# Magogi Foundation Standards — Conformance Tracker (mgf-test-web / ProofWarden)

> **Status (2026-06-29).** Initial conformance audit at **0.1.0** (pre-alpha).
> `mgf-test-web` is **ProofWarden** — the per-project testing & CI authority. Its
> base is the **warden** single-flight broker + the lease registry + the cross-
> process UDS daemon + the `testctl` CLI + the `pytest_runner` adapter (**A4 spike,
> committed**), built on the `mgf-fedres` spine and driving `mgf-test-supervisor`
> (`mtest`) as the runner. The base is **FastAPI-free**; the `[web]` console is an
> opt-in extra. The product's later surfaces — the catalog, the console, live-NDJSON
> run-logs + run-records, history, the CI trigger, and the production
> `mgf-test-supervisor`-as-library runner adapter (**M2–M5, unbuilt**) — are tracked
> honestly here.
> **Scope.** mgf-test-web's conformance to the standards at
> [mgf-standard/docs/standards/](https://codeberg.org/magogi-admin/mgf-standard/src/branch/main/docs/standards/).
> **Audience.** Maintainer-tomorrow, AI coding agents, future contributors.
> **Cross-references.** [README.md](../../README.md), [CHANGELOG.md](../../CHANGELOG.md),
> the plan/spec in [`mgf-fedres/docs/planning/mgf-test-web/`](https://codeberg.org/magogi-admin/mgf-fedres/src/branch/main/docs/planning/mgf-test-web).

---

## §1 You are here

**Project shape:** an **application** — the warden **run authority** (a per-project
resident broker + an atomic lease registry + a cross-process Unix-domain-socket
daemon), the `testctl` CLI contract surface, and a swappable runner seam. The
warden core is also an importable library (`mgf.test_web`). Two `mgf-*` runtime deps
(`mgf-fedres` the spine; `mgf-test-supervisor` the runner); the base is
**FastAPI-free** (the `[web]` console is a separate optional extra). That shape makes
the service-only / GUI / deploy / observability / perf / app-config rule families
N/A, while bringing the **concurrency, subprocess, IPC, and fail-closed** surfaces
squarely into scope (DP / EH / SC / TS).

**Current version:** **0.1.0** (Development Status :: 2 — Pre-Alpha). **A4** (the
single-flight core) is committed: `src/mgf/test_web/warden/` (`broker.py`,
`leases.py`, `client.py`, `daemon.py`, `runner.py`) + `testctl.py` + the 13-test
concurrency/fail-closed suite. **M2–M5** (catalog, console, live-NDJSON run-logs,
history, CI trigger, the production runner adapter) are **not yet built** and are
tracked ⏳ (§4).

**Declared conformance level: L2 (operational baseline). Target: L3.** This is a
conformance level, not a feature-completeness claim — the product is an A4 spike.
What earns L2: the full generated CI pipeline (the four gates + a 3.11/3.12/3.13
matrix + `commit-trailers` + `vuln-scan`/pip-audit + `secret-scan`/gitleaks +
`app-doctor --standards` + the `mtest` supervisor gates + the tag-driven
build→smoke→publish→verify flow), a complete DOC-01 doc baseline, an enumerated +
typed public surface (`__all__` + `py.typed` + `PUBLIC_API.json`), and the four
local gates green. The L3 distance is the §4 ⏳ clusters (the unbuilt `[web]`
console + product surfaces, the test-maturity uplift, the operability verbs, version
single-sourcing, the local git-hook half).

**Per-MUST tally (§Z).** Of the **263 MUSTs**: **121 ✅** · **19 ⏳** · **123 N/A**
· **0 🚫**. Applicable (non-N/A) = **140**; **121/140 (86%)** evidenced ✅. Every
code-quality family the A4 spike exercises (DP, EH-translation/boundary, SC-
subprocess/parse/secret-scan, TS-concurrency/fail-closed/supervisor, AP surface, NM,
TM) lands ✅, as do CI/release/packaging (WF, REL machinery, PKG); the **19 ⏳** are
the unbuilt `[web]` console (PR ×3), the test-maturity uplift (TS ×4), the
operability verbs (OP ×2), the not-yet-performed release (REL ×3), and the smaller
single items (DP-09 cancel, EH-01 app-error base, AP-11/13, WF-11 lock, DOC-03,
AG-18 local hooks).

| Marker | Meaning here |
|---|---|
| ✅ | conformant against the committed A4 code / the existing repo artefacts / the shipped docs (evidence in §Z) |
| ⏳ | applicable MUST not yet met — open gap with a plan (§4); the unbuilt console + product surfaces + the test-maturity/operability uplift |
| N/A | rule's premise is service / GUI / deploy / metrics / perf / app-config / logging-shaped; the warden base binds none of those |
| 🚫 | declined-with-rationale (CFM-04) — none currently |

