diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 0805b9c..54edbee 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -14,10 +14,20 @@ Commands run:
 
 ```
 
+Checklist:
+
+- [ ] `pnpm install`
+- [ ] `pnpm lint`
+- [ ] `pnpm format`
+- [ ] `pnpm typecheck`
+- [ ] `pnpm test`
+- [ ] `pnpm build`
+
 ## Security Impact
 
 - [ ] No security-sensitive behavior changed.
 - [ ] This touches daemon, command execution, permissions, secret redaction, workflow validation, patch approval, or audit.
+- [ ] Security-sensitive behavior has focused tests or a written risk note.
 
 Notes:
 
@@ -32,3 +42,9 @@ Notes:
 
 - [ ] Docs updated.
 - [ ] Docs not needed.
+
+## Tests
+
+- [ ] Added or updated tests for behavior changes.
+- [ ] Existing tests cover the change.
+- [ ] Tests not needed because this is docs/config only.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..4ef9f19
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Verify
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Check formatting
+        run: pnpm format
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: pnpm build
diff --git a/docs/contributing.md b/docs/contributing.md
index 06156d1..d4dd16a 100644
--- a/docs/contributing.md
+++ b/docs/contributing.md
@@ -14,12 +14,38 @@ Read:
 ## Task Flow
 
 1. Pick an open `AD-*` issue from GitHub or `docs/development/task-backlog.md`.
-2. Create a focused branch.
+2. Create a focused branch using the task ID.
 3. Keep changes scoped to the selected task.
 4. Update the task checklist when the task is complete.
 5. Run the strongest available verification commands.
 6. Open a pull request that links the issue.
 
+## Branch Naming
+
+Use a short branch prefix that matches the work type, followed by the task ID and a concise slug:
+
+```text
+feat/ad-101-agent-schema
+fix/ad-402-runtime-events
+docs/ad-1001-basic-agent-workspace
+chore/ad-1002-contributor-workflow
+```
+
+Use `feat/` for product behavior, `fix/` for defects, `docs/` for documentation or examples, and `chore/` for repository workflow or maintenance changes.
+
+## Commit Style
+
+Use conventional, imperative commit messages:
+
+```text
+feat: add workflow canvas mvp
+fix: stabilize daemon event cleanup test
+docs: add basic agent workspace example
+chore: add contributor workflow
+```
+
+Keep each commit focused on one task. Include docs, tests, and task checklist updates in the same commit when they are part of the task completion.
+
 ## Verification Commands
 
 For the current scaffold:
@@ -43,6 +69,8 @@ Mention:
 - UI impact, with screenshots when relevant.
 - Documentation updates.
 
+Pull requests should pass the same quality gates locally and in CI: install, lint, format, typecheck, test, and build.
+
 ## Security-Sensitive Changes
 
 Changes involving daemon execution, runtime adapters, workflow patches, permission policy, audit logs, or secret redaction require extra scrutiny and tests.
diff --git a/docs/development/task-backlog.md b/docs/development/task-backlog.md
index 10fdc04..fe68047 100644
--- a/docs/development/task-backlog.md
+++ b/docs/development/task-backlog.md
@@ -575,10 +575,10 @@ Status markers:
 
 **Tasks:**
 
-- [ ] Document branch naming, commit style, and local verification commands.
-- [ ] Add PR checklist for tests, docs, and security-sensitive behavior.
-- [ ] Add CI steps for install, lint, typecheck, and test.
-- [ ] Commit with message `chore: add contributor workflow`.
+- [x] Document branch naming, commit style, and local verification commands.
+- [x] Add PR checklist for tests, docs, and security-sensitive behavior.
+- [x] Add CI steps for install, lint, typecheck, and test.
+- [x] Commit with message `chore: add contributor workflow`.
 
 **Acceptance Criteria:**