ci: add vin-decoder spec to build-docs.yaml aggregation step

Add checkout step for leeworks-agents/vin-decoder and copy
vin-decoder/openapi.yaml into docs-site/public/specs/vin-decoder.yaml
so the vin-decoder.astro Redoc page renders correctly.

Closes leeworks-agents/api-company#148

.gitea/workflows/build-docs.yaml

@@ -42,12 +42,20 @@ jobs:
           token: ${{ secrets.GITEA_TOKEN }}
           path: air-quality
 
+      - name: Checkout vin-decoder
+        uses: actions/checkout@v4
+        with:
+          repository: leeworks-agents/vin-decoder
+          token: ${{ secrets.GITEA_TOKEN }}
+          path: vin-decoder
+
       - name: Copy openapi.yaml specs into docs-site
         run: |
           mkdir -p api-company/docs-site/public/specs
           cp zip-enrichment/openapi.yaml api-company/docs-site/public/specs/zip-enrichment.yaml
           cp holidays/openapi.yaml api-company/docs-site/public/specs/holidays.yaml
           cp air-quality/openapi.yaml api-company/docs-site/public/specs/air-quality.yaml
+          cp vin-decoder/openapi.yaml api-company/docs-site/public/specs/vin-decoder.yaml
           echo "Specs copied:"
           ls -la api-company/docs-site/public/specs/
 

.gitea/workflows/publish-openapi.yaml

@@ -2,7 +2,8 @@
 # Requires secrets (configured once RapidAPI listings are live):
 #   RAPIDAPI_PLATFORM_KEY, RAPIDAPI_ZIP_API_ID, RAPIDAPI_ZIP_VERSION_ID,
 #   RAPIDAPI_HOLIDAYS_API_ID, RAPIDAPI_HOLIDAYS_VERSION_ID,
-#   RAPIDAPI_AQI_API_ID, RAPIDAPI_AQI_VERSION_ID
+#   RAPIDAPI_AQI_API_ID, RAPIDAPI_AQI_VERSION_ID,
+#   RAPIDAPI_VIN_API_ID, RAPIDAPI_VIN_VERSION_ID
 #
 # If RAPIDAPI_PLATFORM_KEY is not set the publish step exits 0 with a skip message.
 
@@ -55,4 +56,6 @@ jobs:
           RAPIDAPI_HOLIDAYS_VERSION_ID: ${{ secrets.RAPIDAPI_HOLIDAYS_VERSION_ID }}
           RAPIDAPI_AQI_API_ID: ${{ secrets.RAPIDAPI_AQI_API_ID }}
           RAPIDAPI_AQI_VERSION_ID: ${{ secrets.RAPIDAPI_AQI_VERSION_ID }}
+          RAPIDAPI_VIN_API_ID: ${{ secrets.RAPIDAPI_VIN_API_ID }}
+          RAPIDAPI_VIN_VERSION_ID: ${{ secrets.RAPIDAPI_VIN_VERSION_ID }}
         run: node scripts/publish-openapi.js

ROADMAP.md

@@ -2,6 +2,8 @@
 
 Cross-repo milestones. Per-API phases live in each API repo's ROADMAP.md.
 
+> **As of 2026-05-30, a 4th API (VIN Decoder) has been added. Per-API phases also live in `leeworks-agents/vin-decoder`.**
+
 ## Phase 0 — Orientation (one-time)
 - [ ] Audit cluster: nodes, namespaces, ingress, Flux state → `docs/cluster-audit.md`
 - [ ] Add Flux GitRepository + Kustomization watching `leeworks-agents/api-company`
@@ -10,30 +12,38 @@ Cross-repo milestones. Per-API phases live in each API repo's ROADMAP.md.
 
