fix(scripts): unique PAT names + show HTTP error body in token helper

Re-running the helper hit Gitea 400 'token name has been used' because the token name was only date-stamped. Add time+pid to make names unique, surface the real HTTP status/body, and continue past a single token failure.
fix(ci): authenticate registry push with package-scoped REGISTRY_TOKEN
2026-06-20 18:04:16 -04:00 · 2026-06-20 17:53:28 -04:00 · 2026-06-20 17:49:43 -04:00 · 2026-06-20 17:41:09 -04:00 · 2026-06-20 17:35:59 -04:00 · 2026-06-20 17:31:55 -04:00
36 changed files with 9951 additions and 94 deletions
@@ -21,33 +21,47 @@ jobs:
        with:
          path: api-company

+      # NOTE: cross-repo checkouts use SIBLING_REPOS_TOKEN, NOT the auto-injected
+      # GITEA_TOKEN. Gitea's automatic GITEA_TOKEN is scoped to THIS repo only,
+      # so checking out other repos fails with
+      # "Determining the default branch → not found". GITEA_TOKEN is also a
+      # reserved secret name that cannot be overridden, hence a separate secret.
+      # SIBLING_REPOS_TOKEN must be a PAT with read access to the API repos.
      - name: Checkout zip-enrichment
        uses: actions/checkout@v4
        with:
          repository: leeworks-agents/zip-enrichment
-          token: ${{ secrets.GITEA_TOKEN }}
+          token: ${{ secrets.SIBLING_REPOS_TOKEN }}
          path: zip-enrichment

      - name: Checkout holidays
        uses: actions/checkout@v4
        with:
          repository: leeworks-agents/holidays
-          token: ${{ secrets.GITEA_TOKEN }}
+          token: ${{ secrets.SIBLING_REPOS_TOKEN }}
          path: holidays

      - name: Checkout air-quality
        uses: actions/checkout@v4
        with:
          repository: leeworks-agents/air-quality
-          token: ${{ secrets.GITEA_TOKEN }}
+          token: ${{ secrets.SIBLING_REPOS_TOKEN }}
          path: air-quality

+      - name: Checkout vin-decoder
+        uses: actions/checkout@v4
+        with:
+          repository: leeworks-agents/vin-decoder
+          token: ${{ secrets.SIBLING_REPOS_TOKEN }}
+          path: vin-decoder
+
      - name: Copy openapi.yaml specs into docs-site
        run: |
          mkdir -p api-company/docs-site/public/specs
          cp zip-enrichment/openapi.yaml api-company/docs-site/public/specs/zip-enrichment.yaml
          cp holidays/openapi.yaml api-company/docs-site/public/specs/holidays.yaml
          cp air-quality/openapi.yaml api-company/docs-site/public/specs/air-quality.yaml
+          cp vin-decoder/openapi.yaml api-company/docs-site/public/specs/vin-decoder.yaml
          echo "Specs copied:"
          ls -la api-company/docs-site/public/specs/

@@ -64,15 +78,39 @@ jobs:
        working-directory: api-company/docs-site
        run: npm run build

-      - name: Log in to container registry
+      - name: Install Docker CLI
+        # The job container (node:20) ships no `docker` binary. The runner has a
+        # dind daemon (dind.enabled in the runner HelmRelease), reachable via
+        # DOCKER_HOST, so we only need the client. Install the static binary.
+        env:
+          DOCKER_CLI_VERSION: "27.3.1"
        run: |
-          echo "${{ secrets.GITEA_TOKEN }}" | docker login registry.leeworks.dev \
-            -u ${{ gitea.actor }} --password-stdin
+          set -euxo pipefail
+          curl -fSL --retry 5 --retry-delay 3 --retry-all-errors \
+            -o /tmp/docker.tgz \
+            "https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_CLI_VERSION}.tgz"
+          tar -xzf /tmp/docker.tgz -C /tmp
+          install -m 0755 /tmp/docker/docker /usr/local/bin/docker
+          docker version --format '{{.Client.Version}}'
+          docker info >/dev/null   # confirms the dind daemon is reachable
+
+      - name: Log in to container registry
+        # Use Gitea's built-in container registry (gitea.leeworks.dev), which
+        # has a valid Let's Encrypt cert. The standalone registry.leeworks.dev
+        # serves Traefik's default self-signed cert and fails TLS verification.
+        #
+        # Auth uses REGISTRY_TOKEN, NOT the auto GITEA_TOKEN: the auto token has
+        # no package-registry scope, and the registry requires the username to
+        # match the token owner. REGISTRY_TOKEN must be a PAT (owner: 0xWheatyz)
+        # with write:package + read:package scope.
+        run: |
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.leeworks.dev \
+            -u 0xWheatyz --password-stdin

      - name: Build and push docs-site image
        working-directory: api-company/docs-site
        run: |
-          IMAGE="registry.leeworks.dev/leeworks-agents/docs-site"
+          IMAGE="gitea.leeworks.dev/leeworks-agents/docs-site"
          SHA="${{ gitea.sha }}"
          docker build -t "$IMAGE:$SHA" -t "$IMAGE:latest" .
          docker push "$IMAGE:$SHA"
@@ -2,7 +2,8 @@
 # Requires secrets (configured once RapidAPI listings are live):
 #   RAPIDAPI_PLATFORM_KEY, RAPIDAPI_ZIP_API_ID, RAPIDAPI_ZIP_VERSION_ID,
 #   RAPIDAPI_HOLIDAYS_API_ID, RAPIDAPI_HOLIDAYS_VERSION_ID,
-#   RAPIDAPI_AQI_API_ID, RAPIDAPI_AQI_VERSION_ID
+#   RAPIDAPI_AQI_API_ID, RAPIDAPI_AQI_VERSION_ID,
+#   RAPIDAPI_VIN_API_ID, RAPIDAPI_VIN_VERSION_ID
 #
 # If RAPIDAPI_PLATFORM_KEY is not set the publish step exits 0 with a skip message.

@@ -55,4 +56,6 @@ jobs:
          RAPIDAPI_HOLIDAYS_VERSION_ID: ${{ secrets.RAPIDAPI_HOLIDAYS_VERSION_ID }}
          RAPIDAPI_AQI_API_ID: ${{ secrets.RAPIDAPI_AQI_API_ID }}
          RAPIDAPI_AQI_VERSION_ID: ${{ secrets.RAPIDAPI_AQI_VERSION_ID }}
+          RAPIDAPI_VIN_API_ID: ${{ secrets.RAPIDAPI_VIN_API_ID }}
+          RAPIDAPI_VIN_VERSION_ID: ${{ secrets.RAPIDAPI_VIN_VERSION_ID }}
        run: node scripts/publish-openapi.js
@@ -13,9 +13,19 @@ jobs:
      - uses: actions/checkout@v4

      - name: Install kustomize
+        # The act runner runs as root (no `sudo`). Download a pinned release
+        # tarball directly with retries instead of piping the upstream installer
+        # script through bash — the installer makes extra GitHub API calls that
+        # are rate-limited/unreliable on this runner, and `curl -s` hid the
+        # error (a silent exit 6 = could not resolve host).
+        env:
+          KUSTOMIZE_VERSION: "5.4.3"
        run: |
-          curl -sL "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash
-          sudo mv kustomize /usr/local/bin/
+          set -euxo pipefail
+          url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz"
+          curl -fSL --retry 5 --retry-delay 3 --retry-all-errors -o /tmp/kustomize.tar.gz "$url"
+          tar -xzf /tmp/kustomize.tar.gz -C /usr/local/bin kustomize
+          kustomize version

      - name: kustomize build flux/
        run: kustomize build flux/ > /dev/null
@@ -2,40 +2,58 @@

 Cross-repo milestones. Per-API phases live in each API repo's ROADMAP.md.

+> **As of 2026-05-30, a 4th API (VIN Decoder) has been added. Per-API phases also live in `leeworks-agents/vin-decoder`.**
+
 ## Phase 0 — Orientation (one-time)
- [ ] Audit cluster: nodes, namespaces, ingress, Flux state → `docs/cluster-audit.md`
- [ ] Add Flux GitRepository + Kustomization watching `leeworks-agents/api-company`
- [ ] Deploy `gitea-act-runner` in cluster via Flux HelmRelease (`flux/gitea-runner/`)
- [ ] Stand up `registry.leeworks.dev` (container registry) — required before any API CI works
+- [x] Audit cluster: nodes, namespaces, ingress, Flux state → `docs/cluster-audit.md` (issue #36 — closed ✅)
+- [ ] Add Flux GitRepository + Kustomization watching `leeworks-agents/api-company` — issue #218 (fork PR #399 merged to leeworks-agents/Talos; awaiting operator merge of 0xWheatyz/Talos PR #14)
+- [ ] Deploy `gitea-act-runner` in cluster via Flux HelmRelease (`flux/gitea-runner/`) — issue #3
+- [ ] Stand up `registry.leeworks.dev` (container registry) — required before any API CI works — issue #4
+- [ ] Validate ESO HelmRelease deployment and ExternalSecret sync for all 4 API namespaces — issue #178
+- [ ] Extend full-stack Flux validation checklist to cover VIN Decoder — issue #179 (extends #66)

 ## Phase 1 — API Contracts
 Each API repo writes its `openapi.yaml` first and lints it. Spec is the source of truth.
- See: `leeworks-agents/zip-enrichment`, `holidays`, `air-quality`
+- See: `leeworks-agents/zip-enrichment`, `holidays`, `air-quality`, `vin-decoder`

 ## Phase 2 — Data
 Per-API: pull free public data sources, cache locally (SQLite or in-memory), schedule monthly re-seed.
+- [x] VIN Decoder: NHTSA vPIC as data source — SQLite cache seeded on demand (issue #120 — closed ✅)

 ## Phase 3 — Servers
 Per-API: implement Fastify/FastAPI service matching `openapi.yaml` exactly. RapidAPI proxy-secret middleware on every route.
+- [x] VIN Decoder: Fastify server implementation (issue #121 — closed ✅)

 ## Phase 4 — Monitoring
- [ ] Prometheus + Grafana via Flux HelmRelease (`flux/monitoring/`)
- [ ] Gatus public status page at `status.leeworks.dev`
- [ ] Instrument every API with `api_requests_total`, `api_response_duration_seconds`, `api_data_freshness_seconds`
+- [ ] Prometheus + Grafana via Flux HelmRelease (`flux/monitoring/`) — issue #7
+- [ ] Gatus public status page at `status.leeworks.dev` — issue #8
+- [x] Instrument every API with `api_requests_total`, `api_response_duration_seconds`, `api_data_freshness_seconds` (issue #27 — closed ✅)
+- [x] Add Prometheus metrics endpoint to holidays service (issue #180 — closed ✅)
+- [ ] Verify VIN Decoder metrics endpoint and ServiceMonitor scrape config — issue #231
+- [x] VIN Decoder metrics instrumentation + Grafana dashboard (issue #129 — closed ✅)
+- [x] VIN Decoder Gatus health check (issue #134 — closed ✅)
+- [x] Enable Alertmanager in kube-prometheus-stack + configure Slack receiver for SLO alerts (issue #210 — closed ✅)

 ## Phase 5 — Documentation site
- [ ] `docs-site/` Astro + Redoc skeleton
- [ ] Gitea Actions pipeline that copies per-API `openapi.yaml` files at build time
- [ ] Deploy to `docs.leeworks.dev` via Flux
- [ ] One SEO blog post per API minimum (see master prompt §Phase 5)
+- [x] `docs-site/` Astro + Redoc skeleton (issue #28 — closed ✅)
+- [x] Gitea Actions pipeline that copies per-API `openapi.yaml` files at build time (issues #29 ✅, #38 ✅, #85 ✅)
+- [ ] Deploy to `docs.leeworks.dev` via Flux — issue #30
+- [x] One SEO blog post per API minimum (issues #39 ✅ — ZIP/Holidays/AirQuality, #124 ✅ — VIN Decoder)
+- [x] VIN Decoder docs page (issue #123 — closed ✅)
+- [x] VIN Decoder SEO blog post (issue #124 — closed ✅)

