chore: add root-allow.txt and sonar-project.properties

Author: hyperpolymath

.machine_readable/root-allow.txt

@@ -0,0 +1,71 @@
+# Canonical root allowlist for RSR-templated repositories.
+#
+# Lists every entry permitted at the repository root.
+# Anything tracked at root that is not in this list is drift and
+# must be moved into the appropriate subdirectory (or added here
+# with a justification comment).
+#
+# Used by: scripts/check-root-shape.sh
+# Authority: TEMPLATE-STANDARDS-AUDIT.adoc, "Proposed Final Directory Map"
+#
+# Format: one entry per line; '#' starts a comment; trailing '/' marks a directory.
+# Blank lines and comment-only lines are ignored.
+
+# ─── Authority files (template-mandated) ─────────────────────────────────────
+README.adoc
+AUDIT.adoc
+EXPLAINME.adoc
+AFFIRMATION.adoc           # dated/signed honesty snapshot (README/EXPLAINME/AFFIRMATION trio)
+0-AI-MANIFEST.a2ml         # thin pointer to .machine_readable/0.1-AI-MANIFEST.a2ml
+GOVERNANCE.adoc            # governance model (validator accepts root or docs/governance/)
+MAINTAINERS.adoc           # maintainer roster
+CONTRIBUTING.md            # Accepted at root OR .github/ — CI (openssf/quality/rhodibot) now checks both; .github/ is the canonical estate location (org-inherited). Allow-listed if present at root.
+SECURITY.md                # Accepted at root OR .github/ — see CONTRIBUTING.md note above; security-policy contractile now accepts the .github/ copy.
+LICENSE
+LICENSES/                  # REUSE licence texts (MPL-2.0.txt + CC-BY-SA-4.0.txt) for the dual-licence model (code MPL-2.0 / docs CC-BY-SA-4.0)
+CHANGELOG.md
+CITATION.cff               # citation metadata (surfaced at root by #96)
+
+# ─── Build entry points (must live at root for their tooling) ────────────────
+Justfile                   # delegates phases to build/just/*.just
+coordination.k9            # repo-local session binding (template-mandated)
+abi.ipkg                   # Idris2 package for the ABI seam; sourcedir=src/interface (estate canon: root-level *-abi.ipkg). Single case-consistent src/interface/Abi/ dir. Typecheck: `idris2 --typecheck abi.ipkg`.
+
+# ─── Conventional dotfiles (tool-required at root) ───────────────────────────
+.editorconfig
+.envrc
+.gitattributes
+.gitignore
+.tool-versions
+CLAUDE.md                  # AI session instructions, generated by the arrival-pack from .machine_readable/ a2ml and read by agents at repo root (do not hand-edit; edit the a2ml source)
+.hypatia-ignore            # repo-scoped Hypatia scanner exemptions; the scanner reads it from the repo root
+sonar-project.properties   # SonarCloud analysis config; the SonarQube scan action reads it from the repo root
+
+# ─── Directories ─────────────────────────────────────────────────────────────
+.devcontainer/             # VS Code dev container spec; tool-required at root
+.git/
+.github/                   # CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/
+.machine_readable/         # AI manifests, contractiles, custom-format configs
+.well-known/
+build/                     # contractile.just, setup.sh, guix.scm, .guix-channel, Containerfile
+ci/                        # .gitlab-ci.yml, .pre-commit-config.yaml (root shims if tools require)
+docs/                      # onboarding/, status/, governance/, ...
+docs-template/             # template-only: scaffolding docs copied into new repos
+machine-readable-design/   # template-only: design rationale for .machine_readable/ layout
+session/                   # dispatch.sh, custom-checks.k9, local-hooks.sh
+
+# Source / test / artifact trees (project-specific but conventional)
+src/
+tests/
+benches/
+examples/
+features/
+scripts/
+verification/
+container/                 # may host Containerfile if not at build/
+
+# ─── Tolerated pending follow-up (re-evaluate when item lands) ───────────────
+.gitlab-ci.yml             # TODO: relocate to ci/.gitlab-ci.yml after GitLab project-setting update
+.pre-commit-config.yaml    # TODO: relocate to ci/.pre-commit-config.yaml after invocation pattern decided
+affinescript/              # AffineScript source subtree consumed by this template
+tools/                     # TODO: consolidate with scripts/ or document the split (pending decision)

sonar-project.properties

@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: MPL-2.0
+# SonarQube Cloud (SonarCloud) configuration.
+# Project: https://sonarcloud.io/project/overview?id=hyperpolymath_rsr-template-repo
+# Requires the SONAR_TOKEN repository secret + a SonarCloud project (owner setup).
+sonar.organization=hyperpolymath
+sonar.projectKey=hyperpolymath_rsr-template-repo
+
+# Analysable surface = shell scripts + any JS/TS the template carries. Idris2,
+# Zig, Elixir and AffineScript have no SonarCloud analyser; vendored, generated,
+# build, proof, doc-template and dependency trees are excluded to keep findings
+# signal-rich (mirrors the boj-server arrangement).
+sonar.exclusions=build/**,container/**,generated/**,**/node_modules/**,**/_build/**,**/deps/**,**/.lake/**,verification/**,docs-template/**,machine-readable-design/**,**/*.idr,**/*.ipkg,**/*.zig
+sonar.coverage.exclusions=tests/**,**/*test*