The sovereign No-Ops manifesto.

Principle 01

Repetitive toil is a design defect.

If the same human must repeatedly nurse the same system back into compliance, that labor is not a badge of seriousness. It is an interface the architecture failed to create.

Principle 02

State must have a named home.

Relational truth belongs in D1. Large bytes belong in R2. Money state belongs in Stripe and is mirrored locally through signed webhooks. A browser cache is not a database, and an email inbox is not an order system.

Request → Worker → authorization → prepared D1 query
                        ↘ R2 object metadata
Stripe event → signature verify → idempotent D1 update

Principle 03

Managed primitives are leverage, not moral failure.

Running your own server does not make you more sovereign if it creates a permanent dependency on your attention. Sovereignty comes from legible boundaries, portable data, recoverable configurations, and an exit plan—not from owning a loud box.

Principle 04

Small and obvious beats impressive.

Every dependency enters the system with a future tax. Use the platform, the web platform, and plain SQL before importing another universe. The correct abstraction is the smallest one that makes the risky part understandable.

• Static HTML and CSS for public pages.
• A focused Worker for protected behavior.
• D1 queries behind clear authorization checks.
• Stripe-hosted Checkout and Portal for payment surfaces.

Principle 05

Failure should be loud, bounded, and recoverable.

Silent partial success is more dangerous than an honest error. Orders begin pending, become paid only after a verified event, and preserve a trail. Moderation actions are attributable. Configuration absence fails closed.

Principle 06

Security is the shape of the system.

Authorization lives on the Worker, not behind a hidden button. Passwords are derived with a slow cryptographic function and unique salts. Session tokens are random, stored only as hashes, and delivered in secure cookies. Inputs are bounded. Queries are prepared. Stripe signatures are checked against the raw request body.

Security theater adds checklists. Security architecture reduces the number of places trust can hide.

Principle 07

Design as if the author disappears.

The system must remain explainable when the original builder is asleep, fired, traveling, grieving, or simply finished. Configuration is documented. Product data is editable in one table. Recovery procedures exist before the emergency.

Principle 08

Own the exit before you enter.

Data can be exported from D1. Objects can be listed from R2. Stripe customer and subscription identifiers are stored locally. Static pages remain ordinary files. Vendor choice is strongest when migration is tedious—not existential.

Principle 09

Cost behavior is part of correctness.

A system that can financially ambush its owner is broken. Favor request-bounded work, narrow queries, explicit file limits, cached public content, and managed services whose free or lowest tier matches actual demand.

Principle 10

No-Ops never means no accountability.

The platform may execute the mechanics, but people still choose the rules. We remain responsible for access, fairness, moderation, privacy, customer promises, and the harms a system makes easy.

Delete the pager. Keep the conscience.

Reference architecture

The four planes.