pal-e-docs

Review: Update NetworkPolicy: replace westside-ror with westside-basketball

review-1632-2026-06-27 Review

review approved
Project

Verdict: READY

Note: Both READY and APPROVED are accepted as passing verdicts by the check-board-advance hook. Use either keyword interchangeably.

Template Completeness

  • [x] Type
  • [x] Lineage
  • [x] Repo
  • [x] What Broke
  • [x] Repro Steps
  • [x] Expected Behavior
  • [x] Environment
  • [x] Acceptance Criteria
  • [x] Related
All required sections for template-issue-bug are present.

Traceability

  • [x] story:WS-S1 label — "As superadmin, I want to deploy platform changes via IaC so that infrastructure is reproducible and auditable"
  • [x] story note verified — found in project-westside-basketball user-stories section (Superadmin list)
  • [x] arch:iac label — infrastructure-as-code component
  • [ ] arch note MISSING — [SCOPE] Create architecture note arch-iac for component iac (systemic gap, not a blocker for this ticket)
  • [x] Forgejo issue — ldraney/pal-e-platform#475, open

File Targets

  • [x] terraform/network-policies.tf — verified: westside-ror namespace selector found at line 178 (issue says line 181, off by 3 — minor discrepancy, does not affect implementation)
  • [x] Only one occurrence of westside-ror in the entire pal-e-platform terraform codebase — clean single-line fix

Repo Placement

OK. Issue filed on ldraney/pal-e-platform, fix is in ldraney/pal-e-platform. Single-repo change.

Dependencies

  • Sibling ticket #1631 (Add Tailscale funnel ingress + rename westside-ror overlay to westside-basketball, 3pts) — coordinates the overlay rename. This NetworkPolicy fix is logically independent: it can be applied before or after the overlay rename without conflict. The namespace selector just needs to match the target state.
  • Sibling ticket #1633 (Drop stale basketball DB role + update Keycloak westside-ror references, 2pts) — different systems (DB role + Keycloak), no ordering dependency.
  • Parent issue: ldraney/pal-e-deployments#220 — decomposed per review-1630-2026-06-27.
  • No blockers in in_progress column.

Acceptance Criteria

4 criteria, all verifiable by an agent:
  • [x] network-policies.tf namespace selector updated — verifiable via grep
  • [x] terraform plan shows only expected change — verifiable via CLI
  • [x] terraform apply succeeds — verifiable via CLI
  • [x] No regression in other namespace NetworkPolicies — verifiable via grep for unchanged entries

Blast Radius

Minimal. Only 1 occurrence of westside-ror across all .tf files in pal-e-platform. No other terraform files reference this namespace. No downstream consumers affected — this is a NetworkPolicy ingress rule allowing a specific namespace to reach postgres. Changing the selector only affects the westside app's postgres access path.

Decomposition Assessment

No decomposition needed. 1 file target, 1 repo, 4 acceptance criteria, estimated agent work well under 5 minutes. Single-line string replacement.

Recommendation

  • [BODY] Fix line reference: line 181 should be line 178 (minor, non-blocking)
  • [SCOPE] Create architecture note arch-iac for component iac (systemic gap across multiple sibling tickets — not a blocker for this ticket)
No action needed to proceed — ticket is READY.