openalice-inspector

12 test files covering scanners, security, SARIF, call-graph, feature-ops, parallelism, caching, and detection — reasonable breadth for a CLI tool; but 3 test files have unused pytest imports (test_advanced_analysis, test_orphan_verbs, test_call_graph) suggesting placeholder or incomplete tests; no CI status available (latest_ci='?'); no coverage metric reported.

Valid manifest (100/100), zero circular dependencies, and 23 features suggest decent module structure; however 10 dead imports and 58 unreferenced definitions (god-module-scale dead code in call_graph, formatter, quality checks) show poor pruning discipline; code_health only 30/100 in Atlas.

No evidence of graceful shutdown, timeouts, retries, or idempotency; CLI tool with no error-recovery patterns visible; 58 unreferenced definitions suggest significant dead code paths that could mask runtime failures; no health endpoint (Atlas confirms 'no https endpoint').

CLI tool with no authn/authz surface, but SECURITY_AUDIT_REPORT.md exists suggesting awareness; no evidence of input-sanitization on file paths fed to tree-sitter, no rate-limiting (N/A for CLI), no secret handling visible — low risk surface but no defensive guards either.

No metrics, no tracing, no structured logging evident; Atlas health probe fails with 'no https endpoint in manifest exposes'; CLI tool with no --verbose/--debug flag evidence in provided signals; zero observability infrastructure.

manifest_owns_tables is empty, no migrations directory, no database interaction at all — pure stateless CLI; axis is essentially N/A but scored conservatively per instructions.