
  # mgf-common compat-matrix (AP-16 — the federation pin-window safety net). The wide
  # `mgf-common>=<floor>,<1.0` pin (AP-16 / API_DESIGN §4.4) is honest only if a real
  # break is caught before a consumer hits it. The normal test step already exercises
  # the UPPER end of the window (mgf-common resolves to latest-in-pin = the current
  # cornerstone, dynamically — so a cornerstone bump needs no regen; the B-lite ping
  # just re-runs CI). This step covers the LOWER end: re-pin mgf-common DOWN to the
  # declared floor and re-run the suite. A red means the import surface broke against
  # the floor; THAT (not a routine MINOR) is when the sibling raises its floor +
  # releases. The floor is derived by mgf-fed from the repo's own pin; spliced only
  # into repos that carry a versioned mgf-common dependency (never the cornerstone).
  - name: mgf-common-matrix
    image: python:3.12-slim
    commands:
      - pip install --quiet --upgrade pip
      - {{EXTRAS_INSTALL_CMD}}
      # re-pin mgf-common DOWN to the floor, then re-run. Non-quiet so pip logs the
      # resolved version (a `python -c "...floor: mgf-common..."` diagnostic is a trap:
      # the ': ' inside the command makes Woodpecker's YAML compiler read the list item
      # as a map and error the whole pipeline — PyYAML is lenient, WP is not). The
      # index is $DEVPI_URL — the Woodpecker server-level variable (PAPER-113;
      # MGF_INFRA.md §2), never a hardcoded IP; the guard fails fast when unset.
      - '[ -n "$DEVPI_URL" ] || { echo "DEVPI_URL is unset -- set the Woodpecker server-level variable (MGF_INFRA.md §2; PAPER-113)"; exit 1; }'
      - pip install "mgf-common=={{MGF_COMMON_FLOOR}}.*" --index-url "$DEVPI_URL" || (sleep 15 && pip install "mgf-common=={{MGF_COMMON_FLOOR}}.*" --index-url "$DEVPI_URL")
      - pytest -q
