# DBAOps Sovereign™
## Post-Audit Addendum to Team Instructions

> **May 2026 — Engineering reality**
> - Seeded bcrypt lives in **SQL `ctl.ConsoleUsers`**; mock **`src/api/db.js`** removed literal **`$2b$`** hashes (runtime `bcryptjs.hashSync`); still treat ACTIVE seeds as **HIGH risk** operationally.
> - **`POST /api/auth/login`** anonymous is correct; **`POST /api/artifacts/verify`** intentionally public.
> - **Gating `GET /api/license`** behind JWT conflicts with SPA **Layout** fetching license before login and **`globalApiAuth.js`** anonymous allowlist unless UI + auth bootstrap change first — treat as a **product decision**, not a blind Day-1 copy-paste.

**Related docs:** [`TEAM-INSTRUCTIONS-PATH-TO-SHIPPABLE.md`](TEAM-INSTRUCTIONS-PATH-TO-SHIPPABLE.md) · [`ENGINEERING-HANDOFF-STATUS.md`](ENGINEERING-HANDOFF-STATUS.md)

### What changed after the deep audit — read this before opening the main manual

A deep audit was performed against the live codebase and repository database on May 16, 2026. Three substantive findings shift the priority order in your Team Instructions document. The shifts are summarized below. Read this addendum first; then the main Team Instructions; then the Engineering Handoff Manual.

## 1. Disable the seeded admin accounts today, not Monday

**What we found:** Three default accounts (admin@sovereign.local, operator@sovereign.local, auditor@sovereign.local) are ACTIVE in ctl.ConsoleUsers and use bcrypt hashes that are hardcoded in source at src/api/db.js. Anyone with read access to the repo can extract the hash, brute force the plaintext (likely seconds for a default password), and log in as Administrator. This is more urgent than the 95 unauthenticated read routes because it requires only git clone, not knowledge of the API surface.

**Action today:** Create one real Administrator account with a real password before disabling the seeded ones. Then in a transaction, log the action to audit.ActionLog and update IsActive = 0 for the three seeded emails. Do not lock yourself out — verify the new account works first. The exact SQL is in the deep-audit summary file at `_discovery/deep-<timestamp>/deep-summary.md`.

## 2. License Manifest schema already exists — work is hardening, not design

**What we found:** ctl.LicenseEntitlements has 13 columns that match the License Manifest model the Engineering Handoff Manual proposes: LicenseId, Edition, Tier, InstancesAllowed, EnginesAllowed, RetentionDays, MaxUsers, MaxCustomRoles, FeaturesJson, ExpiresAt, IsActive, LicenseKey, CreatedAt. The current row is a real Community-tier license with structured features. Someone on the team had the same idea and built it three weeks ago.

**What is missing:** Signature verification (LicenseKey is null), expiration enforcement (ExpiresAt is null), hardware fingerprint binding, tenant binding, portable file delivery. These are real ship-blockers, but they are hardening tasks on existing infrastructure — not green-field design work.

**Plan impact:** Section 3.1 of the Engineering Handoff Manual (License Manifest System) is reduced from 6-8 weeks to 3-4 weeks. The schema is already correct; you are adding Ed25519 signing, expiration enforcement, hardware binding, and the offline file delivery path on top. Focus Zone 5 (Power BI) and Focus Zone 7 (Simulator) can pull forward by 2-3 weeks.

## 3. Middleware architecture is real, not aspirational

**What we found:** Thirteen of fourteen middleware files in src/api/middleware/ implement actual gates with auth, role, tenant, and audit logic. The only suspect is licenseGate.js, which lacks signature verification — addressed by finding 2 above. The work to gate the 95 remaining unauthenticated read routes is mechanical wiring, not new design.

**Plan impact:** Focus Zone 1 of the Team Instructions document is largely accurate. Auth gating remains a priority but is scoped down — no architecture work, just attaching existing middleware to remaining routes through careful code review.

## Corrections to the Team Instructions document

Two specific items in the main Team Instructions document need updating in light of these findings:

1. The "two unauthenticated writes" listed in Section 3.1 are false positives. Both POST /api/auth/login (login endpoint, must be reachable without auth) and POST /api/artifacts/verify (public artifact verifier, correctly designed) are intentionally unauthenticated. They have other protections (rate limiting on login, hash verification on artifacts). Do not gate them.

2. Add GET /api/license to the urgent-this-week list. This endpoint returns license details without authentication, leaking which edition and which features a customer has enabled. An attacker can use this to choose which features to target. Gate it with requireAuth this week.

## Revised Day 1 sequence

The first day of work shifts to reflect the credential finding. Replace the Day 1 ordering in Section 6 of the main document with this:

3. Hour 1: Create one real Administrator account. Verify login works. Document the credentials in your password manager — not in source code, not in a shared text file.

4. Hour 2: In a transaction, log the action to audit.ActionLog and set IsActive = 0 on the three seeded accounts. Verify you can still log in with the new account. Commit.

5. Hour 3: Configure nightly full backup of SovereignRepository. Trigger one manual backup and verify the .bak file exists.

6. Hour 4: Gate GET /api/license with requireAuth. Restart the API, confirm the endpoint returns 401 unauthenticated and 200 with a valid session.

7. Afternoon: Begin auth gating of the remaining 95 unauthenticated read routes. Order them by sensitivity: license, auth, sovereignty, security, compliance first; everything else after.

## Closing note

The deep audit revealed a product whose architecture is more complete than its surface state suggests. The seeded credential exposure is the single most urgent fix. After that, the planned work in the main Team Instructions document is correct in shape — just smaller in scope and faster to deliver than originally estimated. Proceed with confidence; the foundation is real.

Rhoylle Innovation Empire LLC · DBAOps™ Serial No. 99717776  
Addendum v1.0 · May 2026
