Review: Landing site rename

Verdict: NEEDS_REFINEMENT

Template Completeness

• [x] Type — Feature
• [x] Lineage — Standalone, architectural decision from 2026-03-27
• [x] Repo — forgejo_admin/westside-app
• [x] User Story — superadmin wants repo renamed so westside-app is freed for auth portal
• [x] Context — clear motivation, 3-phase split described
• [x] File Targets — 6 targets listed with do/don't-touch sections
• [x] Acceptance Criteria — 6 items
• [x] Test Expectations — 3 manual checks + 1 curl command
• [x] Constraints — 5 constraints including atomicity, Harbor naming, tofu -lock=false
• [x] Checklist — present
• [x] Related — project link + related issues + future phases

Traceability

• [x] story:WS-S26 label — Westside landing site story
• [x] arch:landing-site label — landing site architecture component
• [x] Forgejo issue — forgejo_admin/westside-app#109, open

File Targets

• [x] Forgejo repo settings (rename via API) — valid target, API endpoint exists
• [x] pal-e-services/terraform/k3s.tfvars — verified: line 41 westside-app = {, line 43 client_id = "westside-app", line 130 forgejo_repo = "forgejo_admin/westside-app"
• [x] pal-e-deployments/overlays/westsidekingsandqueens/ — verified: 5 files with 20+ references to westside-app (ingress, kustomization, deployment-patch, dev deployment)
• [x] pal-e-platform/terraform/main.tf — PARTIAL: main.tf itself only has a moved block for keycloak theme. The actual blackbox probe is in terraform/modules/monitoring/main.tf lines 366-368 (name = "westside-app", url, labels). File target path is imprecise.
• [x] .woodpecker.yaml — verified: line 16 uses ${CI_REPO} for clone URL. Auto-adjusts as ticket states.
• [x] Woodpecker webhook + secrets — valid concern, needs verification after rename

• [ ] pal-e-services/terraform/keycloak-import.sh — ISSUE: lines 13, 28-29 reference westside-app in import commands. Not listed in ticket.
• [ ] pal-e-services/terraform/services.tf — ISSUE: line 173 has a comment referencing westside-app-funnel. Minor but should be consistent.

Repo Placement

• westside-app — Forgejo API rename only (no code changes)
• pal-e-services — tfvars service key, forgejo_repo, Keycloak client map key, import script
• pal-e-deployments — 5 files across prod/dev overlays
• pal-e-platform — monitoring module blackbox probe

Dependencies

• Undocumented blocker: Board items #534 ("Show contract status in admin CRM player list") and #529 ("Validate: girls draft board + coach login access") are currently in_progress with arch:westside-app. Renaming the repo while these have open branches will break their CI pipelines and require branch rebases against the renamed remote. These must complete before the rename.
• pal-e-services#35 (dead funnel ingress) is listed as related cleanup — appropriate.
• Phase 2 (extract app routes) and Phase 3 (separate funnels) are correctly deferred to future tickets.

Acceptance Criteria

• [x] "Repo renamed on Forgejo" — verifiable via API
• [x] "CI pipeline builds and pushes successfully" — verifiable via Woodpecker
• [x] "ArgoCD syncs under new repo reference" — verifiable via kubectl/ArgoCD
• [x] "Site remains live" — verifiable via curl
• [x] "No broken webhooks or secrets" — verifiable via Woodpecker
• [ ] "Harbor project updated or new project created" — ISSUE: image_repo = "westsidekingsandqueens/app" in k3s.tfvars. Harbor project is derived from hostname prefix (westsidekingsandqueens), not repo name. Per feedback_harbor_project_naming.md, Harbor project should NOT need changing. This AC is likely wrong — should be "Verify Harbor project unchanged (image_repo uses hostname prefix, not repo name)" or removed.

Blast Radius

• basketball-api — references westside-app in 2 source comments (routes/register.py, routes/public.py) and 1 doc file. These are comments only, no functional impact. Ticket correctly lists this as "do not touch." Acceptable.
• pal-e-deployments/overlays/basketball-api/prod/kustomization.yaml — has a comment referencing westside-app cross-namespace access. Comment only, no functional impact.
• Keycloak client_id is westside-app (k3s.tfvars line 43). The ticket says "Keycloak config — realm/client names are independent of repo name" which is true for the Keycloak realm, but the tfvars map KEY is westside-app. Decision needed: should the service key and client_id rename to westside-landing, or stay as westside-app? If the point is that westside-app will become the auth portal later, keeping westside-app as the Keycloak client for the landing site creates confusion. But changing it now means updating redirect URIs, secrets, and the SvelteKit app's auth config.

Decomposition

• File targets: 8+ files across 4 repos (exceeds >3 files across >2 repos threshold)
• Acceptance criteria: 9 verifiable items (exceeds >5 AC threshold)
• Estimated agent time: 15-20 minutes due to cross-repo coordination, API calls, terraform plans, and ArgoCD sync verification
• Atomicity constraint adds risk — if any step fails mid-rename, recovery is manual

• Forgejo repo rename + Woodpecker verification (standalone API operation)
• pal-e-services tfvars + terraform apply (service key, forgejo_repo, import script)
• pal-e-deployments overlay updates (all 5 files)
• pal-e-platform monitoring probe update

Recommendation

• [BODY] Fix file path: pal-e-platform/terraform/main.tf → pal-e-platform/terraform/modules/monitoring/main.tf (lines 366-368)
• [BODY] Add missing file target: pal-e-services/terraform/keycloak-import.sh (lines 13, 28-29)
• [BODY] Add missing file target: pal-e-services/terraform/services.tf (line 173, comment reference)
• [BODY] Fix AC: "Harbor project updated or new project created" → "Verify Harbor project unchanged (image_repo uses hostname prefix westsidekingsandqueens, not repo name)"
• [BODY] Update checklist to include pal-e-platform PR
• [LABEL] Board item #450 has title "None" — update title to "Landing site rename" to match board item metadata
• [SCOPE] Clarify: should Keycloak client_id rename from westside-app to westside-landing? If yes, add SvelteKit auth config + redirect URI updates to file targets. If no, document why the landing site keeps the westside-app client_id.
• [SCOPE] Document dependency: in_progress items #534 and #529 must complete before rename. Add blocked-by:ws-534,ws-529 label or document in Constraints.
• [DECOMPOSE] 8+ files across 4 repos, 9 AC, ~15-20 min estimated. Split into 3-4 sub-tickets via template-board: (1) Forgejo rename + webhook verify, (2) pal-e-services terraform, (3) pal-e-deployments overlays, (4) pal-e-platform monitoring.