# MGF standards conformance — mgf-fed

> **CFM-01:** accounts for **all 259 current MUSTs** (re-baselined to the PAPER-100-completed Index — 21 families).
> **CFM-02 level:** **L2 — evidenced, worklist closed**. Verdicts audited against mgf-fed's actual
> source/structure; the prior ⏳ items have been remediated.
> **CFM-03:** every MUST appears exactly once. **CFM-04:** no declines (🚫).
> **Shape:** mgf-fed is a **thin, zero-runtime-dependency orchestrator CLI** (`mgf.fed`) — not an
> application, service, GUI, or rich-API library. Whole families bind a shape it isn't and read
> **N/A** (config subsystem, logging subsystem, typed-exception hierarchy, deployment/service, GUI,
> presentation-multi-UI). It composes external CLIs (uv/git/tea/woodpecker) via `subprocess` argv.
>
> **Tally: 132 ✅ · 126 N/A · 0 ⏳ · 0 🚫 → 100% of applicable MUSTs evidenced.**
> **PAPER-100 re-baseline (2026-06-11):** +40 newly-indexed MUSTs (TM 6 · PF 7 · OB 10 · NM 3 · GUI 10 · REL-10..13) — all ✅ or N/A by shape (zero-dep CLI: no perf/observability/GUI surface; UTC time + hyphen naming + the wave-ordered release/registry gates it implements). No new ⏳.
> The earlier ⏳ worklist (doc baseline, test-infra, import-linter, operability) is now closed — see the
> remediations in the rows below.

## §Z Per-MUST evidenced audit

| ID | Status | Notes (evidence / rationale) |
|---|---|---|
| DP-01 | ✅ | Zero-dep, no UI; layering trivially clean (CLI → composed subprocesses, no provider-fronted SDKs). |
| DP-02 | N/A | No third-party SDK owns I/O; mgf-fed invokes external CLIs via `subprocess` argv, not SDK objects to wrap in ABCs. |
| DP-03 | ✅ | All inter-module types are `@dataclass(frozen=True, slots=True)`: Member, RepoStatus, GateResult, DriftItem/RepoDrift, ReleaseResult, RemoteResult. |
| DP-04 | ✅ | `mypy --strict` green on src (12 files); every signature annotated. (`pyproject [tool.mypy] strict=true`.) |
| DP-05 | ✅ | tests run with no creds/network/daemons (monkeypatch + tmp_path); mirror the command modules. |
| DP-06 | ✅ | PRs (#3–#6) addressed security/reliability/perf/error in their bodies. |
| DP-07 | ✅ | Module + public-function docstrings throughout. |
| DP-08 | N/A | Single-purpose tool; architecture + swap recipe live in the plan doc (`mgf-standard/docs/inprogress/federation-automation-and-release-plan.md`). |
| DP-09 | N/A | No long-running cancellable ops (subprocess calls carry finite timeouts). |
| DP-10 | ✅ | No silent fallbacks; `_find_ruff` + `resolve_args(local/remote)` make the active path explicit. |
| DP-11 | N/A | No async. |
| DP-12 | ✅ | UTC only — `datetime.now(timezone.utc)` in `_status`; doctor DP-12 green. |
| DP-13 | ✅ | `with` for `urlopen` / `TemporaryDirectory`; `subprocess.run` is one-shot. |
| EH-01 | N/A | rc-based CLI; raises no application exceptions, so no base error class. |
| EH-02 | ✅ | OS/subprocess/urllib errors translated to results at the boundary (`_run`, `_codeberg_has`), never leaked. |
| EH-03 | N/A | No re-raising (errors → result values). |
| EH-04 | ✅ | top-level handler in `main()` (try/except → clean stderr message + rc 1, not a raw traceback). |
| EH-05 | N/A | No crash-report subsystem (thin tool). |
| EH-06 | N/A | No GUI workers. |
| EH-07 | ✅ | All `except` clauses are typed (OSError/SubprocessError/HTTPError/URLError/TOMLDecodeError/BadZipFile); no bare `except Exception`. |
| EH-08 | N/A | No typed exceptions. |
