent-reconciler.py`, which runs on-host via cron (**HIGH**, MITM); and missing `PUBLIC_API.md` (AP-10 **HIGH**).
- **mgf-logship** — unbounded request body on the central collector's ingest/stats endpoints (**HIGH**, DoS).
- **mgf-vm-interchange** — `SECURITY.md` describes this untrusted-OVA/OVF parser as a no-I/O library (**HIGH**, wrong threat model).

---

### 3. Batching — 4 uplift waves

Grouped by family-similarity + near→far + template-fixability. Each wave runs the shared template/doc fixes as its spine, then the wave-specific per-repo work.

#### Wave 1 — Closers (near-L3; proves the template + regen)
**mgf-sqlalchemy, mgf-apiprobe, mgf-tele-core, mgf-auth, mgf-alembic**
Rationale: closest to L3, lowest effort; residual is dominated by the shared template fixes (A1/A2) plus tiny per-repo deltas — sqlalchemy+alembic pair on perf-baselines/TS-28 (data family), auth needs ~3 log lines (LG-11/SC-17, all SHOULDs N/A), tele-core needs a test-dir split (TS-01/20), apiprobe needs a body-cap + baselines. **Ship the template bump + fleet regen here first** to de-risk the regen for everyone. *Prereq: pull the supervisor perf module (F) forward for sqlalchemy/alembic.*

#### Wave 2 — Integration & web logging build-out
**mgf-http, mgf-livepush, mgf-logship, mgf-django, mgf-tele-teltonika**
Rationale: all share the LG-09/11/15/16 structured-logging cluster on network/request boundaries as their dominant per-repo blocker. **Build the shared logging helper + EVENTS.md pattern (C9) once, apply five times.** Pull logship's HIGH body-cap + SC-14 brute-force gaps forward (G). django adds CF-02 (settings precedence) + supervisor-on-full-matrix.

#### Wave 3 — vm-* domain core + consuming app
**mgf-vm-core → mgf-vm-sdk, mgf-hrb, mgf-vm-forensics, mgf-vm-interchange, mgf-vm-libvirt**
Rationale: vm-core first (Protocol anchor; unblocks firecracker). vm-sdk/interchange/libvirt share the *zero-logging vacuum* + the same contracts surface — apply Wave-2's proven logging/SC-17 pattern consistently. vm-interchange carries the HIGH `SECURITY.md` rewrite (G). hrb rides along as the consuming app (OP-01/05/06/07 commands, CF-09 `--config`, LG cluster). Heaviest per-repo wave.

#### Wave 4 — Structural / blocked
**mgf-vm-firecracker, mgf-test-supervisor, mgf-cloud-provision**
Rationale: not addressable until upstream lands. firecracker's ~40 MUSTs are deferred until vm-core stabilizes (Wave 3). test-supervisor is self-assessed below L2 (TS-01..27 self-conformance + AP surface) — but **its perf-schema slice is a Wave-1 prerequisite (F), so split it: ship perf schema ≥1.1.0 early, finish its own L3 last.** cloud-provision is Phase-1a with the full audit deferred — but its two HIGH items (PUBLIC_API.md authoring, SSL-disabled example) are **immediate must-fixes (G)** regardless of wave.

---

### 4. Single highest-leverage action

**Add the `mgf-fed app-doctor --standards` step to the canonical `templates/woodpecker/.woodpecker.yml` and run one fleet regen.**

Why this one, first:
- It is the **only** runtime gate missing, and it is missing in **all 19** repos — one template line + one regen (a pipeline you already run for the registry) closes the same gap everywhere.
- It is **unconditionally safe** — purely additive, with none of the prerequisites that gate WF-11 (devpi backfill) or supervisor-wiring (perf schema).
- Crucially, it is not just a checkbox: the doctor `--standards` check is the **standing automated guard for the fleet's most common MUST risk (pattern E — stale pins, stale trackers, overclaimed levels)**. Wiring it once stops the DOC-drift epidemic from recurring across all subsequent waves.

Then, because you are touching that file and regenerating anyway, **stage WF-11 (`uv sync --frozen`) and supervisor-on-full-matrix behind the same template bump** and ship them in the *same* regen the moment their prerequisites clear (devpi backfill; supervisor perf schema ≥1.1.0), to amortize the single fleet regen.

---

## Wave 1 execution log (2026-06-26)

### DOC-15 ledger-reconciliation recipe (PROVEN on mgf-apiprobe → app-doctor GREEN)
The fleet-uniform `app-doctor --standards` failure is **DOC-15**: every repo's
`docs/inprogress/MGF_STANDARDS_CONFORMANCE.md` is missing rows for the 4
recently-added MUSTs — **AG-17, AG-18, AG-19, WF-13**. Recipe (per repo):
add 4 rows in the existing table format —
- `AG-17` ✅ — `docs/memory/MEMORY.md` present.
- `AG-18` ✅ — `my_stuff/` git-ignored + `.githooks/prepare-commit-msg` hook present.
- `AG-19` N/A — no runtime auto-memory store yet (binds once one exists).
- `WF-13` ✅ — `.woodpecker.yml` is a generated artifact (header "GENERATED — do not hand-edit").

Statuses are confirmed per repo by `mgf-fed app-doctor --standards`'s own ✓ lines.
Then re-run app-doctor → DOC-15 passes (exit 0). **Wave 1 (apiprobe ✅ landed
recipe; sqlalchemy/tele-core/auth/alembic via the `wave1-doc15` workflow).**

### The app-doctor gate — coordinated rollout (the #1-leverage action)
`mgf-fed app-doctor --standards` exists and works (audits AP-*/DP-*/TS-*/DOC-*;
exit 2 on any fail). Wiring it into CI is an **atomic fleet event** (the
`.woodpecker.yml` is drift-checked against `mgf-standard/templates/woodpecker/base.yml`,
so the gate can't be added to a subset without the rest failing drift-check):
1. **Prereq — DOC-15 green fleet-wide** (the recipe above) so the gate passes everywhere. ← in progress (Wave 1 first)
2. Add the step to `templates/woodpecker/base.yml` — install `mgf-fed[cli]` from devpi, then `mgf-fed app-doctor --standards` (read-only, exit-coded).
3. Release **mgf-standard** (the template ships in its package; CI's drift-check resolves the installed template).
4. Regen every repo's `.woodpecker.yml` (`mgf-fed catch-up --apply`) + land — **bundle with WF-11 (`uv sync --frozen`, once devpi backfill clears) and supervisor-on-full-matrix in the SAME regen** to amortize the one fleet regen (per §4).

### Wave 1 per-repo deltas remaining (after DOC-15)
- apiprobe: response body-cap (SC) + perf `baselines.json` (PF-01/03/05).
- sqlalchemy + alembic: perf-baselines + TS-28 (needs the test-supervisor `perf` schema slice — a Wave-4 prerequisite to pull forward).
- auth: ~3 structured-log lines (LG-11/SC-17); all 8 SHOULDs already N/A.
- tele-core: test-dir split (TS-01/20).
