Review: Automate Salt highstate via Woodpecker CI on pal-e-platform merge (re-review)

Verdict: APPROVED

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- Discovered during Sprint 5 validation (Caddy pillar deploy delay)
• [x] Repo -- ldraney/pal-e-platform
• [x] User Story -- As a platform operator, I want Salt highstate to run automatically...
• [x] Context -- Manual SSH gap after merge, second time causing deploy delay
• [x] File Targets -- .woodpecker/salt.yaml (new file), explicit DO NOT TOUCH list
• [x] Feature Flag -- none (infra automation, correct)
• [x] Acceptance Criteria -- 4 criteria, all testable
• [x] Test Expectations -- integration test described (merge no-op pillar change)
• [x] Constraints -- 3 items including SSH secret name and reference pattern
• [x] Checklist -- present
• [x] Related -- 2 references (project-westside-basketball, sop-platform-tf-changes)

Traceability

• [x] story:WS-S1 label -- "As superadmin, I want to deploy platform changes via IaC so that infrastructure is reproducible and auditable"
• [x] story note verified -- found in project-westside-basketball user-stories section (Superadmin list)
• [x] arch:salt label -- Salt configuration management component
• [ ] arch note MISSING -- [SCOPE] Create architecture note arch-salt for the Salt component. No note found via search_notes("arch-salt"). NOT BLOCKING per re-review instructions.
• [x] Forgejo issue -- ldraney/pal-e-platform#466, open

Previous Review Fixes -- All Addressed

• [x] [BODY] File target path fixed: now correctly specifies .woodpecker/salt.yaml (new file in existing .woodpecker/ directory)
• [x] [BODY] SSH secret name added: AC4 now specifies ssh_edge_proxy_key as Woodpecker repo secret, states it must be provisioned before first run
• [x] [BODY] Constraints reference fixed: now says "Follow existing .woodpecker/terraform.yaml clone block and path-filter patterns from this same repo" (was incorrectly referencing pal-e-services)

File Targets

• [x] .woodpecker/salt.yaml -- new file, follows directory convention. Verified: .woodpecker/ directory exists with terraform.yaml and ruby-arch.yaml.
• [x] .woodpecker/terraform.yaml -- correctly listed as reference only (DO NOT TOUCH)
• [x] terraform/ -- correctly listed as separate concern (DO NOT TOUCH)

Repo Placement

Dependencies

• No blocking dependencies. This ticket is independent.
• Board item #1480 (pal-e-platform#453, tofu CI pipeline) is the predecessor that established the Woodpecker CI pattern -- DONE, not blocking.
• Board item #1104 (pal-e-platform#306, arch:salt chore) is related Salt work in backlog -- not blocking.
• No in_progress items conflict with this work.

Acceptance Criteria

• [x] AC1: "Woodpecker pipeline triggers Salt highstate on edge-proxy after merge to main" -- verifiable via Woodpecker UI
• [x] AC2: "Pipeline only runs when salt/ directory has changes (path filter, matching .woodpecker/terraform.yaml pattern)" -- verifiable. Note: terraform.yaml uses internal git-diff module detection rather than Woodpecker path filters, but the agent can implement either approach. The intent is clear.
• [x] AC3: "Failure alerts via Woodpecker notification (existing pattern)" -- verifiable, references existing pattern
• [x] AC4: "Pipeline uses SSH key via Woodpecker secret ssh_edge_proxy_key to connect to edge-proxy (secret must be provisioned as a repo secret before first run)" -- verifiable, secret name and provisioning requirement are now clearly specified

Blast Radius

• New .woodpecker/salt.yaml is a separate file -- no interference with existing terraform.yaml pipeline.
• Salt changes will trigger both cross-pillar-review (in terraform.yaml) AND the new salt pipeline -- correct behavior.
• Edge-proxy SSH access requires Tailscale (noted in Constraints). Woodpecker runner must be on tailnet -- infrastructure prerequisite.
• Salt is only managed in pal-e-platform -- no similar gap in other repos.

Decomposition Assessment

Recommendations

• [SCOPE] Create architecture note arch-salt for the Salt configuration management component in pal-e-docs. (Carried forward from previous review -- not blocking this ticket.)