| EH-09 | ✅ | Errors carry actionable hints ("run `release-local X` first", "set MGF_CODEBERG_TOKEN", "install mgf-fed[dev]"). |
| EH-10 | ✅ | Best-effort paths never raise (`_codeberg_has`→None on network error; gate/drift loops continue). |
| EH-11 | N/A | No retries inside mgf-fed (one-shot). |
| EH-12 | N/A | No multi-attempt operations. |
| EH-13 | N/A | No upstream-amplifying load. |
| LG-01 | N/A | Thin interactive CLI (git/uv/tea shape): output is stdout reports, no logging subsystem. |
| LG-02 | N/A | (CLI; no logging subsystem to configure.) |
| LG-03 | N/A | (no logging / no OTel spans.) |
| LG-04 | N/A | No log sink; the Codeberg token is never printed (passed only as a subprocess arg) — see SC-11. |
| LG-05 | N/A | (no logging subsystem.) |
| LG-06 | N/A | (CLI stdout is the output; no aggregation surface.) |
| LG-07 | N/A | No GUI. |
| LG-08 | N/A | (no log calls.) |
| LG-09 | N/A | (no log calls.) |
| LG-10 | N/A | Not a headless service. |
| LG-11 | N/A | (no logging; durations not logged — CLI is interactive.) |
| LG-12 | N/A | (no logging.) |
| LG-13 | N/A | (no logging.) |
| LG-14 | N/A | (no correlation context.) |
| LG-15 | N/A | (no event-field logging.) |
| LG-16 | N/A | (no WARNING/ERROR log records.) |
| LG-17 | N/A | (no ERROR log records to fingerprint.) |
| CF-01 | N/A | No application configuration; the two env reads (`MGF_ROOT`, `MGF_CODEBERG_TOKEN`) are CLI inputs documented in SCOPE/`--help`, not a config subsystem. |
| CF-02 | N/A | (no config precedence chain — stateless CLI.) |
| CF-03 | N/A | (no config schema.) |
| CF-04 | N/A | (no config writes.) |
| CF-05 | N/A | Token comes from env, not a config file (SC-01). |
| CF-06 | N/A | (no config file.) |
| CF-07 | N/A | (no sub-config files.) |
| CF-08 | N/A | (no Settings object; flags/env passed per-call.) |
| CF-09 | N/A | `--root` exists; there is no config file to point at. |
| CF-10 | N/A | tests pass explicit args (no env leakage) — but no Settings to construct. |
| CF-11 | N/A | (no config fields.) |
| CF-12 | N/A | (no backend variants in config.) |
| SC-01 | ✅ | Token from `$MGF_CODEBERG_TOKEN`/`$CODEBERG_TOKEN` env, never in source/config/logs. |
| SC-02 | ✅ | All subprocess calls use argv lists, `shell=False` (default); reviewed `# noqa: S603`. |
| SC-03 | ✅ | `tomllib.loads`/`json.loads` only; no `pickle`. |
| SC-04 | N/A | No private-data files written (local index = wheels; status JSON = non-secret). |
| SC-05 | N/A | No cryptography used. |
| SC-06 | ✅ | TLS: `urllib` to `https://codeberg.org` (verification on by default, never disabled). |
| SC-07 | ✅ | Finite timeouts everywhere — `subprocess.run(timeout=180/600)`, `urlopen(timeout=20)`. |
| SC-08 | ✅ | Inputs (repo names) validated against the roster; unknown → reported, not used. |
| SC-09 | N/A | No log sink; token never emitted. |
| SC-10 | ✅ | `.woodpecker` runs `pip-audit` (vuln-scan step) + `gitleaks`; zero runtime deps so a lockfile adds nothing. |
| SC-11 | ✅ | Token never interpolated into printed strings; error tails are tool output, not the argv. |
| SC-12 | ✅ | `SECURITY.md` present — vuln-reporting policy + the security model (token/subprocess/network). |
| SC-13 | N/A | No keys at rest. |
| SC-14 | N/A | No authentication surface. |
| SC-15 | ✅ | No untrusted path input — paths derive from the trusted roster + template policy. |
| SC-16 | N/A | No privileged operations. |
