diff --git a/.gitea/workflows/node.yaml b/.gitea/workflows/node.yaml
new file mode 100644
index 0000000..2955abb
--- /dev/null
+++ b/.gitea/workflows/node.yaml
@@ -0,0 +1,85 @@
+# Shared Node.js CI: install the locked dependencies and run the repository's own gates, in order,
+# in the official node:<version>-bookworm image. Verify only; nothing is published.
+name: node
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        description: Node.js major (or exact) version; selects the node:<version>-bookworm image
+        type: string
+        default: '22'
+      runner:
+        type: string
+        default: container-build
+      install:
+        description: Dependency install command
+        type: string
+        default: npm ci
+      commands:
+        description: Shell commands, one per line, run in order; the first failure fails the build
+        type: string
+        required: true
+      uv:
+        description: Install a pinned, checksum-verified uv (for Python script checks)
+        type: boolean
+        default: false
+      working-directory:
+        description: Directory the install and commands run in
+        type: string
+        default: '.'
+
+permissions:
+  contents: read
+
+env:
+  UV_VERSION: 0.13.6
+  UV_SHA256: f29c3e94ffabd7e6f3ba521dba169a9b7ec12100bf3257087f0f24f6123f3645
+
+jobs:
+  node:
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
+    container:
+      image: node:${{ inputs.node-version }}-bookworm
+      volumes:
+        - /var/lib/gitea-job-workspace:${{ github.workspace }}
+    env:
+      HOME: /tmp
+      CI: 'true'
+    steps:
+      - uses: builtin:checkout
+
+      - name: Set up
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          echo "node $(node --version), npm $(npm --version)"
+
+      - name: Install uv
+        if: inputs.uv
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/tools && cd /tmp/tools
+          curl -fsSLo uv.tgz "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz"
+          echo "$UV_SHA256  uv.tgz" | sha256sum -c -
+          tar -xzf uv.tgz --strip-components=1 && rm uv.tgz
+          echo /tmp/tools >> "$GITHUB_PATH"
+
+      - name: Install dependencies
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+        env:
+          INSTALL: ${{ inputs.install }}
+        run: bash -exo pipefail -c "$INSTALL"
+
+      - name: Run commands
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+        env:
+          COMMANDS: ${{ inputs.commands }}
+        run: |
+          printf '%s\n' "$COMMANDS" > /tmp/commands.sh
+          bash -exo pipefail /tmp/commands.sh
diff --git a/MIGRATION.md b/MIGRATION.md
index c79f906..8ce77a6 100644
--- a/MIGRATION.md
+++ b/MIGRATION.md
@@ -19,19 +19,20 @@ Every repository that needs CI/CD on the new system, and its state. The old syst
 | KofTwentyTwo/investinginchester | container.yaml + GitOps | On Gitea image in prod (cluster-gitops #300); auto-deploy PR #12 needs `GITOPS_TOKEN` |
 | KofTwentyTwo/nuncio-website | container.yaml + GitOps | Merged; image builds; deploy needs `GITOPS_TOKEN` |
 | KofTwentyTwo/theimpactbuilding | container.yaml + GitOps | On develop; main PR #6 needs `GITOPS_TOKEN` first |
-| QRun-IO/qqq-all, qqq-business-platform, qqq-cli, qqq-print-protocol | maven.yaml / container.yaml | Being migrated |
+| QRun-IO/qqq-all, qqq-business-platform | maven.yaml / container.yaml | Being migrated |
+| QRun-IO/qqq-cli, qqq-print-protocol | node.yaml (verify) | Callers pin `@v1`; run once `v1` includes node.yaml. Release publishing not ported yet (owner decision) |
 
 ## To migrate (after the baseline is stable)
 
 | Repository | Type | Needs | Notes |
 |---|---|---|---|
-| QRun-IO/qqq-frontend-core | npm library | new npm workflow | published via qqq publisher |
+| QRun-IO/qqq-frontend-core | npm library | node.yaml + npm publish (not built yet) | published via qqq publisher |
 | QRun-IO/qqq-android | Android AAR | new Gradle/Android workflow | android-build runner label |
 | QRun-IO/scoop-bucket | Windows Scoop bucket | small scoop workflow | 4 old workflows removed |
 | QRun-IO/qqq-print-agent | Windows .NET client | native Windows workflow | needs Windows runner |
 | KofTwentyTwo/AppKit, MetalPOC, VisionPOC | macOS/native | native macOS workflow | macOS runner |
 | KofTwentyTwo/standards | docs/standards checks | small lint workflow | |
-| KofTwentyTwo/obsidian-penny | Obsidian plugin (Node) | node workflow | |
+| KofTwentyTwo/obsidian-penny | Obsidian plugin (Node) | node.yaml | |
 | KofTwentyTwo/Lukes-Rocket-Launcher | CMake/PlatformIO firmware | small build workflow | |
 | QRun-IO/ci-qualification | old CI qualification | probably retire | |
 | QRun-IO/Voyage | app image + deploy | container.yaml + GitOps | parked: app broken (replicas 0) |
diff --git a/README.md b/README.md
index d34631d..099a20b 100644
--- a/README.md
+++ b/README.md
@@ -40,6 +40,36 @@ Packages go to the owner's Gitea Maven registry,
 (or an optional `PACKAGES_TOKEN` secret). Builds resolve dependencies from the
 QRun-IO registry as well as Maven Central.
 
+## Node
+
+`.gitea/workflows/build.yaml`:
+
+```yaml
+name: build
+on:
+  push:
+jobs:
+  node:
+    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/node.yaml@v1
+    with:
+      node-version: '24'
+      commands: |
+        npm run lint
+        npm test
+```
+
+| Input | Default | Meaning |
+| --- | --- | --- |
+| `commands` | required | Shell commands, one per line, run in order; the first failure fails the build |
+| `node-version` | `'22'` | Selects the official `node:<version>-bookworm` image |
+| `install` | `npm ci` | Dependency install command |
+| `uv` | `false` | Install a pinned, sha256-verified `uv` for Python script checks |
+| `working-directory` | `.` | Where the install and commands run |
+| `runner` | `container-build` | Runner label |
+
+Verify only: it publishes nothing. npm, binary and release publishing are a
+separate, later workflow.
+
 ## Releasing
 
 | To publish | Do this |