# STANDARDS_NOTE — `mgf-common` federation standards and `mgf-vm-interchange`

> **Status.** Target conformance: **L2 — Standard** (per D-H3).
> The per-rule ledger lives in
> [`docs/inprogress/MGF_STANDARDS_CONFORMANCE.md`](docs/inprogress/MGF_STANDARDS_CONFORMANCE.md).

## §1 Why L2

`mgf-vm-interchange` parses **attacker-controllable bundles** — an
OVA is a `tar` archive containing XML and disk images, all potentially
hostile. L2 is the right bar because:

- **The XML parsing seam is security-critical.** Per SH-03, every
  `ET.fromstring` / `ET.parse` goes through `defusedxml` (no billion-
  laughs, no XXE). L2 makes that mechanically enforced.
- **The tar extraction seam is security-critical.** Per SH-04 + SC-15,
  every extracted file path is validated against the destination root
  (`Path.resolve().is_relative_to(dest)`); symbolic links, absolute
  paths, and `../` traversal entries are rejected.
- **Spec translation is contract-shaped.** Output is typed
  (`ImportResult` / `ExportResult` carrying an `OVFDescriptor` +
  `VMHandle` today; a `VmSpec`-shaped surface is the Phase-0 target).
  L2's typing + AP-04 deprecation cycle protect consumers from silent
  schema drift.

## §2 Rules that apply non-trivially here

- **SC-15 (path traversal).** Hard rule. Every entry in an OVA tar
  is validated before extraction. Symbolic links rejected entirely.
- **SH-03 (defusedxml).** Every OVF XML parse path uses `defusedxml`
  (carried from vm-vmanager-app's hardening corpus).
- **SH-04 (safe-tar).** The tar extraction helper enforces:
  - resolved destination path is inside the extraction root,
  - no symlinks,
  - cumulative size bound (resists zip-bomb-style OVAs).
- **DP-13 (deterministic cleanup).** Tar handles, temp directories,
  parsed XML trees — all in context managers or try/finally.
- **EH-02 (translate at seam).** `tarfile`, `defusedxml`, and
  provider errors raise their own exceptions; translate at the
  import/export boundary to `mgf.vm.exceptions.ImportExportError`
  (chained with `from`).
- **LG-04 (log redaction).** OVF can contain arbitrary metadata
  strings; redact before logging.

## §3 What this library does NOT enforce

- **CF-** — N/A. Library, no application config.
- **SC-02 / SC-06 / SC-07** — N/A (no subprocess, no outbound calls).
- **EH-04** — N/A (library, not entry point).

## §4 How this file evolves

Same discipline as the other federation siblings.
