docs: preserve canonical commit attribution

.github/pull_request_template.md

@@ -13,6 +13,12 @@
 - [ ] `cargo test --workspace` passes
 - [ ] Manual test: <!-- describe what you ran and what you observed -->
 
+## Commit attribution
+
+- [ ] I verified the name and email on every commit in this PR and corrected
+      any unintended identity before requesting merge. See
+      [commit attribution guidance](https://github.com/akitaonrails/ai-memory/blob/main/CONTRIBUTING.md#commit-attribution).
+
 ## CHANGELOG (merge gate)
 
 - [ ] I added a `CHANGELOG.md` `[Unreleased]` entry — **required** for any

.mailmap

@@ -0,0 +1,2 @@
+# Keep contributor identities canonical without rewriting published history.
+Lucas Oliveira <lucasouliveira@gmail.com> <lucasoliveira@apoioprodesp.sp.gov.br>

CONTRIBUTING.md

@@ -14,6 +14,31 @@ self-contained: SQLite is bundled via `rusqlite`'s `bundled` feature, and
 `libgit2` is vendored via `git2`'s `vendored-libgit2` feature. No system
 libraries need installing beyond a standard C toolchain.
 
+## Commit attribution
+
+GitHub associates commits with accounts through the author email stored in
+each commit. Before pushing a branch, inspect every commit that the pull request
+will add:
+
+```bash
+git log --format='%h %an <%ae>' "$(git merge-base HEAD origin/main)"..HEAD
+```
+
+Use an email verified by your GitHub account, or its GitHub-provided `noreply`
+address. Set it for this checkout when your global Git identity belongs to a
+different project or employer:
+
+```bash
+git config --local user.name "Your Name"
+git config --local user.email "your-verified-address@example.com"
+```
+
+Correct attribution mistakes on the pull-request branch before it is merged.
+The project does not rewrite shared `main` history or published release tags
+solely to change attribution because doing so invalidates commit hashes and
+breaks existing clones and forks. Maintainers use [`.mailmap`](.mailmap) to
+canonicalize accidental aliases without changing published commits.
+
 ## Required gates before every PR
 
 All four must pass — the CI workflow enforces them and so does the `bin/release`