diff --git a/.tangled/workflows/ci.yml b/.tangled/workflows/ci.yml
new file mode 100644
index 0000000..98dcd6a
--- /dev/null
+++ b/.tangled/workflows/ci.yml
@@ -0,0 +1,37 @@
+# CI on tangled spindles (Linux runners). Scope: trawler-core — the whole
+# backend (storage, indexes, query engine, search) including the integrity
+# gates from openspec change add-integrity-gates. The GPUI app crate has
+# only ever been built on Windows (see README) and is gated by
+# .github/workflows/ci.yml on windows-latest instead; building gpui on a
+# Linux runner is untested and deliberately not on this pipeline.
+#
+# The toolchain comes from rust-toolchain.toml (rustup reads it); gcc is
+# the linker plus cc for the C bits in the dependency tree (zstd via
+# tantivy); cacert so cargo can reach crates.io over TLS.
+
+when:
+  - event: ["push", "manual"]
+    branch: ["main"]
+  - event: ["pull_request"]
+    branch: ["main"]
+
+engine: "nixery"
+
+dependencies:
+  nixpkgs:
+    - rustup
+    - gcc
+    - cacert
+
+environment:
+  CARGO_TERM_COLOR: "always"
+
+steps:
+  - name: "Install pinned toolchain (rust-toolchain.toml)"
+    command: "rustup toolchain install && rustup show"
+  - name: "Format check"
+    command: "cargo fmt --all -- --check"
+  - name: "Clippy (trawler-core)"
+    command: "cargo clippy -p trawler-core --all-targets -- -D warnings"
+  - name: "Tests including integrity gates (trawler-core)"
+    command: "cargo test -p trawler-core"
diff --git a/.tangled/workflows/deep-gates.yml b/.tangled/workflows/deep-gates.yml
new file mode 100644
index 0000000..fd68a91
--- /dev/null
+++ b/.tangled/workflows/deep-gates.yml
@@ -0,0 +1,26 @@
+# Manual-only deep sweep: the #[ignore]d expensive tests — the integrity
+# gates' deep tiers (4x1500-op rebuild equivalence, 20-kill crash sweep)
+# and the synthetic 100k-block scale tests. ~7 minutes of test time on a
+# fast machine after a cold release build; trigger from the tangled UI
+# when touching storage/index code or before a release.
+
+when:
+  - event: ["manual"]
+    branch: ["main"]
+
+engine: "nixery"
+
+dependencies:
+  nixpkgs:
+    - rustup
+    - gcc
+    - cacert
+
+environment:
+  CARGO_TERM_COLOR: "always"
+
+steps:
+  - name: "Install pinned toolchain (rust-toolchain.toml)"
+    command: "rustup toolchain install && rustup show"
+  - name: "Deep tiers (release, ignored tests)"
+    command: "cargo test -p trawler-core --release -- --ignored"