pal-e-docs

Review: fix: /admin returns 500 — ADMIN_SECRET not in prod deployment

review-835-2026-04-05 Doc

review ready
Project

Verdict: READY

Template Completeness

  • [x] Type — Bug
  • [x] Lineage — Standalone, discovered scope from #46
  • [x] Repo — forgejo_admin/pal-e-deployments
  • [x] User Story — Marcus (operator) needs /admin to load so he can manage the game queue
  • [x] Context — ADMIN_SECRET added to dev overlay in #46 but never to prod
  • [x] File Targets — 1 file with exact YAML block to add
  • [x] Acceptance Criteria — 4 testable criteria
  • [x] Test Expectations — kubectl verify, curl /admin, ArgoCD sync check
  • [x] Constraints — single-file change, no new secrets needed
  • [x] Checklist — implicit in file targets (single block addition)
  • [x] Related — links to #46 and #95

Traceability

  • [x] story:operator-flow label — Marcus's operator view
  • [ ] story note MISSING — [SCOPE] Create user story entry "operator-flow" on project-twitch-2k-wager user-stories section (section does not exist yet)
  • [x] arch:deployment-twitch-2k-wager label — kustomize overlay component
  • [ ] arch note MISSING — [SCOPE] Create architecture note arch-deployment-twitch-2k-wager in pal-e-docs
  • [x] Forgejo issue — forgejo_admin/twitch-2k-wager#63, open

File Targets

  • [x] overlays/twitch-2k-wager/prod/deployment-patch.yaml — verified: file exists in pal-e-deployments repo, ADMIN_SECRET is NOT present (last env var is STRIPE_WEBHOOK_SECRET at lines 21-25), confirming the bug
  • [x] overlays/twitch-2k-wager/dev/deployment.yaml — verified: ADMIN_SECRET correctly mapped at lines 46-50, confirming the pattern to replicate
  • [x] K8s secret twitch-2k-wager-secrets — verified via kubectl: admin-secret key exists in the secret
Targets are specific enough — exact YAML block provided in issue body.

Repo Placement

OK. Issue filed on twitch-2k-wager repo (project tracker) but correctly identifies fix repo as forgejo_admin/pal-e-deployments. Single repo change. Agent must be dispatched against pal-e-deployments, not twitch-2k-wager.

Dependencies

  • [x] Board item #817 (twitch-2k-wager#46 — "Fix: ADMIN_SECRET in dev overlay") — satisfied (done column)
  • [x] K8s secret admin-secret key — satisfied (confirmed exists in prod namespace)
No unresolved dependencies.

Acceptance Criteria

4 criteria, all verifiable:
  • [x] ADMIN_SECRET in prod deployment spec — kubectl get deployment twitch-2k-wager -n playme2k -o json | jq '.spec.template.spec.containers[0].env'
  • [x] /admin loads successfully — curl -s -o /dev/null -w "%{http_code}" https://playme2k.tail5b443a.ts.net/admin
  • [x] ArgoCD syncs cleanly — argocd app get playme2k
  • [x] No regression in existing env vars — diff deployment spec before/after
All criteria are concrete, specific, and agent-testable. No ambiguous language.

Blast Radius

  • 1 file touched in 1 repo (pal-e-deployments)
  • Change is additive (new env var block), not mutative — existing env vars untouched
  • ADMIN_SECRET grep across pal-e-deployments shows only the dev overlay uses it — no other services affected
  • Rollback is trivial — revert the single YAML block addition

Decomposition Assessment

Apply the three-thing limit and five-minute rule:
  • 1 discrete change (add YAML block to 1 file) — well under 3-thing limit
  • Estimated agent time: under 2 minutes — well under 5-minute rule
  • No independent subtasks to parallelize — atomic single change
No decomposition needed.

Recommendation

  • [SCOPE] Create user-stories section on project-twitch-2k-wager with "operator-flow" story entry — traceability backfill, does not block dispatch
  • [SCOPE] Create architecture note arch-deployment-twitch-2k-wager for the kustomize overlay component — traceability backfill, does not block dispatch
Neither recommendation blocks execution. Scope is solid for dispatch.