Review: Terraform worktree workflow guardrails (Makefile + SOP fix)

Verdict: NEEDS_REFINEMENT

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- Standalone, discovered during PR #138
• [x] Repo -- ldraney/pal-e-services
• [x] User Story -- present, well-formed
• [x] Context -- thorough explanation of the gap (plan vs apply locking, flag incantations)
• [x] File Targets -- 2 targets (Makefile new, sop-platform-tf-changes update)
• [x] Feature Flag -- none (appropriate for DX tooling)
• [x] Acceptance Criteria -- 5 items
• [x] Test Expectations -- manual verification steps + make validate
• [x] Constraints -- 4 constraints listed
• [x] Checklist -- standard 3-item
• [x] Related -- 5 references

Traceability

• [x] story:provision label -- present on board item
• [x] story note verified -- found in project-page-ios-infrastructure user-stories section (key: "provision", role: Platform engineer)
• [x] arch:tofu-consumers label -- present on board item
• [ ] arch note MISSING -- [SCOPE] Create architecture note arch-tofu-consumers. Search returned zero results. This label is also used by board items #1533 and #1534 on the same board.
• [x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/pal-e-services/issues/140, state: open

File Targets

• [x] Makefile -- verified: no Makefile currently exists in pal-e-services (confirmed via Forgejo API tree listing). New file creation is correct.
• [x] sop-platform-tf-changes (pal-e-docs) -- verified: note exists (slug: sop-platform-tf-changes), status: active, project: pal-e-platform. The pal-e-services section currently says -lock=false for both plan AND apply, confirming the issue's claim that locking is applied too broadly.
• [x] Constraint reference: ~/secrets/pal-e-services/k3s.tfvars -- verified: file exists at /home/ldraney/secrets/pal-e-services/k3s.tfvars.
• [x] Convention reference: pal-e-platform Makefile -- verified: exists and contains tofu-plan, tofu-apply, tofu-fmt targets. Good convention to follow. Note: pal-e-platform uses tofu- prefix; issue should follow the same naming.

Repo Placement

Dependencies

• No blocking dependencies on the board. Item #1534 (pal-e-services: CLAUDE.md symlink + docs upgrade) is in todo on the same repo but is independent work.
• The worktree-workflow SOP (slug: worktree-workflow) is referenced but does NOT need modification -- only sop-platform-tf-changes needs the locking clarification.

Acceptance Criteria

• AC 1-4: Makefile targets -- agent can verify by reading generated Makefile and confirming flag usage. Manual testing from /tmp/ clone is appropriate.
• AC 5: SOP update -- agent can verify by reading the updated pal-e-docs note content.
• No missing criteria detected. The scope is well-bounded.

Blast Radius

• CI pipeline inconsistency: The pal-e-services Woodpecker CI apply step (.woodpecker/terraform.yaml) currently uses -lock=false on apply. The ticket explicitly says "CI pipeline unchanged" and excludes .woodpecker.yaml. This is acceptable -- the CI locking fix should be a separate issue since CI runs in-cluster with different locking semantics. However, the SOP update should note this distinction.
• pal-e-platform already has a Makefile: Confirmed. pal-e-platform uses tofu-plan, tofu-apply, tofu-fmt naming. The new Makefile should follow this convention (not make plan / make apply as the AC currently suggests).
• No other repos with similar Terraform patterns lack Makefiles (pal-e-platform already has one, appstoreconnect-tofu is a provider not a consumer).

Decomposition Assessment

Recommendation

• [SCOPE] Create architecture note arch-tofu-consumers for the tofu-consumers component. This label is shared by 3 board items (#1533, #1534, #1542) and has no backing architecture note.
• [BODY] Clarify Makefile target naming convention: AC says "make plan" / "make apply" but pal-e-platform convention uses tofu-plan / tofu-apply prefix. Update AC to use make tofu-plan / make tofu-apply for cross-repo consistency, or explicitly document why a different naming is chosen.