diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 324c0f91..f687e3b6 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -55,8 +55,17 @@ npm run dev:backend
 
 # Docker
 npm run docker:dev
+
+# Verify a change before declaring it done (mirrors CI: frontend lint + typecheck)
+npm run verify
 ```
 
+**Before declaring any change done, run `npm run verify`.** It runs the same
+hermetic gates as CI (`.github/workflows/ci.yml`: frontend lint + typecheck), so
+green locally means green on `main`. Build and the full-stack Playwright e2e are
+not yet gated in CI (build hits a prisma-engine issue; e2e needs both servers +
+a DB) — run those manually until wired.
+
 ---
 
 ## Critical: Monorepo Rules
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..6910e64b
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,57 @@
+# Golden CI floor — see dotfiles/templates/ci/README.md.
+# datacat: npm monorepo (frontend/ + backend/). The only tests are full-stack
+# Playwright e2e that need both servers + a DB running — NOT hermetic, so they
+# are deferred to a future e2e job (lift revampit's e2e-local pattern once a
+# seeded DB service is wired). This floor gates the frontend quality signals
+# that currently never run: lint, typecheck, build (contentlayer + prisma
+# generate + next build). The frontend needs --legacy-peer-deps (proven in the
+# old deploy workflow). The production Docker deploy stays disabled — enabling a
+# deploy is an outward-facing decision, not part of the CI floor.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify-frontend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          # Node 18: contentlayer (unmaintained) crashes on exit under Node 20+
+          # (ERR_INVALID_ARG_TYPE in clipanion) even though it generates docs
+          # fine. The old deploy workflow pinned 18 for the same reason.
+          node-version: 18
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install
+        run: npm ci --legacy-peer-deps
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Typecheck
+        run: npx tsc --noEmit
+
+      # Build is DEFERRED, not skipped silently. `prisma generate` currently
+      # fails in CI on a missing engine (query_engine_bg.postgresql.wasm) — a
+      # repo tooling issue to fix separately, not a gate-worthy signal. The
+      # full-stack Playwright e2e is also deferred (needs both servers + a DB).
+      # This floor gates the frontend signals that never ran before:
+      # lint + typecheck. Add build + e2e once the prisma engine is resolved
+      # (revampit e2e-local pattern in dotfiles/templates/ci/README.md).
diff --git a/package.json b/package.json
index 6d3b4aea..9dbddee4 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,8 @@
     "test:ui": "npx playwright test --ui",
     "test:debug": "npx playwright test --debug",
     "test:headed": "npx playwright test --headed",
-    "test:report": "npx playwright show-report"
+    "test:report": "npx playwright show-report",
+    "verify": "npm run lint && cd frontend && npx tsc --noEmit"
   },
   "keywords": [
     "data-capture",