diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..d211479
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,59 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  checks:
+    name: typecheck · unit · live matrix · audit · build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Unit tests (campaigns · config · render)
+        run: npm test
+
+      - name: Boot a real NEDB engine
+        run: |
+          pip install nedb-engine
+          nohup nedbd --data /tmp/salon-ci-data > /tmp/nedbd.log 2>&1 &
+          for i in $(seq 1 30); do
+            if curl -sf http://127.0.0.1:7070/health > /dev/null; then
+              echo "nedbd is up:" && curl -s http://127.0.0.1:7070/health
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "nedbd failed to start" && cat /tmp/nedbd.log && exit 1
+
+      - name: Live suite — the three-storefront matrix (real app, real engine, no mocks)
+        run: npm run test:api
+        env:
+          NEDB_TEST_URL: http://127.0.0.1:7070
+
+      - name: Portal audit (contract gate)
+        run: npx portal audit
+
+      - name: Build
+        run: npm run build
+
+      - name: Engine log (on failure)
+        if: failure()
+        run: cat /tmp/nedbd.log || true