@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.4

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/.opencode/declared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under a declared top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/.workflows/declared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under a declared top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/AGENTS.md

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/CHANGELOG.md

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/CLAUDE-INVARIANTS.md

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/CLAUDE.md

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/INDEPENDENT-VERIFICATION.md

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/INVARIANTS.md

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/LICENSE

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/NOTICE

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/README.md

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/RELEASE.md

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/VERSION

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/backend/declared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under a declared top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/compliance/declared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under a declared top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/dev/declared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under a declared top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/docker/declared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under a declared top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/docs/declared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under a declared top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/frontend/declared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under a declared top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/infra/declared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under a declared top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/justfile

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/opencode.jsonc

@@ -0,0 +1 @@
+root-layout corpus: a declared top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/rule-tests/undeclared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under an UNDECLARED top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/rules/undeclared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under an UNDECLARED top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/unapproved-root/undeclared.txt

@@ -0,0 +1 @@
+root-layout corpus: content under an UNDECLARED top-level directory.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/fixtures/undeclared-root-file.txt

@@ -0,0 +1 @@
+root-layout corpus: an UNDECLARED top-level file.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_closed_set/test_check.py

@@ -0,0 +1,122 @@
+"""LAY-012 — the repository root is a closed set.
+
+Ported from `compliance_new/checks/layout/root-closed-set/test.sh`. ONE corpus,
+two sets: the gate recovers the root listing from the GIVEN SET, so the clean
+case is the same tree with the four undeclared entries left out of the list —
+exactly what a commit touching nothing undeclared looks like in production.
+The declared-but-missing arm reads DISK, so the corpus carries every entry the
+check declares; a corpus missing one of them would fail both cases for a
+reason unrelated to either.
+
+This check is not yet wired into `checks/__init__.py` (a later step wires this
+port's whole wave into the registry in one shot, to avoid concurrent edits to
+that shared file), so `runner.run` would report "no check implements LAY-012"
+before ever reaching this check's own logic — `lookup()` runs before scope
+narrowing. Every test below therefore calls `RootClosedSet` directly, the same
+`decide()`-around-`run()` shape `layout/markdown_trees/test_check.py` already
+uses to bypass row-scope narrowing; nothing here is a new pattern.
+"""
+
+from __future__ import annotations
+
+from helpers import corpus, corpus_files
+
+from adl_compliance.checks.layout.root_closed_set import RootClosedSet
+from adl_compliance.core.context import Context, FileSet
+from adl_compliance.core.finding import Advisory, Finding
+from adl_compliance.core.verdict import Outcome, Verdict, decide
+from adl_compliance.policy.registry import load
+
+CORPUS = corpus("layout", "root-closed-set")
+ROW = load().by_id("LAY-012")
+
+BROKEN_DIRS = ("rules/", "rule-tests/", "unapproved-root/")
+BROKEN_FILE = "undeclared-root-file.txt"
+
+
+def clean_set() -> tuple[str, ...]:
+    return tuple(
+        p for p in corpus_files(CORPUS)
+        if not p.startswith(BROKEN_DIRS) and p != BROKEN_FILE
+    )
+
+
+def verdict_for(given: tuple[str, ...]) -> Verdict:
+    ctx = Context(root=CORPUS, row=ROW)
+    reported = tuple(RootClosedSet().run(ctx, FileSet(paths=given)))
+    findings = tuple(r for r in reported if isinstance(r, Finding))
+    advisories = tuple(r for r in reported if isinstance(r, Advisory))
+    return decide(ROW, findings, 0, advisories)
+
+
+def test_the_premise_holds() -> None:
+    """Asserted, not assumed: a mistyped prefix would leave both sets
+    identical and every case below would agree for nothing."""
+    assert len(corpus_files(CORPUS)) == 42
+    assert len(clean_set()) == 38
+
+
+def test_the_closed_set_is_silent() -> None:
+    verdict = verdict_for(clean_set())
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+    assert verdict.findings == ()
+
+
+def test_the_undeclared_roots_are_reported() -> None:
+    verdict = verdict_for(corpus_files(CORPUS))
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+
+    # One assertion per entry: a single "it failed" would pass on any one of
+    # the four firing and hide the other three going quiet.
+    for entry in ("rules", "rule-tests", "unapproved-root"):
+        assert f"{entry}: undeclared top-level directory" in verdict.render(), verdict.render()
+    assert "undeclared-root-file.txt: undeclared top-level file" in verdict.render()
+
+
+def test_every_finding_is_tagged_lay_011() -> None:
+    """`check-root-layout.sh` hardcodes `RULE_ID=LAY-011`, not this row's own
+    LAY-012 — carried over as-is (see check.py's module docstring)."""
+    verdict = verdict_for(corpus_files(CORPUS))
+    assert verdict.findings
+    assert all(f.rule == "LAY-011" for f in verdict.findings), verdict.render()
+
+
+def test_declared_roots_stay_silent() -> None:
+    """Without this, the case above also passes against a gate that calls
+    every root entry undeclared."""
+    text = verdict_for(corpus_files(CORPUS)).render()
+    assert "compliance: undeclared" not in text
+
+
+def test_the_corpus_is_missing_nothing_declared() -> None:
+    """The corpus is required to carry every declared entry; a gap here would
+    mean the run graded the corpus rather than the case."""
+    assert "is missing" not in verdict_for(corpus_files(CORPUS)).render()
+
+
+def test_every_finding_resolves_inside_the_corpus() -> None:
+    """This checkout's own root is a superset of the corpus's. A check that
+    resolved a repository root instead of the root it was handed would name
+    entries from it.
+
+    Asserted by EXISTENCE, not by prefix: a corpus path and a checkout path
+    are the same shape, so only "does this resolve inside the corpus"
+    separates them.
+    """
+    for finding in verdict_for(corpus_files(CORPUS)).findings:
+        assert (CORPUS / finding.path).exists(), finding.render()
+
+
+def test_an_empty_set_grades_nothing_from_the_set() -> None:
+    """Every undeclared root is still on disk. A check that grades only what
+    it is handed must report none of them from the graded half."""
+    verdict = verdict_for(())
+    assert all("undeclared" not in f.message for f in verdict.findings), verdict.render()
+
+
+def test_the_structural_half_still_runs_on_an_empty_set() -> None:
+    """`structural` is not gated on the set: the declared names are probed on
+    disk, and the corpus carries every one of them, so an empty given set is
+    still a clean verdict."""
+    verdict = verdict_for(())
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/__init__.py