 ## Phase 6 — Pre-launch
- [ ] `docs/legal/terms-of-service.md`
- [ ] `docs/legal/privacy-policy.md`
- [ ] `docs/legal/acceptable-use-policy.md`
- [ ] DNS: `zip.leeworks.dev`, `holidays.leeworks.dev`, `aqi.leeworks.dev`, `docs.`, `status.`, `registry.`
- [ ] PayPal linked to RapidAPI (manual, on 18th birthday)
- [ ] Paid tiers enabled on RapidAPI listings (manual)
+- [x] `docs/legal/terms-of-service.md` (issue #40 — closed ✅)
+- [x] `docs/legal/privacy-policy.md` (issue #40 — closed ✅)
+- [x] `docs/legal/acceptable-use-policy.md` (issues #40 ✅, #89 ✅)
+- [ ] DNS: `zip.leeworks.dev`, `holidays.leeworks.dev`, `aqi.leeworks.dev`, `docs.`, `status.`, `registry.` — issues #33, #106, #150
+- [x] VIN Decoder DNS `vin.leeworks.dev` (issue #130 — closed ✅)
+- [x] VIN Decoder RapidAPI listing (issue #131 — closed ✅ as tracker; operator action required)
+- [ ] PayPal linked to RapidAPI (manual, on 18th birthday) — issue #19
+- [ ] Paid tiers enabled on RapidAPI listings (manual) — issues #44 (original 3), #151 (VIN Decoder)
+
+- [ ] Execute pre-launch checklist before go-live — issue #166
+- [ ] Publish launch announcement (HN, Reddit, Twitter, Dev.to) — issue #167

 ## Revenue target

@@ -47,4 +65,4 @@ $100/mo **net** ≈ $136/mo gross after RapidAPI 25% + PayPal ~2%.
 | 7 Pro @ $19 | $97 net |
 | 3 Ultra @ $49 | $107 net |

-(Per-API rough math; mix-and-match across the 3 APIs.)
+(Per-API rough math; mix-and-match across all 4 APIs — ZIP Enrichment, Holidays, Air Quality, VIN Decoder.)
@@ -1,29 +1,314 @@
 # Company Status

-_Last updated: 2026-05-30 (sprint planning cycle)_
+_Last updated: 2026-06-15 (triage cycle)_
+
+## Completed This Cycle (2026-06-15 — Triage Cycle)
+
+- **Triage** — All 38 open `agent-ready` issues reviewed; all confirmed still blocked on the same critical-path operator tasks: #47 (create `0xWheatyz/api-company`), #218 (merge Talos PR #14), #33/#106/#150 (DNS for all 8 subdomains).
+- **No agent-implementable work found** — every open issue is either a manual operator task or gated on Flux/cluster activation; kubectl unreachable from agent environment.
+- **0 new issues, 0 closures, 0 label changes, 0 open PRs.**
+- **`kustomize build flux/` = PASS** (1648 lines, no manifest regressions).
+- **Critical path unchanged:** (1) Operator creates `0xWheatyz/api-company` (#47), (2) Operator merges `0xWheatyz/Talos` PR #14 (#218), (3) Operator configures DNS for all 8 subdomains (#33, #106, #150).

 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
 |----------------|------|------|----------|--------------------|--------------|-----|
-| ZIP Enrichment | [~]  | [~]  | [ ]      | [ ]                | 0            | $0  |
-| Holidays       | [~]  | [~]  | [ ]      | [ ]                | 0            | $0  |
-| Air Quality    | [ ]  | [ ]  | [ ]      | [ ]                | 0            | $0  |
+| ZIP Enrichment | [x]  | [x]  | [ ]      | [ ]                | 0            | $0  |
+| Holidays       | [x]  | [x]  | [ ]      | [ ]                | 0            | $0  |
+| Air Quality    | [x]  | [x]  | [ ]      | [ ]                | 0            | $0  |
+| VIN Decoder    | [x]  | [x]  | [ ]      | [ ]                | 0            | $0  |

 Legend: [x]=done, [~]=in-progress, [ ]=not started

 ## Infrastructure
 - Cluster nodes: 3 control plane (10.0.1.3, .4, .5) + workers (testing1)
- **Flux wiring (api-company):** Manifests staged at `flux/api-company-source/` — PENDING Talos merge (issue #2)
+- **Flux wiring (api-company):** `flux/api-company-source/` — Fork PR #399 **MERGED** to leeworks-agents/Talos; upstream PR #14 open on 0xWheatyz/Talos — awaiting operator merge to activate Flux (issue #2)
 - **Gitea Actions runner:** Flux manifest committed at `flux/gitea-runner/` — PENDING runner token secret + Talos wiring (issue #3)
 - **Container registry:** Gitea built-in registry selected; docs/registry.md committed — PENDING Gitea packages enabled (issue #4)
 - **Prometheus + Grafana:** Flux HelmRelease at `flux/monitoring/` — PENDING Flux wiring + Grafana secret (issue #7)
 - **Gatus status page:** Flux HelmRelease at `flux/monitoring/gatus-helmrelease.yaml` — PENDING Flux wiring (issue #8)
 - **API service manifests:** `flux/zip-enrichment/`, `flux/holidays/`, `flux/air-quality/` scaffolded (PR #48, closes #46)
 - **Image automation:** `flux/image-automation/` — ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
+- **VIN Decoder manifests:** `flux/vin-decoder/` — Flux HelmRelease + Kustomization committed (issue #140)
+- **Alertmanager:** `flux/monitoring/helmrelease.yaml` — enabled with Slack receiver config (`gatus-slack-webhook` secret); PR #212 open (issue #210)

