docs: annotate ROADMAP.md Phase 6 unchecked items + update STATUS.md sprint cycle

Closes leeworks-agents/api-company#176
Closes leeworks-agents/api-company#175

ROADMAP.md Phase 6 changes:
- DNS line: add '— issues #33, #106, #150'
- PayPal line: add '— issue #19'
- Paid tiers line: add '— issues #44 (original 3), #151 (VIN Decoder)'

STATUS.md changes:
- Last updated: 2026-06-02 (sprint planning cycle #175/#176)
- New 'Completed This Cycle' section with sprint summary
- Current Blockers date updated to 2026-06-02
- Added blockers #173 (ESO source secrets) and #174 (VIN metrics)

kustomize build flux/ = PASS

ROADMAP.md

@@ -6,9 +6,9 @@ Cross-repo milestones. Per-API phases live in each API repo's ROADMAP.md.
 
 ## Phase 0 — Orientation (one-time)
 - [x] Audit cluster: nodes, namespaces, ingress, Flux state → `docs/cluster-audit.md` (issue #36 — closed ✅)
-- [ ] Add Flux GitRepository + Kustomization watching `leeworks-agents/api-company`
+- [ ] Add Flux GitRepository + Kustomization watching `leeworks-agents/api-company` — issue #2
-- [ ] Deploy `gitea-act-runner` in cluster via Flux HelmRelease (`flux/gitea-runner/`)
+- [ ] Deploy `gitea-act-runner` in cluster via Flux HelmRelease (`flux/gitea-runner/`) — issue #3
-- [ ] Stand up `registry.leeworks.dev` (container registry) — required before any API CI works
+- [ ] Stand up `registry.leeworks.dev` (container registry) — required before any API CI works — issue #4
 
 ## Phase 1 — API Contracts
 Each API repo writes its `openapi.yaml` first and lints it. Spec is the source of truth.
@@ -23,16 +23,16 @@ Per-API: implement Fastify/FastAPI service matching `openapi.yaml` exactly. Rapi
 - [x] VIN Decoder: Fastify server implementation (issue #121 — closed ✅)
 
 ## Phase 4 — Monitoring
-- [ ] Prometheus + Grafana via Flux HelmRelease (`flux/monitoring/`)
+- [ ] Prometheus + Grafana via Flux HelmRelease (`flux/monitoring/`) — issue #7
-- [ ] Gatus public status page at `status.leeworks.dev`
+- [ ] Gatus public status page at `status.leeworks.dev` — issue #8
-- [ ] Instrument every API with `api_requests_total`, `api_response_duration_seconds`, `api_data_freshness_seconds`
+- [ ] Instrument every API with `api_requests_total`, `api_response_duration_seconds`, `api_data_freshness_seconds` — issue #27
 - [x] VIN Decoder metrics instrumentation + Grafana dashboard (issue #129 — closed ✅)
 - [x] VIN Decoder Gatus health check (issue #134 — closed ✅)
 
 ## Phase 5 — Documentation site
 - [x] `docs-site/` Astro + Redoc skeleton (issue #28 — closed ✅)
 - [x] Gitea Actions pipeline that copies per-API `openapi.yaml` files at build time (issues #29 ✅, #38 ✅, #85 ✅)
-- [ ] Deploy to `docs.leeworks.dev` via Flux
+- [ ] Deploy to `docs.leeworks.dev` via Flux — issue #30
 - [x] One SEO blog post per API minimum (issues #39 ✅ — ZIP/Holidays/AirQuality, #124 ✅ — VIN Decoder)
 - [x] VIN Decoder docs page (issue #123 — closed ✅)
 - [x] VIN Decoder SEO blog post (issue #124 — closed ✅)
@@ -41,11 +41,11 @@ Per-API: implement Fastify/FastAPI service matching `openapi.yaml` exactly. Rapi
 - [x] `docs/legal/terms-of-service.md` (issue #40 — closed ✅)
 - [x] `docs/legal/privacy-policy.md` (issue #40 — closed ✅)
 - [x] `docs/legal/acceptable-use-policy.md` (issues #40 ✅, #89 ✅)
-- [ ] DNS: `zip.leeworks.dev`, `holidays.leeworks.dev`, `aqi.leeworks.dev`, `docs.`, `status.`, `registry.`
+- [ ] DNS: `zip.leeworks.dev`, `holidays.leeworks.dev`, `aqi.leeworks.dev`, `docs.`, `status.`, `registry.` — issues #33, #106, #150
 - [x] VIN Decoder DNS `vin.leeworks.dev` (issue #130 — closed ✅)
 - [x] VIN Decoder RapidAPI listing (issue #131 — closed ✅ as tracker; operator action required)
-- [ ] PayPal linked to RapidAPI (manual, on 18th birthday)
+- [ ] PayPal linked to RapidAPI (manual, on 18th birthday) — issue #19
-- [ ] Paid tiers enabled on RapidAPI listings (manual)
+- [ ] Paid tiers enabled on RapidAPI listings (manual) — issues #44 (original 3), #151 (VIN Decoder)
 
