# `mgf-apiprobe` — scope policy

> `mgf-apiprobe`'s **scope policy** (family **SP**) — what belongs in this REST API
> verification tool. A proposed addition is in scope only if it passes the §3 gate.

## §1 In scope (SP-01)
- typed **probes / checks / findings** + the check battery (contract, schema, security,
  quality, observability)
- **auth flows** for authenticating to the *target* API (bearer/basic/api-key/cookie/custom)
- the **CLI runner** + report writers (human/JSON)
- the pluggable **Transport** seam (httpx production impl + mocks)

The boundary: **verify a REST API's responses, contract, schema, and security hygiene.**

## §2 Out of scope (SP-02) — with reasons
| Not here | Why | Where instead |
|---|---|---|
| Load / performance testing | functional verification, not throughput | `locust` / `k6` |
| A full API gateway / proxy | a probe, not infrastructure | the consumer's gateway |
| Implementing the target API | we verify, not build | the consumer's service |
| A GUI / web dashboard | CLI + structured findings | pipe JSON to your tooling |
| Traffic-recording contract generation | spec-driven, not traffic-driven | `mitmproxy` + hand-authored specs |
| Fuzzing / pentest exploitation | hygiene checks, not exploitation | `zap` / a pentest engagement |

## §3 Scope-creep gate (SP-03)
A PR adding a module/check MUST answer: (1) is it response/contract/schema/security
*verification* (else out)? (2) does it fit the Probe→Check→Finding model behind the
Transport seam? (3) consumer demand signal? Any "no/unclear" blocks it.

## §4 Adjacent scope (SP-04)
Adjacent (not yet in): OpenAPI/JSON-Schema validators (DESIGN phases 1.5/2), a cassette-replay
transport, GraphQL probes. Promote adjacent → in only on a documented consumer demand signal.

## §5 Alternatives for out-of-scope needs (SP-05)
Load → `locust`/`k6`; gateway → your infra; GUI → pipe the JSON; fuzzing/pentest → `zap`.

## §6 Revisiting scope (SP-06)
Revisited at every **MAJOR** boundary (0.x → 1.0 and later majors) — the only place a
previously-IN item may be removed; a major bump re-justifies the whole surface against §1/§2
and re-affirms the verify-only / Probe-Check-Finding / transport-behind-a-seam invariants.


## Boundary — verified ownership (generated)

> Generated from the fleet-wide import matrix — the **verified** ownership boundary (who is the SOLE importer of each third-party dep across the whole federation). Regenerate with `fleet_ownership_audit.py --inject`; CI-gated against code drift by `--check`. **Do not hand-edit the block below.**

<!-- BEGIN BOUNDARY (generated by mgf-standard/scripts/fleet_ownership_audit.py --inject; do not hand-edit) -->
- **Owns (sole third-party importer, fleet-verified):** `jsonpath_ng`
- **Shared third-party (intentional, boundary-checked):** `httpx` (+mgf-http, mgf-logship)
- **Federation deps (imports):** `mgf.apiprobe`, `mgf.common`
<!-- END BOUNDARY -->
