The Avatar Brothers

Verdict: APPROVED

Round 3 re-review of board item #1522. Previous reviews: review-1522-2026-06-20 (5 findings), review-1522-2026-06-20-r2 (2 remaining). Both remaining findings resolved.

Previous Findings Disposition

• [x] [BODY] k3s.tfvars clarification -- RESOLVED in r2. Issue states "local tofu apply, NOT a PR" with full path.
• [x] [BODY] godaddy-tofu file targets -- RESOLVED in r2. DNS targets listed under pal-e-platform: terraform/dns.tf + salt/pillar/caddy.sls.
• [x] [BODY] Missing AC for DNS -- RESOLVED in r2. AC includes "theavatarbrothers.com resolves and serves the app via Caddy reverse proxy" and "CNPG databases created". Total: 8 AC.
• [x] [SCOPE] Create arch-iac note -- RESOLVED. arch:iac added to convention-architecture-ids under Infrastructure category: "IaC provisioning (tofu apply, service onboarding, DNS records)". The convention note is the canonical backing definition for arch labels; a separate arch-iac note is not required.
• [x] [DECOMPOSE] Decomposition needed -- DISMISSED by project owner. This is standard three-repo service onboarding (patterned work following landscaping-assistant, not novel). 8 points is appropriate for the scope.

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- Standalone, follows docs ticket (#1)
• [x] Repo -- ldraney/the-avatar-brothers (primary), with pal-e-deployments, pal-e-platform, pal-e-services identified
• [x] User Story -- well-formed (developer wants CI/CD + prod deployment)
• [x] Context -- references three-repo IaC pattern, explains no Keycloak, lists all infrastructure components
• [x] File Targets -- comprehensive with create/modify/do-not-touch sections across all 4 repos
• [x] Feature Flag -- none (correct for infra work)
• [x] Acceptance Criteria -- 8 items, all testable
• [x] Test Expectations -- present with run command (bundle exec rspec)
• [x] Constraints -- present, references patterns, base images, port convention
• [x] Checklist -- present with multi-repo PR tracking (3 PRs + 1 local tofu apply)
• [x] Related -- present (the-avatar-brothers, landscaping-assistant reference)

All required sections present and complete.

Traceability

• [x] story:project-bootstrap label -- present on board item
• [x] story note verified -- "project-bootstrap" found in project-the-avatar-brothers user-stories section (Key: project-bootstrap, Role: Developer (Lucas), Summary: "Docs, infra, and pipeline deployed", Metric: "theavatarbrothers.com serves a page, CI/CD works")
• [x] arch:iac label -- present on board item
• [x] arch note verified -- arch:iac defined in convention-architecture-ids under Infrastructure category: "IaC provisioning (tofu apply, service onboarding, DNS records)"
• [x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/the-avatar-brothers/issues/2, state: open

File Targets

In the-avatar-brothers (currently docs-only):

• [x] Dockerfile -- to create. Harbor base images specified.
• [x] .woodpecker.yaml -- to create
• [x] docker-compose.yml -- to create
• [x] Gemfile / Gemfile.lock -- to create
• [x] Full Rails app skeleton -- to create
• [x] bin/setup -- to create

In pal-e-services (local tofu apply, NOT a PR):

• [x] ~/secrets/pal-e-services/k3s.tfvars -- correctly identified as local-only (gitignored). Add to services map and service_databases map. Run tofu apply.

In pal-e-deployments:

• [x] overlays/the-avatar-brothers/prod/kustomization.yaml -- to create
• [x] overlays/the-avatar-brothers/prod/deployment-patch.yaml -- to create
• [x] overlays/the-avatar-brothers/prod/secrets.enc.yaml -- to create (SOPS-encrypted)

In pal-e-platform:

• [x] terraform/network-policies.tf -- to modify (postgres ingress allowlist)
• [x] terraform/dns.tf -- to modify (godaddy_dns_record for theavatarbrothers.com A record)
• [x] salt/pillar/caddy.sls -- to modify (reverse proxy entry)

All file targets verified in r1/r2. No changes since.

Repo Placement

Correct. Issue filed on ldraney/the-avatar-brothers as primary repo. Work spans 4 repos matching the established three-repo IaC pattern plus pal-e-services for provisioning. Checklist tracks all 4 work items (3 PRs + 1 local tofu apply).

