diff --git a/.delivery-readiness.yml b/.delivery-readiness.yml
new file mode 100644
index 0000000..25b55f7
--- /dev/null
+++ b/.delivery-readiness.yml
@@ -0,0 +1,9 @@
+version: 1
+recommended_checks:
+  - dependency_lock
+  - security_guidance
+  - support_guidance
+  - architecture_guidance
+  - limitations_guidance
+  - workflow_permissions
+  - action_pinning
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6ecbcfa..5605922 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,11 +1,13 @@
 name: CI
 on: [push, pull_request]
+permissions:
+  contents: read
 jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with: { node-version: '24', cache: 'npm' }
       - run: npm ci --no-fund
       - run: npm run typecheck
diff --git a/README.md b/README.md
index 8629647..bf61627 100644
--- a/README.md
+++ b/README.md
@@ -16,21 +16,38 @@ The rescue moves validation to the HTTP boundary, durably claims one order opera
 
 See [the root-cause analysis](docs/ROOT_CAUSE_ANALYSIS.md), [before/after evidence](docs/BEFORE_AFTER.md), and [architecture](docs/ARCHITECTURE.md).
 
-## Reproduce and validate
+## Setup
 
 Requires Node 24.
 
 ```sh
 npm ci --no-fund
+```
+
+On Windows where `npm.ps1` is blocked, `npm.cmd` is equivalent. No private cache path is required.
+
+## Run
+
+Start the local synthetic API with:
+
+```sh
+npm run dev
+```
+
+The fixed route is `POST /webhooks/orders` with `eventId`, `orderId`, and positive integer `amountCents`; `GET /health` returns service status.
+
+## Test and validation
+
+Run the deterministic verification set with:
+
+```sh
 npm run typecheck
 npm test
 npm run build
 npm audit
 ```
 
-On Windows where `npm.ps1` is blocked, `npm.cmd` is equivalent. No private cache path is required.
-
-The tests named `SYNTHETIC INTENTIONALLY FLAWED BASELINE` pass by asserting known-bad behavior. They are evidence, not approval of the baseline. The fixed route is `POST /webhooks/orders` with `eventId`, `orderId`, and positive integer `amountCents`; `GET /health` returns service status.
+The tests named `SYNTHETIC INTENTIONALLY FLAWED BASELINE` pass by asserting known-bad behavior. They are evidence, not approval of the baseline.
 
 ## Limitations