From e7fda7f54c9b6b4b04b4ab0f3e2632cb838ec6df Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 28 Aug 2026 13:12:36 +0000
Subject: [PATCH 1/3] feat(kotoba): add honest v1 header and VARINT64 fixture

Add a fork-only Kotoba 0.7.2 wasm32/i64-v1 module that encodes and
decodes one vendored xlang record: header bitmap, NOT_NULL, VARINT64 42.
CI runs checks.sh against a real compiler receipt and runtime value.

Co-authored-by: Jun Kawasaki <04.feasts_minded@icloud.com>
---
 .github/workflows/kotoba.yml    |  42 +++++++++
 kotoba/.gitignore               |   1 +
 kotoba/README.md                |  62 ++++++++++++
 kotoba/checks.sh                | 162 ++++++++++++++++++++++++++++++++
 kotoba/fixtures/varint64-42.hex |   1 +
 kotoba/fory.kotoba              |  93 ++++++++++++++++++
 6 files changed, 361 insertions(+)
 create mode 100644 .github/workflows/kotoba.yml
 create mode 100644 kotoba/.gitignore
 create mode 100644 kotoba/README.md
 create mode 100755 kotoba/checks.sh
 create mode 100644 kotoba/fixtures/varint64-42.hex
 create mode 100644 kotoba/fory.kotoba

