@@ -9,6 +9,15 @@ const { getSetupTimeoutMs } = require("./child_process_timeouts.cjs");
 // Only controlled messages may be propagated to workflow failure issues.
 class CheckoutPreparationError extends Error {}
 
+/**
+ * @param {string | undefined} value
+ */
+function validateSingleRepository(value) {
+  if (!value || !/^[a-zA-Z0-9][a-zA-Z0-9-]*\/[a-zA-Z0-9_.-]+$/.test(value.trim()) || [".", ".."].includes(value.trim().split("/")[1])) {
+    throw new CheckoutPreparationError("checkout.repository (or repo) must resolve to exactly one owner/repo slug unless checkout.multi is true");
+  }
+}
+
 /**
  * @param {string} value
  * @returns {string[]}
@@ -351,4 +360,4 @@ async function finish(options = {}) {
   return entries;
 }
 
-module.exports = { prepare, finish, parseRepositories, parseAllowedRepos, workspacePath };
+module.exports = { prepare, finish, parseRepositories, parseAllowedRepos, workspacePath, validateSingleRepository };
@@ -2,9 +2,19 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import fs from "fs";
 import path from "path";
 import { execFileSync } from "child_process";
-import { prepare, finish, parseRepositories, parseAllowedRepos, workspacePath } from "./checkout_dynamic.cjs";
+import { prepare, finish, parseRepositories, parseAllowedRepos, workspacePath, validateSingleRepository } from "./checkout_dynamic.cjs";
 import { buildCheckoutManifest, readManifestEntriesFromEnv } from "./build_checkout_manifest.cjs";
 
+describe("single repository checkout", () => {
+  it.each(["org/repo", "Org/Private.Repo", " org/repo \n", "org/repo.wiki"])("accepts exactly one repository without multi-repo policy: %s", repository => {
+    expect(() => validateSingleRepository(repository)).not.toThrow();
+  });
+
+  it.each([undefined, "", " \n", "org/a\norg/b", "org/a\nORG/A", "org/a,org/b", "org/*", "org/repo/extra", "org/..", "org/.", "org/a\rorg/b"])("rejects missing, multiple, or invalid repositories: %s", repository => {
+    expect(() => validateSingleRepository(repository)).toThrow("exactly one owner/repo slug");
+  });
+});
+
 describe("runtime repository checkout", () => {
   let temp;
   let workspace;
 
@@ -48,11 +48,12 @@ checkout:
 
 | Field | Type | Description |
 |-------|------|-------------|
-| `repository` | string | Explicit repository in `owner/repo` format, or a newline-separated list with `allowed-repos`. Expressions require `allowed-repos`. Does not support wildcards. Defaults to the current repository. |
+| `repository` | string | Explicit repository in `owner/repo` format, or a newline-separated list with `multi: true`. Without `multi`, expressions must resolve to exactly one repository and need no allowlist. Does not support wildcards. Defaults to the current repository. |
 | `repo` | string | Alias for `repository`; specify only one. Does not support wildcards. |
-| `allowed-repos` | string \| string[] | Mandatory allowlist for runtime repository-list expansion. Accepts newline-separated patterns, an array, or an expression; supports scoped patterns such as `owner/*` and `*/repo`, but not unrestricted `"*"` or `"*/*"`. |
-| `max-repos` | integer | Maximum unique repositories per runtime checkout entry. Requires `allowed-repos`; defaults to `10`. Must be a positive literal integer. |
-| `allow-private-repos` | boolean | Allow private/internal targets in a runtime list hosted by a private/internal repository. Requires `allowed-repos`; defaults to `false` and must be a literal boolean. Public hosts always reject non-public targets, even when `true`. |
+| `multi` | boolean | Explicitly enables runtime repository-list expansion and its restrictions. Defaults to `false`; must be a literal boolean. |
+| `allowed-repos` | string \| string[] | Mandatory allowlist for `multi: true`; does not enable multi mode by itself. Accepts newline-separated patterns, an array, or an expression; supports scoped patterns such as `owner/*` and `*/repo`, but not unrestricted `"*"` or `"*/*"`. Ignored in single-repository mode. |
+| `max-repos` | integer | Maximum unique repositories per `multi: true` checkout entry. Requires `allowed-repos` in multi mode; defaults to `10`. Must be a positive literal integer. Ignored in single-repository mode. |
+| `allow-private-repos` | boolean | With `multi: true`, allow private/internal targets in a runtime list hosted by a private/internal repository. Requires `allowed-repos` in multi mode; defaults to `false` and must be a literal boolean. Public hosts always reject non-public multi targets, even when `true`. Ignored in single-repository mode. |
 | `ref` | string | Branch, tag, or SHA to checkout. Defaults to the triggering ref. |
 | `path` | string | Path within `GITHUB_WORKSPACE` to place the checkout. Defaults to workspace root. |
 | `github-token` | string | Token for authentication. Use `${{ secrets.MY_TOKEN }}` syntax. |
@@ -68,7 +69,16 @@ checkout:
 
