openalice-vault

5-table schema with FK constraints (vault_versions/dek_meta/consent_records → identities), CHECK constraints on subject_kind + status enums, UNIQUE (identity_id,version); RLS owner policies on all 5 tables with idempotent FORCE toggle helpers and NOSUPERUSER/NOBYPASSRLS prerequisite documented; owner_user_id denormalized onto every child (no JOIN for policy eval); crypto-shred = NULL wrapped_dek + shredded_at + zero-overwrite blob delete (GDPR erasure); versioned migrations (0001_init + 0002_audit_signed_at binding timestamp into signed surface); UUIDv7 PKs.

~63 tests (55 inline unit + 8 DB-gated acceptance): crypto paths deeply covered (seal/open roundtrip, AAD-transplant rejection at both DEK-wrap and bundle-seal layers, tampered ciphertext, wrong key, nonce uniqueness); audit hash-chain tested for valid/tampered-core/tampered-timestamp/removed/reordered/forged-key; acceptance tests cover full seal→verify→shred lifecycle, RLS cross-owner isolation (alice vs mallory), version chaining with parent_hash, revoke-without-erasure, mandate-gated instantiation; boot-guard + vault-mode unit tests. Gap: no HTTP-level handler integration tests (api/mod.rs handlers untested at the HTTP boundary), acceptance gated behind TEST_DATABASE_URL.

Shares openalice-axum-common for CORS, rate-limit (TenantRateLimit), AuthUser/JwtVerifier, tracing init, HTTP metrics, security-headers, normalize_errors, shutdown, internal_client — mirrors openalice-tenants skeleton explicitly; consistent middleware layer ordering documented in router.rs; uniform {error:{code,message}} envelope; rustls-only posture (sqlx + reqwest); cargo-deny with org-standard config. Gaps: 85 missing docstrings, 7 god-module flags, duplicate error types (api::ApiError vs error::AppError both do status→JSON mapping).

Prometheus /metrics endpoint with HTTP latency+count middleware (bounded cardinality via MatchedPath); /health returns 200/503 with dep status JSON (postgres: ok/down); structured tracing with env-filter + OTEL span export when OTEL_EXPORTER_OTLP_ENDPOINT set; W3C traceparent propagation (propagate_incoming); INFO-level request spans. Missing: no custom business metrics (seal/shred counts), health probe doesn't report crypto subsystem readiness, no separate readiness vs liveness probe.

Graceful shutdown via with_graceful_shutdown(shutdown_signal()); pool acquire_timeout 5s (4..20 conns); boot-guard pattern — absent signing key or master key degrades to 503 on identity endpoints while /health stays live; kill switch (off/on/shadow) for incident response; blob write-before-insert prevents dangling rows; SET LOCAL tx-scoped owner context never leaks across pooled connections; idempotent RLS toggle. Gaps: no retry/backoff on transient DB errors, no explicit request-level timeout, no idempotency keys on create/seal (client retry could duplicate).

Excellent inline module docs (//! blocks on every module explaining purpose, security invariants, Alex §13 decisions, milestone scope); 2 @feature annotations (rate-limit, identity-custodian); migrations carry detailed schema/RLS design comments; cargo-deny thoroughly commented. Gaps: no README (Atlas readme_excerpt empty), no OpenAPI/Swagger spec, 85 missing function-level docstrings per inspector, only 2 registered features vs the full lifecycle surface, no architecture diagram.