fix(rhodibot): stop demanding filenames the estate abandoned (#534)

The RSR required-file table predated the Markdown/TXT → AsciiDoc
migration
(#486, 2026-08), so rhodibot was demanding filenames the estate had
deliberately moved away from. Measured against 269 estate repositories:

| Demanded | Repos that have it | What they actually have |
|---|---|---|
| `LICENSE.txt` | **0/269** | `LICENSE` 269/269 |
| `CONTRIBUTING.md` | 25/269 | `CONTRIBUTING.adoc` 255 |
| `CODE_OF_CONDUCT.md` | 15/269 | `CODE_OF_CONDUCT.adoc` 240 |
| `SECURITY.md` | 35/269 | `SECURITY.adoc` 250 |
| lowercase `justfile` | 7/269 | `Justfile` 267 |
| `.machine_readable/STATE.scm` | 1/269 | `.a2ml` spelling 13 |

A bot whose stated job is "structural checks, directory layout" was
telling
essentially every repository to reintroduce the pre-migration filenames
—
i.e. to undo the AsciiDoc migration.

### What changed

Required files now name the current convention, with the superseded
spellings
accepted as **alternates**, so a completed rename is never reported as a
regression. `CheckDef` gains `alternates`, and `check_path_exists()`
tries the
canonical path first and only falls back, so the common case still costs
one
request.

Adds `RSR-016` (`www/.well-known/security.txt`, canonical since #53) and
`RSR-017` (legacy root `.well-known/`, remediation "move, do not
delete"). Both
advisory at minimal/standard while the stage-5 migration window is open.

Rule IDs `RSR-002`…`RSR-015` are unchanged and still resolve from the
old
spellings, so existing reports and `.rsr.toml` overrides keep working.

### Two defects found while in here, both fixed

1. **`is_fixable()` advertised four auto-fixes with no template behind
them.**
   It listed 7 files; `robot-repo-automaton` ships 3 templates, and
`get_template_content()` falls through to `String::new()` for anything
it
   does not recognise — so it would open PRs creating `.gitattributes`,
`.gitignore`, `.claude/CLAUDE.md` and `.machine_readable/bot_directives`
**empty**. `inbox-steward.yml` auto-merges PRs that pass CI. Narrowed to
the
   three that have templates.
2. **No `SECURITY.adoc` arm in `get_template_content()`**, so the
renamed check
would also have produced an empty file. Added, sharing `SECURITY.tmpl`.

### Tests

- rhodibot **50 passed / 0 failed** (was 45 passing / 3 failing). The 3
failures were the tests asserting the stale filenames — the stale
contract
written down in code — brought to the current canon. Two regression
tests
added: superseded spellings still pass, and the `www/` check is present
and
  honestly fails when absent.
- robot-repo-automaton **114 passed / 0 failed**.

### Caveat on deployment

**This PR does not by itself change what the deployed bot does.**
`deploy-bot-fleet.k9.ncl` sets `rhodibot.enabled = true` and points at
`.github/workflows/rhodibot.yml`, which does not exist in this repo —
the live
instance is most likely a service under `deploy/systemd/`. Someone with
host
access needs to confirm where it runs.

### Root cause, not addressed

`standards` has zero references to rhodibot; its rules are hardcoded in
Rust,
which is how they went seven months stale. The durable fix is to make
the
required-file table *data* with `standards` as the source of truth.
Worth doing
as a follow-up.

