openalice-agent-protocol

Strong substrate adoption — valid .atlas-deps.yml, AGENTS.md, @feature blocks, drift 100, code_health 100, avg complexity 1.08; one tools→events→tools circular dependency and 5 god-modules are the only uniformity blemishes in an otherwise clean, convention-following package.

17 tests across 3 files (protocol 7, cooldown 6, perception 4) under vitest covering the core contract, cooldown middleware, and perception split — solid for the surface area, but no tests exercise RestAgentRuntime's fetch/stream-parsing path, the riskiest code.

Owns zero tables (manifest_owns_tables empty), no migrations or persistence — N/A by design; graded conservatively since the only 'schema' is the TS type contract, which is well-typed but carries no DB/RLS/GDPR concerns to evaluate.

Wire-contract lib with no authn/secrets surface of its own; RestAgentRuntime passes caller-supplied Authorization headers verbatim and uses an injectable fetch with no URL/SSRF validation, no timeout, and no scheme allowlist — fine for a contract package but no input hardening exists.

RestAgentRuntime does a network fetch with NO timeout/AbortController, no retry, and 1 broad/bare except flagged by inspector; cooldown middleware adds backpressure but stream-collapse error handling is thin — acceptable for a thin client, but no graceful-failure guarantees.

No metrics, tracing, structured logging, or health probes (Atlas health: 'no https endpoint' — none expected for an npm lib); zero console statements, so the package emits nothing observable by design — graded conservatively as absent.