diff --git a/.github/workflows/keep-ci.yml b/.github/workflows/keep-ci.yml
new file mode 100644
index 0000000..93682b6
--- /dev/null
+++ b/.github/workflows/keep-ci.yml
@@ -0,0 +1,47 @@
+# Pull-request and main CI: format, lint, the workspace tests, and the
+# release contract. The issue loop's review step merges a PR only after these
+# checks pass, and a PR without checks blocks its issue.
+name: keep-ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: keep-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gates:
+    name: fmt, clippy, tests, release contract
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # The Dockerfile's toolchain, so a new stable release does not fail PRs.
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: "1.92"
+          components: rustfmt, clippy
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: 0.12.1
+          enable-cache: false
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          shared-key: keep-ci
+      - name: Run Keep gates
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo fmt --all -- --check
+          cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
+          cargo test --locked --workspace
+      - name: Release contract
+        shell: bash
+        run: |
+          set -euo pipefail
+          uv run --python 3.13 --no-project scripts/release/verify-release-contract.py --app keep