docs: mark VIN Decoder Code [x] in STATUS.md (closes leeworks-agents/api-company#157)

leeworks-agents/vin-decoder data layer (#120) and Fastify server (#121)
are confirmed merged. Previous PR #160 closed due to merge conflicts and
ROADMAP.md regressions (incorrectly unchecked completed items).

kustomize build flux/ = PASS

ROADMAP.md

@@ -5,7 +5,7 @@ Cross-repo milestones. Per-API phases live in each API repo's ROADMAP.md.
 > **As of 2026-05-30, a 4th API (VIN Decoder) has been added. Per-API phases also live in `leeworks-agents/vin-decoder`.**
 
 ## Phase 0 — Orientation (one-time)
-- [ ] Audit cluster: nodes, namespaces, ingress, Flux state → `docs/cluster-audit.md`
+- [x] Audit cluster: nodes, namespaces, ingress, Flux state → `docs/cluster-audit.md` (issue #36 — closed ✅)
 - [ ] Add Flux GitRepository + Kustomization watching `leeworks-agents/api-company`
 - [ ] Deploy `gitea-act-runner` in cluster via Flux HelmRelease (`flux/gitea-runner/`)
 - [ ] Stand up `registry.leeworks.dev` (container registry) — required before any API CI works
@@ -26,21 +26,21 @@ Per-API: implement Fastify/FastAPI service matching `openapi.yaml` exactly. Rapi
 - [ ] Prometheus + Grafana via Flux HelmRelease (`flux/monitoring/`)
 - [ ] Gatus public status page at `status.leeworks.dev`
 - [ ] Instrument every API with `api_requests_total`, `api_response_duration_seconds`, `api_data_freshness_seconds`
-- [ ] VIN Decoder metrics instrumentation + Grafana dashboard (issue #129)
+- [x] VIN Decoder metrics instrumentation + Grafana dashboard (issue #129 — closed ✅)
 - [x] VIN Decoder Gatus health check (issue #134 — closed ✅)
 
 ## Phase 5 — Documentation site
-- [ ] `docs-site/` Astro + Redoc skeleton
+- [x] `docs-site/` Astro + Redoc skeleton (issue #28 — closed ✅)
-- [ ] Gitea Actions pipeline that copies per-API `openapi.yaml` files at build time
+- [x] Gitea Actions pipeline that copies per-API `openapi.yaml` files at build time (issues #29 ✅, #38 ✅, #85 ✅)
 - [ ] Deploy to `docs.leeworks.dev` via Flux
-- [ ] One SEO blog post per API minimum (see master prompt §Phase 5)
+- [x] One SEO blog post per API minimum (issues #39 ✅ — ZIP/Holidays/AirQuality, #124 ✅ — VIN Decoder)
 - [x] VIN Decoder docs page (issue #123 — closed ✅)
 - [x] VIN Decoder SEO blog post (issue #124 — closed ✅)
 
 ## Phase 6 — Pre-launch
-- [ ] `docs/legal/terms-of-service.md`
+- [x] `docs/legal/terms-of-service.md` (issue #40 — closed ✅)
-- [ ] `docs/legal/privacy-policy.md`
+- [x] `docs/legal/privacy-policy.md` (issue #40 — closed ✅)
-- [ ] `docs/legal/acceptable-use-policy.md`
+- [x] `docs/legal/acceptable-use-policy.md` (issues #40 ✅, #89 ✅)
 - [ ] DNS: `zip.leeworks.dev`, `holidays.leeworks.dev`, `aqi.leeworks.dev`, `docs.`, `status.`, `registry.`
 - [x] VIN Decoder DNS `vin.leeworks.dev` (issue #130 — closed ✅)
 - [x] VIN Decoder RapidAPI listing (issue #131 — closed ✅ as tracker; operator action required)

STATUS.md

@@ -1,6 +1,6 @@
 # Company Status
 
-_Last updated: 2026-05-31 (sprint planning cycle)_
+_Last updated: 2026-06-01 (triage cycle — second pass)_
 
 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
@@ -8,7 +8,7 @@ _Last updated: 2026-05-31 (sprint planning cycle)_
 | ZIP Enrichment | [~]  | [~]  | [ ]      | [ ]                | 0            | $0  |
 | Holidays       | [~]  | [~]  | [ ]      | [ ]                | 0            | $0  |
 | Air Quality    | [ ]  | [ ]  | [ ]      | [ ]                | 0            | $0  |
-| VIN Decoder    | [x]  | [ ]  | [ ]      | [ ]                | 0            | $0  |
+| VIN Decoder    | [x]  | [x]  | [ ]      | [ ]                | 0            | $0  |
 