-## Completed This Cycle (2026-05-30 — Sprint Cycle)
+## Completed Previous Cycle (2026-06-08 — Triage Cycle #240)
+
+- **Triage** — All 28 open `agent-ready` issues reviewed and commented with current status (2026-06-08).
+  - **All issues confirmed blocked** on the same critical-path operator tasks: #47 (create `0xWheatyz/api-company`), #218 (merge Talos PR #14), #33/#106/#150 (DNS).
+  - **No agent-implementable work found** — all open issues are either manual operator tasks or gated on Flux/cluster activation; kubectl unreachable from agent environment.
+  - **28 issues triaged** — status comments posted on all open `agent-ready` issues.
+  - **0 new issues created** — no gaps found; all ROADMAP items remain grounded in open issues.
+  - **0 issues closed** — no stale issues; oldest open issue is #3 from 2026-05-18 (21 days < 30-day threshold).
+  - **0 label changes** — all existing labels correct.
+  - **0 open PRs** — nothing to review or merge.
+  - **`kustomize build flux/` = PASS** — no manifest regressions.
+- **Critical path unchanged:** (1) Operator creates `0xWheatyz/api-company` (#47), (2) Operator merges `0xWheatyz/Talos` PR #14 (#218), (3) Operator configures DNS for all 8 subdomains (#33, #106, #150).
+
+## Completed Previous Cycle (2026-06-07 — Triage Cycle #232)
+
+- **Triage** — All 28 open `agent-ready` issues reviewed and commented with current status (2026-06-07).
+  - **All issues confirmed blocked** on the same critical-path operator tasks: #47 (create `0xWheatyz/api-company`), #218 (merge Talos PR #14), #33/#106/#150 (DNS).
+  - **No agent-implementable work found** — all open issues are either manual operator tasks or gated on Flux/cluster activation; kubectl unreachable from agent environment.
+  - **1 new issue triaged** — #231 commented with @qa-engineer assessment; BLOCKED on #218.
+  - **0 new issues created** — no gaps found; all ROADMAP items remain grounded in open issues.
+  - **0 issues closed** — no stale issues.
+  - **0 label changes** — all existing labels correct.
+  - **0 open PRs** — nothing to review or merge.
+  - **`kustomize build flux/` = PASS** — no manifest regressions.
+- **Critical path unchanged:** (1) Operator creates `0xWheatyz/api-company` (#47), (2) Operator merges `0xWheatyz/Talos` PR #14 (#218), (3) Operator configures DNS for all 8 subdomains (#33, #106, #150).
+
+## Completed Previous Cycle (2026-06-06 — Sprint Planning Cycle #227)
+
+
+
+- **Sprint Planning** — Full ROADMAP cross-reference + backlog triage completed (2026-06-06).
+  - **ROADMAP cross-reference:** All 18 unchecked items confirmed grounded in open issues — **zero gaps**.
+    - Phase 0: #3, #4, #66, #76–#83, #126–#128, #173, #178, #179, #203, #218 — all tracked.
+    - Phase 4: #7, #8, #174 — all tracked.
+    - Phase 5: #30 — tracked.
+    - Phase 6: #19, #33, #44, #106, #116, #139, #150, #151, #161, #166, #167 — all tracked.
+  - **Staleness check:** Oldest open issue is #3 / #4 from 2026-05-18 (19 days) — **below 30-day threshold; zero closures**.
+  - **Label audit:** All priority/complexity labels confirmed correct from cycle #221 audit — **zero changes**.
+  - **0 new issues created** — no roadmap gaps found.
+  - **0 issues closed** — no stale issues.
+  - **0 label changes** — all existing labels correct.
+  - **`kustomize build flux/` = PASS** — no manifest regressions.
+- **Critical path unchanged:** (1) Operator creates `0xWheatyz/api-company` (#47), (2) Operator merges `0xWheatyz/Talos` PR #14 (#218), (3) Operator configures DNS for all 8 subdomains (#33, #106, #150).
+
+## Completed Previous Cycle (2026-06-06 — Triage Cycle #226)
+
+- **Triage** — All 28 open `agent-ready` issues reviewed and commented with current status (2026-06-06).
+  - **All issues confirmed blocked** on the same critical-path operator tasks: #47 (create `0xWheatyz/api-company`), #218 (merge Talos PR #14), #33/#106/#150 (DNS).
+  - **No agent-implementable work found** — all open issues are either manual operator tasks or gated on Flux/cluster activation.
+  - **0 new issues created** — no gaps found; all ROADMAP items are grounded in open issues.
+  - **0 issues closed** — no issues are stale or resolvable by agent action.
+  - **0 PRs open** — nothing to review or merge.
+  - **`kustomize build flux/` = PASS** — no manifest regressions.
+- **Current critical path unchanged:** (1) Operator creates `0xWheatyz/api-company` (#47), (2) Operator merges `0xWheatyz/Talos` PR #14 (#218), (3) Operator configures DNS for all 8 subdomains (#33, #106, #150).
+
+## Completed Previous Cycle (2026-06-06 — Sprint Planning Cycle #221)
+
+- **#221** — STATUS.md updated for 2026-06-06 sprint planning cycle (this entry). Last-updated date confirmed 2026-06-06.
+- **0 new issues created** — all ROADMAP unchecked items confirmed grounded in open issues (35 open issues, zero gaps).
+- **0 issues closed** — oldest open issue is #3 from 2026-05-18 (19 days < 30-day stale threshold).
+- **3 label changes:**
+  - #106 (grafana.leeworks.dev DNS): added `blocked` label (missing despite dependency on #47)
+  - #150 (vin.leeworks.dev DNS): added `blocked` label (missing despite dependency on #47)
+  - #203 (ClusterIssuer verification): downgraded P1 → P2 (gated on DNS #33, not a first-order blocker)
+- **Critical path unchanged:** Operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#218) to activate Flux, (3) configure DNS (#33, #106, #150).
+- **`kustomize build flux/` = PASS** — no manifest regressions.
+
+## Completed Previous Cycle (2026-06-06 — Docs Cycle #219)
+
+- **#219** — STATUS.md Current Blockers updated: removed closed issues #187 and #90; replaced with open issue #218 (Operator: merge 0xWheatyz/Talos upstream PR #14 to activate Flux GitOps for api-company). Critical Path item 2 updated to reference #218. `kustomize build flux/` = PASS.
+
+## Completed Previous Cycle (2026-06-05 — Sprint Planning Cycle #215)
+
+- **#215** — STATUS.md updated for 2026-06-05 sprint planning cycle (this entry). Last-updated date confirmed 2026-06-05.
+- **1 new issue created:** #214 (ROADMAP.md Phase 4 Alertmanager annotation — documentation gap filed).
+- **0 issues closed** — no stale issues; oldest open issue is #2 from 2026-05-18 (18 days < 30-day threshold).
+- **0 label/priority changes** — all existing labels confirmed correct.
+- **ROADMAP cross-reference:** all unchecked items confirmed grounded in open issues; 1 new documentation gap found and filed (#214 — Alertmanager / Slack receiver missing from ROADMAP.md Phase 4).
+- **Critical path unchanged:** Operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150).
+- **`kustomize build flux/` = PASS** — no regressions.
+- **0 open PRs** — nothing to review or merge.
+
+## Completed Previous Cycle (2026-06-05 — Sprint Planning Cycle #211)
+
+- **#211** — STATUS.md updated for 2026-06-05 sprint planning cycle (this entry). Last-updated date confirmed 2026-06-05.
+- **1 new issue implemented:** #210 (Enable Alertmanager + Slack receiver — gap identified by roadmap cross-reference); PR #212 opened to `leeworks-agents/api-company` with `kustomize build flux/` = PASS.
+- **0 issues closed** — oldest open issue is #2 from 2026-05-18 (18 days old — under 30-day stale threshold).
+- **0 label changes** — all priority/complexity labels confirmed correct.
+- **ROADMAP cross-reference:** 18 unchecked items confirmed grounded in open issues; 1 new gap found and filed (#210 — Alertmanager was missing from roadmap coverage).
+- **Current Blockers unchanged:** Operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150).
+- **`kustomize build flux/` = PASS** — no regressions.
+- **1 open PR** — PR #212 (Alertmanager enable + Slack receiver): `kustomize build flux/` PASS; pending merge.
+
+## Completed Previous Cycle (2026-06-05 — Sprint Planning Cycle #206)
+
+- **#206** — STATUS.md updated for 2026-06-05 sprint planning cycle (this entry). Last-updated date set to 2026-06-05.
+- **Completed outcomes from 2026-06-04 sprint planning cycle recorded:**
+  - Issue #204 (smoke-tests): reopened and relabeled `blocked` — was prematurely closed while prerequisites (DNS #33/#150, Flux #2/#187) are still open.
+  - ROADMAP cross-reference: all 18 unchecked items confirmed grounded in open issues (zero gaps).
+  - Staleness check: oldest open issue is #2 from 2026-05-18 (18 days, under 30-day threshold — no closures).
+  - Label audit: no label changes required — all existing priority/complexity labels are correct.
+- **Critical path confirmed:** Operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150).
+- **`kustomize build flux/` = PASS** — no regressions.
+- **0 open PRs** — nothing to review or merge.
+
+## Completed Previous Cycle (2026-06-04 — Triage Cycle #204)
+
+- **Triage** — All 29 open `agent-ready` issues reviewed and commented with current status (2026-06-04).
+  - **#204** (smoke tests): ❌ BLOCKED — all HTTP endpoints timeout; DNS not configured; kubectl unreachable.
+  - **#203** (ClusterIssuer): ❌ BLOCKED — kubectl not accessible from agent environment.
+  - **#187, #90, #2** (Flux wiring): Waiting on operator to merge upstream Talos PR #14.
+  - **#179, #178, #66** (validation checklists): Blocked on Flux active + cluster access.
+  - **#174** (VIN metrics): `kustomize build flux/` PASS; blocked on cluster deploy.
+  - **#173, #81, #128, #126, #127, #83, #80, #79, #77, #76, #74, #73, #70** (secrets): Manual operator tasks, all documented.
+  - **#167, #166** (launch/pre-launch): Blocked on DNS + Flux + RapidAPI + PayPal.
+  - **#161, #151, #150, #139, #116, #106, #47, #44, #33, #30, #19, #8, #7, #4, #3**: Manual operator tasks or blocked on operator actions.
+- **`kustomize build flux/` = PASS** — no regressions.
+- **0 PRs open** — nothing to review or merge.
+- **Critical path unchanged:** Operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux.
+
+## Completed Previous Cycle (2026-06-04 — Sprint Planning Cycle #200/#201)
+
+- **#200** — STATUS.md Infrastructure section updated: Flux wiring row for `flux/api-company-source/` updated to reflect Fork PR #399 **MERGED** to leeworks-agents/Talos; upstream PR #14 open on 0xWheatyz/Talos awaiting operator merge. Current Blockers updated to note upstream PR #14 as critical gate.
+- **#201** — Sprint planning STATUS.md update for 2026-06-04 cycle. Issues #200 and #201 created this cycle. ROADMAP cross-reference: all 18 unchecked items confirmed grounded in open issues (no gaps). Staleness check: oldest open issue is #2 from 2026-05-18 (17 days, not stale — threshold 30 days). Priority review: all labels confirmed appropriate. Critical path: operator-gated on 0xWheatyz/Talos PR #14 merge.
+- **`kustomize build flux/` = PASS** — no regressions confirmed.
+
+## Completed Previous Cycle (2026-06-04 — Sprint Planning Cycle #198)
+
+- **#198** — STATUS.md updated for 2026-06-04 sprint planning cycle. Last updated date set to 2026-06-04.
+- **Sprint Summary:** 0 new code issues created (all ROADMAP items grounded — all 18 unchecked items have corresponding open issues). 0 issues closed (no stale; oldest is #2 at 17 days). 0 label changes. Critical path is entirely operator-gated: Talos merge of #187 unblocks the #2/#3/#4 chain.
+- **`kustomize build flux/` = PASS** — no regressions confirmed.
+
+## Completed Previous Cycle (2026-06-04 — Sprint Planning Cycle #196)
+
+- **#196** — STATUS.md updated for 2026-06-04 sprint planning cycle. Last updated date set to 2026-06-04.
+- **Sprint Summary:** ROADMAP cross-reference complete — all 18 unchecked items have corresponding open issues (no gaps). 1 new issue created: #196 (this STATUS.md update). 0 issues closed (no stale issues; oldest open issue is #2 from 2026-05-18, only 17 days old). 0 label changes (all priority/complexity labels correct). Critical path remains entirely operator-gated.
+- **`kustomize build flux/` = PASS** — no regressions confirmed.
+
+## Completed Previous Cycle (2026-06-03 — Sprint Planning Cycle #193/#194)
+
+- **#194** — ROADMAP.md annotated with missing issue cross-references: Phase 0 issue #2 entry updated to reference implementation issue #187; Phase 6 entries added for issue #166 (pre-launch checklist) and #167 (launch announcement). Closes leeworks-agents/api-company#194.
+- **#193** — STATUS.md updated for 2026-06-03 sprint planning cycle. Current Blockers confirmed accurate; #80 (gitea-image-automation-token) listed. Closes leeworks-agents/api-company#193.
+- **Sprint Summary:** 2 new documentation issues created (#193 STATUS.md update, #194 ROADMAP annotation). 0 issues closed. 0 stale. Critical path entirely operator-gated.
+- **`kustomize build flux/` = PASS** — no regressions confirmed.
+
+## Completed Previous Cycle (2026-06-03 — Audit Cycle #190/#191)
+
+- **#190** — ZIP Enrichment API audit complete: `openapi.yaml` present at repo root (57 KB, OpenAPI 3.0.3); server entry point `src/server.js`; all routes confirmed implemented; `X-RapidAPI-Proxy-Secret` preHandler middleware on all routes except `/health`; `/metrics` Prometheus endpoint present; STATUS.md ZIP Enrichment Spec and Code rows updated to `[x]`. Closes leeworks-agents/api-company#190.
+- **#191** — Holidays API audit complete: `openapi.yaml` present at repo root (13 KB, OpenAPI 3.0.3); server entry point `src/server.js`; all routes confirmed implemented; `X-RapidAPI-Proxy-Secret` preHandler middleware on all routes except `/health` and `/metrics`; `/metrics` Prometheus endpoint present (issue #180 confirmed done); STATUS.md Holidays Spec and Code rows updated to `[x]`. Closes leeworks-agents/api-company#191.
+- **`kustomize build flux/` = PASS** — no regressions confirmed.
+
+## Completed Previous Cycle (2026-06-03 — Sprint Planning Cycle)
+
+- **#188** — STATUS.md updated for 2026-06-03 sprint planning cycle (this entry). Last updated date set to 2026-06-03.
+- **#187** — Talos PR for api-company Flux source manifests: PR #399 on `leeworks-agents/Talos` confirmed valid; upstream deploy PR created targeting `0xWheatyz/Talos`.
+- **#186** — Air Quality API audit complete: `openapi.yaml` ✅ exists at repo root in `leeworks-agents/air-quality`; server implementation ✅ present (`src/server.ts`, `src/app.ts`, `src/routes/`); STATUS.md Air Quality row updated to `[x]/[x]`.
+- **#178** relabeled — added `blocked` label (depends on #173 + Flux active).
+- **#174** relabeled — added `blocked` label (depends on #18 deploy + #7 monitoring).
+- **Current Blockers updated:** #187 added before #90 (same unblock target, more actionable).
+- **`kustomize build flux/` = PASS** — no regressions confirmed.
+
+## Completed Previous Cycle (2026-06-02 — Sprint Planning Cycle #175/#176)
+
+- **#176** — ROADMAP.md Phase 6 unchecked items annotated with issue cross-references: DNS — issues #33, #106, #150; PayPal — issue #19; Paid tiers — issues #44 (original 3), #151 (VIN Decoder). No checked items changed.
+- **#175** — STATUS.md updated with 2026-06-02 sprint planning cycle results (this entry). Last updated date set to 2026-06-02.
+- **Sprint Summary:** 2 new documentation issues created (#175 STATUS.md update, #176 ROADMAP Phase 5/6 annotation). 0 code issues created (all ROADMAP items already covered by existing issues). 0 issues closed (none stale). 0 reprioritizations.
+- **Current Blockers updated:** #173 (ESO source secrets in `external-secrets` ns) and #174 (VIN Decoder metrics instrumentation) added.
+- **`kustomize build flux/` = PASS** — no regressions confirmed.
+
+## Completed Previous Cycle (2026-06-02 — Sprint Planning Cycle)
+
+- **#171** — ROADMAP.md Phase 0 unchecked items annotated with issue #2, #3, #4; Phase 4 unchecked items annotated with issue #7, #8, #27; Phase 5 unchecked item annotated with issue #30. No checked-off items changed.
+- **#170** — STATUS.md updated with 2026-06-02 sprint planning cycle results (this entry). Last updated date set to 2026-06-02.
+- **Sprint Summary:** 2 new issues created (#171, #170), 0 issues closed this cycle, 0 stale found.
+- **`kustomize build flux/` = PASS** — no regressions confirmed.
+
+## Completed Previous Cycle (2026-06-02 — Triage Cycle #168)
+- **#168** — STATUS.md cleanup: removed all stale “open, in progress” references to #120 and #121 (both confirmed closed ✅ in leeworks-agents/vin-decoder). Historical sections corrected. VIN Decoder Code column confirmed `[x]`.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Completed Previous Cycle (2026-06-01 — Sprint Planning Cycle)
+- **#163** — ROADMAP.md Phase 2 and Phase 3 VIN Decoder bullets marked `[x]` with closed ✅ references for issues #120 and #121.
+- **#164** — STATUS.md Current Blockers updated: removed #120 and #121 (both confirmed closed ✅). Top actionable agent task updated to #163.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Completed Previous Cycle (2026-06-01 — Triage Cycle)
+- **#158** — STATUS.md updated with 2026-06-01 current blockers and sprint summary.
+- **#156** — ROADMAP.md checkboxes updated: Phase 4 VIN Decoder metrics, Phase 5 docs-site/pipeline/blog, Phase 6 legal docs all checked off.
+- **VIN Decoder Code `[x]`** — leeworks-agents/vin-decoder data layer (#120) and Fastify server (#121) confirmed merged; STATUS.md Code column updated.
+- **PR #160 closed** — had merge conflicts and ROADMAP.md regressions (unchecked completed items). Clean fix applied here.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Current Blockers (as of 2026-06-07)
+
+In dependency order — operator tasks unless noted:
+
+1. **P1 #47** — Create `0xWheatyz/api-company` upstream repo (operator) — **highest priority, unblocks everything**
+2. **P1 #76** — Create `gitea-leeworks-agents-token` secret in `flux-system` (operator)
+3. **P1 #77** — Create `gitea-runner-token` secret in `gitea-runner` namespace (operator)
+4. **P1 #79** — Create `gitea-registry` imagePullSecrets in all API namespaces (operator)
+5. **P1 #83** — Configure `GITEA_TOKEN` Actions secret in zip-enrichment, holidays, air-quality repos (operator)
+6. **P1 #126** — Configure `GITEA_TOKEN` Actions secret in vin-decoder repo (operator — depends on #122 ✅)
+7. **P1 #127** — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace (operator)
+8. **P1 #218** — Operator: merge 0xWheatyz/Talos upstream PR #14 to activate Flux GitOps for api-company — Fork PR #399 already MERGED to leeworks-agents/Talos; upstream PR #14 is the critical gate; unblocks #2, #3, #4, #66 chain (replaces closed #187 and #90)
+10. **P2 #80** — Create `gitea-image-automation-token` secret in `flux-system` namespace (operator) — enables Flux image automation
+11. **P2 #173** — Create ESO source secrets in `external-secrets` namespace for RapidAPI proxy-secret syncing (operator) — blocks ESO sync
+12. **P2 #231** — Verify VIN Decoder metrics endpoint and ServiceMonitor scrape config in live cluster (depends on #218 — Flux must be active first)
+13. **P2 #178** — Validate ESO HelmRelease deployment and ExternalSecret sync for all 4 API namespaces (depends on #173 + Flux active)
+14. **P2 #179** — Execute extended full-stack Flux validation checklist including VIN Decoder (depends on #126, #127, #128)
+
+## Sprint Summary (2026-06-01 — Sprint Planning Cycle)
+- **Issues closed this cycle:** 0
+- **New issues created this cycle:** 1 (#163 — ROADMAP/STATUS cleanup after #120/#121)
+- **Stale issues found:** 0
+- **Top actionable agent task:** #163 (pure doc update, immediately actionable)
+- **Critical path:** Entirely operator-gated after #163 is merged (see Current Blockers)
+
+## Sprint Summary (2026-06-01)
+- **Issues closed since last STATUS update (#146):** #145–#154 — VIN Decoder sprint docs + infra (✅ all closed)
+- **Issues opened this sprint:** #150 (vin DNS reminder), #151 (VIN Decoder RapidAPI tiers), #155 (if applicable), #156 (ROADMAP.md update), #157 (full-stack validation), #158 (STATUS.md update), #163 (ROADMAP/STATUS cleanup post-#120/#121), #164 (STATUS.md sprint planning update)
+- **Top actionable agent task:** #163 (ROADMAP/STATUS doc cleanup for #120/#121 — pure doc update, immediately actionable)
+
+## Completed Previous Cycle (2026-05-31 — Sprint Cycle)
+- **#146** — STATUS.md updated to reflect VIN Decoder sprint wave (#117–#141): APIs table row added, completed wave documented, blockers updated.
+- **#145** — ROADMAP.md updated to reference VIN Decoder as 4th API across all phases (Phase 1–6). `kustomize build flux/` = PASS.
+- **PR #147 opened** — docs: update ROADMAP.md and STATUS.md for VIN Decoder sprint wave (closes #145, #146).
+
+## Completed Previous Cycle (2026-05-30 — VIN Decoder Sprint Wave)
+### VIN Decoder issues #117–#141 — status as of 2026-05-31:
+- **#117** — VIN Decoder spec + feasibility — **closed ✅** (`apis/vin-decoder/openapi.yaml` merged)
+- **#120** — VIN Decoder data layer (SQLite/NHTSA vPIC) — **closed ✅** (leeworks-agents/vin-decoder)
+- **#121** — VIN Decoder Fastify server — **closed ✅** (leeworks-agents/vin-decoder)
+- **#122** — Create `leeworks-agents/vin-decoder` repo — **closed ✅**
+- **#123** — VIN Decoder docs page — **closed ✅**
+- **#124** — VIN Decoder SEO blog post — **closed ✅**
+- **#130** — VIN Decoder DNS `vin.leeworks.dev` — **closed ✅**
+- **#131** — VIN Decoder RapidAPI listing — **closed ✅** (tracker; operator action required)
+- **#133** — VIN Decoder pricing page integration — **closed ✅**
+- **#134** — VIN Decoder Gatus health check — **closed ✅**
+- **#135** — VIN Decoder image automation — **closed ✅**
+- **#136** — VIN Decoder ExternalSecret manifest — **closed ✅**
+- **#138** — Extend publish-openapi pipeline to include VIN Decoder — **closed ✅** (PR #142 merged)
+- **#139** — Operator: add RAPIDAPI_VIN_API_ID + RAPIDAPI_VIN_VERSION_ID secrets — **open** (operator task, blocked on RapidAPI listing)
+- **#140** — VIN Decoder Flux manifests — **closed ✅** (PR #143 merged)
+- **#141** — Pricing page updated for VIN Decoder — **closed ✅** (PR #144 merged)
+
+## Critical Path (operator must complete in order)
+See **Current Blockers** section above for the full ordered list as of 2026-06-01.
+
+1. **Create `0xWheatyz/api-company` repo** (#47) — **highest priority, unblocks everything**
+2. **Merge upstream Talos PR #14 to activate Flux for api-company** (#218) — manifests already committed; operator must merge 0xWheatyz/Talos PR #14
+3. **Create `gitea-leeworks-agents-token` secret** in `flux-system` (#76)
+4. **Create `gitea-runner-token` secret** in `gitea-runner` (#77)
+5. **Enable Gitea packages + DNS for `registry.leeworks.dev`** (#4)
+6. **All other secrets** (#70, #73, #74, #79, #80, #81, #83) follow in order
+
+## Blockers — VIN Decoder critical path
+- **P1: #127** — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace — operator manual task
+- **P2: #126** — Configure `GITEA_TOKEN` secret in `vin-decoder` repo — operator manual task
+- **P2: #128** — Create `rapidapi-proxy-secret` in `vin-decoder` namespace — operator manual task
+- ~~**P2: #129** — VIN Decoder Prometheus metrics instrumentation~~ — **closed ✅** (PR merged)
+- **P3: #139** — Add RAPIDAPI_VIN_* Actions secrets — operator task, depends on RapidAPI listing (#131)
+
+## New Issues This Sprint (2026-05-30, #120–#146)
+- **#120** — VIN Decoder data layer — **closed ✅** (leeworks-agents/vin-decoder)
+- **#121** — VIN Decoder Fastify server — **closed ✅** (leeworks-agents/vin-decoder)
+- **#126** — Operator: GITEA_TOKEN secret in vin-decoder repo — manual operator task
+- **#127** — Operator: gitea-registry imagePullSecret in vin-decoder namespace — manual operator task, P1 blocker
+- **#128** — Operator: rapidapi-proxy-secret in vin-decoder namespace — manual operator task
+- **#129** — VIN Decoder Prometheus metrics — **open, P2, depends on #121**
+- **#139** — Operator: RAPIDAPI_VIN_* secrets — **open, P3, operator task**
+- **#145** — Update ROADMAP.md for VIN Decoder — **DONE (this cycle)**
+- **#146** — Update STATUS.md for VIN Decoder sprint wave — **DONE (this cycle)**
+
+## Completed Previous Cycle (2026-05-30 — Sprint Cycle)
 - **#108** — STATUS.md updated with 2026-05-30 sprint plan and critical path.
- **#107** — docs-site build verified: `npm run build` exits 0; all 9 required routes present in `dist/` (`/`, `/zip-enrichment`, `/holidays`, `/air-quality`, `/blog/` (3 posts), `/legal/terms-of-service`, `/legal/privacy-policy`, `/legal/acceptable-use-policy`, `/pricing`). Unblocks #30.
+- **#107** — docs-site build verified: `npm run build` exits 0; all 9 required routes present in `dist/`.
 - **PR #105 MERGED** — `scripts/publish-openapi.js` + `.gitea/workflows/publish-openapi.yaml` (closes #100).
 - **PR #103 MERGED** — `docs-site/src/pages/pricing.astro` + nav link (closes #101).
 - **PR #104 MERGED** — `research/RESEARCH_LOG.md` first session: VIN Decoder next candidate (closes #102).
@@ -31,26 +316,6 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **`0xWheatyz/api-company`** — still does not exist; fork sync skipped (blocker #47).
 - **`kustomize build flux/` = PASS** — no regressions.