diff --git a/.github/workflows/kotoba.yml b/.github/workflows/kotoba.yml
new file mode 100644
index 0000000000..6043a4d73e
--- /dev/null
+++ b/.github/workflows/kotoba.yml
@@ -0,0 +1,42 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Kotoba v1
+
+on:
+  push:
+    paths:
+      - "kotoba/**"
+      - ".github/workflows/kotoba.yml"
+  pull_request:
+    paths:
+      - "kotoba/**"
+      - ".github/workflows/kotoba.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    name: Header and one-record fixture
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Run Kotoba v1 checks
+        run: bash kotoba/checks.sh
diff --git a/kotoba/.gitignore b/kotoba/.gitignore
new file mode 100644
index 0000000000..ceddaa37f1
--- /dev/null
+++ b/kotoba/.gitignore
@@ -0,0 +1 @@
+.cache/
diff --git a/kotoba/README.md b/kotoba/README.md
new file mode 100644
index 0000000000..868e7f07dc
--- /dev/null
+++ b/kotoba/README.md
@@ -0,0 +1,62 @@
+# Kotoba v1 Fory binding
+
+Honest v1 only. This tree is a first-class sibling of `java/`, `python/`,
+`go/`, and the other runtimes **on this fork**. It is not a replacement for
+those implementations and it is not robotics-ready.
+
+The module compiles with [Kotoba](https://github.com/kotoba-lang/kotoba) CLI
+**0.7.2** to `wasm32-kotoba-v1` under the `i64-v1` value profile: no FFI, no
+IEEE floats, no vector or externref ABI.
+
+## What this implements
+
+One vendored xlang record and the Fory header bitmap that precedes it.
+
+| Byte | Value  | Meaning                                                |
+| ---- | ------ | ------------------------------------------------------ |
+| 0    | `0x01` | xlang bit set; oob clear; reserved bits 2-7 zero       |
+| 1    | `0xFF` | `NOT_NULL_VALUE_FLAG` (root ref tracking is null-only) |
+| 2    | `0x07` | `VARINT64` type id                                     |
+| 3    | `0x54` | zigzag(`42`) as a one-byte unsigned varint             |
+
+The fixture is `fixtures/varint64-42.hex`. `fory.kotoba` encodes that same
+integer and decodes those same four bytes. It does not implement the rest of
+the xlang serializer: no structs, collections, strings, metadata, references
+beyond this null-only flag, or a general varint loop.
+
+Layout source: `docs/specification/xlang_serialization_spec.md` (Fory header,
+reference flags, type id table, signed varint64 / zigzag).
+
+## What this is not
+
+- Not a Java, Python, Go, Rust, or other Fory runtime.
+- Not cross-language integration coverage.
+- Not schema evolution, codegen, or row format.
+- Not a claim that Kotoba can exchange arbitrary Fory payloads.
+
+## Checks
+
+`checks.sh` downloads Kotoba 0.7.2 (or uses `KOTOBA_BIN`), compiles
+`fory.kotoba` to wasm, and requires a real compiler receipt:
+
+- `value-profile` is `i64-v1`
+- target is `wasm32-kotoba-v1`
+- `value-abi` is `direct-v1`
+- `wasm-features` is empty
+- the artifact starts with wasm magic and carries `wasm32-kotoba-v1`
+
+It then runs the module and requires runtime value `1`. The script fails if
+the fixture, module comment, or byte literals drift. It does not invent a
+pass.
+
+```sh
+bash kotoba/checks.sh
+```
+
+## Upstream
+
+This binding lives on `kotoba-lang/fory`. It is not an Apache Fory release
+surface. An eventual pull request to `apache/fory` may require an ASF ICLA.
+This tree does not file that ICLA.
+
+Fork operator: [awai.network](https://awai.network) / Ryo Awai.
diff --git a/kotoba/checks.sh b/kotoba/checks.sh
new file mode 100755
index 0000000000..54b37aa51f
--- /dev/null
+++ b/kotoba/checks.sh
@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Compile the Kotoba v1 Fory header/record module with CLI 0.7.2 and
+# assert the vendored fixture. Do not invent a pass: every gate reads
+# a real compiler receipt or runtime value.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")" && pwd)"
+MODULE="${ROOT}/fory.kotoba"
+FIXTURE="${ROOT}/fixtures/varint64-42.hex"
+EXPECTED_HEX="01ff0754"
+
+KOTOBA_VERSION="0.7.2"
+KOTOBA_TARBALL="kotoba-linux-amd64.tar.gz"
+KOTOBA_URL="https://github.com/kotoba-lang/kotoba/releases/download/v${KOTOBA_VERSION}/${KOTOBA_TARBALL}"
