refactor(root): move root artefacts to their canonical locations

.github/actions/code-hygiene-check/check.sh

@@ -26,7 +26,7 @@ fi
 # machine-readable templates, packaging recipes, and container templates are
 # not silently relabelled as application source.
 exclude_paths=(
-  ':(exclude).github/**' ':(exclude).githooks/**'
+  ':(exclude).github/**' ':(exclude).github/hooks/**'
   ':(exclude).machine_readable/**' ':(exclude)docs/**'
   ':(exclude)packaging/**' ':(exclude)container/**'
   ":(exclude)$allow_file"

.github/hooks/install.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Point this clone's git hooks at .github/hooks/ so the local Dogfood Gate runs
+# on push. Idempotent; safe to re-run.
+set -euo pipefail
+cd "$(git rev-parse --show-toplevel)"
+git config core.hooksPath .github/hooks
+chmod +x .github/hooks/pre-push .github/hooks/validate-a2ml.sh .github/hooks/validate-k9.sh 2>/dev/null || true
+echo "Installed: core.hooksPath -> .githooks (pre-push A2ML+K9 gate active)."

.githooks/pre-push → .github/hooks/pre-push

@@ -11,8 +11,8 @@
 # refreshed by the estate `refresh-githooks` sweep.
 #
 # Enable once per clone:
-#     git config core.hooksPath .githooks
-#   (or run: .githooks/install.sh)
+#     git config core.hooksPath .github/hooks
+#   (or run: .github/hooks/install.sh)
 #
 # Override for an emergency push:  git push --no-verify
 #

.github/workflows/dogfood-gate.yml

@@ -48,14 +48,14 @@ jobs:
       # That action repository does not exist — `gh api repos/...` returns 404
       # and the job failed at Set up job with "Unable to resolve action ...,
       # repository not found", so it never ran. Meanwhile the real
-      # implementation ships here as .githooks/validate-a2ml.sh and takes the
+      # implementation ships here as .github/hooks/validate-a2ml.sh and takes the
       # same INPUT_PATH / INPUT_STRICT interface the action was passed.
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
         env:
           INPUT_PATH: '.'
           INPUT_STRICT: 'false'
-        run: bash .githooks/validate-a2ml.sh
+        run: bash .github/hooks/validate-a2ml.sh
 
       - name: Write summary
         run: |
@@ -106,7 +106,7 @@ jobs:
         env:
           INPUT_PATH: '.'
           INPUT_STRICT: 'false'
-        run: bash .githooks/validate-k9.sh
+        run: bash .github/hooks/validate-k9.sh
 
       - name: Write summary
         run: |

.gitignore

@@ -117,7 +117,7 @@ dist/
 !/build/
 !/build/**
 
-# ...but never track Idris2 typecheck output. `idris2 --typecheck abi.ipkg`
+# ...but never track Idris2 typecheck output. `idris2 --typecheck src/interface/abi.ipkg`
 # writes compiled .ttc/.ttm under build/ttc/; these are generated artifacts.
 /build/ttc/
 

.machine_readable/root-allow.txt

@@ -25,15 +25,13 @@ LICENSE
 LICENSES/                  # REUSE licence texts (MPL-2.0.txt + CC-BY-SA-4.0.txt) for the dual-licence model (code MPL-2.0 / docs CC-BY-SA-4.0)
 CHANGELOG.md
 CHANGELOG.adoc            # Current changelog after the AsciiDoc migration.
-CONTRIBUTING.adoc         # Current contributor guide after the AsciiDoc migration.
 SECURITY.adoc             # Current security policy after the AsciiDoc migration.
 CITATION.cff               # citation metadata (surfaced at root by #96)
 RSR-PHILOSOPHY.adoc        # RSR philosophy statement (root authority file; was drift until 2026-07-07)
 
 # ─── Build entry points (must live at root for their tooling) ────────────────
 Justfile                   # delegates phases to build/just/*.just
 coordination.k9            # repo-local session binding (template-mandated)
-abi.ipkg                   # Idris2 package for the ABI seam; sourcedir=src/interface (estate canon: root-level *-abi.ipkg). Single case-consistent src/interface/Abi/ dir. Typecheck: `idris2 --typecheck abi.ipkg`.
 