-## Critical Path (operator must complete in order)
-1. **Create `0xWheatyz/api-company` repo** (#47) — **highest priority, unblocks everything**
-2. **Add api-company Flux source to Talos** (#90) — needs Talos PR, reference manifests at `flux/api-company-source/`
-3. **Create `gitea-leeworks-agents-token` secret** in `flux-system` (#76)
-4. **Create `gitea-runner-token` secret** in `gitea-runner` (#77)
-5. **Enable Gitea packages + DNS for `registry.leeworks.dev`** (#4)
-6. **All other secrets** (#70, #73, #74, #79, #80, #81, #83) follow in order
-
-## New Issues This Sprint (2026-05-29, #100–#108)
- **#100** — `scripts/publish-openapi.js` + CI workflow — **DONE (PR #105 merged)**
- **#101** — Pricing page at `docs.leeworks.dev/pricing/` — **DONE (PR #103 merged)**
- **#102** — Seed `research/RESEARCH_LOG.md` — **DONE (PR #104 merged)**
- **#106** — Add `grafana.leeworks.dev` as 7th subdomain to DNS task (#33) — tracker only; docs already updated (#67)
- **#107** — docs-site build verification — **DONE (build passes, all 9 routes confirmed)**
- **#108** — STATUS.md update — **DONE (this update)**
-
-## Backlog
- **28 open issues total**; all remaining blocked on operator Phase 0 actions above.
- **Agent work that can proceed without operator:** all completed this cycle.
-
 ## Completed Previous Cycle (2026-05-28 — Cycle-2 Triage)
 - **#83** — Triaged: `GITEA_TOKEN` Actions secrets needed in `zip-enrichment`, `holidays`, `air-quality` repos. Manual operator task; reuse token from #74 if it has `write:package` scope. Step-by-step instructions posted.
 - **No open PRs** — queue empty.
@@ -130,6 +395,7 @@ All flux manifests validate successfully. Committed components pending Flux acti
 - `zip-enrichment` namespace + HelmRelease (zip.leeworks.dev) + rapidapi-proxy-secret placeholder
 - `holidays` namespace + HelmRelease (holidays.leeworks.dev) + rapidapi-proxy-secret placeholder
 - `air-quality` namespace + HelmRelease (aqi.leeworks.dev) + rapidapi-proxy-secret placeholder
+- `vin-decoder` namespace + HelmRelease (vin.leeworks.dev) + Flux manifests
 - `image-automation` ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs

 ## Blockers (human operator action required)
@@ -138,6 +404,7 @@ All flux manifests validate successfully. Committed components pending Flux acti
 3. **Create `gitea-leeworks-agents-token` secret** in `flux-system` namespace (HTTPS token for Gitea)
 4. **Create `gitea-runner-token` secret** in `gitea-runner` namespace (Gitea Admin -> Actions -> Runners -> New Runner) (#3)
 5. **Enable Gitea packages** (for container registry at `registry.leeworks.dev`) (#4)
-6. **RapidAPI + PayPal setup** — manual, gated on operator turning 18 (#19, #44)
+6. **Create `gitea-registry` imagePullSecret in `vin-decoder` namespace** (#127) — VIN Decoder P1
+7. **RapidAPI + PayPal setup** — manual, gated on operator turning 18 (#19, #44)