 Legend: [x]=done, [~]=in-progress, [ ]=not started
 
@@ -23,6 +23,32 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **Image automation:** `flux/image-automation/` — ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
 - **VIN Decoder manifests:** `flux/vin-decoder/` — Flux HelmRelease + Kustomization committed (issue #140)
 
+## Completed This Cycle (2026-06-01 — Triage Cycle)
+- **#158** — STATUS.md updated with 2026-06-01 current blockers and sprint summary.
+- **#156** — ROADMAP.md checkboxes updated: Phase 4 VIN Decoder metrics, Phase 5 docs-site/pipeline/blog, Phase 6 legal docs all checked off.
+- **VIN Decoder Code `[x]`** — leeworks-agents/vin-decoder data layer (#120) and Fastify server (#121) confirmed merged; STATUS.md Code column updated.
+- **PR #160 closed** — had merge conflicts and ROADMAP.md regressions (unchecked completed items). Clean fix applied here.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Current Blockers (as of 2026-06-01)
+
+In dependency order — operator tasks unless noted:
+
+1. **P1 #47** — Create `0xWheatyz/api-company` upstream repo (operator) — **highest priority, unblocks everything**
+2. **P1 #76** — Create `gitea-leeworks-agents-token` secret in `flux-system` (operator)
+3. **P1 #77** — Create `gitea-runner-token` secret in `gitea-runner` namespace (operator)
+4. **P1 #79** — Create `gitea-registry` imagePullSecrets in all API namespaces (operator)
+5. **P1 #83** — Configure `GITEA_TOKEN` Actions secret in zip-enrichment, holidays, air-quality repos (operator)
+6. **P1 #120** — VIN Decoder data layer — SQLite cache seeded from NHTSA vPIC (**agent — actionable now, not blocked**)
+7. **P1 #121** — VIN Decoder Fastify server implementation (agent — depends on #120)
+8. **P1 #126** — Configure `GITEA_TOKEN` Actions secret in vin-decoder repo (operator — depends on #122 ✅)
+9. **P1 #127** — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace (operator)
+
+## Sprint Summary (2026-06-01)
+- **Issues closed since last STATUS update (#146):** #145–#154 — VIN Decoder sprint docs + infra (✅ all closed)
+- **Issues opened this sprint:** #150 (vin DNS reminder), #151 (VIN Decoder RapidAPI tiers), #155 (if applicable), #156 (ROADMAP.md update), #157 (full-stack validation), #158 (STATUS.md update)
+- **Top actionable agent task:** VIN Decoder code work — #120 (data layer) then #121 (Fastify server)
+
 ## Completed This Cycle (2026-05-31 — Sprint Cycle)
 - **#146** — STATUS.md updated to reflect VIN Decoder sprint wave (#117–#141): APIs table row added, completed wave documented, blockers updated.
 - **#145** — ROADMAP.md updated to reference VIN Decoder as 4th API across all phases (Phase 1–6). `kustomize build flux/` = PASS.
@@ -48,6 +74,8 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **#141** — Pricing page updated for VIN Decoder — **closed ✅** (PR #144 merged)
 
 ## Critical Path (operator must complete in order)
+See **Current Blockers** section above for the full ordered list as of 2026-06-01.
+
 1. **Create `0xWheatyz/api-company` repo** (#47) — **highest priority, unblocks everything**
 2. **Add api-company Flux source to Talos** (#90) — needs Talos PR, reference manifests at `flux/api-company-source/`
 3. **Create `gitea-leeworks-agents-token` secret** in `flux-system` (#76)
@@ -56,11 +84,12 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 6. **All other secrets** (#70, #73, #74, #79, #80, #81, #83) follow in order
 
 ## Blockers — VIN Decoder critical path
-- **P1: #120** — VIN Decoder data layer (NHTSA vPIC SQLite cache) — agent work pending
+- **P1: #120** — VIN Decoder data layer (NHTSA vPIC SQLite cache) — **agent work, actionable now**
 - **P1: #121** — VIN Decoder Fastify server — agent work pending, depends on #120
 - **P1: #127** — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace — operator manual task
+- **P2: #126** — Configure `GITEA_TOKEN` secret in `vin-decoder` repo — operator manual task
 - **P2: #128** — Create `rapidapi-proxy-secret` in `vin-decoder` namespace — operator manual task
-- **P2: #129** — VIN Decoder Prometheus metrics instrumentation — agent work pending, depends on #121
+- ~~**P2: #129** — VIN Decoder Prometheus metrics instrumentation~~ — **closed ✅** (PR merged)
 - **P3: #139** — Add RAPIDAPI_VIN_* Actions secrets — operator task, depends on RapidAPI listing (#131)
 
