openalice-stream-host

Valid manifest (100) with rich @feature annotations (59, features 100), AGENTS.md and docs/ dir present — but README is a stub (just an Atlas-card link) and 138 missing docstrings weaken in-code architecture notes.

CI green and clean module graph (0 cycles), but max cyclomatic complexity 124 in a god-module and 17 god-modules total signal fragile encoder-selection paths; no visible RTMP reconnect/retry, timeout, or graceful-shutdown evidence for a long-running streaming process.

Desktop Tauri thin-client with small attack surface, but RTMP stream-key/secret handling unverified and INTERNAL_BROADCAST_SECRET is declared-yet-unused (env drift) — no evidence of injection/SSRF guards or hardened secret storage; graded conservatively on absent signals.

Owns zero tables, no migrations, no RLS/FK/constraints — by-design for a local GPU encoder client, so no persistence/GDPR surface to evaluate; scored low for absence rather than defect.

No HTTPS/health endpoint (manifest exposes only binaries), so no probes/metrics/tracing by nature; structured-logging quality unknown and unverified — graded conservatively as effectively absent.

No tests/ directory detected in clone and inspector reports no test count for 59 features incl. cross-platform encoders (NVENC/QSV/VideoToolbox/VAAPI/x264) — critical streaming paths appear untested.