 > Full ordered runbook with copy-paste commands: `docs/operator-runbook.md`
@@ -8,9 +8,9 @@
    "preview": "astro preview"
  },
  "dependencies": {
-    "astro": "^4.8.0",
    "@astrojs/mdx": "^3.0.0",
-    "@astrojs/sitemap": "^3.1.0",
+    "@astrojs/sitemap": "~3.2.1",
+    "astro": "^4.8.0",
    "redoc": "^2.1.5"
  },
  "devDependencies": {
@@ -0,0 +1,405 @@
+openapi: 3.1.0
+info:
+  title: VIN Decoder API
+  version: 1.0.0
+  description: |
+    Decode any 17-character Vehicle Identification Number (VIN) into structured
+    vehicle data including make, model, year, trim, engine, body style, and more.
+    Powered by the NHTSA vPIC public-domain database.
+
+    **Data source:** NHTSA Product Information Catalog and Vehicle Listing (vPIC)
+    public API - US federal government data, public domain (17 U.S.C. 105).
+
+    **Coverage:** Model years 1981-present, all major manufacturers registered
+    with NHTSA (domestic and import).
+
+    **Caching:** Decoded results are cached for 90 days; cache status is
+    indicated by the X-Cache response header.
+  contact:
+    name: leeworks.dev API Support
+    url: https://docs.leeworks.dev
+  license:
+    name: MIT
+    url: https://opensource.org/licenses/MIT
+
+servers:
+  - url: https://vin.leeworks.dev/v1
+    description: Production
+
+security:
+  - RapidApiProxy: []
+
+tags:
+  - name: decode
+    description: VIN decoding endpoints
+  - name: health
+    description: Service health and observability
+
+paths:
+  /decode:
+    get:
+      operationId: decodeVin
+      summary: Decode a single VIN
+      description: |
+        Decodes a 17-character VIN and returns structured vehicle attributes.
+        Results are cached for 90 days; a cache hit is indicated by
+        X-Cache: HIT in the response headers.
+      tags:
+        - decode
+      parameters:
+        - name: vin
+          in: query
+          required: true
+          description: 17-character Vehicle Identification Number (uppercase, no I/O/Q).
+          schema:
+            type: string
+            minLength: 17
+            maxLength: 17
+            pattern: "^[A-HJ-NPR-Z0-9]{17}$"
+          example: 1HGCM82633A004352
+        - name: raw
+          in: query
+          required: false
+          description: If true, include raw NHTSA vPIC fields in the response.
+          schema:
+            type: boolean
+            default: false
+      responses:
+        "200":
+          description: VIN successfully decoded
+          headers:
+            X-Cache:
+              schema:
+                type: string
+                enum: [HIT, MISS]
+              description: Whether the result was served from cache
+            X-Data-Source:
+              schema:
+                type: string
+              description: Upstream data source identifier
+            X-Request-Id:
+              schema:
+                type: string
+              description: Unique request identifier
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/VinDecodeResult"
+        "400":
+          description: Invalid VIN format or missing parameter
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "403":
+          description: Missing or invalid RapidAPI proxy secret
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "429":
+          description: Rate limit exceeded for your plan
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "500":
+          description: Internal server error or upstream NHTSA API failure
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+
+  /batch:
+    post:
+      operationId: decodeVinBatch
+      summary: Decode up to 50 VINs in a single request
+      description: |
+        Accepts a JSON body with an array of VINs (1-50) and returns a decoded
+        result for each. Each VIN is processed independently; partial failures
+        return an error object in that position rather than failing the whole batch.
+      tags:
+        - decode
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - vins
+              properties:
+                vins:
+                  type: array
+                  minItems: 1
+                  maxItems: 50
+                  items:
+                    type: string
+                    minLength: 17
+                    maxLength: 17
+                    pattern: "^[A-HJ-NPR-Z0-9]{17}$"
+                  description: Array of 17-character VINs to decode
+            example:
+              vins:
+                - 1HGCM82633A004352
+                - WBABW33486PX01612
+      responses:
+        "200":
+          description: Batch decode results (one entry per input VIN, in order)
+          headers:
+            X-Request-Id:
+              schema:
+                type: string
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  results:
+                    type: array
+                    items:
+                      oneOf:
+                        - $ref: "#/components/schemas/VinDecodeResult"
+                        - $ref: "#/components/schemas/VinDecodeError"
+                  count:
+                    type: integer
+                    description: Total number of VINs processed
+                  cached_count:
+                    type: integer
+                    description: Number of results served from cache
+                  error_count:
+                    type: integer
+                    description: Number of VINs that could not be decoded
+        "400":
+          description: Invalid request body
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "403":
+          description: Missing or invalid RapidAPI proxy secret
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "429":
+          description: Rate limit exceeded
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "500":
+          description: Internal server error
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+
+  /health:
+    get:
+      operationId: healthCheck
+      summary: Service health check
+      description: |
+        Returns health status of the VIN Decoder service including cache
+        statistics and NHTSA API reachability. Does not require X-RapidAPI-Proxy-Secret.
+      tags:
+        - health
+      security: []
+      responses:
+        "200":
+          description: Service is healthy
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/HealthResponse"
+        "503":
+          description: Service is degraded (upstream unreachable or DB error)
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/HealthResponse"
+
+components:
+  securitySchemes:
+    RapidApiProxy:
+      type: apiKey
+      in: header
+      name: X-RapidAPI-Proxy-Secret
+      description: |
+        RapidAPI proxy secret injected automatically by RapidAPI on every
+        subscriber request. Direct callers must include this header manually.
+
+  schemas:
+    VinDecodeResult:
+      type: object
+      required:
+        - vin
+        - error_code
+      properties:
+        vin:
+          type: string
+          description: The input VIN (uppercased)
+          example: 1HGCM82633A004352
+        make:
+          type: ["string", "null"]
+          description: Vehicle manufacturer brand
+          example: HONDA
+        model:
+          type: ["string", "null"]
+          description: Vehicle model name
+          example: Accord
+        model_year:
+          type: ["string", "null"]
+          description: Model year as a 4-digit string
+          example: "2003"
+        trim:
+          type: ["string", "null"]
+          description: Trim level (e.g. EX, LX, Sport)
+          example: EX
+        series:
+          type: ["string", "null"]
+          description: Series designation if applicable
+        body_class:
+          type: ["string", "null"]
+          description: Body style classification
+          example: Sedan/Saloon
+        drive_type:
+          type: ["string", "null"]
+          description: Drive configuration
+          example: FWD/Front-Wheel Drive
+        engine_displacement_cc:
+          type: ["number", "null"]
+          description: Engine displacement in cubic centimetres
+          example: 2354
+        engine_displacement_l:
+          type: ["number", "null"]
+          description: Engine displacement in litres
+          example: 2.4
+        engine_cylinders:
+          type: ["integer", "null"]
+          description: Number of engine cylinders
+          example: 4
+        fuel_type_primary:
+          type: ["string", "null"]
+          description: Primary fuel type
+          example: Gasoline
+        transmission_style:
+          type: ["string", "null"]
+          description: Transmission type (Automatic, Manual, CVT, etc.)
+          example: Automatic
+        transmission_speeds:
+          type: ["string", "null"]
+          description: Number of transmission speeds as string
+          example: "5"
+        plant_city:
+          type: ["string", "null"]
+          description: Assembly plant city
+          example: MARYSVILLE
+        plant_state:
+          type: ["string", "null"]
+          description: Assembly plant state/province
+          example: OHIO
+        plant_country:
+          type: ["string", "null"]
+          description: Assembly plant country
+          example: UNITED STATES (USA)
+        manufacturer_name:
+          type: ["string", "null"]
+          description: Full legal name of the manufacturer
+          example: HONDA OF AMERICA MFG., INC.
+        vehicle_type:
+          type: ["string", "null"]
+          description: NHTSA vehicle type classification
+          example: PASSENGER CAR
+        error_code:
+          type: string
+          description: NHTSA decode error code. "0" means successful decode.
+          example: "0"
+        error_text:
+          type: ["string", "null"]
+          description: Human-readable decode error (null when error_code is "0")
+        cached:
+          type: boolean
+          description: Whether this result was served from the local cache
+          example: true
+
+    VinDecodeError:
+      type: object
+      required:
+        - vin
+        - error
+        - message
+      properties:
+        vin:
+          type: string
+          description: The VIN that could not be decoded
+        error:
+          type: string
+          description: Error code
+          example: INVALID_VIN
+        message:
+          type: string
+          description: Human-readable error description
+          example: VIN must be exactly 17 alphanumeric characters
+
+    Error:
+      type: object
+      required:
+        - error
+        - message
+        - status
+      properties:
+        error:
+          type: string
+          description: Machine-readable error code
+          example: BAD_REQUEST
+        message:
+          type: string
+          description: Human-readable error description
+          example: "Query parameter 'vin' is required"
+        status:
+          type: integer
+          description: HTTP status code
+          example: 400
+
+    HealthResponse:
+      type: object
+      required:
+        - status
+        - version
+      properties:
+        status:
+          type: string
+          enum: [ok, degraded]
+          description: Overall service health
+        version:
+          type: string
+          description: Service version
+          example: "1.0.0"
+        uptime_seconds:
+          type: integer
+          description: Seconds since the service started
+          example: 86400
+        cache:
+          type: object
+          properties:
+            entries:
+              type: integer
+              description: Number of cached VIN records
+            hit_rate_24h:
+              type: number
+              description: Cache hit rate over the last 24 hours (0.0-1.0)
+            size_mb:
+              type: number
+              description: SQLite cache file size in megabytes
+        upstream:
+          type: object
+          properties:
+            nhtsa_vpic:
+              type: string
+              enum: [reachable, unreachable]
+              description: NHTSA vPIC API reachability
+            last_check:
+              type: string
+              format: date-time
+              description: ISO-8601 timestamp of last upstream health check
@@ -0,0 +1,340 @@
+---
+title: "How to Decode a VIN Number with Node.js Using Free NHTSA Data"
+description: "Learn how to decode any 17-character Vehicle Identification Number (VIN) with Node.js using the free NHTSA vPIC database — or skip the plumbing and call the leeworks.dev VIN Decoder API directly."
+date: "2026-05-30"
+author: "leeworks.dev"
+tags: ["vin-decoder", "nodejs", "automotive", "api", "tutorial"]
+---
+
+import Base from '../../layouts/Base.astro';
+
+<Base title="How to Decode a VIN Number with Node.js Using Free NHTSA Data" description="Learn how to decode any 17-character Vehicle Identification Number (VIN) with Node.js using the free NHTSA vPIC database — or skip the plumbing and call the leeworks.dev VIN Decoder API directly.">
+
+<article style="max-width: 800px; margin: 0 auto; padding: 2rem; line-height: 1.75;">
+
+<script type="application/ld+json" set:html={JSON.stringify({
+  "@context": "https://schema.org",
+  "@type": "Article",
+  "headline": "How to Decode a VIN Number with Node.js Using Free NHTSA Data",
+  "datePublished": "2026-05-30",
+  "author": { "@type": "Organization", "name": "leeworks.dev" },
+  "publisher": { "@type": "Organization", "name": "leeworks.dev", "url": "https://docs.leeworks.dev" }
+})} />
+
+# How to Decode a VIN Number with Node.js Using Free NHTSA Data
+
+Every vehicle sold in the United States since 1981 carries a unique 17-character fingerprint stamped into the chassis: the **Vehicle Identification Number**, or VIN. Decode it and you unlock make, model, year, trim level, engine type, body class, transmission, plant of manufacture, and more — without paying Carfax $40 per report.
+
+In this tutorial you'll learn how VINs are structured, how to query the free NHTSA vPIC database directly in Node.js, and how to call the **leeworks.dev VIN Decoder API** for a production-ready solution that handles caching, error handling, and batch decoding out of the box.
+
+---
+
+## What Is a VIN?
+
+A VIN is a 17-character alphanumeric string divided into three logical sections:
+
+| Section | Characters | Name | What It Encodes |
+|---------|-----------|------|-----------------|
+| **WMI** | 1–3 | World Manufacturer Identifier | Country of origin + manufacturer |
+| **VDS** | 4–9 | Vehicle Descriptor Section | Model, body style, engine type, check digit |
+| **VIS** | 10–17 | Vehicle Identifier Section | Model year, plant, sequential serial number |
+
+### Breaking down a real VIN
+
+Take `1HGCM82633A004352` — a 2003 Honda Accord EX:
+
+- `1HG` → Manufactured in the USA by Honda
+- `CM826` → Accord EX 4-door sedan, 2.4L i-VTEC engine (position 9 = check digit `3`)
+- `3` → Model year 2003 (position 10)
+- `A` → Marysville, Ohio assembly plant (position 11)
+- `004352` → Sequential production number
+
+VIN characters deliberately exclude `I`, `O`, and `Q` to avoid confusion with `1`, `0`, and `0` respectively — something to remember when validating user input.
+
+---
+
+## Why NHTSA vPIC?
+
+The **NHTSA Product Information Catalog and Vehicle Listing (vPIC)** is a US federal government database maintained by the National Highway Traffic Safety Administration. It covers:
+
+- All model years 1981 to present
+- Every manufacturer registered with NHTSA (domestic and imported)
+- 70+ decoded attributes per VIN including engine displacement, fuel type, GVWR, and more
+- **No API key, no rate limits** (beyond fair-use throttling), **public domain** under 17 U.S.C. 105
+
+The base endpoint is:
+
+```
+https://vpic.nhtsa.dot.gov/api/vehicles/DecodeVinValues/{vin}?format=json
+```
+
+---
+
+## Calling NHTSA vPIC Directly in Node.js
+
+Here's a minimal Node.js script using the built-in `fetch` API (Node 18+):
+
+```js
+// decode-vin.js
+const VIN = process.argv[2] ?? '1HGCM82633A004352';
+
+async function decodeVin(vin) {
+  // Validate: 17 chars, no I/O/Q
+  if (!/^[A-HJ-NPR-Z0-9]{17}$/.test(vin)) {
+    throw new Error(`Invalid VIN format: ${vin}`);
+  }
+
+  const url = `https://vpic.nhtsa.dot.gov/api/vehicles/DecodeVinValues/${vin}?format=json`;
+  const res = await fetch(url);
+
+  if (!res.ok) {
+    throw new Error(`NHTSA returned HTTP ${res.status}`);
+  }
+
+  const json = await res.json();
+  const r = json.Results[0];
+
+  return {
+    vin: r.VIN,
+    make: r.Make,
+    model: r.Model,
+    modelYear: r.ModelYear,
+    trim: r.Trim,
+    series: r.Series,
+    bodyClass: r.BodyClass,
+    driveType: r.DriveType,
+    engineDisplacementL: r.DisplacementL,
+    engineCylinders: r.EngineCylinders,
+    fuelTypePrimary: r.FuelTypePrimary,
+    transmissionStyle: r.TransmissionStyle,
+    manufacturerName: r.Manufacturer,
+    plantCity: r.PlantCity,
+    plantState: r.PlantState,
+    plantCountry: r.PlantCountry,
+    errorCode: r.ErrorCode,
+    errorText: r.ErrorText,
+  };
+}
+
+decodeVin(VIN)
+  .then(data => console.log(JSON.stringify(data, null, 2)))
+  .catch(err => { console.error(err.message); process.exit(1); });
+```
+
+Run it:
+
+```bash
+node decode-vin.js 1HGCM82633A004352
+```
+
+Expected output (abridged):
+
+```json
+{
+  "vin": "1HGCM82633A004352",
+  "make": "HONDA",
+  "model": "Accord",
+  "modelYear": "2003",
+  "trim": "EX",
+  "bodyClass": "Sedan/Saloon",
+  "driveType": "FWD/Front-Wheel Drive",
+  "engineDisplacementL": "2.4",
+  "engineCylinders": "4",
+  "fuelTypePrimary": "Gasoline",
+  "transmissionStyle": "Automatic",
+  "manufacturerName": "HONDA OF AMERICA MFG., INC.",
+  "plantCity": "MARYSVILLE",
+  "plantState": "OHIO",
+  "plantCountry": "UNITED STATES (USA)"
+}
+```
+
+---
+
+## The Problem with Rolling Your Own
+
+Calling NHTSA directly works great for a quick script. But for a production application, you'll quickly run into friction:
+
+1. **No caching** — every request hits the NHTSA servers. At scale, this is slow (NHTSA p99 ≈ 800ms) and risks being throttled.
+2. **Raw NHTSA response** — the flat key/value array has 80+ fields, many empty; you need to map and filter these yourself.
+3. **No batch support** — decoding 50 VINs means 50 sequential round-trips.
+4. **No SLA** — the NHTSA API is a government service; it has no uptime guarantee.
+5. **Header boilerplate** — proxy-secret validation, request IDs, CORS headers — you write it every time.
+
+---
+
+## Using the leeworks.dev VIN Decoder API
+
+The **leeworks.dev VIN Decoder API** wraps NHTSA vPIC with a 90-day SQLite cache, pre-mapped response schema, and batch endpoint — all available on RapidAPI.
+
+### Single VIN decode
+
+```js
+// Using the leeworks.dev VIN Decoder API
+const VIN = '1HGCM82633A004352';
+const API_KEY = process.env.RAPIDAPI_KEY; // Your RapidAPI key
+
+const res = await fetch(`https://vin.leeworks.dev/v1/decode?vin=${VIN}`, {
+  headers: {
+    'X-RapidAPI-Key': API_KEY,
+    'X-RapidAPI-Host': 'vin.leeworks.dev',
+  },
+});
+
+const data = await res.json();
+console.log(`${data.make} ${data.model} (${data.model_year})`);
+// → HONDA Accord (2003)
+
+// Check cache status
+const cacheStatus = res.headers.get('X-Cache'); // "HIT" or "MISS"
+console.log(`Cache: ${cacheStatus}`);
+```
+
+### Batch decode (up to 50 VINs)
+
+```js
+const vins = [
+  '1HGCM82633A004352',  // 2003 Honda Accord
+  '1FTFW1ET5DFA18803',  // 2013 Ford F-150
+  'WBA3A5G59DNP26082',  // 2013 BMW 3 Series
+];
+
+const res = await fetch('https://vin.leeworks.dev/v1/batch', {
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'X-RapidAPI-Key': API_KEY,
+    'X-RapidAPI-Host': 'vin.leeworks.dev',
+  },
+  body: JSON.stringify({ vins }),
+});
+
+const { results, count, cached_count } = await res.json();
+console.log(`Decoded ${count} VINs, ${cached_count} from cache`);
+
+results.forEach(r => {
+  if (r.error) {
+    console.log(`${r.vin}: ERROR — ${r.error}`);
+  } else {
+    console.log(`${r.vin}: ${r.make} ${r.model} ${r.model_year}`);
+  }
+});
+```
+
+### Health check
+
+```js
+// No auth required on /health
+const health = await fetch('https://vin.leeworks.dev/v1/health').then(r => r.json());
+console.log(`Status: ${health.status}, Cache: ${health.cache.total_entries} entries`);
+```
+
+---
+
+## Real-World Use Cases
+
+### Automotive apps and dealership software
+
+Show instant vehicle details when a user types a VIN at checkout or trade-in. Cache the result — the same VIN is often looked up dozens of times across different users.
+
+```js
+async function enrichListing(listingVin) {
+  const vehicle = await decodeVinCached(listingVin);
+  return {
+    title: `${vehicle.model_year} ${vehicle.make} ${vehicle.model} ${vehicle.trim}`,
+    engine: `${vehicle.engine_displacement_l}L ${vehicle.engine_cylinders}-cyl ${vehicle.fuel_type_primary}`,
+    drivetrain: vehicle.drive_type,
+    body: vehicle.body_class,
+  };
+}
+```
+
+### Insurance tech and underwriting
+
+Premium calculators, claims systems, and underwriting platforms need reliable vehicle specs. A VIN decode call returns body class (sedan vs. SUV vs. pickup) and engine details in under 50ms with a cache hit — fast enough for real-time quote generation.
+
+### Fleet management platforms
+
+Decode entire fleets in a single batch call. The `/v1/batch` endpoint processes up to 50 VINs per request, making it practical to seed a database of 10,000 fleet vehicles with 200 API calls rather than 10,000 sequential hits.
+
+### Used car marketplaces
+
+User-generated listings often contain VIN typos or incorrect specs. Validate and auto-fill vehicle details server-side on listing creation:
+
+```js
+app.post('/listings', async (req, res) => {
+  const { vin, ...listing } = req.body;
+
+  // Validate + enrich
+  const vehicle = await vinApi.decode(vin);
+  if (vehicle.error_code !== '0') {
+    return res.status(422).json({ error: 'Invalid or unrecognised VIN' });
+  }
+
+  const enriched = { ...listing, vin, make: vehicle.make, model: vehicle.model, year: vehicle.model_year };
+  await db.listings.create(enriched);
+  res.status(201).json(enriched);
+});
+```
+
+---
+
+## VIN Validation
+
+Before calling any API, validate the VIN client-side to save an unnecessary round-trip:
+
+```js
+function isValidVin(vin) {
+  // 17 chars, alphanumeric excluding I, O, Q
+  if (!/^[A-HJ-NPR-Z0-9]{17}$/.test(vin)) return false;
+
+  // Optional: verify check digit (position 9)
+  const weights = [8,7,6,5,4,3,2,10,0,9,8,7,6,5,4,3,2];
+  const transliteration = { A:1,B:2,C:3,D:4,E:5,F:6,G:7,H:8,
+    J:1,K:2,L:3,M:4,N:5,P:7,R:9,S:2,T:3,U:4,V:5,W:6,X:7,Y:8,Z:9 };
+
+  const vals = vin.toUpperCase().split('').map(c =>
+    /\d/.test(c) ? parseInt(c) : transliteration[c]
+  );
+
+  const sum = vals.reduce((acc, v, i) => acc + v * weights[i], 0);
+  const check = sum % 11;
+  const expected = check === 10 ? 'X' : String(check);
+
+  return vin[8].toUpperCase() === expected;
+}
+
+console.log(isValidVin('1HGCM82633A004352')); // true
+console.log(isValidVin('1HGCM82633A00435X')); // false (bad check digit)
+```
+
+---
+
+## About the Data Source
+
+The NHTSA vPIC database is maintained by the US Department of Transportation under its statutory mandate (49 U.S.C. § 30111). Manufacturers are legally required to register VIN patterns with NHTSA, so coverage is comprehensive for vehicles sold in the US market.
+
+Key facts:
+- **Coverage**: Model years 1981–present; 1980 and earlier VINs were not standardised and are not covered
+- **Accuracy**: Authoritative for the original vehicle specification; does not reflect modifications, title brands, or recall status
+- **Update frequency**: NHTSA updates the database when new model variants are registered, typically months before vehicles reach dealerships
+- **Licence**: US federal government work, public domain under 17 U.S.C. 105 — free to use commercially with no attribution requirement
+
+---
+
+## Get Started
+
+The leeworks.dev VIN Decoder API is available on RapidAPI with a free tier (100 requests/month, no credit card required):
+
+👉 **[VIN Decoder API on RapidAPI](https://rapidapi.com/leeworks/api/vin-decoder)**
+
+Full API reference, including request/response schemas and error codes:
+
+👉 **[API Documentation](/vin-decoder)**
+
+---
+
+*Built with ❤️ by [leeworks.dev](https://docs.leeworks.dev) — production-ready data APIs powered by free public-domain data sources.*
+
+</article>
+</Base>
@@ -20,7 +20,7 @@ import Base from '../layouts/Base.astro';

