diff --git a/ROADMAP.md b/ROADMAP.md
new file mode 100644
index 0000000..73115d3
--- /dev/null
+++ b/ROADMAP.md
@@ -0,0 +1,17 @@
+# Roadmap
+
+This repository keeps its active roadmap content under:
+
+- `.planning/roadmap.md`
+- `.planning/roadmap/open/SECURITY_OPEN.md`
+- `.planning/roadmap/open/ROBUSTNESS_OPEN.md`
+- `.planning/roadmap/open/FUNCTIONALITY_OPEN.md`
+
+This file is a discoverability stub only.
+
+Rules:
+- Do not maintain a second active roadmap here.
+- Update the `.planning/` roadmap surface instead.
+- Archive snapshots remain under `.planning/roadmap/archive/`.
+
+If you are reading this in the local workspace, use `.planning/roadmap.md` as the source of truth.
diff --git a/scripts/precommit_block_sensitive_files.py b/scripts/precommit_block_sensitive_files.py
index e26df5b..892fa09 100644
--- a/scripts/precommit_block_sensitive_files.py
+++ b/scripts/precommit_block_sensitive_files.py
@@ -8,10 +8,6 @@ SENSITIVE_PATH_PREFIXES = (
     ".planning\\",
 )
 
-SENSITIVE_EXACT = {
-    "ROADMAP.md",
-}
-
 
 def _get_staged_paths() -> list[str]:
     res = subprocess.run(
@@ -28,17 +24,17 @@ def _get_staged_paths() -> list[str]:
     return [line.strip() for line in res.stdout.splitlines() if line.strip()]
 
 
-def main() -> int:
-    staged = _get_staged_paths()
+def _get_blocked_paths(staged: list[str]) -> list[str]:
     blocked: list[str] = []
-
     for path in staged:
-        if path in SENSITIVE_EXACT:
-            blocked.append(path)
-            continue
         if path.startswith(SENSITIVE_PATH_PREFIXES):
             blocked.append(path)
-            continue
+    return blocked
+
+
+def main() -> int:
+    staged = _get_staged_paths()
+    blocked = _get_blocked_paths(staged)
 
     if not blocked:
         return 0
@@ -51,7 +47,7 @@ def main() -> int:
             *[f"  - {p}" for p in blocked],
             "",
             "Fix:",
-            "  git restore --staged ROADMAP.md .planning",
+            "  git restore --staged .planning",
             "",
             "If you intentionally need an internal-only commit, use a separate private remote/repo.",
         ]
diff --git a/tests/test_precommit_block_sensitive_files.py b/tests/test_precommit_block_sensitive_files.py
new file mode 100644
index 0000000..d93488b
--- /dev/null
+++ b/tests/test_precommit_block_sensitive_files.py
@@ -0,0 +1,32 @@
+import unittest
+
+import scripts.precommit_block_sensitive_files as mod
+
+
+class PrecommitBlockSensitiveFilesTests(unittest.TestCase):
+    def test_planning_paths_are_blocked(self):
+        staged = [
+            ".planning/roadmap.md",
+            ".planning/roadmap/open/ROBUSTNESS_OPEN.md",
+            "tests/TEST_SOP.md",
+        ]
+
+        self.assertEqual(
+            mod._get_blocked_paths(staged),
+            [
+                ".planning/roadmap.md",
+                ".planning/roadmap/open/ROBUSTNESS_OPEN.md",
+            ],
+        )
+
+    def test_root_roadmap_stub_is_allowed(self):
+        staged = [
+            "ROADMAP.md",
+            "README.md",
+        ]
+
+        self.assertEqual(mod._get_blocked_paths(staged), [])
+
+
+if __name__ == "__main__":
+    unittest.main()