- QUICKSTART.md — Local development from clone to first test pass
- DEPLOY_AWS.md — AWS deployment guide, including Lambda environment override warnings
- RUNBOOKS.md — Copy/paste-safe deployment, rotation, incident, audit, and troubleshooting runbooks
- ARCHITECTURE.md — System design, trust boundaries, and package responsibilities
- COMPATIBILITY.md — BLESS compatibility contract and intentional behavior differences
- THREAT_MODEL.md — Assets, attackers, mitigations, and residual risks
- DEPENDENCY_POLICY.md — Dependency approval boundaries and review process
- TEST_STRATEGY.md — Test philosophy, race policy, fuzzing, and fixture expectations
- TEST_MATRIX.md — Coverage matrix mapping risks to test files
- adr/001-key-custody.md — CA key custody decision
- adr/002-iam-authorization.md — IAM authorization and principal binding decision
- adr/003-serial-generation.md — Certificate serial generation decision
- adr/004-source-address.md — Source-address derivation and RSA key-size floor decision