Three PR-scoped constraints are declared agent-enforced and never execute — harness-enforcer has no dispatch path

[russmiles]

Three constraints in HARNESS.md are declared **Enforcement**: agent with
**Scope**: pr, and none of them runs anywhere. There is no CI job, no hook and
no script that executes an agent-enforced constraint. The tier is declared and
inert.

The three

Constraint	Tool declared
PRs have adjudicated objections	harness-enforcer
PRs have adjudicated choice stories	harness-enforcer
Specs cite the source of a claimed convention	harness-enforcer

.github/workflows/harness.yml is the PR-constraint job, and its own header says
what it covers: "Runs PR-scoped deterministic constraints from
HARNESS.md." Every step in it is a deterministic tool — markdownlint, secret
scan, bash -n, ShellCheck, frontmatter check, sentinel integrity, decision-record
validation. grep -rn 'harness-enforcer' .github/workflows/ returns nothing.

So the job named Enforce PR constraints passes on every PR without having
evaluated any of the three.

Observed on PR #604

PR #604 carries a spec dated 2026-08-25 — after the 2026-04-27 cutoff in the
PRs have adjudicated choice stories rule — and no choice-story record at
docs/superpowers/stories/. All eleven checks passed, including Enforce PR
constraints.

The gap was found by reading the constraint, not by CI. That is the whole
finding: the rule's own text says it "requires an active exemption claim, not
silent elision through spec-first bypass", and silent elision is exactly what
the tooling permits, because nothing evaluates the rule.

Why this matters more than three missing checks

HARNESS.md's Status block counts these three among its enforced constraints.
A constraint that is declared, counted, and never executed is the defect class
the in-force decision record already names —
HDR-2026-08-25-four-mechanisms-report-the-reassuring-answer-when-they-cannot-determine-the-real-one:
a mechanism must not report a pass on the strength of a property weaker than the
one it names. "Enforce PR constraints — pass" names more than it checked.

It is also the same shape as the Template currency GC rule being deleted in
#601: declared deterministic, no tool behind it, absent from gc.yml. That one
is being removed because nothing backed it. These three are worth backing
rather than removing, because the behaviour they describe is wanted.

Two of the three may not need an agent at all

.github/workflows/consultation-disposition-check.yml already enforces a
structurally identical rule deterministically: every voice in a consultation
record must carry a disposition, and no two may share an outcome. It is the
working precedent.

• PRs have adjudicated objections — "no disposition: pending and no
  disposition_rationale: null in the matching objection record" is a schema
  check. The record's own frontmatter is machine-readable, and
  objection-taxonomy-check.yml already parses these files for categories and
  severities; it simply does not look at dispositions.
• PRs have adjudicated choice stories — same shape against
  docs/superpowers/stories/<slug>.md, plus "a record exists for each
  non-exempt spec".

Both rules carry a judgement clause — "'Resolved' is a judgment call on
rationale quality, not a schema check" — so a deterministic check cannot cover
them fully. But it can cover the falsifiable half (presence, no pending,
no null rationale) and that is the half that failed silently on #604. Whether the
judgement half is worth an agent, or is better left to human review, is the
design question.

Specs cite the source of a claimed convention is genuinely semantic and is
the one with a real case for an agent.

What the change has to decide

1. Deterministic-first or agent-first. Following the consultation precedent
   for the two disposition rules is cheap, fast and needs no model call. Doing so
   means their Enforcement field changes from agent to deterministic and
   the rule text acknowledges the judgement half is uncovered — which is more
   honest than today, where it claims full agent coverage and gets none.
2. Whether harness-enforcer gets a dispatch path at all, or whether the
   agent tier is retired for PR scope. Related: Give TDAD Layers 2 and 3 a dispatch path — 50 scenarios are written and never executed #583 makes the same argument for
   TDAD Layers 2 and 3 — "50 scenarios are written and never executed."
3. The 15 agent-enforced GC rules. Out of scope here (they run on a cadence,
   not per PR) but they share the tier, and whatever is decided about dispatch
   affects them. Named so the decision is made knowingly.
4. What the Status block should say while a constraint is declared but
   unexecuted. /harness-audit counts these three today.

Non-goals

• Removing the three constraints. The behaviour they describe is wanted; only
  the enforcement is missing.
• Rewriting harness.yml's deterministic steps.
• The GC-rule side of the agent tier.

Process

• Spec-first applies if this changes constraint enforcement levels or adds a
  dispatch path — a behaviour change, not exempt via chore/fix.
• Version bump: minor if HARNESS.md enforcement fields or workflows change
  under ai-literacy-superpowers/.
• Worth an /harness-assay first: "a constraint tier that is declared, counted
  and never executed" is exactly the shape the Assayer characterises, and it
  would give the spec evidence rather than an argument.

Related

• Spec: retire the template-currency nudge (#601) #604 — the PR where this surfaced
• The template-version marker tracks plugin releases, not template content: make it optional and treat its absence as opt-out #601 — deletes a GC rule with the same declared-but-unbacked defect
• Give TDAD Layers 2 and 3 a dispatch path — 50 scenarios are written and never executed #583 — TDAD Layers 2 and 3 written but never executed; same class

[russmiles]

Correction to this issue's central table — one of the three rows is wrong, and it was my error.

Surfaced by the 2026-08-25 assay (harness/assay/2026-08-25T23-46Z-assay.md, finding-3), and re-verified before posting.

This issue asserts that three constraints declare Enforcement: agent with Scope: pr and tabulates all three as declaring Tool: harness-enforcer. Two do. The third does not.

HARNESS.md:322 declares Specs cite the source of a claimed convention with:

- **Tool**: advocatus-diaboli (spec-mode gate)

git log -L '/### Specs cite the source of a claimed convention/,+16:HARNESS.md' shows that field has read advocatus-diaboli since the constraint was introduced at 2faf38c (#521). It was never harness-enforcer. And that path is not merely present — it was exercised three times in the phase that produced this issue, via the three /diaboli runs on PR #604.

So the accurate statement is:

Constraint	Tool	Dispatch path
PRs have adjudicated objections	harness-enforcer	none
PRs have adjudicated choice stories	harness-enforcer	none
Specs cite the source of a claimed convention	advocatus-diaboli (spec-mode gate)	human-typed /diaboli; no CI path

Two PR-scoped constraints name a tool with no dispatch path anywhere. A third names a tool with a human-typed path and no CI path. The headline — "none of them runs anywhere" — is false for a third of its subject.

Also worth correcting from the same assay: the agent tier is 4 constraints, not the 10 this issue's supporting text implies via the Status block. Parsing ## Constraints with HTML comments stripped gives 36 total — 26 deterministic, 6 unverified, 4 agent. The four are the three above plus Label PRs at creation time (manual scope, harness-enforcer). The "10" is a figure the Status block carries forward and that PR #607 already flagged as unverified.

Why this matters for the spec this issue feeds. The "What the change has to decide" section asks whether harness-enforcer should get a dispatch path at all. A spec starting from three inert rows would scope dispatch for a constraint that already has a gate — and would miss that the interesting question for the third row is narrower: whether a human-typed gate needs a CI path, which is a different question from whether an undispatched tool needs one.

The assay deliberately proposes no rule here. A constraint requiring issues to quote HARNESS.md fields verbatim would burden every issue to catch a class observed once, and would itself be a fourth PR-scoped agent rule with no dispatch path — the exact condition this issue exists to complain about.