diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..aa048be
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,27 @@
+# Workflow rules for this project
+
+## Checkpoint on every addition (mandatory)
+
+Whenever any feature, fix, or change is added, prepare/update a checkpoint the user
+can refer to if something goes wrong. This is a standing requirement, not optional.
+
+The checkpoint lives in `CHECKPOINT-encryption.md` (repo root). Keep it accurate and
+current. It must contain:
+
+- A title with the current date.
+- Where things are: project path, the latest commit hash(es) and their messages, and a
+  clear note on whether the working tree is clean or what is still uncommitted.
+- What was completed, in plain terms (user-facing, not just code-detail).
+- The commit(s) added in this session (newest first).
+- Exact verification commands that were run and their green results (Rust + frontend).
+- How to resume / reproduce the feature (GUI and CLI commands).
+- Any outstanding or next-step items.
+
+Discipline:
+- Run the full verification suite before finishing a change: `cargo test`,
+  `cargo clippy --all-targets`, `cargo fmt --check`, `cargo build --release` and
+  `npm test`, `npm run typecheck`, `npm run lint`, `npm run format:check`,
+  `npm run electron:build`, `npm run build` (all in `frontend/` where applicable).
+- Commit the change first, then update the checkpoint to reference the new commit hash,
+  then commit the checkpoint update. Never leave the checkpoint stale.
+- The checkpoint must always reflect reality: if anything is uncommitted, say so.