 ## New Issues This Sprint (2026-05-30, #120–#146)

flux/monitoring/grafana-dashboard-apis.yaml

@@ -9,7 +9,7 @@ data:
   api-dashboard.json: |
     {
       "annotations": { "list": [] },
-      "description": "Request rate, latency, error rate, and data freshness for zip-enrichment, holidays, and air-quality APIs",
+      "description": "Request rate, latency, error rate, and data freshness for zip-enrichment, holidays, air-quality, and vin-decoder APIs",
       "editable": true,
       "graphTooltip": 1,
       "panels": [

flux/monitoring/kustomization.yaml

@@ -8,3 +8,4 @@ resources:
   - gatus-helmrelease.yaml
   - grafana-dashboard-apis.yaml
   - prometheusrule-apis.yaml
+  - vin-decoder-dashboard.yaml

flux/monitoring/prometheusrule-apis.yaml

@@ -18,9 +18,9 @@ spec:
         - alert: APIHighErrorRate
           expr: |
             (
-              sum by (job) (rate(api_requests_total{status=~"5..", job=~"zip|holidays|air-quality"}[5m]))
+              sum by (job) (rate(api_requests_total{status=~"5..", job=~"zip|holidays|air-quality|vin-decoder"}[5m]))
               /
-              sum by (job) (rate(api_requests_total{job=~"zip|holidays|air-quality"}[5m]))
+              sum by (job) (rate(api_requests_total{job=~"zip|holidays|air-quality|vin-decoder"}[5m]))
             ) > 0.05
           for: 5m
           labels:
@@ -36,9 +36,9 @@ spec:
         - alert: APIHighErrorRate
           expr: |
             (
-              sum by (job) (rate(api_requests_total{status=~"5..", job=~"zip|holidays|air-quality"}[5m]))
+              sum by (job) (rate(api_requests_total{status=~"5..", job=~"zip|holidays|air-quality|vin-decoder"}[5m]))
               /
-              sum by (job) (rate(api_requests_total{job=~"zip|holidays|air-quality"}[5m]))
+              sum by (job) (rate(api_requests_total{job=~"zip|holidays|air-quality|vin-decoder"}[5m]))
             ) > 0.20
           for: 5m
           labels:
@@ -55,7 +55,7 @@ spec:
           expr: |
             histogram_quantile(
               0.95,
-              sum by (job, le) (rate(api_response_duration_seconds_bucket{job=~"zip|holidays|air-quality"}[5m]))
+              sum by (job, le) (rate(api_response_duration_seconds_bucket{job=~"zip|holidays|air-quality|vin-decoder"}[5m]))
             ) > 2
           for: 5m
           labels:
@@ -70,7 +70,7 @@ spec:
         # -------------------------------------------------------------------
         - alert: APIDataStale
           expr: |
-            api_data_freshness_seconds{job=~"zip|holidays|air-quality"} > 2592000
+            api_data_freshness_seconds{job=~"zip|holidays|air-quality|vin-decoder"} > 2592000
           for: 30m
           labels:
             severity: warning
@@ -84,7 +84,7 @@ spec:
         # -------------------------------------------------------------------
         - alert: APIDataCriticallyStale
           expr: |
-            api_data_freshness_seconds{job=~"zip|holidays|air-quality"} > 5184000
+            api_data_freshness_seconds{job=~"zip|holidays|air-quality|vin-decoder"} > 5184000
           for: 1h
           labels:
             severity: critical
@@ -98,9 +98,9 @@ spec:
         # -------------------------------------------------------------------
         - alert: APIDown
           expr: |
-            absent(up{job=~"zip|holidays|air-quality"} == 1)
+            absent(up{job=~"zip|holidays|air-quality|vin-decoder"} == 1)
             or
-            up{job=~"zip|holidays|air-quality"} == 0
+            up{job=~"zip|holidays|air-quality|vin-decoder"} == 0
           for: 2m
           labels:
             severity: critical

