# Magogi Foundation Standards — Conformance Tracker (mgf-fed-web)

> **Status (2026-06-29).** Initial conformance audit at **0.1.0** — the **skeleton**
> stage. `mgf-fed-web` is the **federation dashboard** — a read-mostly FastAPI + Jinja
> web tool that composes + displays the `fed-resources/generated/` state the `mgf-fedres`
> spine produces. Today the repo holds **only the DOC-01 documentation baseline + the
> packaging shape** (the `mgf.fed_web` namespace package + the hatchling FastAPI/Jinja
> distribution). **The app itself — routes, templates, the 8 lenses, the sync matrix UI,
> the feedback loop, Follow-live — is Phase B / M2+ and not yet built.** This ledger is
> honest about that: the doc / scope / naming / packaging-declaration rows land ✅; the
> code-quality + CI + release rows that need the M2+ implementation are tracked ⏳ (§4);
> the service / deploy / metrics / Qt-GUI / perf rows are N/A by shape.
> **Scope.** mgf-fed-web's conformance to the standards at
> [mgf-standard/docs/standards/](https://codeberg.org/magogi-admin/mgf-standard/src/branch/main/docs/standards/).
> **Audience.** Maintainer-tomorrow, AI coding agents, future contributors.
> **Cross-references.** [README.md](../../README.md), [SCOPE.md](../../SCOPE.md),
> the spine's [planning specs](https://codeberg.org/magogi-admin/mgf-fedres/src/branch/main/docs/planning/).

---

## §1 You are here

**Project shape:** a **local, single-user web GUI** (`mgf.fed_web`) — a thin FastAPI +
Jinja presentation layer over the `mgf-fedres` spine, rendered with the `mgf-brand-web`
instrument kit. It is **read-only on project state** (it composes + displays `generated/`,
tags what it computes `derived`, and never authors project facts), binds `127.0.0.1`, has
no auth, and is operator-run on a maintainer's own machine — **not** a deployed,
page-able, multi-user service. All read / sync / live logic lives in the spine; this
distribution owns only the app, routes, templates, and the brand mount. That shape decides
which rules apply (the presentation + app-lifecycle families) and which are N/A (the
deployed-service, Qt-desktop-GUI, metrics, and perf families).

**Current version:** **0.1.0** (Development Status :: 2 — Pre-Alpha). `__version__` is a
literal in `mgf.fed_web.__init__` + `pyproject.toml::project.version` (in agreement;
single-sourcing + the `app-doctor` AP-13 check land with the scaffold — §4).

**Declared conformance level: L1 (structural baseline). Target: L2.** Current standing:
the DOC-01 doc baseline + the packaging shape are in place, the `[tool.ruff]` /
`[tool.mypy --strict]` / `[tool.pytest]` / `[tool.coverage]` config is mirrored from the
spine and green on the skeleton, and naming / scope / feedback / agent docs land ✅. The
FastAPI app, the test suite, CI, and the release pipeline are **not yet built** — this is
an honest pre-implementation L1, not a seeded-from-sibling all-green facade.

**Per-MUST tally (§Z).** Of the **263 MUSTs**: **51 ✅** · **111 ⏳** · **101 N/A** ·
**0 🚫**. Applicable (non-N/A) = **162**; **51/162 (31%)** evidenced ✅. The low ✅ /
high ⏳ split is the truthful skeleton picture: what the docs + scaffold provide is ✅;
the **111 ⏳** are the M2+ FastAPI app (the lenses / sync UI / feedback / live and the
DP/EH/LG/CF/PR/SC-runtime/AP-surface/OP-verb/TS rows they evidence) + the tool-driven
scaffold (CI ×13, AG-03 hooks, `PUBLIC_API`) + release/publish (REL/PKG) — each tracked
in §4.

| Marker | Meaning here |
|---|---|
| ✅ | conformant against the committed skeleton (docs / scope / naming / packaging / config) — evidence in §Z |
| ⏳ | applicable MUST not yet met — open gap with a plan (§4); the M2+ app build + the tool-driven scaffold + release |
| N/A | rule's premise is deployed-service / Qt-GUI / metrics / perf / async-shaped; mgf-fed-web is a read-only local web tool |
| 🚫 | declined-with-rationale (CFM-04) — none currently |

