> **Relayed** to mgf-standard#PAPER-155 by the supervisor (FB-05), 2026-08-06.
> Target PR: <https://codeberg.org/magogi-admin/mgf-standard/pulls/306> — **MERGED**
> as `a0ba136`. FB-05's targets-before-receipts order is satisfied: the paper is on
> mgf-standard's `main`, so this receipt records a landed relay, not a pending one.

---

### PAPER-155 — `frag-mgf-common-matrix.yml` is the one generated step that runs the suite WITHOUT git, so the compat gate measures a smaller suite than the gate it is meant to mirror

**Severity:** 🟡 Sharp edge (the step runs, and greens or reds against a suite that
is not the one the PR gate ran — and when a new test shells out to git it does not
skip there, it *errors*)
**Origin:** mgf-fed · 2026-08-06 · found when mgf-fed pipeline 473 went red on
`mgf-common-matrix` alone, every other step green

**What hurts.** `templates/woodpecker/base.yml` installs git in all three test
steps, and says why in a comment that is one of the better pieces of writing in
the template set:

> GIT IS INSTALLED IN ALL THREE TEST STEPS, because python:slim ships none and a
> test that needs git SKIPS rather than fails. **The suite the gate ran was smaller
> than the suite the bench ran, and nothing said so, because pytest reports a skip
> as a pass.**
>
>     mgf-fed, bench, git + sibling repos present   1333 pass,   0 skip
>     mgf-fed, bench, git REMOVED                   1239 pass,  94 skip
>     mgf-fed, CI (no git AND single-repo clone)    1167 pass, 155 skip

`frag-mgf-common-matrix.yml` ends in `pytest -q` — the same suite, the same
`python:3.12-slim` image — and carries **neither** of the two lines:

```yaml
  - name: mgf-common-matrix
    image: python:3.12-slim
    commands:
      - pip install --quiet --upgrade pip
      - {{EXTRAS_INSTALL_CMD}}
      # ... no `apt-get install git`, no `git config --global --add safe.directory`
      - pytest -q
```

So the reasoning the base template wrote down for the test steps applies verbatim
to the matrix step and was not applied to it. The compat gate — whose entire job is
"re-run **the suite** against the mgf-common floor" — re-runs a *different, smaller*
suite than the gate it mirrors, and says nothing about the difference.

**Why it matters.** Two failure modes, one of them already observed.

1. **The measured one.** mgf-fed PR #159 added eight fixtures that build real git
   repos (mgf-fed PAPER-152's banner resolves refs *through* git, so a faked `_git`
   would only prove the parser agrees with the fixture). Pipeline 473: every step
   green, `mgf-common-matrix` red — `FileNotFoundError: 'git'`, in that step only.
   The immediate cause is the missing apt line; the *reason it surprised* is that
   the matrix step silently ran a smaller suite for as long as it has existed.
2. **The quiet one.** AP-16's floor check is only honest if the floor is exercised
   by the same tests the upper end is. Today ~94 of mgf-fed's tests are
   git-attributable, so the floor is checked by a suite ~94 tests short — and a
   real break in that band would green. That is the base template's own
   "a skip reports as a pass" argument, at the one step that did not get the fix.

**Evidence** (mgf-standard `origin/main`, read 2026-08-06):

- `templates/woodpecker/base.yml:155-172` — the comment + numbers quoted above;
  `:176`, `:186`, `:212` — `apt-get update -qq && apt-get install -y -qq
  --no-install-recommends git`, once per test step, each followed by
  `git config --global --add safe.directory "$CI_WORKSPACE"`.
- `templates/woodpecker/frag-mgf-common-matrix.yml` — ends `pytest -q`;
  `grep -c apt-get` = **0**, `grep -c safe.directory` = **0**.
- `templates/woodpecker/frag-commit-trailers.yml` — has the pair (the base comment
  calls it "the same two lines the canonical commit-trailers fragment already
  uses"), which makes the matrix fragment the sole `pytest`-running exception.
- mgf-fed pipeline **473**, step `mgf-common-matrix`: 1195 passed, 9 errored on
  `FileNotFoundError: 'git'`; every other step green.

**What I'd want.** The two lines the sibling steps already carry, in
`frag-mgf-common-matrix.yml`, before `pytest -q`:

```yaml
      - apt-get update -qq && apt-get install -y -qq --no-install-recommends git
      - git config --global --add safe.directory "$CI_WORKSPACE"
```

Both, not just the first: the test steps pair them, and installing git without the
`safe.directory` line would newly *enable* ~94 tests in a step whose workspace
ownership has never been configured — trading one red for an unknown.

**What I did instead, and why it is not the fix.** mgf-fed's eight fixtures now
carry the house `requires_git` marker (`shutil.which("git") is None`), joining the
~94 that already skip, plus two mute pins that never skip so the feature keeps
coverage where git is absent. That unblocks the PR; it does not make the matrix
step measure the right suite, and it leaves every other generated member with the
same gap. Two paths were considered and rejected as worse:

- **hand-editing mgf-fed's `.woodpecker.yml`** — it is a generated artifact and
  mgf-fed is not in `[exempt].woodpecker`, so the edit is `ci-generated` drift that
  the next `mgf-fed scaffold` silently reverts;
- **declaring `apt_packages = ["git"]` in mgf-fed's `[tool.mgf-fed]`** — verified to
  work (the carve-out's `apt_prefix` does render into the matrix step via
  `{{EXTRAS_INSTALL_CMD}}`), but it is a per-repo *shape* declaration, so it would
  fix one member and leave ~40 others to re-discover this through their own red CI —
  the propagation anti-pattern mgf-fed PAPER-150 is about. It also duplicates the
  apt line in the three test steps that already hard-code it.

The template is the right altitude. One fragment, two lines, every member.
