# DEPS — mgf-vm-interchange's bidirectional dependency manifest

> **§1** — what mgf-vm-interchange depends on. **§2** — who depends on
> mgf-vm-interchange. Knowing both directions makes deprecation,
> breaking-change blast-radius, and feature-prioritisation tractable.
>
> **Per standard DOC-16** (v2.12): every project ships a `DEPS.md`.
> Replaces the former `USERS.md`.

Last verified: 2026-06-09.

---

## §1 What mgf-vm-interchange depends on

| Dependency | Window | Why | Tier |
|---|---|---|---|
| `mgf-common` | `>=0.41,<0.43` | typed exceptions / bootstrap / observability (`operation_span`) | runtime (sibling) |
| `mgf-vm-core` | `>=0.1.9,<0.2` | `mgf.vm.core.{domain,exceptions,common.safe_tar,common.progress}` | runtime (sibling) |
| `defusedxml` | `>=0.7,<0.8` | mandatory safe OVF XML parse (SH-03) — input is attacker-controlled | runtime |

*Federation siblings depended on: `mgf-common` (cornerstone) and
`mgf-vm-core`. ✅ **Drained off the `mgf-vm` umbrella on 2026-06-05 (v0.2.0);
the umbrella is now RETIRED & DELETED.** The OVF/domain XML parsers
(`parse_xml_string` / `parse_xml_file`) are owned locally in
`interchange._xml` — they need `defusedxml`, which `mgf-vm-core`'s import-linter
purity contract forbids, so they cannot live in core. The disk-format converter
is caller-injected (`convert_fn`, REQUIRED since 0.2.0) — the interchange no
longer bundles a qemu-img wrapper. The shipped surface returns
`importer.ImportResult` / `exporter.ExportResult` (carrying an
`mgf.vm.core.domain.VMHandle` + `OVFDescriptor`).*

Runtime core is kept tight. The dev-only tooling (`pytest`,
`hypothesis`, `ruff`, `mypy`, `import-linter`) lives in the `[dev]`
extra.

---

## §2 Who depends on mgf-vm-interchange

Consumer projects + federation siblings that import this project.
(Inverse of each consumer's `MGF_ADOPTION.md`.)

| Project / sibling | Location | Import sites | Status | Surfaces used |
|---|---|---:|---|---|
| **vm-vmanager-app** (consumer) | `/home/bassam/PycharmProjects/vm-vmanager-app` | (verify) | Designed-for | `import_ova` / `export_ova` powering `vmanager image import/export` |

*Import survey 2026-05-29: `mgf-vm` does **not** import
`mgf.vm.interchange` outside the subpackage itself (0 sites) — it
**ships** the subpackage (extraction not yet completed there) but does
not consume it. `mgf-vm-forensics` also has 0 sites. No published
sibling currently imports this library; the intended consumer is the
vm-vmanager-app control plane.*

---

## §3 Maintenance

Updated every MINOR release + when a dependency or consumer changes.
Import-survey methodology:

```sh
grep -rE "(from|import) +mgf\.vm\.interchange" /path/to/each/consumer \
  --include='*.py' | wc -l
```