---

## §2 Per-standard audit (corpus 263 MUSTs / 22 families)

| Family | MUSTs | Verdict | Notes (evidence: §Z) |
|---|---|---|---|
| **DP** DESIGN_PRINCIPLES | 13 | ✅ / ⏳ / N/A | FastAPI-free layering, the `Runner` + `WardenClient` seams, frozen DTOs (`RunRequest`/`AcquireOutcome`), `mypy --strict`, UTC time, deterministic resource release. ⏳ DP-09 (no cancel surface yet). N/A async. |
| **EH** ERROR_HANDLING | 13 | ✅ / ⏳ / N/A | Boundary translation `OSError → WardenUnreachable` (chained), typed `except`, documented resilience boundaries, fail-closed CLI. ⏳ EH-01 (no app-error base; bare singleton `RuntimeError`). N/A retries/breaker/GUI. |
| **LG** LOGGING | 17 | N/A | No log sites — the warden emits structured `Emit` events + a registry audit (domain data); `testctl` prints. A logging seam would be audited when added. |
| **CF** CONFIGURATION | 12 | N/A | No app-config subsystem; the project id is read from `project.toml` (identity); the per-run config overlay is domain data. |
| **SC** SECURITY | 18 | ✅ / N/A | argv subprocess `shell=False` (SC-02), stdlib-json deserialization (SC-03), guarded socket dispatch (SC-08), pip-audit (SC-10), SECURITY.md (SC-12), reproducible SBOM (SC-18), gitleaks (SC-01). No secrets/network/crypto/auth (N/A). |
| **TS** TESTING | 28 | ✅ / ⏳ / N/A | Concurrency + cross-process + fail-closed suite (`tmp_path` UDS), `filterwarnings=error`, strict markers, the supervisor gates (`mtest --self-check`/`--tier 0` → JSONL/quarantine/bundles). ⏳ the maturity stack (mirror, dir partition, smoke, floor 75→80). |
| **AP** API_DESIGN | 15 | ✅ / ⏳ / N/A | `__all__`, `py.typed`, `PUBLIC_API.json`, `from __future__`, keyword-only options, narrow returns, documented fail-closed raise. ⏳ AP-11 (tiers) + AP-13 (version single-sourcing). |
| **SP** SCOPE | 6 | ✅ | SCOPE.md (SP-01..06): the warden authority + `testctl` + runner adapters IN; the spine / `[web]` console / fleet orchestration / tier runner OUT with owners cited. |
| **WF** WORKFLOWS | 13 | ✅ / ⏳ | The full generated `.woodpecker.yml` — push/PR/tag/manual, four gates, 3.11/3.12/3.13 matrix, pinned images, full clone, tag-publish + verify. ⏳ WF-11 (frozen-lock install). |
| **REL** RELEASING | 13 | ✅ / ⏳ / N/A | The build→tag-coherence→smoke→publish→verify-devpi flow is wired (REL-02..06/08). ⏳ REL-01/07/09 (no tag pushed yet). Cohort/phase/registry N/A (application leaf). |
| **PKG** PACKAGE_DISTRIBUTION | 12 | ✅ / N/A | devpi channel + token-scoped publish + REST verify (PKG-01..05/09), pinned `mgf-*` deps from the private index (PKG-06), dotted-name build (PKG-10), no pypi.org (PKG-12). |
| **DOC** DOCUMENTATION | 19 | ✅ / ⏳ / N/A | Full DOC-01 root baseline + `docs/` tree + this ledger + DEPS/FEDERATION/LESSON_LEARNED + CLAUDE.md + PUBLIC_API.json. ⏳ DOC-03 (bucket charters). |
| **OP** OPERABILITY | 12 | ✅ / ⏳ / N/A | `testctl --version` (OP-01), `app-doctor --standards` gate (OP-02), no-placeholder URLs (OP-03), honest README (OP-04), bounded audit ring (OP-08). ⏳ explain/bundle verbs. Service rules N/A. |
| **DEP** DEPLOYMENT | 11 | N/A | Not a deployed service — a local CLI/daemon (+ a future local console). |
| **PR** PRESENTATION_LAYER | 5 | ✅ / ⏳ | FastAPI-free base imports no web framework (PR-01/07 ✅). ⏳ PR-03/04/05 — the console (the `[web]` extra) is unbuilt. |
| **AG** AGENTS | 19 | ✅ / ⏳ / N/A | AGENTS.md + CLAUDE.md + docs/memory + `[standards]` extra + the `commit-trailers` CI gate (AG-03). ⏳ AG-18 (`.gitmessage`/`.githooks` local half). Session-conduct rules N/A. |
| **TM** TIME | 6 | ✅ / N/A | UTC/RFC-3339 boundary (`now_iso`), monotonic waits (`wait_idle`), injectable clock (`reclaim_stale`), ruff DTZ. No IANA / async (N/A). |
| **PF** PERFORMANCE | 7 | N/A | No perf-pinned hot path / budgets. |
| **OB** OBSERVABILITY | 10 | N/A | No metrics/traces/SLI surface; emits no `LogRecord` (cf. LG). |
| **NM** NAMING | 3 | ✅ | `mgf-test-web` dist → `mgf.test_web` import → `mgf-test-web` slug; PEP-420 (no `src/mgf/__init__.py`). |
| **GUI** GUI_CONSUMERS | 10 | ✅ / N/A | Imports no Qt (GUI-01); no GUI (rest N/A — the console is web). |
| **FB** FEEDBACK | 1 | ✅ | FEEDBACK.md present + the authority-vs-spine-vs-runner-vs-federation routing documented (FB-05). |

---

## §3 Decline-with-rationale ledger (CFM-04)

None. `mgf-test-web` declines no rule. Rules whose premise its
warden-authority/CLI shape doesn't bind are read **N/A** (with a per-row rationale in
§Z), not declined. The gaps that DO apply are tracked ⏳ in §4, not declined.

---

## §4 Open gaps — tracked with a plan (⏳)

Most open items are the **unbuilt product surfaces** (the `[web]` console + the M2–M5
milestones) and the **test-maturity / operability uplift** — not hand-authored
defects. Per the plan, these land as ProofWarden is completed.

| Cluster | Rules | Status |
|---|---|---|
| **The `[web]` console** | PR-03, PR-04, PR-05 | ⏳ The FastAPI console (the `[web]` extra) is unbuilt; its presentation layering / adapter independence land with it. The base stays FastAPI-free until then. |
| **Cancellation** | DP-09 | ⏳ No explicit cancellation token yet; `testctl cancel` + the warden's cooperative child-stop is milestone M3. |
| **App-error base** | EH-01 | ⏳ The boundary raises a typed `WardenUnreachable` ✅, but there is no unifying base error and the singleton path raises bare `RuntimeError`. Add a small `WardenError` base + a typed singleton exception (runtime `mgf-common`-free, so not from `AppError`). |
| **Test maturity** | TS-01, TS-06, TS-20, TS-21 | ⏳ The src↔test 1:1 mirror + mirror-lint, the four-dir partition, a `tests/smoke/` smoke test, and raising the coverage floor 75→80 (set low pre-alpha while the `[web]`/runner surfaces are unbuilt). |
| **Public API surface** | AP-11, AP-13 | ⏳ Declare stability tiers in `PUBLIC_API`; single-source `__version__` from package metadata + add a version-in-sync unit test (CI `tag-coherence` already asserts tag == pyproject == `__version__`). |
| **Frozen-lock install** | WF-11 | ⏳ `uv sync --frozen` + a committed hash-pinned lock — rides the fleet devpi-backfill gap; CI currently `pip install -e .` with a retry. |
| **Release execution** | REL-01, REL-07, REL-09 | ⏳ The release machinery is wired (build→tag-coherence→smoke→publish→verify); no `v*` tag pushed yet, so no published artefact and no FEEDBACK papers to retro/flip. |
| **Operability verbs** | OP-05, OP-07 | ⏳ `testctl explain` / `testctl bundle` — later CLI milestones. |
| **Docs polish** | DOC-03 | ⏳ Bucket `README.md` charters for `docs/claude/` / `docs/memory/` / `docs/inprogress/`. |
| **AG-03 local git half** | AG-18 | ⏳ The `.gitmessage` + `.githooks/prepare-commit-msg` (local half). `.gitignore` (incl. `my_stuff/`) ✅ + the CI `commit-trailers` gate ✅ are already present. |
| **Product surfaces (not numbered MUSTs)** | — | ⏳ The production `mgf-test-supervisor`-as-library **runner adapter** (D-MTEST-API; `pytest_runner` is the spike's swap-in, same signature), and the **live-NDJSON run-log + run-records + test-catalog** spine integration (M2–M4; the wire/validator I/O is owned by `mgf-fedres`). |