  <div class="hero">
    <h1>Simple. Reliable. APIs.</h1>
-    <p>Production-ready data APIs for ZIP enrichment, public holidays, and air quality. Available on RapidAPI.</p>
+    <p>Production-ready data APIs for ZIP enrichment, public holidays, air quality, and VIN decoding. Available on RapidAPI.</p>
    <a href="https://rapidapi.com/leeworks" class="cta" target="_blank" rel="noopener">Get API Key on RapidAPI</a>
  </div>

@@ -52,6 +52,15 @@ import Base from '../layouts/Base.astro';
        <a href="https://rapidapi.com/leeworks/api/air-quality" target="_blank" rel="noopener">RapidAPI</a>
      </div>
    </div>
+    <div class="api-card">
+      <span class="badge wip">In Development</span>
+      <h2>VIN Decoder API</h2>
+      <p>Decode any 17-character VIN into make, model, year, trim, engine, body class, and more. Powered by the NHTSA vPIC public-domain database.</p>
+      <div class="links">
+        <a href="/vin-decoder">Docs</a>
+        <a href="https://rapidapi.com/leeworks/api/vin-decoder" target="_blank" rel="noopener">RapidAPI</a>
+      </div>
+    </div>
  </div>

  <footer style="text-align: center; padding: 2rem; border-top: 1px solid #2d3748; margin-top: 3rem; color: #718096; font-size: 0.875rem;">
@@ -1,7 +1,7 @@
 ---
 import Base from '../layouts/Base.astro';
 ---
-<Base title="API Pricing" description="API Pricing — leeworks.dev — compare plans for ZIP Enrichment, Holidays, and Air Quality APIs">
+<Base title="API Pricing" description="API Pricing — leeworks.dev — compare plans for ZIP Enrichment, Holidays, Air Quality, and VIN Decoder APIs">
  <style>
    .pricing-hero { padding: 4rem 2rem 2rem; text-align: center; }
    .pricing-hero h1 { font-size: 2.5rem; font-weight: 800; background: linear-gradient(135deg, #90cdf4, #667eea); -webkit-background-clip: text; -webkit-text-fill-color: transparent; margin-bottom: 1rem; }
@@ -26,7 +26,7 @@ import Base from '../layouts/Base.astro';

  <div class="pricing-hero">
    <h1>API Pricing</h1>
-    <p>Simple, transparent pricing for all three APIs. Start free — upgrade when you need more.</p>
+    <p>Simple, transparent pricing for all four APIs. Start free — upgrade when you need more.</p>
  </div>

  <div class="pricing-wrap">
@@ -39,6 +39,7 @@ import Base from '../layouts/Base.astro';
          <th scope="col">ZIP Enrichment</th>
          <th scope="col">Holidays</th>
          <th scope="col">Air Quality</th>
+          <th scope="col">VIN Decoder</th>
        </tr>
      </thead>
      <tbody>
@@ -48,6 +49,7 @@ import Base from '../layouts/Base.astro';
          <td>100 req/mo &middot; 5 req/min</td>
          <td>100 req/mo &middot; 5 req/min</td>
          <td>100 req/mo &middot; 5 req/min</td>
+          <td>100 req/mo &middot; 5 req/min</td>
        </tr>
        <tr>
          <td class="tier-name">Basic</td>
@@ -55,6 +57,7 @@ import Base from '../layouts/Base.astro';
          <td>5,000 req/mo &middot; 60 req/min</td>
          <td>5,000 req/mo &middot; 60 req/min</td>
          <td>5,000 req/mo &middot; 60 req/min</td>
+          <td>5,000 req/mo &middot; 60 req/min</td>
        </tr>
        <tr>
          <td class="tier-name">Pro</td>
@@ -62,6 +65,7 @@ import Base from '../layouts/Base.astro';
          <td>25,000 req/mo &middot; 200 req/min</td>
          <td>20,000 req/mo &middot; 200 req/min</td>
          <td>20,000 req/mo &middot; 200 req/min</td>
+          <td>20,000 req/mo &middot; 200 req/min</td>
        </tr>
        <tr>
          <td class="tier-name">Ultra</td>
@@ -69,6 +73,7 @@ import Base from '../layouts/Base.astro';
          <td>100,000 req/mo &middot; 500 req/min</td>
          <td>100,000 req/mo &middot; 500 req/min</td>
          <td>100,000 req/mo &middot; 500 req/min</td>
+          <td>100,000 req/mo &middot; 500 req/min</td>
        </tr>
      </tbody>
    </table>
@@ -77,6 +82,7 @@ import Base from '../layouts/Base.astro';
      <a href="#" class="cta-btn">ZIP Enrichment on RapidAPI</a>
      <a href="#" class="cta-btn">Holidays on RapidAPI</a>
      <a href="#" class="cta-btn">Air Quality on RapidAPI</a>
+      <a href="/vin-decoder" class="cta-btn">VIN Decoder Docs</a>
    </div>