@@ -0,0 +1,12 @@
+"""The `layout.root-markdown-allowlist` gate.
+
+A folder rather than a module for the same reason as `layout.agents-layout`:
+this gate carries its own fixture corpus, and the corpus belongs beside the
+check that reads it.
+"""
+
+from __future__ import annotations
+
+from .check import RootMarkdownAllowlist
+
+__all__ = ["RootMarkdownAllowlist"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/check.py

@@ -0,0 +1,290 @@
+"""LAY-013 — README ban and tracked Markdown allowlist (I-40).
+
+Ported from `compliance_new/checks/layout/root-markdown-allowlist/check.sh`,
+which itself already carried its own header explaining the two mechanisms it
+had just shed (`git rev-parse --show-toplevel` and `git ls-files "*.md"
+"README.md"`) — both were answering the scope question a second time. Neither
+is reintroduced here: the given `FileSet` already reflects the row's
+`engine.scope`, applied once by the runner.
+
+Two rules, split across the two hooks exactly as the base class draws the
+line:
+
+  structural  the three bootstrap guides (`REQUIRED_AGENTS`) that must exist
+              on disk after the README rename. An absent file is in no file
+              set, so only a named-path probe can answer this.
+  graded      the nested-README ban and the root-Markdown allowlist, both
+              read from the given set.
+
+`allowed_markdown` is ported literal-for-literal from check.sh's Python
+heredoc, including branches that are reachable but redundant given an earlier
+branch (`AGENTS.md`/`CLAUDE.md` basename admits `.workflows/AGENTS.md` before
+its own explicit clause runs) — removing them would be a cleanup this port did
+not ask for, and every one of them is a `return True` that can only ever widen
+the allowlist to a superset of what preceded it, never narrow it.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from typing import ClassVar
+
+from ....core.check import Check
+from ....core.context import Context, FileSet
+from ....core.finding import Report
+from ....policy.root_shape import GOVERNANCE, GUIDES, REGISTERS
+
+
+class RootMarkdownAllowlist(Check):
+    id: ClassVar[str] = "LAY-013"
+    rule: ClassVar[str] = "LAY-013"
+
+    inputs: ClassVar[dict[str, str]] = {
+        "workflows_root": "<workflows>",
+        "plans_root": "<plans>",
+        "docs_root": "<docs>",
+        "rust_root": "<rust>",
+        "frontend_root": "<frontend>",
+    }
+    """FIXED 2026-09-16 (K-42 sweep, LOUD form, approved): every
+    `backend/...`/`frontend/...`/`.workflows/...`/`plans/...`/`.specs/...`/
+    `docs/...` entry below was a hardcoded literal, tested with `==`/
+    `startswith` inside `_allowed_markdown`. A repository whose corresponding
+    root is not the packaged default had a real, legitimately-allowed
+    Markdown file fail every one of those tests, and the gate reported it as
+    "outside the root allowlist" -- a visible, wrong finding about a file the
+    allowlist was written to admit, never a quiet pass. Every suffix below
+    stays literal: named documents and code-asset trees, not resolvable
+    paths."""
+
+    # A tree that EXISTS needs a guide. Previously these were three absolute
+    # requirements, which meant a repository without a `.specs/` tree was told
+    # to create a guide for a directory it had deliberately never made — and
+    # `.plans/` was named with a dot this layout no longer uses, so the guide
+    # that does exist at `plans/AGENTS.md` went unseen while a phantom one was
+    # demanded. The rule is about trees being documented, not about these exact
+    # paths being present.
+    GUIDED_TREES: ClassVar[tuple[str, ...]] = (".workflows", "plans", "specs", "docs")