**Registration note.** `mgf-test-web` is **not yet registered** in
`mgf-standard/MGF_LIBRARIES.{json,md}` (REL-13 is a release-time gate run from the
mgf-common supervisor, not a per-repo CI step). Registration + the DOC-18 ripple are
tracked at mgf-standard.

---

## §SHOULD — the indexed SHOULD rules

L3 requires every SHOULD met or justified. The corpus indexes 8 SHOULDs:

| Rule | Verdict | Evidence |
|---|---|---|
| **NM-04** | N/A | Operator-chosen local clone layout; never appears in an artifact (cloned to its slug). |
| **NM-05** | ✅ | No junk-drawer modules — every module is domain-named (`broker`/`leases`/`client`/`daemon`/`runner`/`testctl`); zero `utils/misc/helpers`. |
| **OB-06** | N/A | SLI→SLO targets are for a page-able service; ProofWarden is a local authority + CLI. |
| **PF-06** | N/A | No non-obvious hot-path algorithm to annotate (the acquire decision is a small critical section). |
| **PR-02** | N/A | "2+ UI consumers → a dedicated `-app` repo" — there is one console, delivered in-repo as the `[web]` extra (not 2+ consumers needing extraction). |
| **PR-06** | N/A | No medium-agnostic `fmt` helpers exposed; `testctl` prints / emits JSON directly. The console `fmt` lands with `[web]`. |
| **TM-05** | N/A | No presentation layer yet; wire timestamps are RFC-3339 strings carried through unchanged. |
| **TM-06** | N/A | No OTel-trace ns timestamps of its own; wire timestamps follow the federation ISO-8601 contract. |

**Result: 8/8 met / N-A.** The remaining L3 distance is the §4 ⏳ clusters (the
unbuilt console + product surfaces, the test-maturity + operability uplift), not an
open SHOULD.

---

## §5 Audit log

| Date | Auditor | Trigger | Findings |
|---|---|---|---|
| 2026-06-29 | DOC-01 baseline author | new-sibling bootstrap — author the documentation baseline + stand up the conformance ledger (DOC-15 / CFM-03) | **Full per-MUST §Z built** — all 263 MUSTs carry a Rule · Verdict · Evidence row in the `_status.py`-parseable format. Honest pre-alpha tally **121 ✅ / 19 ⏳ / 123 N/A / 0 🚫** (140 applicable, 86%). Declared **L2 (operational baseline)**, target L3 — the full CI pipeline + supervisor gates + DOC-01 baseline + typed/enumerated public surface are in place; the unbuilt `[web]` console + M2–M5 product surfaces + the test-maturity/operability uplift are the ⏳ set (§4). Code touched only to add `__all__` re-exports + `py.typed` + `PUBLIC_API.json` (the public-surface baseline); the warden core unchanged. |

---

## §6 Cross-references

- [`mgf-standard/docs/standards/`](https://codeberg.org/magogi-admin/mgf-standard/src/branch/main/docs/standards/) — the corpus this audits against (263 MUSTs / 8 SHOULDs).
- [`mgf-fedres/docs/planning/mgf-test-web/`](https://codeberg.org/magogi-admin/mgf-fedres/src/branch/main/docs/planning/mgf-test-web) — the approved plan + spec (the milestones M0–M6).
- [`../../SCOPE.md`](../../SCOPE.md) — IN/OUT/gate (SP-01..06).
- [`../../DEPS.md`](../../DEPS.md) — deps + dependents (DOC-16).
- [`../../FEDERATION.md`](../../FEDERATION.md) — the contract (DOC-17).
- The mgf-common reference ledger: [`mgf-common/docs/inprogress/MGF_STANDARDS_CONFORMANCE.md`](https://codeberg.org/magogi-admin/mgf-common/src/branch/main/docs/inprogress/MGF_STANDARDS_CONFORMANCE.md).

---

## §Z Per-MUST evidenced audit — all 263 MUSTs (DOC-15 / CFM-03 completeness)

> Every one of the 263 corpus MUSTs carries a row. Columns: Rule · Verdict
> (✅ / ⏳ / 🚫 / N/A) · Evidence/rationale. ⏳ rows are tracked in §4. Evidence
> cites committed A4 code (`src/mgf/test_web/warden/*.py`, `testctl.py`,
> `tests/*.py`), the repo artefacts (`pyproject.toml`, `.woodpecker.yml`,
> `scripts/`, `.gitleaks.toml`, `.gitignore`), and the docs authored in this pass.
> **Tally: 121 ✅ · 19 ⏳ · 123 N/A · 0 🚫** (140 applicable).

