pal-e-docs

Review: Terraform service onboarding for westside-ror

review-1374-2026-06-06 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type
  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related
All template sections present. Template completeness is good.

Traceability

  • [x] story:ci-pipeline label -- present on board item
  • [ ] story note MISSING -- [SCOPE] project-westside-ror note does not exist; cannot verify user story entry. Create project page with user-stories section.
  • [x] arch:terraform label -- present on board item
  • [ ] arch note MISSING -- [SCOPE] No arch-terraform note found in pal-e-docs. Create architecture note arch-terraform for the terraform services module.
  • [x] Forgejo issue -- ldraney/westside-ror#41, state: open

File Targets

  • [x] pal-e-services/terraform/k3s.tfvars -- verified exists (225 lines). Services block starts at line 137. westside-ror is NOT yet present in the file.
  • [ ] Line reference inaccurate -- [BODY] Issue says "Reference: landscaping-assistant entry in k3s.tfvars (lines 137-225)". The landscaping-assistant service entry is actually at lines 147-154; lines 137-225 is the entire services block. Recommend clarifying to "lines 147-154" for the landscaping-assistant entry pattern.

Repo Placement

MISMATCH: The issue body declares ### Repo: forgejo_admin/pal-e-services (the repo where the file change lives), but the Forgejo issue is filed on ldraney/westside-ror. This is a cross-repo issue -- the actual code change is in pal-e-services, not westside-ror. The implementing agent needs to clone/checkout pal-e-services, not westside-ror.
[BODY] Clarify that the PR should be opened against forgejo_admin/pal-e-services, not ldraney/westside-ror. Consider whether the Forgejo issue should be filed on pal-e-services instead, or add explicit instructions that the agent must work in the pal-e-services repo.

Dependencies

  • #40 (board item #1372) -- parent epic "CI/CD pipeline", backlog. This ticket is a child.
  • #42 (board item #1375) -- "K8s prod manifests + secrets for ArgoCD deployment", backlog. Depends on this ticket (needs Harbor project for image refs). Documented in issue body.
  • #43 (board item #1376) -- "Dockerfile + Woodpecker CI pipeline", backlog. Depends on this indirectly (CI needs Harbor to push images).
  • No items in in_progress or next_up block this ticket.
  • The k8s/prod directory referenced in the ArgoCD source_path does NOT exist yet in westside-ror -- expected, as #42 will create it. ArgoCD app will be unhealthy until then (documented in AC).

Acceptance Criteria

5 acceptance criteria -- at the upper bound but acceptable for a single agent pass.
  • AC 1 (add services entry) -- verifiable by grep/read
  • AC 2 (terraform plan shows resources) -- verifiable but requires terraform CLI access and credentials
  • AC 3 (terraform apply succeeds) -- requires live infra access, not automatable by code agent alone
  • AC 4 (Harbor project exists) -- requires Harbor API/UI access post-apply
  • AC 5 (ArgoCD app created) -- requires ArgoCD access post-apply
AC 2-5 are infrastructure verification steps that happen after the code change. The code change itself (AC 1) is straightforward. An agent can handle the code change + PR; AC 2-5 are manual validation steps.

Blast Radius

  • Existing namespace resources: rails-env secret and Tailscale Funnel ingresses are manually created in the westside-ror namespace. Terraform namespace resource could conflict. Constraints section documents this risk correctly.
  • No similar pattern bugs found -- the services block is well-established with 9 existing entries.
  • ArgoCD pruning policy is a risk factor -- if ArgoCD prunes unmanaged resources in the namespace, the manually-created resources could be deleted. This is noted in the Context section.

Decomposition Assessment

1 file target, 1 repo (pal-e-services), 5 AC (but only 1 is a code change). Estimated agent work: under 5 minutes for the code change + PR. No decomposition needed.

Recommendation

  • [BODY] Fix line reference: "landscaping-assistant entry in k3s.tfvars (lines 137-225)" should be "(lines 147-154)" for the service entry pattern, or "(services block: lines 137-225)" for the full block.
  • [BODY] Add explicit instruction that the PR must be opened against forgejo_admin/pal-e-services, and the agent must clone/work in that repo, not westside-ror.
  • [SCOPE] Create project page project-westside-ror with a user-stories section that includes the ci-pipeline story.
  • [SCOPE] Create architecture note arch-terraform documenting the terraform services module pattern.