# SCOPE — mgf-cloud-provision

## In scope
- **Declarative service provisioning** on top of `mgf-cloud`: a `ServiceSpec` (one service-bearing VM + its cloud-init) and the `plan` / `apply` / `destroy` converge engine.
- **Idempotency + drift**: `plan` is read-only and diffs desired vs. live (CREATE / NOOP / REPLACE); `apply` gates destructive REPLACE behind an explicit flag.
- **Built-in service specs** for the federation's own infra — devpi first; CI agents, Vault, registry-mirror to follow.
- **Provider-agnostic + testable**: drives any `mgf.cloud.providers.base.CloudProvider`, so the whole surface runs against the in-memory `FakeProvider` with no cloud.

## Out of scope (by design)
- **The cloud SDK itself** — VM/volume/network primitives live in `mgf-cloud`; this library composes them, never re-implements them.
- **General-purpose IaC** (Terraform/Ansible/k8s replacement). This is a thin, boring converge layer for *our* handful of services, not a config-management platform.
- **Application/runtime config** of the services beyond first boot (cloud-init). Day-2 service config is the service's own concern.
- **Secrets storage** — credentials come from `mgf-cloud`'s config / a future Vault; this library never persists secrets.

## Boundary with siblings
- `mgf-cloud` — *talk to OpenStack* (adapter, models, CLI). We depend on it.
- `mgf-cloud-provision` — *declare + converge our services* (this repo). **Absorbs** `mgf-fed provision-ci-host`.
- `mgf-fed` — federation orchestration/tracking only; provisioning moves out of it into here.
