openalice-ranker

Zero circular deps, valid manifest (100/100), drift 90, uniform collector/registry/utils layout following org conventions; minor erosion from 5 dead imports and 14 unreferenced definitions.

~15 test modules covering collectors, registry, priority_scorer, reports, cli, dashboard, analysis, git and yaml_io — broad critical-path coverage; docked for 5 dead test imports and no reported coverage %.

5 bare/broad excepts swallow errors and no evidence of network timeouts/retries on git clone or HTTP collectors; CollectionStatus model suggests some state tracking, but no idempotency or graceful-shutdown signals — conservative given unknowns.

CLI tool with no authn/authz surface, but clones rival repos + fetches arbitrary websites (SSRF/command-injection surface in git_clone_shallow/WebsiteCollector) with no visible guards; GITHUB_TOKEN declared-but-unused (env drift) and 5 bare/broad excepts mask failures.

No relational DB — owns 0 tables, uses YAML/file registry (load_meta/save_meta) with no migrations, constraints, RLS or GDPR controls; acceptable for a file-based tool but the axis signals (schema/FK/tenant isolation) are essentially absent.

54 console/print statements instead of structured logging; no metrics, tracing, or health probes (Atlas health probe fails — no https endpoint, expected for a CLI), so operational visibility is print-only.