openalice-canary

Manifest present and valid (100/100 in Atlas); follows shared eval contract for result JSON; but 17 missing type hints, 8 missing docstrings, 1 god module, and 9 undeclared env vars show poor adoption of project conventions; Atlas drift score 10/100 confirms significant divergence from substrate norms

5 bare/broad excepts suppress real failures; no evidence of graceful shutdown, timeouts, retries, or idempotency; max cyclomatic complexity 13 in a god module suggests monolithic error-prone flow; FLEET_LOOP_THRESHOLD/FLEET_RESTART_THRESHOLD env vars hint at restart logic but undeclared and unvalidated

9 undeclared env vars (CANARY_ORIGIN, CANARY_PROMPT, etc.) with no .env schema or secret-handling layer; no authn/authz on the canary itself; 5 bare/broad excepts risk swallowing injection or SSRF errors silently; no evidence of input sanitization on CANARY_PROMPT before use

5 console.log statements are the only output mechanism; no structured logging, no metrics export, no tracing, no health probe (Atlas confirms 'no https endpoint in manifest exposes', up=false); canary result JSON is the sole observable artifact

No database, no migrations, no schema; writes a flat JSON file to /home/blal/shared/eval/canary.json with no FK constraints, no tenant isolation, no GDPR controls; eval_history.py likely appends without rotation beyond EVAL_GZIP_AGE_DAYS env var

Zero test files detected in repo structure; the canary IS a test harness for other services but has no tests for its own logic (fleet_scan, eval_history, prompt handling); complexity-13 god module and 3 source files with no self-test coverage