Atlas
m4/org/openalice-registry

openalice-registry

Features
9
Status
·unknown
Last activity
1mo ago
Branch
main

Architecture rating

★★★☆☆D1mo ago
consistency★★★★☆B-

Strong substrate adherence: valid manifest (100), code_health 100, drift 100, zero cycles, zero dead imports, AGENTS.md present and standard Cargo layout — uniform with OpenAlice conventions; minor demerit for one god-module breaking the otherwise clean structure.

docs★★★☆★☆C

Valid manifest with clear summary and 9 features (features 92/100), AGENTS.md present, and @feature annotations drive a 91 overall grade — but README excerpt is empty, 11 missing docstrings/format issues, and roadmap is the named weakest axis (30/100).

reliability★★★☆★☆D

Clean AST (0 circular deps, 0 bare/broad excepts, avg complexity 5.09) is a good base, but one god-module and a max-complexity-18 hotspot concentrate risk; no evidence of request timeouts, retries, graceful SIGTERM shutdown, or idempotent publish handling for an HTTP service.

security★★★☆☆D

Pack-marketplace HTTP service exposing /api/v1/* for publishing/downloading WASM packs — a prime SSRF/upload-abuse/supply-chain surface, yet manifest declares 0 runtime deps and no evidence of authn/authz, signature verification, rate-limiting, or SSRF guards; conservative score given no observable security signal for a download/upload registry.

data layer★★★☆☆D

manifest_owns_tables is empty and no migrations/ dir present — registry appears to persist packs without a declared schema, FK/constraints, RLS or tenant isolation; no GDPR signal. Conservatively weak: data layer is either ad-hoc/filesystem or undisclosed.

observability★★☆★☆☆F

Manifest exposes only an http_endpoint with no https health probe (Atlas health: 'no https endpoint in manifest exposes', up=false); no declared metrics, tracing, or structured-log signal — service is effectively unprobed/unmonitored.

testing★★☆☆☆F

No tests/ directory and no test presence detected in the clone; inspector surfaces a max-complexity-18 hotspot and a god-module with zero covering tests — critical publish/download paths are unverified.

source · auto-grader-2026-06-16

Ecosystem manifest

.atlas-deps.yml

OpenAlice Pack Registry — HTTP marketplace for publishing and downloading WASM packs.

Consumed env
  • REGISTRY_DATA_DIR
Exposes
  • http_endpoint: http://openalice-registry:8102/api/v1/*

Code composition

tokei · loc
327loc
  • Rust95.4%
  • TOML4.6%
  • Rust95.4%· 312
  • TOML4.6%· 15
Language% codecodecommentsblanksfiles
Rust95.4%31218411
TOML4.6%15011
Markdown0.0%0831

Telemetry ribbon · last 90 days

1 event
MAYJUNJUL2026-06-10 · lifecycle · first scan — repo indexedNOW
commitmanifestlifecyclekind

registry/api

2 features
  • registry.api.health
    src/main.rs:150
    GET /api/v1/health — liveness probe returning service identity + version.
    route:GET /api/v1/health
    since 0.1.0
  • registry.api.stats
    src/main.rs:160
    GET /api/v1/stats — aggregate pack count + total download count across the registry.
    route:GET /api/v1/stats
    since 0.1.0

registry/config

1 feature
  • registry.bin.entrypoint
    src/main.rs:418
    REGISTRY_DATA_DIR env var selects the on-disk root for pack JSON + .wasm blobs; auto-created at boot, defaults to $HOME/.openalice-registry.
    bin:openalice-registry
    since 0.1.0

registry/model

1 feature
  • registry.service.http-api
    src/main.rs:13
    Pack metadata schema — name, version, author, pack_type, tags, tools, wasm_size, downloads, rating, signed flag.
    bin:openalice-registry
    since 0.1.0

registry/packs

4 features
  • registry.packs.download
    src/main.rs:234
    GET /api/v1/packs/{name}/{version}/download — stream the .wasm blob for a specific version; bumps the pack's download counter on success.
    route:GET /api/v1/packs/{name}/{version}/download
    since 0.1.0
  • registry.packs.get
    src/main.rs:216
    GET /api/v1/packs/{name} — fetch pack metadata + all ratings for a single pack; 404 if unknown.
    route:GET /api/v1/packs/{name}
    since 0.1.0
  • registry.packs.rate
    src/main.rs:373
    POST /api/v1/packs/{name}/rate — submit a 1-5 score with optional review; recomputes pack's rolling average rating + rating_count and persists metadata.
    route:POST /api/v1/packs/{name}/rate
    since 0.1.0
  • registry.packs.search
    src/main.rs:183
    GET /api/v1/packs — list/search packs with full-text filter on name+description, tag filter, sort by name/downloads/rating/newest, configurable limit.
    route:GET /api/v1/packs
    since 0.1.0

registry/security

1 feature
  • registry.packs.publish
    src/main.rs:273
    Optional detached signature upload alongside .wasm — stored as `{version}.wasm.sig`, surfaced via PackMeta.signed flag. Verification not yet enforced server-side.
    route:POST /api/v1/packs
    since 0.1.0