docs: cleanup pass 3, architecture history, RFCs, e2e guides, operations

.github/workflows/ci.yml

@@ -59,15 +59,8 @@ jobs:
         #     fact — never as live vocabulary a reader would adopt.
         #       - docs/VERIFICATION-GAPS.md: narrates the terminology
         #         sweep itself.
-        #       - docs/architecture/repository-certification.md,
-        #         docs/architecture/phase2b-technical-debt-assessment.md,
-        #         docs/architecture/phase2c-terminology-guard.md: each
-        #         independently found and/or fixed this exact guard gap,
-        #         and necessarily quotes the retired phrase to document
-        #         what was found. Expect this category to keep gaining
-        #         entries over time — that is normal, not a regression;
-        #         see phase2c-terminology-guard.md for why a per-file list
-        #         is the deliberate choice here, not a stopgap.
+        #         A per file list is the deliberate choice here, not a
+        #         stopgap; expect it to gain entries over time.
         #
         # (2) Third-party citation: docs/site's two "Related work" notes
         #     cite an unrelated third-party academic framework that is
@@ -99,9 +92,6 @@ jobs:
             --exclude='VERIFICATION-GAPS.md' \
             --exclude='how-parmana-thinks.mdx' \
             --exclude='execution-authorization.mdx' \
-            --exclude='repository-certification.md' \
-            --exclude='phase2b-technical-debt-assessment.md' \
-            --exclude='phase2c-terminology-guard.md' \
             --exclude='changelog.mdx' \
             --exclude='ci.yml' \
             --exclude='terminology-guard.test.ts' \

.gitleaks.toml

@@ -34,7 +34,7 @@ regexes = [
 
   # SHA-256 hash of the publicly documented local-dev demo caller key
   # (raw key "my-secret-api-key", see docs/site/api-reference/authentication.mdx
-  # and docs/guides/e2e/04-execute-transaction.md). A hash is not reversible
+  # and docs/site/deployment/local.mdx). A hash is not reversible
   # and the raw value it hashes is intentionally public.
   '''325ededd6c3b9988f623c7f964abb9b016b76b0f8b3474df0f7d7c23b941381f''',
 

docs/adr/ADR-0009-KMS-Secrets-And-Connector-Signature-Hardening.md

@@ -7,8 +7,8 @@
 **Update (2026-09-20):** AWS KMS refuses a raw Ed25519 message over 4096 bytes, which broke signing of a full Execution Trust Record in production. A message over that size is now signed as a fixed size commitment, see `ADR-0010-Large-Message-Signing-Under-KMS.md`.
 
 **Update (2026-09-15):** Architecture §1 (gateway signing key → AWS KMS) and §4 (Paytm connector signature verification) are now built — see `ROADMAP.md`'s "Secrets, Signing-Key Custody & Connector Signature Hardening" section and `docs/CLAIMS.md`'s 2026-09-15 update on the G-40 entry for exact status and verification evidence. Architecture §2 (opaque connector secrets → AWS Secrets Manager) and §3 (GitHub App credential elimination) remain not built. **Update (2026-09-16):** Full setup guide and troubleshooting record for everything in this
-ADR: `docs/operations/aws-kms-vercel-oidc-setup-guide.md` and
-`docs/operations/2026-09-15-kms-migration-troubleshooting-guide.md`. Five additional real
+ADR: `docs/site/deployment/aws-kms-signing.mdx` and
+the 2026-09-15 KMS migration troubleshooting guide (in git history). Five additional real
 production bugs were found and fixed getting this live — none visible from code review,
 only from testing against real Vercel/AWS/traffic — full detail in those documents and in
 `docs/VERIFICATION-GAPS.md` G-48/G-49.