diff --git a/README.md b/README.md
index 3c1ed44..650fd69 100644
--- a/README.md
+++ b/README.md
@@ -55,6 +55,13 @@ pnpm run admin-login -- --url http://127.0.0.1:5999/#/auth/login
 
 如果本机 Node/npm/pnpm 版本不对，先执行 `nvm ls` 查看已安装版本，再用 `nvm use <version>` 切换到目标版本；不要先扫盘找 `node.exe` 路径。
 
+## Jenkins 入口模板
+
+- `ci/jenkins/KT-NapCatQQ-Upstream-Sync.Jenkinsfile` 是 NapCatQQ 上游审计入口，只调用 ktWorkflow 的 `napcat-upstream-audit`，保留人工审查边界。
+- `ci/jenkins/KT-NapCatQQ-Runtime-Release.Jenkinsfile` 是运行时发布入口，先调用 `napcat-runtime-release-readiness`，再通过显式参数触发运行时镜像构建和 API promotion。
+- 两个模板默认使用 NAS 工作区 `/vol1/docker/kt-codex/workspace/KT`，运行证据落在 `/vol1/docker/kt-codex/artifacts` 下。
+- 模板只保存入口和参数形状，不记录 Jenkins credential、Token、SSH key 或其他真实凭据。
+
 ## MCP 客户端配置
 