---

## §2 Per-standard audit (corpus 263 MUSTs / 22 families)

| Family | MUSTs | Verdict | Notes (evidence: §Z) |
|---|---|---|---|
| **DP** DESIGN_PRINCIPLES | 13 | ✅ / ⏳ / N/A | `mypy --strict` green on the skeleton + `from __future__` (DP-04), the read-only / honest-absence design centre + the spine's `SourceProvider` replaceability documented (DP-06/08), no naive datetime / DTZ on (DP-12). ⏳ the web/core layering + import-linter + frozen view-models + honest-absence renderers (M2+). Async N/A. |
| **EH** ERROR_HANDLING | 13 | ⏳ / N/A | The typed-error vocabulary + the `bootstrap()` top-level handler + boundary translation land with the M2+ app (⏳). No Qt workers / retries / multi-attempt load (N/A). |
| **LG** LOGGING | 17 | ⏳ / N/A | The logging pillar (`getLogger(__name__)` + `bootstrap()` at the `serve` entry) lands with the M2+ app (⏳). No desktop GUI (LG-07), not a headless service (LG-10), no high-freq/correlation/fingerprint surface (LG-13/14/17 N/A). |
| **CF** CONFIGURATION | 12 | ⏳ / N/A | A typed `Settings` (project roots + bind address) + precedence + inject-by-arg land with the app (⏳). No owned versioned config schema / secrets / sub-config / backend variants (N/A — read-only dashboard handles no secrets). |
| **SC** SECURITY | 18 | ✅ / ⏳ / N/A | `SECURITY.md` (SC-12). ⏳ argv subprocess to the `fedres` CLI, path-traversal validation, input validation, the lock/pip-audit + reproducible build (M2+/pipeline). No secrets / crypto / outbound TLS / auth (N/A). |
| **TS** TESTING | 28 | ✅ / ⏳ / N/A | `filterwarnings=error`, strict markers/config, coverage floor 80, the 13-marker taxonomy (TS-04/05/06/19 — pyproject mirrored). ⏳ the whole suite + the mirror / partition / smoke / supervisor stack (M2+). No GUI / perf / native artefact (N/A). |
| **AP** API_DESIGN | 15 | ✅ / ⏳ / N/A | `__all__`, `from __future__`, `py.typed`, SemVer, no internal-module leakage (AP-01/08/09/03/14). ⏳ the M2+ public surface docstrings + `PUBLIC_API` + AP-13 single-sourcing. No deprecations yet (N/A). |
| **SP** SCOPE | 6 | ✅ | SCOPE.md (FW-01..06): the presentation layer IN; spine logic / brand kit / state-authoring / warden / fleet orchestration / standards corpus OUT with owners cited. |
| **WF** WORKFLOWS | 13 | ⏳ | **No `.woodpecker.yml` yet.** CI is the tool-driven `mgf-fed scaffold` step (the generated library pipeline + commit-trailers + gitleaks + `app-doctor` + the freshness fragment). §4. |
| **REL** RELEASING | 13 | ⏳ / N/A | Not yet released (0.1.0 unpublished, no tags); the release flow lands with the publish pipeline (REL-01..09 ⏳). Cohort/phase/registry rules N/A (new leaf; orchestrator-owned). |
| **PKG** PACKAGE_DISTRIBUTION | 12 | ✅ / ⏳ / N/A | Hatchling, `py.typed`, dotted-name mapping, mgf-* deps resolve from the devpi `[tool.uv]` index, no pypi.org surface (PKG-06/10/12 ✅). Publish/verify chain ⏳ (no pipeline); index-operator rules N/A. |
| **DOC** DOCUMENTATION | 19 | ✅ / ⏳ / N/A | Full DOC-01 root baseline + `docs/` tree + this ledger (DOC-15) + DEPS/FEDERATION/LESSON_LEARNED/CLAUDE/memory. ⏳ DOC-03 (bucket charters) + DOC-08 (`PUBLIC_API`, tool-driven). |
| **OP** OPERABILITY | 12 | ✅ / ⏳ / N/A | `[project.urls]` no placeholders (OP-03), honest README (OP-04). ⏳ version/doctor/explain/bundle verbs + the `app-doctor` gate (M2+/CI). Service-guard rules N/A. |
| **DEP** DEPLOYMENT | 11 | N/A | Operator-run local tool, not a deployed service (no systemd unit / container image / deploy pipeline of its own). |
| **PR** PRESENTATION_LAYER | 5 | ⏳ | The UI is the whole point — but the templates / lenses / the web↔core import-linter contract are all M2+. The design (logic in the headless spine; FastAPI only at the web edge) satisfies PR-01; enforcement lands with the app. §4. |
| **AG** AGENTS | 19 | ✅ / ⏳ / N/A | AGENTS.md + CLAUDE.md + docs/memory + the `[standards]` extra (AG-01/12/16/17), AG-14 propagation (docs + ledger walked together). ⏳ AG-03 (trailer hook + CI gate) + AG-18 (`.gitmessage`/`.githooks`). Session-conduct rules N/A. |
| **TM** TIME | 6 | ✅ / N/A | No naive datetimes in the skeleton; ruff DTZ on; wire timestamps are the spine's RFC-3339 (TM-01/02). No duration / clock-dependent / async / IANA usage yet (N/A). |
| **PF** PERFORMANCE | 7 | N/A | I/O-bound local tool (reads local trees, shells to `fedres`); no in-process hot path / budget to baseline. |
| **OB** OBSERVABILITY | 10 | ⏳ / N/A | The logs + traces pillars (via `bootstrap()`) land with the M2+ app (OB-01/04/09/10 ⏳). No metrics / SLI / alert surface (N/A — not a page-able service). |
| **NM** NAMING | 3 | ✅ | `mgf-fed-web` dist → `mgf.fed_web` import → `mgf-fed-web` slug; PEP-420 (no `src/mgf/__init__.py`). |
| **GUI** GUI_CONSUMERS | 10 | ✅ / N/A | Imports no Qt (GUI-01); the GUI is a server-rendered local web page, not a Qt desktop app (rest N/A). |
| **FB** FEEDBACK | 1 | ✅ | FEEDBACK.md present + the dashboard-vs-spine-vs-brand-vs-federation routing documented (FB-05). |

---

## §3 Decline-with-rationale ledger (CFM-04)

None. `mgf-fed-web` declines no rule. Rules whose premise its read-only-local-web-tool
shape doesn't bind are read **N/A** (with a per-row rationale in §Z), not declined. The
gaps that DO apply are tracked ⏳ in §4, not declined.

---

## §4 Open gaps — tracked with a plan (⏳)

Most open items are the **M2+ FastAPI app build** (Phase B per the spine's `PLAN.md`) plus
the **tool-driven federation-conformance bundle** (`mgf-fed scaffold` / the generated CI
template) + the release pipeline — not hand-authored defects. They land as the dashboard
is built on top of the published spine.