 ## Phase 1 — API Contracts
 Each API repo writes its `openapi.yaml` first and lints it. Spec is the source of truth.
-- See: `leeworks-agents/zip-enrichment`, `holidays`, `air-quality`
+- See: `leeworks-agents/zip-enrichment`, `holidays`, `air-quality`, `vin-decoder`
 
 ## Phase 2 — Data
 Per-API: pull free public data sources, cache locally (SQLite or in-memory), schedule monthly re-seed.
+- VIN Decoder: NHTSA vPIC as data source — SQLite cache seeded on demand (issue #120)
 
 ## Phase 3 — Servers
 Per-API: implement Fastify/FastAPI service matching `openapi.yaml` exactly. RapidAPI proxy-secret middleware on every route.
+- VIN Decoder: Fastify server implementation (issue #121)
 
 ## Phase 4 — Monitoring
 - [ ] Prometheus + Grafana via Flux HelmRelease (`flux/monitoring/`)
 - [ ] Gatus public status page at `status.leeworks.dev`
 - [ ] Instrument every API with `api_requests_total`, `api_response_duration_seconds`, `api_data_freshness_seconds`
+- [ ] VIN Decoder metrics instrumentation + Grafana dashboard (issue #129)
+- [x] VIN Decoder Gatus health check (issue #134 — closed ✅)
 
 ## Phase 5 — Documentation site
 - [ ] `docs-site/` Astro + Redoc skeleton
 - [ ] Gitea Actions pipeline that copies per-API `openapi.yaml` files at build time
 - [ ] Deploy to `docs.leeworks.dev` via Flux
 - [ ] One SEO blog post per API minimum (see master prompt §Phase 5)
+- [x] VIN Decoder docs page (issue #123 — closed ✅)
+- [x] VIN Decoder SEO blog post (issue #124 — closed ✅)
 
 ## Phase 6 — Pre-launch
 - [ ] `docs/legal/terms-of-service.md`
 - [ ] `docs/legal/privacy-policy.md`
 - [ ] `docs/legal/acceptable-use-policy.md`
 - [ ] DNS: `zip.leeworks.dev`, `holidays.leeworks.dev`, `aqi.leeworks.dev`, `docs.`, `status.`, `registry.`
+- [x] VIN Decoder DNS `vin.leeworks.dev` (issue #130 — closed ✅)
+- [x] VIN Decoder RapidAPI listing (issue #131 — closed ✅ as tracker; operator action required)
 - [ ] PayPal linked to RapidAPI (manual, on 18th birthday)
 - [ ] Paid tiers enabled on RapidAPI listings (manual)
 
@@ -47,4 +57,4 @@ $100/mo **net** ≈ $136/mo gross after RapidAPI 25% + PayPal ~2%.
 | 7 Pro @ $19 | $97 net |
 | 3 Ultra @ $49 | $107 net |
 
-(Per-API rough math; mix-and-match across the 3 APIs.)
+(Per-API rough math; mix-and-match across all 4 APIs — ZIP Enrichment, Holidays, Air Quality, VIN Decoder.)

STATUS.md

@@ -1,6 +1,6 @@
 # Company Status
 
-_Last updated: 2026-05-30 (sprint planning cycle)_
+_Last updated: 2026-05-31 (sprint planning cycle)_
 
 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
@@ -8,6 +8,7 @@ _Last updated: 2026-05-30 (sprint planning cycle)_
 | ZIP Enrichment | [~]  | [~]  | [ ]      | [ ]                | 0            | $0  |
 | Holidays       | [~]  | [~]  | [ ]      | [ ]                | 0            | $0  |
 | Air Quality    | [ ]  | [ ]  | [ ]      | [ ]                | 0            | $0  |
+| VIN Decoder    | [x]  | [ ]  | [ ]      | [ ]                | 0            | $0  |
 
 Legend: [x]=done, [~]=in-progress, [ ]=not started
 
@@ -20,16 +21,31 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **Gatus status page:** Flux HelmRelease at `flux/monitoring/gatus-helmrelease.yaml` — PENDING Flux wiring (issue #8)
 - **API service manifests:** `flux/zip-enrichment/`, `flux/holidays/`, `flux/air-quality/` scaffolded (PR #48, closes #46)
 - **Image automation:** `flux/image-automation/` — ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
+- **VIN Decoder manifests:** `flux/vin-decoder/` — Flux HelmRelease + Kustomization committed (issue #140)
 
