ATLAS · openalicelabs

Criticality

criticalhttp / shared-jwt

importantws · grpc · event

minoroptional

─ direct · - - transitive

Consumers

51 repos would be affected by changes to openalice-auth.

Direct consumers15

openaliceshared-jwt
via SHARED_JWT_SECRET
Verify oa_session JWTs on every authenticated HTTP route; ALICE_JWT_SECRET shares the same secret.
openalice-a2ahttp
via A2A_INTERNAL_SECRET
Internal callers (openalice main, MC) authenticate to /internal/* endpoints using a shared secret issued by openalice-auth.
openalice-atlasshared-jwt
via SHARED_JWT_SECRET
Verify oa_session JWTs from the ecosystem SSO for UI access (read endpoints stay anonymous).
openalice-bluegenieshared-jwt
via SHARED_JWT_SECRET
Verify oa_session JWTs on /v1/me/* routes via HS256 SHARED_JWT_SECRET
openalice-canary
openalice-gatewayhttp
via GATEWAY_URL_AUTH
Validate API keys by calling /auth/me on the auth service (fail-closed)
openalice-labshared-jwtoptional
via SHARED_JWT_SECRET
Prompt Evolution Studio verifies oa_session JWTs (HS256) minted by alice's /v1/auth/login on every write route.
openalice-liveshared-jwt
via SHARED_JWT_SECRET
JWTs issued by openalice-tenants are signed with the same shared secret so /auth/me + every openalice service accepts them without a separate SSO round-trip.
openalice-personashared-jwt
via SHARED_JWT_SECRET
Verify oa_session JWTs (HS256, issuer=openalice-auth) on every authenticated API route.
openalice-radioshared-jwt
via SHARED_JWT_SECRET
Verify oa_session JWTs on owner-gated routes (create channel, add/remove track, share-track).
openalice-rtshared-jwt
via SHARED_JWT_SECRET
Validate oa_session JWTs on WS upgrade and HTTP routes (SHARED_JWT_SECRET; RT_JWT_SECRET as standalone fallback).
openalice-selfhostedhttp
via SHARED_JWT_SECRET
Bundled auth service; issues and verifies JWTs for all co-located services
openalice-socialhttp
via NEXT_PUBLIC_API_URL (AuthProvider)
SSO — AuthProvider validates oa_session JWTs and issues the shared OpenAliceClient.
openalice-voicehttp
via AUTH_INTERNAL_URL
Fetch per-user unified agent_config (TTS/STT provider, voice id, emotion, pace, language) via /internal/agent-config/:user_id.
openalice-worldhttp
via NEXT_PUBLIC_AUTH_URL
Session auth for world users; X-Internal-Secret for internal GDPR export endpoint

