openalice-axum-common

Provides JWT (jsonwebtoken) and reqwest plumbing but no evidence of SSRF guards, rate-limit middleware, or security-header defaults; cargo deny.toml present for supply-chain audit which is a positive signal; 7 declared-but-unused env vars (INTERNAL_SECRET, SSO_COOKIE_DOMAIN, etc.) suggest dead auth config paths.

README exists but is a one-line frozen notice; AGENTS.md present; manifest valid with summary; no @feature annotations, no in-code architecture docs, no usage examples for consumers; roadmap 30/100 from Atlas confirms thin documentation.

No visible timeout wrappers, retry policies, or structured error types exported for consumers; as a shared reqwest/axum adapter library these would be high-value; 1 star import is cosmetic; frozen status means no active reliability hardening.

No tables owned, no migrations, no schema — entirely N/A by design as a pure library crate, but the axis is therefore absent, not satisfied.

No tracing layer, no metrics export, no health-probe helper exposed; library provides no observability primitives for downstream services to inherit — a missed opportunity for a shared substrate crate.

No tests directory in repo structure; zero test files visible; for a shared auth/JWT/reqwest library this is a critical gap — any regression here cascades across all downstream services.