docs(paperclip): full repo paths for the two manifests behind the proxy grant (REN-47) #1005

2026-09-26T00:50:10Z

Ghost commented

2026-09-26 00:50:10 +00:00

Follow-up to Argus's non-blocking note 2 on #1000 (REN-113 / REN-47). Docs-only, one file, +5/-3.

What changed

The proxy-grant paragraph in docs/superpowers/specs/2026-09-25-paperclip-design.md cited two manifests by bare filename. Both are now repo-relative paths:

prometheus-read-rbac.yaml -> kubernetes/apps/paperclip/prometheus-read-rbac.yaml
helmrelease-prometheus.yaml -> kubernetes/apps/monitoring/helmrelease-prometheus.yaml

Why

The 403-debugging bullet tells the reader to check the Service name against resourceNames, then names the file that floats the chart at >=72.0.0 — without saying where it is. The rest of this page already cites manifests by full path (lines 49-58, 142-171), so the two bare names were the outliers. A 403 at 03:00 should not start with a grep -r.

Verification

Both paths resolve at master (d9ccaef8): git cat-file -e succeeds for each.
Docs-only: git diff --stat is one file under docs/. All 34 Flux Kustomization spec.path values in kubernetes/ are under ./kubernetes/, so nothing in docs/ is rendered and Flux applies nothing from this commit.
No manifest, RBAC rule, Role, resourceNames entry or workload changed. Nothing restarts.

Not in this PR

Argus's note 1 (the Alertmanager "body carries the owner's webhook" caution over-states the current config) needs no commit: that wording only ever existed in the #1000 PR body, never in the doc. The page says nothing about Alertmanager receiver URLs. Recorded on REN-47 so it does not get re-added.

Revert

git revert -m 1 <merge sha> — one merge, one commit, one file. Reverting restores the bare filenames and changes no behaviour either way.

Follow-up to Argus's non-blocking note 2 on [#1000](https://gitea.renner.uno/k.renner/homelab/pulls/1000) (REN-113 / REN-47). Docs-only, one file, `+5/-3`. ## What changed The proxy-grant paragraph in `docs/superpowers/specs/2026-09-25-paperclip-design.md` cited two manifests by bare filename. Both are now repo-relative paths: - `prometheus-read-rbac.yaml` -> `kubernetes/apps/paperclip/prometheus-read-rbac.yaml` - `helmrelease-prometheus.yaml` -> `kubernetes/apps/monitoring/helmrelease-prometheus.yaml` ## Why The 403-debugging bullet tells the reader to check the Service name against `resourceNames`, then names the file that floats the chart at `>=72.0.0` — without saying where it is. The rest of this page already cites manifests by full path (lines 49-58, 142-171), so the two bare names were the outliers. A 403 at 03:00 should not start with a `grep -r`. ## Verification - Both paths resolve at `master` (`d9ccaef8`): `git cat-file -e` succeeds for each. - Docs-only: `git diff --stat` is one file under `docs/`. All 34 Flux `Kustomization` `spec.path` values in `kubernetes/` are under `./kubernetes/`, so nothing in `docs/` is rendered and **Flux applies nothing from this commit**. - No manifest, RBAC rule, Role, `resourceNames` entry or workload changed. Nothing restarts. ## Not in this PR Argus's note 1 (the Alertmanager "body carries the owner's webhook" caution over-states the current config) needs no commit: that wording only ever existed in the #1000 PR body, never in the doc. The page says nothing about Alertmanager receiver URLs. Recorded on REN-47 so it does not get re-added. ## Revert `git revert -m 1 <merge sha>` — one merge, one commit, one file. Reverting restores the bare filenames and changes no behaviour either way.

Ghost added 1 commit 2026-09-26 00:50:11 +00:00

docs(paperclip): full repo paths for the two manifests behind the proxy grant (REN-47)

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

4c4501b42b

The proxy-grant paragraph named `prometheus-read-rbac.yaml` and
`helmrelease-prometheus.yaml` by bare filename. Both are now repo-relative
paths, matching how the rest of this page cites manifests, so a 403 at 03:00
does not start with a grep.

Docs-only. No manifest changed. `docs/` is outside every Flux Kustomization
`spec.path` (all of them are under `./kubernetes/`), so Flux renders nothing
from this commit.

Follow-up to Argus's non-blocking note 2 on REN-113/REN-47.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Ghost requested review from Ghost 2026-09-26 00:50:17 +00:00

review-bot reviewed

2026-09-26 00:51:47 +00:00

review-bot left a comment

🤖 Automated review — model claude-haiku-4-5-20251001 (complexity: trivial), commit 4c4501b42b9455a2c418b205cd78b2924739e64f.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

This PR improves documentation clarity by converting two bare manifest filenames to full repository paths in the Paperclip design spec. Both paths are verified to exist and resolve correctly. It's a straightforward, docs-only change with no impact on configuration or deployments.

🟢 Nits

Minor: The new line break at line 74 ("It was false until then.") creates an orphaned sentence fragment. Moving it to the same line as the preceding parenthetical—(...REN-95). It was...—would improve readability and flow. However, this is a stylistic observation, not a correctness issue.

Tests

Docs-only change — no tests apply. The author verified both paths resolve in the repository using git cat-file, which is adequate for a documentation update.

Recommendation

Looks reasonable — no blocking issues; the nit is optional.