Co-authored-by: Rhodibot canon update <bot-canon@example.invalid>

Author: hyperpolymath

bots/rhodibot/src/fleet.rs

@@ -48,20 +48,23 @@ fn rule_id(check_name: &str) -> String {
     // Map known checks to stable rule IDs
     match check_name {
         "README.adoc" => format!("{}-001", RULE_PREFIX),
-        "LICENSE.txt" => format!("{}-002", RULE_PREFIX),
-        "SECURITY.md" => format!("{}-003", RULE_PREFIX),
-        "CONTRIBUTING.md" => format!("{}-004", RULE_PREFIX),
-        "CODE_OF_CONDUCT.md" => format!("{}-005", RULE_PREFIX),
+        "LICENSE.txt" | "LICENSE" => format!("{}-002", RULE_PREFIX),
+        "SECURITY.md" | "SECURITY.adoc" => format!("{}-003", RULE_PREFIX),
+        "CONTRIBUTING.md" | "CONTRIBUTING.adoc" => format!("{}-004", RULE_PREFIX),
+        "CODE_OF_CONDUCT.md" | "CODE_OF_CONDUCT.adoc" => format!("{}-005", RULE_PREFIX),
         ".claude/CLAUDE.md" => format!("{}-006", RULE_PREFIX),
-        ".machine_readable/STATE.scm" => format!("{}-007", RULE_PREFIX),
-        ".machine_readable/META.scm" => format!("{}-008", RULE_PREFIX),
-        ".machine_readable/ECOSYSTEM.scm" => format!("{}-009", RULE_PREFIX),
+        ".machine_readable/STATE.scm" | ".machine_readable/STATE.a2ml" => format!("{}-007", RULE_PREFIX),
+        ".machine_readable/META.scm" | ".machine_readable/META.a2ml" => format!("{}-008", RULE_PREFIX),
+        ".machine_readable/ECOSYSTEM.scm" | ".machine_readable/ECOSYSTEM.a2ml" => format!("{}-009", RULE_PREFIX),
         ".github/workflows" => format!("{}-010", RULE_PREFIX),
         ".editorconfig" => format!("{}-011", RULE_PREFIX),
         ".gitattributes" => format!("{}-012", RULE_PREFIX),
         ".gitignore" => format!("{}-013", RULE_PREFIX),
-        "justfile" => format!("{}-014", RULE_PREFIX),
+        "justfile" | "Justfile" => format!("{}-014", RULE_PREFIX),
         ".machine_readable/bot_directives" => format!("{}-015", RULE_PREFIX),
+        "0-AI-MANIFEST.a2ml" => format!("{}-016", RULE_PREFIX),
+        "www/.well-known/security.txt" => format!("{}-017", RULE_PREFIX),
+        ".machine_readable/root-allow.txt" => format!("{}-018", RULE_PREFIX),
         "no-.bot_directives" => format!("{}-LEGACY-001", RULE_PREFIX),
         "license-type" => format!("{}-LIC-001", RULE_PREFIX),
         name if name.starts_with("no-") => {
@@ -75,21 +78,27 @@ fn rule_id(check_name: &str) -> String {
 fn suggestion_for(check_name: &str) -> Option<String> {
     match check_name {
         "README.adoc" => Some("Create a README.adoc file with project documentation".to_string()),
-        "LICENSE.txt" => Some("Add a LICENSE.txt file with MPL-2.0".to_string()),
-        "SECURITY.md" => Some("Add a SECURITY.md with vulnerability reporting instructions".to_string()),
-        "CONTRIBUTING.md" => Some("Add a CONTRIBUTING.md with contribution guidelines".to_string()),
-        "CODE_OF_CONDUCT.md" => Some("Add a CODE_OF_CONDUCT.md (Contributor Covenant recommended)".to_string()),
+        "LICENSE.txt" | "LICENSE" => Some("Add a LICENSE file with MPL-2.0 (LICENSE is the current spelling)".to_string()),
+        "SECURITY.adoc" | "SECURITY.md" => Some("Add a SECURITY.adoc with vulnerability reporting instructions".to_string()),
+        "CONTRIBUTING.adoc" | "CONTRIBUTING.md" => Some("Add a CONTRIBUTING.adoc with contribution guidelines".to_string()),
+        "CODE_OF_CONDUCT.adoc" | "CODE_OF_CONDUCT.md" => Some("Add a CODE_OF_CONDUCT.adoc (Contributor Covenant recommended)".to_string()),
         ".claude/CLAUDE.md" => Some("Create .claude/CLAUDE.md with AI assistant instructions".to_string()),
-        ".machine_readable/STATE.scm" => Some("Add .machine_readable/STATE.scm with project state".to_string()),
