# DEPS — mgf-cloud's bidirectional dependency manifest

> **§1** — what mgf-cloud depends on. **§2** — who depends on mgf-cloud.
> Knowing both directions makes deprecation, breaking-change blast-radius, and
> feature-prioritisation tractable.
>
> **Maintained by:** the mgf-common owner (Bassam — mgf-common owns the
> federation per the one-big-library mindset).
> **Per standard DOC-16:** every project ships a `DEPS.md` at repo root.

Last verified: 2026-06-14.

---

## §1 What mgf-cloud depends on

### Runtime (core — every install pays these)

| Dependency | Window | Why | Tier |
|---|---|---|---|
| `mgf-common` | `>=0.46,<0.47` | cornerstone — typed exceptions, structured logging, layered config | runtime |
| `pydantic` | `>=2.6,<3` | typed resource + credential models | runtime |
| `pydantic-settings` | `>=2.2,<3` | credential / environment config loading | runtime |
| `pyyaml` | `>=6.0,<8` | parse the OpenStack `clouds.yaml` credential file | runtime |

The core stays **light + importable on its own**: importing `mgf.cloud` pulls
no provider SDK. The heavy bits live in optional extras (below), loaded lazily.

### Optional extras (pay only what you use)

| Extra | Dependency | Why |
|---|---|---|
| `infomaniak` | `openstacksdk>=4,<5` | Infomaniak Public Cloud = OpenStack (compute/block/Swift/network) |
| `s3` | `boto3>=1.34,<2` | S3-compatible object storage (Infomaniak S3 endpoint) |
| `aws` | `boto3>=1.34,<2` | AWS provider (0.1 ships a stub adapter only) |
| `remote` | `paramiko>=3,<4` | SSH remote-exec + file-push for post-provision bootstrap |
| `web` | `fastapi>=0.110`, `uvicorn>=0.30`, `jinja2>=3.1,<4`, `mgf-fastapi>=0.6,<0.7` | the local web GUI (`mgf-cloud web`) |
| `standards` | `mgf-common[standards]>=0.46,<0.47` | the standards corpus for the federation CLI checks (dev/opt) |

*Federation siblings depended on: `mgf-common` (cornerstone, runtime) and
`mgf-fastapi` (only under the `[web]` extra). Per AP-03's 0.x discipline the
pins are walked one minor at a time. PKG-06: only the `mgf-*` names resolve from
the Codeberg index; everything else is public PyPI.*

---

## §2 Who depends on mgf-cloud

| Project / sibling | Location | Import sites | Status | Surfaces used |
|---|---|---:|---|---|
| **mgf-fed** | `/home/bassam/PycharmProjects/mgf-fed` | 0 *(planned — Pass 6)* | Will import `mgf.cloud` (via the `mgf-fed[cloud]` extra) to provision the federation's Infomaniak resources — the self-hosted Woodpecker CI host | provider + compute + block + network + bootstrap |

**Zero-consumer reality (today).** mgf-cloud is new at **0.1.0** and has no
runtime adopters yet. `mgf-fed` is the sole intended consumer (the federation's
owner of Infomaniak resources); the wiring lands in Pass 6 of the build plan,
behind a `[cloud]` extra with graceful degradation so base `mgf-fed` stays
light. Per the design, mgf-cloud is **only used by mgf-fed at this time** (a rule
we may relax with a documented reason).

**Federation siblings.** No siblings depend on mgf-cloud today — it is leaf-only
until Pass 6 wires `mgf-fed`.

---

## §3 Maintenance

Updated every MINOR release + when a dependency or consumer changes.
Import-survey methodology for `mgf.cloud`:

```sh
for proj in mgf-fed; do
  grep -rE "(from|import) +mgf\.cloud" "/home/bassam/PycharmProjects/$proj" \
    --include='*.py' | wc -l
done
```

The first non-zero count flips mgf-cloud from "preemptive surface" to "real
library with users" (expected when Pass 6 lands).