| Rule | Verdict | Evidence |
|---|---|---|
| DP-01 | ✅ | Layering enforced — the warden core (`warden/*.py`) + `testctl` import no web framework; FastAPI lives only in the `[web]` extra. The FastAPI-free base is the defining constraint (SCOPE SP-01/03). |
| DP-02 | ✅ | I/O deps sit behind seams — the `Runner` Callable seam (`pytest_runner` prod + `Controllable`/`_sleep_runner` test doubles) + the `WardenClient`/`WardenDaemon` IPC seam (the production `mgf-test-supervisor` adapter swaps in at the same signature). |
| DP-03 | ✅ | Value/DTO types are frozen dataclasses — `AcquireOutcome` + `RunRequest` (`@dataclass(frozen=True)`); `Lease`/`LeaseRegistry` are the warden's mutable in-memory authority by design (documented). |
| DP-04 | ✅ | `pyproject [tool.mypy] strict=true`; every signature annotated; `from __future__ import annotations` in every module. |
| DP-05 | ✅ | Tests run with no creds/network/external daemon — `tmp_path` UDS + in-process wardens. |
| DP-06 | ✅ | Correctness-first — single-flight by construction, fail-closed, audited reclaim is the design centre (CHANGELOG + this ledger). |
| DP-07 | ✅ | Module + class + public-method docstrings throughout (`Warden`, `WardenClient`, `WardenDaemon`, `LeaseRegistry`, `RunRequest`, `is_live`). |
| DP-08 | ✅ | Replaceability documented — the `Runner` seam (pytest → `mgf-test-supervisor`-as-library, same signature) + the `WardenClient` transport; design in the spec. |
| DP-09 | ⏳ | No explicit cancellation-token surface yet; the warden owns the child + reclaims dead holders, but `testctl cancel` + cooperative child-stop is milestone M3. §4. |
| DP-10 | ✅ | No silent fallbacks — the client raises `WardenUnreachable`; `status` returns `broker:down`; `submit` returns an explicit `AcquireOutcome` (started/coalesced/queued). |
| DP-11 | N/A | Threading (`RLock`), not asyncio; no bare `asyncio.create_task`. |
| DP-12 | ✅ | `now_iso()` = `datetime.now(UTC)`; `reclaim_stale(now=…)` takes an injectable clock; ruff `DTZ` selected. |
| DP-13 | ✅ | Deterministic resource release — `WardenDaemon.serve_forever` `try/finally → shutdown`; sockets via `with`; the singleton lock fh is `flock(LOCK_UN)` + closed in `shutdown`. |
| EH-01 | ⏳ | The fail-closed boundary raises a typed domain exception (`WardenUnreachable`); but there is no unifying app base error and the singleton conflict raises bare `RuntimeError`. A `WardenError` base + typed singleton exception is the gap (runtime `mgf-common`-free). §4. |
| EH-02 | ✅ | Third-party errors translated at the boundary — `WardenClient._call` maps `OSError → WardenUnreachable` (`client.py`). |
| EH-03 | ✅ | The translated exception chains the cause — `raise WardenUnreachable(...) from exc` (`client.py`); `raise RuntimeError(...) from exc` (`daemon._acquire_singleton`). |
| EH-04 | ✅ | Entry-point top-level handling — `testctl.main` returns rc codes, catches `WardenUnreachable` → `REFUSED` (rc 1), no raw traceback for expected failures. |
| EH-05 | N/A | No crash-report subsystem (a small authority + CLI). |
| EH-06 | N/A | No GUI workers. |
| EH-07 | ✅ | The two broad `except Exception` are narrow, documented resilience boundaries that record an error rather than swallow it — the warden surviving an arbitrary runner failure (`broker._run`) + a bad socket request (`daemon._Handler.handle`). |
| EH-08 | ✅ | A typed application exception exists — `WardenUnreachable` (`client.py`). |
| EH-09 | ✅ | Errors carry actionable context — `WardenUnreachable` names the socket path + "fail-closed"; the singleton error names the lock path. |
| EH-10 | ✅ | Best-effort loop — the daemon survives a malformed request (responds `{ok:false,error}`) and keeps serving; `broker._advance` continues the queue after a release. |
| EH-11 | N/A | No retries in app code (the CI install retry is ops, not the library). |
| EH-12 | N/A | No multi-attempt operations. |
| EH-13 | N/A | No upstream-amplifying load. |
| LG-01 | N/A | No log sites yet; the warden emits structured events via the `Emit` seam + audits via the registry. A logging seam would use `getLogger(__name__)`. |
| LG-02 | N/A | No logging bootstrap (the host owns logging). |
| LG-03 | N/A | No logging / OTel spans. |
| LG-04 | N/A | No log sink to redact (no secrets handled regardless). |
| LG-05 | N/A | No ERROR-level logging (failures become `error` events / typed exceptions). |
| LG-06 | N/A | No aggregator wiring. |
| LG-07 | N/A | No GUI. |
| LG-08 | N/A | No log calls. |
| LG-09 | N/A | No structured log fields (no logging). |
| LG-10 | N/A | Not a headless network service. |
| LG-11 | N/A | Operation outcomes are audit events, not logs. |
| LG-12 | N/A | No logging. |
| LG-13 | N/A | No logging. |
| LG-14 | N/A | No correlation context (the `run_id` threads the event stream instead). |
| LG-15 | N/A | No event-field logging. |
| LG-16 | N/A | No WARNING/ERROR records. |
| LG-17 | N/A | No ERROR records to fingerprint. |
| CF-01 | N/A | No application `Settings` object; the project id is read from `project.toml`, inputs are explicit args. |
| CF-02 | N/A | No config precedence chain (the per-run config overlay is domain data, not app config). |
| CF-03 | N/A | No owned app-config schema. |
| CF-04 | N/A | No config/state writes (the warden writes ephemeral `live/`, not config). |
| CF-05 | N/A | No config file / no secrets. |
| CF-06 | N/A | No config file with keys to reject. |
| CF-07 | N/A | No sub-config files. |