 ## Runtime Repository Lists
 
-An entry with `allowed-repos` expands `repository` (or `repo`) at runtime into one checkout per newline-separated `owner/repo` slug. This allows scheduled workers to process a changing repository set supplied through variables, inputs, or earlier step outputs:
+An entry with `multi: true` expands `repository` (or `repo`) at runtime into one checkout per newline-separated `owner/repo` slug. It requires `allowed-repos`. This allows scheduled workers to process a changing repository set supplied through variables, inputs, or earlier step outputs.
+
+Without `multi: true` (including `multi: false`), the runtime requires exactly one `owner/repo` slug. Repository expressions do not require `allowed-repos` or a non-root path prefix. Normal single-checkout authentication, private-repository access, LFS, submodules, `current`, and `wiki` behavior applies; none of the multi-repo restrictions below apply. Merely specifying `allowed-repos` does not enable expansion or constrain a single checkout.
+
+```yaml wrap
+checkout:
+  repo: ${{ inputs.repo }}
+  path: target
+  current: true
+```
 
 `repository` and `repo` select explicit repository names, not wildcard patterns. Their expressions must resolve to concrete `owner/repo` slugs. Wildcards are supported only in `allowed-repos`, which filters the selected list and never discovers or selects repositories.
 
@@ -78,14 +88,15 @@ An entry with `allowed-repos` expands `repository` (or `repo`) at runtime into o
 on:
   schedule: daily
 checkout:
-  - repository: ${{ vars.WORKER_REPOS }}
+  - multi: true
+    repository: ${{ vars.WORKER_REPOS }}
     path: targets
     allowed-repos: ${{ vars.ALLOWED_WORKER_REPOS }}
     max-repos: 5
     github-token: ${{ secrets.CROSS_REPO_PAT }}
 ```
 
-For `WORKER_REPOS` containing `org/api` and `org/web` on separate lines, the checkouts are placed at `targets/org/api` and `targets/org/web`. `path` must be a literal, non-root prefix. The compiler requires `allowed-repos` for `repository` or `repo` expressions, even when they select a single repository, except for the standalone `${{ github.repository }}` expression. That expression selects the workflow repository using normal single-checkout behavior and needs neither an allowlist nor a path prefix. Expressions that combine it with other values still require `allowed-repos`. The allowlist may contain scoped wildcard patterns such as `org/*` or `*/api`. Unrestricted patterns such as `*` and `*/*` are rejected, including when an expression resolves to them at runtime. Matching and deduplication are case-insensitive; an empty selected list produces no additional checkouts, not all allowlisted repositories.
+For `WORKER_REPOS` containing `org/api` and `org/web` on separate lines, the checkouts are placed at `targets/org/api` and `targets/org/web`. With `multi: true`, `path` must be a literal, non-root prefix and `allowed-repos` is mandatory, even if the selector is literal or resolves to just the workflow repository. The allowlist may contain scoped wildcard patterns such as `org/*` or `*/api`. Unrestricted patterns such as `*` and `*/*` are rejected, including when an expression resolves to them at runtime. Matching and deduplication are case-insensitive; an empty selected list produces no additional checkouts, not all allowlisted repositories.
 
 Every selected repository must pass the allowlist and GitHub API metadata checks before the checkout action is generated. Redirected repository names are checked against the allowlist again. Runtime lists allow only public targets by default. Set `allow-private-repos: true` on an entry to also allow private/internal targets when the hosting repository is private/internal. **Public workflow repositories cannot check out private or internal repositories**, even when this flag is `true` and the supplied token can access them. The flag requires `allowed-repos` and a literal boolean; it does not change ordinary static checkouts. Both checkout jobs enforce the same policy, and merged entries permit non-public targets only if every entry explicitly opts in. Omission or `false` prevents an imported entry from broadening access. Failed or incomplete visibility checks stop the job.
 
 
@@ -7,7 +7,7 @@ sidebar:
 
 # Checkout Behavior Specification
 
-**Version**: 1.3.2<br>
+**Version**: 1.3.3<br>
 **Status**: Working Draft  
 **Publication Date**: 2026-10-14<br>
 **Editor**: GitHub Agentic Workflows Team  
@@ -82,7 +82,7 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S
 ### 3.1 Checkout Entry Parsing
 
 `checkout:` MUST accept either a single object or an array of objects.  
-Each entry MAY define: `repository` (or `repo`), `allowed-repos`, `max-repos`, `allow-private-repos`, `ref`, `path`, `github-token` (or legacy `token`), `github-app` (or deprecated alias `app`), `safe-outputs-github-app`, `fetch-depth`, `fetch`, `sparse-checkout`, `submodules`, `lfs`, `current`, `wiki`, and `force-clean-git-credentials`.
+Each entry MAY define: `repository` (or `repo`), `multi`, `allowed-repos`, `max-repos`, `allow-private-repos`, `ref`, `path`, `github-token` (or legacy `token`), `github-app` (or deprecated alias `app`), `safe-outputs-github-app`, `fetch-depth`, `fetch`, `sparse-checkout`, `submodules`, `lfs`, `current`, `wiki`, and `force-clean-git-credentials`.
 
