diff --git a/.github/workflows/validate-data.yml b/.github/workflows/validate-data.yml
index 3727652..e8793f4 100644
--- a/.github/workflows/validate-data.yml
+++ b/.github/workflows/validate-data.yml
@@ -1,18 +1,22 @@
 name: Validate research data
 
 on:
-  push:
-    branches:
-      - main
   pull_request:
-  workflow_dispatch:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
   contents: read
 
+concurrency:
+  group: validate-data-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   validate:
-    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..284d4eb
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,11 @@
+# Research data delivery
+
+Publish changes through one ready PR to main after focused local validation.
+The PR runs `npm run validate`; wait for that complete result and merge only
+when it passes. Branch checkpoints and main merges do not repeat the validation.
+Batch fixes before updating a ready PR. Do not manually dispatch or blindly
+rerun a pending, passing or unchanged failed validation.
+
+Preserve data history, DOI records and integrity manifests. Workflow-only changes
+must not change published datasets. This public repository does not need a plan
+upgrade or paid runner. Preserve the account-wide US$10 Actions stop budget.