From 7102fa18466ce7e3bcd8a3862d71ae7a78259e24 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 28 Jul 2026 19:17:17 +0100
Subject: [PATCH] fix(ci): allow .githooks/ in the placement guard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`.githooks` is missing from the guard's ALLOW list while `.github`, `.claude`,
`.machine_readable`, `.bot_directives`, `.well-known` and `.hypatia` are all
present. It is repo infrastructure, not database content, and has to sit at the
worktree root because that is where git resolves core.hooksPath.

This is now load-bearing rather than theoretical. #59 landed
.githooks/validate-a2ml.sh and .githooks/validate-k9.sh, and dogfood-gate.yml on
main runs both. They are tracked today, so the next PR that adds a file there is
flagged "Misplaced content" and fails the guard — which is exactly what happened
on the #59 branch.

Not a policy decision. rsr-template-repo's own root-allow.txt carries a comment
recording the identical omission for the identical directory: it "failed
scripts/check-root-shape.sh on this repo itself and on every repo instantiated
from it".

Verified the guard still discriminates rather than merely passing more:

    .githooks/validate-a2ml.sh   -> ALLOW
    docs/y.adoc                  -> ALLOW
    verisimdb/x.res              -> warn (grandfathered)
    lithoglyph/new.zig           -> ERROR   <- the #58 tightening still holds
    random/thing.rs              -> ERROR
---
 .github/workflows/placement-guard.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/placement-guard.yml b/.github/workflows/placement-guard.yml
index 31d5aff9..7c76283b 100644
--- a/.github/workflows/placement-guard.yml
+++ b/.github/workflows/placement-guard.yml
@@ -52,7 +52,19 @@ jobs:
 
           # Allowed coordination paths (regex, anchored at repo root).
           ALLOW='^(README|EXPLAINME|TOPOLOGY|ROADMAP|TOOLING-STATUS|REGISTRY|CONTRIBUTING|CODE_OF_CONDUCT|SECURITY|MAINTAINERS|NOTICE|LICENSE|PROOF-NEEDS|TEST-NEEDS|QUICKSTART-[A-Z]+|0-AI-MANIFEST|CLAUDE|AGENTS|llm-warmup-[a-z]+)\.[A-Za-z0-9]+$'
-          ALLOW="$ALLOW"'|^(docs|tests|scripts|\.github|\.claude|\.machine_readable|\.bot_directives|\.well-known|\.hypatia|LICENSES|contractiles)/'
+          # `.githooks` added 2026-07-27. It is repo infrastructure, not database
+          # content — git resolves core.hooksPath relative to the worktree root,
+          # so it must live there, exactly like .github/ and .claude/ which were
+          # already allowed.
+          #
+          # This became load-bearing when #59 landed .githooks/validate-a2ml.sh and
+          # validate-k9.sh: those files are tracked on main today, so the next PR
+          # touching either one is flagged "Misplaced content" and fails the guard.
+          #
+          # rsr-template-repo's own root-allow.txt records the identical omission for
+          # the identical directory — it "failed check-root-shape.sh on this repo
+          # itself and on every repo instantiated from it". An oversight, not a policy.
+          ALLOW="$ALLOW"'|^(docs|tests|scripts|\.github|\.githooks|\.claude|\.machine_readable|\.bot_directives|\.well-known|\.hypatia|LICENSES|contractiles)/'
           ALLOW="$ALLOW"'|^(flake\.nix|guix\.scm|Justfile|contractile\.just|stapeln\.toml|opsm\.toml|setup\.sh|\.gitignore|\.gitattributes|\.editorconfig|\.gitlab-ci\.yml|\.nojekyll)$'
 
           # Legacy per-database dirs (grandfathered: warn, do not fail — being extracted).