 `github-token` and `github-app` MUST be mutually exclusive per entry.
 
@@ -91,17 +91,24 @@ Each entry MAY define: `repository` (or `repo`), `allowed-repos`, `max-repos`, `
 #### Runtime Repository Lists
 
 `repo` MUST be accepted as an alias for `repository`; specifying both MUST fail.
-Any GitHub Actions expression in `repository` or `repo` MUST require
-`allowed-repos` at compile time, even for a single selected repository, except
-the standalone `${{ github.repository }}` expression. Without `allowed-repos`,
-that expression MUST retain normal single-repository checkout behavior and MUST
-NOT require a path prefix. Whitespace within the expression MAY vary; combining
-it with other expressions or literal values MUST NOT qualify for the exception.
+`multi` MUST be a literal boolean and MUST default to false. Only `multi: true`
+MUST enable repository-list expansion and the multi-repo restrictions in this
+subsection. Neither an expression selector nor `allowed-repos` alone MUST
+implicitly enable multi mode. Without multi mode, an explicit `repository` or
+`repo` MUST resolve to exactly one `owner/repo` slug; empty, malformed, wildcard,
+and multiple resolved slugs (including duplicates) MUST fail before checkout.
+Literal lists MUST fail compilation. Runtime expression values MUST be validated
+as data before `actions/checkout` in both agent and safe-output jobs.
+Single-repository expressions MUST NOT require an allowlist, a non-root path
+prefix, visibility preflight, private-target opt-in, or explicit App scoping.
+Normal single-checkout LFS, submodule, `current`, and `wiki` support MUST remain
+available. Multi-only policy fields MUST NOT activate or constrain a single
+checkout; their declared types still apply.
 `repository` and `repo` MUST select explicit repository names, not wildcard
 patterns. Literal repository wildcards MUST fail at compile time, and wildcard
 values in expression-resolved lists MUST fail at runtime. Wildcards MUST only
 be used in `allowed-repos`; the allowlist MUST NOT discover or select repositories.
-An entry with `allowed-repos` MUST expand its repository value as newline-separated
+An entry with `multi: true` MUST expand its repository value as newline-separated
 `owner/repo` slugs at runtime. List expansion MUST require a non-empty allowlist
 and a literal, non-root path prefix. Each repository MUST be checked out under
 `<prefix>/<owner>/<repo>`. Matching and deduplication MUST be case-insensitive.
@@ -162,7 +169,9 @@ Safe-output jobs MUST retain their intended authenticated-write credentials.
 
 ### 3.2 Entry Merge Rules
 
-Entries with the same `(repository, path, wiki)` key MUST merge with these rules:
+Entries with the same `(repository, path, wiki, multi)` key MUST merge with these rules.
+Single and multi entries MUST remain distinct; an imported multi entry MUST NOT
+silently turn a single entry into a repository list:
 
 - `fetch-depth`: deepest wins (`0` wins over all)
 - `ref`: first non-empty wins
@@ -375,6 +384,7 @@ When `GH_AW_TARGET_REPO_SLUG` is set but equals `GITHUB_REPOSITORY`, the impleme
 - **T-CHK-017**: Activation sparse checkout pins supported pull-request events to the base SHA, retains non-PR and `workflow_call` fallback refs, excludes `pull_request_target`, and preserves the same-repo guard for optional App token fallback
 - **T-CHK-018**: Checkout-time and final cleanup fail closed on helper failure or residual credentials, including included config files; successful verified cleanup and the no-checkout case remain usable
 - **T-CHK-019**: Runtime private/internal targets require literal per-entry opt-in and a non-public host; public hosts reject them even with opt-in, merged entries cannot broaden access, and denials reach agent failure issues
+- **T-CHK-020**: Only literal `multi: true` enables lists; omitted/false mode accepts single-repository expressions without multi restrictions, rejects empty/multiple/wildcard resolved slugs before either job's checkout, and remains distinct when imports merge
 
 ### 7.2 Compliance Checklist
 
@@ -394,6 +404,7 @@ When `GH_AW_TARGET_REPO_SLUG` is set but equals `GITHUB_REPOSITORY`, the impleme
 | Activation checkout ref and fallback provenance | T-CHK-017 | C1 | Required |
 | Verified fail-closed credential cleanup | T-CHK-018 | C1/C2 | Required |
 | Explicit private checkout opt-in and public-host isolation | T-CHK-019 | C1/C2 | Required |
+| Explicit multi opt-in and single-repository enforcement | T-CHK-020 | C1/C2 | Required |
 
 ### 7.3 Safeguards
 
@@ -438,6 +449,12 @@ The following MUST-level norms govern credential and token safety during checkou
 
 ## 9. Change Log
 
+### Version 1.3.3 (Working Draft)
+
+- Required explicit `multi: true` for repository lists and scoped all list-only
+  restrictions to that mode. Restored ordinary single-repository expressions,
+  required runtime cardinality validation in both jobs, and added T-CHK-020.
+
 ### Version 1.3.2 (Working Draft)
 
 - Required explicit `allow-private-repos` opt-in for runtime private/internal