diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..1514dea
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,110 @@
+# CI 管道 — moziplus v2.0
+#
+# 触发条件：
+#   - push（非 main 分支）→ 快速门控（lint + unit test）
+#   - pull_request（opened, synchronize）→ 同上
+#
+# 注意：main 分支的 CI 由 deploy.yml 负责（完整 CI + 部署）
+#
+# Gitea v1.23.4 限制注意：
+#   - 不支持 failure() 表达式，用 always() + shell 条件判断替代
+#   - 不支持 concurrency / continue-on-error / timeout-minutes / permissions
+#   - 无内置 CI_TOKEN，需手动配置 PAT 为 secret
+#   - runs-on 只支持单个 label
+
+name: CI
+
+on:
+  push:
+    branches:
+      - '**'
+      - '!main'
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  # ── Job 1: Lint ──────────────────────────────────────
+  lint:
+    runs-on: macos-arm64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        run: |
+          python3 -m venv .venv
+          .venv/bin/pip install --quiet ruff
+
+      - name: Lint with ruff
+        run: |
+          test -d src && .venv/bin/ruff check src/ || echo "No src/ directory, skipping lint"
+
+  # ── Job 2: Test ──────────────────────────────────────
+  test:
+    runs-on: macos-arm64
+    needs: lint
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        run: |
+          python3 -m venv .venv
+          if [ -f pyproject.toml ]; then
+            .venv/bin/pip install --quiet -e ".[dev]"
+          else
+            echo "No pyproject.toml, skipping dev install"
+          fi
+
+      - name: Run tests (exclude E2E)
+        run: |
+          if [ -d tests ]; then
+            .venv/bin/pytest tests/ -m "not e2e" -x -q
+          else
+            echo "No tests/ directory, skipping tests"
+          fi
+
+  # ── Job 3: CI 失败通知 ───────────────────────────────
+  # v1.23 不支持 failure()，用 always() + shell 检查 commit status 替代
+  notify-on-failure:
+    runs-on: macos-arm64
+    needs: [lint, test]
+    if: always()
+    steps:
+      - name: Check results and notify
+        env:
+          CI_TOKEN: ${{ secrets.CI_TOKEN }}
+        run: |
+          # 查询当前 commit 的 status
+          STATUS=$(curl -sf \
+            -H "Authorization: token $CI_TOKEN" \
+            "${{ gitea.api_url }}/repos/${{ gitea.repository }}/commits/${{ gitea.sha }}/status" \
+            | python3 -c "import sys,json; print(json.load(sys.stdin).get('state',''))" 2>/dev/null || echo "")
+
+          echo "Commit status: $STATUS"
+
+          if [ "$STATUS" != "success" ]; then
+            echo "CI failed or status unknown, sending notification..."
+
+            # 如果是 PR 事件，写评论通知
+            PR_NUMBER="${{ gitea.event.pull_request.number }}"
+            if [ -n "$PR_NUMBER" ]; then
+              curl -sf -X POST \
+                -H "Authorization: token $CI_TOKEN" \
+                -H "Content-Type: application/json" \
+                "${{ gitea.api_url }}/repos/${{ gitea.repository }}/issues/${PR_NUMBER}/comments" \
+                -d "{\"body\": \"❌ **CI 失败**\\n\\n请检查 CI 日志并修复。\\n\\n触发 commit: \`${{ gitea.sha }}\`\"}" \
+                || echo "Failed to post PR comment"
+              echo "PR comment posted."
+            else
+              # 非 PR 事件（push 分支），创建 Issue 通知
+              BRANCH="${{ gitea.ref_name }}"
+              curl -sf -X POST \
+                -H "Authorization: token $CI_TOKEN" \
+                -H "Content-Type: application/json" \
+                "${{ gitea.api_url }}/repos/${{ gitea.repository }}/issues" \
+                -d "{\"title\": \"🔴 CI 失败: branch $BRANCH\", \"body\": \"非 main 分支 push CI 失败。\\n\\n触发 commit: \`${{ gitea.sha }}\`\\n分支: $BRANCH\\n\\n请检查 CI 日志并修复。\", \"labels\": [\"bug\"]}" \
+                || echo "Failed to create issue"
+              echo "Issue created for branch push CI failure."
+            fi
+          else
+            echo "CI passed, no notification needed."