-## Completed This Cycle (2026-05-30 — Sprint Cycle)
-- **#108** — STATUS.md updated with 2026-05-30 sprint plan and critical path.
-- **#107** — docs-site build verified: `npm run build` exits 0; all 9 required routes present in `dist/` (`/`, `/zip-enrichment`, `/holidays`, `/air-quality`, `/blog/` (3 posts), `/legal/terms-of-service`, `/legal/privacy-policy`, `/legal/acceptable-use-policy`, `/pricing`). Unblocks #30.
-- **PR #105 MERGED** — `scripts/publish-openapi.js` + `.gitea/workflows/publish-openapi.yaml` (closes #100).
-- **PR #103 MERGED** — `docs-site/src/pages/pricing.astro` + nav link (closes #101).
-- **PR #104 MERGED** — `research/RESEARCH_LOG.md` first session: VIN Decoder next candidate (closes #102).
-- **New issues triaged** — #100–#108 (sprint planning cycle issues reviewed).
-- **`0xWheatyz/api-company`** — still does not exist; fork sync skipped (blocker #47).
-- **`kustomize build flux/` = PASS** — no regressions.
+## Completed This Cycle (2026-05-31 — Sprint Cycle)
+- **#146** — STATUS.md updated to reflect VIN Decoder sprint wave (#117–#141): APIs table row added, completed wave documented, blockers updated.
+- **#145** — ROADMAP.md updated to reference VIN Decoder as 4th API across all phases (Phase 1–6). `kustomize build flux/` = PASS.
+- **PR #147 opened** — docs: update ROADMAP.md and STATUS.md for VIN Decoder sprint wave (closes #145, #146).
+
+## Completed Previous Cycle (2026-05-30 — VIN Decoder Sprint Wave)
+### VIN Decoder issues #117–#141 — status as of 2026-05-31:
+- **#117** — VIN Decoder spec + feasibility — **closed ✅** (`apis/vin-decoder/openapi.yaml` merged)
+- **#120** — VIN Decoder data layer (SQLite/NHTSA vPIC) — **open, in progress** (P1 blocker)
+- **#121** — VIN Decoder Fastify server — **open, in progress** (P1 blocker, depends on #120)
+- **#122** — Create `leeworks-agents/vin-decoder` repo — **closed ✅**
+- **#123** — VIN Decoder docs page — **closed ✅**
+- **#124** — VIN Decoder SEO blog post — **closed ✅**
+- **#130** — VIN Decoder DNS `vin.leeworks.dev` — **closed ✅**
+- **#131** — VIN Decoder RapidAPI listing — **closed ✅** (tracker; operator action required)
+- **#133** — VIN Decoder pricing page integration — **closed ✅**
+- **#134** — VIN Decoder Gatus health check — **closed ✅**
+- **#135** — VIN Decoder image automation — **closed ✅**
+- **#136** — VIN Decoder ExternalSecret manifest — **closed ✅**
+- **#138** — Extend publish-openapi pipeline to include VIN Decoder — **closed ✅** (PR #142 merged)
+- **#139** — Operator: add RAPIDAPI_VIN_API_ID + RAPIDAPI_VIN_VERSION_ID secrets — **open** (operator task, blocked on RapidAPI listing)
+- **#140** — VIN Decoder Flux manifests — **closed ✅** (PR #143 merged)
+- **#141** — Pricing page updated for VIN Decoder — **closed ✅** (PR #144 merged)
 
 ## Critical Path (operator must complete in order)
 1. **Create `0xWheatyz/api-company` repo** (#47) — **highest priority, unblocks everything**
@@ -39,17 +55,34 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 5. **Enable Gitea packages + DNS for `registry.leeworks.dev`** (#4)
 6. **All other secrets** (#70, #73, #74, #79, #80, #81, #83) follow in order
 
-## New Issues This Sprint (2026-05-29, #100–#108)
-- **#100** — `scripts/publish-openapi.js` + CI workflow — **DONE (PR #105 merged)**
-- **#101** — Pricing page at `docs.leeworks.dev/pricing/` — **DONE (PR #103 merged)**
-- **#102** — Seed `research/RESEARCH_LOG.md` — **DONE (PR #104 merged)**
-- **#106** — Add `grafana.leeworks.dev` as 7th subdomain to DNS task (#33) — tracker only; docs already updated (#67)
-- **#107** — docs-site build verification — **DONE (build passes, all 9 routes confirmed)**
-- **#108** — STATUS.md update — **DONE (this update)**
+## Blockers — VIN Decoder critical path
+- **P1: #120** — VIN Decoder data layer (NHTSA vPIC SQLite cache) — agent work pending
+- **P1: #121** — VIN Decoder Fastify server — agent work pending, depends on #120
+- **P1: #127** — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace — operator manual task
+- **P2: #128** — Create `rapidapi-proxy-secret` in `vin-decoder` namespace — operator manual task
+- **P2: #129** — VIN Decoder Prometheus metrics instrumentation — agent work pending, depends on #121
+- **P3: #139** — Add RAPIDAPI_VIN_* Actions secrets — operator task, depends on RapidAPI listing (#131)
 