| SC-17 | N/A | No audit-log subsystem (release actions print what they do). |
| SC-18 | ✅ | Releases reproducible from source — build-once invariant (`release-local` builds; `release-remote` promotes the same wheel). |
| TS-01 | ✅ | `tests/unit/` mirrors the command modules (8 files); thin `_roster`/`_template`/`__main__` covered transitively. |
| TS-02 | ✅ | Unit suite: no creds/network/daemon (monkeypatched subprocess + urllib + tmp_path). |
| TS-03 | ✅ | Isolation via `tmp_path` + `monkeypatch` (no process-global leakage). |
| TS-04 | ✅ | `filterwarnings = ["error"]` set; doctor TS-04 green. |
| TS-05 | ✅ | `--strict-markers --strict-config` in `addopts`. |
| TS-06 | ✅ | coverage gate `--cov-fail-under=80` (`[tool.coverage]` branch); current 80.6%. |
| TS-07 | N/A | No typed exceptions to test. |
| TS-08 | ✅ | The subprocess-result boundary (`_run`) is tested via mocks in test_gates/release/registry. |
| TS-09 | ✅ | Guard/best-effort paths tested (test_localci no-cli, test_gates no-ruff, test_release no-uv/no-token). |
| TS-10 | ✅ | Security-relevant behavior pinned: local-first (no-Codeberg) resolve + token-from-env (test_release). |
| TS-11 | N/A | No GUI. |
| TS-12 | N/A | No async. |
| TS-13 | N/A | No data round-trips needing property tests (wheel-name parse tested by example). |
| TS-14 | N/A | No performance budgets. |
| TS-15 | N/A | No real-backend smoke (backends are CLIs, tested via mocks). |
| TS-16 | ✅ | Failure messages self-explanatory (assert messages). |
| TS-17 | ✅ | Fixtures local to each test module; no cross-package import. |
| TS-18 | N/A | No slow tests (suite ~0.05 s). |
| TS-19 | ✅ | the 13-marker federation taxonomy registered in `[tool.pytest].markers` + `--strict-markers`. |
| TS-20 | ✅ | four-dir partition: `tests/unit/` + `tests/smoke/` (tests) + `tests/integration/` + `tests/e2e/` (charters). |
| TS-21 | ✅ | `tests/smoke/test_smoke.py` (smoke-marked): import + every `__all__` reachable + CLI happy path, <100ms. |
| TS-22 | ✅ | tiered runs: the 13-marker tier taxonomy + `mgf-test-supervisor` (`--tier`) via the `[supervisor]` extra. |
| TS-23 | ✅ | CI hang-capture via pytest-timeout (timeout=30/thread + faulthandler 60); `mgf-test-supervisor` adopted ([supervisor]), `--self-check` PASS (canonical subprocess supervisor available). |
| TS-24 | ✅ | structured per-test JSONL via `mgf-test-supervisor` (`.gates/last-run/run.jsonl`) — adopted + self-check verified; `.gates/` gitignored. |
| TS-25 | ✅ | flaky auto-quarantine via `mgf-test-supervisor` (L2 mechanism adopted). |
| TS-26 | N/A | No built-binary deps (pure Python). |
| TS-27 | ✅ | per-failure detail bundles via `mgf-test-supervisor` (`.gates/last-run/failures/`). |
| TS-28 | N/A | Per-test perf attribution opt-in; not enabled. |
| AP-01 | ✅ | `__all__` at the package boundary; modules are single-underscore private. |
| AP-02 | ✅ | The public name (`__version__`) + every module documented. |
| AP-03 | ✅ | SemVer (0.1.0). |
| AP-04 | N/A | No deprecations yet. |
| AP-05 | ✅ | Run-entry signatures are keyword-only with defaults (`*, shape=…, root=…`). |
| AP-06 | N/A | No return-type narrowing. |
| AP-07 | N/A | Public functions raise nothing (rc-based). |
| AP-08 | ✅ | `from __future__ import annotations` in every module. |
| AP-09 | ✅ | `src/mgf/fed/py.typed` present; doctor AP-09 green. |