+          fi
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..61b1cdf
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,121 @@
+# 部署管道 — moziplus v2.0
+#
+# 触发条件：
+#   - push 到 main 分支 → 完整 CI（lint + test + coverage）+ 部署
+#
+# 注意：非 main 分支的 CI 由 ci.yml 负责（快速门控）
+#
+# Gitea v1.23.4 限制注意：
+#   - 不支持 failure() 表达式
+#   - 不支持 concurrency / permissions
+#   - 部署脚本占位，等姜维确认 act-runner 环境后再补具体命令
+
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  # ── Job 1: CI（main 分支跑完整测试）─────────────────
+  ci:
+    runs-on: macos-arm64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        run: |
+          python3 -m venv .venv
+          .venv/bin/pip install --quiet -e ".[dev]"
+
+      - name: Lint
+        run: |
+          test -d src && .venv/bin/ruff check src/ || echo "No src/ directory, skipping lint"
+
+      - name: Unit & Integration Tests
+        run: |
+          if [ -d tests ]; then
+            .venv/bin/pytest tests/ -m "not e2e" -x -q
+          else
+            echo "No tests/ directory, skipping tests"
+          fi
+
+      - name: Coverage Report
+        run: |
+          if [ -d tests ] && [ -d src ]; then
+            .venv/bin/pytest tests/ -m "not e2e" --cov=src --cov-report=term-missing -q
+          else
+            echo "No tests/ or src/ directory, skipping coverage"
+          fi
+
+  # ── Job 2: 部署 ─────────────────────────────────────
+  deploy:
+    runs-on: macos-arm64
+    needs: ci
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Record current version
+        run: |
+          echo "Deploying commit: ${{ gitea.sha }}"
+          echo "Branch: ${{ gitea.ref }}"
+          echo "Timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          # TODO: bash scripts/deploy.sh --version
+          #       等姜维确认 act-runner 环境后再补
+
+      - name: Deploy
+        run: |
+          echo "=== Deploy step (placeholder) ==="
+          echo "Source: ${{ gitea.workspace }}"
+          # TODO: 实际部署脚本
+          # bash scripts/deploy.sh --source="$GITHUB_WORKSPACE" --target="$HOME/.sanguo_projects/sanguo_moziplus_v2" --health-check
+          echo "Deploy placeholder completed."
+          # placeholder: 后续替换为实际部署脚本
+          true
+
+      - name: Health check
+        run: |
+          echo "=== Health check (placeholder) ==="
+          # TODO: 等服务启动后做健康检查
+          # curl -sf http://localhost:8083/api/health || exit 1
+          echo "Health check placeholder passed."
+          # placeholder: 后续替换为实际健康检查
+          true
+
+      # ── 失败时回滚 ────────────────────────────────
+      # v1.23 不支持 if: failure()
+      # 回滚逻辑改由 notify-on-failure job 检测 commit status 后通知人工介入
+      # 后续可升级到 v1.24+ 后改用 failure() 表达式
+
+  # ── Job 3: 部署失败通知 ──────────────────────────────
+  notify-deploy-failure:
+    runs-on: macos-arm64
+    needs: [ci, deploy]
+    if: always()
+    steps:
+      - name: Check deploy result and notify
+        env:
+          CI_TOKEN: ${{ secrets.CI_TOKEN }}
+        run: |
+          STATUS=$(curl -sf \
+            -H "Authorization: token $CI_TOKEN" \
+            "${{ gitea.api_url }}/repos/${{ gitea.repository }}/commits/${{ gitea.sha }}/status" \
+            | python3 -c "import sys,json; print(json.load(sys.stdin).get('state',''))" 2>/dev/null || echo "")
+
+          echo "Deploy status: $STATUS"
+
+          if [ "$STATUS" != "success" ]; then
+            echo "Deploy failed, creating Issue for manual intervention..."
+
+            # 创建 Issue 通知人工介入
+            curl -sf -X POST \
+              -H "Authorization: token $CI_TOKEN" \
+              -H "Content-Type: application/json" \
+              "${{ gitea.api_url }}/repos/${{ gitea.repository }}/issues" \
+              -d "{\"title\": \"🔴 部署失败: commit ${{ gitea.sha }}\", \"body\": \"部署失败，需人工介入排查。\\n\\n触发 commit: \`${{ gitea.sha }}\`\\n分支: main\\n\\n请检查 deploy 日志并手动处理。\", \"labels\": [\"bug\", \"priority:high\"]}" \
+              || echo "Failed to create issue"
+
+            echo "Issue created for deploy failure."
