diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..fe4a464
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,70 @@
+name: deploy-132
+
+# 只认 main（含 PR 合并入 main）。runner 在 128，应用部署到 132：
+# runner 检出 → rsync 仓库到 132 → 在 132 本地 docker compose up -d --build → 健康检查。
+# 在 132 构建、132 运行：不把 4 个大镜像塞去 128 构建（128 是基础设施机）。
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+env:
+  REMOTE_DIR: /opt/sundynix-agentix
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest   # 须匹配 128 上已注册 runner 的标签；不符请改成你的标签
+    steps:
+      - name: 检出代码
+        uses: actions/checkout@v4
+
+      - name: 安装 ssh / rsync 工具
+        run: |
+          if command -v apt-get >/dev/null; then
+            apt-get update && apt-get install -y sshpass openssh-client rsync
+          elif command -v apk >/dev/null; then
+            apk add --no-cache sshpass openssh-client rsync
+          fi
+
+      - name: rsync 仓库到 132
+        env:
+          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
+        run: |
+          H="${{ secrets.DEPLOY_HOST }}"
+          U="${{ secrets.DEPLOY_USER }}"
+          sshpass -e ssh -o StrictHostKeyChecking=no "$U@$H" "mkdir -p $REMOTE_DIR"
+          # 同步源码；排除本地产物与密钥（132 上的 .env 由你手工放置，绝不被覆盖/删除）。
+          sshpass -e rsync -az --delete \
+            --exclude '.git' \
+            --exclude 'node_modules' \
+            --exclude '**/node_modules' \
+            --exclude '**/dist' \
+            --exclude '.env' \
+            --exclude '**/.env' \
+            -e "ssh -o StrictHostKeyChecking=no" \
+            ./ "$U@$H:$REMOTE_DIR/"
+
+      - name: 132 本地构建并起服务
+        env:
+          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
+        run: |
+          H="${{ secrets.DEPLOY_HOST }}"
+          U="${{ secrets.DEPLOY_USER }}"
+          sshpass -e ssh -o StrictHostKeyChecking=no "$U@$H" "\
+            cd $REMOTE_DIR/deploy/132-app && \
+            docker compose up -d --build && \
+            docker image prune -f"
+
+      - name: 健康检查（gateway :3000/healthz）
+        env:
+          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
+        run: |
+          H="${{ secrets.DEPLOY_HOST }}"
+          U="${{ secrets.DEPLOY_USER }}"
+          sshpass -e ssh -o StrictHostKeyChecking=no "$U@$H" "\
+            for i in \$(seq 1 20); do \
+              curl -sf http://127.0.0.1:3000/healthz && echo ' ✅ 健康' && exit 0; \
+              sleep 3; \
+            done; \
+            echo '❌ 健康检查失败'; \
+            cd $REMOTE_DIR/deploy/132-app && docker compose logs --tail 50 gateway; exit 1"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0fa99e4..71d66ad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,8 @@ concurrency:
 jobs:
   go:
     name: Go · build + vet + test
+    # 本 CI 只在 GitHub 跑；Gitea(git.sundynix.cn)只跑 .gitea/workflows/deploy.yml，不误跑这套。
+    if: ${{ !contains(github.server_url, 'sundynix.cn') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -37,7 +39,7 @@ jobs:
   # 仅在 PR 跑：dev→main 的 PR 是唯一合入口，据 base 算 diff；push 到 main 不重复跑。
   lint:
     name: Go · golangci-lint (new issues)
-    if: github.event_name == 'pull_request'
+    if: ${{ github.event_name == 'pull_request' && !contains(github.server_url, 'sundynix.cn') }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -61,6 +63,7 @@ jobs:
   # 不拿它红门，只做可见性；gitleaks(密钥泄漏)在 PR 上扫 diff，硬拦提交密钥。
   security:
     name: Security · govulncheck + gitleaks
+    if: ${{ !contains(github.server_url, 'sundynix.cn') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -86,6 +89,7 @@ jobs:
 
   web:
     name: Frontend · tsc + vitest
+    if: ${{ !contains(github.server_url, 'sundynix.cn') }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -111,6 +115,7 @@ jobs:
   # go:embed frontend/dist 要求先出前端产物，故先 npm build。
   desktop:
     name: Desktop · go build + test (macOS)
+    if: ${{ !contains(github.server_url, 'sundynix.cn') }}
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
@@ -139,6 +144,7 @@ jobs:
 
   py:
     name: mcp-py · sandbox guard
+    if: ${{ !contains(github.server_url, 'sundynix.cn') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4