pal-e-docs

Review: Deploy paldocs to production

review-1369-2026-06-06-r3 Review

review ready
Project

Verdict: APPROVED

Round 3 review (2026-06-06). Prior reviews (review-1369-2026-06-06) returned false positives on two points: (1) claiming service-onboarding-sop does not exist, and (2) claiming bin/docker-entrypoint skips db:migrate. Both were incorrect. This review corrects those findings and re-evaluates the full scope.

Prior Findings Corrections

Prior Finding Correction
[BODY] service-onboarding-sop "does not exist" <strong>FALSE POSITIVE</strong> -- <code>service-onboarding-sop</code> exists in pal-e-docs (note_type: sop, status: active, project: pal-e-platform). The issue's reference is valid.
[BODY] AC #6 "db:migrate is factually wrong" <strong>FALSE POSITIVE</strong> -- The local working tree has stale uncommitted changes that revert PR #21. The committed version (<code>git show HEAD:bin/docker-entrypoint</code>) correctly runs <code>./bin/rails db:migrate</code> when the command is <code>bundle</code> or <code>./bin/rails</code>. The issue's reference to "db:migrate runs on pod startup via entrypoint (PR #21)" is accurate.

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- references #15 CI/CD infrastructure and service-onboarding-sop gap
  • [x] Repo -- ldraney/pal-e-services (primary), ldraney/pal-e-platform (NetworkPolicy)
  • [x] User Story -- present as narrative
  • [x] Context -- thorough, includes "what exists" and "what's missing" with SOP step mapping
  • [x] File Targets -- 3 targets listed in table format (1 partially stale, see below)
  • [x] Acceptance Criteria -- 9 criteria listed, all verifiable
  • [x] Test Expectations -- 5 manual verification steps
  • [x] Constraints -- 4 constraints documented, all accurate
  • [x] Checklist -- 11 ordered steps
  • [x] Related -- references issues, SOPs, PRs
  • [x] Pre-Deploy Validation -- bonus section maps SOP checklist items
All required sections for a Feature template are present.

Traceability

  • [x] story:infra label -- present on board item
  • [ ] story note MISSING -- No story-paldocs-infra entry exists in project-paldocs user-stories section. Only story-paldocs-kanban and story-paldocs-project-pages are listed. Infrastructure/deployment is foundational work -- acceptable to defer, but note should exist for traceability. [SCOPE] Create user story entry story-paldocs-infra on project-paldocs user-stories section.
  • [x] arch:ci-cd label -- present on board item
  • [ ] arch note MISSING -- No arch-ci-cd note exists in pal-e-docs. Search returned zero results. [SCOPE] Create architecture note arch-ci-cd for CI/CD component.
  • [x] Forgejo issue -- ldraney/paldocs#22, state: open

File Targets

  • [x] pal-e-services/terraform/k3s.tfvars -- verified: file exists at /home/ldraney/pal-e-services/terraform/k3s.tfvars. paldocs is NOT yet in the services map. The proposed var.services entry follows the landscaping-assistant pattern correctly (port 3000, funnel true, source_repo/source_path for pal-e-deployments overlay).
  • [x] pal-e-platform/terraform/network-policies.tf -- verified: file exists. NOTE: paldocs namespace is ALREADY present in the postgres NetworkPolicy allowlist. This file target is already satisfied. The issue says "Add paldocs namespace to postgres NetworkPolicy" but this work appears to be done. Minor scope inaccuracy -- the checklist step and AC #5 referencing this can be checked off immediately. Not blocking.
  • [x] paldocs-secrets (k8s Secret) -- manual kubectl creation. Correctly documented as "Create manually" with keys SECRET_KEY_BASE + DATABASE_URL. The deployment patch in pal-e-deployments/overlays/paldocs/prod/ references paldocs-secrets with envFrom. Constraint about "secrets before sync" is correctly documented and matches service-onboarding-sop step 3.