+KOTOBA_SHA256="95e225461e1b8a21849b251e8c8b654693d2c8a516b258532771651e978e1977"
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+need_cmd() {
+  command -v "$1" >/dev/null 2>&1 || fail "required command not found: $1"
+}
+
+need_cmd python3
+need_cmd curl
+need_cmd tar
+need_cmd sha256sum
+need_cmd grep
+
+[[ -f "${MODULE}" ]] || fail "missing module ${MODULE}"
+[[ -f "${FIXTURE}" ]] || fail "missing fixture ${FIXTURE}"
+
+FILE_HEX="$(tr -d ' \n\t\r' <"${FIXTURE}" | tr 'A-F' 'a-f')"
+[[ "${FILE_HEX}" == "${EXPECTED_HEX}" ]] || fail "fixture hex is ${FILE_HEX}, expected ${EXPECTED_HEX}"
+
+MODULE_HEX="$(sed -n 's/^;; Vendored fixture bytes (hex): //p' "${MODULE}" | tr -d ' \n\t\r' | tr 'A-F' 'a-f')"
+[[ "${MODULE_HEX}" == "${EXPECTED_HEX}" ]] || fail "module fixture comment is ${MODULE_HEX}, expected ${EXPECTED_HEX}"
+
+python3 - "${MODULE}" "${EXPECTED_HEX}" <<'PY'
+import pathlib
+import re
+import sys
+
+module = pathlib.Path(sys.argv[1]).read_text()
+expected = sys.argv[2]
+wanted = {
+    "fixture-b0": "0x01",
+    "fixture-b1": "0xFF",
+    "fixture-b2": "0x07",
+    "fixture-b3": "0x54",
+}
+for name, lit in wanted.items():
+    if not re.search(rf"\(defn {name} \[\] {lit}\)", module):
+        raise SystemExit(f"module is missing ({name} {lit})")
+lits = "".join(wanted[name][2:] for name in ("fixture-b0", "fixture-b1", "fixture-b2", "fixture-b3"))
+if lits.lower() != expected:
+    raise SystemExit(f"module literals {lits.lower()} != fixture {expected}")
+PY
+
+HEADER_BYTE="$(python3 -c "print(int('${EXPECTED_HEX}'[0:2], 16))")"
+[[ "${HEADER_BYTE}" == "1" ]] || fail "fixture header byte is ${HEADER_BYTE}, expected 1"
+
+if [[ -n "${KOTOBA_BIN:-}" ]]; then
+  KOTOBA="${KOTOBA_BIN}"
+  [[ -x "${KOTOBA}" ]] || fail "KOTOBA_BIN is not executable: ${KOTOBA}"
+else
+  CACHE="${KOTOBA_CACHE:-${ROOT}/.cache/kotoba-${KOTOBA_VERSION}}"
+  mkdir -p "${CACHE}"
+  TARBALL="${CACHE}/${KOTOBA_TARBALL}"
+  if [[ ! -x "${CACHE}/kotoba" ]]; then
+    echo "downloading Kotoba CLI ${KOTOBA_VERSION}"
+    curl -fsSL -o "${TARBALL}" "${KOTOBA_URL}"
+    echo "${KOTOBA_SHA256}  ${TARBALL}" | sha256sum -c -
+    tar -xzf "${TARBALL}" -C "${CACHE}" kotoba
+  fi
+  KOTOBA="${CACHE}/kotoba"
+  [[ -x "${KOTOBA}" ]] || fail "downloaded kotoba binary missing at ${KOTOBA}"
+fi
+
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "${WORKDIR}"' EXIT
+WASM="${WORKDIR}/fory.wasm"
+COMPILE_JSON="${WORKDIR}/compile.json"
+RUN_JSON="${WORKDIR}/run.json"
+
+echo "compile ${MODULE} with ${KOTOBA}"
+"${KOTOBA}" compile "${MODULE}" --target wasm -o "${WASM}" --json >"${COMPILE_JSON}"
+
+python3 - "${COMPILE_JSON}" "${WASM}" <<'PY'
+import json
+import pathlib
+import sys
+
+receipt = json.loads(pathlib.Path(sys.argv[1]).read_text())
+wasm = pathlib.Path(sys.argv[2]).read_bytes()
+if receipt.get("kotoba.cli/ok?") is not True:
+    raise SystemExit(f"compile ok? {receipt.get('kotoba.cli/ok?')}: {receipt}")
+if receipt.get("kotoba.cli/code") != "emitted":
+    raise SystemExit(f"compile code {receipt.get('kotoba.cli/code')}: {receipt}")
+data = receipt.get("kotoba.cli/data") or {}
+if data.get("value-profile") != "i64-v1":
+    raise SystemExit(f"value-profile {data.get('value-profile')!r}, expected i64-v1")
+compat = data.get("compatibility") or {}
+if compat.get("target") != "wasm32-kotoba-v1":
+    raise SystemExit(f"target {compat.get('target')!r}, expected wasm32-kotoba-v1")
+if data.get("value-abi") != "direct-v1":
+    raise SystemExit(f"value-abi {data.get('value-abi')!r}, expected direct-v1")
+features = data.get("wasm-features") or []
+if features:
+    raise SystemExit(f"wasm-features {features!r}, expected none for i64-v1")
+if wasm[:4] != b"\x00asm":
+    raise SystemExit("compiled artifact is not a wasm module")
+if b"wasm32-kotoba-v1" not in wasm:
+    raise SystemExit("compiled artifact is missing wasm32-kotoba-v1 target mark")
+print("compile receipt: i64-v1 wasm32-kotoba-v1 direct-v1")
+PY
+
+echo "run ${MODULE}"
+"${KOTOBA}" run "${MODULE}" --json >"${RUN_JSON}"
+
+python3 - "${RUN_JSON}" <<'PY'
+import json
+import pathlib