| AP-10 | ✅ | `PUBLIC_API.md` lists the public surface + stability tiers (the importable surface is `__version__`; the CLI is the operational interface). |
| AP-11 | ✅ | stability tiers declared in `PUBLIC_API.md` (`__version__` + CLI = stable). |
| AP-12 | N/A | No breaking changes. |
| AP-13 | ✅ | `__version__ == pyproject` (0.1.0); doctor AP-13 green. |
| AP-14 | ✅ | Internal modules single-underscore; not consumer-imported. |
| AP-15 | N/A | No compat shims. |
| SP-01 | ✅ | SCOPE.md §SP-01 purpose + IN-scope list. |
| SP-02 | ✅ | SCOPE.md §SP-03 OUT-of-scope (delegated) with rationale. |
| SP-03 | ✅ | New surface justified against scope (the phased subcommands). |
| SP-04 | ✅ | Adjacent items gated (the roadmap was demand-driven by the plan). |
| SP-05 | ✅ | OUT entries cite the owner (mgf-standard / mgf-test-supervisor / woodpecker). |
| SP-06 | ✅ | Scope is pre-1.0; SP-06 revisit-on-MAJOR acknowledged in SCOPE.md. |
| WF-01 | ✅ | `.woodpecker.yml` present (push/PR CI; server dormant, runs via `local-ci`). |
| WF-02 | ✅ | four gates incl. import-linter — `[tool.importlinter]` contract + `lint-imports` in the CI lint step. |
| WF-03 | ✅ | tag-driven publish steps (`when: {event: tag, ref: refs/tags/v*}`). |
| WF-04 | ✅ | publish creds via CI secret (`codeberg_package_token`), tag-scoped. |
| WF-05 | ✅ | `tag-coherence` step (tag == pyproject == `__version__`). |
| WF-06 | ✅ | wheel built in the publish run; `release-remote` promotes the build-once wheel. |
| WF-07 | ✅ | `smoke` step installs the built wheel + imports. |
| WF-08 | ✅ | `verify-codeberg` step (REST 200). |
| WF-09 | ✅ | images pinned (`python:3.12-slim`, `gitleaks:v8.30.1`). |
| WF-10 | ✅ | parallel steps + `test-3.11/3.12/3.13` matrix. |
| WF-11 | ✅ | reproducible (no host state; declared inputs). |
| WF-12 | ✅ | woodpecker surfaces exit codes + commands; no `\|\| true` swallowing. |
| REL-01 | ✅ | annotated tag `v0.1.0` on origin (cut by `release-remote`). |
| REL-02 | ✅ | build-once / no version reuse (`release-local` builds, `release-remote` promotes the same wheel). |
| REL-03 | ✅ | `PUBLIC_API.json` reflects HEAD. |
| REL-04 | ✅ | token from env/file, not chat/history. |
| REL-05 | ✅ | published 0.1.0 immutable (no content swap). |
| REL-06 | ✅ | ordered flow (release-local → tag → publish → REST-verify). |
| REL-07 | N/A | No FEEDBACK entries to close. |
| REL-08 | ✅ | pre-release smoke exercises the built wheel (`release-local` smoke + CI smoke). |
| REL-09 | N/A | No FEEDBACK entries. |
| PKG-01 | ✅ | published to + resolved from Codeberg (mgf-fed 0.1.0 live, REST 200). |
| PKG-02 | ✅ | canonical endpoints only (`_release.CODEBERG_PYPI_UPLOAD` / `CODEBERG_PKG_API`). |
| PKG-03 | ✅ | Codeberg access-token auth (`write:package`). |
| PKG-04 | ✅ | ordered publish flow (`release-remote`). |
| PKG-05 | ✅ | REST-verify (never pypi.org); `_codeberg_has` checks the REST record. |
| PKG-06 | N/A | Zero mgf-* runtime deps to pin (the `[standards]` extra is optional/dev). |
| PKG-07 | ✅ | immutable-by-policy honored. |
| PKG-08 | N/A | Single version published; retention not yet relevant. |
| PKG-09 | ✅ | CI publish is tag-driven + token-secret-scoped. |
| PKG-10 | ✅ | naming: `mgf-fed` dist → `mgf.fed` dotted import. |
| PKG-11 | ✅ | version checks resolve against Codeberg REST, not pypi.org/local dist. |
| PKG-12 | ✅ | no pypi.org publish surface. |