-## Backlog
-- **28 open issues total**; all remaining blocked on operator Phase 0 actions above.
-- **Agent work that can proceed without operator:** all completed this cycle.
+## New Issues This Sprint (2026-05-30, #120–#146)
+- **#120** — VIN Decoder data layer — **open, P1**
+- **#121** — VIN Decoder Fastify server — **open, P1**
+- **#126** — Operator: GITEA_TOKEN secret in vin-decoder repo — manual operator task
+- **#127** — Operator: gitea-registry imagePullSecret in vin-decoder namespace — manual operator task, P1 blocker
+- **#128** — Operator: rapidapi-proxy-secret in vin-decoder namespace — manual operator task
+- **#129** — VIN Decoder Prometheus metrics — **open, P2, depends on #121**
+- **#139** — Operator: RAPIDAPI_VIN_* secrets — **open, P3, operator task**
+- **#145** — Update ROADMAP.md for VIN Decoder — **DONE (this cycle)**
+- **#146** — Update STATUS.md for VIN Decoder sprint wave — **DONE (this cycle)**
+
+## Completed Previous Cycle (2026-05-30 — Sprint Cycle)
+- **#108** — STATUS.md updated with 2026-05-30 sprint plan and critical path.
+- **#107** — docs-site build verified: `npm run build` exits 0; all 9 required routes present in `dist/`.
+- **PR #105 MERGED** — `scripts/publish-openapi.js` + `.gitea/workflows/publish-openapi.yaml` (closes #100).
+- **PR #103 MERGED** — `docs-site/src/pages/pricing.astro` + nav link (closes #101).
+- **PR #104 MERGED** — `research/RESEARCH_LOG.md` first session: VIN Decoder next candidate (closes #102).
+- **New issues triaged** — #100–#108 (sprint planning cycle issues reviewed).
+- **`0xWheatyz/api-company`** — still does not exist; fork sync skipped (blocker #47).
+- **`kustomize build flux/` = PASS** — no regressions.
 
 ## Completed Previous Cycle (2026-05-28 — Cycle-2 Triage)
 - **#83** — Triaged: `GITEA_TOKEN` Actions secrets needed in `zip-enrichment`, `holidays`, `air-quality` repos. Manual operator task; reuse token from #74 if it has `write:package` scope. Step-by-step instructions posted.
@@ -130,6 +163,7 @@ All flux manifests validate successfully. Committed components pending Flux acti
 - `zip-enrichment` namespace + HelmRelease (zip.leeworks.dev) + rapidapi-proxy-secret placeholder
 - `holidays` namespace + HelmRelease (holidays.leeworks.dev) + rapidapi-proxy-secret placeholder
 - `air-quality` namespace + HelmRelease (aqi.leeworks.dev) + rapidapi-proxy-secret placeholder
+- `vin-decoder` namespace + HelmRelease (vin.leeworks.dev) + Flux manifests
 - `image-automation` ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
 
 ## Blockers (human operator action required)
@@ -138,6 +172,7 @@ All flux manifests validate successfully. Committed components pending Flux acti
 3. **Create `gitea-leeworks-agents-token` secret** in `flux-system` namespace (HTTPS token for Gitea)
 4. **Create `gitea-runner-token` secret** in `gitea-runner` namespace (Gitea Admin -> Actions -> Runners -> New Runner) (#3)
 5. **Enable Gitea packages** (for container registry at `registry.leeworks.dev`) (#4)
-6. **RapidAPI + PayPal setup** — manual, gated on operator turning 18 (#19, #44)
+6. **Create `gitea-registry` imagePullSecret in `vin-decoder` namespace** (#127) — VIN Decoder P1
+7. **RapidAPI + PayPal setup** — manual, gated on operator turning 18 (#19, #44)
 
