# `mgf-test-web` — scope policy

> What belongs in ProofWarden, the testing & CI authority (family **SP**). A
> proposed addition is in scope only if it passes the §3 gate.

## §1 In scope (SP-01)

The **per-project testing & CI authority** — the FastAPI-free base:

- **The warden authority** — the per-project resident broker that is the **sole
  executor**; single-flight enforced *by construction* via an atomic **lease
  registry** (running leases + FIFO queue + the rolling audit), with heartbeat +
  TTL + **audited reclaim** for crash recovery, and the cross-process UDS daemon
  (`fcntl` singleton + stale-socket reclaim) so every origin reaches one warden.
- **`testctl`** — the deterministic, JSON-emitting **contract surface** (`serve` /
  `run` / `status` now; `catalog` / `watch` / `cancel` / `ci start` later). None of
  these execute a test directly; `run` is **fail-closed**.
- **Runner adapters** — the swappable `Runner` seam: `pytest_runner` now; the
  production `mgf-test-supervisor`-as-library adapter + `zig build test` / shell
  adapters later (same signature).

The boundary: **the run authority + its contract surface** live here, headless of
the web stack so the warden is unit-testable and CI-installable without FastAPI.

## §2 Out of scope (SP-02)

| Not here | Why | Where instead |
|---|---|---|
| The schemas / sync engine / version-aware reader / live-NDJSON + run-record I/O / `SourceProvider` | the shared spine — consumed, not owned | `mgf-fedres` |
| The **FastAPI console** | a separable presentation layer, delivered as the **`[web]` optional extra** so the base stays FastAPI-free (CI installs the authority alone) | `mgf-test-web[web]` (this repo's extra) |
| The brand-web CSS / instrument layer | presentation assets, not the authority | `mgf-brand-web` |
| Fleet orchestration (gates, release, drift, registry) | federation-wide tooling | `mgf-fed` |
| Actually running the pytest tiers (`.gates`, quarantine, bundles) | the test executor, driven as a library | `mgf-test-supervisor` |
| Defining the standards corpus / the registry | the standards source of truth | `mgf-standard` |

## §3 Scope-creep gate (SP-03)

A PR MUST answer: (1) does it belong to the **run authority** (the warden / leases /
`testctl` / a runner adapter) rather than the spine or the console? (2) does it keep
the **base FastAPI-free** (no web-framework import outside the `[web]` extra)? (3)
does it preserve the authority invariants — **single-flight by construction**,
**fail-closed**, **lease-not-lock** (heartbeat + TTL + audited reclaim), every
acquire/coalesce/queue/reclaim/refusal **recorded as visible proof**, and the
contract surface **read-mostly** (submits run requests, never executes elsewhere,
never edits committed state)? Any "no/unclear" blocks it.

## §6 Revisiting scope (SP-06)

Revisited at every MAJOR boundary; re-affirms the single-flight-by-construction +
fail-closed + lease-not-lock + FastAPI-free-base invariants.
