Review: Decommission basketball-api and westsidekingsandqueens namespaces (re-review)

Verdict: APPROVED

Previous Review Findings — Resolution Status

• [x] [BODY] Add k3s.tfvars to file targets — RESOLVED. Now the primary file target with specific line references for both services and clients blocks.
• [x] [LABEL] Change story:admin-roster-report to story:consolidation — RESOLVED. Board item #1367 now has label story:consolidation.
• [ ] [SCOPE] Create project-westside-ror project page — STILL MISSING. No project-westside-ror note exists in pal-e-docs. Not a blocker for ticket execution; the story label is meaningful without it.
• [ ] [SCOPE] Create arch-westside-ror architecture note — STILL MISSING. No arch-westside-ror note exists in pal-e-docs. Not a blocker for this infra teardown ticket.
• [x] [DECOMPOSE] Previous review recommended decomposition — REASSESSED below. The rewritten issue correctly reframes all work as terraform-driven, making it a single coordinated operation rather than 5 separate system touches.

Template Completeness

• [x] Type — Feature
• [x] Lineage — references #33 consolidation spike, #35, #36 as prerequisites
• [x] Repo — correctly identifies pal-e-services (terraform), pal-e-deployments (overlays), Forgejo admin (archival)
• [x] User Story — clear operator perspective
• [x] Context — explains terraform as source of truth, why manual kubectl is wrong
• [x] File Targets — specific files with line references, plus explicit "do NOT touch" list
• [x] Acceptance Criteria — 12 items
• [x] Test Expectations — 5 verification commands
• [x] Constraints — terraform-first, review plan before apply, archive-not-delete, keep realm
• [x] Checklist — two PRs (pal-e-services, pal-e-deployments) + tofu plan output
• [x] Related — links to project and prerequisite issues

Traceability

• [x] story:consolidation label — matches decommission/cleanup scope
• [ ] story note NOT verified — no project-westside-ror note with user-stories section exists. [SCOPE] Create project page project-westside-ror with user-stories section (deferred, not a blocker).
• [x] arch:westside-ror label — present on board item
• [ ] arch note NOT verified — no arch-westside-ror note exists. [SCOPE] Create architecture note arch-westside-ror (deferred, not a blocker).
• [x] Forgejo issue — #37, open, valid

File Targets

• [x] pal-e-services/terraform/k3s.tfvars — verified exists (10k). basketball-api service block at lines 200-208. westsidekingsandqueens service block at lines 209-217. Both confirmed present.
• [x] pal-e-services/terraform/k3s.tfvars clients — westside-landing block (HCL key) at lines 73-89 with client_id = "westside-app". westside-spa block at lines 90-109. Both confirmed present.
• [x] pal-e-deployments/overlays/basketball-api/ — verified exists (prod/ subdirectory with postgres.yaml, secrets, etc.)
• [x] pal-e-deployments/overlays/westsidekingsandqueens/ — verified exists (dev/ and prod/ subdirectories)

• Issue says basketball-api at lines 200-207 — actual block includes cmp_plugin field, runs to line 208
• Issue says westsidekingsandqueens at lines 209-216 — actual block runs to line 217
• Issue says westside-app at lines 74-89 — the HCL key is westside-landing (line 73), inner content 74-89 is correct. Agent implementing this should remove the entire block including the key line.
• Issue says westside-spa at lines 91-107 — actual block starts at line 90, includes extra http://localhost web_origin, closing brace at line 109

Repo Placement

Dependencies

• [x] #35 (data migration) — board item 1365, column: done. Prerequisite satisfied.
• [x] #36 (URL cutover) — board item 1366, column: done. Prerequisite satisfied.
• [x] #33 (consolidation spike) — board item 1362, column: done. Parent work complete.
• [x] #7 (Keycloak auth) — correctly noted as unblocked by this work; realm is preserved.
• No blocking items in in_progress.

Acceptance Criteria

• AC 1-4 (remove tfvars entries) — directly verifiable by diffing the PR
• AC 5-6 (tofu plan/apply) — verifiable by operator running commands; plan output included in PR per checklist
• AC 7 (kubectl get ns) — verifiable post-apply
• AC 8-9 (repo archival) — manual Forgejo admin action, verifiable
• AC 10 (Tailscale nodes) — issue now correctly notes "may happen automatically via funnel teardown." Acceptable.
• AC 11 (PVC noted) — informational, not a pass/fail criterion. Backup location documented.
• AC 12 (overlay directories removed) — verifiable via PR diff

Blast Radius

• pal-e-services docs — README.md (line 65), CLAUDE.md (line 12), SERVICE_ONBOARDING.md (17+ references) all mention basketball-api as examples. These are documentation references, not functional. Low priority cleanup, not required for this ticket.
• pal-e-deployments/overlays/dev-tunnel/README.md — line 27 references basketball-api.basketball-api.svc.cluster.local:8000. Minor doc cleanup.
• pal-e-deployments/overlays/westside-ror/README.md — line 3 mentions "replacing basketball-api and westsidekingsandqueens." Historical reference, no action needed.
• No code-level blast radius — terraform handles all resource teardown cleanly.

Decomposition Assessment

• PR 1: Edit k3s.tfvars (remove 4 blocks from 1 file), run tofu plan, include output — single agent pass, <5 min
• PR 2: git rm two overlay directories in pal-e-deployments — trivial, <2 min
• Manual steps: tofu apply (operator), repo archival (operator), Tailscale cleanup (may auto-resolve) — these are operator actions, not agent work

Recommendation

• [SCOPE] Create project page project-westside-ror with user-stories section (deferred — does not block ticket execution).
• [SCOPE] Create architecture note arch-westside-ror (deferred — does not block ticket execution).