openalice-embed-app

Manifest present and valid (100/100 manifest score from Atlas), but 26 undeclared env vars vs 3 declared-unused shows severe env-contract drift (drift score 0/100); code_health at 70 suggests moderate linting adherence but no inspector AST data to confirm pattern uniformity.

Manifest declares zero owned tables — app is a pure UI shell with no local schema, migrations, RLS, or FK constraints to evaluate; no GDPR data-handling evidence; env drift shows 3 declared-but-unused API base URLs vs 26 undeclared-but-used, indicating unstable data-source wiring.

26 undeclared env vars in use including INTERNAL_SECRET and OPENROUTER_API_KEY with no manifest declaration — secrets leak risk; INTERNAL_BROADCAST_SECRET handled outside manifest; no evidence of rate-limiting, CSP headers, or SSRF guards; health probe returns builder error so auth layer untestable; CI conclusion=failure means security linting (if any) is not passing.

Health probe returns 'builder error' with 0% 24h uptime; latest CI conclusion=failure; no evidence of graceful shutdown, retry logic, circuit breakers, or idempotency; the app is effectively non-functional in its deployed state.

Health probe fails with builder error and null status; NEXT_SSG_FETCH_METRICS env var referenced but no structured logging, tracing, or metrics export evidence; 0% uptime with no alerting signal; no readiness/liveness probes succeeding.

No inspector analysis run so test count is unknown; CI pipeline exists but conclusion=failure — either tests fail or build does not compile; no evidence of test coverage, integration tests, or critical-path regression suites; graded conservatively given zero passing CI.