| Cluster | Rules | Status |
|---|---|---|
| **The M2+ FastAPI app** | DP-01/02/03/05/07/10/13, EH-01..05/07/08/09/10, LG (the pillar), CF-01/02/06/08/09/10, PR-01/03/04/05/07, SC-02/03/07/08/15, AP-02/05/06/07, TS (the suite), OB-01/04/09/10 | ⏳ **Not yet built.** The shell + the 8 lenses + the sync UI + the feedback loop + Follow-live (Phase B / M2–M6). These rows are re-evidenced against real code as each milestone lands; the entry points wire `mgf.common.bootstrap()` (EH-04 / LG / OB-01) and the web/core split is import-linter-enforced (DP-01 / PR-04). |
| **CI pipeline** | WF-01..13 | ⏳ **Tool-driven.** No `.woodpecker.yml` yet; it is the generated `mgf-fed._woodpecker` base.yml + commit-trailers / gitleaks / `app-doctor --standards` / the freshness fragment, applied by `mgf-fed scaffold mgf-fed-web` (WF-13). |
| **Release / publish** | REL-01..09, PKG-01..05/09 | ⏳ Not yet released (no tag/publish). The tag-driven devpi publish + verify lands with the CI pipeline. PKG-01 is the fleet-wide devpi-vs-Codeberg channel reconciliation (governance, not owned here). |
| **Public API surface** | AP-10, AP-11, DOC-08 | ⏳ **Tool-driven.** `tools/generate_public_api_json.py` is present (adapted for `mgf.fed_web`) but not run — `PUBLIC_API.json`/`.md` + the drift pin are generated/applied by the scaffold step once the surface grows beyond `__version__`. |
| **Version single-sourcing** | AP-13 | ⏳ `__version__` is a literal in `__init__.py` + `pyproject` (in agreement); single-source from metadata + add the version-in-sync test (and the `app-doctor` AP-13 check). |
| **Operability verbs** | OP-01/02/05/07 | ⏳ version / doctor / explain / bundle — arrive with the M2+ console entry + the `app-doctor` per-repo gate. |
| **Test maturity** | TS-01/02/03/07..13/16/17/20..25/27 | ⏳ No tests yet; the src↔test 1:1 mirror + the four-dir partition + the smoke test + the FastAPI `TestClient` suite + `mgf-test-supervisor` adoption land with the app. |
| **AG-03 git scaffolding** | AG-03, AG-18 | ⏳ The `.gitmessage` + `.githooks/prepare-commit-msg` + `check_commit_trailers.py` + the CI commit-trailers gate are the byte-exact scaffold files (tool-driven). `.gitignore` (incl. `my_stuff/` + `fed-resources/live/`) is already present. |
| **Docs polish** | DOC-03 | ⏳ Bucket `README.md` charters for `docs/claude/`, `docs/memory/`, `docs/inprogress/`. |
| **Supply chain** | SC-10, SC-18 | ⏳ A committed hash-pinned lock + `pip-audit` (CI) and the build-once release invariant land with the pipeline (rides the fleet devpi-backfill gap). |

**Registration note.** `mgf-fed-web` is **not yet registered** in
`mgf-standard/MGF_LIBRARIES.{json,md}` (REL-13 is a release-time gate run from the
mgf-common supervisor, not a per-repo CI step). Registration + the DOC-18 ripple are
tracked at mgf-standard, after the spine + this tool publish.

---

## §SHOULD — the indexed SHOULD rules

L3 requires every SHOULD met or justified. The corpus indexes 8 SHOULDs:

| Rule | Verdict | Evidence |
|---|---|---|
| **NM-04** | N/A | Operator-chosen local clone layout; never appears in an artifact (it is cloned to its slug). |
| **NM-05** | ✅ | No junk-drawer modules — the only module is `mgf/fed_web/__init__.py`; zero `utils/misc/helpers`. The M2+ app will keep domain-named modules (`web/`, the lens renderers). |
| **OB-06** | N/A | SLI→SLO targets are for a page-able service; mgf-fed-web is an operator-run local tool. |
| **PF-06** | N/A | No medium-agnostic perf-doc surface; the public surface is trivial (skeleton) and the render cost is the spine read + template render, not a non-obvious algorithm. |
| **PR-02** | ✅ | "2+ UI consumers → a dedicated `-app` repo" — mgf-fed-web **is** that dedicated web-tool repo for the federation dashboard, separate from the headless spine and from the sibling `mgf-test-web` console. |
| **PR-06** | N/A | No medium-agnostic `fmt` helpers exposed; rendered output goes through Jinja templates (M2+). |
| **TM-05** | ⏳ | User-facing datetime display happens at presentation — it lands with the lenses (M2+); the core carries the spine's UTC-aware RFC-3339 strings unchanged. §4. |
| **TM-06** | N/A | No OTel-trace ns timestamps of its own; wire timestamps follow the federation ISO-8601 contract. |

**Result: 7/8 met / N-A; TM-05 ⏳** (the presentation-layer SHOULD, pending the M2+ build).
The remaining L3 distance is the §4 ⏳ clusters (the app, CI, release, the test-maturity +
operability surface), not an open declined SHOULD.

---

## §5 Audit log

| Date | Auditor | Trigger | Findings |
|---|---|---|---|
| 2026-06-29 | DOC-01 baseline author | new-sibling bootstrap — author the documentation baseline + stand up the conformance ledger (DOC-15 / CFM-03) for the skeleton | **Full per-MUST §Z built** — all 263 MUSTs carry a Rule · Verdict · Evidence row in the `_status.py`-parseable `\| Rule \| Verdict \| Evidence \|` format. Honest skeleton tally **51 ✅ / 111 ⏳ / 101 N/A / 0 🚫** (162 applicable, 31%). Declared **L1 (structural baseline)**, target L2. No app code exists — docs + packaging shape only. The ⏳ set is the M2+ FastAPI app (the lenses/sync/feedback/live) + the tool-driven scaffold (CI / `PUBLIC_API` / AG-03 hooks) + release, each tracked in §4. |

---

## §6 Cross-references

- [`mgf-standard/docs/standards/`](https://codeberg.org/magogi-admin/mgf-standard/src/branch/main/docs/standards/) — the corpus this audits against (263 MUSTs / 8 SHOULDs).
- [`mgf-fedres/docs/planning/mgf-fed-web/`](https://codeberg.org/magogi-admin/mgf-fedres/src/branch/main/docs/planning/mgf-fed-web/) — the authoritative spec + brief + dashboard wireframe.
- [`mgf-fedres/docs/planning/PLAN.md`](https://codeberg.org/magogi-admin/mgf-fedres/src/branch/main/docs/planning/PLAN.md) — the approved end-to-end plan (this tool = Phase B).
- [`../../SCOPE.md`](../../SCOPE.md) — IN/OUT (FW-01..06).
- [`../../DEPS.md`](../../DEPS.md) — deps + dependents (DOC-16).
- [`../../FEDERATION.md`](../../FEDERATION.md) — the contract (DOC-17).
- The mgf-common reference ledger: [`mgf-common/docs/inprogress/MGF_STANDARDS_CONFORMANCE.md`](https://codeberg.org/magogi-admin/mgf-common/src/branch/main/docs/inprogress/MGF_STANDARDS_CONFORMANCE.md).

