Ops: Configure pilot environment (Postgres, Slack app, API tokens)

Summary

Configure the pilot environment so M3+ flows work end-to-end: Postgres roster, Slack app, API tokens, and skill IDs. This is operational setup work that can proceed in parallel with code milestones.

Design reference: docs/DESIGN.md §5.6 (Prerequisites), §10 (Configuration), §13 (POC scope)

Why this issue exists

The pipeline requires data and secrets outside the Python codebase:

• person.slack_user_id must exist before status send or /status works
• Slack app must be installed with Socket Mode before status slack run
• Drafter skill must be published before status draft persists real entries
• PILOT_PERSON_IDS safety rail should be set before widening beyond solo pilot

Checklist

Postgres

• Provision Postgres instance (existing cluster DB or new)
• Set DATABASE_URL in .env and OpenShift Secret
• Run migrations: alembic upgrade head
• Seed pilot team person rows:

INSERT INTO person (person_id, display_name, slack_user_id, jira_account_id, github_login, active)
VALUES
  ('yoza', 'Yash Oza', 'UXXXXXXXX', '712020:...', 'yashoza19', true);
-- repeat for 6–10 pilot team members

Slack member ID: Slack profile → ⋮ → Copy member ID

Jira account ID: Atlassian account settings or API; used in JQL assignee filters

Slack app

Create app at https://api.slack.com/apps:

Setting	Value
App name	e.g. Weekly Status Bot
Socket Mode	On
Bot Token Scopes	chat:write, im:write, im:history, users:read, commands
Interactivity	On (no Request URL with Socket Mode)
Slash Commands	/status — description: "Show this week's status draft"

Install to workspace → copy tokens to .env:

SLACK_BOT_TOKEN=xoxb-...
SLACK_APP_TOKEN=xapp-...
REPORT_CHANNEL_ID=C...   # private channel for management reports (M5)

Jira

JIRA_BASE_URL=https://redhat.atlassian.net
JIRA_EMAIL=yoza@redhat.com
JIRA_API_TOKEN=...
JIRA_ACCOUNT_ID=712020:...
JIRA_PROJECTS=EET
JIRA_EPIC_FIELD=customfield_...   # if epic link uses custom field

Note: Shell export JIRA_API_TOKEN=... overrides .env. Run unset JIRA_API_TOKEN if stale token causes 403.

Token must have access to EET project (previous token lacked EET access).

GitHub

GITHUB_TOKEN=ghp_...   # read-only: repo, read:user
GITHUB_LOGIN=yashoza19
GITHUB_REPOS=org/repo1,org/repo2   # scope PR search

Anthropic / Skills

ANTHROPIC_API_KEY=sk-ant-...
CLAUDE_MODEL=claude-sonnet-5
DRAFTER_SKILL_ID=skill_...
DRAFTER_SKILL_VERSION=latest   # pin in prod after publish
SYNTHESIZER_SKILL_ID=skill_...  # M5

Publish skills:

pip install -e ".[slack,dev]"
status skills publish --skill drafter
status skills publish --skill synthesizer

POC safety rail

PILOT_PERSON_IDS=yoza   # comma-separated; expand gradually

Gap: PILOT_PERSON_IDS is parsed in config.py but not yet enforced in send_draft_review() — track enforcement in M6 batch issue or fix early when adding second pilot user.

Local validation flow

pip install -e ".[slack,dev]"
alembic upgrade head

status collect -p yoza --week 2026-08-14 --save-fixture
status draft -p yoza --week 2026-08-14

# terminal 1
status slack run

# terminal 2
status send -p yoza --week 2026-08-14
# or in Slack: /status

# click Looks right → verify in DB:
# SELECT confirmed_at FROM status_entry WHERE person_id='yoza' AND week_ending='2026-08-14';

Acceptance criteria

• One pilot user completes collect → draft → send → confirm locally
• All required env vars documented in .env.example (no secrets committed)
• OpenShift Secret populated from deploy/secrets.example.yaml when cluster deploy begins
• Team roster SQL or seed script checked in (optional: scripts/seed_pilot_team.sql with placeholder IDs)

Not in scope

• OpenShift Deployment manifests (M3.5 issue)
• CronJob automation (M6 issue)

Related open questions (design doc §15)

1. Which pilot team? Manager agrees to parallel Google Form reports for 3 weeks?
2. Report to Slack channel only, or also email?

Document decisions in issue comments when resolved.

Start with docs/DESIGN.md sections 5.6, 10, and 13, then inspect config.py and deploy/secrets.example.yaml. Run the listed install, migration, collect, draft, Slack, and send commands with placeholder-safe pilot credentials. Done means one pilot completes collect through confirmation, required variables are documented, and the OpenShift Secret and roster setup are ready without committed secrets.