2-hop transitive33

openalicehttpoptional
via A2A_API_KEY
Agent-to-agent task dispatch and hybrid group chat (A2A connector bridge).
openaliceotheroptional
via OPENALICE_STORAGE_LAYOUT
File-first identity/session layout (identities/{slug}/, sessions/{conn}-{chat_id}/) read through storage-v2 compat shim when OPENALICE_STORAGE_LAYOUT=v2.
openaliceotheroptional
via OPENALICE_PROMPT_COMPOSER
Composer crate reads Cat-A SHA256-pinned .md blocks at boot and assembles prompts via SectionBuilder when OPENALICE_PROMPT_COMPOSER=v2.
openalice-animwsoptional
via ws
Streams LipsyncFrame tokens (grapheme offset + viseme) into the session so gesture rhythm and mouth blendshapes are driven by the spoken token timeline.
openalice-animws
via INTERNAL_SECRET
Persona renderer connects to /v1/sessions/{sid}/stream to consume PoseFrame + BlendshapeFrame at tick rate.
openalice-bluegeniehttpoptional
via RT_URL
Push real-time events (achievement unlocks, mood-mode broadcasts) for SPA SSE/WS subscriptions
openalice-bluegeniehttpoptional
via PERSONA_INTERNAL_URL
VRM upload/list/delete proxy — SPA talks only to BlueGenie, which forwards to persona-server
openalice-browsews
via INTERNAL_SECRET
Agent Desktop BrowserApp connects over WS to receive JPEG screencast frames and send click/type/navigate commands
openalice-desktophttp
via SOCIAL_URL (hardcoded https://social.blal.pro)
Loads the social UI in the native iframe — frontend served by openalice-social
openalice-gatewayhttpoptional
via GATEWAY_URL_VOICE
Proxy /voice/* HTTP and /ws/voice WebSocket requests to the voice backend
openalice-gatewaywsoptional
via GATEWAY_URL_RT
Proxy /rt/* HTTP and /ws/rt WebSocket requests to the realtime backend
openalice-gatewayhttpoptional
via GATEWAY_URL_PERSONA
Proxy /persona/* HTTP and /ws/persona WebSocket requests to the persona backend
openalice-gatewayhttpoptional
via GATEWAY_URL_A2A
Proxy /a2a/* requests to the agent-to-agent service
openalice-gatewayhttpoptional
via GATEWAY_URL_ALICE
Proxy /alice/* requests to the main OpenAlice service (120s timeout for LLM calls)
openalice-labhttp
via ALICE_URL
System-under-test: lab spins up and probes the openalice agent binary inside the Docker incubator
openalice-livews
via NEXT_PUBLIC_VOICE_SFU_URL
WebRTC recv-only Voice SFU — streams the agent's TTS audio into the OBS Browser Source page via VoiceClient from @openalicelabs/voice-client. BGM BgmPlayer ducks volume on oa-voice-chunk events.
openalice-livews
via NEXT_PUBLIC_RADIO_URL
RadioPlayer subscribes to wss://radio.<domain>/v1/radio/channels/<slug>/subscribe; each now_playing frame drives the BgmPlayer cross-fade so the live page tracks the current radio track without restarting BGM.
openalice-livehttp
via NEXT_PUBLIC_DEFAULT_DOMAIN
Embeds the VRM avatar renderer as an iframe (persona.blal.pro/<user>) in every VRM-bearing scene mode; forwards ?avatar=, ?anim=, ?token= from the parent URL.
openalice-orchestratorother
via docker compose / container volume mount
Spawns and manages openalice containers; mounts alice binary + entrypoint from the main repo build.
openalice-personawsoptional
via RT_URL
Publish persona state mutations (emotion, animation, scene) to the real-time state bus after each agent reply.
openalice-personawsoptional
via DOMAIN
radio_bridge subscribes to wss://radio.${DOMAIN}/v1/radio/channels/:slug/subscribe and re-emits now_playing frames onto the PersonaEvent SSE bus when bgm_source=radio:<slug>.
openalice-personahttpoptional
via NEXT_PUBLIC_AGENT_URL
persona-web points its AI chat stream at the main openalice agent (POST /v1/chat/stream) for SSE-streamed assistant replies.
openalice-rankerotheroptional
via ATLAS_ORG_ROOT
Consumes the OpenAlice feature inventory YAML produced by atlas to power 4-layer fuzzy gap detection and priority scoring.
openalice-relayhttp
via A2A_URL
Poll tasks/list (JSON-RPC) to fetch new A2A messages and forward them to Telegram
openalice-selfhostedhttp
via VOICE_SFU_URL
Bundled SFU; social-api delegates audio/video sessions to it
openalice-selfhostedhttpoptional
via PERSONA_JWT_SECRET
Bundled persona server (profile=persona/full); serves avatar state to rt
openalice-socialws
via VOICE_WS_URL (wss://voice.blal.pro/ws)
P2P-mesh WebRTC signalling — join/leave rooms, relay ICE/SDP between peers.
openalice-voice-agentws
via VOICE_SFU_WS_URL
Join SFU voice rooms as a participant; receive Opus audio frames and send TTS audio back
openalice-voice-agentwsoptional
via RT_URL
Persona side-channel — emit emotion/expression events so the VRM avatar reacts to conversation
openalice-voice-agenthttp
via A2A_URL
External A2A endpoint — forward transcribed user utterances and receive LLM reply text
openalice-worldws
via NEXT_PUBLIC_VOICE_URL
WebRTC SFU for spatial voice chat in 3D world rooms via @openalicelabs/voice-client
openalice-worldws
via NEXT_PUBLIC_RT_URL
Server-authoritative real-time state (presence, persona, room entities) via WS delta stream
openalice-worldhttp
via NEXT_PUBLIC_PERSONA_URL
Fetch and update persona profiles (avatar, emotion) displayed in-world

3-hop transitive3

openalice-bluegeniewsoptional
via ANIM_URL
Live VRM pose-frame stream (v2 only; v1 falls back to Mixamo idle loops)
openalice-livehttp
via BROWSE_INTERNAL_URL
Server-side proxy route (/api/browse-session) mints openalice-browse sessions for the in-scene BrowserApp OS window; internal secret stays server-side.
openalice-schedulerhttpoptional
via INTERNAL_SECRET
anim service calls POST /v1/lease + DELETE /v1/lease/{id} to provision and release anim workers.