pal-e-docs

Review: Automate Gmail OAuth re-auth lifecycle (7-day token expiry) v2

review-359-2026-03-27-v2 Review

review block
Project

Verdict: BLOCK

Template Completeness

  • [ ] Type -- MISSING (issue body is literal $NEW_BODY)
  • [ ] Lineage -- MISSING
  • [ ] Repo -- MISSING
  • [ ] User Story -- MISSING
  • [ ] Context -- MISSING
  • [ ] File Targets -- MISSING
  • [ ] Acceptance Criteria -- MISSING
  • [ ] Test Expectations -- MISSING
  • [ ] Constraints -- MISSING
  • [ ] Checklist -- MISSING
  • [ ] Related -- MISSING
The Forgejo issue body is the literal string $NEW_BODY -- a shell variable that was never interpolated. A comment on 2026-03-27T22:14:04Z claims "Issue body updated per scope review corrections" but the body was not actually updated. The entire issue spec has been lost or was never written.

Traceability

  • [ ] story:X label -- MISSING. Board item has arch:google-oauth,type:feature,scope:discovered but no story label. Prior review recommended story:platform-reliability.
  • [x] arch:google-oauth label -- present on board item #359.
  • [x] Forgejo issue -- forgejo_admin/pal-e-platform#162, confirmed open. But body is empty/broken.

File Targets

Cannot evaluate -- issue body is empty. Based on prior review (review-359-2026-03-27) and independent verification:
  • [x] salt/pillar/secrets_registry.sls -- verified exists. No Gmail OAuth entry present. Adding one is straightforward.
  • [x] scripts/ directory -- exists with 3 scripts (update-kustomize-tag.sh, woodpecker-update-tag-step.yaml, test-update-kustomize-tag.sh). A new gmail-reauth.sh would be consistent.
  • [x] ~/gmail-sdk/src/gmail_sdk/auth.py -- verified exists. Should be scoped as "do not touch."
  • [x] ~/gmail-mcp/ -- verified exists. Should be scoped as "do not touch."
  • [ ] Alerting/cron mechanism -- TBD. Prior review flagged this as unresolved.

Repo Placement

Cannot evaluate from issue body. Prior review confirmed pal-e-platform is the correct repo for core work (secrets_registry.sls, re-auth script). gmail-mcp#6 dependency is satisfied (board item #361, done).

Dependencies

  • Board item #361 (gmail-mcp SSH reauth, forgejo_admin/gmail-mcp#6) -- in done column. Prerequisite satisfied.
  • No blockers in in_progress or next_up that conflict.
  • Undocumented (from prior review): pal-e-mail uses a PVC (gmail-oauth, mounted at /secrets/gmail), not a k8s secret. The re-auth script must handle this or explicitly scope it out. Confirmed: pal-e-deployments/overlays/pal-e-mail/prod/deployment-patch.yaml mounts PVC gmail-oauth as a volume.
  • Two k8s secrets in basketball-api namespace: gmail-oauth-token (18 days old) and gmail-oauth-westsidebasketball (9 days old). Unclear if both are active.

Acceptance Criteria

Cannot evaluate -- issue body is empty. Prior review found 5 ACs with 2 ambiguous (day-6 alerting mechanism unspecified, pal-e-mail PVC vs secret unclear).

Blast Radius

  • Token file naming mismatch: Local file is ~/secrets/google-oauth/gmail-westsidebasktball.json (typo: missing 'e' in basketball). K8s secret is gmail-oauth-westsidebasketball (correct spelling). Any sync script must bridge this naming gap.
  • pal-e-mail PVC pattern: pal-e-mail reads from /secrets/gmail via PVC, not a k8s secret. Re-auth sync must account for this or create a separate ticket.
  • gmail-mcp also consumes the token file -- re-auth script needs to ensure gmail-mcp picks up the refreshed token.

Decomposition

Cannot fully assess without the spec. Prior review did not flag decomposition as needed (estimated 2-3 file targets in 1 repo, 5 ACs). If the alerting mechanism is specified, this likely fits in a single agent pass.

Recommendation

This is a BLOCK because the issue body is completely empty -- no agent can work from $NEW_BODY. Additionally, 4 issues from the prior NEEDS_REFINEMENT review remain unresolved:
  • [BODY] CRITICAL: Rewrite the entire issue body -- the current body is the literal string $NEW_BODY. The spec must be recreated from scratch using template-issue-feature. The prior review (review-359-2026-03-27) documents what the original content covered.
  • [LABEL] Add story:platform-reliability label to board item #359.
  • [BODY] Specify the day-6 alerting mechanism -- pick Prometheus alert rule, k8s CronJob, or Salt scheduled job. Add the specific file target path.
  • [BODY] Clarify pal-e-mail sync path -- PVC gmail-oauth is not a k8s secret. Either add PVC update to scope, explicitly exclude it, or create a separate ticket.
  • [BODY] Document the gmail-westsidebasktball.json typo vs gmail-oauth-westsidebasketball correct-spelling mapping in Constraints section.
  • [SCOPE] Clarify whether both k8s secrets in basketball-api namespace (gmail-oauth-token and gmail-oauth-westsidebasketball) are active, or if one is stale.