
  # fedres check (D-GEN freshness gate) — regenerate fed-resources/generated/ into
  # a temp dir and byte-compare against the committed tree; nonzero on ANY drift
  # (the regenerate→byte-identical discipline). Spliced in only when the repo
  # carries fed-resources/source/project.toml. The Class-P projectors read the
  # registry from the mgf.standard package data, so this runs in a single-repo
  # checkout (no sibling mgf-standard on disk needed); mgf-fedres ships `fedres`.
  - name: fedres-check
    image: python:3.12-slim
    commands:
      - pip install --quiet --upgrade pip
      # The index is $DEVPI_URL — the Woodpecker server-level variable (PAPER-113;
      # MGF_INFRA.md §2), never a hardcoded IP; the guard fails fast when unset.
      - '[ -n "$DEVPI_URL" ] || { echo "DEVPI_URL is unset -- set the Woodpecker server-level variable (MGF_INFRA.md §2; PAPER-113)"; exit 1; }'
      - pip install --quiet mgf-fedres "mgf-common[standards]" --index-url "$DEVPI_URL" || (sleep 15 && pip install --quiet mgf-fedres "mgf-common[standards]" --index-url "$DEVPI_URL")
      - fedres check
