diff --git a/.githooks/validate-a2ml.sh b/.github/hooks/validate-a2ml.sh
similarity index 100%
rename from .githooks/validate-a2ml.sh
rename to .github/hooks/validate-a2ml.sh
diff --git a/.githooks/validate-k9.sh b/.github/hooks/validate-k9.sh
similarity index 100%
rename from .githooks/validate-k9.sh
rename to .github/hooks/validate-k9.sh
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 658b83a..91f62fd 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -38,7 +38,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        run: bash .githooks/validate-a2ml.sh
+        run: bash .github/hooks/validate-a2ml.sh
       - name: Write summary
         run: |
           A2ML_COUNT="${{ steps.detect.outputs.count }}"
@@ -82,7 +82,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        run: bash .githooks/validate-k9.sh
+        run: bash .github/hooks/validate-k9.sh
       - name: Write summary
         run: |
           K9_COUNT="${{ steps.detect.outputs.k9_count }}"
diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt
index 7829965..6ad5204 100644
--- a/.machine_readable/root-allow.txt
+++ b/.machine_readable/root-allow.txt
@@ -20,8 +20,11 @@ EXPLAINME.adoc
 LICENSE
 LICENSES/                  # REUSE-convention license texts (MPL-2.0, CC-BY-SA-4.0)
 CHANGELOG.md
+CHANGELOG.adoc             # Current changelog after the AsciiDoc migration.
 CONTRIBUTING.md            # root path checked by openssf-compliance.yml; recreated by rhodibot
+CONTRIBUTING.adoc          # Current contributor guide after the AsciiDoc migration.
 SECURITY.md                # root path checked by openssf-compliance.yml; recreated by rhodibot
+SECURITY.adoc              # Current security policy after the AsciiDoc migration.
 
 # ─── Build entry points (must live at root for their tooling) ────────────────
 Justfile                   # delegates phases to build/just/*.just
@@ -38,6 +41,7 @@ coordination.k9            # repo-local session binding (template-mandated)
 .devcontainer/             # VS Code dev container spec; tool-required at root
 .git/
 .github/                   # CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/
+www/                       # site-operations bundle; canonical .well-known/ lives at www/.well-known/ (issue #53)
 .machine_readable/         # AI manifests, contractiles, custom-format configs
 .well-known/
 build/                     # contractile.just, setup.sh, flake.{guix,lock}, guix.scm, .guix-channel, Containerfile