diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b77c5b..18f30e3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,3 +128,47 @@ jobs:
           cache-dependency-glob: "uv.lock"
       - run: uv sync --locked --all-extras --group dev
       - run: uv run --frozen pytest -q --durations=25 -m "not od" tests/${{ matrix.suite }}
+
+  # Bitwise proof gate (scripts/check-proof.sh). The shards report a golden leaf root
+  # outside GOLDEN as an xfail; this gate fails it. Informational: GOLDEN holds no root
+  # from a Blacksmith runner yet, so a red gate fails neither ci nor the images publish
+  # that calls it.
+  check-proof:
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 15
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.12.17"
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+      - run: uv sync --locked --all-extras --group dev
+      # Golden leaf roots are per CPU class; record which CPU ran the gate.
+      - name: Runner CPU
+        shell: bash
+        run: |
+          set -euo pipefail
+          MODEL=$(lscpu | sed -n 's/^Model name: *//p' | head -n1)
+          VENDOR=$(lscpu | sed -n 's/^Vendor ID: *//p' | head -n1)
+          if lscpu | grep -E '^Flags:' | grep -qw avx512f; then AVX512F=yes; else AVX512F=no; fi
+          TORCH=$(uv run --frozen python -c "import torch;print(torch.__version__, torch.get_num_threads())")
+          LINE="cpu: ${MODEL} | vendor: ${VENDOR} | avx512f: ${AVX512F} | torch, threads: ${TORCH}"
+          echo "$LINE"
+          echo "check-proof $LINE" >> "$GITHUB_STEP_SUMMARY"
+      - name: Bitwise proof gate
+        shell: bash
+        run: |
+          set -euo pipefail
+          bash scripts/check-proof.sh 2>&1 | tee "$RUNNER_TEMP/check-proof.log"
+      - name: Upload check-proof output
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: check-proof-output
+          path: ${{ runner.temp }}/check-proof.log
+          if-no-files-found: warn