From 7ff856fa8d539084e3f0cb6726464f18ba17bca4 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 27 Jul 2026 20:03:42 +0100
Subject: [PATCH 1/2] fix: allow REUSE LICENSES/ dir in root-shape allowlist

check-root-shape.sh was rejecting the REUSE-mandated LICENSES/ directory
as root drift because .machine_readable/root-allow.txt never listed it.
Add the canonical entry (matching the already-fixed this-ssg reference).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .machine_readable/root-allow.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt
index 2436e1c..ebe5429 100644
--- a/.machine_readable/root-allow.txt
+++ b/.machine_readable/root-allow.txt
@@ -22,6 +22,7 @@ MAINTAINERS.adoc           # maintainer roster
 CONTRIBUTING.md            # REQUIRED AT ROOT by scorecard-enforcer/openssf-compliance/quality CI (test -f, no .github fallback). The fuller copy in .github/ is GitHub's auto-discovery convention; dedupe is an owner decision (would need those CI checks updated to accept .github/).
 SECURITY.md                # REQUIRED AT ROOT by scorecard-enforcer CI + the security-policy contractile (test -f SECURITY.md). See CONTRIBUTING.md note re: the .github/ copy.
 LICENSE
+LICENSES/                  # REUSE licence texts (MPL-2.0.txt + CC-BY-SA-4.0.txt) for the dual-licence model (code MPL-2.0 / docs CC-BY-SA-4.0)
 CHANGELOG.md
 
 # ─── Build entry points (must live at root for their tooling) ────────────────

From 04b0ebc55f8a995622d57bc784ac20439b16c5f4 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 27 Jul 2026 21:57:39 +0100
Subject: [PATCH 2/2] fix(root-shape): allowlist the 7 root entries that
 actually exist here

Measured the gate's actual output rather than guessing: 7 entries at root were
absent from the allowlist -- ARCHITECTURE.md, CODE_OF_CONDUCT.md, Containerfile,
GOVERNANCE.md, MAINTAINERS, mise.toml, flake.nix.

All are legitimate files, so they are allowlisted with justifications rather than
deleted. Two genuine inconsistencies are recorded as TODOs instead of being
silently blessed: the allowlist names GOVERNANCE.adoc / MAINTAINERS.adoc while
this repo carries GOVERNANCE.md / MAINTAINERS, and mise.toml duplicates the
estate-canonical .tool-versions.

flake.nix is marked TOLERATED, NOT BLESSED -- Nix retired 2026-06-01, but its
removal is a policy decision (backlog A), not a CI-unblocking one.

Verified locally: check-root-shape.sh exits 0 clean, exits 1 with a probe file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .machine_readable/root-allow.txt | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt
index ebe5429..85f0c4c 100644
--- a/.machine_readable/root-allow.txt
+++ b/.machine_readable/root-allow.txt
@@ -65,3 +65,24 @@ container/                 # may host Containerfile if not at build/
 .pre-commit-config.yaml    # TODO: relocate to ci/.pre-commit-config.yaml after invocation pattern decided
 affinescript/              # AffineScript source subtree consumed by this template
 tools/                     # TODO: consolidate with scripts/ or document the split (pending decision)
+
+# ─── Nix retirement (policy item, not a CI fix) ───────────────────────────────
+flake.nix                  # TOLERATED, NOT BLESSED. Nix was retired estate-wide on
+                           # 2026-06-01 (Guix primary + sealed-container escape hatch).
+                           # This entry stops the root-shape gate failing on a file whose
+                           # REMOVAL is a policy decision tracked in
+                           # dev-notes/GOVERNANCE-REMEDIATION-BACKLOG.md §A — not something
+                           # a CI-unblocking PR should decide. Do NOT mass-delete: campaign
+                           # #102 hand-diffed 277 candidates and removed exactly 1.
+
+# ─── Present in this repo, added after measuring actual root drift ────────────
+ARCHITECTURE.md            # design overview. TODO: converge to .adoc (AsciiDoc-by-default).
+CODE_OF_CONDUCT.md         # expected at root by OpenSSF tooling; the .github/ copy is
+                           # GitHub's auto-discovery convention, same split as CONTRIBUTING.md.
+GOVERNANCE.md              # this repo carries .md; the allowlist above names GOVERNANCE.adoc.
+                           # TODO: pick one and converge estate-wide.
+MAINTAINERS                # extensionless roster; allowlist above names MAINTAINERS.adoc. Same TODO.
+Containerfile              # sealed-container packaging tier (the policy-endorsed escape hatch
+                           # from Guix-primary). build/ and container/ are the other permitted homes.
+mise.toml                  # toolchain pin read by mise. Estate canon is .tool-versions —
+                           # TODO: decide which is authoritative, then drop the other.