From 1c6e741be25d489710a6003a80e68f06337a2844 Mon Sep 17 00:00:00 2001
From: Volker Christian <me@vchrist.at>
Date: Sat, 10 Oct 2026 18:27:37 +0200
Subject: [PATCH 1/2] Adopt shared Phase 2 Verify while preserving
 repository-specific qualification

---
 .github/workflows/ci.yml                      | 12 +++++++++
 .snodec/repo.yml                              | 18 +++++++++++++
 tests/policy/ci/CiWorkflowPathsPolicyTest.cpp | 27 +++++++++++++++----
 3 files changed, 52 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 .snodec/repo.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..efd213014
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,12 @@
+name: CI
+on: [push, pull_request, workflow_dispatch]
+permissions: { contents: read }
+jobs:
+  snodec:
+    uses: SNodeC/.github/.github/workflows/verify.yml@v1
+    secrets: inherit
+  x-sdk:
+    needs: snodec
+    if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+    permissions: { contents: write }
+    uses: SNodeC/.github/.github/workflows/publish-dev.yml@v1
diff --git a/.snodec/repo.yml b/.snodec/repo.yml
new file mode 100644
index 000000000..ad0afe2f6
--- /dev/null
+++ b/.snodec/repo.yml
@@ -0,0 +1,18 @@
+# Build specifics only; identity lives in SNodeC/.github/catalog.yml.
+ci:
+  profile: cpp
+  apt:
+  - libncurses-dev
+  deps: []
+  cmake_options:
+  - -DCMAKE_BUILD_TYPE=Debug
+  - -DSNODEC_BUILD_TESTS=ON
+  - -DSNODEC_BUILD_APPS=ON
+  ctest_args:
+  - --output-on-failure
+  - --parallel
+  - '8'
+  ipv6: true
+  runtime_dirs: true
+  parallel: 8
+  sdk: true
diff --git a/tests/policy/ci/CiWorkflowPathsPolicyTest.cpp b/tests/policy/ci/CiWorkflowPathsPolicyTest.cpp
index c6e42b257..2f640259c 100644
--- a/tests/policy/ci/CiWorkflowPathsPolicyTest.cpp
+++ b/tests/policy/ci/CiWorkflowPathsPolicyTest.cpp
@@ -31,7 +31,7 @@ namespace {
     using Filters = std::map<std::string, std::set<std::string>>;
     using Triggers = std::map<std::string, Filters>;
 
-    // Read trigger mappings with inline or block lists; ignore the workflow jobs.
+    // Read trigger mappings or an inline event list; ignore the workflow jobs.
     bool matchesTriggers(std::string_view source, const Triggers& expected) {
         Triggers events;
         std::istringstream lines{std::string(source)};
@@ -52,6 +52,19 @@ namespace {
                 if (inOn && foundOn) {
                     return false;
                 }
+                if (content.starts_with("on: [") && content.ends_with(']')) {
+                    if (foundOn) {
+                        return false;
+                    }
+                    foundOn = true;
+                    std::istringstream items(content.substr(5, content.size() - 6));
+                    std::string item;
+                    while (std::getline(items, item, ',')) {
+                        if (!events.emplace(unquote(trim(item)), Filters{}).second) {
+                            return false;
+                        }
+                    }
+                }
                 foundOn = foundOn || inOn;
                 event.clear();
                 filter.clear();
@@ -103,14 +116,18 @@ int main() {
         return 1;
     }
     const std::map<std::string, Triggers> workflows = {
-        {"packages.yml", {{"push", {{"tags", {"v[0-9]*.[0-9]*.[0-9]*"}}}},
-                          {"repository_dispatch", {{"types", {"package-build"}}}}}},
+        {"ci.yml", {{"push", {}}, {"pull_request", {}}, {"workflow_dispatch", {}}}},
+        {"packages.yml", {{"push", {{"tags", {"v[0-9]*.[0-9]*.[0-9]*"}}}}, {"repository_dispatch", {{"types", {"package-build"}}}}}},
     };
-    bool ok = true;
+    const Triggers verifyEvents = {{"push", {}}, {"pull_request", {}}, {"workflow_dispatch", {}}};
+    bool ok = matchesTriggers("on: [push, pull_request, workflow_dispatch]\n", verifyEvents) &&
+              !matchesTriggers("on: [push, push, pull_request, workflow_dispatch]\n", verifyEvents) &&
+              !matchesTriggers("on: [push, pull_request, release]\n", verifyEvents) &&
+              !matchesTriggers("on: [push, pull_request, workflow_dispatch]\non: [push]\n", verifyEvents);
     for (const auto& [name, triggers] : workflows) {
         const auto path = root / ".github/workflows" / name;
         if (!matchesTriggers(source_policy::readSourcePolicyFile(path), triggers)) {
-            std::cerr << "Unexpected CI triggers in " << path << ": only version-tag package builds and package-build handoffs are allowed\n";
+            std::cerr << "Unexpected CI triggers in " << path << ": expected Verify events or version-tag/package-build events\n";
             ok = false;
         }
     }

From e0f3bdb63972e3c61045a837fa0bbd560bd10a58 Mon Sep 17 00:00:00 2001
From: Volker Christian <me@vchrist.at>
Date: Sat, 10 Oct 2026 18:39:28 +0200
Subject: [PATCH 2/2] Reference the approved existing control workflow tag v1.0

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index efd213014..43e6aa12a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,10 +3,10 @@ on: [push, pull_request, workflow_dispatch]
 permissions: { contents: read }
 jobs:
   snodec:
-    uses: SNodeC/.github/.github/workflows/verify.yml@v1
+    uses: SNodeC/.github/.github/workflows/verify.yml@v1.0
     secrets: inherit
   x-sdk:
     needs: snodec
     if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
     permissions: { contents: write }
-    uses: SNodeC/.github/.github/workflows/publish-dev.yml@v1
+    uses: SNodeC/.github/.github/workflows/publish-dev.yml@v1.0