diff --git a/.githooks/validate-a2ml.sh b/.github/hooks/validate-a2ml.sh
similarity index 100%
rename from .githooks/validate-a2ml.sh
rename to .github/hooks/validate-a2ml.sh
diff --git a/.githooks/validate-k9.sh b/.github/hooks/validate-k9.sh
similarity index 100%
rename from .githooks/validate-k9.sh
rename to .github/hooks/validate-k9.sh
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 56664b2..c46ef3e 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -41,7 +41,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        run: bash .githooks/validate-a2ml.sh
+        run: bash .github/hooks/validate-a2ml.sh
       - name: Write summary
         run: |
           A2ML_COUNT="${{ steps.detect.outputs.count }}"
@@ -86,7 +86,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        run: bash .githooks/validate-k9.sh
+        run: bash .github/hooks/validate-k9.sh
       - name: Write summary
         run: |
           K9_COUNT="${{ steps.detect.outputs.k9_count }}"
diff --git a/.gitignore b/.gitignore
index cb3cb35..87e91e8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -120,6 +120,6 @@ dist/
 !/build/
 !/build/**
 
-# ...but never track Idris2 typecheck output. `idris2 --typecheck abi.ipkg`
+# ...but never track Idris2 typecheck output. `idris2 --typecheck src/interface/abi.ipkg`
 # writes compiled .ttc/.ttm under build/ttc/; these are generated artifacts.
 /build/ttc/
diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt
index ebe5429..efa0e0b 100644
--- a/.machine_readable/root-allow.txt
+++ b/.machine_readable/root-allow.txt
@@ -23,12 +23,11 @@ CONTRIBUTING.md            # REQUIRED AT ROOT by scorecard-enforcer/openssf-comp
 SECURITY.md                # REQUIRED AT ROOT by scorecard-enforcer CI + the security-policy contractile (test -f SECURITY.md). See CONTRIBUTING.md note re: the .github/ copy.
 LICENSE
 LICENSES/                  # REUSE licence texts (MPL-2.0.txt + CC-BY-SA-4.0.txt) for the dual-licence model (code MPL-2.0 / docs CC-BY-SA-4.0)
-CHANGELOG.md
+CHANGELOG.adoc             # AsciiDoc is the estate-standard documentation format
 
 # ─── Build entry points (must live at root for their tooling) ────────────────
 Justfile                   # delegates phases to build/just/*.just
 coordination.k9            # repo-local session binding (template-mandated)
-abi.ipkg                   # Idris2 package for the ABI seam; sourcedir=src/interface (estate canon: root-level *-abi.ipkg). Single case-consistent src/interface/Abi/ dir. Typecheck: `idris2 --typecheck abi.ipkg`.
 
 # ─── Conventional dotfiles (tool-required at root) ───────────────────────────
 .editorconfig
@@ -40,7 +39,8 @@ abi.ipkg                   # Idris2 package for the ABI seam; sourcedir=src/inte
 # ─── Directories ─────────────────────────────────────────────────────────────
 .devcontainer/             # VS Code dev container spec; tool-required at root
 .git/
-.github/                   # CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/
+.github/                   # CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/, hooks/
+www/                       # site-operations bundle; canonical .well-known/ lives at www/.well-known/ (issue #53)
 .machine_readable/         # AI manifests, contractiles, custom-format configs
 .well-known/
 build/                     # contractile.just, setup.sh, flake.{nix,lock}, guix.scm, .guix-channel, Containerfile
diff --git a/Justfile b/Justfile
index 0b6e976..e9cd529 100644
--- a/Justfile
+++ b/Justfile
@@ -83,14 +83,14 @@ import? "build/just/assess.just"
 # Build the project (debug mode)
 build *args:
     @echo "Building {{project}} (debug)..."
-    idris2 --build abi.ipkg
+    idris2 --build src/interface/abi.ipkg
     cd src/interface/ffi && zig build {{args}}
     @echo "Build complete"
 
 # Build in release mode with optimizations
 build-release *args:
     @echo "Building {{project}} (release)..."
-    idris2 --build abi.ipkg
+    idris2 --build src/interface/abi.ipkg
     cd src/interface/ffi && zig build -Doptimize=ReleaseFast {{args}}
     @echo "Release build complete"
 
@@ -123,20 +123,20 @@ clean-all: clean
 # Run all tests
 test *args:
     @echo "Running tests..."
-    idris2 --typecheck abi.ipkg
+    idris2 --typecheck src/interface/abi.ipkg
     cd src/interface/ffi && zig build test {{args}}
     @echo "Tests passed!"
 