+          else
+            echo "Deploy succeeded."
+          fi
diff --git a/.gitea/workflows/e2e.yml b/.gitea/workflows/e2e.yml
new file mode 100644
index 0000000..9bd7144
--- /dev/null
+++ b/.gitea/workflows/e2e.yml
@@ -0,0 +1,106 @@
+# E2E 测试 — moziplus v2.0
+#
+# 触发条件：
+#   - workflow_dispatch（手动触发）
+#
+# 注意：E2E 在 CI 隔离环境中运行（独立 venv + 临时 SQLite + 临时端口 8084），
+#       不污染生产环境。
+#       Agent spawn 走生产 openclaw（全局单例，无法隔离），
+#       测试 case 用 UUID 前缀标识。
+#
+# Gitea v1.23.4 限制注意：
+#   - 不支持 workflow_run 触发器（无法直接 needs 另一个 workflow 的 job）
+#   - 此 workflow 需手动触发或在 deploy.yml 中以 needs 方式调用
+#   - 实际使用时可能需要合并到 deploy.yml 作为同一个 workflow 的 job
+#   - 或依赖 daemon Webhook 监听 deploy 完成事件后通过 API 触发
+
+name: E2E Tests
+
+on:
+  workflow_dispatch:
+    # 手动触发，可选参数
+    inputs:
+      test_filter:
+        description: 'Test filter (e.g. tests/e2e/test_api.py)'
+        required: false
+        default: 'tests/e2e/'
+
+jobs:
+  e2e:
+    runs-on: macos-arm64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup isolated environment
+        run: |
+          # 创建独立 venv
+          python3 -m venv /tmp/e2e-venv
+          /tmp/e2e-venv/bin/pip install --quiet -e ".[dev]"
+
+          # 创建临时数据目录
+          mkdir -p /tmp/e2e-test-projects
+          mkdir -p /tmp/e2e-test-data
+
+          echo "Isolated environment ready:"
+          echo "  venv: /tmp/e2e-venv"
+          echo "  projects dir: /tmp/e2e-test-projects"
+          echo "  data dir: /tmp/e2e-test-data"
+          echo "  port: 8084 (avoid conflict with production 8083)"
+
+      - name: Start test service
+        env:
+          SANGUO_PROJECTS_DIR: /tmp/e2e-test-projects
+          BLACKBOARD_ROOT: /tmp/e2e-test-data
+          PORT: "8084"
+        run: |
+          # 启动 FastAPI 服务在临时端口
+          /tmp/e2e-venv/bin/python -m uvicorn src.main:app --host 0.0.0.0 --port 8084 &
+          SERVER_PID=$!
+
+          # 等待服务就绪（最多 30 秒）
+          for i in $(seq 1 30); do
+            if curl -sf http://localhost:8084/api/health > /dev/null 2>&1; then
+              echo "Test service ready (PID: $SERVER_PID)"
+              break
+            fi
+            if [ $i -eq 30 ]; then
+              echo "ERROR: Test service failed to start within 30 seconds"
+              kill $SERVER_PID 2>/dev/null
+              exit 1
+            fi
+            sleep 1
+          done
+
+          echo "SERVER_PID=$SERVER_PID" >> $GITHUB_ENV
+
+      - name: Run E2E tests
+        env:
+          SANGUO_PROJECTS_DIR: /tmp/e2e-test-projects
+          BLACKBOARD_ROOT: /tmp/e2e-test-data
+          RUN_INTEGRATION: "1"
+          BASE_URL: "http://localhost:8084"
+        run: |
+          TEST_PATH="${{ gitea.event.inputs.test_filter }}"
+          if [ -z "$TEST_PATH" ]; then
+            TEST_PATH="tests/e2e/"
+          fi
+
+          /tmp/e2e-venv/bin/pytest "$TEST_PATH" -x -q \
+            --tb=short \
+            -p no:randomly
+
+      - name: Stop test service
+        if: always()
+        run: |
+          if [ -n "$SERVER_PID" ]; then
+            kill $SERVER_PID 2>/dev/null || true
+            echo "Test service stopped."
+          fi
+
+      - name: Cleanup
+        if: always()
+        run: |
+          rm -rf /tmp/e2e-venv
+          rm -rf /tmp/e2e-test-projects
+          rm -rf /tmp/e2e-test-data
+          echo "Isolated environment cleaned up."