openalice-agent-lite

EMBED_SIGNING_SECRET and TURNSTILE_SECRET declared but unused (captcha/signature verification unwired); EMBED_RATE_LIMIT_PER_MIN declared unused suggesting rate-limiting is dead code; 14 env vars used but undeclared including OA_SECRETS_MASTER_KEY and INTERNAL_SECRET — secret surface is unauditable with this drift level

Three separate DB URLs (DATABASE_URL, RAG_DATABASE_URL, VISITOR_DB_URL) with zero owned tables declared in manifest — schema ownership is invisible; no evidence of migrations, RLS, FK constraints, or GDPR controls in any available signal

CI conclusion is 'failure' (run 2026-06-26); no health endpoint exposed (probe error: 'no https endpoint in manifest exposes'); AGENT_LITE_BRAND_KB_FETCH_TIMEOUT_MS declared but unused suggesting timeout config is dead; no evidence of graceful shutdown or idempotency

Drift score 0/100 (Atlas weakest axis); 9 declared-unused + 14 undeclared-used env vars = manifest completely out of sync with runtime; code_health 30/100 indicates conventions are not followed

Health probe unreachable — manifest exposes zero https endpoints; no evidence of structured logging, metrics, or tracing in any available signal; code_health 30/100 further suggests instrumentation is absent

Inspector not run so no test count available; CI is failing with immediate exit (started/finished within 6 seconds) suggesting tests either don't exist or don't compile; no evidence of any test coverage