diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
new file mode 100644
index 0000000..8bd9fbc
--- /dev/null
+++ b/.github/workflows/commit-lint.yml
@@ -0,0 +1,27 @@
+---
+name: Commit Lint
+
+# Thin caller for the organization policy suite: Conventional Commit messages
+# and PR title (decisions/0003), banned bot/AI-agent Co-authored-by trailers
+# (AGENTS.md), branch-name shape (decisions/0019), and issue traceability on
+# the pull request (decisions/0022). Runs on `edited` too, so fixing a title
+# or adding the issue link re-evaluates without a push.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+    branches: [main]
+
+permissions:
+  contents: read
+
+# No concurrency block here: the called workflow declares its own group from
+# github.workflow and github.ref, which resolve to the caller's values, so a
+# second declaration at this level deadlocks against it.
+
+jobs:
+  policy:
+    name: Policy
+    permissions:
+      contents: read
+    uses: z-shell/.github/.github/workflows/commit-lint.yml@6ab97b23f3e6f38dd8721b06bfb628f58f30a06a # main
diff --git a/.pinact.yaml b/.pinact.yaml
new file mode 100644
index 0000000..4fa7e5a
--- /dev/null
+++ b/.pinact.yaml
@@ -0,0 +1,10 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json
+# pinact: https://github.com/suzuki-shunsuke/pinact
+version: 3
+ignore_actions:
+  # Organization reusable workflows are pinned to a full commit SHA of
+  # z-shell/.github with a `# main` branch comment (z-shell/.github PATTERNS.md).
+  # pinact requires a version-tag comment on SHA pins and cannot verify a branch
+  # name, so it rejects that shape. The SHA pin is still enforced here.
+  - name: z-shell/\.github/\.github/workflows/.*
+    ref: "[0-9a-f]{40}"