Repo Placement

Issue is filed on ldraney/paldocs. Primary work is on ldraney/pal-e-services (add to var.services + tofu apply). Secondary work on ldraney/pal-e-platform (NetworkPolicy) appears already complete. This is a deployment/ops ticket -- filing on the service repo being deployed is acceptable. No repo mismatch.

Dependencies

  • #15 (CI/CD infrastructure) -- DONE. Board item #1359 in done column. Pipeline builds images and updates kustomize tags via .woodpecker.yaml.
  • #14 (Infra spike) -- DONE. Board item #1345 in done column.
  • pal-e-deployments PR #179 -- Merged. Kustomize overlay exists at overlays/paldocs/prod/kustomization.yaml. Verified: namespace set to paldocs, containerPort 3000, image reference harbor.tail5b443a.ts.net/paldocs/app.
  • Dockerfile -- EXPOSE 3000 confirmed, matches var.services port and kustomize overlay.
  • bin/docker-entrypoint -- Committed version (HEAD) includes db:migrate guard from PR #21. Correctly handles shared database.
  • No blocking items on board. All upstream dependencies are resolved.

Acceptance Criteria

  • [x] AC1: paldocs entry in var.services -- verifiable via grep
  • [x] AC2: tofu plan shows clean diff -- verifiable, requires Lucas approval
  • [x] AC3: tofu apply succeeds -- verifiable, requires Lucas approval
  • [x] AC4: paldocs-secrets exists before ArgoCD sync -- verifiable via kubectl
  • [x] AC5: NetworkPolicy allows paldocs -> postgres -- already satisfied (paldocs in netpol allowlist)
  • [x] AC6: kubectl get application shows Synced + Healthy -- verifiable
  • [x] AC7: Pod running, /up returns 200 -- verifiable
  • [x] AC8: https://paldocs.tail5b443a.ts.net serves projects index -- verifiable
  • [x] AC9: CI merge triggers full pipeline -- verifiable end-to-end
All 9 acceptance criteria are verifiable. No factual errors found (correcting prior review's false positive on db:migrate).

Blast Radius

  • Shared database: paledocs DB shared with pal-e-docs FastAPI. DATABASE_URL must use same credentials. Correctly documented.
  • CI registry URL: .woodpecker.yaml uses external Harbor URL (harbor.tail5b443a.ts.net) while SOP and landscaping-assistant use internal (harbor.harbor.svc.cluster.local). This is a pre-existing issue from PR #21, not in scope for this deployment ticket. Worth a follow-up issue but not blocking deployment.
  • Port consistency: Dockerfile EXPOSE 3000 = var.services port 3000 = kustomize containerPort 3000 = service targetPort 3000. All aligned.
  • No downstream consumers: paldocs is a UI service. Deployment only affects end-user access.

Decomposition Assessment

3 file targets across 2 repos (one already done). 9 acceptance criteria but they are sequential ops steps in a single deployment workflow, not parallel agent code changes. This is a human-executed ops ticket with tofu apply requiring Lucas approval. The 5-minute rule for agent decomposition does not apply to manual infrastructure deployment. The issue checklist already provides ordered sub-steps.
No decomposition needed.

Recommendations

  • [BODY] Update file target #2: pal-e-platform/terraform/network-policies.tf is listed as "Update -- Add paldocs namespace to postgres NetworkPolicy allowlist" but paldocs is already in the allowlist. Update to reflect this is already done, or remove from file targets.
  • [BODY] Update checklist item "Add paldocs namespace to postgres NetworkPolicy" -- mark as already complete or note it was done previously.
  • [SCOPE] Create user story entry story-paldocs-infra on project-paldocs user-stories section. (Foundational work -- acceptable to defer but note should exist for traceability.)
  • [SCOPE] Create architecture note arch-ci-cd for CI/CD component. (Label exists on board item but backing note is missing.)
Minimum for APPROVED: The [BODY] items are minor inaccuracies (stale file target for already-completed NetworkPolicy work) that do not block execution. The [SCOPE] items are deferrable for infrastructure work. The ticket scope is solid, all remaining work is clearly defined, and all acceptance criteria are verifiable. APPROVED for execution.