# START HERE — mgf-cloud-provision

A navigator for developers + AI agents. For the federation briefing run `mgf-fed agents` (or `mgf-common agents`); this file is the project-specific entry.

## What this is
Declarative provisioning of the Magogi Foundation's self-hosted services on Infomaniak, built on `mgf-cloud`. See [`README.md`](README.md) for the pitch and [`SCOPE.md`](SCOPE.md) for the in/out boundary.

## Layout
```
src/mgf/cloud_provision/
  models.py       ServiceSpec, Action, ServicePlan, ApplyResult (frozen pydantic)
  _provision.py   plan() / apply() / destroy() / to_server_spec()  ← the converge engine
  _spec.py        load_spec(path) — TOML (+ cloud_init_file) → ServiceSpec
  services.py     devpi_service_spec() — the first customer (Phase-0 values)
  exceptions.py   ProvisionError / SpecError (extend mgf.common.exceptions)
  __main__.py     the `mgf-cloud-provision` CLI (plan/apply/destroy)
examples/devpi.toml + devpi-cloud-init.yml   a runnable spec
tests/unit/mgf/cloud_provision/              full coverage vs the fake provider
```

## Run it without a cloud
Everything works against `mgf.cloud`'s in-memory `FakeProvider`:
```bash
mgf-cloud-provision plan examples/devpi.toml --provider fake
pytest            # all green, no credentials
```

## The four gates
`ruff check src tests` · `mypy src` · `pytest --cov --cov-fail-under=80` · `lint-imports`

## Federation context
- Rollout plan: `~/.claude/plans/plan-self-hosted-pypi-sequencing-2026-06-18.md` (this repo = Phase 1a).
- Why now: the 2026-06-18 CI audit — owning the package index (devpi) closes the dependency-confusion findings; this library stands devpi up.
- Conformance: tracked in `docs/inprogress/MGF_STANDARDS_CONFORMANCE.md` (added once the repo is registered as a federation member + scaffolded via `mgf-fed scaffold`).

## Not yet done (Phase 1b+)
- Live `infomaniak` provider end-to-end (cloud-init converge: devpi-server + Caddy/LE + index init + backup).
- Federation registration: add to `MGF_LIBRARIES` + the roster, then `mgf-fed scaffold` generates `.woodpecker.yml` + the byte-exact policy files + conformance tracker.