---

## §Z Per-MUST evidenced audit — all 263 MUSTs (DOC-15 / CFM-03 completeness)

> Every one of the 263 corpus MUSTs carries a row. Columns: Rule · Verdict
> (✅ / ⏳ / 🚫 / N/A) · Evidence/rationale. ⏳ rows are tracked in §4. Evidence cites
> the committed skeleton (`src/mgf/fed_web/__init__.py`, `pyproject.toml`, the DOC-01
> docs); rows that need the M2+ FastAPI app are noted "M2+, not yet built".
> **Tally: 51 ✅ · 111 ⏳ · 101 N/A · 0 🚫** (162 applicable).

| Rule | Verdict | Evidence |
|---|---|---|
| DP-01 | ⏳ | The web-thin-over-spine layering + the `web`↔`cli` import-linter contract are M2+; the spine/presentation split is the design centre (SCOPE FW-01/02). §4. |
| DP-02 | ⏳ | The I/O seam is the spine's `SourceProvider` ABC (`DiskProvider`/`PackageProvider`), consumed at M2; no own I/O code yet. §4. |
| DP-03 | ⏳ | Frozen view-models / DTOs across the render boundary land with the lenses (M2+). §4. |
| DP-04 | ✅ | `pyproject [tool.mypy] strict=true` (mirrored from the spine) is green on the skeleton; `from __future__ import annotations` in `__init__.py`; every M2+ signature is gated. |
| DP-05 | ⏳ | The unit suite (no creds/network/daemon — FastAPI `TestClient` over a temp `generated/` tree) lands with the app (M2+). §4. |
| DP-06 | ✅ | The read-only / honest-absence / generated-not-asserted design centre is recorded in README + SCOPE + CLAUDE (inherited from the spine) — reliability/correctness first, by design. |
| DP-07 | ⏳ | Module + public-function docstrings land with the app (only the package docstring exists today). §4. |
| DP-08 | ✅ | Replaceability documented — consumes the spine's `SourceProvider` (disk→package) seam + the `schema_version` contract; design in SCOPE / DEPS / README. |
| DP-09 | N/A | No long-running cancellable operations. |
| DP-10 | ⏳ | No-silent-fallback (honest-absence) is the contract; the renderers that surface `UNKNOWN`/`UNREADABLE`/`STALE` from the spine are M2+. §4. |
| DP-11 | N/A | No async tasks / `asyncio.create_task` (none at skeleton). |
| DP-12 | ✅ | No naive datetimes in the skeleton; ruff `DTZ` selected (`pyproject`); wire timestamps are carried from the spine. |
| DP-13 | ⏳ | Deterministic resource release (request / file / subprocess handles) lands with the app (M2+). §4. |
| EH-01 | ⏳ | The typed app-exception vocabulary (onto `mgf.common.exceptions.AppError`) lands with the app (M2+). §4. |
| EH-02 | ⏳ | Boundary translation (spine/filesystem/subprocess errors → typed) lands with the app (M2+). §4. |
| EH-03 | ⏳ | `raise … from` cause chaining lands with the app's error paths (M2+). §4. |
| EH-04 | ⏳ | The entry-point top-level handler via `mgf.common.bootstrap()` lands with the M2+ `serve` entry (as `mgf-cloud-app` does). §4. |
| EH-05 | ⏳ | Unhandled-exception crash reporting (`report_now` via `bootstrap()`) lands with the M2+ entry. §4. |
| EH-06 | N/A | No GUI worker threads (server-rendered web page, not Qt). |
| EH-07 | ⏳ | The "no bare `except Exception`" discipline is verified once the app has error paths (M2+; the skeleton has none). §4. |
| EH-08 | ⏳ | Machine-readable fields on typed exceptions land with EH-01 (M2+). §4. |
| EH-09 | ⏳ | Actionable error context (the one action that fixes it) lands with the honest-absence renderers (M2+). §4. |
| EH-10 | ⏳ | The best-effort loop (the Follow-live tail continuing past a bad NDJSON line) lands with M6. §4. |
| EH-11 | N/A | No retries — the web reads local trees + shells to the local `fedres` CLI (no network). |
| EH-12 | N/A | No multi-attempt / idempotency-keyed operations. |
| EH-13 | N/A | No upstream-amplifying load (local single-user tool). |
| LG-01 | ⏳ | Per-module `logging.getLogger(__name__)` lands with the app (M2+). §4. |
| LG-02 | ⏳ | The logging bootstrap (`mgf.common.bootstrap()` at the `serve` entry) lands with M2+. §4. |
| LG-03 | ⏳ | trace_id/span_id via `bootstrap()`'s JsonFormatter — M2+. §4. |
| LG-04 | ⏳ | The `Redactor` is wired by `bootstrap()` before any sink — M2+ (the dashboard handles no secrets regardless). §4. |
| LG-05 | ⏳ | Error-level logs include the exception (`exc_info`) — M2+. §4. |
| LG-06 | ⏳ | The console + rotating-file sinks via `bootstrap()` — M2+. §4. |
| LG-07 | N/A | No desktop GUI (server-rendered local web page, not Qt). |
| LG-08 | ⏳ | Lazy `%`-style log formatting — M2+ code. §4. |
| LG-09 | ⏳ | Structured fields via `extra={…}` — M2+ code. §4. |
| LG-10 | N/A | Not a headless service — an operator-run local web GUI. |
| LG-11 | ⏳ | INFO operation start/end with a stable `operation` field — M2+ (e.g. the sync / feedback-deliver boundaries). §4. |
| LG-12 | ⏳ | Cheap emission (the `bootstrap()` async handler) — M2+. §4. |
| LG-13 | N/A | No high-frequency log sites (and none yet). |
| LG-14 | N/A | Correlation context comes from `bootstrap()`/OTel; no custom context. |
| LG-15 | ⏳ | The event registry (`EVENTS.md`) for the app's named events lands with M2+. §4. |
| LG-16 | ⏳ | WARNING/ERROR WHY+HOW context lands with the app's log sites (M2+). §4. |
| LG-17 | N/A | No ERROR-record dedup/fingerprint surface (local single-user tool). |
| CF-01 | ⏳ | A single typed `Settings` (project roots + bind host/port) lands with the app (M2+). §4. |