 把下面配置加入支持 stdio MCP 的客户端配置里：
diff --git a/ci/jenkins/KT-NapCatQQ-Runtime-Release.Jenkinsfile b/ci/jenkins/KT-NapCatQQ-Runtime-Release.Jenkinsfile
new file mode 100644
index 0000000..dc9f006
--- /dev/null
+++ b/ci/jenkins/KT-NapCatQQ-Runtime-Release.Jenkinsfile
@@ -0,0 +1,100 @@
+pipeline {
+  agent any
+
+  options {
+    skipDefaultCheckout(true)
+    timestamps()
+    timeout(time: 60, unit: 'MINUTES')
+  }
+
+  parameters {
+    string(name: 'NAPCAT_FORK_REF', defaultValue: 'codex/qr-refresh-login-state', description: 'Reviewed NapCatQQ fork branch, tag, or commit.')
+    string(name: 'UPSTREAM_RELEASE_TAG', defaultValue: '', description: 'Reviewed upstream release tag, when applicable.')
+    string(name: 'QQBOT_NAPCAT_IMAGE_OVERRIDE', defaultValue: '', description: 'Explicit runtime image tag to build or promote, for example kt-napcat-desktop-cn:desktop-cn-v9.')
+    string(name: 'QQBOT_NAPCAT_DESKTOP_PROFILE_VERSION_OVERRIDE', defaultValue: '', description: 'Explicit API desktop profile version override.')
+    booleanParam(name: 'BUILD_RUNTIME_IMAGE', defaultValue: false, description: 'When true, trigger the reviewed Jenkins runtime image build/publish job.')
+    string(name: 'RUNTIME_BUILD_JOB', defaultValue: 'KT-NapCatQQ/Runtime-Image-Build', description: 'Jenkins job that performs the reviewed Docker runtime build and publish.')
+    booleanParam(name: 'PROMOTE_API_RUNTIME', defaultValue: false, description: 'When true, trigger API promotion with explicit image/profile overrides.')
+    string(name: 'API_PROMOTION_JOB', defaultValue: 'KT-Template/KT-Template-API/main', description: 'API Jenkins job that accepts NapCat runtime override parameters.')
+  }
+
+  environment {
+    KT_WORKSPACE_ROOT = '/vol1/docker/kt-codex/workspace/KT'
+    KT_WORKFLOW_DIR = '/vol1/docker/kt-codex/workspace/KT/mcp/ktWorkflow'
+    KT_ARTIFACT_ROOT = '/vol1/docker/kt-codex/artifacts'
+  }
+
+  stages {
+    stage('ktWorkflow readiness') {
+      steps {
+        sh '''
+          set -e
+          pnpm --dir /vol1/docker/kt-codex/workspace/KT/mcp/ktWorkflow run napcat-runtime-release-readiness -- \
+            --artifact-root "$KT_ARTIFACT_ROOT/napcat-runtime-release" \
+            --fork-branch "$NAPCAT_FORK_REF" \
+            --upstream-release-tag "$UPSTREAM_RELEASE_TAG" \
+            --napcat-image-tag "$QQBOT_NAPCAT_IMAGE_OVERRIDE" \
+            --profile "$QQBOT_NAPCAT_DESKTOP_PROFILE_VERSION_OVERRIDE"
+        '''
+      }
+    }
+
+    stage('Runtime image build and publish') {
+      when {
+        expression { return params.BUILD_RUNTIME_IMAGE }
+      }
+      steps {
+        script {
+          requireRuntimeOverrides(
+            params.QQBOT_NAPCAT_IMAGE_OVERRIDE,
+            params.QQBOT_NAPCAT_DESKTOP_PROFILE_VERSION_OVERRIDE
+          )
+          build job: params.RUNTIME_BUILD_JOB,
+            wait: true,
+            parameters: [
+              string(name: 'NAPCAT_FORK_REF', value: params.NAPCAT_FORK_REF),
+              string(name: 'UPSTREAM_RELEASE_TAG', value: params.UPSTREAM_RELEASE_TAG),
+              string(name: 'QQBOT_NAPCAT_IMAGE_OVERRIDE', value: params.QQBOT_NAPCAT_IMAGE_OVERRIDE),
+              string(name: 'QQBOT_NAPCAT_DESKTOP_PROFILE_VERSION_OVERRIDE', value: params.QQBOT_NAPCAT_DESKTOP_PROFILE_VERSION_OVERRIDE),
+              string(name: 'KT_ARTIFACT_ROOT', value: "${env.KT_ARTIFACT_ROOT}/napcat-runtime-release")
+            ]
+        }
+      }
+    }
+
+    stage('API promotion') {
+      when {
+        expression { return params.PROMOTE_API_RUNTIME }
+      }
+      steps {
+        script {
+          requireRuntimeOverrides(
+            params.QQBOT_NAPCAT_IMAGE_OVERRIDE,
+            params.QQBOT_NAPCAT_DESKTOP_PROFILE_VERSION_OVERRIDE
+          )
+          build job: params.API_PROMOTION_JOB,
+            wait: true,
+            parameters: [
+              string(name: 'QQBOT_NAPCAT_IMAGE_OVERRIDE', value: params.QQBOT_NAPCAT_IMAGE_OVERRIDE),
+              string(name: 'QQBOT_NAPCAT_DESKTOP_PROFILE_VERSION_OVERRIDE', value: params.QQBOT_NAPCAT_DESKTOP_PROFILE_VERSION_OVERRIDE)
+            ]
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Stops runtime build or promotion unless both release override values are explicit.
+ * @param imageTag Reviewed NapCat runtime image tag supplied by the operator.
+ * @param profile Reviewed desktop profile version supplied by the operator.
+ * @return Nothing; aborts this pipeline through `error` when a required value is missing.
+ */
+void requireRuntimeOverrides(String imageTag, String profile) {
+  if (!imageTag?.trim()) {
+    error('QQBOT_NAPCAT_IMAGE_OVERRIDE is required before build or promotion.')
+  }
+  if (!profile?.trim()) {
+    error('QQBOT_NAPCAT_DESKTOP_PROFILE_VERSION_OVERRIDE is required before build or promotion.')
+  }
+}
diff --git a/ci/jenkins/KT-NapCatQQ-Upstream-Sync.Jenkinsfile b/ci/jenkins/KT-NapCatQQ-Upstream-Sync.Jenkinsfile
new file mode 100644
index 0000000..552dc04
--- /dev/null
+++ b/ci/jenkins/KT-NapCatQQ-Upstream-Sync.Jenkinsfile
@@ -0,0 +1,23 @@
+pipeline {
+  agent any
+
+  options {
+    skipDefaultCheckout(true)
+    timestamps()
+    timeout(time: 30, unit: 'MINUTES')
+  }
+
+  stages {
+    stage('ktWorkflow upstream audit') {
+      steps {
+        sh '''
+          set -e
+          pnpm --dir /vol1/docker/kt-codex/workspace/KT/mcp/ktWorkflow run napcat-upstream-audit -- \
+            --execute \
+            --use-codex \
+            --artifact-root /vol1/docker/kt-codex/artifacts/napcat-upstream-sync
+        '''
+      }
+    }
+  }
+}