openalice-relay

Valid manifest (100/100) with clear summary, AGENTS.md and 8 @feature annotations present, but README excerpt is empty and 7 definitions lack docstrings — manifest-strong, prose-light.

Outbound-only Telegram relay (1 runtime dep, no exposed HTTP surface) limits attack surface, but no visible secret-handling, token-scoping, or rate-limit evidence — bot token presumably via env, unverified; graded conservatively on absent signals.

Polling loop with max complexity 17, one god module and 3 deep-nesting sites; CI green but no observable signal for poll timeouts, retry/backoff, or graceful SIGTERM shutdown — core reliability concerns for a long-running poller unverified.

Stateless relay owns zero tables and ships no migrations — appropriate for the design, but there is no schema/constraint/RLS engineering to credit, so the axis is essentially N/A and scored as absent.

Declared RUST_LOG is unused (env drift) and health probe fails (no HTTPS endpoint in manifest) — no metrics, tracing, or working health probe; logging appears wired but under-used.

No tests/ directory and no test signal in inspector AST output for the relay loop or A2A parsing — critical poll/forward path appears entirely untested despite passing CI.