
  # mgf-test-supervisor (TS-23/24/25/27) — drive the suite through the
  # federation supervisor (`mtest`, shipped by the `[supervisor]` extra) so CI
  # produces the structured JSONL run record (TS-24), exercises auto-quarantine
  # (TS-25), and writes a single-file failure bundle on any failure (TS-27) —
  # not the bare-pytest, exit-code-only path. `mtest` is the supervisor's own
  # console script (`mgf-fed test` is a thin frontend to the same entry point);
  # CI calls `mtest` directly so it needs no mgf-fed[cli] install (and the
  # cornerstone mgf-common avoids a circular dep on mgf-fed). 3.12 only (the
  # supervisor is stdlib, version-agnostic).
  - name: supervisor-self-check
    image: python:3.12-slim
    commands:
      - pip install --quiet --upgrade pip
      - {{EXTRAS_INSTALL_CMD}}
      - mtest --self-check

  # depends_on serializes the two supervisor steps: both `mtest` runs write the
  # shared workspace `.gates/` (guarded by `.gates/.lock`), so running them in
  # parallel corrupts it / fails the lock. Self-check first, then tier-0.
  - name: supervisor-tier-0
    image: python:3.12-slim
    depends_on: [supervisor-self-check]
    commands:
      - pip install --quiet --upgrade pip
      - {{EXTRAS_INSTALL_CMD}}
      - mtest --tier 0
