diff --git a/src/autoskillit/core/types/_type_invariant_registry.py b/src/autoskillit/core/types/_type_invariant_registry.py
index 7c7ce8496..e3def0680 100644
--- a/src/autoskillit/core/types/_type_invariant_registry.py
+++ b/src/autoskillit/core/types/_type_invariant_registry.py
@@ -82,7 +82,7 @@ class InvariantDef:
         prohibition="Must not read recipe/skill/agent files directly in headless sessions",
         source_doc="SKILL.md",
         gate_target="guards/recipe_read_guard.py",
-        enforcement_layer="hook-deny",
+        enforcement_layer="server-side",
         backends=_BOTH,
     ),
     "write-path-prefix": InvariantDef(
@@ -90,7 +90,7 @@ class InvariantDef:
         prohibition="Writes outside allowed prefix are blocked in write-scoped sessions",
         source_doc="SKILL.md",
         gate_target="guards/write_guard.py",
-        enforcement_layer="hook-deny",
+        enforcement_layer="server-side",
         backends=_CLAUDE_ONLY,
     ),
     "skill-orchestration-from-L1": InvariantDef(
diff --git a/tests/core/test_invariant_registry.py b/tests/core/test_invariant_registry.py
index 977e0e254..dbe941b6a 100644
--- a/tests/core/test_invariant_registry.py
+++ b/tests/core/test_invariant_registry.py
@@ -100,6 +100,20 @@ def test_env_key_enforcement_layer() -> None:
     assert INVARIANT_REGISTRY["env-key-in-with-args"].enforcement_layer == "server-side"
 
 
+def test_recipe_read_enforcement_layer() -> None:
+    """recipe-read-headless must have enforcement_layer='server-side'."""
+    from autoskillit.core import INVARIANT_REGISTRY
+
+    assert INVARIANT_REGISTRY["recipe-read-headless"].enforcement_layer == "server-side"
+
+
+def test_write_path_prefix_enforcement_layer() -> None:
+    """write-path-prefix must have enforcement_layer='server-side'."""
+    from autoskillit.core import INVARIANT_REGISTRY
+
+    assert INVARIANT_REGISTRY["write-path-prefix"].enforcement_layer == "server-side"
+
+
 def test_all_gate_targets_are_nonempty() -> None:
     """Every gate_target must be a non-empty string."""
     from autoskillit.core import INVARIANT_REGISTRY