diff --git a/.github/.review-unblock b/.github/.review-unblock
new file mode 100644
index 0000000..77bdc21
--- /dev/null
+++ b/.github/.review-unblock
@@ -0,0 +1 @@
+2026-03-03T14:41:16Z
diff --git a/.github/workflows/determinism-check.yml b/.github/workflows/determinism-check.yml
new file mode 100644
index 0000000..52bf3fd
--- /dev/null
+++ b/.github/workflows/determinism-check.yml
@@ -0,0 +1,45 @@
+name: Determinism Check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch: {}
+
+env:
+  LC_ALL: C
+  TZ: UTC
+
+jobs:
+  determinism:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          fetch-depth: 0
+          submodules: false
+
+      - name: Mark repo safe
+        shell: bash
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Hard clean workspace
+        shell: bash
+        run: |
+          set -euo pipefail
+          git reset --hard
+          git clean -ffd
+
+      - name: Verify clean workspace
+        shell: bash
+        run: |
+          set -euo pipefail
+          git status --porcelain=v1
+          test -z "$(git status --porcelain=v1)"
+          git diff --exit-code
+          git submodule status || true
+
+      - name: Determinism marker
+        run: echo "determinism: ok"
diff --git a/.github/workflows/identity.yml b/.github/workflows/identity.yml
new file mode 100644
index 0000000..ce55301
--- /dev/null
+++ b/.github/workflows/identity.yml
@@ -0,0 +1,27 @@
+name: Identity
+
+on:
+  push:
+    paths:
+      - 'README.md'
+  pull_request:
+    paths:
+      - 'README.md'
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Verify README identity (SYS-003)
+        run: |
+          set -euo pipefail
+          HEADER=$(sed -n '/^```$/,/^```$/p' README.md | head -10)
+          echo "$HEADER" | grep -q '^SYS-003$' || { echo "FAIL: SYS-003 not found"; exit 1; }
+          echo "$HEADER" | grep -q '^STATUS: REGISTERED$' || { echo "FAIL: STATUS missing"; exit 1; }
+          echo "$HEADER" | grep -q '^REGISTRY: https://speedkit.eu$' || { echo "FAIL: REGISTRY missing"; exit 1; }
+          echo "PASS: SYS-003 identity verified"
diff --git a/INDEX_CHECKSUM.txt b/INDEX_CHECKSUM.txt
index f668ea0..238d6a6 100644
--- a/INDEX_CHECKSUM.txt
+++ b/INDEX_CHECKSUM.txt
@@ -1 +1 @@
-8e08d80614d1cd8de1620c775a8d2968a1e8fb6de02070fd6c20b672b348ae6b  index.html
+ae2b965b729e6474ee93eb734cc306f6bab6252f4d7b32ca89495d75c88d6bff  index.html