openalice-live-control

Clear strength: dedicated src/recovery module with watchdog + startup recovery to keep broadcaster/chat-bridge container pairs alive, 100% 24h uptime and healthy probe — but max complexity 54 and 8 god modules concentrate risk, and graceful SIGTERM shutdown/idempotency on /live/start are unconfirmed.

Valid manifest (100/100) with accurate summary, README with clear excerpt, AGENTS.md and a docs/ dir, plus 4 @feature annotations — but 144 missing docstrings across the source mean in-code/architecture documentation is thin.

TENANT_RATE_LIMIT_PER_MINUTE shows per-tenant rate limiting wired, and /internal/agent/* endpoints imply an internal trust boundary; but CORS_ALLOWED_ORIGINS is declared-yet-unused (CORS likely unenforced) and there's no visible authn/authz or SSRF guard on a service that spawns user-scoped containers and calls BROWSE_URL/PTY_URL — high-risk surface graded conservatively.

Owns broadcasts table with two split DBs (BROADCASTS_DB_URL, CHAT_BRIDGE_DB_URL) and migrations present, but inconsistent numbering (0001_broadcasts.sql vs 001_operational_broadcasts.sql) signals migration drift, and despite per-tenant rate limiting there is no evidence of RLS/tenant isolation, FK constraints, or GDPR handling.

Clean AST (0 cycles, 0 dead imports, code_health 100) but drift scores 0/100 — the repo's weakest axis: 13 used-but-undeclared env vars, 2 declared-unused, duplicate migration numbering and 7 duplicate signatures undercut uniform manifest/convention adoption.

No test directory or test files surfaced in the clone (only migrations present) and inspector reports no test count — a container-spawning control plane shipping with no visible automated tests or SSRF/idempotency regressions; graded as effectively absent.