diff --git a/.forgejo/workflows/ci-smoke.yaml b/.forgejo/workflows/ci-smoke.yaml
new file mode 100644
index 0000000..bd44c56
--- /dev/null
+++ b/.forgejo/workflows/ci-smoke.yaml
@@ -0,0 +1,29 @@
+# Canonical CI smoke template (tier 1 routing drill).
+# Copy to: .forgejo/workflows/ci-smoke.yaml in consumer repos.
+name: CI Smoke
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  host-smoke:
+    runs-on: self-hosted
+    steps:
+      - name: Routing probe (host runner)
+        run: |
+          set -eu
+          echo "repository=${GITHUB_REPOSITORY:-unknown}"
+          echo "sha=${GITHUB_SHA:-unknown}"
+          echo "runner=${RUNNER_NAME:-unknown}"
+          uname -a
+
+  container-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Routing probe (container label)
+        run: |
+          set -eu
+          echo "container-smoke ok for ${GITHUB_REPOSITORY:-unknown}"
\ No newline at end of file
diff --git a/.forgejo/workflows/image.yaml b/.forgejo/workflows/image.yaml
new file mode 100644
index 0000000..d730e0c
--- /dev/null
+++ b/.forgejo/workflows/image.yaml
@@ -0,0 +1,61 @@
+# Multi-repo Docker build template for tier-3 prep (e.g. state-hub + hub-core).
+# Copy to: .forgejo/workflows/image.yaml and set PRIMARY_REPO + EXTRA_REPOS.
+# Uses archive checkout (no actions/checkout; non-root runner has no git).
+# Dockerfile must reference named contexts, e.g.:
+#   COPY --from=hub_core_src pyproject.toml /tmp/hub-core/pyproject.toml
+name: Build and Publish Multi-Context Image
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".forgejo/workflows/image.yaml"
+      - "Dockerfile"
+  workflow_dispatch:
+
+env:
+  REGISTRY: forgejo.coulomb.social
+  IMAGE_NAME: coulomb/state-hub
+  DOCKER_HOST: tcp://127.0.0.1:2375
+  # Space-separated coulomb/repo@context_name entries for extra build contexts.
+  # Example: "coulomb/hub-core@hub_core_src"
+  EXTRA_REPOS: "coulomb/hub-core@hub_core_src"
+
+jobs:
+  build-and-push:
+    runs-on: container-build
+    steps:
+      - name: Build and push image
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          REF="${GITHUB_SHA:-main}"
+          mkdir -p buildctx "${HOME}/bin"
+          wget -qO /tmp/primary.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+          tar xzf /tmp/primary.tar.gz -C buildctx --strip-components=1
+          BUILD_ARGS=()
+          for spec in ${EXTRA_REPOS}; do
+            repo="${spec%@*}"
+            ctx="${spec#*@}"
+            extra_ref="${REF}"
+            wget -qO "/tmp/${ctx}.tar.gz" \
+              "https://forgejo.coulomb.social/${repo}/archive/${extra_ref}.tar.gz"
+            mkdir -p "/tmp/ctx-${ctx}"
+            tar xzf "/tmp/${ctx}.tar.gz" -C "/tmp/ctx-${ctx}" --strip-components=1
+            BUILD_ARGS+=(--build-context "${ctx}=/tmp/ctx-${ctx}")
+          done
+          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
+            | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
+          export PATH="${HOME}/bin:${PATH}"
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
+          SHORT="${REF:0:7}"
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          docker build "${BUILD_ARGS[@]}" \
+            -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
+          docker push "${IMAGE}:latest"
+          docker push "${IMAGE}:main-${SHORT}"
+          echo "pushed ${IMAGE}:latest and ${IMAGE}:main-${SHORT}"
\ No newline at end of file