From 11885a07fa19c2fd48a3229749f2059b84165e6f Mon Sep 17 00:00:00 2001
From: Stephen Zweibel <srzweibel@gmail.com>
Date: Thu, 6 Aug 2026 22:55:58 -0400
Subject: [PATCH 1/2] Add root validation check

---
 README.md        |  6 ++++++
 scripts/check.sh | 25 +++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100755 scripts/check.sh

diff --git a/README.md b/README.md
index cae1238..d50511b 100644
--- a/README.md
+++ b/README.md
@@ -237,6 +237,12 @@ bun run lint
 bun run build
 ```
 
+From the repository root, run the credential-free backend/frontend check:
+
+```bash
+./scripts/check.sh
+```
+
 Verify the effective runtime (LLM provider, Docling target, installed binaries) with:
 
 ```bash
diff --git a/scripts/check.sh b/scripts/check.sh
new file mode 100755
index 0000000..1cb9e66
--- /dev/null
+++ b/scripts/check.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+
+(
+  cd "$repo_root/backend"
+  env \
+    GEMINI_API_KEY= \
+    GOOGLE_API_KEY= \
+    LLM_API_KEY=check-only \
+    LLM_BASE_URL=http://127.0.0.1:8000/v1 \
+    LLM_MODEL=gemini-check \
+    USE_DIRECT_GEMINI_PDF=false \
+    DOCLING_SERVE_URL= \
+    DOCLING_SERVE_TOKEN= \
+    PYTHONPATH=. \
+    uv run pytest tests -q
+)
+
+(
+  cd "$repo_root/frontend"
+  bun run lint
+  bun run build
+)

From 29f49ae667582a89c80559386c1a9d6832c69097 Mon Sep 17 00:00:00 2001
From: Stephen Zweibel <srzweibel@gmail.com>
Date: Fri, 7 Aug 2026 03:37:40 -0400
Subject: [PATCH 2/2] Add credential-free CI source gate

---
 .github/workflows/ci.yml | 45 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..a6a8037
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: pdf-accessibility-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  UV_LOCKED: "1"
+
+jobs:
+  source-gate:
+    name: Source gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12.13"
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.32"
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+      - name: Install backend dependencies
+        working-directory: backend
+        run: uv sync --locked --extra dev
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: bun install --frozen-lockfile
+      - name: Run canonical source gate
+        run: ./scripts/check.sh