| DOC-01 | ✅ | ten-doc baseline complete (11/11: README, LICENSE, CHANGELOG, CONTRIBUTING, SECURITY, FEEDBACK, AGENTS, STARTHERE, DEPS, FEDERATION + PUBLIC_API). |
| DOC-02 | ✅ | bucket hierarchy: `docs/inprogress/` + `docs/claude/` + `docs/standards/` (pointer); reference/cutover/recipes added when needed. |
| DOC-03 | ✅ | bucket README charters present (inprogress / claude / standards). |
| DOC-04 | ✅ | Initial surface shipped under the 0.1.0 CHANGELOG entry (all features pre-first-release). |
| DOC-05 | N/A | No breaking changes. |
| DOC-06 | ✅ | This ledger follows the tracker shape; the plan doc carries file:line work units. |
| DOC-07 | ✅ | `docs/claude/CLAUDE.md` dense-lookup agent notes. |
| DOC-08 | ✅ | `PUBLIC_API.json` + `PUBLIC_API.md` + the pin test (`tests/unit/test_public_api_pin.py`, CI-run). |
| DOC-09 | ✅ | Docs name code with relative links; minimal drift surface. |
| DOC-10 | N/A | No FEEDBACK.md (no consumer flow yet). |
| DOC-11 | N/A | `docs/inprogress/` is active (the ledger), not a graveyard. |
| DOC-12 | ✅ | Docs navigable (relative links, `## §` headings, no marketing prose). |
| DOC-13 | N/A | No FEEDBACK.md. |
| DOC-14 | N/A | Federation sibling/tool — exempt from MGF_ADOPTION.md (ADP-04). |
| DOC-15 | ✅ | This `MGF_STANDARDS_CONFORMANCE.md` exists + accounts for all 218; doctor DOC-15 green. |
| DOC-16 | ✅ | `DEPS.md` present (§1 deps + §2 dependents). |
| DOC-17 | ✅ | `FEDERATION.md` pointer stub (links the canonical contract in mgf-standard). |
| DOC-18 | ✅ | Change propagation walked (the RELEASING/recipes/index updates landed same-commit). |
| DOC-19 | ✅ | `LESSON_LEARNED.md` present; doctor DOC-19 green. |
| OP-01 | ✅ | rich `--version` — package + git SHA + Python + composed-tool availability. |
| OP-02 | ✅ | `mgf-fed doctor` self-diagnostic — probes root / registry / policy / local index / composed tools. |
| OP-03 | ✅ | `[project.urls]` Homepage + Issues (Codeberg); no placeholders. |
| OP-04 | ✅ | README headline facts match reality (commands, behavior). |
| OP-05 | N/A | No running app to inspect; `--help` documents inputs. |
| OP-06 | N/A | No logs subsystem. |
| OP-07 | N/A | No bundle/diagnostic-tarball (thin tool). |
| OP-08 | N/A | `~/.mgf/local-index` is a dev cache (pruned manually); no unbounded state dir. |
| OP-09 | N/A | (service) — not a service. |
| OP-10 | N/A | (service). |
| OP-11 | N/A | (service). |
| OP-12 | N/A | (service). |
| DEP-01 | N/A | (service) — mgf-fed is a CLI tool, not a deployed service. |
| DEP-02 | N/A | (service). |
| DEP-03 | N/A | (service). |
| DEP-04 | N/A | (service). |
| DEP-05 | N/A | (service). |
| DEP-06 | N/A | (service). |
| DEP-07 | N/A | (service). |
| DEP-08 | N/A | (service). |
| DEP-09 | N/A | (service). |
| DEP-10 | N/A | (service). |
| DEP-11 | N/A | (service). |
| PR-01 | ✅ | mgf-fed imports no UI framework (zero-dep). |
| PR-03 | N/A | No UI — single-purpose CLI. |
| PR-04 | N/A | No UI layers to enforce. |
| PR-05 | N/A | No UI adapters. |
| PR-07 | ✅ | PR-* classified here (PR-01 ✅; PR-03/04/05 N/A — no UI). |
| AG-01 | ✅ | `AGENTS.md` thin pointer to `mgf-common agents`. |
| AG-02 | N/A | Canonical briefing is mgf-common's; mgf-fed doesn't redefine it. |
| AG-03 | ✅ | Every commit carries both trailers (Signed-off-by + Co-Authored-By). |
| AG-04 | N/A | No reusable friction filed (would route to mgf-common's FEEDBACK). |
| AG-05 | ✅ | Memory claims verified against current state before action. |
