openalice-live-broadcaster

Strong org-substrate adoption: valid manifest (100/100), drift 100, @feature blocks on Dockerfile + entrypoint, AGENTS.md + .atlas-deps.yml convention, uniform OA_-prefixed env config — but inspector found no analyzable source to confirm code-level patterns.

`set -euo pipefail` + fail-fast exits (2/3) and `exec ffmpeg` so SIGTERM reaches the encoder; pulse readiness retry loop (30×0.2s). Weak spots: no trap/cleanup for orphaned Xvfb/Chromium/Pulse children, fixed `sleep 5`/`sleep 1` instead of readiness checks, no curl retry, recovery delegated entirely to compose restart policy.

Internal call gated by X-Internal-Secret header + required-env validation (exits 2 if OA_USER_ID/OA_INTERNAL_SECRET unset) and Chromium dropped to non-root uid 1000; but `--no-sandbox` Chromium, plaintext stream keys fetched then embedded in the ffmpeg `tee` arg (leak via `ps`/process table), `curl -sf … || true` swallows auth failures, scene token passed in URL, and no TLS verification hardening — moderate posture for an internal one-shot.

Stateless one-shot container — owns zero tables, no migrations, no schema/FK/RLS (manifest_owns_tables empty); appropriately stateless so no isolation risk, but nothing to credit either, graded conservatively as N/A-for-data.

Only unstructured `[broadcaster]` echo lines + ffmpeg loglevel=warning; no metrics, no tracing, no health probe (Atlas health: 'no https endpoint in manifest exposes', up=false), no structured/JSON logs — near-blind at runtime.

No tests of any kind — no test dir, no CI signal (latest_ci '?'), inspector found no analyzable source; shell pipeline (jq parsing, tee-string build, env handling) entirely unverified.