+
+    # Trees whose Markdown this repository does not author: vendored provider
+    # documentation, and archives kept for reference. Renaming a README inside
+    # them would edit someone else's file, or rewrite history.
+    UNOWNED_ROOTS: ClassVar[tuple[str, ...]] = (
+        ".agents-archive/",
+        ".claude-plugin/",
+        ".donors/",
+        "node_modules/",
+        "scripts-archive/",
+        "workflows-archived/",
+    )
+    UNOWNED_SEGMENTS: ClassVar[tuple[str, ...]] = (
+        "/.terraform/",
+        "/node_modules/",
+        "/vendor/",
+    )
+
+    # A published package's README is its page on the registry. Renaming it to
+    # AGENTS.md does not move a guide — it removes the description every
+    # consumer of that package reads.
+    #
+    # A per-host plugin root is the same case: `.claude-plugin/<name>/README.md`
+    # is what the plugin marketplace shows, so it is a published description and
+    # not a tree guide. These roots did not exist when this list was written, and
+    # the migration that created them reintroduced exactly the false positive
+    # d841de1 had removed -- three of them, one per host.
+    PUBLISHED_PACKAGE_ROOTS: ClassVar[tuple[str, ...]] = (
+        "packages/",
+        ".claude-plugin/",
+        ".codex-plugin/",
+        ".cursor-plugin/",
+        ".kimi-plugin/",
+        ".opencode/",
+    )
+
+    # Ported from repo-hygiene/check-markdown-placement.py during the
+    # repo-hygiene -> .workflows dissolution (2026-08-04): explicit non-guide
+    # Markdown assets retained outside the published knowledge trees.
+    # Donor absorb triage: every commit of the 2026-08-12 donor fast-forward
+    # with an ABSORB / NOT USEFUL verdict. Tracked deliberately so the
+    # verdicts stay reviewable. Genuinely no resolvable tree prefix.
+    GOVERNANCE_FILES: ClassVar[frozenset[str]] = frozenset({".donors/MANIFEST.md"})
+    RUST_GOVERNANCE_SUFFIXES: ClassVar[frozenset[str]] = frozenset(
+        {"CHANGELOG.md", "crates/enact-session/src/backend/codex_init_prompt.md"}
+    )
+    FRONTEND_GOVERNANCE_SUFFIXES: ClassVar[frozenset[str]] = frozenset({"CHANGELOG.md"})
+    # repo-hygiene/CHANGELOG.md and repo-hygiene/LORE_COMMIT_IDS.md were
+    # deleted outright during the repo-hygiene -> .workflows dissolution — no
+    # successor entry.
+    WORKFLOWS_GOVERNANCE_SUFFIXES: ClassVar[frozenset[str]] = frozenset({"COVERAGE.md"})
+
+    # Genuinely no resolvable tree prefix -- "compliance" here is not
+    # `<compliance>` (that resolves to `compliance_py`); this is a distinct,
+    # literal historical path, unexamined by this fix.
+    RETAINED_MARKDOWN_FILES: ClassVar[frozenset[str]] = frozenset({"compliance/fixtures.md"})
+    # Three entries for now-parked trees stood here. Both trees are gone from
+    # the checkout and neither path is tracked, so the entries allowlisted
+    # nothing while keeping this file in violation of meta.parked-references.
+    WORKFLOWS_RETAINED_SUFFIXES: ClassVar[frozenset[str]] = frozenset(
+        {"config/exceptions/KNOWN-ISSUES.md"}
+    )
+    CODE_ASSET_ROOTS: ClassVar[tuple[str, ...]] = (
+        ".claude/skills/",
+        "agent/docs/",
+    )
+    RUST_CODE_ASSET_SUFFIXES: ClassVar[tuple[str, ...]] = (
+        "crates/enact-app/assets/builtin-assistants/rules/",
+        "crates/enact-app/assets/builtin-skills/",
+        "crates/enact-extension/tests/fixtures/builtin-skills-fixture/",
+    )
+    FRONTEND_CODE_ASSET_SUFFIXES: ClassVar[tuple[str, ...]] = (
+        ".claude/",
+        ".gemini/",
+        "examples/",
+    )
+    FRONTEND_LOCAL_DOC_SUFFIXES: ClassVar[tuple[str, ...]] = (
+        "packages/",
