# `mgf-logship` — scope policy

> `mgf-logship`'s **scope policy** (family **SP**) — what belongs in this log-shipping
> library. A proposed addition is in scope only if it passes the §3 gate.

## §1 In scope (SP-01)
- a **fail-open** logging `Handler` (`LogShipper`) that batches canonical LogRecord JSON + stats
- a versioned, language-neutral **wire protocol** (`_protocol`: ndjson encode/decode, `SHIP_PROTOCOL_VERSION`)
- a **store-now stub collector** (`collector`, optional `[collector]` FastAPI extra)

The boundary: **get logs off the box, safely and without ever breaking the app.**

## §2 Out of scope (SP-02) — with reasons
| Not here | Why | Where instead |
|---|---|---|
| A production-grade collector / storage | the stub is for dev/tests | Loki / Elasticsearch / a real sink |
| Log *formatting* / setup | the consumer's logging config | `mgf-common` `setup_logging` |
| Querying / dashboards / alerting | downstream of shipping | Grafana / Kibana |
| A transport other than HTTP POST | one wire protocol by charter | (future, on demand) |
| Auth/identity for the collector | bearer-token only; consumer owns the rest | the consumer's gateway / `mgf-auth` |

## §3 Scope-creep gate (SP-03)
A PR adding a module/helper MUST answer: (1) is it shipping/protocol/stub-collector (else out)?
(2) does it preserve fail-open + the core↛FastAPI contract? (3) consumer demand signal? Any "no" blocks it.

## §4 Adjacent scope (SP-04)
Adjacent (not yet in): a Loki/OTLP wire adapter, gzip batching, a real collector backend. Promote
adjacent → in only on a documented consumer demand signal, never speculatively.

## §5 Alternatives for out-of-scope needs (SP-05)
Real sink → Loki/ES; formatting → `mgf-common`; dashboards → Grafana/Kibana; other transports → (future).

## §6 Revisiting scope (SP-06)
Revisited at every **MAJOR** boundary; re-affirms the fail-open / one-wire-protocol / stub-collector invariants.
