Summary

• add a dated audit report at docs/audit/2026-04-15_08:49:13.md
• fix runtime/API/setup/security docs to match the current Go implementation
• repair AGENTS.md and feature/index pages with current repo-observable paths and auth wiring

What Was Fixed

• removed stale /api/edu, /status, and Cognito/JWKS runtime claims from the main runtime docs
• updated setup guidance for current env vars, compose services, Redis wiring, and the OTLP env-name mismatch
• refreshed NSC, auth, and Redis feature pages plus added contract-vs-runtime caveats to the getting-started/auth guides

What Remains Unresolved

• the checked-in v0 contract still documents OAuth 2.0 client credentials, but the current Fiber runtime does not yet enforce bearer-token validation
• the runtime still returns plain-text error bodies instead of a versioned public error envelope
• compose and app config still use different OTLP endpoint env var names

Audit Report

• docs/audit/2026-04-15_08:49:13.md

Validation

• pre-commit run markdownlint-cli2 --files AGENTS.md docs/api.md docs/architecture.md docs/features/README.md docs/features/core/nsc-education.md docs/features/infrastructure/redis.md docs/features/security/cognito-auth.md docs/guides/01-getting-started.md docs/guides/02-authentication.md docs/overview.md docs/setup.md docs/audit/2026-04-15_08:49:13.md