Review: S1 — pal-e-services: add westside-streamlit to var.services (round 2)

Verdict: APPROVED

Round 1 Findings Resolution

• [x] Reference services fixed — body now references westsidekingsandqueens (k3s.tfvars line ~225, the live funnel = false precedent) and basketball-api (k3s.tfvars line ~209, alternate shape) with explicit warning "do NOT copy that field from here" for basketball-api's funnel = true. The non-existent westside-contracts and pal-e-dora-exporter references are gone.
• [x] funnel = false AC pinned — AC bullet 3 now reads: "funnel = false — the overlay's ingress.yaml already provides the Tailscale ingress; setting funnel = true would create a duplicate kubernetes_ingress_v1.service_funnel (dead-address class warned at services.tf:171-175) AND violate feedback_funnel_requires_auth." AC bullet 6 verifies tofu plan does NOT show creation of kubernetes_ingress_v1.service_funnel["westside-streamlit"].
• [x] forgejo_repo AC pinned — AC bullet 4 now reads: "forgejo_repo = "forgejo_admin/westside-streamlit" — the schema requires this field with no default (variables.tf:168); copy-from-westsidekingsandqueens MUST override this (that points at forgejo_admin/westside-app)."
• [ ] [SCOPE] arch-services-tf note still missing — search returned no results for arch-services-tf in pal-e-docs. Body's Related section now explicitly calls out this discovered scope: "create arch-services-tf note documenting the var.services fan-out pattern at platform scope." Per skill-review-ticket guidance, missing backing notes are [SCOPE] recommendations and do NOT block advance. Prior review explicitly concluded: "After the three [BODY] fixes land via skill-refine-ticket, this ticket is APPROVED for advance to todo." Carry-forward as a separate ticket.

Template Completeness

• [x] Type — Feature
• [x] Lineage — explicit (audit-discovered, links siblings + supersession)
• [x] Repo — forgejo_admin/pal-e-services
• [x] User Story — well-formed As/I want/So that
• [x] Context — substrate audit summary, schema verified, hostname declared, funnel-collision risk callout added
• [x] File Targets — files to modify (with corrected reference services) and files NOT to touch
• [x] Acceptance Criteria — 9 items (was 7, added funnel = false + forgejo_repo + plan-output-no-funnel-create)
• [x] Test Expectations — fmt/validate/plan with explicit run commands
• [x] Constraints — present, includes -lock=false and no-funnel reminders
• [x] Checklist — present
• [x] Related — present, includes new feedback_funnel_requires_auth + incident-2026-04-10-pal-e-streamlit-public-funnel references

Traceability

• [x] story:reachable label — Dashboard Reachable from Phone
• [x] story note verified — story-westside-streamlit-reachable exists (id 1401, confirmed in round 1)
• [x] arch:services-tf label present
• [ ] arch note MISSING — arch-services-tf still not in pal-e-docs (search returned no results). [SCOPE] Carry forward as separate ticket; body already documents this as discovered scope.
• [x] Forgejo issue — #60 open, body well-structured

File Targets

• [x] ~/pal-e-services/terraform/k3s.tfvars — verified, exists. grep westside-streamlit returns zero hits, so the additive change is correctly scoped.
• [x] Reference services verified live in k3s.tfvars:
• [x] ~/pal-e-services/terraform/variables.tf lines 165-177 — schema verified, supports source_repo + source_path as optional fields. forgejo_repo required with no default (line 168). Body's "no schema extension needed" claim is accurate.
• [x] ~/pal-e-services/terraform/services.tf lines 168-180 — funnel resource gated for_each = { for k, v in var.services : k => v if v.funnel }. Comment block at 171-175 explicitly warns about the dead-address pattern. AC plan-output check matches resource name kubernetes_ingress_v1.service_funnel["westside-streamlit"].
• [x] Overlay path ~/pal-e-deployments/overlays/westside-streamlit/prod/ verified — 6 files (deployment-patch, harbor-creds.enc, ingress, kustomization, namespace, secret.enc). Body's claim that the overlay already provides the Tailscale ingress is correct.

Repo Placement

Dependencies

• Lineage block calls out sibling pal-e-services#61 (Keycloak client) and notes westside-streamlit#3/#6 are blocked by this ticket.
• Lineage notes that westside-streamlit#10 was closed-but-incomplete and is superseded by sibling #61.
• No board blockers — this ticket can advance to todo immediately on approval.

Acceptance Criteria

• AC1 (key = westside-streamlit) — verifiable via grep
• AC2 (image_repo prefix matches key per feedback_harbor_project_naming) — verifiable via diff
• AC3 (new) funnel = false with cited reasons — exact match to round 1 [BODY] recommendation
• AC4 (new) forgejo_repo = "forgejo_admin/westside-streamlit" with override-on-copy warning — exact match to round 1 [BODY] recommendation
• AC5 source_path = "overlays/westside-streamlit/prod" with pre-flight directory check — pre-verified, directory exists
• AC6 (5 specific resource creates) — exact match to services.tf resource names
• AC7 (new) tofu plan does NOT show creation of funnel ingress — proves funnel = false is set
• AC8 (ArgoCD targets namespace westside-streamlit) — guaranteed by services.tf line 155
• AC9 (namespace creates cleanly or no-ops) — handles pre-existing-namespace edge case
• AC10 (no tofu apply in PR) — explicit Lucas-applies gate

Blast Radius

• Funnel collision risk — AC3 + AC7 pin funnel = false AND verify the funnel resource is NOT created in plan output. The services.tf:171-175 warning is now cited in the AC. Resolved.
• forgejo_repo field — AC4 pins the value with the explicit override-on-copy warning. Resolved.
• port field — body Constraints section cites the westsidekingsandqueens shape (which uses port = 80). With funnel = false the port is short-circuited; defensible.
• Harbor naming bug — AC2 enforces image_repo prefix match per feedback_harbor_project_naming. Carry-forward from round 1.

Decomposition Assessment

Recommendation

• [SCOPE] Create arch-services-tf architecture note at platform scope documenting the var.services fan-out pattern (Harbor project + robot accounts + Harbor creds + namespace + ArgoCD app + optional funnel). Already cited in body's Related → Discovered scope.