{"id":1802,"title":"Review: board-landscaping-observability#1313 -- Pyrra + Falco scope review","slug":"review-1313-2026-06-04","html_content":"

Verdict: BLOCK

\n

Board item: board-landscaping-observability#1313 (backlog, 5 points)
\nForgejo issue: ldraney/landscaping-assistant #90 -- \"Deploy Pyrra for SLO tracking and Falco for runtime security\"
\nReviewer: QA Agent
\nDate: 2026-06-04

\n

Template Completeness

\n

Checked against template-issue-feature:

\n\n

Traceability

\n\n

Traceability triangle is intact for the board item. However, the traceability to the platform plan is broken (see Decomposition Assessment below).

\n

File Targets

\n\n

Assessment: Targets are in a different repo than where the issue is filed. An agent dispatched against landscaping-assistant would not find these files.

\n

Repo Placement

\n

PROBLEM: The issue is filed in ldraney/landscaping-assistant but all work targets are in forgejo_admin/pal-e-platform. This is a cross-repo mismatch. The issue body even says Repo: forgejo_admin/pal-e-platform. Either:

\n\n

Dependencies

\n

Per plan-pal-e-platform, the two components have distinct dependency chains:

\n\n

The plan explicitly states \"Tier 1.5 gates Tier 2.\" Falco is Tier 2. Phase 19 (Kyverno) is a prerequisite for Phase 20 and is NOT STARTED. The issue does not acknowledge or justify skipping this dependency.

\n

Acceptance Criteria

\n

Evaluating each AC:

\n
    \n
  1. \"Pyrra deployed and generating PrometheusRules from SLO definitions\" -- Testable via kubectl get prometheusrules. Specific enough.
    2. \n
  2. \"Grafana dashboard shows error budget remaining and burn rate\" -- Testable but requires manual verification. No dashboard JSON path specified.
    3. \n
  3. \"At least one SLO defined (e.g., landscaping-assistant 99.5% availability)\" -- Testable. But the constraint says \"SLO targets need to be decided per-service before deployment\" -- so this AC depends on an unresolved prerequisite.
    4. \n
  4. \"Falco DaemonSet running and detecting test anomaly\" -- Testable via kubectl exec test. Specific enough.
    5. \n
  5. \"Falco alerts route through Alertmanager to Telegram\" -- Testable. Requires Alertmanager config changes not listed in file targets.
    6. \n
\n

AC quality is adequate individually, but conflated across two independent capabilities.

\n

Blast Radius

\n\n

Decomposition Assessment

\n

Three-thing limit: VIOLATED. This ticket has at least 5 discrete changes:

\n
    \n
  1. Deploy Pyrra/Sloth Helm release
    2. \n
  2. Write SLO YAML definitions
    3. \n
  3. Create Grafana SLO dashboard
    4. \n
  4. Deploy Falco Helm release (DaemonSet)
    5. \n
  5. Configure Falco alerting through Alertmanager
    6. \n
\n

Five-minute rule: VIOLATED. An agent would need substantial time to: resolve the Sloth/Pyrra decision, decide SLO YAML location, write SLO definitions for services, create Grafana dashboard JSON, deploy and test two independent Helm releases, and configure Alertmanager routing.

\n

Critical conflict -- Sloth vs Pyrra:

\n\n

Two sources of truth disagree. An agent cannot execute this without a human decision.

\n

Recommendation: Split into two issues aligned with existing plan phases:

\n\n

Helm Chart Verification

\n\n

The observability-roadmap.md references project repos, not chart repos. Terraform helm_release blocks will need the correct chart repository URLs.

\n

Recommendation

\n
    \n
  1. Resolve Sloth vs Pyrra. Human decision required. Update the losing side's documentation (either Phase 16 + project-pal-e-platform validation diagram, or observability-roadmap.md + this issue).
    2. \n
  2. Split into two issues aligned with existing plan phases: Phase 16 (SLO engine) and Phase 20b (Falco). File both in forgejo_admin/pal-e-platform.
    3. \n
  3. Address dependency chains in each new issue. Phase 16 depends on 14+15. Phase 20b depends on 10+19. Either complete prerequisites or document why they can be skipped.
    4. \n
  4. Decide SLO YAML location before the SLO issue moves forward. \"pal-e-platform or pal-e-deployments\" is not actionable.
    5. \n
  5. Add Alertmanager config to file targets for the Falco issue -- routing Falco alerts requires Alertmanager config changes not currently listed.
    6. \n
\n

Related

\n","is_public":true,"note_type":"doc","status":null,"parent_slug":null,"position":null,"created_by_sub":null,"created_by_name":null,"updated_by_sub":null,"updated_by_name":null,"project":{"id":62,"name":"Landscaping Observability","slug":"landscaping-observability","platform":"forgejo","repo_url":"https://forgejo.tail5b443a.ts.net/ldraney/landscaping-assistant","is_public":true,"page_note":null,"created_at":"2026-06-04T05:48:18.704474","updated_at":"2026-06-04T11:56:08.092486"},"tags":[{"id":84,"name":"review"},{"id":104,"name":"block"}],"created_at":"2026-06-04T11:54:29.981445","updated_at":"2026-06-04T11:54:29.981445"}