principles-audit Worker

Backs the free self-serve design-principles audit tool at /audit/. See /Users/benbrignell/.claude/plans/hazy-pondering-gizmo.md (or SETUP.md once this section is added there) for the full architecture.

Files

  • index.js - the Worker: POST /submit, GET /verify, GET /report/:id.
  • rubric-prompt.js - the audit’s system prompt and forced-tool-use JSON schema. Iterate on scoring language here without touching request handling.
  • supabase.js - thin REST (PostgREST) helpers against the audit_runs table. No @supabase/supabase-js dependency, matching this Worker’s zero-npm-dependency style (same reasoning as kit-subscribe.js).
  • disposable-domains.json - vendored from disposable-email-domains/disposable-email-domains (disposable_email_blocklist.conf, fetched 2026-08-30), which is dedicated to the public domain under CC0 1.0 - safe to vendor and redistribute without attribution. 8,368 domains as a flat JSON array, checked via a Set lookup at request time. To refresh: re-fetch that file and re-run the one-line JSON.stringify conversion used to generate this one.
  • wrangler.toml - deploy config. AUDIT_MODEL is set per-environment: default env (wrangler deploy) uses Sonnet for prompt iteration; --env production uses Haiku 4.5. EMAIL_REPLY_TO is a plain (non-secret) var: principles.design has no real mailboxes, so verification emails send from a purpose-specific no-reply-style address but set reply_to to Ben’s real inbox so replies still land somewhere read.

Secrets (set via wrangler secret put <NAME>)

  • ANTHROPIC_API_KEY - dedicated key for this tool only, spend-capped in the Anthropic Console. Never reuse a key shared with other projects.
  • SUPABASE_URL, SUPABASE_SECRET_KEY - a dedicated Supabase project, separate from Calendar Garden’s.
  • RESEND_API_KEY, EMAIL_FROM_ADDRESS - verification emails. EMAIL_FROM_ADDRESS should be on the verified sending domain (e.g. [email protected]) - no mailbox needs to exist there, since sending only requires the domain’s SPF/DKIM DNS records, not an inbox.
  • KIT_API_KEY, KIT_FORM_ID - same Kit account/form as kit-subscribe, reused at verification time to subscribe the now-confirmed email.
  • IP_HASH_PEPPER - random string mixed into the IP hash before storage so raw IPs are never persisted (see supabase.js’s hashIp).

Local dev

wrangler dev in this directory. Needs all secrets above set locally (.dev.vars file, gitignored) to exercise the full flow - /submit alone will run without ANTHROPIC_API_KEY since the LLM call happens in /verify, not /submit.