openalice-stt

Clean trait-based substrate (single STTProvider trait + per-adapter impls), zero circular deps, 0 dead imports, valid manifest (100) and CI green — but env drift (30/100): undeclared keys used + stale declared keys signals config conventions not kept uniform.

7 focused tests in router_test.rs cover the critical routing paths (pinned-provider+cost record, default fallback, typed errors, US-consent gate, regulated-sector block) but there are zero adapter-level or streaming/blob integration tests and no coverage instrumentation.

Per-tenant sovereignty policy enforced (US-provider-needs-consent + regulated-sector hard-block verified in tests), but secret handling drifts: MISTRAL_API_KEY/OPENROUTER_API_KEY used yet undeclared while 4 declared keys are unused; no rate-limit, no SSRF guard on self-hosted Whisper.cpp URL, no auth/header layer (router exposes no endpoint).

Typed errors on unknown-provider/no-default and router-default fallback path are tested, and code is shallow (avg complexity 1.84, max 9, 0 bare excepts), but no evidence of per-provider timeouts, retries/backoff, graceful shutdown, or idempotency on external STT calls — the dominant reliability risk for a multi-vendor router.

Owns no tables and ships zero migrations; per-tenant cost attribution exists only in-memory with no schema, FK/constraints, RLS or GDPR/retention handling — tenant isolation is policy-code, not data-layer enforced.

Health probe fails (no https endpoint in manifest exposes); no metrics, tracing, or structured-log signal surfaced — only the per-provider×tenant cost tracker serves as ad-hoc telemetry. Graded conservatively as observability is largely unknown/absent.