From e96a00009c57c2238bfb4555c6a06fb4e3b73261 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 20:03:47 +0100 Subject: [PATCH 1/2] fix: allow REUSE LICENSES/ dir in root-shape allowlist check-root-shape.sh was rejecting the REUSE-mandated LICENSES/ directory as root drift because .machine_readable/root-allow.txt never listed it. Add the canonical entry (matching the already-fixed this-ssg reference). Co-Authored-By: Claude Opus 5 --- .machine_readable/root-allow.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt index 2436e1c..ebe5429 100644 --- a/.machine_readable/root-allow.txt +++ b/.machine_readable/root-allow.txt @@ -22,6 +22,7 @@ MAINTAINERS.adoc # maintainer roster CONTRIBUTING.md # REQUIRED AT ROOT by scorecard-enforcer/openssf-compliance/quality CI (test -f, no .github fallback). The fuller copy in .github/ is GitHub's auto-discovery convention; dedupe is an owner decision (would need those CI checks updated to accept .github/). SECURITY.md # REQUIRED AT ROOT by scorecard-enforcer CI + the security-policy contractile (test -f SECURITY.md). See CONTRIBUTING.md note re: the .github/ copy. LICENSE +LICENSES/ # REUSE licence texts (MPL-2.0.txt + CC-BY-SA-4.0.txt) for the dual-licence model (code MPL-2.0 / docs CC-BY-SA-4.0) CHANGELOG.md # ─── Build entry points (must live at root for their tooling) ──────────────── From e498807dff0fc9d4f36a1af72cc75a38f9d5deff Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 21:57:51 +0100 Subject: [PATCH 2/2] fix(root-shape): allowlist flake.nix pending the Nix-retirement decision Same fix as bitfuckit: the root-shape gate failed on flake.nix alone. Nix was retired estate-wide 2026-06-01, but removing the file is a policy decision (backlog A), not something a CI-unblocking PR should make. Allowlisted with an explicit TOLERATED-NOT-BLESSED comment so the decision is recorded, not made. Verified locally: check-root-shape.sh exits 0 clean, exits 1 with a probe file. Co-Authored-By: Claude Opus 5 --- .machine_readable/root-allow.txt | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt index ebe5429..c06a590 100644 --- a/.machine_readable/root-allow.txt +++ b/.machine_readable/root-allow.txt @@ -65,3 +65,12 @@ container/ # may host Containerfile if not at build/ .pre-commit-config.yaml # TODO: relocate to ci/.pre-commit-config.yaml after invocation pattern decided affinescript/ # AffineScript source subtree consumed by this template tools/ # TODO: consolidate with scripts/ or document the split (pending decision) + +# ─── Nix retirement (policy item, not a CI fix) ─────────────────────────────── +flake.nix # TOLERATED, NOT BLESSED. Nix was retired estate-wide on + # 2026-06-01 (Guix primary + sealed-container escape hatch). + # This entry stops the root-shape gate failing on a file whose + # REMOVAL is a policy decision tracked in + # dev-notes/GOVERNANCE-REMEDIATION-BACKLOG.md §A — not something + # a CI-unblocking PR should decide. Do NOT mass-delete: campaign + # #102 hand-diffed 277 candidates and removed exactly 1.