sovereign-plugin Development Branch Review — Workers, D1, CORS, Rate Limiting, UI/UX
Access & Environment Confirmation
Full Cloudflare MCP access confirmed. Both deployed workers retrieved and audited from live compiled bundles.
| Resource | Type | Status | Last Modified |
|---|---|---|---|
| sovereign-worker | Pages Functions Bundle | ✓ DEPLOYED | 2026-04-01 |
| d1-rest | Standalone Worker (Hono) | ⚠ DEPLOYED — CRITICAL ISSUES | 2026-04-27 |
| alnet-froi | Vault Worker | ✗ ABSENT | — |
| sovereign-phoenix | D1 Database | ✓ EXISTS | UUID: a72c9ce8 |
| alnet-froi-db | D1 Database | ✓ EXISTS | UUID: 2bad8c0d |
Security Pass
Affected: d1-rest worker · /query POST endpoint
The previous d1-rest worker exposed an authenticated endpoint that executed any SQL statement passed in the request body against the D1 database. Any caller holding the Bearer token could execute DROP TABLE, UPDATE companies SET …, DELETE FROM access_log, PRAGMA …, or any destructive operation. The token is a single shared secret with no per-query scope, no audit trail, and no statement type restriction.
Risk: Complete database destruction or data exfiltration by any party who obtains or guesses the token. The forensic evidence stored in D1 is irreplaceable.
Remediation: Endpoint permanently removed in corrected worker. Named, parameterized REST routes replace the raw SQL interface. If a privileged read interface is required, it must be implemented separately with SELECT-only validation, explicit table whitelist, row limits, separate token, and audit logging.
Affected: d1-rest worker · all endpoints
The previous implementation used cors() with no arguments, which sets Access-Control-Allow-Origin: *. This allows any origin on the web to make credentialed requests to the API. For a production D1 API over forensic data, CORS must be restricted to the explicit albertlane.net origin allowlist.
Remediation: CORS middleware now configured with the same five-origin allowlist used by sovereign-worker. Non-listed origins receive null — the CORS response omits the Access-Control-Allow-Origin header entirely, which browsers treat as a block.
All CRUD handlers returned { error: error.message } directly. D1 error messages contain table names, column names, constraint names, and SQL fragments — enough to enumerate the full database schema through deliberate error induction.
Remediation: Generic messages ("Query failed", "Insert failed") are returned to callers. Raw error details are routed to console.error() for Cloudflare Logpush only.
The REST handler accepted any table name from the URL path. An authenticated caller could target internal tables, system tables, or tables not intended for external access by simply crafting a path like /rest/sqlite_master.
Remediation: Explicit ALLOWED_TABLES Set enforces a whitelist. Non-listed tables return 404 — the response does not reveal whether the table exists.
No rate limiting existed on d1-rest. Any caller with the token (or attempting to brute-force it) could make unlimited requests, exhausting D1 quotas or running denial-of-service on the database.
Remediation: KV-based rate limiting added — 60 requests/minute per IP, auto-block at threshold with 1-hour TTL. Uses the existing SOVEREIGN_CACHE KV namespace binding.
The auth middleware used token !== secret, a standard string comparison that may short-circuit on the first differing character, enabling timing-based token oracle attacks.
Remediation: Replaced with a 512-character padded constant-time comparison (same pattern used in sovereign-worker). A 50–100ms random jitter is also applied on auth failure to defeat remote timing measurement.
Neither worker sets X-Content-Type-Options, X-Frame-Options, or Referrer-Policy on responses. These are low-effort, high-signal hardening headers.
Remediation: Added to d1-rest via a post-response middleware. Apply the same pattern to sovereign-worker in the next source-level build pass.
sovereign-worker's compiled bundle was fully reviewed. The implementation is well-hardened: CORS origin allowlist, HMAC-SHA256 handshake middleware with constant-time comparison and brute-force protection, KV+D1 rate limiting with auto-block, 22-pattern threat scoring, admin token validation, body size limit (16KB), jitter on all responses, and waitUntil for async logging. No changes required before the next deploy.
