# DEPS — mgf-cloud-provision

Dependency rationale (DOC). Pins live in [`pyproject.toml`](pyproject.toml); only the `mgf-*` names resolve from the Codeberg registry (PKG-06, `[tool.uv.sources]`, `explicit = true`).

## Runtime (`[project.dependencies]`)

| Dependency | Pin | Why | Resolves from |
|---|---|---|---|
| `mgf-common` | `>=0.47,<0.48` | Cornerstone — typed exceptions (`ProvisionError`/`SpecError` extend its bases), structured logging, config. | Codeberg |
| `mgf-cloud` | `>=0.1.1,<0.2` | The OpenStack/Infomaniak adapter this library declaratively drives (`CloudProvider`, `ServerSpec`, models, `FakeProvider`). | Codeberg |
| `pydantic` | `>=2.6,<3` | Frozen, validated `ServiceSpec` / plan / result models. | PyPI |

## Optional (`[project.optional-dependencies]`)

| Extra | Adds | Why |
|---|---|---|
| `infomaniak` | `mgf-cloud[infomaniak]` | The real OpenStack provider (openstacksdk, via mgf-cloud's extra). Core stays importable + testable against `FakeProvider` without it. |
| `standards` | `mgf-common[standards]` | The standards corpus for federation-CLI conformance checks. |
| `dev` | pytest(+cov,+timeout), ruff, mypy, import-linter, mgf-test-supervisor, mgf-standard | The four-gate toolchain + the federation test supervisor. |

## Notes
- The heavy cloud SDK is **not** a core dependency — provider construction is lazy (`mgf.cloud.get_provider`), so importing `mgf.cloud_provision` pulls nothing cloud-specific. The whole library runs against `mgf-cloud`'s in-memory `FakeProvider`.
- No `mgf-*` package is published to public PyPI; `explicit = true` makes a public name unable to shadow an `mgf-*` dependency (dependency-confusion-safe).