 ## Revenue target
 

STATUS.md

@@ -1,6 +1,6 @@
 # Company Status
 
-_Last updated: 2026-06-01 (sprint-planning cycle)_
+_Last updated: 2026-06-02 (sprint planning cycle — #175/#176 STATUS/ROADMAP Phase 5/6 annotation)_
 
 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
@@ -23,19 +23,38 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **Image automation:** `flux/image-automation/` — ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
 - **VIN Decoder manifests:** `flux/vin-decoder/` — Flux HelmRelease + Kustomization committed (issue #140)
 
-## Completed This Cycle (2026-06-01 — Sprint Planning Cycle)
+## Completed This Cycle (2026-06-02 — Sprint Planning Cycle #175/#176)
+
+- **#176** — ROADMAP.md Phase 6 unchecked items annotated with issue cross-references: DNS — issues #33, #106, #150; PayPal — issue #19; Paid tiers — issues #44 (original 3), #151 (VIN Decoder). No checked items changed.
+- **#175** — STATUS.md updated with 2026-06-02 sprint planning cycle results (this entry). Last updated date set to 2026-06-02.
+- **Sprint Summary:** 2 new documentation issues created (#175 STATUS.md update, #176 ROADMAP Phase 5/6 annotation). 0 code issues created (all ROADMAP items already covered by existing issues). 0 issues closed (none stale). 0 reprioritizations.
+- **Current Blockers updated:** #173 (ESO source secrets in `external-secrets` ns) and #174 (VIN Decoder metrics instrumentation) added.
+- **`kustomize build flux/` = PASS** — no regressions confirmed.
+
+## Completed Previous Cycle (2026-06-02 — Sprint Planning Cycle)
+
+- **#171** — ROADMAP.md Phase 0 unchecked items annotated with issue #2, #3, #4; Phase 4 unchecked items annotated with issue #7, #8, #27; Phase 5 unchecked item annotated with issue #30. No checked-off items changed.
+- **#170** — STATUS.md updated with 2026-06-02 sprint planning cycle results (this entry). Last updated date set to 2026-06-02.
+- **Sprint Summary:** 2 new issues created (#171, #170), 0 issues closed this cycle, 0 stale found.
+- **`kustomize build flux/` = PASS** — no regressions confirmed.
+
+## Completed Previous Cycle (2026-06-02 — Triage Cycle #168)
+- **#168** — STATUS.md cleanup: removed all stale “open, in progress” references to #120 and #121 (both confirmed closed ✅ in leeworks-agents/vin-decoder). Historical sections corrected. VIN Decoder Code column confirmed `[x]`.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Completed Previous Cycle (2026-06-01 — Sprint Planning Cycle)
 - **#163** — ROADMAP.md Phase 2 and Phase 3 VIN Decoder bullets marked `[x]` with closed ✅ references for issues #120 and #121.
 - **#164** — STATUS.md Current Blockers updated: removed #120 and #121 (both confirmed closed ✅). Top actionable agent task updated to #163.
 - **`kustomize build flux/` = PASS** — no regressions.
 
-## Completed This Cycle (2026-06-01 — Triage Cycle)
+## Completed Previous Cycle (2026-06-01 — Triage Cycle)
 - **#158** — STATUS.md updated with 2026-06-01 current blockers and sprint summary.
 - **#156** — ROADMAP.md checkboxes updated: Phase 4 VIN Decoder metrics, Phase 5 docs-site/pipeline/blog, Phase 6 legal docs all checked off.
 - **VIN Decoder Code `[x]`** — leeworks-agents/vin-decoder data layer (#120) and Fastify server (#121) confirmed merged; STATUS.md Code column updated.
 - **PR #160 closed** — had merge conflicts and ROADMAP.md regressions (unchecked completed items). Clean fix applied here.
 - **`kustomize build flux/` = PASS** — no regressions.
 
