diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..67d0190
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+- package-ecosystem: pip
+  directory: "/"
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 10
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: monthly
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..8a289bf
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,33 @@
+name: Package and configuration checks
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  package-config:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          version: "0.8.8"
+          python-version: "3.12"
+          enable-cache: false
+      - name: Validate Dependabot configuration
+        run: uvx --python 3.12 --from check-jsonschema==0.38.2 check-jsonschema --builtin-schema vendor.dependabot .github/dependabot.yml
+      - name: Build distributions without importing platform handlers
+        run: uv build --python 3.12
+      - name: Validate distribution metadata
+        run: uvx --python 3.12 --from twine==7.0.0 twine check dist/*
diff --git a/agent-notes/repair-task6-keyboard-handler.md b/agent-notes/repair-task6-keyboard-handler.md
new file mode 100644
index 0000000..962dde6
--- /dev/null
+++ b/agent-notes/repair-task6-keyboard-handler.md
@@ -0,0 +1,14 @@
+# Goal
+Resolve the assigned configuration PR #3 and prepare a separate same-org integration for fork PR #2, preserving all original tips and native behavior.
+
+# State
+Fresh master dd2efbd802ec66ad8481a13335d2baed71729e96. PR #3 published/local review tip 67c3a10155a83d9fe8a3c4eccb1dcf7fef724ed5 is separately archived under archive/task6-keyboard-handler-pr3-local and archive/task6-keyboard-handler-pr3-published; canonical tip has its own archive. Canonical untracked CLAUDE.md and kw.zip and original review worktrees are untouched. This isolated branch rebases only the historical seven-line Dependabot migration onto fresh master with --no-update-refs.
+
+# Decisions and why
+The PR changes update configuration, not keyboard runtime behavior. Its relevant safe gate validates the actual Dependabot schema, builds both distributions using setup.py/find_packages, and checks distribution metadata with Twine. No package/platform handler is imported, no keys are captured and no new behavioral tests are invented. One Python 3.12/Linux runner is gate coverage, not a support-policy declaration. Pinned current official actions use read-only permissions, no persisted credentials, timeout and superseded-run concurrency; an Actions-only maintenance entry is added to the original pip schedule. Existing release/support behavior is unchanged.
+
+# Surprises
+Fork PR #2 targets an old 0.52 setup.py while master is 0.53; merging its stale file wholesale would lose current metadata/native fixes. Its original external-author branch must never be pushed. That slice remains separate and serialized after this configuration prerequisite.
+
+# Next step
+actionlint 1.7.12 passed; offline zizmor 1.31.1 reported no findings (one default suppression). Return complete committed local diff/head for coordinator review before publication. No full local CI runs, model calls, settings changes, release or merge actions. Hosted schema/build/metadata execution remains pending publication.