diff --git a/README.md b/README.md
index ff0e1ba..b75aa12 100644
--- a/README.md
+++ b/README.md
@@ -78,8 +78,26 @@ This repo is a sanitized showcase of the systems behind that platform — the ac
 
 ```mermaid
 flowchart LR
-    A["Test A"] --> B["Test B"]
-    B --> C["Test C"]
+    Internet(["Internet"]) --> Edge["Edge Firewall"]
+    Edge --> LAN["LAN"]
+
+    LAN --> DNS["Internal DNS<br/>two zones"]
+    LAN --> Vault["Vault<br/>PKI + secrets"]
+    DNS --> Vault
+
+    Vault --> Apps["App Host<br/>41 stacks"]
+    Vault --> Automation["Automation VM<br/>Git + orchestration"]
+    LAN --> FileServer["File Server"]
+    DNS --> FileServer
+    LAN --> Automation
+
+    Apps --> InternalProxy["Internal Proxy Zone"]
+    Apps --> SSO["SSO"]
+
+    Vault --> EdgeProxy["User-Facing Proxy<br/>mTLS"]
+    DNS --> EdgeProxy
+    Apps -.proxied.-> EdgeProxy
+    SSO -.auth.-> EdgeProxy
 ```
 Solid arrows are real dependencies; dotted arrows are asynchronous telemetry reporting, not a blocking dependency. Full breakdown of all 8 traffic laws (ingress, east-west, secrets, DNS, observability, notifications, CI/CD, management) with the actual trust-boundary reasoning: [docs/architecture-overview.md](docs/architecture-overview.md).