Dependencies

• [x] #1 (Docs) -- in done column. No blocker.
• #1541 "Hello world: Meet Lucas & Marcus landing page" (backlog, 3pts) -- depends on this infra ticket. Implicit from project-bootstrap story.
• #1525 "Spike: iOS app deployment" (backlog, 3pts) -- depends on infra being deployed.

Acceptance Criteria

8 acceptance criteria. All testable by an agent:

• [x] docker compose up on port 7143 -- verifiable locally
• [x] Woodpecker pipeline passes (lint, test, build) -- verifiable via Woodpecker MCP
• [x] Harbor image pushed on main merge -- verifiable via Harbor API
• [x] ArgoCD syncs and deploys -- verifiable via ArgoCD
• [x] Tailscale Funnel URL shows page -- verifiable via curl
• [x] theavatarbrothers.com resolves and serves via Caddy -- verifiable via curl/dig
• [x] Health check /up responds 200 -- verifiable via curl
• [x] CNPG databases created (primary, cache, queue, cable) -- verifiable via kubectl/psql

Blast Radius

Low. All changes are additive: new namespace entry in network-policies.tf, new DNS record, new Caddy site entry, new service in tofu var.services. No existing services modified.

Decomposition Assessment

Owner-dismissed. This is standard three-repo service onboarding patterned on landscaping-assistant. The work is repetitive infrastructure bootstrap, not novel development. 8 points is appropriate. No decomposition needed.

Recommendations

No action needed.

Verdict: NEEDS_REFINEMENT

Re-review of board item #1522 after scope refinement. Previous review: review-1522-2026-06-20.

Previous Findings Disposition

• [x] [BODY] k3s.tfvars clarification -- RESOLVED. Issue now explicitly states "local tofu apply, NOT a PR" and specifies full path ~/secrets/pal-e-services/k3s.tfvars with what tofu apply provisions.
• [x] [BODY] godaddy-tofu file targets -- RESOLVED. DNS targets now listed under pal-e-platform: terraform/dns.tf with godaddy_dns_record for theavatarbrothers.com pointing to module.hetzner_edge.server_ipv4. Also added salt/pillar/caddy.sls reverse proxy entry.
• [x] [BODY] Missing AC for DNS -- RESOLVED. AC now includes "theavatarbrothers.com resolves and serves the app via Caddy reverse proxy" and "CNPG databases created (primary, cache, queue, cable)". Total: 8 AC.
• [ ] [SCOPE] Create arch-iac note -- STILL MISSING. No arch-iac note exists in pal-e-docs. Carried forward.
• [ ] [DECOMPOSE] Decomposition needed -- STILL APPLIES. Issue now has 8 AC (up from 6) across 4 repos with 10+ files. Exceeds all 5-minute rule thresholds.

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- Standalone, follows docs ticket (#1)
• [x] Repo -- ldraney/the-avatar-brothers (primary), with pal-e-deployments, pal-e-platform, pal-e-services identified
• [x] User Story -- well-formed (developer wants CI/CD + prod deployment)
• [x] Context -- excellent: references three-repo IaC pattern, explains no Keycloak, lists all infrastructure components
• [x] File Targets -- comprehensive with create/modify/do-not-touch sections across all 4 repos
• [x] Feature Flag -- none (correct for infra work)
• [x] Acceptance Criteria -- 8 items, all testable
• [x] Test Expectations -- present with run command (bundle exec rspec)
• [x] Constraints -- present, references patterns, base images, port convention
• [x] Checklist -- present with multi-repo PR tracking (4 items: 3 PRs + 1 local tofu apply)
• [x] Related -- present (the-avatar-brothers, landscaping-assistant reference)

All required sections present and complete.

