diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f669825..a39168c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,17 @@
 name: ci
 on: [push, pull_request]
 jobs:
+  lint:
+    # Hard rule (docs/MAINTAINABILITY.md): any finding fails the build.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with: { go-version: stable }
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: cd web && npm ci
+      - run: make lint
   test:
     strategy:
       matrix:
diff --git a/docs/milestones/README.md b/docs/milestones/README.md
index 4b8cadc..cc20d05 100644
--- a/docs/milestones/README.md
+++ b/docs/milestones/README.md
@@ -4,6 +4,7 @@ The build follows the six gated milestones in [`docs/spec/spec.md`](../spec/spec
 Each milestone has its own document here. It is written before any code for that milestone and
 its **Gate log** is filled in when the gate passes. A milestone is done only when:
 
+0. `make lint` is clean: maintainability is a hard rule ([`docs/MAINTAINABILITY.md`](../MAINTAINABILITY.md)), and every gate script runs lint first,
 1. every acceptance line it closes (from [`build-detail.md`](../spec/build-detail.md#acceptance-criteria)) has a test that passes,
 2. `make test` (`go test -race ./...`) and `make test-integration` pass,
 3. its gate command (`make gate-mN`) passes when run by the supervisor, and
@@ -31,6 +32,8 @@ Departures from the spec are recorded in [`docs/DEVIATIONS.md`](../DEVIATIONS.md
 
 ## Rules every WP follows (from "Decisions that don't move")
 
+- **Maintainability is a hard rule.** Follow [`docs/MAINTAINABILITY.md`](../MAINTAINABILITY.md): zero golangci-lint and ESLint findings in your packages, the function, complexity and file-size limits, and the layering rules. Every WP brief cites it.
+
 - One static binary, `CGO_ENABLED=0`. No raw SQL outside `internal/store`.
 - The 60 s poll path talks only to devices (SNMP, ICMP) and the local hot store.
 - Metric labels on SNMP series: `device=<slug>`, plus `iface=<ULID>` on interface series. Nothing else.