| CF-08 | N/A | No `Settings` singleton; arguments passed per-call / constructor. |
| CF-09 | N/A | No config file to point a flag at. |
| CF-10 | N/A | No `Settings` to construct in tests. |
| CF-11 | N/A | No config fields. |
| CF-12 | N/A | No config backend variants. |
| SC-01 | ✅ | No secrets handled by the base; `gitleaks` CI gate (`secret-scan`, `.gitleaks.toml`). |
| SC-02 | ✅ | Subprocess uses an argv list, `shell=False` — `runner.py` `subprocess.Popen(["python","-m","pytest", request.test_id, "-q"], …)`. |
| SC-03 | ✅ | Safe deserialization — stdlib `json.loads` only (socket requests, config); no `pickle`/`yaml.load`/`eval`. |
| SC-04 | N/A | No private-data files written (the warden writes ephemeral, gitignored `live/`). |
| SC-05 | N/A | No cryptography (the `sha256` config digest is integrity hashing, not secret crypto). |
| SC-06 | N/A | No outbound network/TLS (the warden's IPC is a local UDS). |
| SC-07 | N/A | No external/network requests; the local UDS client nonetheless carries a finite socket timeout (`settimeout(10)`; `is_live` 2s). |
| SC-08 | ✅ | Input guarded at the boundary — `_dispatch` rejects an unknown op + `_Handler.handle` wraps dispatch so a malformed request can't crash the warden; `testctl._parse_config` coerces overlay values defensively. |
| SC-09 | N/A | No log sink. |
| SC-10 | ✅ | Dependency CVE scan in CI — `pip-audit --strict` (`vuln-scan` step). A committed hash-pinned lock rides the fleet devpi-backfill gap (§4). |
| SC-11 | N/A | No secrets to leak in logs/repr. |
| SC-12 | ✅ | `SECURITY.md` present — the IPC + subprocess + parse security model + supported-versions + reporting. |
| SC-13 | N/A | No keys at rest. |
| SC-14 | N/A | No authentication surface (UDS reachability is filesystem-permissioned). |
| SC-15 | ✅ | Paths are operator/CLI-supplied (the project root + its `fed-resources/`), not network-derived; built with `pathlib`. |
| SC-16 | N/A | No privileged operations (`fcntl.flock` is advisory). |
| SC-17 | N/A | No security-audit-log subsystem (the lease audit is domain data). |
| SC-18 | ✅ | Reproducible build — hatchling sdist+wheel (`build` step) + a reproducible CycloneDX SBOM (`sbom` step, `--output-reproducible`). |
| TS-01 | ⏳ | Tests are behaviour-organised (`test_single_flight`/`test_daemon`/`test_testctl`), not a 1:1 `src/` mirror; the mirror + `test_mirror.py` lint land later. §4. |
| TS-02 | ✅ | Unit suite: no creds/network/third-party daemon — `tmp_path` UDS + in-process wardens (the warden is the SUT). |
| TS-03 | ✅ | Isolation via `tmp_path`; per-test wardens; no process-global mutation. |
| TS-04 | ✅ | `filterwarnings = ["error"]` (`pyproject [tool.pytest.ini_options]`). |
| TS-05 | ✅ | `--strict-markers --strict-config` in `addopts`. |
| TS-06 | ⏳ | Coverage gate configured (`fail_under=75`, branch=true; `[tool.mgf-fed] coverage_floor=75`) but below the 80 standard — set to 75 pre-alpha (the `[web]`/runner surfaces unbuilt); raise to 80 as they land. §4. |
| TS-07 | ✅ | Typed-exception behaviour tested — `WardenUnreachable` raise/catch (`test_fail_closed_when_warden_down`); the singleton `RuntimeError` (`test_singleton_refuses_a_second_warden`). |
| TS-08 | ✅ | The error-translation boundary is tested — fail-closed `REFUSED`/`broker:down` (`test_testctl.py`); `WardenUnreachable` (`test_daemon.py`). |
| TS-09 | N/A | No NDJSON/stream line-validation surface in the spike (the live-NDJSON I/O is unbuilt; the spine owns the wire validator). |
| TS-10 | ✅ | Security-relevant behaviour pinned — fail-closed-when-down + singleton-refuses-a-second-warden. |
| TS-11 | N/A | No GUI. |
| TS-12 | N/A | No async. |
| TS-13 | N/A | No natural property surface in the spike (the config-digest stability could be a later property test; no `property` marker). |
| TS-14 | N/A | No performance budgets. |
| TS-15 | N/A | No real third-party backend to smoke (the runner spawns local pytest). |
| TS-16 | ✅ | Assert messages are self-explanatory ("exactly one execution — the second was coalesced"; "both ran, serialized — never the wrong config's result"). |
| TS-17 | ✅ | Fixtures local to the test module (the `daemon` fixture in `test_daemon.py`); no cross-package import / no conftest needed yet. |
| TS-18 | N/A | No slow tests (the suite is ~3s; `slow` marker registered). |
| TS-19 | ✅ | The federation marker taxonomy registered (`smoke`/`integration`/`contract`/`concurrency`/`conformance`/`use_case`/`perf`/`stress`/`slow`/`e2e`) + `--strict-markers`. |
| TS-20 | ⏳ | Single flat suite; the `unit/`/`smoke/`/`integration/`/`e2e` dir partition lands with the test-maturity uplift. §4. |
| TS-21 | ⏳ | `smoke` marker registered; the `tests/smoke/` import + `__all__`-reachable smoke test lands with the uplift. §4. |
| TS-22 | ✅ | Tiered runs via `mgf-test-supervisor` — CI runs `mtest --tier 0` (`supervisor-tier-0` step). |
| TS-23 | ✅ | Supervisor self-check — CI runs `mtest --self-check` (`supervisor-self-check` step). |
| TS-24 | ✅ | Structured per-test JSONL via the supervisor (`.gates/last-run/run.jsonl`) — produced by the `mtest` CI steps. |
| TS-25 | ✅ | Flaky auto-quarantine via the supervisor — exercised by the `mtest` CI steps. |
| TS-26 | N/A | Pure Python; no built/native artefacts. |
| TS-27 | ✅ | Per-failure detail bundles via the supervisor (`.gates/last-run/failures/`) — written by the `mtest` CI steps. |
| TS-28 | N/A | Per-test perf attribution opt-in; not enabled. |
| AP-01 | ✅ | `__all__` at the package boundary (`__init__.py`) re-exports the warden API; the warden submodules are the public surface (no `_private` module leaked). |