 # Run tests with verbose output
 test-verbose:
     @echo "Running tests (verbose)..."
-    idris2 --typecheck abi.ipkg
+    idris2 --typecheck src/interface/abi.ipkg
     cd src/interface/ffi && zig build test --summary all
 
 # Smoke test — compiles without running the test suite
 test-smoke:
     @echo "Smoke test..."
-    idris2 --typecheck abi.ipkg
+    idris2 --typecheck src/interface/abi.ipkg
     cd src/interface/ffi && zig build
 
 # Run end-to-end tests (full pipeline: build → run → verify)
@@ -204,7 +204,7 @@ fmt-check:
 # build are where real warnings/errors from either toolchain surface.
 lint:
     @echo "Linting source files..."
-    idris2 --typecheck abi.ipkg
+    idris2 --typecheck src/interface/abi.ipkg
     cd src/interface/ffi && zig build
 
 # ═══════════════════════════════════════════════════════════════════════════════
diff --git a/docs/onboarding/QUICKSTART-DEV.adoc b/docs/onboarding/QUICKSTART-DEV.adoc
index f8952bd..5e75e77 100644
--- a/docs/onboarding/QUICKSTART-DEV.adoc
+++ b/docs/onboarding/QUICKSTART-DEV.adoc
@@ -40,7 +40,7 @@ just setup-dev
 
 [source,bash]
 ----
-idris2 --build abi.ipkg
+idris2 --build src/interface/abi.ipkg
 cd src/interface/ffi && zig build
 ----
 
@@ -48,7 +48,7 @@ cd src/interface/ffi && zig build
 
 [source,bash]
 ----
-idris2 --typecheck abi.ipkg
+idris2 --typecheck src/interface/abi.ipkg
 cd src/interface/ffi && zig build test --summary all
 ----
 
diff --git a/docs/onboarding/QUICKSTART-MAINTAINER.adoc b/docs/onboarding/QUICKSTART-MAINTAINER.adoc
index 244acef..5806313 100644
--- a/docs/onboarding/QUICKSTART-MAINTAINER.adoc
+++ b/docs/onboarding/QUICKSTART-MAINTAINER.adoc
@@ -14,7 +14,7 @@ the honest current state.
 
 == Build-Time Dependencies
 
-* Idris2 0.7.0+ (typed ABI seam, `abi.ipkg`)
+* Idris2 0.7.0+ (typed ABI seam, `src/interface/abi.ipkg`)
 * Zig 0.16+ (FFI implementation, `src/interface/ffi/`)
 * `just` (task runner)
 
diff --git a/docs/onboarding/QUICKSTART-USER.adoc b/docs/onboarding/QUICKSTART-USER.adoc
index 6218d79..bdcdda8 100644
--- a/docs/onboarding/QUICKSTART-USER.adoc
+++ b/docs/onboarding/QUICKSTART-USER.adoc
@@ -42,7 +42,7 @@ cd scaffoldia
 just build
 ----
 
-This builds the typed ABI (Idris2, `abi.ipkg`) and the FFI implementation
+This builds the typed ABI (Idris2, `src/interface/abi.ipkg`) and the FFI implementation
 (Zig, `src/interface/ffi/`) into a static library. There is no interactive
 application to run yet.
 
