diff --git a/.github/justfile b/.github/justfile
new file mode 100644
index 0000000..4c1a862
--- /dev/null
+++ b/.github/justfile
@@ -0,0 +1,40 @@
+# CI job bodies: each workflow job runs exactly one `gha::` recipe, so
+# `just ci` is exactly CI and the workflow files carry no logic beyond
+# environment setup.
+
+set working-directory := '..'
+
+# Wrap one recipe in a GitHub Actions log group (plain passthrough
+# locally).
+[private]
+_step recipe:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ "${GITHUB_ACTIONS:-}" = "true" ]; then
+        echo "::group::just {{recipe}}"
+        status=0
+        just {{recipe}} || status=$?
+        echo "::endgroup::"
+        if [ $status -ne 0 ]; then
+            echo "::error title=just {{recipe}} failed::exit status $status"
+            exit $status
+        fi
+    else
+        just {{recipe}}
+    fi
+
+# The native job: formatting, clippy, host-crate tests, WIT validation.
+host-checks:
+    @just gha::_step fmt-check
+    @just gha::_step lint
+    @just gha::_step test
+    @just gha::_step wit-check
+
+# The full verification matrix (`just all`) plus the fixture pipeline's
+# JUnit demo artifacts (the #11 demo): the workflow's presentation steps
+# render them into the job summary. The deliberate trap is the point -
+# the summary shows a real failure row; the gate is the `all` step, and
+# the fixture is *supposed* to fail, so the emitter is not a verdict.
+verify:
+    @just gha::_step all
+    @just gha::_step emit-demo
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b14d16d..3ce0353 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
         run: ./scripts/setup.sh && echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Host checks
-        run: just host-checks
+        run: just gha::host-checks
 
   # The full verification matrix: component builds, all execution
   # paths (host-embed runner, composed wasi:cli runner under wasmtime,
@@ -71,15 +71,12 @@ jobs:
         run: ./scripts/setup.sh && echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Verification matrix
-        run: just all
-
-      # The #11 demo: the fixture pipeline's results, converted by
-      # `component-test emit junit`, rendered into the run's job summary
-      # by an off-the-shelf reporter. The fixture's deliberate trap
-      # appears as a real failure row; fail_on_failure stays off - the
-      # gate is `just all` above, and the fixture is *supposed* to fail.
-      - name: Emit JUnit (demo)
-        run: just emit-demo
+        # Includes the fixture pipeline's JUnit demo artifacts (the #11
+        # demo): the following steps render them into the job summary.
+        # The fixture's deliberate trap appears as a real failure row;
+        # fail_on_failure stays off - the gate is `just all` inside
+        # gha::verify, and the fixture is *supposed* to fail.
+        run: just gha::verify
 
       - name: Aggregate the demo results into the job summary
         # Dogfoods actions/aggregate (the #14 composite action): the
diff --git a/AGENTS.md b/AGENTS.md
index c6be514..6900603 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -104,7 +104,9 @@ Recipes live in the `justfile` (`just` lists them): `just test` (host
 crates), `just test-wasm` (integration tests that execute built
 components — `#[ignore]`d in plain `cargo test`), `just build`
 (components), `just all` (the full matrix below), `just lock-check` /
-`just lock-update`, `just wit-check`. The verify
+`just lock-update`, `just wit-check`, `just check` (the fast host gate:
+fmt, clippy, host tests, WIT), `just ci` (exactly what CI's gating jobs
+run, via the gha module). The verify
 recipes assert exit codes *and* diff runner/fold output byte-for-byte
 against `expected/` — when you intentionally change output or suite
 cases, regenerate the affected `expected/` files and review the diff.
diff --git a/justfile b/justfile
index 05d9b1f..97abd00 100644
--- a/justfile
+++ b/justfile
@@ -1,18 +1,30 @@
 # component-test task runner. `just` lists recipes; `just all` is the
-# full verification matrix from AGENTS.md.
+# full verification matrix from AGENTS.md. CI job bodies live in the gha
+# module (`.github/justfile`); `just ci` mirrors the gating CI jobs.
 
 wasm_target := "wasm32-wasip2"
 release_dir := "target" / wasm_target / "release"
 wasmtime_flags := "-W component-model-async -S p3"
 
-_default:
+# GitHub Actions plumbing: CI job entry points.
+mod gha '.github'
+
+# List the available recipes.
+default:
     @just --list --unsorted
 
+# The exact set of checks CI runs: each gating CI job runs exactly one
+# gha:: job recipe. The actions-setup-smoke job is excluded: it tests
+# the actions/setup composite action and only runs under Actions.
+ci: (gha::host-checks) (gha::verify)
+
 # Everything: host tests, component builds, all verification paths.
 all: build test test-wasm lock-check verify-embed verify-compose verify-deltic verify-pipeline verify-aggregate verify-viewer verify-imports verify-emit
 
-# CI's native job: formatting, clippy, host tests, WIT validation.
-host-checks: fmt-check lint test wit-check
+# The fast pre-commit checks: formatting, clippy, host tests, WIT
+# validation. The CI job of the same name runs the identical set
+# through gha::host-checks.
+check: fmt-check lint test wit-check
 
 fmt-check:
     cargo fmt --all --check