Review: ConfigMap + volume mount for paldocs Keycloak theme (re-review)

Verdict: READY

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- "Dependency of ldraney/paldocs #82"
• [x] Repo -- ldraney/pal-e-platform
• [x] User Story -- full As a/I want/So that format
• [x] Context -- explains 3-repo pattern, references landscaping PR #416 and westside
• [x] File Targets -- lists files to create, modify, and NOT touch
• [x] Feature Flag -- "none" (correct, infra-only change)
• [x] Acceptance Criteria -- 7 criteria
• [x] Test Expectations -- 3 test items + run command
• [x] Constraints -- 4 constraints including pattern reference and read_only flag
• [x] Checklist -- present
• [x] Related -- 5 items linked

Traceability

• [x] story:auth label -- role-based access control via Keycloak
• [x] story note verified -- story-paldocs-auth found in project-paldocs user-stories section
• [x] arch:keycloak label -- Keycloak infrastructure
• [x] arch note verified -- arch-keycloak-paldocs note exists in pal-e-docs (paldocs project, architecture type, active status). Named with -paldocs suffix to avoid collision with pal-enterprises' arch-keycloak note.
• [x] Forgejo issue -- pal-e-platform #492, state: open

File Targets

• [x] keycloak/themes/paldocs/login/theme.properties -- TO CREATE. Parent directory keycloak/themes/ exists with landscaping/ and westside/ siblings. Landscaping reference file confirms expected content: parent=keycloak, import=common/keycloak, styles=css/login.css.
• [x] keycloak/themes/paldocs/login/resources/css/login.css -- TO CREATE. CSS content originates from paldocs #82 (documented dependency).
• [x] terraform/modules/keycloak/main.tf -- EXISTS. Verified at full path. Contains both reference implementations (westside lines 29-39, landscaping lines 45-55).

• [x] "lines 42-55" -- landscaping ConfigMap resource (actual: comment at 41, resource at 45-55). Close enough for agent guidance.
• [x] "lines 178-182" -- landscaping volume_mount block. Verified exact match.
• [x] "lines 249-265" -- landscaping volume definition block. Verified exact match.

Repo Placement

Dependencies

• Upstream: paldocs #82 (board item #1705, column: todo, 3pts) -- CSS theme source. Issue explicitly states "must be completed first." This ordering must be respected during sprint execution.
• Downstream: pal-e-services #162 (board item #1719, column: backlog, 1pt) -- sets login_theme = "paldocs" on the realm. Cannot apply until this ticket and #82 are complete.
• Sibling sprint:3 auth items: paldocs #26 (OIDC client TF, todo), pal-e-platform #491 (NetworkPolicy, todo), pal-e-deployments #224 (env vars, todo). Independent of this ticket but part of the same auth story.

Acceptance Criteria

• File existence checks (criteria 1-2): trivial
• Terraform resource presence (criteria 3-5): grep/read verification
• tofu plan clean addition (criterion 6): real command provided in Test Expectations
• Keycloak pod restart (criterion 7): requires apply, appropriate for validation phase

Blast Radius

• New ConfigMap resource -- no effect on existing westside/landscaping ConfigMaps
• New volume + volume_mount on Keycloak deployment -- Kubernetes will restart the pod, causing brief downtime for all Keycloak-authenticated apps (acceptable; probes handle recovery)
• Issue explicitly states "Files the agent should NOT touch: Existing westside/landscaping theme resources"
• AC #6 verifies: "tofu plan shows clean addition (no destroy/recreate of existing themes)"

Decomposition Assessment

• 3 file targets, all in 1 repo -- under threshold
• 7 acceptance criteria -- slightly above 5, but all are trivial verification steps following an established copy-paste pattern
• Estimated agent time: well under 5 minutes -- the landscaping implementation is a direct template to follow

Recommendation