    <p class="disclaimer">Subscriptions managed via RapidAPI marketplace. Prices shown in USD. Rate limits apply per API key.</p>
@@ -0,0 +1,27 @@
+---
+import Base from '../layouts/Base.astro';
+
+const apiName = 'vin-decoder';
+const title = 'VIN Decoder API';
+const description = 'Decode any 17-character VIN into make, model, year, trim, engine, body class, and more. Powered by the NHTSA vPIC public-domain database.';
+---
+<Base title={title} description={description}>
+  <style>
+    #redoc-container { background: #fff; }
+  </style>
+  <div id="redoc-container"></div>
+  <script is:inline define:vars={{ specUrl: `/specs/${apiName}.yaml` }}>
+    // Load Redoc from CDN
+    var script = document.createElement('script');
+    script.src = 'https://cdn.jsdelivr.net/npm/redoc@latest/bundles/redoc.standalone.js';
+    script.onload = function () {
+      Redoc.init(specUrl, {
+        theme: {
+          colors: { primary: { main: '#667eea' } },
+          typography: { fontFamily: 'system-ui, sans-serif' },
+        },
+      }, document.getElementById('redoc-container'));
+    };
+    document.head.appendChild(script);
+  </script>
+</Base>
@@ -0,0 +1,120 @@
+# Deploying the APIs (Flux GitOps → Talos)
+
+> Handoff doc. The APIs are **not** deployed by Gitea Actions — they are deployed
+> by **Flux** running on the Talos Kubernetes cluster. The Gitea Actions in this
+> repo only build the docs-site image, validate Flux manifests, and publish
+> OpenAPI specs to RapidAPI.
+
+## How a deploy actually happens
+
+```
+API repo (e.g. leeworks-agents/zip-enrichment)
+  └─ its own CI builds & pushes  registry.leeworks.dev/zip-enrichment/server:<tag>
+       └─ Flux image-automation (flux/image-automation/) rewrites the
+          {"$imagepolicy": "flux-system:<api>"} marker in flux/<api>/helmrelease.yaml
+            └─ Flux GitRepository "api-company" (polls main every 5m)
+                 └─ HelmRelease per API (flux/<api>/helmrelease.yaml, bedag/raw chart)
+                      └─ Deployment rolls out in the cluster namespace
+```
+
+Each API has its own directory under `flux/`:
+
+| API | Namespace | HelmRelease path | Image |
+|---|---|---|---|
+| zip-enrichment | `zip-enrichment` | `flux/zip-enrichment/helmrelease.yaml` | `registry.leeworks.dev/zip-enrichment/server` |
+| holidays | `holidays` | `flux/holidays/helmrelease.yaml` | `registry.leeworks.dev/holidays/server` |
+| air-quality | `air-quality` | `flux/air-quality/helmrelease.yaml` | `registry.leeworks.dev/air-quality/server` |
+| vin-decoder | `vin-decoder` | `flux/vin-decoder/helmrelease.yaml` | `registry.leeworks.dev/vin-decoder/server` |
+
+(Confirm each path's exact image with `grep -r imagepolicy flux/`.)
+
+## Prerequisite: the manifests must be live in the cluster's Flux source
+
+`flux/api-company-source/gitrepository.yaml` is **reference only**. The
+*authoritative* copy must be committed to **`0xWheatyz/Talos`** at:
+
+```
+testing1/first-cluster/cluster/flux/api-company/
+```
+
+If that path does not point Flux at this repo's `flux/` directory, Flux never
+sees these HelmReleases and nothing deploys. Verify the Talos repo references
+this repo's `main` branch and that a Flux `Kustomization` includes the
+`api-company` path.
+
+Per-API the cluster also needs (already templated under `flux/<api>/`):
+- `namespace.yaml` — the target namespace
+- the `gitea-registry` imagePullSecret in that namespace
+- `externalsecret.yaml` — pulls API keys (e.g. RapidAPI) via external-secrets
+- `servicemonitor.yaml` — Prometheus scraping (optional for deploy)
+
+## One-time local setup (machine with cluster access)
+
+You need tools that are **not** installed on the dev machine yet:
+
+```bash
+# Talos kubeconfig — export from the Talos controlplane, e.g.:
+#   talosctl kubeconfig ~/.kube/talos-leeworks
+export KUBECONFIG=~/.kube/talos-leeworks
+kubectl cluster-info        # must succeed before continuing
+
+# Flux CLI
+brew install fluxcd/tap/flux
+# Helm (optional, for debugging charts)
+brew install helm
+
+flux check                  # confirm Flux is installed & healthy in-cluster
+```
+
+## Deploy / sync all APIs
+
+```bash
+export KUBECONFIG=~/.kube/talos-leeworks
+
+# 1. Pull the latest main into the cluster's Git source
+flux reconcile source git api-company -n flux-system
+
+# 2. Apply the manifests (name may differ — check: flux get kustomizations -A)
+flux reconcile kustomization api-company -n flux-system
+
+# 3. Reconcile each API's HelmRelease
+flux reconcile helmrelease zip-enrichment -n zip-enrichment
+flux reconcile helmrelease holidays       -n holidays
+flux reconcile helmrelease air-quality    -n air-quality
+flux reconcile helmrelease vin-decoder    -n vin-decoder
+
+# 4. Verify everything is Ready
+flux get helmreleases -A
+kubectl get pods -A | grep -E 'zip-enrichment|holidays|air-quality|vin-decoder'
+```
+
+## Troubleshooting
+
+```bash
+# Why is a release not Ready?
+flux get helmrelease <name> -n <ns>
+kubectl describe helmrelease <name> -n <ns>
+
+# Is image automation picking up new tags?
+flux get image policy -n flux-system
+flux get image update -A
+
+# Pod won't start (image pull / secret issues)
+kubectl describe pod <pod> -n <ns>
+kubectl get events -n <ns> --sort-by=.lastTimestamp | tail -20
+```
+
+## Force a fresh deploy of a single API
+
+```bash
+flux suspend helmrelease <name> -n <ns>
+flux resume  helmrelease <name> -n <ns>   # triggers a fresh reconcile
+# or restart the workload directly:
+kubectl rollout restart deployment/<name> -n <ns>
+```
+
+## Related docs in this repo
+- `docs/operator-runbook.md` — day-2 operations
+- `docs/registry.md` — container registry (`registry.leeworks.dev`) setup
+- `docs/secrets-checklist.md` — required cluster secrets
+- `flux/image-automation/` — automatic image tag bumping
@@ -1,6 +1,6 @@
 # DNS Configuration

-**Last updated:** 2026-05-24  
+**Last updated:** 2026-05-30  
 **Status:** Planned (Phase 6 pre-launch)

 ---
@@ -28,6 +28,7 @@ kubectl get svc -n ingress-nginx ingress-nginx-controller -o jsonpath='{.status.
 | `status.leeworks.dev` | A | `<cluster-ingress-ip>` | Gatus status page | Yes (cert-manager) |
 | `registry.leeworks.dev` | A | `<cluster-ingress-ip>` | Container registry (Gitea) | Yes (cert-manager) |
 | `grafana.leeworks.dev` | A | `<cluster-ingress-ip>` | Grafana (internal/restricted) | Yes (cert-manager) |
+| `vin.leeworks.dev` | A | `<cluster-ingress-ip>` | VIN Decoder API | Yes (cert-manager) |

 ---

@@ -103,6 +104,7 @@ dig docs.leeworks.dev +short
 dig status.leeworks.dev +short
 dig registry.leeworks.dev +short
 dig grafana.leeworks.dev +short
+dig vin.leeworks.dev +short

 # Check TLS certificates (once services are deployed)
 curl -v https://zip.leeworks.dev/health 2>&1 | grep -E "SSL|certificate|issuer"
@@ -126,7 +128,7 @@ The following actions require human operator access to the DNS provider:

 1. Log into the DNS provider managing `leeworks.dev`
 2. Find the cluster ingress IP: `kubectl get svc -n ingress-nginx ingress-nginx-controller`
-3. Create/update the 7 A records listed in the table above
+3. Create/update the 8 A records listed in the table above
 4. Verify propagation: `dig +trace zip.leeworks.dev`

