Merge branch 'main' into codex/review-and-rewrite-readme-for-documentation-5tftkj

Author: GsCommand

README.md

@@ -23,8 +23,6 @@ Reference Node.js runtime for CommandLayer Commons verbs. This service executes
 
 ### Debug routes
 
-> Debug routes are disabled by default. Enable with `DEBUG_ROUTES_ENABLED=1` and optionally protect with `DEBUG_BEARER_TOKEN`.
-
 - `GET /debug/env` — effective runtime configuration.
 - `GET /debug/enskey` — ENS TXT key discovery state.
 - `GET /debug/schemafetch?verb=<verb>` — computed receipt schema URL.
@@ -122,15 +120,6 @@ Use `POST /debug/prewarm` and `GET /debug/validators` for schema prewarming work
 
 Detailed environment variable documentation lives in [`docs/CONFIGURATION.md`](docs/CONFIGURATION.md).
 
-## Development checks
-
-```bash
-npm run check
-npm test
-```
-
-`npm test` runs an automated smoke suite for signer readiness, verb execution, verify pass/fail paths, and debug route auth.
-
 ## Security notes
 
 - `fetch` only allows `http(s)` URLs.

docs/CONFIGURATION.md

@@ -12,14 +12,6 @@ This runtime is configured via environment variables.
 | `API_VERSION` | `1.0.0` | Version segment used in verb route shape. |
 | `CANONICAL_BASE_URL` | `https://runtime.commandlayer.org` | Base URL metadata in index/health payloads. |
 
-## CORS controls
-
-| Variable | Default | Purpose |
-|---|---|---|
-| `CORS_ALLOW_ORIGINS` | empty | CSV allowlist of browser origins. Empty rejects cross-origin browser requests. Use `*` only when intended. |
-| `CORS_ALLOW_HEADERS` | `Content-Type, Authorization` | Allowed CORS request headers. |
-| `CORS_ALLOW_METHODS` | `GET,POST,OPTIONS` | Allowed CORS methods. |
-
 ## Enabled verbs
 
 | Variable | Default |
@@ -53,14 +45,6 @@ Comma-separated list of enabled handlers. Disabled verbs return `404`.
 | `SCHEMA_FETCH_TIMEOUT_MS` | `15000` | Timeout per schema document fetch. |
 | `SCHEMA_VALIDATE_BUDGET_MS` | `15000` | Budget for async schema compilation. |
 | `VERIFY_SCHEMA_CACHED_ONLY` | `1` | If `1`, `/verify?schema=1` only uses warm validators and returns `202` on cold cache. |
-| `REQUEST_SCHEMA_VALIDATION` | `0` | If `1`, verb endpoints validate request payloads against verb request schema before execution. |
-
-## Debug route controls
-
-| Variable | Default | Purpose |
-|---|---|---|
-| `DEBUG_ROUTES_ENABLED` | `0` | If `1`, enables `/debug/*` endpoints. |
-| `DEBUG_BEARER_TOKEN` | empty | Optional bearer token required for `/debug/*` when set. |
 
 ## Cache controls