pal-e-docs

Review: deploy#242 ISS staging: provision CNPG database + re-add migrate init container

review-1928-2026-07-26 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Feature Flag
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related

Traceability

  • [x] story:dev-environment label -- Dev environment pipeline story
  • [x] story note verified -- found in project-iss user-stories section (key: dev-environment, backing: #192/#193/#194 + docs/pipeline.md)
  • [x] arch:kustomize label -- Kustomize overlays
  • [x] arch note verified -- arch-kustomize note exists in pal-e-docs (covers kalshi-assistant pattern; same overlay conventions apply to ISS)
  • [x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/pal-e-deployments/issues/242, open

File Targets

  • [x] overlays/intelligentstaffingsystems/staging/deployment-patch.yaml -- verified: file exists, currently has no init container (consistent with ticket context about removal in commit 9869037)
  • [x] overlays/intelligentstaffingsystems/staging/secrets.enc.yaml -- verified: file exists, SOPS-encrypted, currently has POSTGRES_USER/PASSWORD/HOST but no DATABASE_URL or DATABASE_NAME key
  • [x] ldraney/intelligentstaffingsystems/config/database.yml (cross-repo) -- verified: production section hardcodes database name intelligentstaffingsystems with no DATABASE_URL or DATABASE_NAME env var support. This confirms the core problem the ticket describes.
  • [ ] CNPG database provisioning resource -- ISSUE: title says "provision CNPG database" but no file target covers the provisioning mechanism. No CNPG custom resources exist anywhere in pal-e-deployments. If Rails db:prepare handles creation, this should be stated. If a manual step or separate resource is needed, add the target.

Repo Placement

Issue filed on ldraney/pal-e-deployments -- correct for the kustomize overlay work. Cross-repo dependency on ldraney/intelligentstaffingsystems/config/database.yml is identified under File Targets. However, the work requires PRs to two repos. The sequencing is critical: the database.yml change in ISS must land BEFORE the staging init container can safely run, otherwise it would still target the prod database. This sequencing is not documented in the issue body.

Dependencies

Peer tickets with sprint:staging label on board-iss:
  • #1930 platform#560 -- DNS CNAME for staging.intelligentstaffingsystems.ai (backlog)
  • #1931 svc#198 -- Caddy reverse proxy for staging (backlog)
  • #1932 svc#199 -- Harbor pull secret for staging image (backlog)
The issue correctly notes staging needs all three peers to be fully functional. These are co-dependencies, not blockers. The implicit prerequisite (database.yml must change first) is not documented.

Acceptance Criteria

4 AC, all testable by an agent. kubectl kustomize build check is a concrete runnable command. "Prod database is unaffected" is verifiable but requires the agent to confirm the staging init container's DATABASE_URL points to the staging database. The missing piece: no AC verifies that the ISS Rails app actually reads DATABASE_URL/DATABASE_NAME (the cross-repo change).

Blast Radius

Low. ISS is the only service with a staging overlay in pal-e-deployments. Other services with migrate init containers (palinks, basketball-api, landscaping-assistant) use their own database configs and are unaffected. The database.yml change in ISS would only affect staging behavior (prod section currently uses hardcoded names and would continue to do so unless DATABASE_URL is set).

Decomposition Assessment

3 file targets across 2 repos, 4 AC. At the boundary but within limits. The cross-repo nature adds coordination complexity but does not require decomposition -- a single agent can handle both PRs if sequencing is documented. No decomposition needed.

Recommendation

  • [BODY] Clarify CNPG database provisioning mechanism: state whether db:prepare creates the database (requires CREATE DATABASE privilege on the CNPG user) or whether a manual step / CNPG Database resource is needed. If a manual prerequisite, add it to Constraints.
  • [BODY] Add explicit cross-repo sequencing: "Step 1: PR to ldraney/intelligentstaffingsystems adding DATABASE_URL support to config/database.yml. Step 2: PR to ldraney/pal-e-deployments re-adding init container with DATABASE_URL env var in staging overlay." The ISS change is a hard prerequisite.
  • [BODY] Add DATABASE_URL (or DATABASE_NAME) env var to the staging deployment-patch.yaml file target description -- both the init container and app container need this new env var to point at the staging database instead of the hardcoded prod name.