+        "scripts/",
+        "tests/e2e/",
+    )
+    FRONTEND_LOCAL_DOC_NAMES: ClassVar[frozenset[str]] = frozenset(
+        {"README.en.md", "MIGRATION.md"}
+    )
+
+    def structural(self, ctx: Context) -> Iterable[Report]:
+        # A deliberate filesystem probe, not a second discovery pass. These
+        # three files are asserted to EXIST; the question is not "is this
+        # file in the set" but "is the tree missing a required guide", which
+        # no file set can answer — the set never contains a path that was
+        # never created.
+        for tree in self.GUIDED_TREES:
+            if not ctx.path(tree).is_dir():
+                continue
+            guide = f"{tree}/AGENTS.md"
+            if not ctx.path(guide).is_file():
+                yield self.report(
+                    guide,
+                    "tree has no AGENTS.md guide",
+                    f"add {guide} describing what belongs in {tree}/",
+                )
+
+    def graded(self, ctx: Context, files: FileSet) -> Iterable[Report]:
+        def cls_unowned(path: str) -> bool:
+            return any(path.startswith(r) for r in self.UNOWNED_ROOTS) or any(
+                seg in path for seg in self.UNOWNED_SEGMENTS
+            )
+
+        # A path in the set that is not a file on disk is a DELETION, not a
+        # finding: a removed Markdown file cannot violate an allowlist. Same
+        # filter check.sh's `is_file()` applied to `ADL_CHANGED_FILES`.
+        for path in sorted(files.existing(ctx.root)):
+            # check.sh: `path.endswith("/README.md") or (path != "README.md"
+            # and path.endswith("README.md"))` — the first clause already
+            # implies the second whenever it holds, so the pair collapses to
+            # this one condition without changing which paths match.
+            if cls_unowned(path):
+                continue
+            if path.endswith("README.md") and path != "README.md":
+                if any(path.startswith(root) for root in self.PUBLISHED_PACKAGE_ROOTS):
+                    # A published package keeps its README; that file is its
+                    # registry page, not a misplaced guide.
+                    continue
+                yield self.report(
+                    path,
+                    "README.md is allowed only at repository root; use AGENTS.md elsewhere",
+                    f"rename {path} to AGENTS.md, or delete it if it is not meant to be a guide",
+                )
+                continue
+            if path.endswith(".md") and not self._allowed_markdown(ctx, path):
+                yield self.report(
+                    path,
+                    "tracked Markdown is outside the root allowlist",
+                    f"move {path} under an allowed tree (docs/, plans/, .specs/, "
+                    ".changeset/, etc.), or add an explicit exception in "
+                    "check.py if it is a legitimate case",
+                )
+
+    def _allowed_markdown(self, ctx: Context, path: str) -> bool:
+        if path == "README.md":
+            return True
+        # ADR-095 admits this one root-relative verification contract by
+        # literal name.
+        #
+        # `policy/root_shape.py` is THE list of what may sit at a repository's
+        # root — GUIDES (AGENTS.md/CLAUDE.md/INVARIANTS.md/…), GOVERNANCE
+        # (CONTRIBUTING.md/SECURITY.md/…) and REGISTERS (GAPS-AND-FINDINGS.md,
+        # OPEN-ITEMS.md, STATUS.md, DRIFT.md). This gate used to carry its own
+        # copy of that same set, hardcoded here, and the two had already
+        # drifted apart once (STATUS.md/DRIFT.md were on neither copy). Import
