diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml
new file mode 100644
index 0000000..85a5f2c
--- /dev/null
+++ b/.github/workflows/truecopy-gate.yml
@@ -0,0 +1,27 @@
+# Dogfood: this repo pins its own demo MCP manifest (demo/clean-mcp.json) in
+# truecopy.lock and gates it with the published truecopy-action. If the demo
+# manifest drifts — or a rule change re-classifies it — this fails until the
+# change is consciously re-pinned.
+name: truecopy gate
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+permissions: read-all
+
+jobs:
+  verify:
+    name: verify pinned skills
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 20
+      - name: truecopy verify
+        uses: askalf/truecopy-action@5c6fcf00edb83ff4846206392722292d45fee227 # v1.0.1
diff --git a/truecopy.lock b/truecopy.lock
new file mode 100644
index 0000000..074662c
--- /dev/null
+++ b/truecopy.lock
@@ -0,0 +1,22 @@
+{
+  "version": 1,
+  "skills": {
+    "filesystem": {
+      "source": "demo/clean-mcp.json",
+      "kind": "mcp",
+      "hash": "a881946cef3fb45d7c78d3297070a179f4c55ba65f00a576ada922c39f4e1f57",
+      "scannedAt": "2026-07-16T17:25:56.559Z",
+      "verdict": "clean",
+      "findings": 0,
+      "detection": {
+        "engine": "redstamp",
+        "version": "0.4.1"
+      },
+      "parts": {
+        "read_file": "cfe9acc21dbc05b0b8baa751e71fe524fd8fa15578d20610fc90b8d533bd8d8f",
+        "list_directory": "ac606087a4a47e23d801beb12699d87364430677f04b6709eacbaec062156227",
+        "(manifest)": "cac4676bf307456c45dfa470fa0b350b6b305b0d3cb86ffc3b68396625261b46"
+      }
+    }
+  }
+}