# DEPS — mgf-apiprobe's bidirectional dependency manifest

> **§1** — what mgf-apiprobe depends on. **§2** — who depends on
> mgf-apiprobe. Knowing both directions makes deprecation,
> breaking-change blast-radius, and feature-prioritisation tractable.
>
> **Maintained by:** the mgf-common owner (Bassam).
> **Per standard DOC-16** (v2.12): every project ships a `DEPS.md` at
> repo root. Replaces the former `USERS.md` (its roster is now §2).

Last verified: 2026-05-28.

---

## §1 What mgf-apiprobe depends on

mgf-apiprobe is a **leaf verification tool** — CLI-first, run against
staging/prod endpoints. Its runtime core is HTTP + JSON-querying; the
heavier capabilities (Faker factories, OpenAPI ingestion, cassette
signing) live behind extras with lazy imports (DP-02).

| Dependency           | Window        | Why                                                  | Tier |
|----------------------|---------------|------------------------------------------------------|------|
| `mgf-common`         | `>=0.40,<0.42`| `BaseAppSettings` / `AppError` / observability / vault — federation cornerstone | runtime |
| `httpx`              | `>=0.27`      | async HTTP client — issues the probe requests        | runtime |
| `pydantic`           | `>=2.7`       | typed probe / check / finding models                 | runtime |
| `jsonpath-ng`        | `>=1.6`       | JSONPath assertions over response bodies             | runtime |
| `jmespath`           | `>=1.0`       | JMESPath assertions over response bodies             | runtime |
| `faker`              | `>=25`        | Faker-backed factories                               | `[faker]` extra (lazy) |
| `openapi-core`       | `>=0.19`      | OpenAPI ingestion                                    | `[openapi]` extra (lazy) |
| `cryptography`       | `>=42`        | cassette signing                                     | `[signing]` extra (lazy) |

*Federation siblings depended on: `mgf-common` — typed exceptions,
bootstrap, observability, and vault per HANDOFF §3.2.*

---

## §2 Who depends on mgf-apiprobe

Consumer projects + federation siblings that import `mgf.apiprobe.*`.
(Inverse of each consumer's `MGF_ADOPTION.md`.)

| Project / sibling | Location                                  | Import sites | Status                           | Surfaces used                        |
|-------------------|-------------------------------------------|-------------:|----------------------------------|--------------------------------------|
| **inthewords**    | `/home/bassam/PycharmProjects/inthewords` | 1            | Single use — release-smoke probe | One check from `mgf.apiprobe.checks` |

**Single-consumer reality.** mgf-apiprobe is positioned as a CLI-first
internal-verification tool. The v0.5.x surface is large because the
library models a rich check API, not because it has many consumers.
Adoption will broaden when more federation consumers ship public APIs.

**Federation siblings (`mgf-*`).** No siblings depend on mgf-apiprobe
today. It is not an in-process dependency — consumers run it via its
CLI against staging/prod endpoints.

**CLI users.** Because the CLI (`apiprobe run …`) is the primary
surface, version-skew concerns are about CLI flag stability rather than
Python-API stability. CLI users won't appear in an import survey but
ARE users; track CLI breaking changes in `CHANGELOG.md` under a
dedicated `### CLI` heading.

---

## §3 Maintenance

Updated every MINOR release + when a dependency or consumer changes.
Import-survey methodology:

```sh
for proj in vm-vmanager-app inthewords PlasmaMapper figrecovery; do
  grep -rE "(from|import) +mgf\.apiprobe" "/home/bassam/PycharmProjects/$proj" \
    --include='*.py' | wc -l
done
```

Re-run before each MINOR release. Count CLI invocations separately
(CI / scripts) — they don't show up in the `grep`.
