diff --git a/.siax-doctor.json b/.siax-doctor.json
new file mode 100644
index 0000000..7524a0c
--- /dev/null
+++ b/.siax-doctor.json
@@ -0,0 +1,30 @@
+{
+  "exemptions": [
+    {
+      "control": "REPO-01",
+      "paths": [
+        "siax/sbom/sbom-0pt-2026-09-29.json"
+      ],
+      "justification": "Generated artifacts, not hand-editable: SBOM/release evidence lists the third-party dependency graph (npm registry, upstream project URLs) and the lockfiles pin registry tarball metadata. Rewriting them would falsify supply-chain evidence."
+    },
+    {
+      "control": "REPO-01",
+      "paths": [
+        "AGENTS.md",
+        "CLAUDE.md",
+        "ONBOARDING.md",
+        "PRODUCTION_EVIDENCE.json",
+        "SECURITY.md",
+        "docs/02-architecture.md",
+        "docs/06-data-engine.md",
+        "docs/07-dependencies.md",
+        "docs/08-infrastructure.md",
+        "docs/09-build-plan.md",
+        "docs/P0_QUERY_SOURCE_FLOW.md",
+        "docs/compliance/INVENTORY.md",
+        "docs/compliance/SLUTRAPPORT.md"
+      ],
+      "justification": "Documentation prose. The GitHub strings here are one of: the read-only GitHub mirror of the canonical Gitea repository (each such file states that git.siax.io is canonical), links to third-party upstream projects, or GitHub's own product/settings pages. None of them configures or names a SIAX git remote."
+    }
+  ]
+}