openalice-llm-router

Valid manifest with clear summary + 10 @feature annotations and a descriptive README, but 95 missing docstrings, roadmap 30/100 and drift 40/100 (stale env declarations) drag in-code/maintenance docs down.

Strong domain controls — GDPR Art 49 consent gating, sovereignty flags, and regulated-sector US-provider blocking all unit-tested; keys via env, but no rate-limit/headers/SSRF guards on outbound provider calls and 6 API-key envs declared-but-unused (incomplete wiring).

9 behavioral tests in one router_test.rs covering the critical paths well — pinned routing+cost, fallback, tenant override, consent block/dispatch, regulated-sector block, allow-list filtering — but thin overall: no adapter/integration tests and provider dispatch appears mocked.

Typed-error paths well covered (unknown-provider, no-default) plus router→tenant fallback tested, but zero evidence of timeouts/retries/graceful shutdown/idempotency on outbound LLM calls — critical gap for a router fanning out to 6 providers; max complexity 16.

No owned tables, no migrations, no schema/RLS/FK artifacts present; tenant isolation exists only at policy level (allow-list + tenant-default override, tested), and the claimed per-tenant×per-provider cost tracker has no visible persistence layer.

No metrics, no tracing, no structured-log signal, and health probe failed (no https endpoint in manifest exposes); cost tracking is business telemetry, not ops observability.