| AP-02 | ✅ | Public names documented — docstrings on `Warden`/`WardenClient`/`WardenDaemon`/`WardenUnreachable`/`LeaseRegistry`/`Lease`/`RunRequest`/`is_live`; `AcquireOutcome` self-documents via field comments. |
| AP-03 | ✅ | SemVer — `0.1.0` (0.x window; MINOR may break). |
| AP-04 | N/A | No deprecations yet. |
| AP-05 | ✅ | Optional params keyword-only with defaults — `Warden(..., *, serialize=True, ttl_s=30, heartbeat_s=10, on_event=None)`; `reclaim_stale(*, now=None)`. |
| AP-06 | ✅ | Narrow return types — `AcquireOutcome`, `dict[str, Any]`, `bool`, `list[str]`; not broad `Any`/`Iterable`. |
| AP-07 | ✅ | The one raising surface is documented — the `WardenClient` module + class docstrings state it raises `WardenUnreachable` (fail-closed) when the warden is down. |
| AP-08 | ✅ | `from __future__ import annotations` in every module; `if TYPE_CHECKING:` for `RunRequest`/`Warden` imports (`client.py`, `daemon.py`, `runner.py`). |
| AP-09 | ✅ | `src/mgf/test_web/py.typed` present; classifier `Typing :: Typed`; the wheel ships `src/mgf` (CI greps `py.typed` in the wheel, `build` step). |
| AP-10 | ✅ | `PUBLIC_API.json` present — generated from the live `__all__` by `tools/generate_public_api_json.py`. |
| AP-11 | ⏳ | Stability tiers not yet declared in `PUBLIC_API` (the JSON is names-only). §4. |
| AP-12 | N/A | No breaking changes yet. |
| AP-13 | ⏳ | `__version__ = "0.1.0"` is a literal in `__init__.py` + `pyproject` `version` (in agreement; CI `tag-coherence` asserts tag == both) — not yet single-sourced from metadata + no version-in-sync unit test. §4. |
| AP-14 | ✅ | No `_private` module imported by consumers; the public surface is re-exported via `__init__` / `warden.__init__`. |
| AP-15 | N/A | No backward-compat shims. |
| AP-16 | ✅ | `pyproject.toml:40` carries the one mgf-common pin — the `[standards]` conformance-tooling extra — on the federation window `mgf-common[standards]>=0.47,<1.0` (floor kept, ceiling `<1.0` per API_DESIGN §4.4; widened in the AP-16 cohort wave, f197787, 2026-07-01). The `mgf-common-matrix` floor re-run step is absent from `.woodpecker.yml` by shape, not by drift: the generator splices it only for a **runtime** mgf-common floor, and this app's runtime dependencies (`mgf-fedres`, `mgf-test-supervisor`) include no mgf-common — the only mgf-common line in CI is the `fedres-check` tooling install (`pip install --quiet mgf-fedres "mgf-common[standards]" --index-url "$DEVPI_URL"`). Mirrors the adjudicated mgf-brand-web / mgf-fed-web AP-16 rows. Row added when mgf.standard 0.1.61 entered AP-16 into the released MUST index (264→265). |
| SP-01 | ✅ | `SCOPE.md` §1 — the warden authority + `testctl` + runner adapters IN (the FastAPI-free base). |
| SP-02 | ✅ | `SCOPE.md` §2 — the spine / the `[web]` console / brand-web / fleet orchestration / the tier runner / the standards corpus OUT, owners cited. |
| SP-03 | ✅ | `SCOPE.md` §3 — the scope-creep gate (authority-not-spine/console? FastAPI-free base? preserves the authority invariants?). |
| SP-04 | ✅ | Adjacent surfaces (the `zig`/shell adapters, the production mtest adapter, the console) are demand-driven by the milestones — held until needed. |
| SP-05 | ✅ | OUT entries cite the owner (`mgf-fedres`/`mgf-test-web[web]`/`mgf-brand-web`/`mgf-fed`/`mgf-test-supervisor`/`mgf-standard`). |
| SP-06 | ✅ | `SCOPE.md` §6 — revisit-on-MAJOR; re-affirms single-flight-by-construction + fail-closed + lease-not-lock + FastAPI-free-base. |
| WF-01 | ✅ | `.woodpecker.yml` runs on push / pull_request / tag / manual (`when:`). |
| WF-02 | ✅ | The gate steps present — `lint` (ruff + import-linter + OP-03 grep), `typecheck` (mypy), `test-3.x` (pytest); `ruff format --check` is the local gate (CONTRIBUTING). |
| WF-03 | ✅ | Tag-driven publish flow — `publish` gated on `event: tag, ref: refs/tags/v*`. |
| WF-04 | ✅ | Publish creds via CI secret — `TWINE_PASSWORD: { from_secret: devpi_password }`. |
| WF-05 | ✅ | Tag-version coherence — the `tag-coherence` step asserts tag == `pyproject.version` == `__version__`. |
| WF-06 | ✅ | Fresh wheel build in CI — `build` step (`python -m build` + `twine check`). |
| WF-07 | ✅ | Pre-publish smoke — `smoke` installs the built wheel into a venv, imports it, checks `__version__`, runs `testctl --version`. |
| WF-08 | ✅ | Post-publish verify — `verify-devpi` confirms the devpi simple index serves the version. |
| WF-09 | ✅ | Pinned CI images — `python:3.1x-slim`, `plugin-git:2.9.2`, `gitleaks:v8.30.1`, `cyclonedx-bom>=7,<8`; full (non-partial) clone. |
| WF-10 | ✅ | Parallel `test-3.11/3.12/3.13` steps; the coverage gate on 3.12 only. |
| WF-11 | ⏳ | Install is `pip install -e .` (with a retry), not `uv sync --frozen`; no committed lock — rides the fleet devpi-backfill gap. §4. |
| WF-12 | ✅ | Gates surface exit codes; the only `\|\| true` is the non-gate `git fetch` (fail-open on shallow-clone), the install `\|\| (sleep…&&retry)` re-runs rather than masks. |
| WF-13 | ✅ | `.woodpecker.yml` is the generated, drift-checked artefact (header: "GENERATED — do not hand-edit … rendered by `mgf-fed`"). |
| REL-01 | ⏳ | No annotated release tag yet (0.1.0 unpublished). §4. |
| REL-02 | ✅ | Build-once / no reuse — `publish` uploads the wheel built in THIS run; devpi rejects a re-upload of the same version. |
| REL-03 | ✅ | `PUBLIC_API.json` reflects HEAD (regenerated from the live `__all__`). |