Traceability

• [x] story:project-bootstrap label -- present on board item
• [x] story note verified -- "project-bootstrap" found in project-the-avatar-brothers user-stories section (Key: project-bootstrap, Role: Developer (Lucas), Summary: "Docs, infra, and pipeline deployed", Metric: "theavatarbrothers.com serves a page, CI/CD works")
• [x] arch:iac label -- present on board item
• [ ] arch note MISSING -- [SCOPE] No arch-iac note found in pal-e-docs. Create architecture note arch-iac documenting the IaC component.
• [x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/the-avatar-brothers/issues/2, state: open

File Targets

In the-avatar-brothers (currently docs-only: CLAUDE.md, README.md, docs/):

• [x] Dockerfile -- to create. Harbor base images confirmed: harbor.tail5b443a.ts.net/library/ruby-rails-build:latest and ruby-rails-runtime:latest
• [x] .woodpecker.yaml -- to create
• [x] docker-compose.yml -- to create
• [x] Gemfile / Gemfile.lock -- to create
• [x] Full Rails app skeleton -- to create
• [x] bin/setup -- to create

In pal-e-services (local tofu apply, NOT a PR):

• [x] ~/secrets/pal-e-services/k3s.tfvars -- correctly identified as local-only (gitignored). Add to services map and service_databases map. Run tofu apply -var-file=k3s.tfvars.

In pal-e-deployments:

• [x] overlays/the-avatar-brothers/prod/kustomization.yaml -- to create. Reference verified: landscaping-assistant/prod/ has kustomization.yaml, deployment-patch.yaml, secrets.enc.yaml.
• [x] overlays/the-avatar-brothers/prod/deployment-patch.yaml -- to create
• [x] overlays/the-avatar-brothers/prod/secrets.enc.yaml -- to create (SOPS-encrypted)

In pal-e-platform:

• [x] terraform/network-policies.tf -- verified exists. Contains per-namespace NetworkPolicy resources with explicit ingress allowlists. Correct target.
• [x] terraform/dns.tf -- verified exists. Contains godaddy_dns_record resources for palinks.app and landscaping-assistant.app with module.hetzner_edge.server_ipv4. Pattern matches what the issue describes.
• [x] salt/pillar/caddy.sls -- verified exists. Contains site entries with domain, proxy_target (Tailscale hostname), and www_redirect. Pattern matches what the issue describes for theavatarbrothers.com.

All file targets verified. No invalid paths or incorrect assumptions.

Repo Placement

Issue filed on ldraney/the-avatar-brothers (correct as primary repo). Work correctly spans 4 repos matching the established three-repo IaC pattern plus pal-e-services for provisioning. DNS is now correctly placed in pal-e-platform/terraform/dns.tf (not a separate godaddy-tofu repo PR). Checklist tracks all 4 work items (3 PRs + 1 local tofu apply). Repo placement is correct.

Dependencies

• [x] #1 (Docs) -- in done column. No blocker.
• #1541 "Hello world: Meet Lucas & Marcus landing page" (backlog, 3pts) -- depends on this infra ticket (needs deployed pipeline to serve a page). Not documented in either ticket but implicit from the project-bootstrap story.
• #1525 "Spike: iOS app deployment" (backlog, 3pts) -- depends on infra being deployed. Not documented.
• Operational: tofu apply requires admin access to k3s cluster and Harbor. Not a code dependency.

Acceptance Criteria

8 acceptance criteria. All testable:

• [x] docker compose up on port 7143 -- verifiable locally
• [x] Woodpecker pipeline passes (lint, test, build) -- verifiable via Woodpecker MCP
• [x] Harbor image pushed on main merge -- verifiable via Harbor API
• [x] ArgoCD syncs and deploys -- verifiable via ArgoCD
• [x] Tailscale Funnel URL shows page -- verifiable via curl
• [x] theavatarbrothers.com resolves and serves via Caddy -- verifiable via curl/dig
• [x] Health check /up responds 200 -- verifiable via curl
• [x] CNPG databases created (primary, cache, queue, cable) -- verifiable via kubectl/psql

Blast Radius

Low. Changes to pal-e-platform network-policies.tf add a new namespace entry (no existing services modified). DNS and Caddy entries are additive. The pal-e-services tofu apply provisions new resources via for_each on var.services -- existing services unaffected.

Decomposition Assessment

NEEDS DECOMPOSITION -- route to skill-decompose-ticket.

