pal-e-docs

Review: Add Dockerfile (westside-streamlit #2)

review-933-2026-04-10 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Ticket body is excellent — thorough, testable, well-scoped. Only gap is the backing architecture note for the arch:ci-pipeline label.

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — standalone, discovered during project bootstrap 2026-04-10
  • [x] Repo — forgejo_admin/westside-streamlit
  • [x] User Story — operator wants container image for pipeline deploy
  • [x] Context — explains Streamlit runtime model vs uvicorn pattern
  • [x] File Targets — Dockerfile + .dockerignore (create), app.py/requirements.txt (do-not-touch)
  • [x] Acceptance Criteria — 6 testable criteria
  • [x] Test Expectations — 4 concrete test commands
  • [x] Constraints — base image, uv, non-root uid 1000, healthcheck, CMD
  • [x] Checklist — present
  • [x] Related — project + arch-deployment-westside-streamlit

Traceability

  • [x] story:reachable — present on board item
  • [x] story note verified — story-westside-streamlit-reachable exists and explicitly lists "Dockerfile" as supporting ticket #1
  • [x] arch:ci-pipeline — present on board item
  • [ ] arch note MISSING — no backing arch-ci-pipeline note in pal-e-docs. Label is used platform-wide (validation-pipeline convention, prior reviews) but no dedicated note exists.
  • [x] Forgejo issue — https://forgejo.tail5b443a.ts.net/forgejo_admin/westside-streamlit/issues/2 (open)
  • [x] Bonus: arch-deployment-westside-streamlit exists and explicitly enumerates this Dockerfile as gap item #1 in the target topology

File Targets

  • [x] Dockerfile — verified absent at ~/westside-streamlit/Dockerfile (correct, this is the create target)
  • [x] .dockerignore — verified absent (correct, create target)
  • [x] app.py — verified present at ~/westside-streamlit/app.py, do-not-touch constraint is correct
  • [x] requirements.txt — verified present; pins streamlit==1.56.0, psycopg[binary]==3.3.3, pandas==3.0.2. Do-not-touch constraint holds.
Targets are specific enough for an agent to act on without guessing.

Repo Placement

OK. Fix lives in westside-streamlit, issue filed on westside-streamlit. Single repo, no cross-repo work.

Dependencies

  • [x] app.py exists — satisfied
  • [x] requirements.txt pinned — satisfied
  • [x] Reference Python service Dockerfiles (basketball-api, mcd-tracker-api, minio-api) — satisfied
First ticket in the "reachable" deployment chain. Blocks #3 (Woodpecker pipeline), #4 (kustomize overlay), #6 (Tailscale funnel), #7 (Keycloak OIDC). Does not block #5 (Postgres read-only role) or #8 (blast feature). No upstream blockers. Dependency chain is clear from arch-deployment-westside-streamlit gap list and story-westside-streamlit-reachable supporting tickets list, even though not restated in the issue body.

Acceptance Criteria

Strong. All 6 AC are programmatically verifiable: docker build exit 0, docker images size <250 MB, docker run + dashboard load, docker exec uid check, curl /_stcore/health HTTP 200, missing-PGURL fast-fail. Test Expectations section duplicates these as explicit commands with a single run command. No ambiguous "works correctly" language.

Blast Radius

Low. New files only (Dockerfile, .dockerignore), no modifications to existing code. Pattern (python:3.12-slim + uv + non-root uid 1000 + healthcheck) matches platform Python service convention — agent has working references. Streamlit-specific deviation (long-lived server vs uvicorn workers) is called out explicitly in Context. No downstream consumers yet — this ticket is the first to produce an image. Rollback is trivial: git rm Dockerfile .dockerignore.

Decomposition Assessment

  • Discrete changes: 2 (Dockerfile, .dockerignore) — under 3-thing limit.
  • File count: 2 files, 1 repo — under decomposition threshold.
  • Acceptance criteria: 6 — at the upper edge but all are single-command checks against the same artifact.
  • Estimated agent time: 3–5 minutes. Within the five-minute rule.
  • Parallelizable subtasks: no — both files are tightly coupled to the same build.
No decomposition needed. Fits comfortably in a single agent pass.

Recommendation

  • [SCOPE] Create architecture note arch-ci-pipeline for the shared Woodpecker CI → Harbor → ArgoCD component. This is a platform-wide gap — the label is used on many tickets across projects but no backing note exists. Not a blocker unique to this ticket; escalate to Ava as a platform-level scoping item. If Ava waives the arch-note requirement (pre-existing platform gap), this ticket is effectively READY to advance to todo.
  • No other action needed. Ticket body, file targets, AC, and test expectations are execution-ready.