pal-e-docs

Review: Mobile app -- API key connection and strategy dashboard

review-1691-2026-07-02-r2 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Re-review of board item #1691. Previous review (review-1691-2026-07-02) returned NEEDS_REFINEMENT. Five of six findings were addressed in refinement. One blocker remains: decomposition has not been performed.

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- dependencies listed (#1-#5 backend, #10 Keycloak, #4 Watchdog)
  • [x] Repo -- ldraney/kalshi-assistant
  • [x] User Story -- present
  • [x] Context -- present, includes decomposition recommendation
  • [x] File Targets -- filled (preliminary Rails + Turbo Native paths, marked pending framework spike)
  • [x] Feature Flag -- none
  • [x] Acceptance Criteria -- 6 items
  • [x] Test Expectations -- filled (system tests, Xcode simulator)
  • [x] Constraints -- present
  • [x] Checklist -- present
  • [x] Related -- present

Traceability

  • [x] story:app-experience label -- App Experience story
  • [x] story note verified -- found in project-kalshi-assistant user-stories section
  • [x] story:credential-onboarding label -- Credential Onboarding story
  • [x] story note verified -- found in project-kalshi-assistant user-stories section
  • [x] arch:frontend label -- Frontend component
  • [x] arch note verified -- arch-frontend note exists (was MISSING in first review, now FIXED)
  • [x] arch:auth label -- Authentication component
  • [x] arch note verified -- arch-auth note exists (was MISSING in first review, now FIXED)
  • [x] Forgejo issue -- ldraney/kalshi-assistant#6, open

File Targets

  • [~] app/views/dashboard/ -- does not exist yet; acceptable for Sprint 4 ticket pending Sprint 1 scaffold
  • [~] app/controllers/dashboard_controller.rb -- does not exist yet; same rationale
  • [~] app/views/credentials/ -- does not exist yet; same rationale
  • [~] app/controllers/credentials_controller.rb -- does not exist yet; same rationale
  • [~] ios/ -- does not exist yet; Turbo Native shell, pending framework spike
All file targets are preliminary and correctly noted as "Pending framework spike." The repo currently contains only docs (no Rails scaffold yet -- that is ticket #1). File targets cannot be verified until Sprint 1 completes. This is acceptable for Sprint 4 scoping but means an agent cannot execute this ticket as-is.

Repo Placement

OK. Issue filed on ldraney/kalshi-assistant, which matches ### Repo. The ios/ Turbo Native shell is kept in the same repo -- reasonable for a thin native wrapper.

Dependencies

  • #1 Rails scaffold (item #1686, backlog) -- prerequisite for all file targets
  • #2 Market scanner (item #1687, backlog) -- provides market data for dashboard
  • #3 Strategy engine (item #1688, backlog) -- provides strategy/trade models
  • #4 Watchdog (item #1689, backlog) -- dashboard needs watchdog data (added in refinement)
  • #5 Option D sizing (item #1690, backlog) -- strategy option
  • #10 Keycloak realm/client (item #1693, backlog) -- auth prerequisite (added in refinement)
All dependencies documented in Lineage. All are in backlog (Sprint 1-3), correctly blocking this Sprint 4 ticket. FIXED from previous review.

Acceptance Criteria

6 criteria spanning 4 distinct feature areas: (1) credential input/validation, (2) strategy + budget configuration, (3) live dashboard, (4) trade history + access revocation. Each criterion is individually testable, but the breadth across 4 domains makes this too large for a single agent pass. Test commands are described at a reasonable level (system tests with mock data, manual Xcode simulator for iOS).

Blast Radius

No existing code in the repo to check -- currently docs only. The credential storage and API key handling patterns described here will set security precedent for the project. Encrypted-at-rest requirement in Constraints is critical -- ensure it aligns with arch-auth note's credential storage design.

Decomposition Assessment

NEEDS DECOMPOSITION -- route to skill-decompose-ticket.
  • 8 story points
  • 6 acceptance criteria across 4 feature areas
  • 5+ file targets spanning controllers, views, and a native iOS shell
  • Estimated agent work well exceeds 5 minutes
  • The issue Context section itself recommends splitting into 6 sub-tickets
Suggested decomposition (from issue Context, validated by this review):
  • Spike: framework decision (React Native / Flutter / Rails Turbo Native)
  • Credential input UI -- API key + private key with validation
  • Strategy + budget configuration
  • Live dashboard -- active positions, unrealized P&L
  • Trade history log
  • Access revocation

Previous Review Findings -- Resolution Status

  • [x] FIXED: arch-frontend note created
  • [x] FIXED: arch-auth note created
  • [x] FIXED: File Targets filled (was TBD)
  • [x] FIXED: Test Expectations filled (was TBD)
  • [x] FIXED: Keycloak dependency #10 added to Lineage
  • [ ] OPEN: Decomposition not performed -- note added to Context acknowledging need, but ticket remains a monolith

Recommendation

  • [DECOMPOSE] 8 points, 6 AC across 4 feature areas -- route to skill-decompose-ticket. Suggested split: (1) Spike: framework decision, (2) Credential input UI, (3) Strategy + budget config, (4) Live dashboard, (5) Trade history, (6) Access revocation.