• File count: 10+ files to create/modify across 4 repos (exceeds >3 files across >2 repos)
• AC count: 8 acceptance criteria (exceeds >5 threshold)
• Estimated time: Well over 5 minutes -- Rails scaffold + Dockerfile + Woodpecker + kustomize overlay + network policies + DNS + Caddy + tofu apply
• Recommended decomposition:
  1. Rails skeleton + Dockerfile + docker-compose in the-avatar-brothers (AC: docker compose up on 7143, health check /up returns 200)
  2. Woodpecker pipeline in the-avatar-brothers (AC: pipeline passes, Harbor image pushed)
  3. IaC provisioning: pal-e-services tofu apply + pal-e-deployments overlay + pal-e-platform network policy (AC: ArgoCD syncs, Funnel URL shows page, CNPG databases created)
  4. DNS + Caddy: pal-e-platform dns.tf + caddy.sls (AC: theavatarbrothers.com resolves and serves)

Recommendations

• [SCOPE] Create architecture note arch-iac documenting the IaC component across the platform. This is a cross-project concern (not specific to this ticket) but the arch:iac label on multiple board items across multiple projects needs a backing note.
• [DECOMPOSE] 10+ files across 4 repos, 8 AC, estimated well over 5 minutes. Route to skill-decompose-ticket for sub-ticket creation. Recommended 4-way split above.

Verdict: NEEDS_REFINEMENT

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- Standalone, follows #1
• [x] Repo -- ldraney/the-avatar-brothers
• [x] User Story -- present and well-formed
• [x] Context -- good background, references three-repo pattern
• [x] File Targets -- present with create/modify/do-not-touch sections
• [x] Feature Flag -- none (correct for infra work)
• [x] Acceptance Criteria -- 6 items, all testable
• [x] Test Expectations -- present with run command
• [x] Constraints -- present, references patterns and base images
• [x] Checklist -- present with multi-repo PR tracking
• [x] Related -- present

All required sections present. Template is complete.

Traceability

• [x] story:project-bootstrap label -- present on board item
• [x] story note verified -- "project-bootstrap" found in project-the-avatar-brothers user-stories section (Key: project-bootstrap, Role: Developer (Lucas), Summary: Docs, infra, and pipeline deployed)
• [x] arch:iac label -- present on board item
• [ ] arch note MISSING -- [SCOPE] No "arch-iac" note found in pal-e-docs. Create architecture note arch-iac documenting the IaC component (or confirm a different slug exists for this concern).
• [x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/the-avatar-brothers/issues/2, state: open

File Targets

In the-avatar-brothers repo (currently only has docs -- CLAUDE.md, README.md, docs/):

• [x] Dockerfile -- to create (does not exist yet, correct)
• [x] .woodpecker.yaml -- to create (does not exist yet, correct)
• [x] docker-compose.yml -- to create (does not exist yet, correct)
• [x] Gemfile / Gemfile.lock -- to create (does not exist yet, correct)
• [x] Full Rails app skeleton -- to create (correct, repo is docs-only currently)
• [x] bin/setup -- to create (does not exist yet, correct)

Reference implementation verified: landscaping-assistant has all four reference files (Dockerfile, .woodpecker.yaml, docker-compose.yml, bin/setup).

In pal-e-services:

• [ ] k3s.tfvars -- ISSUE: The issue says "k3s.tfvars" but the repo only has terraform/k3s.tfvars.example. The actual k3s.tfvars is gitignored (contains secrets). The service entry is driven by var.services in terraform/services.tf. The agent needs to add the service to the tfvars locally and run tofu apply, not open a PR for this file. [BODY] Clarify: "Add the-avatar-brothers to var.services in k3s.tfvars (local, not PR -- file is gitignored). Run tofu apply to provision Harbor project, robot accounts, namespace, ArgoCD app, and funnel."

In pal-e-deployments:

• [x] overlays/the-avatar-brothers/prod/ -- to create. Pattern verified: overlays/ directory exists with 12+ existing service overlays. landscaping-assistant/prod/ has deployment-patch.yaml, kustomization.yaml, secrets.enc.yaml as reference.

In pal-e-platform:

• [x] network-policies.tf -- to modify. File exists at terraform/network-policies.tf. Correct target for postgres access allowlist.

Missing from File Targets:

• [ ] godaddy-tofu DNS -- ISSUE: The ticket title says "godaddy-tofu DNS" but no godaddy-tofu file targets are listed. The godaddy-tofu repo exists and has DNS record resources. [BODY] Add godaddy-tofu file target or remove DNS from scope (split to separate ticket).

