# Item 1b — the L3 uplift (scoping)

> Phase 1b of Item 1: uplift every repo **L2 → L3**. This is **not** mechanical
> (unlike 1a). Durable scoping; the plan + methodology live here.

## What L3 actually requires
`FEDERATION.md` §4 / `CFM-02`: **L3 = every MUST + every SHOULD + run-time
enforcement (audit-logs, redaction) wired up.** Concretely, vs L2:
- **All MUST rules** — *evidence-verified*, not just declared (see "the hard truth").
- **The 8 SHOULD rules** (the entire SHOULD set): `NM-04`, `NM-05` (NAMING),
  `OB-06` (OBSERVABILITY), `PF-06` (PERFORMANCE), `PR-02`, `PR-06` (PRESENTATION),
  `TM-05`, `TM-06` (TIME). *(263 MUST + 8 SHOULD = 271 anchored rules.)*
- **Run-time enforcement** — redaction key-sets, per-attempt audit logging, the
  gate stack (ruff + mypy --strict + import-linter + tests 3.11–3.13 + coverage
  + gitleaks + pip-audit + `app-doctor --standards`).

## The hard truth: **no repo is at L3 today**

> **UPDATE 2026-06-27:** stale — **`mgf-common` (1b-0) and `mgf-cloud` are now L3**;
> 1b-1 (high-stakes) + Wave 1 landed. Waves 2–4 (the long tail) remain. The
> original framing below is kept for context.
>
> **UPDATE 2026-06-28 — Wave 2 progress.** Built **cloud + cloud-provision L3
> ledgers** via a multi-agent workflow (18 agents: family fan-out + adversarial
> refute → complete per-MUST ledgers; the methodology below, validated) → DOC-15
> fleet-green. **A1 SHIPPED:** the `mgf-fed app-doctor --standards` gate added to
> `templates/woodpecker/base.yml` + fleet `.woodpecker` regen — the universally
> -missing L3 runtime gate is now enforced fleet-wide. NEXT per
> [`item1b-2-readiness.md`](item1b-2-readiness.md) §2: B6 doc-pin sweep, A4
> PUBLIC_API complexity column (PF-06), C9 per-repo LG logging build-out.
- **`mgf-common`** — the *only* repo that even *declares* L3 — is by its own
  ledger **"L2-in-progress, not yet L3"**: 181/183 applicable MUSTs evidenced
  (**2 open**: `EH-11` retry primitive, `WF-11`), and the 8-SHOULD set + full
  runtime still ahead.
- **Every other repo declares L2** — but "L2" there means *declared*, mostly
  from a lighter pass, **not** the evidence-based depth audit. Their true MUST
  standing is unverified.

So "all libraries at L3" = reaching a bar **nobody has hit**, including the
cornerstone. This is a large, multi-session (likely multi-month) program — an
order of magnitude beyond 1a.

## The methodology (proven by mgf-common's 2026-06-07 audit)
Per repo, an **evidence-based per-rule audit**: a **16-family auditor fan-out**
(one per standards family) producing ✅/🚫/⏳/N-A with **`file:line` evidence**
for every verdict, then an **adversarial refute pass on every ✅**
(anti-rubber-stamp). Then close the gaps, add the 8 SHOULDs, wire runtime.

→ This shape is a **textbook multi-agent workflow** (fan out auditors per family,
verify adversarially, synthesize). 1b execution is the strongest candidate in
this whole program for the **Workflow** tool — *with explicit opt-in* (it spawns
dozens of agents per repo × 30 repos).

## Recommended sequencing
1. **1b-0 — Finish `mgf-common` to TRUE L3** (the reference). ✅ **DONE 2026-06-25**
   (mgf-common PRs #56 + #57): shipped `EH-11` (`mgf.common.retry` — §13.1 primitive,
   11 tests/100% cov), audited all **8 SHOULDs** (met/N-A/justified), confirmed
   runtime. **`WF-11` is the lone carry-over** — see Fleet-infra below (it's
   template-owned + devpi-gated, not a mgf-common defect). mgf-common is now the
   L3 reference the rest of the fleet copies.
2. **1b-1 — Depth-audit + uplift the high-stakes repos**: `mgf-fed` (orchestrator),
   `mgf-cloud` (holds cloud creds), `mgf-fastapi` (web surface), the `mgf-vm-*`
   that run real workloads. These are where strict conformance matters most.
3. **1b-2 — The long tail** (the remaining siblings), batched by family-similarity.

## Open inputs to wire (when 1b starts)
- A **per-repo L3 conformance ledger** generator (extend `MGF_STANDARDS_CONFORMANCE.md`)
  with the SHOULD set + runtime checklist + evidence columns.
- The 8 SHOULD rules' exact text (read `NAMING/OBSERVABILITY/PERFORMANCE/
  PRESENTATION_LAYER/TIME.md` — they're `indexed=False`, so not in `rules.json` text).
- Decide: drive 1b with multi-agent audit workflows (opt-in) or sequential per-repo.

## Fleet-infra carry-overs (tracked here)
- **WF-11 — CI install via `uv sync --frozen`** (the lockfile, not pyproject
  ranges). The blocker that keeps the *whole fleet* (incl. mgf-common) off the
  WF-11 bar. It's a **template change** (`templates/woodpecker/`) + a fleet
  regen — `.woodpecker.yml` is generated + drift-checked, so no repo can adopt
  it unilaterally. **Gated on the devpi backfill gap** (`uv sync --frozen`
  resolves for mgf-common alone, but the full-graph fleet lock does not — see
  [[devpi-backfill-gap-blocks-uv-parity]]). The proper fix: backfill devpi →
  template `uv sync --frozen` → regen all repos. This is the one thing between
  mgf-common (and the fleet) and an *unqualified* WF-11 ✅.

## Carry-over from 1a (L3-relevant quality)
- **`mgf-fed` C1** closed-box: Tier-1 done (PR #46); **Tier-2** (`_io.atomic_write`
  ×12 etc.) needs a mgf-common public-API paper → fits 1b-1.
- **`mgf-fed` C2**: v0.1 → `bootstrap()` migration.
- These are AP-14 / DP-13 MUST-adjacent — fold into the per-repo L3 audit.