+        # rather than duplicate, exactly as `layout.markdown-trees` and
+        # `layout.placement` already do — one policy, not a fourth copy of it.
+        # (Tarun, 2026-09-27.)
+        if path in (GUIDES | GOVERNANCE | REGISTERS):
+            return True
+        # Ported from check-markdown-placement.py: any AGENTS.md/CLAUDE.md
+        # guide file is allowed regardless of folder — the AGENTS.md/CLAUDE.md
+        # hierarchy is governed separately by layout.agents-layout.
+        if path.rsplit("/", 1)[-1] in {"AGENTS.md", "CLAUDE.md"}:
+            return True
+        workflows_root = ctx.relative(ctx.inputs["workflows_root"])
+        if path == f"{workflows_root}/AGENTS.md":
+            return True
+        if path == "AGENTS.md":
+            return True
+        # The plans tree, in its current undotted shape. The `.plans/a_new`
+        # lifecycle directories it used to name are gone: state lives on the
+        # board and documents no longer move between folders.
+        plans_root = ctx.relative(ctx.inputs["plans_root"])
+        if path.startswith(f"{plans_root}/") and path.endswith(".md"):
+            return True
+        # Widening: a repository with no specs tree simply allows nothing on its
+        # account. Shrinking an allowlist can only add findings, never hide one.
+        specs_input = ctx.inputs.get("specs_root")
+        if specs_input is not None:
+            specs_root = ctx.relative(specs_input)
+            if path == f"{specs_root}/AGENTS.md" or (
+                path.startswith(f"{specs_root}/") and path.endswith(".md")
+            ):
+                return True
+        if path.startswith(".changeset/") and path.endswith(".md"):
+            return True
+        if path == ".donors/MANIFEST.md":
+            return True
+        docs_root = ctx.relative(ctx.inputs["docs_root"])
+        if path.startswith(f"{docs_root}/") and path.endswith(".md"):
+            return True
+        # Ported from check-markdown-placement.py: .docs/ is the Astro site
+        # shell (I-41) — its Markdown is a separate concern from docs/.
+        if path.startswith(".docs/") and path.endswith(".md"):
+            return True
+        # Ported enact-integration-specific exceptions (see class attributes
+        # above).
+        if path in self.GOVERNANCE_FILES or path in self.RETAINED_MARKDOWN_FILES:
+            return True
+        rust_root = ctx.relative(ctx.inputs["rust_root"])
+        frontend_root = ctx.relative(ctx.inputs["frontend_root"])
+        if path in {f"{rust_root}/{suffix}" for suffix in self.RUST_GOVERNANCE_SUFFIXES}:
+            return True
+        if path in {f"{frontend_root}/{suffix}" for suffix in self.FRONTEND_GOVERNANCE_SUFFIXES}:
+            return True
+        if path in {f"{workflows_root}/{suffix}" for suffix in self.WORKFLOWS_GOVERNANCE_SUFFIXES}:
+            return True
+        if path in {f"{workflows_root}/{suffix}" for suffix in self.WORKFLOWS_RETAINED_SUFFIXES}:
+            return True
+        if any(path.startswith(code_root) for code_root in self.CODE_ASSET_ROOTS):
+            return True
+        if any(
+            path.startswith(f"{rust_root}/{suffix}") for suffix in self.RUST_CODE_ASSET_SUFFIXES
+        ):
+            return True
+        if any(
+            path.startswith(f"{frontend_root}/{suffix}")
+            for suffix in self.FRONTEND_CODE_ASSET_SUFFIXES
+        ):
+            return True
+        name = path.rsplit("/", 1)[-1]
+        if name in self.FRONTEND_LOCAL_DOC_NAMES and any(
+            path.startswith(f"{frontend_root}/{suffix}")
+            for suffix in self.FRONTEND_LOCAL_DOC_SUFFIXES
+        ):
+            return True
+        return False

