clm-debug-multilayer

When an agent flow breaks in draftLegal, the bug is rarely in only one layer. Trace through API route → Python agent → config/settings → auth headers → DB scoping in that order, and don't stop after one fix. Includes the canonical "create contract from draft" four-layer case study, the auth-header gotchas (x-internal-secret, x-internal-service, x-org-id), pydantic-settings vs os.getenv, structured-error contract,…