Atlas
m3/org/openalice-ml-gatewayci ok

openalice-ml-gateway

[Atlas card](https://atlas.blal.pro/repos/openalice-ml-gateway)

Features
10
Status
·unknown
Last activity
1mo ago
Branch
mvp

Architecture rating

★★★☆★☆C-1mo ago
consistency★★★★☆★B

Manifest 100/valid, drift 90, zero circular deps, 0 dead imports, avg complexity 4.52 — strong adoption of shared substrate; minor formatting (23) and 25 missing docstrings.

docs★★★★☆B-

Valid manifest with table ownership + 6 endpoints, AGENTS.md present, 10 @feature annotations (features 100); weakened by a stub README (only Atlas card link) and 25 missing docstrings.

security★★★★☆B-

API-key auth + rate limiting + usage tracking declared in manifest, admin/keys gated, /metrics exposed; but SSRF/injection guards on embed/rerank/NER backend calls and security headers are unverified in evidence.

observability★★★★☆C+

Dedicated GET /metrics (Prometheus) endpoint exposed and CI-verified; tracing and structured-log evidence absent, and health probe fails (no https endpoint in manifest exposes).

data layer★★★☆★☆D

Owns api_keys + usage tables with clean manifest, but NO migrations/ dir in clone and zero evidence of RLS/tenant isolation, FK constraints, or GDPR handling on usage data.

reliability★★★☆☆D

CI green and no cycles, but record_usage is unreferenced (likely dead/unwired usage path), PORT env declared-unused, and no evidence of timeouts/retries/graceful SIGTERM shutdown to upstream embed/rerank/NER backends.

testing★★☆★☆☆F

No tests/ dir present in clone and inspector reports no test count; critical paths (auth, rate-limit, usage accounting) appear untested despite green CI.

source · auto-grader-2026-06-16

Ecosystem manifest

.atlas-deps.yml

ML Gateway — API key auth, rate limiting, and usage tracking in front of embed/rerank/NER backends.

Runtime deps
  • openalice-mlhttp
    via EMBED_SERVICE_URL
    Proxy /v1/embed and /v1/rerank requests to the BGE-M3 embedding + reranker backend
  • openalice-nerhttp
    via NER_SERVICE_URL
    Proxy /v1/ner requests to the GLiNER zero-shot NER backend
Consumed env
  • ADMIN_KEY
  • EMBED_SERVICE_URL
  • NER_SERVICE_URL
  • BACKEND_API_KEY
  • ALICE_ML_KEY
  • KEYS_FILE
  • USAGE_FILE
  • PORT
Exposes
  • http_endpoint: POST /v1/embed
  • http_endpoint: POST /v1/rerank
  • http_endpoint: POST /v1/ner
  • http_endpoint: GET /v1/usage
  • http_endpoint: POST /admin/keys
  • http_endpoint: GET /metrics
Owns tables
  • api_keys
  • usage
Env drift · manifest ⇄ code

Atlas grepped the repo's source for env reads (rust env::var · ts process.env · py os.environ · shell $VAR) and diffed against the manifest's consumes_env. Two lists below: stale declarations and undeclared reads.

Manifest declares, code unused
  • PORT
Observed reads: 7 · declared: 8

Roadmap · what's planned next

5% avg5 goals

Code composition

tokei · loc
927loc
  • Rust95.7%
  • JSON2.4%
  • TOML1.9%
  • Rust95.7%· 887
  • JSON2.4%· 22
  • TOML1.9%· 18
Language% codecodecommentsblanksfiles
Rust95.7%88756931
JSON2.4%22002
TOML1.9%18011
Markdown0.0%093432

Telemetry ribbon · last 90 days

9 events
MAYJUNJUL2026-05-21 · commit · new commit 4a32e34 → 50f16d52026-05-21 · commit · new commit 50f16d5 → 98cfae82026-05-22 · commit · new commit 98cfae8 → 76aeb0c2026-05-24 · kind · kind reclassified · service → infrastructure2026-05-24 · kind · kind reclassified · infrastructure → service2026-05-28 · kind · kind reclassified · service → infrastructure2026-05-28 · kind · kind reclassified · infrastructure → service2026-07-16 · kind · kind reclassified · service → infrastructure2026-07-17 · kind · kind reclassified · infrastructure → serviceNOW
commitmanifestlifecyclekind

ml-gateway/admin

1 feature
  • ml-gateway.keys.create
    src/main.rs:639
    Admin endpoint — issue an API key with per-day request limit and per-month token cap.
    api:POST /admin/keys
    since 0.1.0

ml-gateway/embed

1 feature
  • ml-gateway.embed.proxy
    src/main.rs:700
    Authenticated, rate-limited proxy to the embedding backend (/v1/embed).
    api:POST /v1/embed
    since 0.1.0

ml-gateway/health

1 feature
  • ml-gateway.health.endpoint
    src/main.rs:468
    GET /health probes the embed-rerank and NER backends with a 3s timeout and returns per-service status + gateway uptime — used by Traefik and the docs site status badge.
    api:GET /health
    since 0.1.0

ml-gateway/keys

1 feature
  • ml-gateway.keys.validate
    src/main.rs:8
    SHA-256 hashed API key store — constant-time bearer comparison, per-endpoint permission allowlist on the key, daily reset of request counters at UTC midnight.
    since 0.1.0

ml-gateway/metrics

1 feature
  • ml-gateway.metrics.endpoint
    src/main.rs:519
    GET /metrics emits Prometheus text — uptime + total/active key count + cluster-wide requests/tokens/requests_today; gated by admin key (constant-time hash compare) so SaaS tenants can't enumerate other customers' traffic.
    api:GET /metrics
    since 0.1.0

ml-gateway/ner

1 feature
  • ml-gateway.ner.proxy
    src/main.rs:739
    Authenticated, rate-limited proxy to the NER backend (/v1/ner).
    api:POST /v1/ner
    since 0.1.0

ml-gateway/openapi

1 feature
  • ml-gateway.openapi.spec
    src/main.rs:808
    GET /v1/openapi.json serves the OpenAPI 3.0.3 spec covering /v1/embed, /v1/rerank, /v1/ner, /v1/usage, and /health with BearerAuth security scheme — consumed by client SDK generators + the docs site.
    api:GET /v1/openapi.json
    since 0.1.0

ml-gateway/persistence

1 feature
  • ml-gateway.persistence.background-saver
    src/main.rs:759
    5-second background task — snapshots keys + usage under read-lock, writes JSON to disk without holding any lock, then clears `dirty` only after a successful write so process death never loses a counter increment (crash-safe write-behind cache).
    since 0.1.0

ml-gateway/rerank

1 feature
  • ml-gateway.rerank.proxy
    src/main.rs:716
    Authenticated, rate-limited proxy to the reranker backend (/v1/rerank).
    api:POST /v1/rerank
    since 0.1.0

ml-gateway/usage

1 feature
  • ml-gateway.usage.report
    src/main.rs:601
    Per-key usage report — requests today + tokens this month vs configured caps.
    api:GET /v1/usage
    since 0.1.0