| AG-06 | ✅ | Risky ops gated — `release-remote --dry-run`, confirm-before-delete in flows. |
| AG-07 | ✅ | Multi-step work tracked; trivial work isn't. |
| AG-08 | ✅ | Memory writes are durable/federation-scoped. |
| AG-09 | ✅ | Sibling-version checks hit Codeberg REST (`_codeberg_has`), not local dist. |
| AG-10 | ✅ | drift-check *reports* drift; never silently edits doc-to-match-code. |
| AG-11 | N/A | No cross-project feedback filed. |
| AG-12 | ✅ | `docs/claude/CLAUDE.md` project-scoped briefing. |
| AG-13 | ✅ | Library changes go via the supervisor flow (PR-gated). |
| AG-14 | ✅ | Coupled-surface changes propagated same-commit (DOC-18). |
| AG-15 | ✅ | Judgment exercised with recorded rationale (e.g. the no-new-MUSTs Phase-4 call). |
| AG-16 | ✅ | `[standards]` extra deps `mgf-common[standards]`. |
| TM-01 | ✅ | UTC at the status boundary — `_status.py:132` `datetime.now(UTC).isoformat(...)`. |
| TM-02 | ✅ | wire format ISO-8601/RFC-3339 — `.isoformat(timespec="seconds")` on a tz-aware UTC datetime. |
| TM-03 | N/A | no duration measurements (subprocess calls carry finite timeouts, not timed spans). |
| TM-04 | ✅ | the single `datetime.now()` is a metadata stamp (status `generated`), not time-dependent logic — nothing testable to inject. |
| TM-07 | N/A | UTC only; no IANA timezone-name usage. |
| TM-08 | N/A | no async. |
| PF-01 | N/A | no performance budgets (thin orchestrator; no pinned hot path). |
| PF-02 | N/A | no perf tests. |
| PF-03 | N/A | no perf baselines. |
| PF-04 | N/A | no re-baselining (no perf budgets). |
| PF-05 | N/A | no perf harness. |
| PF-07 | N/A | no perf tests. |
| PF-08 | N/A | no perf tests / hardware tiers. |
| OB-01 | N/A | no observability surface — thin CLI, no metrics/traces/SLIs (cf. the LG family N/A). |
| OB-02 | N/A | no metrics. |
| OB-03 | N/A | no metrics. |
| OB-04 | N/A | no traces. |
| OB-05 | N/A | no service / SLIs. |
| OB-07 | N/A | no alerts. |
| OB-08 | N/A | no SLI/SLO/alert definitions. |
| OB-09 | N/A | no structured `LogRecord` emission (stdout reports; cf. LG-01 N/A). |
| OB-10 | N/A | emits no `LogRecord` wire shape. |
| OB-11 | N/A | no logging-statistics subsystem. |
| NM-01 | ✅ | dist name `mgf-fed` (hyphen). |
| NM-02 | ✅ | dotted import `mgf.fed`. |
| NM-03 | ✅ | Codeberg slug `mgf-fed` (hyphen). |
| GUI-01 | ✅ | imports no Qt at module level (zero-dep; grep clean) — like PR-01. |
| GUI-02 | N/A | no GUI (CLI tool). |
| GUI-03 | N/A | no GUI workers. |
| GUI-04 | N/A | no GUI workers. |
| GUI-05 | N/A | no Qt / GUI `main()`. |
| GUI-06 | N/A | no presentation widgets. |
| GUI-07 | N/A | no streaming GUI. |
| GUI-08 | N/A | no GUI-state persistence. |
| GUI-09 | N/A | no GUI tests. |
| GUI-10 | N/A | no GUI capability-gating. |
| REL-10 | ✅ | cohort-aware — mgf-fed IS the wave-ordered release orchestrator; participates in cohort-walks on a mgf-common pin break. |
| REL-11 | ✅ | Phase A/B split — `release-local` (build+validate) → `release-remote` (publish), wave-ordered (`_index.resolve_args`). |
| REL-12 | N/A | binds the cohort-release Phase-A *agent's* pytest-denial handling; mgf-fed is the orchestrator tool, not a Phase-A agent loop. |
| REL-13 | ✅ | `mgf-fed registry --check` IS the federation consistency gate (`_registry.py`). |
| FB-05 | ✅ | cross-repo feedback flows through the `pending-feedback/<target>.md` outbox + the supervisor relay (`mgf-fed feedback`), never a direct edit (FB-05). |
