diff --git a/.agents/rules/workspace.md b/.agents/rules/workspace.md
new file mode 100644
index 0000000000..b819925f83
--- /dev/null
+++ b/.agents/rules/workspace.md
@@ -0,0 +1,18 @@
+---
+trigger: always_on
+---
+
+# Workspace Rules
+
+To avoid confusion from using outdated code states, when starting a new
+conversation/session or when first starting a new branch or worktree, unless
+explicitly instructed otherwise, ensure the latest upstream code is used as the
+basis:
+* Fetch `upstream/main` (`git fetch upstream main`).
+* Base any new branch or worktree upon `upstream/main` (e.g.,
+  `git checkout -b <branch> upstream/main`).
+* Run the workspace helper script to configure upstream tracking and safe
+  pushing:
+  ```bash
+  .agents/scripts/setup_triangle_branch.sh <branch>
+  ```
diff --git a/.agents/scripts/setup_triangle_branch.sh b/.agents/scripts/setup_triangle_branch.sh
new file mode 100755
index 0000000000..b6bdc2bb20
--- /dev/null
+++ b/.agents/scripts/setup_triangle_branch.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+# Helper script to set up upstream tracking for fork-and-PR workflow.
+set -e
+
+# Detect current branch if not provided as argument
+BRANCH_NAME="${1:-$(git symbolic-ref --short HEAD)}"
+
+if [ -z "$BRANCH_NAME" ]; then
+  echo "Error: Could not detect current branch name." >&2
+  exit 1
+fi
+
+echo "Setting up upstream tracking for branch: $BRANCH_NAME"
+
+# 1. Set the pull/fetch behavior to track the canonical repo's main branch
+git config --local "branch.${BRANCH_NAME}.remote" upstream
+git config --local "branch.${BRANCH_NAME}.merge" refs/heads/main
+
+# 2. Override the destination remote for pushing
+git config --local "branch.${BRANCH_NAME}.pushRemote" origin
+
+# 3. Defend against global push.default settings (ensure it pushes to current branch name)
+git config --local push.default current
+
+echo "Successfully configured upstream/main tracking and origin pushRemote for $BRANCH_NAME!"