diff --git a/config/README.md b/config/README.md
new file mode 100644
index 0000000..5600984
--- /dev/null
+++ b/config/README.md
@@ -0,0 +1,8 @@
+# config — reference JSON (non-secret)
+
+Files such as `address-inventory.chain138.json` and `runtime-env.chain138.json` are **reference snapshots** produced during dotenv cleanup. They hold **public** contract addresses and RPC URLs — not private keys or API secrets.
+
+- **Do not** treat these as a replacement for `.env` where secrets are required.
+- When Chain 138 deployment addresses change, update canonical docs (parent repo `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md`) and refresh these files if your tooling depends on them.
+
+See parent repo `docs/00-meta/SUBMODULE_HYGIENE.md` for submodule workflow.