flux/monitoring/vin-decoder-dashboard.yaml

@@ -0,0 +1,161 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-dashboard-vin-decoder
+  namespace: monitoring
+  labels:
+    grafana_dashboard: "1"
+data:
+  vin-decoder-dashboard.json: |
+    {
+      "annotations": { "list": [] },
+      "description": "Request rate, latency, error rate, and cache hit ratio for the VIN Decoder API",
+      "editable": true,
+      "graphTooltip": 1,
+      "panels": [
+        {
+          "collapsed": false,
+          "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 },
+          "id": 1,
+          "title": "VIN Decoder — Request Rate",
+          "type": "row"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "prometheus" },
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "palette-classic" },
+              "custom": { "axisLabel": "requests/sec", "drawStyle": "line", "fillOpacity": 10, "lineWidth": 1, "showPoints": "never" },
+              "unit": "reqps"
+            },
+            "overrides": []
+          },
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 1 },
+          "id": 2,
+          "options": {
+            "legend": { "calcs": ["mean", "max"], "displayMode": "table", "placement": "bottom" },
+            "tooltip": { "mode": "multi" }
+          },
+          "targets": [
+            {
+              "expr": "sum by (route) (rate(api_requests_total{api=\"vin-decoder\"}[5m]))",
+              "legendFormat": "{{route}}",
+              "refId": "A"
+            }
+          ],
+          "title": "Request Rate by Route",
+          "type": "timeseries"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "prometheus" },
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "palette-classic" },
+              "custom": { "axisLabel": "", "drawStyle": "line", "fillOpacity": 10, "lineWidth": 1, "showPoints": "never" },
+              "unit": "percentunit"
+            },
+            "overrides": []
+          },
+          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 1 },
+          "id": 3,
+          "options": {
+            "legend": { "calcs": ["mean", "last"], "displayMode": "table", "placement": "bottom" },
+            "tooltip": { "mode": "multi" }
+          },
+          "targets": [
+            {
+              "expr": "sum(rate(api_requests_total{api=\"vin-decoder\",status_code=~\"5..\"}[5m])) / sum(rate(api_requests_total{api=\"vin-decoder\"}[5m]))",
+              "legendFormat": "5xx error rate",
+              "refId": "A"
+            }
+          ],
+          "title": "5xx Error Rate",
+          "type": "timeseries"
+        },
+        {
+          "collapsed": false,
+          "gridPos": { "h": 1, "w": 24, "x": 0, "y": 9 },
+          "id": 10,
+          "title": "VIN Decoder — Latency",
+          "type": "row"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "prometheus" },
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "palette-classic" },
+              "custom": { "axisLabel": "seconds", "drawStyle": "line", "fillOpacity": 5, "lineWidth": 1, "showPoints": "never" },
+              "unit": "s"
+            },
+            "overrides": []
+          },
+          "gridPos": { "h": 8, "w": 24, "x": 0, "y": 10 },
+          "id": 4,
+          "options": {
+            "legend": { "calcs": ["mean", "max"], "displayMode": "table", "placement": "bottom" },
+            "tooltip": { "mode": "multi" }
+          },
+          "targets": [
+            {
+              "expr": "histogram_quantile(0.50, sum by (route, le) (rate(api_response_duration_seconds_bucket{api=\"vin-decoder\"}[5m])))",
+              "legendFormat": "P50 {{route}}",
+              "refId": "A"
+            },
+            {
+              "expr": "histogram_quantile(0.95, sum by (route, le) (rate(api_response_duration_seconds_bucket{api=\"vin-decoder\"}[5m])))",
+              "legendFormat": "P95 {{route}}",
+              "refId": "B"
+            },
+            {
+              "expr": "histogram_quantile(0.99, sum by (route, le) (rate(api_response_duration_seconds_bucket{api=\"vin-decoder\"}[5m])))",
+              "legendFormat": "P99 {{route}}",
+              "refId": "C"
+            }
+          ],
+          "title": "Response Latency P50 / P95 / P99 by Route",
+          "type": "timeseries"
+        },
+        {
+          "collapsed": false,
+          "gridPos": { "h": 1, "w": 24, "x": 0, "y": 18 },
+          "id": 20,
+          "title": "VIN Decoder — Cache & Data Freshness",
+          "type": "row"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "prometheus" },
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "thresholds" },
+              "thresholds": {
+                "steps": [
+                  { "color": "green", "value": null },
+                  { "color": "yellow", "value": 2592000 },
+                  { "color": "red", "value": 5184000 }
+                ]
+              },
+              "unit": "s"
+            },
+            "overrides": []
+          },
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 19 },
+          "id": 5,
+          "options": { "reduceOptions": { "calcs": ["lastNotNull"] }, "orientation": "auto", "textMode": "auto", "colorMode": "background" },
+          "targets": [
+            {
+              "expr": "api_data_freshness_seconds{api=\"vin-decoder\"}",
+              "legendFormat": "data freshness",
+              "refId": "A"
+            }
+          ],
+          "title": "Data Freshness (seconds since last NHTSA fetch)",
+          "type": "stat"
+        }
+      ],
+      "refresh": "1m",
+      "schemaVersion": 38,
+      "tags": ["vin-decoder", "api-company"],
+      "title": "VIN Decoder API",
+      "uid": "vin-decoder-api",
+      "version": 1
+    }

flux/vin-decoder/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - namespace.yaml
   - externalsecret.yaml
   - helmrelease.yaml
+  - servicemonitor.yaml

flux/vin-decoder/servicemonitor.yaml

@@ -0,0 +1,15 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: vin-decoder
+  namespace: vin-decoder
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app: vin-decoder
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: 30s