From f937ed1548b63ef63f56a8446d43261f927cae7c Mon Sep 17 00:00:00 2001
From: "J.D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 18 Sep 2026 16:17:14 +0000
Subject: [PATCH] chore(root): converge the root allowlist with the AsciiDoc
 migration and the www/ bundle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

scripts/check-root-shape.sh — run as a required step by estate-rules.yml — was
failing on this repository. Two distinct causes:

1. The estate-wide .well-known migration moved the site bundle to
   www/.well-known/, creating a tracked www/ directory at the root. The
   allowlist was not updated. Entry copied verbatim from rsr-template-repo,
   which allowlists www/ for exactly this reason (issue #53).

2. The allowlist names AsciiDoc files that the repository no longer (or never
   did) contain — CHANGELOG.md and friends — while the real .adoc files sit
   unlisted at the root. Added the entries naming the files that exist, using
   the wording the estate already uses for this (lithoglyph).

No files moved and no existing entry removed: only additions.
---
 .machine_readable/root-allow.txt | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt
index fb35678..d71da42 100644
--- a/.machine_readable/root-allow.txt
+++ b/.machine_readable/root-allow.txt
@@ -20,10 +20,13 @@ AFFIRMATION.adoc           # dated/signed honesty snapshot (README/EXPLAINME/AFF
 GOVERNANCE.adoc            # governance model (validator accepts root or docs/governance/)
 MAINTAINERS.adoc           # maintainer roster
 CONTRIBUTING.md            # REQUIRED AT ROOT by scorecard-enforcer/openssf-compliance/quality CI (test -f, no .github fallback). The fuller copy in .github/ is GitHub's auto-discovery convention; dedupe is an owner decision (would need those CI checks updated to accept .github/).
+CONTRIBUTING.adoc          # Current contributor guide after the AsciiDoc migration.
 SECURITY.md                # REQUIRED AT ROOT by scorecard-enforcer CI + the security-policy contractile (test -f SECURITY.md). See CONTRIBUTING.md note re: the .github/ copy.
+SECURITY.adoc              # Current security policy after the AsciiDoc migration.
 LICENSE
 LICENSES/                  # REUSE licence texts (MPL-2.0.txt + CC-BY-SA-4.0.txt) for the dual-licence model (code MPL-2.0 / docs CC-BY-SA-4.0)
 CHANGELOG.md
+CHANGELOG.adoc             # Current changelog after the AsciiDoc migration.
 
 # ─── Build entry points (must live at root for their tooling) ────────────────
 Justfile                   # delegates phases to build/just/*.just
@@ -41,6 +44,7 @@ abi.ipkg                   # Idris2 package for the ABI seam; sourcedir=src/inte
 .devcontainer/             # VS Code dev container spec; tool-required at root
 .git/
 .github/                   # CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/
+www/                       # site-operations bundle; canonical .well-known/ lives at www/.well-known/ (issue #53)
 .machine_readable/         # AI manifests, contractiles, custom-format configs
 .well-known/
 build/                     # contractile.just, setup.sh, flake.{guix,lock}, guix.scm, .guix-channel, Containerfile
@@ -78,6 +82,7 @@ flake.guix                  # TOLERATED, NOT BLESSED. Guix was retired estate-wi
 # ─── Present in this repo, added after measuring actual root drift ────────────
 ARCHITECTURE.md            # design overview. TODO: converge to .adoc (AsciiDoc-by-default).
 CODE_OF_CONDUCT.md         # expected at root by OpenSSF tooling; the .github/ copy is
+CODE_OF_CONDUCT.adoc       # Current code of conduct after the AsciiDoc migration.
                            # GitHub's auto-discovery convention, same split as CONTRIBUTING.md.
 GOVERNANCE.md              # this repo carries .md; the allowlist above names GOVERNANCE.adoc.
                            # TODO: pick one and converge estate-wide.