diff --git a/docs/status/TEST-NEEDS.adoc b/docs/status/TEST-NEEDS.adoc
index cd165c3..627a105 100644
--- a/docs/status/TEST-NEEDS.adoc
+++ b/docs/status/TEST-NEEDS.adoc
@@ -18,7 +18,7 @@ section instead describes the test infrastructure scaffoldia actually has.
 | *Source modules* | 6 | 3 Idris2 ABI (Foreign, Layout, Types), 2 Zig FFI (build.zig, main.zig), 1 Zig integration test module
 | *Unit tests* | 3 | Inline `test` blocks in `src/interface/ffi/src/main.zig` (lifecycle, error handling, version)
 | *Integration tests* | 10 | `src/interface/ffi/test/integration_test.zig` — real tests against the exported FFI (lifecycle, operations, strings, version, build_info, error handling)
-| *E2E tests* | 1 | `tests/e2e.sh` — real preflight + `idris2 --build abi.ipkg` + `zig build`/`zig build test`
+| *E2E tests* | 1 | `tests/e2e.sh` — real preflight + `idris2 --build src/interface/abi.ipkg` + `zig build`/`zig build test`
 | *Aspect tests* | 1 | `tests/aspect_tests.sh` — SPDX header coverage + dangerous-pattern grep (real, pre-existing, unchanged by the cure)
 | *Workflow tests* | 1 | `tests/workflows/validate_workflows_test.sh` (unchanged by the cure)
 | *Benchmarks* | 3 | `benches/template_bench.sh` — Zig build, Zig tests, workflow validation
@@ -29,7 +29,7 @@ section instead describes the test infrastructure scaffoldia actually has.
 * `zig fmt --check .` — exit 0
 * `cd src/interface/ffi && zig build` — exit 0
 * `cd src/interface/ffi && zig build test --summary all` — exit 0, **13/13 tests pass** (3 unit + 10 integration)
-* `idris2 --build abi.ipkg` — exit 0 (2 pre-existing shadowing warnings in `Abi.Layout`, unrelated to this cure, out of scope)
+* `idris2 --build src/interface/abi.ipkg` — exit 0 (2 pre-existing shadowing warnings in `Abi.Layout`, unrelated to this cure, out of scope)
 
 == What Changed From the Template State
 
diff --git a/abi.ipkg b/src/interface/abi.ipkg
similarity index 94%
rename from abi.ipkg
rename to src/interface/abi.ipkg
index 4b62c0b..14ec249 100644
--- a/abi.ipkg
+++ b/src/interface/abi.ipkg
@@ -14,7 +14,7 @@
 -- A bare `idris2 --check src/interface/Abi/Foo.idr` still warns ("module name
 -- does not match file name") because Idris derives the expected module from the
 -- full path; that is expected. Use the package for a real typecheck:
---   idris2 --typecheck abi.ipkg      (or --build)
+--   idris2 --typecheck src/interface/abi.ipkg      (or --build)
 --
 -- The RSR validators accept either Abi/ (canonical, case-consistent) or a
 -- lowercase abi/ for downstream repos that ship lowercase — but never both.
@@ -27,7 +27,7 @@ authors = "Jonathan D.A. Jewell"
 
 brief = "Formally-typed ABI/FFI seam (Idris2 type + layout proofs) for an RSR-templated repository"
 
-sourcedir = "src/interface"
+sourcedir = "."
 
 depends = base
 
diff --git a/tests/e2e.sh b/tests/e2e.sh
index df9073f..d2dfd63 100755
--- a/tests/e2e.sh
+++ b/tests/e2e.sh
@@ -84,16 +84,16 @@ green "  zig found: $(command -v zig)"
 echo ""
 
 # ─── Section 1: Idris2 ABI build ──────────────────────────────────────
-bold "Section 1: Idris2 ABI (abi.ipkg)"
+bold "Section 1: Idris2 ABI (src/interface/abi.ipkg)"
 
 cd "$PROJECT_DIR"
-if IDRIS_OUTPUT=$(idris2 --build abi.ipkg 2>&1); then
+if IDRIS_OUTPUT=$(idris2 --build src/interface/abi.ipkg 2>&1); then
     # A from-scratch build prints "N/M: Building ..." lines; an incremental
     # no-op rebuild prints nothing at all — both are success (exit 0).
-    green "  PASS: idris2 --build abi.ipkg"
+    green "  PASS: idris2 --build src/interface/abi.ipkg"
     PASS=$((PASS + 1))
 else
-    red "  FAIL: idris2 --build abi.ipkg"
+    red "  FAIL: idris2 --build src/interface/abi.ipkg"
     echo "$IDRIS_OUTPUT" | tail -20
     FAIL=$((FAIL + 1))
 fi