| CF-02 | ⏳ | The precedence chain (flags → env → defaults) lands with the app (M2+). §4. |
| CF-03 | N/A | No owned versioned config schema requiring `schema_version` + migration (the dashboard's config is a small flag/path set). |
| CF-04 | N/A | Writes no persistent config/state file — read-only dashboard; the one write (feedback delivery) is project text, not config. |
| CF-05 | N/A | Handles no secrets — reads local `fed-resources/` trees; no credentials. |
| CF-06 | ⏳ | Unknown-key (forbid-extra) rejection on the owned config surface lands with the typed `Settings` (M2+). §4. |
| CF-07 | N/A | No satellite/sub-config files (hooks/schedules/profiles). |
| CF-08 | ⏳ | Inject-by-argument (no module-global `Settings` singleton) lands with the app's entry (M2+). §4. |
| CF-09 | ⏳ | A `--config`/`--roots` flag pointing at config lands with the M2+ console entry. §4. |
| CF-10 | ⏳ | Tests constructing `Settings` with explicit values land with the suite (M2+). §4. |
| CF-11 | N/A | No renamed owned config fields (no config surface yet). |
| CF-12 | N/A | No config-modeled backend variants. |
| SC-01 | N/A | No secrets handled (read-only dashboard; no credentials). |
| SC-02 | ⏳ | The argv/`shell=False` subprocess discipline lands with the code that shells into `fedres check`/`generate` (M2+). §4. |
| SC-03 | ⏳ | Safe deserialization is delegated to the spine (stdlib `json` only); the web's own parsing (if any) lands at M2+ and is re-evidenced then. §4. |
| SC-04 | N/A | No private/secret files written (the only write — `feedback.json` delivery — is non-secret project text). |
| SC-05 | N/A | No cryptography. |
| SC-06 | N/A | No outbound TLS connections (reads local trees + the local `fedres` CLI; serves loopback only). |
| SC-07 | ⏳ | A finite timeout on the `fedres` subprocess calls lands with that code (M2+). §4. |
| SC-08 | ⏳ | Input validation at the boundary (inbound feedback-compose form data; reads rely on the spine's jsonschema) lands with M2+. §4. |
| SC-09 | N/A | No log sink to redact (no secrets; `bootstrap()` wires the `Redactor` regardless — LG-04). |
| SC-10 | ⏳ | No committed hash-pinned lock / `pip-audit` yet (CI not wired); rides the fleet devpi-backfill gap. §4. |
| SC-11 | N/A | No secrets to leak in logs/repr. |
| SC-12 | ✅ | `SECURITY.md` present — the parse / filesystem / non-operative-feedback security model + supported-versions + reporting. |
| SC-13 | N/A | No keys at rest. |
| SC-14 | N/A | No authentication surface (single-user loopback, no auth). |
| SC-15 | ⏳ | Path-traversal validation (`Path.resolve()` + `is_relative_to()`) on operator-supplied project paths lands with the provider wiring (M2+). §4. |
| SC-16 | N/A | No privileged operations. |
| SC-17 | N/A | No auth/privileged seams to security-audit (read-only, no credentials). |
| SC-18 | ⏳ | Reproducible build (build-once) lands with the release/CI pipeline. §4. |
| TS-01 | ⏳ | No tests yet; the `tests/` ↔ `src/` 1:1 mirror + `test_mirror.py` lint land with the app (M2+). §4. |
| TS-02 | ⏳ | The unit suite (no creds/network/daemon) lands with the app (M2+). §4. |
| TS-03 | ⏳ | Test isolation (`tmp_path` temp trees) lands with the suite (M2+). §4. |
| TS-04 | ✅ | `filterwarnings = ["error"]` set (`pyproject` `[tool.pytest.ini_options]`, mirrored from the spine). |
| TS-05 | ✅ | `--strict-markers --strict-config` in `addopts`. |
| TS-06 | ✅ | Coverage floor 80 — `[tool.coverage] fail_under=80` + `[tool.mgf-fed] coverage_floor=80`; CI enforcement lands with the pipeline. |
| TS-07 | ⏳ | Tests for the typed app exceptions land with EH-01 + the suite (M2+). §4. |
| TS-08 | ⏳ | The error-translation boundary tests land with the app (M2+). §4. |
| TS-09 | ⏳ | The Follow-live NDJSON-tail path tests land with M6. §4. |
| TS-10 | ⏳ | Security-relevant behaviour pinned (honest-absence; path-traversal) lands with the suite (M2+). §4. |
| TS-11 | N/A | No GUI (no Qt). |
| TS-12 | ⏳ | Async-route tests (the FastAPI handlers) land with the app (M2+). §4. |
| TS-13 | ⏳ | The natural property test (e.g. the next-best ranking invariants) lands with M2+; `property` marker registered. §4. |
| TS-14 | N/A | No performance budgets. |
| TS-15 | N/A | No external backend (reads local files / the local `fedres` CLI). |
| TS-16 | ⏳ | Self-explanatory assert messages land with the suite (M2+). §4. |
| TS-17 | ⏳ | Local fixtures / conftest land with the suite (M2+). §4. |
| TS-18 | N/A | No slow tests (none yet). |
| TS-19 | ✅ | The 13-marker federation taxonomy registered + `--strict-markers` (`pyproject` markers, mirrored). |
| TS-20 | ⏳ | The `unit/`/`smoke/`/`integration/`/`e2e` partition lands with the suite (M2+). §4. |
| TS-21 | ⏳ | `smoke` marker registered; the `tests/smoke/` import + `__all__`-reachable smoke test land with M2+. §4. |
| TS-22 | ⏳ | `mgf-test-supervisor` tiered runs (`--tier` / `.gates`) — not yet wired (supervisor not in `[dev]` yet). §4. |
| TS-23 | ⏳ | `pytest-timeout` configured (`timeout=30`/thread, `faulthandler_timeout=60`); the supervisor self-check / `.gates` adoption is pending. §4. |
