# DEPS — bidirectional dependency manifest

> **Rule DOC-16.** §1 = what this project depends on; §2 = who depends on
> this project. Verified by import survey before every MINOR release.

`mgf-standard` is the federation's **standards / contract / registry
source of truth**, shipped as a tiny zero-dependency data package
(`mgf.standard`). It is the **leaf-of-leaves**: it depends on nothing
in the `mgf.*` namespace, and (transitively, through `mgf-common`) the
entire federation depends on it.

---

## §1 — What this project depends on

### Runtime

**Nothing.** `mgf.standard` is pure-stdlib (`importlib.resources` +
`pathlib`). It has **zero** `mgf-*` runtime deps and **zero** third-party
runtime deps. This is load-bearing: it keeps the federation dependency
graph acyclic (`mgf-standard` sits below `mgf-common`, which depends
on it). The invariant is pinned by `.importlinter`
(`standard-is-the-federation-leaf`).

### Build

| Dependency | Pin | Why |
|---|---|---|
| `hatchling` | `>=1.21` | Build backend; force-includes `docs/standards/` as wheel data. |

### Dev (`[project.optional-dependencies].dev`)

| Dependency | Pin | Why |
|---|---|---|
| `pytest` | `>=8.0,<10` | Test runner (plain pytest — see the TS-23 carve-out below). |
| `pytest-cov` | `>=5.0,<8` | Coverage. |
| `ruff` | `>=0.4,<1` | Lint + format gate. |
| `mypy` | `>=1.10,<2` | `--strict` typecheck gate. |
| `import-linter` | `>=2.0,<3` | Layering gate (keeps the package a leaf). |

> **CFM-04 carve-out (TS-23).** This repo deliberately does **not**
> dev-depend on `mgf-test-supervisor`. That edge would be
> `mgf-standard → mgf-test-supervisor → mgf-common → mgf-standard`
> — a cycle the REL-13 registry generator would record (it reads `mgf-*`
> deps from optional groups too). The test surface here is trivial (the
> resolver + the moved registry-generator test), so we run plain pytest and
> keep the graph clean. See `docs/inprogress/MGF_STANDARDS_CONFORMANCE.md`.

---

## §2 — Who depends on this project

| Dependent | Kind | How | Surfaces used |
|---|---|---|---|
| [`mgf-common`](https://codeberg.org/magogi-admin/mgf-common) | cornerstone library | **runtime** dependency (`mgf-standard>=0.1,<0.2`) | `mgf.standard.standards_dir()` — surfaced through the `mgf-fed standards` / `mgf-fed agents` CLI |
| **every `mgf-*` sibling** | libraries | **transitive** (each depends on `mgf-common`) | the standards corpus + the contract they conform to |
| **every consumer application** | apps | **transitive** (via `mgf-common` + siblings) | the rules they're audited against |

In other words: `mgf-common` is the **only direct** dependent, but because
every federation project depends on `mgf-common`, this package is
transitively in the dependency closure of the **entire** federation. A
breaking change here (a removed/renamed public symbol in `mgf.standard`,
or a corpus-resolution change) has federation-wide blast radius — treat the
`mgf.standard` public surface (`standards_dir` / `list_standards` /
`read_standard` / `recipes_dir` / `list_recipes` / `read_recipe` /
`libraries`) as a stable contract and version it per AP-03/AP-04.

The authoritative, always-current map of the whole federation is
[`MGF_LIBRARIES.md`](MGF_LIBRARIES.md) (generated by
`scripts/gen_mgf_libraries.py`, REL-13).
