diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..d38f2a0
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,72 @@
+<!--
+Binding: microservice-app-docs/docs/Pull request and task tracking conventions.md
+Constitution principle 13 (Traceable Delivery) makes it non-negotiable.
+
+Every section below is required. Where one genuinely does not apply, write
+"N/A" and one clause saying why. Do not delete sections.
+
+Title: the same Conventional Commit string as the primary commit, e.g.
+  feat(us3): implement the auth-api operational contract
+
+Language: the TITLE is English (it becomes the squash-merge commit subject).
+The BODY is bilingual — write every section in English, then repeat it under a
+`## Español` heading. Same content, not a summary. See section 3.
+This applies to AI agents too: write both halves, do not leave one for someone
+else.
+-->
+
+## What changes
+
+<!-- The behavior difference, not a file list. GitHub already shows the files. -->
+
+## Why
+
+<!-- The problem this solves. For a defect: what breaks today, and what the
+     user or operator actually experiences when it does. -->
+
+## Tasks
+
+<!-- Task IDs advanced, qualified by repository and spec. One per line.
+     Example: gitops specs/009-full-platform-rollout T045
+
+     The tasks.md update ships in THIS pull request, not a follow-up.
+     Tick only against a located artifact — never from a summary, a green
+     check, or a rendered manifest. Annotate partial delivery instead of
+     ticking it.
+
+     If no register applies, say so here and say why. -->
+
+- [ ] The task register is updated in this pull request
+- [ ] Every task ticked here was verified by locating its artifact
+
+## How it is verified
+
+<!-- The exact commands run and their result. Quote the decisive output.
+     "Tests pass" is not verification.
+     For a guard whose job is to refuse: the mutation result.
+     For infrastructure: the plan summary, from the plan JSON. -->
+
+## Risk and rollback
+
+<!-- What could break, and how to undo it. For GitOps this is normally
+     "revert the commit" — say so rather than leaving it blank. -->
+
+## What this PR does not do
+
+<!-- Scope deliberately left out, so a reviewer does not look for it. -->
+
+---
+
+<!-- Reminders that are not optional:
+     - No self-approval. No `--admin` merge. No force-push to main.
+     - Never disable a branch protection rule to land your own work.
+     - An AI agent may open and update this PR. It may not approve it, and may
+       not author an acceptance artifact.
+     - Report faithfully: if CI is red, say what is red. If a step was skipped,
+       say it was skipped. -->
+
+---
+
+## Español
+
+<!-- Repite arriba, en español. Mismo contenido, no un resumen. -->
diff --git a/AGENTS.md b/AGENTS.md
index b617bb8..a8c3a75 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -27,6 +27,13 @@ It exposes Prometheus metrics, reports traces to Zipkin, and publishes create/de
 - Todo state is keyed by `req.user.username`; a new user receives three seeded items, and mutations are explicitly not concurrency-safe.
 - `/metrics` is registered before JWT middleware and is public; all `/todos` routes require a JWT bearer token.
 - The API has no update route, and only create/delete operations publish Redis messages containing the Zipkin trace ID.
+- Write pull-request bodies bilingually: every section in English, then repeated under a `## Español` heading with the same content, not a summary. Titles, commits, code comments, documentation, and specification text stay English-only. As an AI agent you write both halves yourself.
+- Open every pull request through `.github/pull_request_template.md` and follow `microservice-app-docs/docs/Pull request and task tracking conventions.md`: one concern per short-lived `<type>/<summary>` branch, a Conventional Commit title with a scope, and every template section filled. Constitution principle 13 makes this binding, not advisory.
+- Keep the Spec-Driven Development commit pair intact: `test(<scope>): specify ...` must be committed failing before `feat(<scope>): implement ...`. Never squash the pair; the failing-test commit is the evidence the cycle was followed.
+- Track every task. Name in the pull-request body the task IDs it advances, qualified by repository and spec, and update `tasks.md` in that same pull request rather than a follow-up. Mark a task `[X]` only after locating and inspecting its named artifact — never from a summary, a green check, a rendered manifest, or recollection. Annotate partial delivery instead of ticking it; work no register covers either gains a task or records in the PR body why none applies.
+- Reconcile, never quietly edit, when a register and reality disagree: a specification that pins a version nobody shipped is a maintainer decision, and `microservice-app-docs/full-platform/plan-reconciliation.md` is the worked example.
+- Never merge with `--admin`, force-push to `main`, disable a branch protection rule to land your own work, or approve your own pull request. As an AI agent you may open, describe, and update a pull request; you may never approve one and never author an acceptance or approval artifact — only a named human unlocks a gate.
+- Report outcomes faithfully in commits and pull-request bodies: name what is red, say what was skipped, and correct an earlier claim that turns out to be wrong rather than leaving the record wrong.
 
 ## Notes for the Kubernetes migration
 - The service listens on `TODO_API_PORT` (default `8082`) and serves `/metrics` on the same port.