| REL-04 | ✅ | Publish token from a CI secret (`devpi_password`), tag-event-scoped. |
| REL-05 | ✅ | Immutable published artefact — devpi (no overwrite); no release performed yet. |
| REL-06 | ✅ | Ordered publish flow — `build → tag-coherence → smoke → publish → verify-devpi` (via `depends_on`). |
| REL-07 | ⏳ | Retro-and-notify on a shipped FEEDBACK — no release yet (no papers). §4. |
| REL-08 | ✅ | Pre-release smoke on the built wheel — the `smoke` step. |
| REL-09 | ⏳ | FEEDBACK status flips at release — no release yet. §4. |
| REL-10 | N/A | Cohort-walk applies to a library with dependents; ProofWarden is an application leaf. |
| REL-11 | N/A | Phase A/B release split is an orchestrator (`mgf-fed`) discipline. |
| REL-12 | N/A | The Phase-A agent pytest-denial handling is an orchestrator-loop concern. |
| REL-13 | N/A | The federation consistency gate runs from the supervisor at release; not yet registered (tracked at mgf-standard). |
| PKG-01 | ✅ | Channel — `[tool.uv] index-url` is the self-hosted devpi index; CI installs + publishes there (not pypi.org/Codeberg). |
| PKG-02 | ✅ | Publish endpoint — `twine upload --repository-url …/magogi/prod/` (`publish`). |
| PKG-03 | ✅ | Token-scoped publish auth — `TWINE_USERNAME=magogi` + the tag-scoped `devpi_password` secret. |
| PKG-04 | ✅ | Ordered publish to the index — gated on every green gate via `depends_on`. |
| PKG-05 | ✅ | Post-publish REST/index verify — `verify-devpi`. |
| PKG-06 | ✅ | The `mgf-*` runtime deps are pinned (`mgf-fedres>=0.1,<0.2`, `mgf-test-supervisor>=0.1.3,<0.2`) + resolved from the private index (`--index-url` devpi); no public-PyPI source for them. |
| PKG-07 | N/A | Index-operator immutability/recovery, not the repo's. |
| PKG-08 | N/A | Account/index-level retention, not per-repo. |
| PKG-09 | ✅ | Tag-driven CI publish (`publish` on `refs/tags/v*`). |
| PKG-10 | ✅ | Naming/build — `mgf-test-web` dist → `mgf.test_web` dotted import (PEP 420); `[tool.hatch] packages=["src/mgf"]`; `[project.urls]` → Codeberg. |
| PKG-11 | N/A | No agent version-check tooling in this repo. |
| PKG-12 | ✅ | No `pypi.org` publish surface — README/pyproject/CI target the self-hosted index only. |
| DOC-01 | ✅ | Root baseline complete — README, LICENSE, CHANGELOG, CONTRIBUTING, SECURITY, FEEDBACK, AGENTS, STARTHERE, SCOPE, DEPS, FEDERATION, LESSON_LEARNED + `PUBLIC_API.json` + the `docs/` tree. |
| DOC-02 | ✅ | `docs/` buckets — `docs/claude/`, `docs/memory/`, `docs/inprogress/` (the plan/spec live in the spine's `docs/planning/`, cross-referenced). |
| DOC-03 | ⏳ | Bucket `README.md` charters for `docs/claude/` / `docs/memory/` / `docs/inprogress/` not yet authored. §4. |
| DOC-04 | ✅ | `CHANGELOG.md` (Keep a Changelog; the A4 `[0.1.0]` + the M2–M5 `[Unreleased]`). |
| DOC-05 | N/A | No breaking changes / cutover yet. |
| DOC-06 | ✅ | The work-unit tracker is the plan/spec in `mgf-fedres/docs/planning/mgf-test-web/` (cross-referenced); this file is the conformance tracker. |
| DOC-07 | ✅ | `docs/claude/CLAUDE.md` (federation briefing pointer + project-specific lookup). |
| DOC-08 | ✅ | `PUBLIC_API.json` present + `tools/generate_public_api_json.py` regenerates it from the live `__all__`. |
| DOC-09 | ✅ | Docs name code with relative links; minimal drift surface. |
| DOC-10 | ✅ | `FEEDBACK.md` (repo-scoped; spine/runner/federation routing documented). |
| DOC-11 | N/A | `docs/inprogress/` is active (this ledger), not a graveyard. |
| DOC-12 | ✅ | Docs navigable — relative links, `## §` headings, no marketing prose. |
| DOC-13 | ✅ | `FEEDBACK.md` documents the authority-scoped vs spine vs runner vs federation-wide routing. |
| DOC-14 | N/A | Federation sibling — exempt from `MGF_ADOPTION.md` (ADP-04). |
| DOC-15 | ✅ | This `MGF_STANDARDS_CONFORMANCE.md` exists + accounts for all 263 MUSTs. |
| DOC-16 | ✅ | `DEPS.md` present (§1 deps + §2 dependents). |
| DOC-17 | ✅ | `FEDERATION.md` pointer stub (links the canonical contract in mgf-standard). |
| DOC-18 | ✅ | Change propagation walked — the doc baseline + this ledger authored together (CHANGELOG/DEPS/SCOPE/CLAUDE consistent). |
| DOC-19 | ✅ | `LESSON_LEARNED.md` (append-only, dated, newest-first). |
| OP-01 | ✅ | Version verb — `testctl --version` (argparse version action; CI `smoke` asserts it). |
| OP-02 | ✅ | `app-doctor --standards` per-repo gate — the `app-doctor` CI step. |
| OP-03 | ✅ | `[project.urls]` Homepage/Issues/Changelog (Codeberg); the `lint` step greps for placeholder URLs. |
| OP-04 | ✅ | README states the A4-spike status honestly + links the plan/spec; no false "shipped" framing. |
| OP-05 | ⏳ | `explain` verb — a later `testctl` milestone. §4. |
| OP-06 | N/A | No runtime-log access surface (no logging — see LG). |
| OP-07 | ⏳ | `bundle` diagnostic verb — a later `testctl` milestone. §4. |
| OP-08 | ✅ | Bounded state — the audit ring is a `deque(maxlen=50)`; `live/` (the future run-log dir) is gitignored ephemeral. |
| OP-09 | N/A | Service-only (production safety guards). |
| OP-10 | N/A | Service-only (deployable-artefact versioning). |
| OP-11 | N/A | Service-only (alert routing / runbooks). |
| OP-12 | N/A | Service-only (backup/restore drills). |
| DEP-01 | N/A | Not a deployed service (Infrastructure-as-Code) — a local CLI/daemon. |
| DEP-02 | N/A | Service-only (config-as-code on VMs). |
| DEP-03 | N/A | Service-only (immutable release artefacts on deploy). |
| DEP-04 | N/A | Service-only (production secrets). |
| DEP-05 | N/A | Service-only (environment-explicit deploy). |
