# DEPS — mgf-secrets's bidirectional dependency manifest

> **§1** — what mgf-secrets depends on. **§2** — who depends on it.
> **Per standard DOC-16:** every project ships a `DEPS.md` at repo root.

Last verified: 2026-07-18.

## §1 What mgf-secrets depends on

The registry/doctor core stays stdlib-only (`tomllib` for TOML); **Phase 2 adds one
runtime dependency, `pyrage`** (age encryption — DECISION D-2: one wheel, no daemon,
no binary), imported only by `mgf.secrets.store`. No `mgf-*` runtime dependency — the
tool must keep working even when the rest of the federation is mid-change.

| Scope | Dependency | Why |
|---|---|---|
| runtime | `pyrage>=1.2,<2` | age-encrypted store (`mgf.secrets.store`); resolves via devpi's `root/pypi` mirror |
| runtime | Python ≥3.11 stdlib | registry (`tomllib`), doctor, probes, CLI, materialize |
| `standards` | `mgf-common[standards]>=0.47,<1.0` | standards corpus for the federation CLI checks (dev/opt) |
| `dev` | pytest, pytest-cov, pytest-timeout, ruff, mypy, import-linter, mgf-test-supervisor, mgf-standard | the green gates + the tier runner + the standards corpus |

It reads (does not import) two sibling data sources at runtime from the federation
root: `mgf-standard/SECRETS.toml` + `sooth-standard/SECRETS.toml` (the registry),
and `MGF_LIBRARIES.json` + `SOOTH_LIBRARIES.json` (for `ALL_MANAGED` resolution).
These are *data*, not package dependencies.

## §2 Who depends on mgf-secrets

| Project | Status | Surfaces used |
|---|---|---|
| the estate cron (agent2) | **planned** (P4) | `doctor --json` on a schedule → pager |
| CI pipelines / agents | **planned** (P2+) | the machine CLI (`--json`, exit codes) + the `exec` value-injection verb |

As the credential-governance leaf it is **not** a runtime dependency of any
consumer: tools keep reading env vars + `my_stuff/` paths. If `mgf-secrets`
vanished, everything keeps running — only governance stops.

## §3 Maintenance

Updated every MINOR release + when a consumer adopts it. A registry-schema bump or
a new `kind`/surface walks the cross-family contract (DOC-18) and is recorded in
`CHANGELOG.md`.