 # ─── Conventional dotfiles (tool-required at root) ───────────────────────────
 .editorconfig
@@ -46,7 +44,7 @@ CLAUDE.md                  # AI session instructions, generated by the arrival-p
 sonar-project.properties   # SonarCloud analysis config; the SonarQube scan action reads it from the repo root
 
 # ─── Directories ─────────────────────────────────────────────────────────────
-.githooks/                 # git hooks (install.sh, pre-push, validate-a2ml.sh); tool-required at root — git's core.hooksPath resolves relative to the worktree root, exactly like .devcontainer/. Tracked since #141 (pre-push Dogfood Gate) but never allow-listed, so scripts/check-root-shape.sh failed on this repo itself and on every repo instantiated from it.
+.github/hooks/                 # git hooks (install.sh, pre-push, validate-a2ml.sh); tool-required at root — git's core.hooksPath resolves relative to the worktree root, exactly like .devcontainer/. Tracked since #141 (pre-push Dogfood Gate) but never allow-listed, so scripts/check-root-shape.sh failed on this repo itself and on every repo instantiated from it.
 .devcontainer/             # VS Code dev container spec; tool-required at root
 .git/
 .github/                   # CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/

.machine_readable/root-allow.txt.backup

@@ -45,7 +45,7 @@
 ?generated/
 ?geo/
 ?.gitattributes
-?.githooks/
+?.github/hooks/
 ?.github/
 ?.gitignore
 ?.gitlab-ci.yml

.machine_readable/rsr-profile.a2ml

@@ -28,12 +28,12 @@ declares-against = "2.0.0-draft"
 # Effective capability set (direct declaration; no preset shorthand used).
 capabilities = [
   "zig",                # src/interface/ffi/build.zig + Zig FFI layer
-  "idris2",             # abi.ipkg + src/interface/Abi/ (dependent-typed ABI)
+  "idris2",             # src/interface/abi.ipkg + src/interface/Abi/ (dependent-typed ABI)
   "bash",               # scripts/*.sh automation
   "cli",                # src/ command-line entry scaffolding
   "library",            # consumed/published as a library surface
   "ffi",                # C-ABI FFI seam (Zig), src/interface/ffi/
-  "abi",                # formally specified ABI: abi.ipkg + src/interface/Abi/ proofs
+  "abi",                # formally specified ABI: src/interface/abi.ipkg + src/interface/Abi/ proofs
   "formal-proofs",      # verification/proofs/ (in-tree mechanised proofs)
   "docs-site",          # .github/workflows/pages.yml (casket/Pages)
   "container",          # container/ + .devcontainer/Containerfile

AFFIRMATION.adoc

@@ -68,7 +68,7 @@ file. Bring a counter-example, a failing run, or a contradicting source.
 |===
 | Claim | Status | Evidence (command / `file:line`)
 | _e.g. The library builds clean_ | affirmed | `just build` at the anchor SHA
-| _e.g. The ABI seam typechecks_ | affirmed | `idris2 --typecheck abi.ipkg`
+| _e.g. The ABI seam typechecks_ | affirmed | `idris2 --typecheck src/interface/abi.ipkg`
 | _e.g. Feature X is complete_ | aspiration | README §… (not yet checked)
 |===
 

scripts/validate-template.sh

@@ -310,8 +310,8 @@ fi
 # path / import breakage that a bare per-file `idris2 --check` masks as a
 # tolerated "module name does not match file name" warning.
 if command -v idris2 &> /dev/null; then
-    if [ -f "$REPO_ROOT/abi.ipkg" ]; then
-        if (cd "$REPO_ROOT" && idris2 --typecheck abi.ipkg) > /dev/null 2>&1; then
+    if [ -f "$REPO_ROOT/src/interface/abi.ipkg" ]; then
+        if (cd "$REPO_ROOT" && idris2 --typecheck src/interface/abi.ipkg) > /dev/null 2>&1; then
             log_pass "Idris2 ABI typechecks (abi.ipkg)"
         else
             log_error "Idris2 ABI does NOT typecheck (abi.ipkg)"

abi.ipkg → src/interface/abi.ipkg

@@ -14,7 +14,7 @@
 -- A bare `idris2 --check src/interface/Abi/Foo.idr` still warns ("module name
 -- does not match file name") because Idris derives the expected module from the
 -- full path; that is expected. Use the package for a real typecheck:
---   idris2 --typecheck abi.ipkg      (or --build)
+--   idris2 --typecheck src/interface/abi.ipkg      (or --build)
 --
 -- The RSR validators accept either Abi/ (canonical, case-consistent) or a
 -- lowercase abi/ for downstream repos that ship lowercase — but never both.
@@ -27,7 +27,7 @@ authors = "Jonathan D.A. Jewell"
 
 brief = "Formally-typed ABI/FFI seam (Idris2 type + layout proofs) for an RSR-templated repository"
 
-sourcedir = "src/interface"
+sourcedir = "."
 
 depends = base