openalice-tts

Uniform adapter pattern (new→with_*→config→TTSProvider impl) across all 4 adapters, mirrors openalice-llm-router+openalice-stt shapes exactly (Sovereignty/Sector/TenantPolicy/CostEvent), @feature annotations on every module, wiremock for all adapter tests, openalice-axum-common shared — but 69 missing docstrings and 9 god-module flags from inspector.

Thorough README (architecture, emotion-tag table, adapter matrix, conventions), VOICE_CATALOG.md with root-cause analysis + systematic-fix recommendations, @feature annotations on every public surface, Cargo.toml fully populated (license/repo/description) — but inspector flags 69 missing docstrings across the crate, no rustdoc beyond struct/trait headers.

GDPR Art 49 consent gating per modality (consent_us_tts), sovereignty enforcement with regulated-sector block, tenant allow-list, input validation (empty+oversized text pre-network), rustls-only, API keys from env — but 3 undeclared env vars (FISH_AUDIO_API_KEY, MISTRAL_API_KEY, OPENROUTER_API_KEY) in Atlas drift, no rate-limit logic (library, but still unguarded), no SSRF guard on configurable base_url.

30s HTTP timeout on every adapter, is_retryable() classifies 500/408/425/429 correctly, input validation rejects oversized text before network — but no retry/circuit-breaker logic, no graceful stream-abort cost attribution (CostEvent only fires on SynthChunk::Done), no backpressure on upstream.

LoggingTracker emits structured tracing::info with tenant/provider/model/voice/characters/cost/latency per call — but no prometheus metrics, no distributed tracing spans on synth calls, no health probe endpoint (Atlas confirms 'no https endpoint in manifest exposes'), latency_ms recorded but not histogrammed.

Library crate owns zero tables (manifest_owns_tables=[]), no schema/migrations/RLS to evaluate; GDPR consent gating exists in router logic but no data-erasure or retention lifecycle — cost events are emitted via trait but persistence is entirely external.