- .githooks/pre-commit: rejects commits touching src/ without spec/ or DESIGN.md in the same commit. Fast local feedback. - .tangled/workflows/spec-check.yml: server-side enforcement of the same rule on push and PR. Cannot be bypassed. - .tangled/workflows/check.yml: full definition-of-done check (fmt, test, clippy both feature sets, bevy build, spec header hygiene) on push and PR. - AGENT.md: documents the mechanical enforcement layer. - tools/check.sh: notes the spec-touch check is handled by hook and pipeline. Defense: AGENT.md states 'no amendment, no functional change' — this makes it mechanically enforced rather than relying on agent discipline. The pre-commit hook is the fast-feedback layer; the Tangled pipeline is the unbypassable enforcement layer.