diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index b789287..4b98171 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,102 +1,39 @@
+---
+# Homelab CI — baseline secret scan (git-ci-02)
 name: CI
 
 on:
   push:
-    branches: [ main, master, develop, feature/** ]
+    branches: [master, main]
   pull_request:
-    # Trigger on all pull requests regardless of target branch
-  workflow_dispatch:
+    types: [opened, synchronize, reopened]
 
 jobs:
-  lint:
-    name: Lint with ruff
-    runs-on: ubuntu-latest
-    
+  skip-ci-check:
+    runs-on: [homelab, self-hosted, linux]
+    outputs:
+      should-skip: ${{ steps.check.outputs.skip }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: '3.11'
-        
-    - name: Install ruff
-      run: |
-        python -m pip install --upgrade pip
-        pip install ruff>=0.1.0
-        
-    - name: Run ruff check
-      run: |
-        ruff check nanobot/
-        
-    - name: Run ruff format check
-      run: |
-        ruff format --check nanobot/
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+      - id: check
+        run: |
+          SKIP=0
+          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
+          MSG="${GITHUB_EVENT_HEAD_COMMIT_MESSAGE:-$(git log -1 --pretty=%B 2>/dev/null || true)}"
+          echo "$BRANCH" "$MSG" | grep -qi '@skipci' && SKIP=1
+          echo "skip=$SKIP" >> $GITHUB_OUTPUT
 
-  test:
-    name: Test Python ${{ matrix.python-version }}
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ['3.11', '3.12']
-        
+  secret-scan:
+    needs: skip-ci-check
+    if: needs.skip-ci-check.outputs.should-skip != '1'
+    runs-on: [homelab, self-hosted, linux, heavy]
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ matrix.python-version }}
-        
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        # Install nanobot with all dependencies and dev dependencies
-        pip install -e ".[dev]"
-        # Verify key dependencies are installed
-        pip list | grep -E "(pytest|ruff|pydantic|typer|litellm)"
-        
-    - name: Run tests
-      run: |
-        pytest tests/ -v --tb=short
-        
-    - name: Check package can be imported
-      run: |
-        python -c "import nanobot; print(f'nanobot version check passed')"
-
-  build:
-    name: Build package
-    runs-on: ubuntu-latest
-    needs: [lint, test]
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: '3.11'
-        
-    - name: Install build dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install build hatchling
-        
-    - name: Build package
-      run: |
-        python -m build
-        
-    - name: Check build artifacts
-      run: |
-        ls -lh dist/
-        
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: dist-packages
-        path: dist/
-        retention-days: 7
-
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Gitleaks
+        run: |
+          docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:latest \
+            detect --source /repo --no-banner --redact