# Fleet co-install gate

mgf-fed is the federation orchestrator, so it carries the fleet-wide **co-install
lock**: proof that the *whole* published `mgf-*` fleet installs together at the
current `mgf-common` cornerstone.

## Why

A cornerstone-minor bump (e.g. `mgf-common` 0.48 → 0.49) pin-walks every consumer
to `<0.50` on `main`, but a leaf's **published** artifact can still cap
`mgf-common` below the cornerstone (pin-walked but never republished — the devpi
backfill gap). When that happens, `uv pip install <all mgf-*>` silently resolves
the fleet down to an *older* mgf-common. REL-13 (which reads pyproject `main`)
stays green, so nothing flags it until an install picks the wrong version.

`test_fleet_coinstall.py` resolves the full fleet from devpi and asserts
`mgf-common` lands on the **same version mgf-fed itself installed** (the
cornerstone). A lagging leaf turns it red, naming the fix.

## Files

| file | what |
|------|------|
| `fleet-coinstall.in` | the roster — every published python `mgf-*` library |
| `fleet-coinstall.lock` | committed uv lockfile; its `mgf-common==` line is the cornerstone |
| `test_fleet_coinstall.py` | the gate (skips unless `uv` + devpi are available) |
| `refresh_lock.py` | regenerates both from the mgf-standard registry + `uv pip compile` |

## After a cornerstone ripple

Once the cornerstone bump + leaf backfill have landed on devpi, refresh the lock:

```sh
python tests/fleet/refresh_lock.py   # rewrites .in + .lock
```

Commit the result alongside the registry regen. If `refresh_lock.py` (or the test)
can't resolve the fleet at the cornerstone, a leaf still needs backfilling — see
the cornerstone-ripple-playbook.
