Review: var.services entry for notion-mcp-remote (ArgoCD discovery)

Verdict: NEEDS_REFINEMENT

Template Completeness

• [x] Type (Feature)
• [x] Lineage (standalone, scoped from project-notion-mcp-remote)
• [x] Repo (forgejo_admin/pal-e-services)
• [x] User Story
• [x] Context (detailed, includes key values)
• [x] File Targets
• [x] Acceptance Criteria
• [x] Test Expectations (with run command)
• [x] Constraints
• [x] Checklist
• [x] Related

Traceability

• [x] story:ops-deploy-gitops label -- maps to story-notion-mcp-remote-ops-deploy-gitops
• [x] story note verified -- listed in project-notion-mcp-remote user-stories table (AC: "pal-e-services var.services entry landed via PR")
• [x] arch:argocd label -- component: ArgoCD (entry drives ArgoCD Application discovery)
• [ ] arch note MISSING -- [SCOPE] No arch-argocd note exists in pal-e-docs. search_notes(query="arch-argocd") returned zero results. Create arch-argocd describing ArgoCD's role as the GitOps sync engine for pal-e services (driven by argocd_application.service in terraform/services.tf).
• [x] Forgejo issue -- forgejo_admin/pal-e-services#57, open

File Targets

• [x] terraform/k3s.tfvars -- verified path. File is gitignored (per repo .gitignore: *.tfvars excluded, only *.tfvars.example tracked). This is expected: sop-platform-tf-changes documents pal-e-services as "plan-and-apply-before-merge" with k3s.tfvars edited locally. Agent must have local k3s.tfvars available.
• [ ] terraform/services.tf -- [BODY] imprecise. Issue says "Possibly terraform/services.tf -- if the module signature needs adjustment to pass funnel=true". This is not needed. services.tf already handles per-service funnel via kubernetes_ingress_v1.service_funnel with for_each = { for k, v in var.services : k => v if v.funnel }, and variables.tf already exposes funnel = bool in the var.services object type. Remove the speculative "possibly services.tf" bullet -- it's already supported. A dev agent could burn time "inspecting" a file that needs no change.

Repo Placement

Dependencies

• Upstream (blocking): forgejo_admin/pal-e-deployments#132 -- kustomize overlay at overlays/notion-mcp-remote/prod. Currently OPEN, board item #1044 in backlog. Ticket correctly documents this ("Sibling overlay PR on pal-e-deployments must land first"). ArgoCD sync will fail if the overlay path doesn't exist in the pal-e-deployments repo on the branch referenced by target_revision = main.
• Downstream: forgejo_admin/pal-e-platform#296 (tofu apply to provision) -- board item #1045 in backlog. Ticket does not name this explicitly, but it is implied by "PR reviewed and merged" -- the actual tofu apply against infrastructure is a separate board item handled after this PR lands. [BODY] optional: add an explicit "Downstream: pal-e-platform#296 handles the tofu apply" bullet to Related for dev-agent clarity, since this ticket's AC includes "tofu plan" but not "tofu apply" (the SOP requires manual apply-before-merge on pal-e-services).

Schema precision issues (BODY fixes)

• [BODY] source_repo value is underspecified. Issue body says source_repo: pal-e-deployments. Verified against variables.tf (variable "services" schema) and services.tf (coalesce(each.value.source_repo, each.value.forgejo_repo) interpolated as http://forgejo-http.forgejo.svc.cluster.local/${source_repo}.git), plus the k3s.tfvars.example example which uses forgejo_admin/pal-e-deployments in forgejo_repo. The value MUST include the forgejo_admin/ owner prefix: source_repo = "forgejo_admin/pal-e-deployments". Without the prefix, ArgoCD will attempt to sync from an invalid URL forgejo-http.forgejo.svc.cluster.local/pal-e-deployments.git and fail. Fix in issue body.
• [BODY] Clarify workflow expectation. Per sop-platform-tf-changes, pal-e-services uses plan-and-apply-before-merge (manual tofu apply), not CI-driven apply-on-merge (which is the pal-e-platform pattern). The ticket's AC "tofu plan ... no unexpected diff" + "PR reviewed and merged" is correct, but the agent needs to know the apply is manual and happens BEFORE PR merge. Add a sentence to Constraints: "pal-e-services uses plan-and-apply-before-merge per sop-platform-tf-changes -- do NOT rely on CI apply; a human operator runs tofu apply -lock=false -var-file=k3s.tfvars after plan review."

Acceptance Criteria

• AC1 (entry present) -- grep-verifiable.
• AC2 (plan diff shows expected resources) -- runnable; the expected resource list is explicit (ArgoCD Application, namespace, Harbor project + robots, image pull secret, Tailscale Funnel ingress). Matches services.tf resources exactly.
• AC3 (values match pre-deploy-validation checklist rows) -- references service-onboarding-sop (slug not found via search_notes; may live under a different slug but is referenced consistently across platform docs -- treat as present).
• AC4 (PR reviewed and merged) -- process criterion, verifiable via PR URL.

Blast Radius

Decomposition Assessment

Recommendation

• [BODY] Fix source_repo value: pal-e-deployments -> forgejo_admin/pal-e-deployments (full owner/repo form; required by services.tf URL construction).
• [BODY] Remove the "Possibly terraform/services.tf" speculation under File Targets. The module already supports per-service funnel=true; no module adjustment is needed. Replace with explicit "File Targets: terraform/k3s.tfvars only" to prevent the agent from opening/editing services.tf.
• [BODY] Add workflow clarification to Constraints: pal-e-services uses plan-and-apply-before-merge (manual tofu apply), not CI-driven apply-on-merge. Reference sop-platform-tf-changes.
• [BODY] Add a "Blast Radius" note: verify tofu plan diff is isolated to new notion-mcp-remote resources only; if other services' resources show drift, stop and escalate (reference review-1064-2026-04-20).
• [SCOPE] Create architecture note arch-argocd describing ArgoCD's role in the platform (GitOps sync engine, argocd_application.service per-service via pal-e-services Terraform, Image Updater write-back pattern). Without this note, the arch:argocd label points to a missing document -- same pattern as the missing arch-tailscale-funnel gap flagged in review-788-2026-04-03.

Once refinements land