openalice-app

BFF correctly owns zero tables (manifest_owns_tables=[]) and proxies to backend APIs—appropriate architecture; however no schema validation layer (e.g. zod) is evidenced for API responses, and env-drift shows undeclared runtime vars suggesting config-as-data is loosely managed.

23 test files covering API clients (polls, youtube, audio, sounds, ai-mod, lounge, etc.) plus 1 component test (ConfirmDialog); e2e/ directory with Playwright config exists but no passing CI to confirm green suite; for 126 features and 52 god modules, critical-path coverage is thin—no auth flow, OAuth callback, or error-boundary tests visible.

Zero circular deps is clean, but 52 god modules, 359 format issues, 16 duplicate function signatures, 37 dynamic imports, and 18 missing React key props indicate inconsistent code conventions; eslint config exists but format violations suggest it is not enforced in CI (which is itself failing).

Health probe live and responding (200/25ms, 100% uptime_24h); no evidence of structured logging, distributed tracing, or exported metrics; only 1 console statement found suggesting minimal runtime instrumentation for a 126-feature app.

YouTube OAuth flow and 4 REST API surfaces exposed with zero evidence of rate-limiting, CSRF tokens, or security headers; 44 bare/broad excepts risk swallowing auth failures; 2 undeclared env vars (NEXT_PUBLIC_API_URL) leak build-time config assumptions; no security-focused tests visible.

44 bare/broad excepts swallow errors indiscriminately; max cyclomatic complexity 72 with 8 deep-nesting sites create fragile control flow; CI pipeline is failing (conclusion:failure 2026-06-26); no evidence of graceful shutdown, retry logic, or circuit breakers; 100% uptime and 25ms health latency are positive but insufficient without error-handling discipline.