| TS-24 | ⏳ | Structured per-test JSONL (`.gates/last-run/run.jsonl`) — supervisor not yet adopted. §4. |
| TS-25 | ⏳ | Flaky auto-quarantine via the supervisor — not yet wired. §4. |
| TS-26 | N/A | Pure Python; no built/native artefacts. |
| TS-27 | ⏳ | Per-failure detail bundles (`.gates/last-run/failures/`) — supervisor not yet wired. §4. |
| TS-28 | N/A | Per-test perf attribution opt-in; not enabled. |
| AP-01 | ✅ | `__all__` at the package boundary (`__init__.py` — `__all__ = ["__version__"]`); internal modules will be single-underscore-private. |
| AP-02 | ⏳ | Docstrings on the public surface (the M2+ `serve`/app API); today the only public name is `__version__`. §4. |
| AP-03 | ✅ | SemVer — `0.1.0` (0.x window; MINOR may break per AP-03). |
| AP-04 | N/A | No deprecations yet. |
| AP-05 | ⏳ | Keyword-only optional params on the public API land with the M2+ surface. §4. |
| AP-06 | ⏳ | Narrow return types on the public API land with the M2+ surface. §4. |
| AP-07 | ⏳ | Documented raised exceptions on public functions land with the M2+ surface. §4. |
| AP-08 | ✅ | `from __future__ import annotations` in `__init__.py`; `if TYPE_CHECKING:` used as the surface grows. |
| AP-09 | ✅ | `src/mgf/fed_web/py.typed` present; classifier `Typing :: Typed`; wheel ships `src/mgf`. |
| AP-10 | ⏳ | No `PUBLIC_API.json`/`.md` yet — `tools/generate_public_api_json.py` is present (adapted for `mgf.fed_web`) but not run; generated by the scaffold step. §4. |
| AP-11 | ⏳ | Stability tiers declared in `PUBLIC_API` — pending AP-10. §4. |
| AP-12 | N/A | No breaking changes yet. |
| AP-13 | ⏳ | `__version__ = "0.1.0"` is a literal in `__init__.py` + `pyproject` `version` (in agreement) — not yet single-sourced from metadata + no version-in-sync test / `app-doctor` check. §4. |
| AP-14 | ✅ | The public surface is the `__all__` boundary; no consumer imports internals (single-underscore module names reserved as the app grows). |
| AP-15 | N/A | No backward-compat shims. |
| SP-01 | ✅ | `SCOPE.md` §1 — the presentation layer IN (the FastAPI app, the lenses render code, the sync/feedback/Follow-live UI, print/export, `derived` tagging). |
| SP-02 | ✅ | `SCOPE.md` §2 — spine logic / brand kit / state-authoring / warden+testctl / fleet orchestration / standards corpus OUT with owners cited. |
| SP-03 | ✅ | `SCOPE.md` §3 — the scope-creep gate (is it presentation? read-only on state? preserves no-second-source-of-truth + honest-absence + `derived`? brand additive?). |
| SP-04 | ✅ | Adjacent surfaces (package mode, the mobile companion) are demand-driven by the plan — held until a consumer signal. |
| SP-05 | ✅ | OUT entries cite the owner (`mgf-fedres`/`mgf-brand-web`/`mgf-test-web`/`mgf-fed`/`mgf-standard`). |
| SP-06 | ✅ | `SCOPE.md` §6 — revisit-on-MAJOR; re-affirms the presentation-only + read-only + no-second-source-of-truth + honest-absence invariants. |
| WF-01 | ⏳ | No `.woodpecker.yml` yet (push/PR CI) — the tool-driven scaffold step. §4. |
| WF-02 | ⏳ | The four-gate CI (ruff / `ruff format --check` / mypy / pytest) is generated, not yet applied. §4. |
| WF-03 | ⏳ | Tag-driven publish steps — pending the pipeline. §4. |
| WF-04 | ⏳ | Publish creds via CI secret — pending the pipeline. §4. |
| WF-05 | ⏳ | Tag-version coherence step — pending the pipeline. §4. |
| WF-06 | ⏳ | Fresh wheel build in CI — pending the pipeline. §4. |
| WF-07 | ⏳ | Pre-publish smoke (install the built wheel + import) — pending the pipeline. §4. |
| WF-08 | ⏳ | Post-publish verify — pending the pipeline. §4. |
| WF-09 | ⏳ | Pinned CI images — set when `.woodpecker.yml` is generated. §4. |
| WF-10 | ⏳ | Parallel `test-3.11/3.12/3.13` matrix — set when CI is generated. §4. |
| WF-11 | ⏳ | Frozen-lock install (`uv sync --frozen`) — fleet-infra (devpi backfill gap), part of the generated template. §4. |
| WF-12 | ⏳ | CI surfaces exit codes / no `\|\| true` — set when CI is generated. §4. |
| WF-13 | ⏳ | `.woodpecker.yml` will be the generated, drift-checked artefact (`mgf-fed scaffold`); not yet present. §4. |
| REL-01 | ⏳ | No annotated release tag yet (0.1.0 unpublished). §4. |
| REL-02 | ⏳ | Build-once / no version reuse — lands with the release flow. §4. |
| REL-03 | ⏳ | `PUBLIC_API.json` reflecting HEAD — pending AP-10/the release. §4. |
| REL-04 | ⏳ | Publish token from CI secret — pending the pipeline. §4. |
| REL-05 | ⏳ | Immutable published artefact — no release yet. §4. |
| REL-06 | ⏳ | Ordered publish flow (build → tag → publish → verify) — pending the pipeline. §4. |
| REL-07 | ⏳ | Retro-and-notify on a shipped FEEDBACK — no release yet (no papers). §4. |
| REL-08 | ⏳ | Pre-release smoke on the built wheel — pending the pipeline. §4. |
| REL-09 | ⏳ | FEEDBACK status flips at release — no release yet. §4. |
| REL-10 | N/A | Cohort-walk applies to a cornerstone with consumers; mgf-fed-web is a leaf web tool. |
| REL-11 | N/A | Phase release split is an orchestrator (`mgf-fed`) discipline, not per-library. |
| REL-12 | N/A | The Phase-A agent pytest-denial handling is an orchestrator-loop concern. |
| REL-13 | N/A | The federation consistency gate runs from the mgf-common supervisor at release time; mgf-fed-web is not yet registered (tracked at mgf-standard). |
