diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d987ca8..c4590e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,3 +39,66 @@ jobs:
         run: |
           find . -name SKILL.md -not -path './.git/*' -print0 \
             | xargs -0 python3 .githooks/check-description-length.py
+
+  # construct-cli/ is the one real build surface in this repo — everything else
+  # is markdown. It went ungated until now, which is how a clippy break
+  # (items_after_test_module in src/sources/skillmd.rs) sat unnoticed on main:
+  # the lint job above never invokes cargo.
+  #
+  # Deliberately not path-filtered. A filtered job reports nothing at all when
+  # it is skipped, which makes it unusable as a required status check; the
+  # cache makes a markdown-only PR cheap enough that always running is the
+  # better trade.
+  cargo:
+    name: construct-cli — fmt + clippy + test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: construct-cli
+    steps:
+      - uses: actions/checkout@v4
+
+      # Stable, not the declared MSRV: clippy lints and rustfmt output drift
+      # between versions, so pinning the gate to the MSRV would freeze both. See
+      # the msrv job below for the compatibility check.
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: construct-cli
+
+      - name: Format
+        run: cargo fmt --check
+
+      # -D warnings matches construct-cli/CLAUDE.md; a warning is a failure.
+      - name: Clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Test
+        run: cargo test
+
+  # Separate from the gate above so an MSRV bump is a visible, deliberate
+  # change rather than something that silently rides along with a dependency
+  # update. Keep the version in step with `rust-version` in Cargo.toml.
+  msrv:
+    name: construct-cli — MSRV (1.88)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: construct-cli
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@1.88.0
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: construct-cli
+          key: msrv
+
+      # `check`, not `test`: dev-dependencies are not bound by the MSRV the
+      # crate advertises to consumers.
+      - name: Check against the declared MSRV
+        run: cargo check --all-features
diff --git a/construct-cli/AGENTS.md b/construct-cli/AGENTS.md
index 74464aa..112e2ed 100644
--- a/construct-cli/AGENTS.md
+++ b/construct-cli/AGENTS.md
@@ -17,6 +17,15 @@ cargo audit
 nix build .#construct && ./result/bin/construct --version
 ```
 
+`cargo fmt --check`, `cargo clippy --all-targets -- -D warnings`, and
+`cargo test` are gated in CI by the **`cargo`** job in
+`.github/workflows/ci.yml`, and a separate **`msrv`** job runs `cargo check`
+against the `rust-version` declared in `Cargo.toml` (1.88). The gate runs on
+stable, so a clippy or rustfmt change can turn a green PR red — fix the finding
+rather than pinning the toolchain. `cargo audit` is **not** in CI: a new
+advisory would redden `main` for a reason unrelated to the change under review,
+so run it locally before adding a dependency (Standard §3.3).
+
 ## Architecture
 
 - `main.rs` is thin: parse → build `Context` → `commands::dispatch` → render.
diff --git a/construct-cli/Cargo.toml b/construct-cli/Cargo.toml
index ffd11e8..c4aa1ff 100644
--- a/construct-cli/Cargo.toml
+++ b/construct-cli/Cargo.toml
@@ -4,7 +4,15 @@
 name = "construct"
 version = "0.1.0"
 edition = "2021"
-rust-version = "1.82"
+# The real floor, measured by CI's `msrv` job rather than asserted. It is set
+# by the locked dependency tree, not by this crate's own source: darling 0.23
+# and instability 0.3.12 (transitive, via ratatui) both require 1.88, and
+# indexmap 2.14 needs the `edition2024` Cargo feature from 1.85. The value that
+# stood here before (1.82) could not even parse the tree.
+#
+# Raise or lower this only alongside a green `msrv` run — cargo's resolver
+# reports the exact offending packages, so re-measure rather than guess.
+rust-version = "1.88"
 description = "Spacecraft Software Construct skills package manager (CLI + TUI)"
 homepage = "https://Construct.SpacecraftSoftware.org/"
 repository = "https://github.com/Spacecraft-Software/Construct"