openalice-passport

Uniform adoption of openalice-axum-common: AuthUser/JwtVerifier, CORS, rate_limit, security_headers, normalize_errors, http_metrics, tracing init, shutdown_signal, internal_client. Middleware stack order documented as identical to vault/tenants. RLS owner-context pattern (with_owner_context + SET LOCAL) matches vault. Canonical JSON + BLAKE3 ported verbatim from vault (documented byte-identical). Same cargo-deny + Docker BuildKit pattern. Minor: dual error types (AppError in error.rs + ApiError in api/mod.rs); 4 god modules flagged by inspector.

40 tests across 7 modules: 13 VC crypto tests covering every tamper vector (subject id, component, manifest_hash, provenance, vault_version, issuer, proof metadata, wrong key, missing proof) + determinism + JSON roundtrip; 4 DB-gated acceptance tests (full issue→verify→revoke lifecycle, RLS cross-owner isolation, unknown-id 404, tampered-stored-credential detection); 4 router wire tests (auth gating on issue/revoke, public verify reachability, health mount); 6 boot-guard tests; 6 signing tests incl. 0600 keyfile enforcement; 4 canon tests (float rejection, BLAKE3 stability). No coverage metrics; CI status unknown.

Single clean migration with CHECK constraint on component enum; 3 RLS policies (public SELECT USING(true), owner INSERT WITH CHECK, owner UPDATE USING+WITH CHECK) correctly model asymmetric trust; idempotent FORCE RLS toggle helpers; with_owner_context uses SET LOCAL (tx-scoped, no pool leakage); UUIDv7 PKs; indexes on identity_id + owner_user_id; revoked_at nullable pattern. No FKs (documented intentional denormalization). No GDPR purge mechanism visible; manifest_owns_tables empty in Atlas.

Graceful shutdown via axum with_graceful_shutdown(shutdown_signal()) on SIGTERM; pool acquire_timeout 5s with 4..20 connections; idempotent RLS toggle + idempotent revocation (re-revoke returns false, not error); boot-guard pattern: missing signing key → 503 for passport ops while /health stays up; kill switch (off/on/shadow) for incident-response hard stop. No circuit breaker, no retry logic, no per-request timeout middleware visible.

Prometheus recorder installed at boot with /metrics endpoint; track_http_metrics middleware on all routes; init_tracing with EnvFilter + OTEL guard; TraceLayer (INFO spans); propagate_incoming for distributed trace context; structured tracing::info/warn/error throughout (key fingerprint, RLS state, rate limit config at boot); /health returns JSON with deps.postgres status. No domain-specific counters (passports_issued_total, verifications_total); no readiness vs liveness distinction.

Extensive in-code architecture docs: every module has //! doc blocks explaining the trust model, signed surface recipe, and RLS asymmetry; migration file heavily commented with policy rationale; Cargo.toml annotates every dep group (security justification for sqlx default-features=false); deny.toml thoroughly commented; @feature annotations in lib.rs + main.rs. No README (Atlas readme_excerpt empty); no manifest file (manifest_present=false); no OpenAPI spec; no CHANGELOG.