| PKG-01 | ⏳ | Channel: `pyproject [tool.uv] index-url` is the self-hosted devpi index; the devpi-vs-Codeberg reconciliation is a fleet-governance decision. §4. |
| PKG-02 | ⏳ | Publish endpoint — pending the pipeline. §4. |
| PKG-03 | ⏳ | Token-scoped publish auth — pending the pipeline. §4. |
| PKG-04 | ⏳ | Ordered publish flow to the index — pending the pipeline. §4. |
| PKG-05 | ⏳ | Post-publish REST/index verify — pending the pipeline. §4. |
| PKG-06 | ✅ | The `mgf-*` runtime deps (`mgf-fedres`, `mgf-brand-web`) resolve from the self-hosted devpi index — `pyproject [tool.uv] index-url` points at it (no public-PyPI dependency-confusion path). |
| PKG-07 | N/A | Index-operator immutability/recovery concern, not the library repo's. |
| PKG-08 | N/A | Account/index-level retention, not per-repo. |
| PKG-09 | ⏳ | Tag-driven CI publish — pending the pipeline. §4. |
| PKG-10 | ✅ | Naming/build — `mgf-fed-web` dist → `mgf.fed_web` dotted import (PEP 420); `[tool.hatch] packages=["src/mgf"]`; `[project.urls]` → Codeberg. |
| PKG-11 | N/A | No agent version-check tooling in this app. |
| PKG-12 | ✅ | No `pypi.org` publish surface — README/pyproject target the self-hosted index only. |
| DOC-01 | ✅ | Root baseline complete — README, LICENSE, CHANGELOG, CONTRIBUTING, SECURITY, FEEDBACK, AGENTS, STARTHERE, DEPS, FEDERATION + the `docs/` tree (`PUBLIC_API` pending = DOC-08). |
| DOC-02 | ✅ | `docs/` buckets present — `docs/claude/`, `docs/memory/`, `docs/inprogress/` (the planning specs live in the spine repo, linked). |
| DOC-03 | ⏳ | Bucket `README.md` charters for `docs/claude/` / `docs/memory/` / `docs/inprogress/` not yet authored. §4. |
| DOC-04 | ✅ | `CHANGELOG.md` present (Keep a Changelog; the 0.1.0 skeleton + the planned M2+ Unreleased section). |
| DOC-05 | N/A | No breaking changes / cutover yet. |
| DOC-06 | ✅ | The work-unit tracker is the spine's `docs/planning/PLAN.md` (Phase B, linked from README/CHANGELOG); this file is the conformance tracker. |
| DOC-07 | ✅ | `docs/claude/CLAUDE.md` present (federation briefing pointer + the project-specific lookup). |
| DOC-08 | ⏳ | `PUBLIC_API.json`/`.md` + the drift pin — generated by the scaffold step; not yet present (the generator tool is in `tools/`). §4. |
| DOC-09 | ✅ | Docs name code with relative links; minimal drift surface. |
| DOC-10 | ✅ | `FEEDBACK.md` present (repo-scoped; spine/brand/federation routing). |
| DOC-11 | N/A | `docs/inprogress/` is active (this ledger), not a graveyard. |
| DOC-12 | ✅ | Docs navigable — relative links, `## §` headings, no marketing prose. |
| DOC-13 | ✅ | `FEEDBACK.md` documents the dashboard-vs-spine-vs-brand-vs-federation routing. |
| DOC-14 | N/A | Federation sibling — exempt from `MGF_ADOPTION.md` (ADP-04). |
| DOC-15 | ✅ | This `MGF_STANDARDS_CONFORMANCE.md` exists + accounts for all 263 MUSTs. |
| DOC-16 | ✅ | `DEPS.md` present (§1 deps + §2 dependents). |
| DOC-17 | ✅ | `FEDERATION.md` pointer stub (links the canonical contract in mgf-standard; no duplication). |
| DOC-18 | ✅ | Change propagation walked — the doc baseline + this ledger authored together (README/CHANGELOG/DEPS/SCOPE/CLAUDE consistent). |
| DOC-19 | ✅ | `LESSON_LEARNED.md` present (append-only, dated, newest-first). |
| OP-01 | ⏳ | Rich `version` verb — arrives with the M2+ console entry. §4. |
| OP-02 | ⏳ | `app-doctor --standards` per-repo gate — lands with the CI pipeline. §4. |
| OP-03 | ✅ | `[project.urls]` Homepage + Issues + Changelog (Codeberg); no placeholder URLs in pyproject/README. |
| OP-04 | ✅ | README states the skeleton / pre-implementation status honestly + links the spine specs; no false "shipped" framing. |
| OP-05 | ⏳ | `explain` verb — M2+ console. §4. |
| OP-06 | N/A | No runtime-log-access service surface (local single-user tool; logs land on disk via `bootstrap()`). |
| OP-07 | ⏳ | `bundle` diagnostic verb — M2+ console. §4. |
| OP-08 | N/A | No unbounded state directory. |
| OP-09 | N/A | Service-only (production safety guards). |
| OP-10 | N/A | Service-only (deployable-artefact versioning). |
| OP-11 | N/A | Service-only (alert routing / runbooks). |
| OP-12 | N/A | Service-only (backup/restore drills). |
| DEP-01 | N/A | Not a deployed service (Infrastructure-as-Code). |
| DEP-02 | N/A | Service-only (config-as-code on VMs). |
| DEP-03 | N/A | Service-only (immutable release artefacts). |
| DEP-04 | N/A | Service-only (production secrets). |
| DEP-05 | N/A | Service-only (environment-explicit deploy). |
| DEP-06 | N/A | Service-only (reversible deploys / rollback). |
| DEP-07 | N/A | Service-only (`deploy/` structure). |
| DEP-08 | N/A | Service-only (production observability). |
| DEP-09 | N/A | Service-only (DNS + TLS infra). |
| DEP-10 | N/A | Service-only (first-cut runbook). |
| DEP-11 | N/A | Service-only (multi-environment topology). |
| PR-01 | ⏳ | The design keeps logic in the headless spine with FastAPI/Jinja only at the web edge; the import-linter PR-01 forbidden-floor contract lands with the app (M2+). §4. |
| PR-03 | ⏳ | The UI rendering discipline (server-rendered, print-clean, the brand mount) lands with the templates (M2+). §4. |
