diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 09ebf71..ae3a5aa 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -341,3 +341,26 @@ jobs:
             apps/pwa/test-results/
             apps/pwa/playwright-report/
           retention-days: 14
+
+  gate:
+    runs-on: ubuntu-latest
+    needs: [fast-checks, changes, api, harness]
+    if: always()
+    steps:
+      - name: Check all required jobs passed or were skipped
+        run: |
+          # fast-checks always runs — must be success
+          if [ "${{ needs.fast-checks.result }}" != "success" ]; then
+            echo "fast-checks: ${{ needs.fast-checks.result }}"
+            exit 1
+          fi
+          # api and harness are conditionally skipped — success OR skipped are both acceptable
+          # NOTE: uses individual needs.X.result checks (not the wildcard aggregate) due to
+          # Gitea 1.26.2 bug #31007 where the wildcard expression returns false even when jobs succeed.
+          for result in "${{ needs.api.result }}" "${{ needs.harness.result }}"; do
+            if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
+              echo "Heavy job failed or was cancelled: $result"
+              exit 1
+            fi
+          done
+          echo "Gate passed."