ops: document Sentry fallback env

Author: ohld

agents/.paperclip.yaml

@@ -123,6 +123,14 @@ agents:
         SENTRY_AUTH_TOKEN:
           kind: "secret"
           requirement: "optional"
+        SENTRY_ORG:
+          kind: "plain"
+          default: "ffmemes"
+          requirement: "optional"
+        SENTRY_PROJECT:
+          kind: "plain"
+          default: "ff-backend"
+          requirement: "optional"
         COOLIFY_ACCESS_TOKEN:
           kind: "secret"
           requirement: "optional"
@@ -182,6 +190,14 @@ agents:
         SENTRY_AUTH_TOKEN:
           kind: "secret"
           requirement: "required"
+        SENTRY_ORG:
+          kind: "plain"
+          default: "ffmemes"
+          requirement: "optional"
+        SENTRY_PROJECT:
+          kind: "plain"
+          default: "ff-backend"
+          requirement: "optional"
         PREFECT_AUTH_STRING:
           kind: "secret"
           requirement: "required"

agents/qa-engineer/AGENTS.md

@@ -25,7 +25,7 @@ You are running without a human operator. NEVER call `AskUserQuestion`. When ski
 
 ## Log Sources
 
-1. **Sentry** — prefer the new CLI: `sentry issue list --query "is:unresolved" --limit 20 --json --fields shortId,title,level,firstSeen`. If only `sentry-cli` exists, use `sentry-cli issues list --status unresolved --max-rows 20`. Use `sentry issue view <id>` / `sentry-cli issues info <id>` for details.
+1. **Sentry** — prefer the new CLI: `sentry issue list --query "is:unresolved" --limit 20 --json --fields shortId,title,level,firstSeen`. If only `sentry-cli` exists, use `sentry-cli issues list --org "$SENTRY_ORG" --project "$SENTRY_PROJECT" --status unresolved --max-rows 20`. Use `sentry issue view <id>` or Sentry REST API for details.
 2. **Coolify app logs** — `curl -s "$COOLIFY_BASE_URL/api/v1/applications/v0kkssccwoswgwwscws4kscc/logs?lines=200" -H "Authorization: Bearer $COOLIFY_ACCESS_TOKEN"`.
 3. **DB health** — `psql $ANALYST_DATABASE_URL` (read-only). Query `user_meme_reaction`, `user_stats.updated_at`, `meme_stats.updated_at`, and new `meme` rows in the last hour.
 
@@ -113,7 +113,7 @@ even when the run is partial or errored.
 
 When reviewing after a deploy, whether from scheduled heartbeat, Sentry trigger, or handoff:
 1. **Run `/canary`** — MANDATORY. Handles console errors, performance regressions, page failures, baseline comparison.
-2. **Sentry scan** — run `sentry issue list --query "is:unresolved" --limit 20 --json --fields shortId,title,level,firstSeen`; if only legacy `sentry-cli` exists, run `sentry-cli issues list --status unresolved --max-rows 20`. Cross-reference against the deploy timestamp.
+2. **Sentry scan** — run `sentry issue list --query "is:unresolved" --limit 20 --json --fields shortId,title,level,firstSeen`; if only legacy `sentry-cli` exists, run `sentry-cli issues list --org "$SENTRY_ORG" --project "$SENTRY_PROJECT" --status unresolved --max-rows 20`. Cross-reference against the deploy timestamp.
 3. Run E2E smoke tests if credentials are configured (see below).
 4. Report results to **CTO** — GREEN (all clear) or RED (issues found).
 

docs/paperclip-ops-runbook.md

@@ -344,7 +344,7 @@ Agents need `PATH=/paperclip/bin:$PATH` to find them.
 | `codex` | `/paperclip/bin/codex` | `npm install --prefix /paperclip/.npm-global @openai/codex@latest && ln -sf /paperclip/.npm-global/node_modules/.bin/codex /paperclip/bin/codex` |
 | `sentry` / `sentry-cli` | `/paperclip/bin/sentry` or system path | `npm install --prefix /paperclip/.npm-global sentry @sentry/cli && ln -sf /paperclip/.npm-global/node_modules/.bin/sentry /paperclip/bin/sentry && ln -sf /paperclip/.npm-global/node_modules/.bin/sentry-cli /paperclip/bin/sentry-cli` |
 
-`sentry` and legacy `sentry-cli` use different issue-list syntax. Prefer `sentry issue list --query "is:unresolved" --limit 20`; use `sentry-cli issues list --status unresolved --max-rows 20` only as a legacy fallback.
+`sentry` and legacy `sentry-cli` use different issue-list syntax. Prefer `sentry issue list --query "is:unresolved" --limit 20`; use `sentry-cli issues list --org "$SENTRY_ORG" --project "$SENTRY_PROJECT" --status unresolved --max-rows 20` only as a legacy fallback. QA and CTO receive `SENTRY_ORG=ffmemes` and `SENTRY_PROJECT=ff-backend` from the manifest.
 
 Post-deployment command (runs after each Coolify deploy) is configured to reinstall these,
 but runs as non-root `node` user — see Coolify Quirks below.