ci: add repository validation workflow

.github/workflows/ci.yml

@@ -0,0 +1,90 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  backend:
+    name: Backend tests (Python 3.12)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: backend/requirements.txt
+
+      - name: Install backend dependencies
+        run: python -m pip install --requirement backend/requirements.txt
+
+      - name: Run backend tests
+        working-directory: backend
+        run: python -m pytest
+
+  frontend:
+    name: Frontend tests, lint, and build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Set up Node.js 22
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Run frontend tests
+        working-directory: frontend
+        run: npm test
+
+      - name: Run frontend lint
+        working-directory: frontend
+        run: npm run lint
+
+      - name: Build frontend
+        working-directory: frontend
+        run: npm run build
+
+  contracts:
+    name: Node and provider contracts
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Set up Node.js 22
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: "22"
+
+      - name: Check node contracts
+        run: node scripts/check-node-contracts.mjs
+
+      - name: Inventory provider contracts
+        run: node scripts/contract-inventory.mjs
+
+      - name: Check generated model reference
+        run: node scripts/generate-model-reference.mjs --check

implementation-notes.md

@@ -1,5 +1,24 @@
 # Implementation Notes
 
+## 2026-07-22 - GitHub Actions CI baseline
+
+The repository previously had no configured GitHub checks. The first CI
+workflow mirrors the local merge gates in three independent jobs.
+
+Decisions:
+- Run on pull requests and pushes to `main`; do not change branch protection.
+- Keep backend, frontend, and contract jobs independent so a failure names the
+  affected surface and does not serialize unrelated work.
+- Use Python 3.12 and Node.js 22, with dependency caches keyed by the existing
+  requirements and lockfiles.
+- Pin official GitHub Actions to immutable commits while documenting their
+  release-major tags in comments.
+- Do not upgrade pip or run an audit auto-fix in CI. The workflow installs only
+  repository-pinned Python requirements and the checked-in npm lockfile.
+- Treat the contract inventory as an executable inventory gate. Its 48 known
+  exemplar gaps remain visible in logs rather than being reclassified as CI
+  failures by this infrastructure-only change.
+
 ## 2026-07-22 - Malformed Cinema refs and FileProvider object audit
 
 Four loose refs had Finder-style duplicate names ending in ` 2`: local and