-        ".machine_readable/META.scm" => Some("Add .machine_readable/META.scm with meta information".to_string()),
-        ".machine_readable/ECOSYSTEM.scm" => Some("Add .machine_readable/ECOSYSTEM.scm with ecosystem position".to_string()),
+        ".machine_readable/STATE.a2ml" | ".machine_readable/STATE.scm" => Some("Add .machine_readable/STATE.a2ml with project state".to_string()),
+        ".machine_readable/META.a2ml" | ".machine_readable/META.scm" => Some("Add .machine_readable/META.a2ml with meta information".to_string()),
+        ".machine_readable/ECOSYSTEM.a2ml" | ".machine_readable/ECOSYSTEM.scm" => Some("Add .machine_readable/ECOSYSTEM.a2ml with ecosystem position".to_string()),
         ".github/workflows" => Some("Add GitHub Actions workflows in .github/workflows/".to_string()),
         ".editorconfig" => Some("Add .editorconfig for consistent formatting".to_string()),
         ".gitattributes" => Some("Add .gitattributes for line ending and diff config".to_string()),
         ".gitignore" => Some("Add .gitignore for build artifacts".to_string()),
-        "justfile" => Some("Add a justfile as the primary build system".to_string()),
+        "Justfile" | "justfile" => Some("Add a Justfile as the primary build system".to_string()),
         ".machine_readable/bot_directives" => Some("Create .machine_readable/bot_directives/ for bot configs".to_string()),
         "no-.bot_directives" => Some("Migrate legacy .bot_directives/ to .machine_readable/bot_directives/".to_string()),
+        "0-AI-MANIFEST.a2ml" => Some("Add a 0-AI-MANIFEST.a2ml machine-readable manifest at the repository root".to_string()),
+        "www/.well-known/security.txt" => Some("Create www/.well-known/security.txt; run scripts/migrate-wellknown-to-www.sh to move an existing root .well-known/".to_string()),
+        ".machine_readable/root-allow.txt" => Some("Add .machine_readable/root-allow.txt declaring the permitted root entries".to_string()),
+        // Move, do not delete: the generic no- arm below would advise
+        // removing the file, which loses live security-contact metadata.
+        "no-.well-known/security.txt" => Some("Migrate the root .well-known/ to www/.well-known/ with scripts/migrate-wellknown-to-www.sh - move it, do not delete it".to_string()),
         "license-type" => Some("Set repository license to an approved type (MPL-2.0 recommended)".to_string()),
         name if name.starts_with("no-") => {
             let banned_file = name.strip_prefix("no-").unwrap_or(name);
@@ -106,10 +115,20 @@ fn suggestion_for(check_name: &str) -> Option<String> {
 /// fixable. Files without templates (CONTRIBUTING.md, CODE_OF_CONDUCT.md)
 /// would produce empty boilerplate and are excluded.
 fn is_fixable(check_name: &str) -> bool {
+    // Must match the arms of robot-repo-automaton's get_template_content()
+    // exactly. That function falls through to String::new() for anything it
+    // does not recognise, so advertising a check as fixable without a
+    // template behind it makes the automaton open a PR that creates the file
+    // EMPTY - and inbox-steward auto-merges PRs that pass CI.
+    //
+    // This list was previously four entries wider than the templates
+    // (.gitattributes, .gitignore, .claude/CLAUDE.md and
+    // .machine_readable/bot_directives), which is how an empty-file PR could
+    // reach a repository and be merged without anyone reading it.
     matches!(check_name,
-        "SECURITY.md" |
-        ".editorconfig" | ".gitattributes" | ".gitignore" |
-        ".claude/CLAUDE.md" | ".machine_readable/bot_directives"
+        "LICENSE" | "LICENSE.txt" |
+        "SECURITY.adoc" | "SECURITY.md" |
+        ".editorconfig"
     )
 }