Repo Placement

Issue is filed on ldraney/the-avatar-brothers which is correct as the primary repo. The issue correctly identifies work spanning 4 repos (the-avatar-brothers, pal-e-services, pal-e-deployments, pal-e-platform). However, godaddy-tofu is mentioned in the title but not in File Targets, making it a 5th repo if DNS is in scope.

The Checklist section correctly tracks 4 separate PRs. If godaddy-tofu is in scope, a 5th PR line is needed.

Dependencies

• [x] #1 (Docs) -- in done column. No blocker.
• Board item #1541 "Hello world: Meet Lucas & Marcus landing page" (backlog, 3pts) depends on this infra ticket -- it needs the deployed pipeline to serve a page. Not documented in either ticket's scope.
• Board item #1525 "Spike: iOS app deployment" (backlog, 3pts) depends on infra being deployed. Not documented.
• pal-e-services tofu apply requires admin access to the k3s cluster and Harbor. Not a code dependency but an operational one.

Acceptance Criteria

6 acceptance criteria. All are testable by an agent:

• [x] docker compose up on port 7143 -- verifiable
• [x] Woodpecker pipeline passes -- verifiable via woodpecker MCP
• [x] Harbor image pushed -- verifiable via Harbor API
• [x] ArgoCD syncs -- verifiable via ArgoCD
• [x] Tailscale Funnel URL shows page -- verifiable via curl
• [x] Health check /up responds 200 -- verifiable via curl

Missing: No AC for godaddy-tofu DNS (theavatarbrothers.com resolving) despite being in the title.

Blast Radius

Low blast radius for existing services. Changes to pal-e-platform network-policies.tf could affect other services if the allowlist is misconfigured, but each service gets its own entry. The pal-e-services tofu apply provisions new resources only (for_each on var.services). No existing services are modified.

Decomposition Assessment

NEEDS DECOMPOSITION -- route to skill-decompose-ticket.

• File count: 10+ files to create across 4-5 repos (exceeds >3 files across >2 repos threshold)
• AC count: 6 acceptance criteria (exceeds >5 threshold)
• Estimated time: Well over 5 minutes -- Rails scaffold + Dockerfile + Woodpecker pipeline + kustomize overlay + network policies + tofu apply + DNS. Each repo needs its own PR.
• Recommended decomposition:
  1. Rails skeleton + Dockerfile + docker-compose in the-avatar-brothers (AC: docker compose up, health check /up)
  2. Woodpecker pipeline in the-avatar-brothers (AC: pipeline passes, Harbor image pushed)
  3. IaC: pal-e-services tofu apply + pal-e-deployments overlay + pal-e-platform network policy (AC: ArgoCD syncs, Funnel URL shows page)
  4. DNS: godaddy-tofu record for theavatarbrothers.com (AC: domain resolves)

Recommendations

• [BODY] Fix file target: "k3s.tfvars" is gitignored. Clarify that the agent should add the service to the local k3s.tfvars and run tofu apply, not open a PR for that file. Or reference terraform/services.tf for the pattern.
• [BODY] Add godaddy-tofu file targets (DNS record for theavatarbrothers.com) or remove "godaddy-tofu DNS" from scope and split to a separate ticket.
• [BODY] Add missing AC for DNS resolution if DNS stays in scope.
• [SCOPE] Create architecture note arch-iac documenting the IaC component across the platform.
• [DECOMPOSE] 10+ files across 4-5 repos, 6 AC, estimated well over 5 minutes. Route to skill-decompose-ticket for sub-ticket creation.

Vision

Animated motion comic website and iOS app telling the story of two brothers — Lucas and Marcus — who become dual Avatars. Episodes play as animated comic strips on page load: fight scenes, facial expressions, dialogue boxes. Character identity is the foundation. No UI chrome, no controls — just the story. Public site at theavatarbrothers.com.

User Stories

Architecture

Rails 8 monolith + Hotwire + GSAP. SVG characters with swappable expressions. Episodes are Rails views with embedded GSAP timelines. Content model: Season → Episode → Scene.

Key decisions: No Capacitor (Turbo Native for iOS). No PWA. No user accounts. Episodes auto-play on load.

Board

board-the-avatar-brothers

Status

Docs merged (PR #5). Architecture, user stories, and Episode 1 scene breakdown in place. Next: infra bootstrap (#2), then hello world landing page (#7).

Milestones

None yet.

Repos