pal-e-docs

Review: Add prediction-assistant database to CNPG

review-1769-2026-07-04 Review

review ready
Project

Verdict: READY

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — Standalone
  • [x] Repo — ldraney/pal-e-services
  • [x] User Story — present, proper As/I want/So that format
  • [x] Context — explains SQLite-to-Postgres migration history (Sprint 2, PR #33)
  • [x] File Targets — includes both modify and do-not-touch lists
  • [x] Feature Flag — none (appropriate for infra)
  • [x] Acceptance Criteria — 3 items, all verifiable
  • [x] Test Expectations — tofu plan command specified
  • [x] Constraints — follow existing pattern
  • [x] Checklist — standard 3-item checklist
  • [x] Related — prediction-assistant project referenced

Traceability

  • [x] story:platform-setup label — Platform Setup
  • [x] story note verified — story-prediction-assistant-platform-setup found in project-prediction-assistant user-stories section
  • [x] arch:postgres label — PostgreSQL Architecture
  • [x] arch note verified — arch-postgres note exists in pal-e-docs (project: prediction-assistant, status: active)
  • [x] Forgejo issue — ldraney/pal-e-services#172, state: open

File Targets

  • [x] terraform/k3s.tfvars — verified: exists (symlink to ../../secrets/pal-e-services/k3s.tfvars). Contains service_databases map at line 15 with existing entries for palinks and westside_basketball. Pattern is clear: map key = role name, value = {password, databases list}.
  • [x] terraform/databases.tf — verified: exists, contains for_each = var.service_databases loop that auto-provisions roles and databases. Correctly listed as do-not-touch.

Database Name Verification

Cross-checked against config/database.yml in prediction-assistant repo. Production config expects DATABASE_URL (primary), CACHE_DATABASE_URL, QUEUE_DATABASE_URL, CABLE_DATABASE_URL. The ticket's proposed databases (prediction_assistant, prediction_assistant_cache, prediction_assistant_queue, prediction_assistant_cable) match exactly.

Repo Placement

OK — issue filed on ldraney/pal-e-services, file target is in pal-e-services. Single-repo change.

Dependencies

  • #1767 (id=1767) "Add prediction-assistant to services terraform" — sprint:9 sibling, independent (provisions namespace/Harbor/ArgoCD, not database)
  • #1768 (id=1768) "Add Keycloak realm + OIDC client" — sprint:9 sibling, independent
  • #1772 (id=1772) "tofu apply — provision prediction-assistant infra" — sprint:10, depends on this ticket being done first. Sprint ordering handles sequencing correctly.
Dependencies are not explicitly documented in the issue body but the sprint ordering (9 before 10) handles sequencing. Acceptable for infra tickets in the same plan.

Acceptance Criteria

3 criteria, all agent-verifiable:
  • service_databases has prediction_assistant entry — verifiable by grep/read
  • 4 databases listed — verifiable by reading the databases list in tfvars
  • Password in gitignored tfvars — verifiable by checking file location (already a symlink to secrets/)
Test command cd terraform && tofu plan is real and appropriate.

Blast Radius

Minimal. Adding a new entry to the service_databases map is purely additive. The for_each loop in databases.tf is stable and handles new entries without affecting existing databases (palinks, westside_basketball). No downstream consumers are affected by adding a new database role.

Decomposition Assessment

1 file target, 1 repo, 3 acceptance criteria. Estimated agent work: under 2 minutes (add a map entry with generated password). No decomposition needed.

Recommendation

No action needed.