diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7fe12c3..41c759a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -49,11 +49,10 @@ jobs:
             | sh -s -- -y --default-toolchain none
           echo "$HOME/.elan/bin" >> "$GITHUB_PATH"
 
-      - name: Restore mathlib cache and build Lean gate
+      - name: Restore mathlib cache
         run: |
           lake update
           lake exe cache get
-          lake build
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
@@ -83,43 +82,7 @@ jobs:
           # SDK as a separate package — both layouts work, and the
           # PYTHONPATH route avoids a setuptools build step in CI.
           PYTHONPATH: .:sdks/python
-        run: |
-          # PR-N1/N2/N3/N4 (ADR 0008) cleanup: this gate covers ONLY
-          # verifier-independent code. The Linux runner cannot load
-          # real Qwen3 weights; the cleanup PRs retired the
-          # FakeVerifier / DeterministicEngine / DeterministicTokenizer
-          # / _MinimalVerifierStub test doubles. Verifier-dependent
-          # modules — ``inference_engine.session.coordinator``,
-          # ``inference_engine.session.generator``,
-          # ``inference_engine.scheduler.scheduler``,
-          # ``inference_engine.server.{app, engine, tokenizer, streaming}``,
-          # ``kakeya.{client, session}`` — move to the
-          # tests/integration/ suite, gated on Mac M4 / CUDA hosts.
-          #
-          # Coverage is invoked via ``coverage run -m pytest`` rather
-          # than ``pytest --cov=`` to avoid a torch+pytest-cov race
-          # at conftest-import time on the hosted Linux runner.
-          coverage run -m pytest \
-            tests/inference_engine/server/ \
-            tests/inference_engine/memory/ \
-            tests/inference_engine/scheduler/ \
-            tests/inference_engine/pipeline/ \
-            tests/inference_engine/session/ \
-            tests/inference_engine/bench/ \
-            tests/inference_engine/setup/ \
-            tests/inference_engine/bridge/ \
-            tests/inference_engine/distributed/ \
-            tests/inference_engine/network/ \
-            tests/sdk/python/ \
-            tests/training/repr_align/ \
-            tests/backends/mlx/test_env.py \
-            --junitxml=junit.xml \
-            -v
-          coverage report \
-            --include='inference_engine/server/auth.py,inference_engine/server/config.py,inference_engine/server/errors.py,inference_engine/server/grpc_app.py,inference_engine/server/metrics.py,inference_engine/server/schemas.py,inference_engine/server/proto_gen/**/*.py,inference_engine/memory/*,inference_engine/bridge/*,inference_engine/distributed/*,inference_engine/network/*,inference_engine/scheduler/config.py,inference_engine/scheduler/session.py,inference_engine/pipeline/*,inference_engine/session/store.py,inference_engine/setup/*,sdks/python/kakeya/__init__.py,sdks/python/kakeya/errors.py,training/repr_align/*' \
-            --fail-under=100
-          coverage xml -o coverage.xml \
-            --include='inference_engine/server/auth.py,inference_engine/server/config.py,inference_engine/server/errors.py,inference_engine/server/grpc_app.py,inference_engine/server/metrics.py,inference_engine/server/schemas.py,inference_engine/server/proto_gen/**/*.py,inference_engine/memory/*,inference_engine/bridge/*,inference_engine/distributed/*,inference_engine/network/*,inference_engine/scheduler/config.py,inference_engine/scheduler/session.py,inference_engine/pipeline/*,inference_engine/session/store.py,inference_engine/setup/*,sdks/python/kakeya/__init__.py,sdks/python/kakeya/errors.py,training/repr_align/*'
+        run: ./scripts/run_local_ci.sh
 
       - name: Upload coverage artifact
         if: always()
diff --git a/scripts/run_local_ci.sh b/scripts/run_local_ci.sh
new file mode 100755
index 0000000..ed338f8
--- /dev/null
+++ b/scripts/run_local_ci.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+PYTHON="${PYTHON:-python}"
+export PYTHONPATH="${PYTHONPATH:-.:sdks/python}"
+
+# This script is the canonical local CI subset. GitHub Actions invokes this
+# exact file, then adds Docker, package, proto, TypeScript, and Mac integration
+# jobs around it.
+lake build
+
+"$PYTHON" -m coverage erase
+"$PYTHON" -m coverage run -m pytest \
+  tests/inference_engine/server/ \
+  tests/inference_engine/memory/ \
+  tests/inference_engine/scheduler/ \
+  tests/inference_engine/pipeline/ \
+  tests/inference_engine/session/ \
+  tests/inference_engine/bench/ \
+  tests/inference_engine/setup/ \
+  tests/inference_engine/bridge/ \
+  tests/inference_engine/distributed/ \
+  tests/inference_engine/network/ \
+  tests/sdk/python/ \
+  tests/training/repr_align/ \
+  tests/backends/mlx/test_env.py \
+  --junitxml=junit.xml \
+  -v
+
+COVERAGE_INCLUDE='inference_engine/server/auth.py,inference_engine/server/config.py,inference_engine/server/errors.py,inference_engine/server/grpc_app.py,inference_engine/server/metrics.py,inference_engine/server/schemas.py,inference_engine/server/proto_gen/**/*.py,inference_engine/memory/*,inference_engine/bridge/*,inference_engine/distributed/*,inference_engine/network/*,inference_engine/scheduler/config.py,inference_engine/scheduler/session.py,inference_engine/pipeline/*,inference_engine/session/store.py,inference_engine/setup/*,sdks/python/kakeya/__init__.py,sdks/python/kakeya/errors.py,training/repr_align/*'
+
+"$PYTHON" -m coverage report \
+  --include="$COVERAGE_INCLUDE" \
+  --fail-under=100
+"$PYTHON" -m coverage xml \
+  -o coverage.xml \
+  --include="$COVERAGE_INCLUDE"