diff --git a/README.md b/README.md
index a7065ea..83c73f2 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,52 @@ Stacks (all deployed by `cdk deploy --all` / the CD workflow):
 | `seahaven-backup` | us-east-1 | Primary AWS Backup vault + plan + role (C-7) |
 | `seahaven-backup-offsite` | us-west-2 | Governance-locked offsite copy vault (C-7) |
 
+## CDK app
+
+The repo is a single AWS CDK app written in TypeScript. `cdk.json` is the
+project config the `cdk` CLI reads on every command: its `app` key
+(`npx ts-node bin/app.ts`) tells CDK how to synthesize the app straight from
+the TypeScript source — no separate compile step needed for `cdk synth` /
+`diff` / `deploy` — and its `context` block carries the AWS CDK feature flags.
+
+| Path | Role |
+|---|---|
+| `cdk.json` | CDK config: `app` synth command, `watch` includes/excludes, `context` feature flags |
+| `bin/app.ts` | App entry point — instantiates every stack with an explicit kebab-case `stackName` and its target `env` (account `328440206208`, per-region) |
+| `lib/*-stack.ts` | Stack definitions (one class per stack; larger stacks compose the constructs in `lib/*.ts`) |
+| `tsconfig.json` | TypeScript compiler options (`outDir: cdk.out`) |
+| `package.json` | Pinned `aws-cdk-lib`, CDK CLI, and the `build` / `synth` / `diff` / `deploy` npm scripts |
+
+`bin/app.ts` synthesizes six stacks across three regions:
+
+| Construct id | Stack name | Region | Source |
+|---|---|---|---|
+| `account-baseline` | `seahaven-account-baseline` | us-east-1 | `lib/account-baseline-stack.ts` |
+| `dynamodb-cmk` | `seahaven-dynamodb-cmk` | us-east-1 | `lib/dynamodb-cmk-stack.ts` |
+| `regional-baseline-us-west-2` | `seahaven-regional-baseline-us-west-2` | us-west-2 | `lib/regional-baseline-stack.ts` |
+| `regional-baseline-us-east-2` | `seahaven-regional-baseline-us-east-2` | us-east-2 | `lib/regional-baseline-stack.ts` |
+| `backup-offsite` | `seahaven-backup-offsite` | us-west-2 | `lib/backup-offsite-stack.ts` |
+| `backup` | `seahaven-backup` | us-east-1 | `lib/backup-stack.ts` |
+
+`backup` declares an explicit dependency on `backup-offsite` so the offsite copy
+vault exists before the primary plan that copies into it. Stack names are set
+explicitly to enforce kebab-case (CDK defaults to PascalCase). Synthesized
+CloudFormation templates land in `cdk.out/` (git-ignored).
+
+Common commands:
+
+```
+npm ci                         # install pinned deps
+npm run build                  # tsc type-check (compiles to cdk.out/)
+npx cdk synth                  # synthesize CloudFormation for all stacks
+npx cdk diff                   # diff synthesized stacks against deployed state
+npx cdk deploy --all           # deploy every stack
+npx cdk deploy <stack-name>    # deploy a single stack
+```
+
+The `--context <key>=<value>` flag overrides `cdk.json` context at the command
+line (e.g. the `encryptTrailLogGroup` toggle under *Monitoring + logging*).
+
 ## Documentation
 
 The canonical map of Sea Haven's AWS infrastructure lives in Confluence. This project's `seahaven-account-baseline`, `seahaven-backup`, and `seahaven-backup-offsite` stacks are represented there as Mermaid subgraphs.