-## Current Blockers (as of 2026-06-01)
+## Current Blockers (as of 2026-06-02)
 
 In dependency order — operator tasks unless noted:
 
@@ -46,6 +65,8 @@ In dependency order — operator tasks unless noted:
 5. **P1 #83** — Configure `GITEA_TOKEN` Actions secret in zip-enrichment, holidays, air-quality repos (operator)
 6. **P1 #126** — Configure `GITEA_TOKEN` Actions secret in vin-decoder repo (operator — depends on #122 ✅)
 7. **P1 #127** — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace (operator)
+8. **P2 #173** — Create ESO source secrets in `external-secrets` namespace for RapidAPI proxy-secret syncing (operator) — blocks ESO sync
+9. **P2 #174** — VIN Decoder metrics instrumentation in `leeworks-agents/vin-decoder` repo (agent task, depends on #18 deploy)
 
 ## Sprint Summary (2026-06-01 — Sprint Planning Cycle)
 - **Issues closed this cycle:** 0
@@ -59,7 +80,7 @@ In dependency order — operator tasks unless noted:
 - **Issues opened this sprint:** #150 (vin DNS reminder), #151 (VIN Decoder RapidAPI tiers), #155 (if applicable), #156 (ROADMAP.md update), #157 (full-stack validation), #158 (STATUS.md update), #163 (ROADMAP/STATUS cleanup post-#120/#121), #164 (STATUS.md sprint planning update)
 - **Top actionable agent task:** #163 (ROADMAP/STATUS doc cleanup for #120/#121 — pure doc update, immediately actionable)
 
-## Completed This Cycle (2026-05-31 — Sprint Cycle)
+## Completed Previous Cycle (2026-05-31 — Sprint Cycle)
 - **#146** — STATUS.md updated to reflect VIN Decoder sprint wave (#117–#141): APIs table row added, completed wave documented, blockers updated.
 - **#145** — ROADMAP.md updated to reference VIN Decoder as 4th API across all phases (Phase 1–6). `kustomize build flux/` = PASS.
 - **PR #147 opened** — docs: update ROADMAP.md and STATUS.md for VIN Decoder sprint wave (closes #145, #146).
@@ -67,8 +88,8 @@ In dependency order — operator tasks unless noted:
 ## Completed Previous Cycle (2026-05-30 — VIN Decoder Sprint Wave)
 ### VIN Decoder issues #117–#141 — status as of 2026-05-31:
 - **#117** — VIN Decoder spec + feasibility — **closed ✅** (`apis/vin-decoder/openapi.yaml` merged)
-- **#120** — VIN Decoder data layer (SQLite/NHTSA vPIC) — **open, in progress** (P1 blocker)
+- **#120** — VIN Decoder data layer (SQLite/NHTSA vPIC) — **closed ✅** (leeworks-agents/vin-decoder)
-- **#121** — VIN Decoder Fastify server — **open, in progress** (P1 blocker, depends on #120)
+- **#121** — VIN Decoder Fastify server — **closed ✅** (leeworks-agents/vin-decoder)
 - **#122** — Create `leeworks-agents/vin-decoder` repo — **closed ✅**
 - **#123** — VIN Decoder docs page — **closed ✅**
 - **#124** — VIN Decoder SEO blog post — **closed ✅**
@@ -101,8 +122,8 @@ See **Current Blockers** section above for the full ordered list as of 2026-06-0
 - **P3: #139** — Add RAPIDAPI_VIN_* Actions secrets — operator task, depends on RapidAPI listing (#131)
 
 ## New Issues This Sprint (2026-05-30, #120–#146)
-- **#120** — VIN Decoder data layer — **open, P1**
+- **#120** — VIN Decoder data layer — **closed ✅** (leeworks-agents/vin-decoder)
-- **#121** — VIN Decoder Fastify server — **open, P1**
+- **#121** — VIN Decoder Fastify server — **closed ✅** (leeworks-agents/vin-decoder)
 - **#126** — Operator: GITEA_TOKEN secret in vin-decoder repo — manual operator task
 - **#127** — Operator: gitea-registry imagePullSecret in vin-decoder namespace — manual operator task, P1 blocker
 - **#128** — Operator: rapidapi-proxy-secret in vin-decoder namespace — manual operator task