diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index af068da..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-# Dependabot config for .NET / NuGet API repos.
-# main is replaced by the rollout script with `develop` (if the
-# repo has that branch) or the repo's actual default branch otherwise.
-version: 2
-updates:
-  - package-ecosystem: "nuget"
-    directory: "/"
-    target-branch: "main"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "06:00"
-      timezone: "Asia/Amman"
-    cooldown:
-      default-days: 3
-      semver-patch-days: 5
-      semver-minor-days: 3
-      semver-major-days: 7
-    open-pull-requests-limit: 10
-    groups:
-      nuget-patch:
-        update-types: ["patch"]
-      nuget-minor:
-        update-types: ["minor"]
-    labels:
-      - "dependencies"
-      - "nuget"
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    target-branch: "main"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "06:00"
-      timezone: "Asia/Amman"
-    cooldown:
-      default-days: 3
-      semver-patch-days: 5
-      semver-minor-days: 3
-      semver-major-days: 7
-    open-pull-requests-limit: 5
-    groups:
-      actions-patch:
-        update-types: ["patch"]
-      actions-minor:
-        update-types: ["minor"]
-    labels:
-      - "dependencies"
-      - "github-actions"
diff --git a/.github/workflows/critical-vuln-check.yml b/.github/workflows/critical-vuln-check.yml
deleted file mode 100644
index bb11ee1..0000000
--- a/.github/workflows/critical-vuln-check.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-# =============================================================================
-# Critical Dependabot Vulnerability Check — Caller template
-# =============================================================================
-# USAGE:
-#   Copy this file to your repo at .github/workflows/critical-vuln-check.yml.
-#   No REPLACE values needed — this template requires no customization.
-#
-# WHAT IT DOES:
-#   Runs on every PR targeting main or develop. Fails if the repository has
-#   any open CRITICAL-severity Dependabot alert.
-#
-#   Enforcement differs by target branch via each repo's OWN branch
-#   protection settings (not by anything in this file):
-#     - On `main`:    mark this check REQUIRED in branch protection — merge
-#                     is physically blocked while a critical alert is open.
-#     - On `develop`: leave this check NOT required — it still shows as a
-#                     failing/red check (a visible warning) without blocking
-#                     the merge.
-# =============================================================================
-name: Critical Vulnerability Check
-run-name: vuln-check-${{ github.event.pull_request.number }}
-
-on:
-  pull_request_target:
-    branches: [main, develop]
-
-# critical-vuln-gate.yml's own job requests these two scopes -- a caller can
-# only narrow permissions for a nested reusable-workflow job, never widen
-# them, so these must be granted here or the whole file fails to parse.
-permissions:
-  contents: write
-  security-events: read
-
-jobs:
-  vuln-gate:
-    uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main
-    secrets:
-      dependabot-alerts-token: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }}
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
deleted file mode 100644
index b6f154f..0000000
--- a/.github/workflows/dependabot-auto-merge.yml
+++ /dev/null
@@ -1,68 +0,0 @@
-# =============================================================================
-# Dependabot Auto-Merge — Caller template
-# =============================================================================
-# USAGE:
-#   Copy this file to your repo at .github/workflows/dependabot-auto-merge.yml.
-#   No REPLACE values needed.
-#
-# WHAT IT DOES:
-#   Auto-merges a Dependabot PR ONLY when ALL of the following hold:
-#     - The PR author is dependabot[bot]
-#     - The update is a semver PATCH bump (never minor/major)
-#     - The ecosystem is npm, nuget, pub, bundler, or github-actions
-#       (NEVER docker — base image bumps always need manual review)
-#     - This repo currently has no open critical Dependabot alert (re-checked
-#       here explicitly — see workflow-templates/critical-vuln-check.yml's
-#       header for why this can't just `needs:` that file's job)
-#   "Auto-merge" here means GitHub's native auto-merge feature: it still
-#   waits for the repo's actual required status checks (build/test) to pass
-#   before merging — this workflow does not bypass those.
-# =============================================================================
-name: Dependabot Auto-Merge
-
-on:
-  pull_request_target:
-    branches: [main, develop]
-
-permissions:
-  pull-requests: write
-  contents: write
-  security-events: read
-
-jobs:
-  vuln-gate:
-    if: ${{ github.actor == 'dependabot[bot]' && github.event.pull_request.base.ref == 'main' }}
-    uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main
-    secrets:
-      dependabot-alerts-token: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }}
-
-  auto-merge:
-    needs: vuln-gate
-    # needs: vuln-gate normally skips this job if vuln-gate itself was skipped
-    # (base.ref != 'main') -- always() overrides that, then the boolean logic
-    # below re-applies the real gate: a develop-bound PR never needed
-    # vuln-gate to run at all, a main-bound PR still requires it to succeed.
-    if: |
-      always() &&
-      github.actor == 'dependabot[bot]' &&
-      (github.event.pull_request.base.ref != 'main' || needs.vuln-gate.result == 'success')
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Fetch Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@v3
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Enable auto-merge for eligible patch bumps
-        if: |
-          steps.metadata.outputs.update-type == 'version-update:semver-patch' &&
-          contains(fromJSON('["npm_and_yarn", "nuget", "pub", "bundler", "github_actions"]'), steps.metadata.outputs.package-ecosystem)
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
-        run: |
-          set -euo pipefail
-          echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} — patch-level ${{ steps.metadata.outputs.package-ecosystem }} bump, vuln gate passed"
-          gh pr merge --auto --squash "$PR_URL"
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
new file mode 100644
index 0000000..a4066dc
--- /dev/null
+++ b/.github/workflows/verify.yml
@@ -0,0 +1,47 @@
+# =============================================================================
+# Verify -- Caller template
+# =============================================================================
+# USAGE:
+#   Copy this file to your repo at .github/workflows/verify.yml and replace
+#   `stack: REPLACE` with one of: dotnet-service, dotnet-library, web,
+#   react-native, flutter, strapi, infra.
+#
+#   Then mark `verify / result` as the REQUIRED status check in the org ruleset.
+#   `result` always reports: a human PR into develop/development/staging passes
+#   immediately; PRs into the default branch, bot PRs and manual runs get the
+#   full verification ladder.
+#
+#   Add your repo's default branch and Renovate target branch to `branches`
+#   below if they are not already listed.
+#
+# SECRETS: DEPENDABOT_ALERTS_TOKEN (optional), NUGET_PACKAGE_PAT (optional).
+# =============================================================================
+name: Verify
+run-name: verify-${{ github.event.pull_request.number || github.ref_name }}
+
+on:
+  pull_request:
+    branches: [main, develop, development, staging, gigstaging]
+    types: [opened, synchronize, reopened, edited]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+  pull-requests: read
+
+# One billed run per PR. Safe to cancel: verification is read-only and deploys nothing.
+concurrency:
+  group: verify-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    uses: simplify9/.github/.github/workflows/verify.yml@main
+    with:
+      stack: dotnet-library
+      known-failing: ''
+      contract-deadline: '2026-12-21'
+    secrets:
+      dependabot-alerts-token: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }}
+      nuget-restore-token: ${{ secrets.NUGET_PACKAGE_PAT }}