+import sys
+
+receipt = json.loads(pathlib.Path(sys.argv[1]).read_text())
+if receipt.get("kotoba.cli/ok?") is not True:
+    raise SystemExit(f"run ok? {receipt.get('kotoba.cli/ok?')}: {receipt}")
+if receipt.get("kotoba.cli/code") != "completed":
+    raise SystemExit(f"run code {receipt.get('kotoba.cli/code')}: {receipt}")
+data = receipt.get("kotoba.cli/data") or {}
+result = data.get("kotoba.runtime/result") or {}
+if result.get("kotoba.runtime/ok?") is not True:
+    raise SystemExit(f"runtime ok? {result.get('kotoba.runtime/ok?')}: {receipt}")
+value = result.get("kotoba.runtime/value")
+if value != 1:
+    raise SystemExit(f"runtime value {value!r}, expected 1")
+print("run result: 1")
+PY
+
+echo "PASS: Kotoba v1 Fory header and VARINT64=42 fixture"
diff --git a/kotoba/fixtures/varint64-42.hex b/kotoba/fixtures/varint64-42.hex
new file mode 100644
index 0000000000..25bc7f5dd1
--- /dev/null
+++ b/kotoba/fixtures/varint64-42.hex
@@ -0,0 +1 @@
+01ff0754
diff --git a/kotoba/fory.kotoba b/kotoba/fory.kotoba
new file mode 100644
index 0000000000..1b4fd6ee02
--- /dev/null
+++ b/kotoba/fory.kotoba
@@ -0,0 +1,93 @@
+;; Licensed to the Apache Software Foundation (ASF) under one
+;; or more contributor license agreements.  See the NOTICE file
+;; distributed with this work for additional information
+;; regarding copyright ownership.  The ASF licenses this file
+;; to you under the Apache License, Version 2.0 (the
+;; "License"); you may not use this file except in compliance
+;; with the License.  You may obtain a copy of the License at
+;;
+;;   http://www.apache.org/licenses/LICENSE-2.0
+;;
+;; Unless required by applicable law or agreed to in writing,
+;; software distributed under the License is distributed on an
+;; "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+;; KIND, either express or implied.  See the License for the
+;; specific language governing permissions and limitations
+;; under the License.
+
+;; Honest Kotoba v1 Fory binding: xlang header + one VARINT64 record.
+;; Vendored fixture bytes (hex): 01ff0754
+;; Layout from docs/specification/xlang_serialization_spec.md:
+;;   byte0 bitmap: bit0 xlang, bit1 oob, bits2-7 reserved-zero
+;;   byte1 NOT_NULL_VALUE_FLAG (0xFF) because root ref tracking is null-only
+;;   byte2 VARINT64 type id 7 as small7 varuint32
+;;   byte3 zigzag(42)=84 as one-byte unsigned varint (value < 128)
+;; i64-v1 only: no vectors, no IEEE floats, no FFI, no general varint loop.
+
+(ns fory.header)
+
+(defn fixture-b0 [] 0x01)
+(defn fixture-b1 [] 0xFF)
+(defn fixture-b2 [] 0x07)
+(defn fixture-b3 [] 0x54)
+
+(defn xlang-bit [] 1)
+(defn oob-bit [] 2)
+(defn reserved-mask [] 0xFC)
+(defn not-null-flag [] 0xFF)
+(defn varint64-type [] 7)
+(defn record-value [] 42)
+
+(defn header-ok? [b]
+  (if (= (bit-and b (xlang-bit)) (xlang-bit))
+    (if (zero? (bit-and b (reserved-mask))) 1 0)
+    0))
+
+(defn header-rejects-native? []
+  (if (zero? (header-ok? 0)) 1 0))
+
+(defn header-rejects-reserved? []
+  (if (zero? (header-ok? 5)) 1 0))
+
+(defn zigzag-encode [n]
+  (* n 2))
+
+(defn zigzag-decode [u]
+  (bit-xor (quot u 2) (- 0 (bit-and u 1))))
+
+(defn encode-b0 [] (xlang-bit))
+(defn encode-b1 [] (not-null-flag))
+(defn encode-b2 [] (varint64-type))
+(defn encode-b3 [] (zigzag-encode (record-value)))
+
+(defn encode-matches-fixture? []
+  (if (= (encode-b0) (fixture-b0))
+    (if (= (encode-b1) (fixture-b1))
+      (if (= (encode-b2) (fixture-b2))
+        (if (= (encode-b3) (fixture-b3)) 1 0)
+        0)
+      0)
+    0))
+
+(defn decode-value []
+  (zigzag-decode (fixture-b3)))
+
+(defn decode-ok? []
+  (if (= (header-ok? (fixture-b0)) 1)
+    (if (zero? (bit-and (fixture-b0) (oob-bit)))
+      (if (= (fixture-b1) (not-null-flag))
+        (if (= (fixture-b2) (varint64-type))
+          (if (= (decode-value) (record-value)) 1 0)
+          0)
+        0)
+      0)
+    0))
+
+(defn main []
+  (if (= (header-rejects-native?) 1)
+    (if (= (header-rejects-reserved?) 1)
+      (if (= (decode-ok?) 1)
+        (if (= (encode-matches-fixture?) 1) 1 0)
+        0)
+      0)
+    0))

