[magnusp]

Fixes #80

Three-layer contract: Hrana 3 remains the transport source of truth (untouched), java.sql the JDBC surface source of truth (untouched), and xerial/sqlite-jdbc only a behavioural reference (untouched). This PR is CI configuration only.

Change

Two workflows filtered pull_request to base branch main, so a PR stacked on a feature branch got neither PR Verification nor CodeQL. Both filters are removed. push and schedule triggers, permissions, job graphs, and check names are unchanged.

.github/workflows/pr.yml

# before
on:
  pull_request:
    branches: [ "main" ]
    types: [opened, synchronize, reopened]
# after
on:
  pull_request:
    types: [opened, synchronize, reopened]

.github/workflows/codeql.yml

# before
on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '0 6 * * 1' # Every Monday at 06:00 UTC
# after
on:
  push:
    branches: [ "main" ]
  pull_request:
  schedule:
    - cron: '0 6 * * 1' # Every Monday at 06:00 UTC

A bare pull_request: means every base branch and the default activity types, which are exactly opened, synchronize, reopened — the same set pr.yml still lists explicitly.

Red / green

• Red (trunk 5401ce9): both pull_request triggers carry branches: ["main"]; a PR based on a feature branch starts neither workflow.
• Green (head cd15094): neither pr.yml nor codeql.yml filters pull_request by base branch, so Build & Test (Java 25/26) and Analyze Code with CodeQL match every PR base.

Lanes

1. Trigger blocks before/after for both workflows (lane-1-regression.log) — pass.
2. Resolved triggers: pr.yml has no base filter, codeql.yml has pull_request: None (all bases); the only remaining branches: is under push (lane-2-specific.log) — pass.
3. Jobs sections identical to trunk in both files (lane-3-specific.log) — pass.
4. All four workflows parse via PyYAML (lane-4-yaml.log) — pass. actionlint is not installed in this environment, so the plan's fallback parse was used.
5. ./mvnw -pl libsql-jdbc test: 223 tests, BUILD SUCCESS (lane-5-unit.log) — pass.
6. git diff origin/main -- .github/workflows: two removed lines, one per workflow (lane-6-diff.log) — pass.
7. Job sets unchanged: pr.yml → verify; codeql.yml → analyze (lane-7-jobs.log) — pass.
8. ./mvnw -q validate BUILD SUCCESS (lane-8-validate.log) — pass. spotless:check clean.
9. Next stacked PR's checks — deferred, observable only after this merges (lane-9-specific.log).
10. Required check names unchanged: Build & Test (Java 25), Build & Test (Java 26), Analyze Code with CodeQL (lane-10-checks.log) — pass.

Perf: ./mvnw -pl libsql-jdbc test; trunk median 2370 ms at 5401ce9, head medians 2396 ms at c2a6891 and 2269 ms at cd15094 — inside the 10% rule.

Divergences

• .github/workflows/codeql.yml was added to the plan's Files block by the queue owner after the first push, because the plan's "You see" box requires CodeQL coverage for stacked PRs and CodeQL is defined there, not in pr.yml.
• Plan commands say mise exec --; the queue owner brief forbids it (mise tries to install an unrelated tool and fails), so lanes ran with ./mvnw directly.

Base SHA: 5401ce9
Head SHA: cd15094