# DEPS — mgf-fed-web's bidirectional dependency manifest

> **§1** — what mgf-fed-web depends on. **§2** — who depends on it.
> **Per standard DOC-16:** every project ships a `DEPS.md` at repo root.

Last verified: 2026-06-29.

## §1 What mgf-fed-web depends on

This distribution **is** the federation dashboard web GUI, so the FastAPI stack is a
**core** dependency (not an extra), matching `mgf-cloud-app`'s shape. All the read / sync
/ live logic comes from the `mgf-fedres` spine; the presentation tokens + instrument
layer come from `mgf-brand-web`.

| Scope | Dependency | Why |
|---|---|---|
| runtime | `mgf-fedres>=0.1,<0.2` | the spine — schemas + version-aware reader + sync engine + `SourceProvider` seam + live NDJSON + run-records; **all** the read/sync/live logic |
| runtime | `mgf-brand-web>=0.2,<0.3` | the brand tokens + operator-instrument CSS layer, mounted at `/static/brand` (consumed, not vendored) |
| runtime | `fastapi>=0.110` | the web framework (this distribution is the GUI, so it is core) |
| runtime | `uvicorn>=0.29` | the ASGI server behind the `mgf-fed-web` console entry |
| runtime | `jinja2>=3.1` | server-side templates for the lenses + readout views |
| `standards` | `mgf-common[standards]>=0.47,<0.50` | standards corpus for the federation CLI checks (dev/opt) |
| `dev` | pytest, pytest-cov, pytest-timeout, ruff, mypy, httpx | the green gates + the FastAPI `TestClient` (httpx) |

No direct `jsonschema` dependency: validation is the spine's job (`mgf-fedres` brings it
transitively); this tool consumes the reader, never re-validates.

## §2 Who depends on mgf-fed-web

| Project | Status | Surfaces used |
|---|---|---|
| _(none)_ | — | `mgf-fed-web` is a **leaf** — an operator-run web tool with no library consumers |

It is the leaf of a small sub-stack:
`mgf-brand-web` → `mgf-fedres` → **`mgf-fed-web`**. The sibling `mgf-test-web`
(ProofWarden) sits on the same spine but does not depend on this tool. As a leaf, the
spine + brand kit must publish before this tool can pin them.

## §3 Maintenance

Updated every MINOR release + when a dependency it consumes (`mgf-fedres`,
`mgf-brand-web`) publishes a new MINOR (re-pin) or a `schema_version` bump walks here
(DOC-18), and recorded in `CHANGELOG.md`.
