# LESSON_LEARNED — mgf-cloud-provision

An append-only, dated log of non-obvious lessons (DOC-19).

## 2026-06-18 — drive the cloud through `mgf-cloud`'s CloudProvider so the whole library tests with no cloud
The converge engine (`plan`/`apply`/`destroy`) takes a `CloudProvider` rather than building one itself, so every test runs against `mgf-cloud`'s in-memory `FakeProvider` — full coverage, zero credentials, zero billing. The CLI is the only place that constructs the real provider (`mgf.cloud.config.load` → `get_provider`). *Takeaway:* for any tool that wraps a side-effecting SDK, inject the SDK boundary so the logic is exercisable in CI; keep credential/provider construction at the edge.