| PR-04 | ⏳ | The UI-layer independence contract (e.g. `web` ↔ any `cli`) lands with the app's second internal layer (M2+). §4. |
| PR-05 | ⏳ | UI adapters / the presenter seam land with the app (M2+). §4. |
| PR-07 | ⏳ | The PR-family classification is re-evidenced once the presentation layer exists (M2+); PR-02 (dedicated repo) is already met (§SHOULD). §4. |
| AG-01 | ✅ | `AGENTS.md` thin pointer to `mgf-fed agents`. |
| AG-02 | N/A | The canonical briefing is mgf-common's; mgf-fed-web doesn't redefine it. |
| AG-03 | ⏳ | Commit-trailer hook + `check_commit_trailers.py` + the CI commit-trailers gate are the byte-exact scaffold files; not yet applied. §4. |
| AG-04 | N/A | Friction-filing is session conduct, not a codebase artefact. |
| AG-05 | N/A | Memory verification is session conduct. |
| AG-06 | N/A | Risky-op confirmation is session conduct. |
| AG-07 | N/A | TaskCreate is session conduct. |
| AG-08 | N/A | Memory-write scoping is session conduct. |
| AG-09 | N/A | Sibling-version verification is session conduct. |
| AG-10 | N/A | Standards-drift filing is session conduct. |
| AG-11 | N/A | Cross-project feedback routing is session conduct. |
| AG-12 | ✅ | `docs/claude/CLAUDE.md` carries the project-scoped briefing. |
| AG-13 | N/A | Supervisor-flow enforcement (process rule). |
| AG-14 | ✅ | Coupled-surface changes propagated same-pass (the doc baseline + ledger authored together). |
| AG-15 | N/A | Agent-empowerment charter (conduct). |
| AG-16 | ✅ | The `[standards]` extra deps `mgf-common[standards]>=0.47,<0.50` (`pyproject`). |
| AG-17 | ✅ | In-repo agent memory present — `docs/memory/MEMORY.md` (AG-17 index + template). |
| AG-18 | ⏳ | `.gitignore` present + ignores `my_stuff/` + `fed-resources/live/` ✅; the `.gitmessage` + `.githooks/prepare-commit-msg` are the scaffold step. §4. |
| AG-19 | N/A | Runtime off-machine auto-memory — machine-local; not a codebase rule. |
| TM-01 | ✅ | UTC/RFC-3339 at the boundary — no naive datetime in the skeleton; wire timestamps are the spine's (`format: date-time`); ruff DTZ on. |
| TM-02 | ✅ | Wire format ISO-8601 — the spine's schemas pin `format: date-time`; the web carries them through unchanged. |
| TM-03 | N/A | No duration measurement in the skeleton (durations are recorded values supplied by the spine's run-records). |
| TM-04 | N/A | No `datetime.now()` in the skeleton; no clock-dependent logic to inject yet. |
| TM-07 | N/A | UTC only; no IANA timezone-name usage. |
| TM-08 | N/A | No async yet (no blocking sleep in async to audit). |
| PF-01 | N/A | I/O-bound local tool (spine read + template render); no in-process hot path to baseline. |
| PF-02 | N/A | `perf` marker registered; no perf tests. |
| PF-03 | N/A | No perf baselines. |
| PF-04 | N/A | No re-baselining (no budgets). |
| PF-05 | N/A | No perf harness. |
| PF-07 | N/A | No perf tests. |
| PF-08 | N/A | No hardware-tier baselines. |
| OB-01 | ⏳ | The logs pillar (via `bootstrap()`) lands with the M2+ entry; metrics N/A for a local tool. §4. |
| OB-02 | N/A | No metrics (local tool, not a page-able service). |
| OB-03 | N/A | No metrics. |
| OB-04 | ⏳ | Traces via `bootstrap()`'s OTel wiring land with the M2+ entry. §4. |
| OB-05 | N/A | No service / SLIs. |
| OB-07 | N/A | No alerts. |
| OB-08 | N/A | No SLI/SLO/alert definitions. |
| OB-09 | ⏳ | The canonical `LogRecord` schema (via mgf-common) lands with the logging wiring (M2+). §4. |
| OB-10 | ⏳ | The canonical `LogRecord` wire shape (via `bootstrap()`'s JsonFormatter) lands with M2+. §4. |
| OB-11 | N/A | No log-statistics subsystem (local single-user tool). |
| NM-01 | ✅ | Dist name `mgf-fed-web` (hyphen) — `pyproject.name`. |
| NM-02 | ✅ | Dotted import `mgf.fed_web`; PEP-420 (no `src/mgf/__init__.py`). |
| NM-03 | ✅ | Codeberg slug `mgf-fed-web` (hyphen) — `[project.urls]`. |
| GUI-01 | ✅ | Imports no Qt at module level (the GUI is a server-rendered web page; grep clean) — like PR-01. |
| GUI-02 | N/A | No Qt GUI. |
| GUI-03 | N/A | No Qt GUI workers. |
| GUI-04 | N/A | No Qt GUI workers. |
| GUI-05 | N/A | No Qt `main()`. |
| GUI-06 | N/A | No Qt presentation widgets. |
| GUI-07 | N/A | No streaming Qt GUI. |
| GUI-08 | N/A | No Qt GUI-state persistence. |
| GUI-09 | N/A | No Qt GUI tests. |
| GUI-10 | N/A | No Qt GUI capability-gating. |
| FB-05 | ✅ | `FEEDBACK.md` present + the dashboard-vs-spine-vs-brand-vs-federation routing documented; cross-repo feedback routes to the target repo, never a direct edit. |

---

## AG-20 — owned-infrastructure discipline (standards v2.26)

✅ **Accounted 2026-06-29.** Review-enforced agent conduct (like AG-04 / AG-05 / AG-15 —
no single checkable artifact). Before declaring an action **blocked / human-gated /
impossible**, an agent consults
[`MGF_INFRA.md`](https://codeberg.org/magogi-admin/mgf-standard/src/branch/main/MGF_INFRA.md)
(the fleet infrastructure / access registry) and attempts the self-owned recovery path —
an auth/access failure on Magogi-owned infra (expired token, 401, stopped service) is a
solvable sub-problem, not a terminal wall. Recorded "blocked" / "gated" notes carry an
unblock-path + as-of date and are re-derived against current capabilities.