Performance Pass
The previous d1-rest worker constructed new Hono(), called app.use(), defined all routes, and compiled the SmartRouter trie inside the fetch() handler — meaning this work was repeated on every single HTTP request, including warm requests where the Worker isolate was already running.
Hono's SmartRouter builds a compiled RegExp trie on first match, but only if the app is built outside the hot path. Inside fetch(), the trie is thrown away after every request.
Remediation: App, middleware, and routes moved to module scope. export default { fetch: app.fetch }. The Hono instance is built once at isolate load time and reused across all requests in the same isolate. Estimated 5–15ms improvement per warm request.
/api/phoenix/entity, /api/phoenix/detect, and /api/phoenix/summary query D1 on every request. The forensic data in these tables changes infrequently. Every read hits D1, which has non-trivial per-query latency in a Worker context.
Recommendation: Apply the same KV-caching pattern already used in /api/search: compute a normalized cache key, check KV first (TTL: 5 minutes), fall through to D1 on miss. The search endpoint already proves this pattern works end-to-end in this codebase.
The /api/search system prompt array is constructed and .join()'d inside the request handler on every call. This is trivial at the JS engine level but represents a pattern inconsistency — all fixed strings should be module-scope constants.
Recommendation: Move to a const SEARCH_SYSTEM_PROMPT = … at module scope in the source file.
UI/UX & Design System
Design Language Assessment
The existing HTML components — Albert Theme Schematic, sovereign_chats_v2, FaaF forensic report — represent a coherent and intentional design system. Three distinct but related modes:
| Component | Mode | Tone | Status |
|---|---|---|---|
| Albert Theme Schematic | Light / Document | Deep purple + teal, serif display, forensic authority | Reference / Complete |
| sovereign_chats_v2 | Dark / Application | Zinc-950, violet-600, monospace, operational | Production-ready |
| FaaF Report Draft | Light / Document | Navy + gold, editorial serif, evidentiary weight | Draft / Good bones |
The "minimum design, maximum function" imperative is met in sovereign_chats_v2. The chat interface is so well-structured that the UI disappears — the content and interaction take over. The Albert Theme is rigorous. The FaaF report needs its rough-draft status addressed, but the aesthetic foundation is right.
What's Missing: Operational Surface for the API
The existing /api/threats and /api/access-log endpoints in sovereign-worker return rich forensic data — IP threat logs, access history, top offenders. There is no front-end surface for this data. The data exists; the interface does not. This is the gap. A security monitoring dashboard in the established Albert forensic aesthetic, deployable directly to /public/security-monitor.html, has been produced as a companion deliverable.
Deployment Gap
The alnet-froi worker (vault API at /vault/api/*) is absent from the Cloudflare account. The alnet-froi-db D1 database exists and is ready. Until the worker is deployed, the entire FROI Incident Preservation Vault is unreachable. This should be the next deployment task after d1-rest is corrected and pushed.
Corrected Files & Commit Instructions
d1-rest worker must be replaced before next production use
The corrected d1-rest/src/index.ts is ready to commit. Deploy via wrangler after review.
-
1
Replace d1-rest/src/index.ts — corrected source file is the primary output of this audit. Resolves D1REST-SEC-01 through SEC-07 and PERF-01.
-
2
Deploy d1-rest:
wrangler deploy --name d1-rest— verify SOVEREIGN_CACHE KV binding is present in wrangler config for rate limiting to activate. -
3
Deploy security-monitor.html to
sovereign-plugin/public/security-monitor.html— provides operational surface for the live /api/threats and /api/access-log endpoints. -
4
Apply sovereign-worker source patches (SW-SEC-03 comment, SW-PERF-02 const hoisting, security headers) at next scheduled build and deploy. Not urgent — no critical issues.
-
5
Deploy alnet-froi worker — vault API remains unreachable until this is done. alnet-froi-db is ready and waiting.