diff --git a/AGENTS.md b/AGENTS.md
index 9ddb84b..75d42ff 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -78,6 +78,9 @@ The subject is the first line:
 
 ### Pull requests
 
+- Do not push to `main`. Start each OpenSpec change on a branch named for it
+  (`git switch -c <change-name>` when the change is created) and open a pull
+  request when it is archived.
 - Write the PR title as a Conventional Commit (`fix: retry tsping once`), not
   a `dir: verb` line. It becomes the squash-merge commit subject that
   release-please reads. GitHub appends `(#nnnn)` when it squash-merges; do not
diff --git a/CLAUDE.md b/CLAUDE.md
index 8e4428f..0075314 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -159,6 +159,15 @@
 - The OpenSpec CLI is pinned in `mise.toml` (`npm:@fission-ai/openspec`); run
   it as `mise exec -- openspec ...`. Project context and artifact rules live
   in `openspec/config.yaml`.
+- Every OpenSpec change gets its own branch, named for the change. When
+  `/opsx:new`, `/opsx:propose` or `/opsx:ff` creates a change, run
+  `git switch -c <change-name>` right after `openspec new change`, before
+  writing any artifact. Start from an up-to-date `main` (`git pull --rebase`
+  first). If the current branch is another change's unmerged branch, ask
+  whether to stack on it or branch from `main`. Apply, verify and archive
+  commit on that branch, and the work lands through a pull request, never a
+  direct push to `main`. This overrides the usual "stay on the current branch"
+  default, but only for a change that OpenSpec starts.
 - All 12 workflows are installed (`/opsx:propose`, `/opsx:apply`,
   `/opsx:verify`, `/opsx:archive`, ...). The workflow list is global OpenSpec
   config; after changing it, run `openspec update .` to regenerate `.claude/`.