| DEP-06 | N/A | Service-only (reversible deploys / rollback). |
| DEP-07 | N/A | Service-only (`deploy/` structure). |
| DEP-08 | N/A | Service-only (production observability). |
| DEP-09 | N/A | Service-only (DNS + TLS infra). |
| DEP-10 | N/A | Service-only (first-cut runbook). |
| DEP-11 | N/A | Service-only (multi-environment topology). |
| PR-01 | ✅ | The base imports no UI/web framework — FastAPI-free is the defining base constraint (SCOPE SP-01/03). |
| PR-03 | ⏳ | The console layering (presentation reads via the seam, never executes) lands with the `[web]` extra — unbuilt. §4. |
| PR-04 | ⏳ | Console adapter independence — lands with the `[web]` extra. §4. |
| PR-05 | ⏳ | Console UI adapters — land with the `[web]` extra. §4. |
| PR-07 | ✅ | PR-* classified here — PR-01 ✅; the console PR-03/04/05 ⏳ (the `[web]` extra). |
| AG-01 | ✅ | `AGENTS.md` thin pointer to `mgf-fed agents`. |
| AG-02 | N/A | The canonical briefing is mgf-common's; not redefined here. |
| AG-03 | ✅ | Commit-trailer CI gate present — the `commit-trailers` step runs `scripts/check_commit_trailers.py` (the server-side half of AG-03). |
| AG-04 | N/A | Friction-filing is session conduct, not a codebase artefact. |
| AG-05 | N/A | Memory verification is session conduct. |
| AG-06 | N/A | Risky-op confirmation is session conduct. |
| AG-07 | N/A | TaskCreate is session conduct. |
| AG-08 | N/A | Memory-write scoping is session conduct. |
| AG-09 | N/A | Sibling-version verification is session conduct. |
| AG-10 | N/A | Standards-drift filing is session conduct. |
| AG-11 | N/A | Cross-project feedback routing is session conduct. |
| AG-12 | ✅ | `docs/claude/CLAUDE.md` carries the project-scoped briefing. |
| AG-13 | N/A | Supervisor-flow enforcement (process rule). |
| AG-14 | ✅ | Coupled-surface changes propagated same-pass (the doc baseline + ledger + `__init__`/`py.typed`/`PUBLIC_API` authored together). |
| AG-15 | N/A | Agent-empowerment charter (conduct). |
| AG-16 | ✅ | The `[standards]` extra deps `mgf-common[standards]>=0.47,<1.0` (`pyproject`; window widened in the AP-16 cohort wave, f197787). |
| AG-17 | ✅ | In-repo agent memory present — `docs/memory/MEMORY.md`. |
| AG-18 | ⏳ | `.gitignore` present + ignores `my_stuff/` ✅; the `.gitmessage` + `.githooks/prepare-commit-msg` (the local git half) are not yet present. §4. |
| AG-19 | N/A | Runtime off-machine auto-memory — machine-local; not a codebase rule. |
| TM-01 | ✅ | UTC at the boundary — `now_iso()` = `datetime.now(UTC)`; lease/audit timestamps are RFC-3339 `…Z`. |
| TM-02 | ✅ | Wire format ISO-8601 — `now_iso()` emits `%Y-%m-%dT%H:%M:%SZ`; `parse_iso` round-trips it as UTC-aware. |
| TM-03 | ✅ | Elapsed-time waits use a monotonic clock — `wait_idle` uses `time.monotonic()`; lease TTL ages RFC-3339 wire timestamps (wall-clock by contract, with an injectable `now`). |
| TM-04 | ✅ | No naive `datetime.now()` — `datetime.now(UTC)` only; `reclaim_stale(now=…)` injects the clock for tests; ruff `DTZ` on. |
| TM-07 | N/A | UTC only; no IANA timezone-name usage. |
| TM-08 | N/A | No async. |
| PF-01 | N/A | No perf-pinned hot path / budgets (the acquire decision is a small critical section). |
| PF-02 | N/A | `perf` marker registered; no perf tests. |
| PF-03 | N/A | No perf baselines. |
| PF-04 | N/A | No re-baselining (no budgets). |
| PF-05 | N/A | No perf harness. |
| PF-07 | N/A | No perf tests. |
| PF-08 | N/A | No hardware-tier baselines. |
| OB-01 | N/A | No observability surface — no metrics/traces/SLIs (cf. LG N/A). |
| OB-02 | N/A | No metrics. |
| OB-03 | N/A | No metrics. |
| OB-04 | N/A | No traces. |
| OB-05 | N/A | No service / SLIs. |
| OB-07 | N/A | No alerts. |
| OB-08 | N/A | No SLI/SLO/alert definitions. |
| OB-09 | N/A | Emits no structured `LogRecord` (the `Emit`/audit events are domain data). |
| OB-10 | N/A | Emits no `LogRecord` wire shape. |
| OB-11 | N/A | No logging-statistics subsystem. |
| NM-01 | ✅ | Dist name `mgf-test-web` (hyphen) — `pyproject.name`. |
| NM-02 | ✅ | Dotted import `mgf.test_web`; PEP-420 (no `src/mgf/__init__.py`). |
| NM-03 | ✅ | Codeberg slug `mgf-test-web` (hyphen) — `[project.urls]`. |
| GUI-01 | ✅ | Imports no Qt at module level (the console is web, not Qt; grep clean) — like PR-01. |
| GUI-02 | N/A | No GUI. |
| GUI-03 | N/A | No GUI workers. |
| GUI-04 | N/A | No GUI workers. |
| GUI-05 | N/A | No Qt `main()`. |
| GUI-06 | N/A | No presentation widgets. |
| GUI-07 | N/A | No streaming GUI. |
| GUI-08 | N/A | No GUI-state persistence. |
| GUI-09 | N/A | No GUI tests. |
| GUI-10 | N/A | No GUI capability-gating. |
| FB-05 | ✅ | `FEEDBACK.md` present + the authority-vs-spine-vs-runner-vs-federation routing documented; cross-repo feedback routes to the target repo, never a direct edit. |

---

## AG-20 — owned-infrastructure discipline (standards v2.26)

✅ **Accounted 2026-06-29.** Review-enforced agent conduct (like AG-04 / AG-05 /
AG-15 — no single checkable artifact). Before declaring an action **blocked /
human-gated / impossible**, an agent consults
[`MGF_INFRA.md`](https://codeberg.org/magogi-admin/mgf-standard/src/branch/main/MGF_INFRA.md)
(the fleet infrastructure / access registry) and attempts the self-owned recovery
path — an auth/access failure on Magogi-owned infra (expired token, 401, stopped
service) is a solvable sub-problem, not a terminal wall. Recorded "blocked" /
"gated" notes carry an unblock-path + as-of date and are re-derived against current
capabilities.
