Entry point: ../README.md. Files are per-feature design notes; verify against code. Subdirectories: runbooks/, postmortems/, security/, architecture/.
- api-docs-route-security.md
- api-notifications-security.md
- auth-middleware.md
- auth-session-hardening.md
- backend-security-regression-suite.md
- cors-allowlist.md
- input-sanitization.md
- issue-979-refresh-regression-validation.md
- jwt-claim-validation.md
- jwt-key-rotation.md
- oidc-discovery-digest-alert.md
- oidc-front-channel-logout.md
- oidc-group-role-mapping.md
- oidc-jwks-staleness-alarm.md
- password-reset-rate-controls.md
- password-strength-policies.md
- password-strength.md
- postgres-session-store.md
- rbac-hierarchy-property-tests.md
- rbac-policy-diff-approval.md
- refresh-token-absolute-lifetime-and-reauth.md
- refresh-token-replay-detection.md
- refresh-token-rotation.md
- scim-provisioning.md
- session-storage-partial-index.md
- social-anti-enumeration-regression.md
- social-anti-enumeration.md
- social-login.md
- startup-auth-brute-force-mitigation.md
- startup-auth-service.md
- stryker-auth-signature.md
- user-session-repositories.md
- webhook-auth-clock-skew.md
- webhook-signature-verification.md
- aml-case-load-balancer.md
- aml-fixture-recorder.md
- aml-transaction-monitoring.md
- aml-velocity-sliding-window.md
- cost-basis-strategies.md
- kyc-risk-tier-investment-caps.md
- kyc-webhook-dual-key.md
- ofac-dual-control-review-queue.md
- ofac-signed-source.md
- ofac-vessel-aircraft-screening.md
- sanctions-list-diff-audit.md
- sanctions-list-version-diff-audit.md
- sanctions-screening-fuzzy-matching.md
- sanctions-screening-investment-submission.md
- wash-sale-detection.md
- deferred-distribution-scheduling.md
- dispute-sla-timers.md
- distribution-advisory-lock.md
- distribution-cron-window-definitions.md
- distribution-engine-atomic-transactions.md
- distribution-engine-retry-strategy.md
- distribution-engine-safety.md
- distribution-scheduler-idempotency.md
- fx-cost-aware-selection.md
- fx-provider-health-scoring.md
- fx-quorum-variance-guard.md
- fx-rate-freeze-per-run.md
- fx-triangulation-hop-audit.md
- holiday-calendar-service.md
- investment-consistency-checks.md
- investment-double-submit-protection.md
- investor-registration-idempotency.md
- investor-statement-batch-pipeline.md
- investor-statement-deterministic-pdf.md
- ledger-export-double-entry.md
- ledger-export-gl-filter.md
- ledger-export-stream-jsonl.md
- ledger-period-close.md
- ledger-retention-legal-hold.md
- payout-batching-edge-cases.md
- payout-filters-and-pagination.md
- payouts-stellar-result-codes-retry-storms.md
- reconciliation-metrics.md
- reconciliation-replay-cli.md
- revenue-reconciliation-checks.md
- revenue-reconciliation.md
- revenue-report-ingestion-validation.md
- revenue-route-schema-validation.md
- revenue-route-tests.md
- revenuehandler-validation-decimal-boundaries.md
- statement-pdf-draft-watermark.md
- vesting-event-schema-versioning.md
- vesting-partial-claim-tracking.md
- contract-upgrade-auto-rollback.md
- contract-upgrade-canary.md
- contract-upgrade-slsa-attestation.md
- hardened-milestone-validation.md
- milestone-event-publishing-reliability.md
- offering-status-transition-guardrails.md
- offering-validation-matrix.md
- storage-layout-drift.md
- notification-fan-out-reliability.md
- notification-preferences-validation.md
- notification-read-state-concurrency.md
- outbox-hmac-secret-rotation.md
- outbox-lag-saturation-alerts.md
- push-ab-templating.md
- push-quiet-hours.md
- push-token-lifecycle.md
- smtp-email-provider.md
- transactional-email-providers.md
- transactional-outbox.md
- webhook-dead-letters.md
- webhook-queue-backpressure.md
- webhooks-implementation.md
- webhooks-stellar-integration.md
- horizon-history-gap-chaos.md
- stellar-rpc-failure-behavior.md
- stellar-rpc-failure-classification.md
- stellar-submission-idempotency.md
- api-version-prefix-consistency.md
- audit-log-hash-chain.md
- backend-ci-coverage-gate.md
- global-error-handler-enhancements.md
- health-readiness-probe-expansion.md
- indexer-health-endpoint-database-setup.md
- indexer-health-endpoint-deployment.md
- lag-aware-read-routing.md
- load-testing.md
- metrics-and-logging-baseline.md
- openapi-conformance.md
- p99-latency-budgets.md
- prometheus-metrics-endpoint.md
- rate-limiter-tier-policies.md
- repository-transaction-boundaries.md
- request-id-propagation.md
- structured-error-mapping.md
- transaction-boundaries-migration-guide.md
- transaction-boundaries-quick-start.md
- worker-role-separation.md