pal-e-docs

Review: Delete stale pal-e-app overlay from pal-e-deployments

review-427-2026-03-26 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Re-review after full rewrite. 4 of 5 original issues resolved. 1 remaining issue plus 1 new finding.

Previous Issues Resolution

  • [x] Issue 1: Wrong file targets — FIXED. Rewrite lists actual files: kustomization.yaml, deployment-patch.yaml, ingress.yaml, pal-e-auth-secrets.enc.yaml, harbor-creds.enc.yaml. All verified to exist at overlays/pal-e-app/prod/.
  • [x] Issue 2: Scope decision (update vs delete) — FIXED. Title changed to "Delete stale overlay." Context explicitly states the overlay is unused and ArgoCD points to in-repo k8s/. Scope is now "delete entire directory."
  • [ ] Issue 3: Repo placement — PARTIALLY FIXED. The ### Repo field correctly says forgejo_admin/pal-e-deployments. Constraints section says "This is a pal-e-deployments repo change." However, the Forgejo issue is still filed on forgejo_admin/pal-e-app repo, not forgejo_admin/pal-e-deployments. An agent spawned against this issue URL will clone pal-e-app, not pal-e-deployments.
  • [x] Issue 4: Missing ArgoCD acceptance criterion — FIXED. Test expectations now include kubectl get application -n argocd pal-e-app sync status check and cross-overlay render test.
  • [x] Issue 5: Missing scope (env vars, probes, memory, ingress) — FIXED via delete-all approach. Deleting the entire directory eliminates all stale references at once. No need to enumerate individual line changes.

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — Discovered scope from PR #57 (issue #53)
  • [x] Repo — forgejo_admin/pal-e-deployments
  • [x] User Story
  • [x] Context — clear explanation of why overlay is stale and why delete (not update)
  • [x] File Targets — all 5 files listed, all verified to exist
  • [x] Acceptance Criteria
  • [x] Test Expectations — includes ArgoCD sync check and sibling overlay render
  • [x] Constraints
  • [x] Checklist
  • [x] Related

Traceability

  • [x] story:spa-convention label — SPA convention migration story
  • [x] arch:deploy label — deployment architecture component
  • [x] Forgejo issue — forgejo_admin/pal-e-app#58, open

File Targets — all verified

  • [x] overlays/pal-e-app/prod/kustomization.yaml — verified: exists, references port 3000, pal-e-auth-secrets, harbor-creds, stale image tag
  • [x] overlays/pal-e-app/prod/deployment-patch.yaml — verified: exists, contains server env vars (PAL_E_DOCS_API_URL, AUTH_TRUST_HOST), port 3000 probes, pal-e-auth-secrets envFrom
  • [x] overlays/pal-e-app/prod/ingress.yaml — verified: exists, service port 3000
  • [x] overlays/pal-e-app/prod/pal-e-auth-secrets.enc.yaml — verified: exists, SOPS-encrypted dead secrets
  • [x] overlays/pal-e-app/prod/harbor-creds.enc.yaml — verified: exists, SOPS-encrypted. Issue correctly flags for evaluation.

Harbor-creds Safety Analysis

The harbor-creds secret in the pal-e-app namespace is managed by HashiCorp (Terraform/OpenTofu), NOT by the kustomize overlay. The in-repo k8s/deployment.yaml references harbor-creds as an imagePullSecret (line 21) but the in-repo k8s/kustomization.yaml does NOT include harbor-creds.enc.yaml as a resource. Deleting the overlay copy is safe — the secret is provisioned independently.

Repo Placement

STILL MISMATCHED. The ### Repo field and ### Constraints correctly identify pal-e-deployments as the target. But the Forgejo issue itself is filed on forgejo_admin/pal-e-app, not forgejo_admin/pal-e-deployments. The agent spawn hook reads the issue URL to determine which repo to clone. An agent spawned against forgejo_admin/pal-e-app#58 will clone pal-e-app and not find the overlay files.

Dependencies

  • Board item #414 (pal-e-app#53 — adapter-static switch) is in done column — parent work complete.
  • Board item #413 (pal-e-app#52 — client-side auth migration) is in done column — auth removal complete.
  • No blockers. This ticket is unblocked.

Acceptance Criteria

All criteria are testable:
  • "overlays/pal-e-app/ directory is deleted" — verifiable via ls
  • "No other overlays affected" — verifiable via kubectl kustomize on sibling overlays
  • "ArgoCD pal-e-app application still syncs correctly" — verifiable via kubectl get application

Blast Radius

  • ArgoCD confirmed using in-repo k8s/: repoURL: forgejo_admin/pal-e-app.git, path: k8s — the overlay is genuinely unused.
  • No other overlays in pal-e-deployments reference pal-e-app.
  • 10 other overlays in pal-e-deployments each have their own harbor-creds.enc.yaml — deleting one overlay's copy does not affect others.

Discovered Scope: in-repo k8s/ is stale

The in-repo ~/pal-e-app/k8s/deployment.yaml still references port 3000, pal-e-auth-secrets envFrom, PAL_E_DOCS_API_URL, AUTH_TRUST_HOST, and 128Mi memory limit. Out of scope for this ticket (which targets pal-e-deployments), but indicates discovered scope: the in-repo k8s/ manifests need their own cleanup ticket on forgejo_admin/pal-e-app.

Recommendation

One remaining issue before READY:
  • Move issue to correct repo — The Forgejo issue must be filed on forgejo_admin/pal-e-deployments, not forgejo_admin/pal-e-app. An agent spawned against the current URL will clone the wrong repo. Either create a new issue on pal-e-deployments and close this one, or use Forgejo transfer if available.
Discovered scope (separate ticket needed):
  • In-repo k8s/ cleanup — pal-e-app/k8s/deployment.yaml still has stale port 3000, server env vars, and auth secrets references. This should be a separate Forgejo issue on forgejo_admin/pal-e-app.