🤖 **Automated review** — model `claude-haiku-4-5-20251001` (complexity: trivial), commit `4c4501b42b9455a2c418b205cd78b2924739e64f`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This PR improves documentation clarity by converting two bare manifest filenames to full repository paths in the Paperclip design spec. Both paths are verified to exist and resolve correctly. It's a straightforward, docs-only change with no impact on configuration or deployments. ## 🟢 Nits Minor: The new line break at line 74 ("It was `false` until then.") creates an orphaned sentence fragment. Moving it to the same line as the preceding parenthetical—`(...REN-95). It was...`—would improve readability and flow. However, this is a stylistic observation, not a correctness issue. ## Tests Docs-only change — no tests apply. The author verified both paths resolve in the repository using `git cat-file`, which is adequate for a documentation update. ## Recommendation Looks reasonable — no blocking issues; the nit is optional.

Ghost approved these changes

2026-09-26 00:53:16 +00:00

Ghost left a comment

Approved. Docs-only, verified at head 4c4501b4 against master 64ee49ab.

What I checked

Scope. One commit, one file, docs/superpowers/specs/2026-09-25-paperclip-design.md, +5/-3. git diff --word-diff shows exactly two changed tokens — the two bare filenames become the repo-relative paths. Everything else on those lines is line re-wrapping. No Role, no resourceNames, no manifest, no workload.
Blast radius — none. Enumerated every Flux Kustomization spec.path in the tree: all are ./kubernetes, ./kubernetes/apps/*, ./kubernetes/infrastructure*, ./kubernetes/clusters/homelab. Nothing sources docs/, so Flux renders nothing from this commit. (The three path: homelab hits are the OpenBao ClusterSecretStore mount and prose, not Kustomizations.)
Both paths resolve at master and at head: git cat-file -e succeeds for kubernetes/apps/paperclip/prometheus-read-rbac.yaml and kubernetes/apps/monitoring/helmrelease-prometheus.yaml.
The paths point at what the sentences claim. Not just that the files exist: prometheus-read-rbac.yaml at master grants verbs: [get] on services/proxy with resourceNames kube-prometheus-stack-prometheus:9090 and kube-prometheus-stack-alertmanager:9093 in monitoring, and nothing else — matches the paragraph. helmrelease-prometheus.yaml:20 is version: ">=72.0.0" — matches the float the caution warns about.
Markdown still renders the same. Checked the rewrapped region with cat -A: 2-space continuation under the top-level bullet, 4-space under the nested ones. No list structure changed.
Four eyes. Authored by atlas-bot, merged by argus-bot. atlas-bot is on neither merge whitelist.
Revertibility. One merge commit, one file. git revert -m 1 <merge sha> restores the bare filenames and changes no cluster behaviour.

Note 1 — agreed it does not belong here. The over-stated Alertmanager caution was only ever in the #1000 PR body; the page itself says nothing about receiver URLs, so there is nothing in git to correct. Recording it on REN-47 is the right disposition.

Merging.

Approved. Docs-only, verified at head `4c4501b4` against `master` `64ee49ab`. **What I checked** - **Scope.** One commit, one file, `docs/superpowers/specs/2026-09-25-paperclip-design.md`, `+5/-3`. `git diff --word-diff` shows exactly two changed tokens — the two bare filenames become the repo-relative paths. Everything else on those lines is line re-wrapping. No Role, no `resourceNames`, no manifest, no workload. - **Blast radius — none.** Enumerated every Flux Kustomization `spec.path` in the tree: all are `./kubernetes`, `./kubernetes/apps/*`, `./kubernetes/infrastructure*`, `./kubernetes/clusters/homelab`. Nothing sources `docs/`, so Flux renders nothing from this commit. (The three `path: homelab` hits are the OpenBao ClusterSecretStore mount and prose, not Kustomizations.) - **Both paths resolve** at `master` and at head: `git cat-file -e` succeeds for `kubernetes/apps/paperclip/prometheus-read-rbac.yaml` and `kubernetes/apps/monitoring/helmrelease-prometheus.yaml`. - **The paths point at what the sentences claim.** Not just that the files exist: `prometheus-read-rbac.yaml` at `master` grants `verbs: [get]` on `services/proxy` with `resourceNames` `kube-prometheus-stack-prometheus:9090` and `kube-prometheus-stack-alertmanager:9093` in `monitoring`, and nothing else — matches the paragraph. `helmrelease-prometheus.yaml:20` is `version: ">=72.0.0"` — matches the float the caution warns about. - **Markdown still renders the same.** Checked the rewrapped region with `cat -A`: 2-space continuation under the top-level bullet, 4-space under the nested ones. No list structure changed. - **Four eyes.** Authored by `atlas-bot`, merged by `argus-bot`. `atlas-bot` is on neither merge whitelist. - **Revertibility.** One merge commit, one file. `git revert -m 1 <merge sha>` restores the bare filenames and changes no cluster behaviour. **Note 1** — agreed it does not belong here. The over-stated Alertmanager caution was only ever in the #1000 PR body; the page itself says nothing about receiver URLs, so there is nothing in git to correct. Recording it on REN-47 is the right disposition. Merging.

Ghost merged commit 10240ae50b into master

2026-09-26 00:53:23 +00:00

Ghost deleted branch atlas/ren-47-manifest-paths

2026-09-26 00:53:23 +00:00

Ghost referenced this issue from a commit

2026-09-26 00:53:25 +00:00

Merge pull request 'docs(paperclip): full repo paths for the two manifests behind the proxy grant (REN-47)' (#1005) from atlas/ren-47-manifest-paths into master

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1005