From 40cd8b97044f8e6ba30b53c4ec62cab466711409 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 28 Aug 2026 13:47:35 +0000
Subject: [PATCH 2/3] ci(kotoba): ignore kotoba-only paths in native workflows

Stop wheels, language CI, lint, allowlist, and PR-body cleanup from
enqueueing on kotoba/** or kotoba.yml-only changes. Kotoba v1 stays
path-filtered to those files. No CI result is claimed.

Co-authored-by: Jun Kawasaki <04.feasts_minded@icloud.com>
---
 .github/workflows/asf-allowlist.yml          | 6 ++++++
 .github/workflows/build-containerized-pr.yml | 6 ++++++
 .github/workflows/build-native-pr.yml        | 6 ++++++
 .github/workflows/ci.yml                     | 5 +++++
 .github/workflows/clean-pr-body.yml          | 3 +++
 .github/workflows/lint.yml                   | 6 ++++++
 .github/workflows/pr-lint.yml                | 3 +++
 7 files changed, 35 insertions(+)

diff --git a/.github/workflows/asf-allowlist.yml b/.github/workflows/asf-allowlist.yml
index 821b3befc5..d9e5e9f3c0 100644
--- a/.github/workflows/asf-allowlist.yml
+++ b/.github/workflows/asf-allowlist.yml
@@ -19,7 +19,13 @@ name: ASF GitHub Actions Allowlist
 
 on:
   push:
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
   pull_request:
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
 
 permissions:
   contents: read
diff --git a/.github/workflows/build-containerized-pr.yml b/.github/workflows/build-containerized-pr.yml
index 6434f2cf54..6745a0c057 100644
--- a/.github/workflows/build-containerized-pr.yml
+++ b/.github/workflows/build-containerized-pr.yml
@@ -22,9 +22,15 @@ name: Build Containerized PR Wheels
 on:
   pull_request:
     paths: [ci/**, python/**, .github/workflows/**]
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
   push:
     branches: [main]
     paths: [ci/**, python/**, .github/workflows/**]
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
 
 jobs:
   build:
diff --git a/.github/workflows/build-native-pr.yml b/.github/workflows/build-native-pr.yml
index e45cd26d49..d4bb5a174a 100644
--- a/.github/workflows/build-native-pr.yml
+++ b/.github/workflows/build-native-pr.yml
@@ -22,9 +22,15 @@ name: Build Native PR Wheels
 on:
   pull_request:
     paths: [ci/**, python/**, .github/workflows/**]
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
   push:
     branches: [main]
     paths: [ci/**, python/**, .github/workflows/**]
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
 
 jobs:
   build-windows:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 16108ec7d1..39fd55a5e7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,6 +33,9 @@ on:
       - "test*"
     tags:
       - v*
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
   pull_request:
     paths-ignore:
       - "**/*.md"
@@ -42,6 +45,8 @@ on:
       - "licenses/**"
       - "DISCLAIMER"
       - "NOTICE"
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
     types: ["opened", "reopened", "synchronize"]
 
 permissions:
diff --git a/.github/workflows/clean-pr-body.yml b/.github/workflows/clean-pr-body.yml
index 5961c93233..a1c447c5b7 100644
--- a/.github/workflows/clean-pr-body.yml
+++ b/.github/workflows/clean-pr-body.yml
@@ -24,6 +24,9 @@ on:
   pull_request_target:
     types:
       - opened
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
 
