diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..e159cd2
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,79 @@
+# nova-platform CI — offline mirror of scripts/run_ci.sh (task order coreci/nova-platform#3, hip c12363)
+#
+# Stages mirror the local CI script: lint (py_compile) -> test (pytest,
+# not shell markers) -> check-only (run_platform.sh --check-only).
+# Every leg either runs for real or fails loud with its reason — no leg
+# is skipped silently and nothing skipped is presented as passed.
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: fetch (probe: stock actions/checkout@v4)
+        id: actfetch
+        continue-on-error: true
+        uses: actions/checkout@v4
+      - name: fetch (git-clone fallback, run token)
+        if: ${{ steps.actfetch.outcome == 'failure' }}
+        run: |
+          set -euo pipefail
+          REF="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
+          git clone --depth 1 -b "$REF" "https://coreci-nova-po:${{ secrets.GITEA_TOKEN }}@git.coreci.dev/${{ github.repository }}.git" .
+      - name: toolchain probe (reports; never gates)
+        run: |
+          set -u
+          python3 --version
+          python3 -m pytest --version 2>/dev/null || echo "pytest: ABSENT"
+          for m in yaml jsonschema boto3 moto; do
+            python3 -c "import $m" 2>/dev/null && echo "$m: OK" || echo "$m: ABSENT"
+          done
+          timeout 25 pip download --no-deps --dest /tmp/piptest pytest >/dev/null 2>&1 && echo "pypi: REACHABLE" || echo "pypi: UNREACHABLE"
+      - name: deps (requirements-test.txt when pypi reachable)
+        run: |
+          if timeout 25 pip download --no-deps --dest /tmp/piptest pytest >/dev/null 2>&1; then
+            pip install -q -r requirements-test.txt && echo "deps: installed from requirements-test.txt"
+          else
+            echo "deps: pypi UNREACHABLE - proceeding on the runner's preinstalled toolchain only"
+          fi
+      - name: lint (stage 1/3 - py_compile, stdlib-only)
+        run: |
+          set -euo pipefail
+          python3 -m py_compile $(find core/ adapters/ scripts/ -name '*.py' -not -path '*/__pycache__/*')
+          echo "lint: OK"
+      - name: test (stage 2/3 - pytest, offline markers)
+        run: |
+          set -euo pipefail
+          MISSING=""
+          python3 -m pytest --version >/dev/null 2>&1 || MISSING="$MISSING pytest"
+          for m in yaml jsonschema boto3 moto; do
+            python3 -c "import $m" 2>/dev/null || MISSING="$MISSING $m"
+          done
+          if [ -n "$MISSING" ]; then
+            echo "FAIL: test leg cannot run - toolchain absent on runner vantage:$MISSING" >&2
+            exit 1
+          fi
+          python3 -m pytest tests/ -q --tb=short -m "not shell"
+          echo "test: OK"
+      - name: check-only (stage 3/3 - run_platform.sh --check-only)
+        run: |
+          set -euo pipefail
+          MISSING=""
+          for m in yaml jsonschema; do
+            python3 -c "import $m" 2>/dev/null || MISSING="$MISSING $m"
+          done
+          if [ -n "$MISSING" ]; then
+            echo "FAIL: check-only leg cannot run - toolchain absent on runner vantage:$MISSING" >&2
+            exit 1
+          fi
+          bash scripts/run_platform.sh --check-only contracts/static-assets.yml
+          echo "check-only: OK"
+      - name: summary
+        run: echo "=== CI stages complete: lint, test, check-only ==="