diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
new file mode 100644
index 0000000..68d0a90
--- /dev/null
+++ b/.github/workflows/rust.yml
@@ -0,0 +1,53 @@
+name: Rust
+
+# Until now this repo had zero CI: the 25 tests covering the Only-Lang
+# parser, the signed governance chain, and the conductor's UDP-to-rule-
+# engine wiring only ran when someone remembered to run them locally. This
+# is what actually protects that work going forward.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo registry and build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Build (workspace)
+        run: cargo build --workspace --verbose
+
+      - name: Test (workspace)
+        run: cargo test --workspace --verbose
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+        continue-on-error: true # cargo fmt has never been run on this codebase (116 pre-existing
+        # diff hunks, all whitespace); fixing that is a separate, dedicated change, not something
+        # to smuggle into a CI PR. Report, don't block, until that happens.
+
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
+        # No continue-on-error: the 6 pre-existing warnings this would have caught (unused
+        # imports, a manual range-contains, a redundant single-component import) are fixed in
+        # this same PR, so this is a real gate, not a report-only check from day one.
diff --git a/pchi-schema/src/lib.rs b/pchi-schema/src/lib.rs
index 3576b01..771c4cc 100644
--- a/pchi-schema/src/lib.rs
+++ b/pchi-schema/src/lib.rs
@@ -11,8 +11,6 @@ pub use invariants::{PIRInvariants, EquilibriumCheck};
 pub use transform::Transform;
 
 use serde::{Deserialize, Serialize};
-use chrono::{DateTime, Utc};
-use thiserror::Error;
 use std::collections::HashMap;
 
 /// PCHI v2.0 message with PIR invariants
diff --git a/pchi-schema/src/validation.rs b/pchi-schema/src/validation.rs
index 9ade510..ca3cdb2 100644
--- a/pchi-schema/src/validation.rs
+++ b/pchi-schema/src/validation.rs
@@ -90,7 +90,7 @@ fn validate_timestamp(timestamp: f64) -> Result<(), ValidationError> {
     const MIN_TIMESTAMP: f64 = 946_684_800_000.0; // 2000-01-01
     const MAX_TIMESTAMP: f64 = 4_102_444_800_000.0; // 2100-01-01
     
-    if timestamp < MIN_TIMESTAMP || timestamp > MAX_TIMESTAMP {
+    if !(MIN_TIMESTAMP..=MAX_TIMESTAMP).contains(&timestamp) {
         return Err(ValidationError::InvalidTimestamp(
             format!("timestamp {} out of valid range", timestamp)
         ));
diff --git a/primeswarm-pchi/src/main.rs b/primeswarm-pchi/src/main.rs
index 15c6336..a7d7a46 100644
--- a/primeswarm-pchi/src/main.rs
+++ b/primeswarm-pchi/src/main.rs
@@ -2,7 +2,6 @@
 
 use primeswarm_pchi::{PCHIConductor, WebServerState, create_router};
 use pchi_schema::{PCHIMessage, MessageType, Payload, ControlParameterData};
-use tracing_subscriber;
 use std::sync::Arc;
 
 #[tokio::main]
diff --git a/primeswarm-pchi/src/transport.rs b/primeswarm-pchi/src/transport.rs
index daaf0ae..e700e52 100644
--- a/primeswarm-pchi/src/transport.rs
+++ b/primeswarm-pchi/src/transport.rs
@@ -3,7 +3,7 @@
 use crate::ConductorError;
 use tokio::net::UdpSocket;
 use tokio_tungstenite::tungstenite::protocol::Message;
-use futures_util::{SinkExt, StreamExt};
+use futures_util::SinkExt;
 use std::sync::Arc;
 use tokio::sync::Mutex;
 use tracing::info;
diff --git a/primeswarm-pchi/src/web_server.rs b/primeswarm-pchi/src/web_server.rs
index c6be4e2..87112e1 100644
--- a/primeswarm-pchi/src/web_server.rs
+++ b/primeswarm-pchi/src/web_server.rs
@@ -10,7 +10,7 @@ use axum::{
 };
 use std::sync::Arc;
 use tokio::sync::RwLock;
-use futures_util::{SinkExt, StreamExt};
+use futures_util::StreamExt;
 use serde_json::json;
 
 /// Web server state