 permissions:
   pull-requests: write
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index b64a3ad4ff..f200faf025 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -24,6 +24,9 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
   push:
     branches:
       - main
@@ -31,6 +34,9 @@ on:
       - "**.md"
       - "**.yml"
       - "**.yaml"
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
 
 permissions:
   contents: read
diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
index c330f6ac0e..15d5f1587b 100644
--- a/.github/workflows/pr-lint.yml
+++ b/.github/workflows/pr-lint.yml
@@ -26,6 +26,9 @@ on:
       - opened
       - edited
       - synchronize
+    paths-ignore:
+      - "kotoba/**"
+      - ".github/workflows/kotoba*.yml"
 
 permissions:
   pull-requests: read

From 4ae22d0d8b09527b9c3c155f857ba9df76bbc193 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 28 Aug 2026 13:48:43 +0000
Subject: [PATCH 3/3] ci(kotoba): use path negation where paths-ignore is
 illegal

GitHub rejects paths and paths-ignore on the same event. Wheel and
lint-push filters now exclude kotoba/** and kotoba.yml with ! globs.

Co-authored-by: Jun Kawasaki <04.feasts_minded@icloud.com>
---
 .github/workflows/build-containerized-pr.yml | 20 ++++++++++++--------
 .github/workflows/build-native-pr.yml        | 20 ++++++++++++--------
 .github/workflows/lint.yml                   |  5 ++---
 3 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/build-containerized-pr.yml b/.github/workflows/build-containerized-pr.yml
index 6745a0c057..8425e56698 100644
--- a/.github/workflows/build-containerized-pr.yml
+++ b/.github/workflows/build-containerized-pr.yml
@@ -21,16 +21,20 @@
 name: Build Containerized PR Wheels
 on:
   pull_request:
-    paths: [ci/**, python/**, .github/workflows/**]
-    paths-ignore:
-      - "kotoba/**"
-      - ".github/workflows/kotoba*.yml"
+    paths:
+      - ci/**
+      - python/**
+      - .github/workflows/**
+      - "!kotoba/**"
+      - "!.github/workflows/kotoba*.yml"
   push:
     branches: [main]
-    paths: [ci/**, python/**, .github/workflows/**]
-    paths-ignore:
-      - "kotoba/**"
-      - ".github/workflows/kotoba*.yml"
+    paths:
+      - ci/**
+      - python/**
+      - .github/workflows/**
+      - "!kotoba/**"
+      - "!.github/workflows/kotoba*.yml"
 
 jobs:
   build:
diff --git a/.github/workflows/build-native-pr.yml b/.github/workflows/build-native-pr.yml
index d4bb5a174a..e8b149324e 100644
--- a/.github/workflows/build-native-pr.yml
+++ b/.github/workflows/build-native-pr.yml
@@ -21,16 +21,20 @@
 name: Build Native PR Wheels
 on:
   pull_request:
-    paths: [ci/**, python/**, .github/workflows/**]
-    paths-ignore:
-      - "kotoba/**"
-      - ".github/workflows/kotoba*.yml"
+    paths:
+      - ci/**
+      - python/**
+      - .github/workflows/**
+      - "!kotoba/**"
+      - "!.github/workflows/kotoba*.yml"
   push:
     branches: [main]
-    paths: [ci/**, python/**, .github/workflows/**]
-    paths-ignore:
-      - "kotoba/**"
-      - ".github/workflows/kotoba*.yml"
+    paths:
+      - ci/**
+      - python/**
+      - .github/workflows/**
+      - "!kotoba/**"
+      - "!.github/workflows/kotoba*.yml"
 
 jobs:
   build-windows:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f200faf025..72687ab1a8 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -34,9 +34,8 @@ on:
       - "**.md"
       - "**.yml"
       - "**.yaml"
-    paths-ignore:
-      - "kotoba/**"
-      - ".github/workflows/kotoba*.yml"
+      - "!kotoba/**"
+      - "!.github/workflows/kotoba*.yml"
 
 permissions:
   contents: read