 > Full ordered runbook with copy-paste commands: `docs/operator-runbook.md`

flux/kustomization.yaml

@@ -9,4 +9,5 @@ resources:
   - zip-enrichment
   - holidays
   - air-quality
+  - vin-decoder
   - image-automation

flux/vin-decoder/externalsecret.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: rapidapi-proxy-secret
+  namespace: vin-decoder
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: kubernetes-provider
+    kind: ClusterSecretStore
+  target:
+    name: rapidapi-proxy-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: X-RapidAPI-Proxy-Secret
+      remoteRef:
+        key: rapidapi-vin-decoder-source
+        property: X-RapidAPI-Proxy-Secret

flux/vin-decoder/helmrelease.yaml

@@ -0,0 +1,101 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vin-decoder
+  namespace: vin-decoder
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: raw
+      version: ">=0.2.0"
+      sourceRef:
+        kind: HelmRepository
+        name: bedag
+        namespace: flux-system
+      interval: 60m
+  values:
+    resources:
+      - apiVersion: apps/v1
+        kind: Deployment
+        metadata:
+          name: vin-decoder
+          namespace: vin-decoder
+        spec:
+          replicas: 1
+          selector:
+            matchLabels:
+              app: vin-decoder
+          template:
+            metadata:
+              labels:
+                app: vin-decoder
+            spec:
+              imagePullSecrets:
+                - name: gitea-registry
+              containers:
+                - name: vin-decoder
+                  image: registry.leeworks.dev/vin-decoder/api:latest # {"$imagepolicy": "flux-system:vin-decoder"}
+                  ports:
+                    - containerPort: 3000
+                  env:
+                    - name: RAPIDAPI_PROXY_SECRET
+                      valueFrom:
+                        secretKeyRef:
+                          name: rapidapi-proxy-secret
+                          key: X-RapidAPI-Proxy-Secret
+                  resources:
+                    requests:
+                      cpu: 50m
+                      memory: 128Mi
+                    limits:
+                      cpu: 500m
+                      memory: 256Mi
+                  livenessProbe:
+                    httpGet:
+                      path: /v1/health
+                      port: 3000
+                    initialDelaySeconds: 10
+                    periodSeconds: 30
+                  readinessProbe:
+                    httpGet:
+                      path: /v1/health
+                      port: 3000
+                    initialDelaySeconds: 5
+                    periodSeconds: 10
+      - apiVersion: v1
+        kind: Service
+        metadata:
+          name: vin-decoder
+          namespace: vin-decoder
+        spec:
+          selector:
+            app: vin-decoder
+          ports:
+            - port: 80
+              targetPort: 3000
+      - apiVersion: networking.k8s.io/v1
+        kind: Ingress
+        metadata:
+          name: vin-decoder
+          namespace: vin-decoder
+          annotations:
+            cert-manager.io/cluster-issuer: letsencrypt-prod
+            nginx.ingress.kubernetes.io/ssl-redirect: "true"
+        spec:
+          ingressClassName: nginx
+          tls:
+            - hosts:
+                - vin.leeworks.dev
+              secretName: vin-decoder-tls
+          rules:
+            - host: vin.leeworks.dev
+              http:
+                paths:
+                  - path: /
+                    pathType: Prefix
+                    backend:
+                      service:
+                        name: vin-decoder
+                        port:
+                          number: 80

flux/vin-decoder/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - externalsecret.yaml
+  - helmrelease.yaml

flux/vin-decoder/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vin-decoder

scripts/publish-openapi.js

@@ -11,6 +11,8 @@
  *   RAPIDAPI_HOLIDAYS_VERSION_ID
  *   RAPIDAPI_AQI_API_ID
  *   RAPIDAPI_AQI_VERSION_ID
+ *   RAPIDAPI_VIN_API_ID
+ *   RAPIDAPI_VIN_VERSION_ID
  *
  * Usage: node scripts/publish-openapi.js
  */
@@ -45,6 +47,12 @@ const APIS = [
     apiId: process.env.RAPIDAPI_AQI_API_ID,
     versionId: process.env.RAPIDAPI_AQI_VERSION_ID,
   },
+  {
+    name: 'vin-decoder',
+    specPath: path.join(__dirname, '..', 'apis', 'vin-decoder', 'openapi.yaml'),
+    apiId: process.env.RAPIDAPI_VIN_API_ID,
+    versionId: process.env.RAPIDAPI_VIN_VERSION_ID,
+  },
 ];
 
 /**