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/.changeset/some-change.md

@@ -0,0 +1,3 @@
+# change
+
+Under .changeset/, admitted by tree.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/.plans/AGENTS.md

@@ -0,0 +1,3 @@
+# .plans/AGENTS.md
+
+A guide file, admitted anywhere by basename.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/.specs/AGENTS.md

@@ -0,0 +1,3 @@
+# .specs/AGENTS.md
+
+A guide file, admitted anywhere by basename.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/.workflows/AGENTS.md

@@ -0,0 +1,3 @@
+# .workflows/AGENTS.md
+
+A guide file, admitted anywhere by basename.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/AGENTS.md

@@ -0,0 +1,3 @@
+# AGENTS.md
+
+Admitted by literal name in the gate root allowlist.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/CHANGELOG.md

@@ -0,0 +1,3 @@
+# CHANGELOG.md
+
+Admitted by literal name in the gate root allowlist.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/CLAUDE.md

@@ -0,0 +1,3 @@
+# CLAUDE.md
+
+Admitted by literal name in the gate root allowlist.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/INDEPENDENT-VERIFICATION.md

@@ -0,0 +1,3 @@
+# INDEPENDENT-VERIFICATION.md
+
+Admitted by literal name in the gate root allowlist.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/INVARIANTS.md

@@ -0,0 +1,3 @@
+# INVARIANTS.md
+
+Admitted by literal name in the gate root allowlist.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/README.md

@@ -0,0 +1,3 @@
+# README.md
+
+Admitted by literal name in the gate root allowlist.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/RELEASE.md

@@ -0,0 +1,3 @@
+# RELEASE.md
+
+Admitted by literal name in the gate root allowlist.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/STRAY.md

@@ -0,0 +1,3 @@
+# stray
+
+Root Markdown outside the allowlist.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/docs/AGENTS.md

@@ -0,0 +1,3 @@
+# docs/AGENTS.md
+
+A guide file, admitted anywhere by basename.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/docs/architecture/note.md

@@ -0,0 +1,3 @@
+# note
+
+Under docs/, admitted by tree.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-clean/frontend/README.md

@@ -0,0 +1,3 @@
+# frontend
+
+A nested README. Allowed only at the repository root.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-missing-guide/.workflows/AGENTS.md

@@ -0,0 +1 @@
+# .workflows/AGENTS.md

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-missing-guide/AGENTS.md

@@ -0,0 +1 @@
+# AGENTS.md

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-missing-guide/README.md

@@ -0,0 +1 @@
+# README.md

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-missing-guide/docs/overview.md

@@ -0,0 +1 @@
+# placeholder

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/root_markdown_allowlist/fixtures/root-markdown-missing-guide/plans/AGENTS.md

@@ -0,0 +1 @@
+# .plans/AGENTS.md