 DNS propagation typically takes 5–60 minutes.
@@ -143,4 +145,5 @@ DNS propagation typically takes 5–60 minutes.
 - [ ] `status.leeworks.dev` → DNS record created
 - [ ] `registry.leeworks.dev` → DNS record created
 - [ ] `grafana.leeworks.dev` → DNS record created
- [ ] TLS certificates issued and valid for all 7 subdomains
+- [ ] `vin.leeworks.dev` → DNS record created
+- [ ] TLS certificates issued and valid for all 8 subdomains
@@ -0,0 +1,359 @@
+# Launch Announcement Copy
+
+Ready-to-copy marketing text for leeworks.dev API launch day.
+
+**Status key:**
+- **DRAFT** — copy is written and ready; needs final RapidAPI URLs inserted once issue #44 is complete
+- **READY** — all placeholders filled; copy-paste ready to publish
+
+All sections are currently **DRAFT** pending RapidAPI listing URLs from issue #44.
+
+---
+
+## Placeholder Reference
+
+When issue #44 is complete, replace these placeholders throughout this document:
+
+| Placeholder | Replace with |
+|---|---|
+| `[RAPIDAPI_ZIP_URL]` | RapidAPI listing URL for ZIP Code Enrichment API |
+| `[RAPIDAPI_HOLIDAYS_URL]` | RapidAPI listing URL for Holidays API |
+| `[RAPIDAPI_AQI_URL]` | RapidAPI listing URL for Air Quality Index API |
+| `[RAPIDAPI_PROFILE_URL]` | Your RapidAPI provider profile URL |
+
+---
+
+## 1. Hacker News — Show HN Post [DRAFT]
+
+**Title:**
+```
+Show HN: I built 3 free-data APIs on Kubernetes — ZIP enrichment, public holidays, air quality
+```
+
+**Body (paste into the "text" field):**
+```
+Three small APIs I've been building over the past few months, deployed via Flux GitOps on a self-hosted Kubernetes cluster.
+
+**What they do:**
+
+1. ZIP Code Enrichment API — turn any US ZIP code into city, state, county, timezone, area codes, and coordinates. Backed by USPS/Census public data, refreshed monthly. [RAPIDAPI_ZIP_URL]
+
+2. Public Holidays API — query official public holidays for any country and year. 90+ countries, ISO 3166 codes. Backed by Nager.Date / public government calendars. [RAPIDAPI_HOLIDAYS_URL]
+
+3. Air Quality Index API — current and historical AQI by city or coordinates. PM2.5, PM10, O3, NO2, SO2, CO. Backed by OpenAQ public dataset. [RAPIDAPI_AQI_URL]
+
+**Tech stack:** Fastify (Node.js), SQLite (data cache), Flux GitOps on Talos Linux, cert-manager + ingress-nginx, Prometheus + Grafana for metrics, Gatus for status page.
+
+**Business model:** Free tier (100 req/mo) + paid tiers ($9/$19/$49/mo) on RapidAPI. All three APIs use only public-domain data sources with no redistribution restrictions, so operating costs are cluster hosting only.
+
+**Why I built this:** I wanted to learn GitOps/Kubernetes end-to-end, build something that generates real revenue, and ship entirely on open data. The stack is overkill for 3 simple APIs — but that's the point.
+
+Code is private (it's a product), but happy to answer questions about the architecture.
+```
+
+---
+
+## 2. Reddit Posts [DRAFT]
+
+### r/webdev
+
+**Title:**
+```
+I built a ZIP code enrichment API on public Census data — city, state, county, timezone from a single lookup
+```
+
+**Body:**
+```
+Been working on a simple utility API for the past few months. ZIP Code Enrichment takes any US ZIP code and returns:
+
+- City name + state (abbreviation and full name)
+- County + FIPS code
+- Timezone (IANA name + UTC offset)
+- Area codes
+- Latitude/longitude centroid
+- ZIP type (standard, PO Box, military, unique)
+
+**The data source** is a monthly-refreshed dataset from USPS/Census Bureau — entirely public domain, no scraping.
+
+**Code example:**
+
+```javascript
+const response = await fetch('https://zip.leeworks.dev/v1/lookup?zip=10001', {
+  headers: { 'X-RapidAPI-Proxy-Secret': process.env.RAPIDAPI_KEY }
+});
+const data = await response.json();
+// { zip: "10001", city: "New York", state: "NY", county: "New York County",
+//   timezone: "America/New_York", lat: 40.7484, lon: -73.9967, ... }
+```
+
+Free tier is 100 requests/month. Paid plans start at $9/mo for 10,000 req/mo.
+
+RapidAPI listing: [RAPIDAPI_ZIP_URL]
+
+Happy to answer any questions about the stack (Fastify + SQLite + Kubernetes/Flux).
+```
+
+---
+
+### r/SideProject
+
+**Title:**
+```
+Launched 3 data APIs on RapidAPI — ZIP enrichment, public holidays, air quality. $0 → targeting $100/mo MRR
+```
+
+**Body:**
+```
+Finally shipped the thing I've been building on weekends for the past few months.
+
+**What I built:**
+Three utility APIs on RapidAPI, all backed by free public-domain data:
+
+1. **ZIP Code Enrichment** — city/state/county/timezone from a ZIP code ([RAPIDAPI_ZIP_URL])
+2. **Public Holidays** — official holidays for 90+ countries ([RAPIDAPI_HOLIDAYS_URL])
+3. **Air Quality Index** — current + historical AQI by city or coordinates ([RAPIDAPI_AQI_URL])
+
+**Stack:** Fastify + SQLite + Kubernetes (Talos Linux) + Flux GitOps + Prometheus/Grafana
+
+**Business model:**
+- Free tier: 100 req/month (marketing + trial)
+- Basic: $9/mo — 10,000 req/mo
+- Pro: $19/mo — 50,000 req/mo
+- Ultra: $49/mo — 250,000 req/mo
+
+**Data cost: $0.** All three APIs use US government / OpenAQ public datasets with no licensing fees.
+
+**Revenue so far:** $0 (launched today). Target: $100/mo net within 90 days, which is roughly 12 Basic subscribers across all three APIs.
+
+The whole build — from first commit to Kubernetes deployment — is documented in a private research log. Happy to share architecture details.
+
+What would you do differently for the pricing?
+```
+
+---
+
+### r/learnprogramming
+
+**Title:**
+```
+I used free US government data to build a ZIP code API — here's how the data pipeline works
+```
+
+**Body:**
+```
+A walkthrough of the data layer behind the ZIP Code Enrichment API I just launched.
+
+**The problem:** ZIP codes change. Cities merge. New ZIPs are added. Any ZIP lookup service needs to stay fresh.
+
+**The solution:** A monthly seed script that:
+1. Downloads the latest US ZIP code dataset from USPS/Census Bureau (public domain)
+2. Parses and normalizes ~43,000 records
+3. Inserts into SQLite with upsert logic (new ZIPs added, old ones retired)
+4. Runs automatically via a Kubernetes CronJob on the 1st of each month
+
+**The API itself** is a Fastify (Node.js) server that queries SQLite. Cold query: ~5ms. The whole thing runs in a 128MB container.
+
+**Code snippet** (the seed script core logic):
+
+```javascript
+// Fetch and parse Census ZIP dataset
+const stream = await fetch(CENSUS_ZIP_URL);
+const records = await parseCSV(stream.body);
+
+// Upsert into SQLite
+const stmt = db.prepare(`
+  INSERT INTO zips (zip, city, state, county, lat, lon, timezone, type)
+  VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+  ON CONFLICT(zip) DO UPDATE SET
+    city=excluded.city, state=excluded.state,
+    updated_at=CURRENT_TIMESTAMP
+`);
+
+for (const record of records) {
+  stmt.run([record.zip, record.city, record.state, record.county,
+            record.lat, record.lon, record.timezone, record.type]);
+}
+```
+
+The API is live on RapidAPI with a free tier: [RAPIDAPI_ZIP_URL]
+
+Happy to answer questions about SQLite performance, the seed pipeline, or the Kubernetes/Flux deployment.
+```
+
+---
+
+## 3. Indie Hackers Milestone Post [DRAFT]
+
+**Title:**
+```
+Launched 3 data APIs on RapidAPI: $0 MRR, targeting $100/mo in 90 days
+```
+
+**Body:**
+```
+### What I built
+
+Three utility APIs backed entirely by free public-domain data:
+
+- **ZIP Code Enrichment** — city/state/county/timezone/coordinates from any US ZIP ([RAPIDAPI_ZIP_URL])
+- **Public Holidays** — official holidays for 90+ countries + year ([RAPIDAPI_HOLIDAYS_URL])
+- **Air Quality Index** — current + historical AQI by city or coordinates ([RAPIDAPI_AQI_URL])
+
+### Revenue: $0 → targeting $100/mo
+
+The $100/mo target is ~12 Basic subscribers ($9/mo) across all three APIs after RapidAPI's 25% cut. Stretch: 4 Pro subscribers ($19/mo each).
+
+### Stack
+
+- **API servers:** Fastify (Node.js) + SQLite for data cache
+- **Infrastructure:** Talos Linux Kubernetes cluster (self-hosted, single-node)
+- **GitOps:** Flux CD — everything is declared in YAML, zero manual kubectl
+- **Observability:** Prometheus + Grafana, Gatus status page at status.leeworks.dev
+- **Data sources:** USPS/Census (ZIP), Nager.Date (Holidays), OpenAQ (AQI) — all public domain, $0 licensing cost
+
+### What I learned
+
+1. **GitOps is excellent for solo projects.** Flux means my cluster is always in sync with git. I've done zero manual deploys.
+2. **SQLite is underrated for read-heavy APIs.** Sub-5ms query times for cached lookups, zero infrastructure overhead vs PostgreSQL.
+3. **Public-domain data has a moat.** Anyone can build this, but most people don't bother. The data is stable, legal, and free forever.
+4. **Kubernetes is overkill — and that's fine.** I did it to learn. I now know Talos, Flux, cert-manager, ingress-nginx, Prometheus, Grafana from first principles.
+
+### What's next
+
+- Monitor first 30 days for subscriber growth
+- Build VIN Decoder as API #4 (NHTSA vPIC data, also public domain)
+- Add batch endpoints to ZIP and Holidays
+
+Would love feedback on pricing — is $9/mo entry too high or too low for a utility API with a free tier?
+```
+
+---
+
+## 4. Product Hunt Listing [DRAFT]
+
+### Tagline (60 chars max)
+```
+3 utility APIs on public data — ZIP, Holidays, Air Quality
+```
+*(58 characters ✓)*
+
+### Description (260 chars max)
+```
+Look up ZIP codes, public holidays for 90+ countries, and air quality index data — all via clean REST APIs backed by free government datasets. Free tier included. No API keys to generate — available on RapidAPI.
+```
+*(211 characters ✓)*
+
+### First Comment (Maker Note)
+```
+Hey Product Hunt! 👋
+
+I'm the developer behind leeworks.dev — three utility APIs I've been building over the past few months:
+
+**ZIP Code Enrichment** [RAPIDAPI_ZIP_URL]
+Turn any US ZIP code into city, state, county, timezone, area codes, and GPS coordinates. 43,000+ ZIP codes, refreshed monthly from USPS/Census Bureau public data.
+
+**Public Holidays API** [RAPIDAPI_HOLIDAYS_URL]
+Query official public holidays for any country and year. 90+ countries, ISO 3166 codes, backed by government calendar data. Great for payroll software, scheduling tools, and calendar apps.
+
+**Air Quality Index API** [RAPIDAPI_AQI_URL]
+Current and historical AQI readings by city or coordinates. PM2.5, PM10, O3, NO2, SO2, CO — backed by the OpenAQ public dataset covering thousands of monitoring stations worldwide.
+
+**What makes these different:**
+- All data is 100% public domain — no licensing fees, no terms restrictions
+- Free tier (100 req/mo) to try before you buy
+- Paid plans start at $9/mo for 10,000 requests/month
+- Running on Kubernetes with Prometheus monitoring and a public status page at status.leeworks.dev
+
+Happy to answer questions about the data sources, the tech stack (Fastify + SQLite + Flux GitOps), or the pricing model. Thanks for checking it out!
+```
+
+### Gallery / Screenshot URL Placeholders
+```
+1. docs-site homepage: https://docs.leeworks.dev (screenshot)
+2. Grafana dashboard: https://grafana.leeworks.dev (screenshot)
+3. status.leeworks.dev (screenshot)
+4. Example API response (ZIP lookup): code screenshot
+5. RapidAPI listing page: [RAPIDAPI_PROFILE_URL] (screenshot)
+```
+
+---
+
+## 5. Email Waitlist Message [DRAFT]
+
+**Subject line:**
+```
+leeworks.dev APIs are live — here's your free tier access
+```
+
+**Body:**
+```
+Hi there,
+
+The three APIs I've been building are now live on RapidAPI. Here's what's available and how to get started:
+
+---
+
+**ZIP Code Enrichment API**
+Turn any US ZIP code into city, state, county, timezone, area codes, and GPS coordinates — in a single API call.
+→ [RAPIDAPI_ZIP_URL]
+
+**Public Holidays API**
+Query official public holidays for any country and year. 90+ countries, ISO 3166 codes.
+→ [RAPIDAPI_HOLIDAYS_URL]
+
+**Air Quality Index API**
+Current and historical AQI by city or coordinates. PM2.5, PM10, O3, NO2, SO2, CO.
+→ [RAPIDAPI_AQI_URL]
+
+---
+
+**How to try for free:**
+1. Click any link above
+2. Subscribe to the **Free tier** (100 requests/month, no credit card needed)
+3. Copy your RapidAPI key from the dashboard
+4. Make your first request — full docs at https://docs.leeworks.dev
+
+---
+
+**Quick start (ZIP enrichment):**
+
+```bash
+curl "https://zip.leeworks.dev/v1/lookup?zip=90210" \
+  -H "X-RapidAPI-Key: YOUR_KEY" \
+  -H "X-RapidAPI-Host: zip-enrichment.p.rapidapi.com"
+```
+
+---
+
+**Want more than 100 requests/month?**
+Paid plans start at $9/mo for 10,000 requests. See the full pricing table on each API's RapidAPI listing page.
+
+Questions? Reply to this email or open an issue at https://docs.leeworks.dev/support.
+
+Thanks for your interest,
+Wyatt
+leeworks.dev
+
+---
+
+*You're receiving this because you signed up for early access. To unsubscribe, reply with "unsubscribe".*
+```
+
+---
+
+## Checklist Before Publishing
+
+Before changing any section from DRAFT to READY:
+
+- [ ] Issue #44 complete — RapidAPI listing URLs obtained
+- [ ] Replace all `[RAPIDAPI_ZIP_URL]` placeholders
+- [ ] Replace all `[RAPIDAPI_HOLIDAYS_URL]` placeholders
+- [ ] Replace all `[RAPIDAPI_AQI_URL]` placeholders
+- [ ] Replace all `[RAPIDAPI_PROFILE_URL]` placeholders
+- [ ] Verify code examples work against live endpoints
+- [ ] Confirm free tier limit is accurate (currently documented as 100 req/mo)
+- [ ] Confirm all three APIs pass pre-launch-checklist.md
+- [ ] Product Hunt gallery screenshots captured
+- [ ] Email list exported from whatever signup form was used
+
+Once all items above are checked, update the Status key at the top of this document from DRAFT to READY for each section.
@@ -286,7 +286,11 @@ annotations:

 ## Grafana Dashboard

-A reference dashboard JSON is available at `docs/grafana-api-dashboard.json` (TBD — will be committed once Grafana is deployed per issue #7).
+Grafana dashboards are committed as Flux ConfigMaps and are auto-loaded by Grafana via the `grafana_dashboard: "1"` label:
+- `flux/monitoring/grafana-dashboard-apis.yaml` — consolidated 4-API dashboard (all APIs)
+- `flux/monitoring/vin-decoder-dashboard.yaml` — VIN Decoder-specific dashboard
+
+Dashboards will load automatically once Grafana is deployed (issue #7) and Flux is active (issue #218).

 Key panels to include:
 1. Request rate by API and status (`rate(api_requests_total[5m])`)
@@ -2,7 +2,7 @@

 **Audience:** Human operator (0xWheatyz)  
 **Purpose:** Ordered, copy-paste-ready guide to bring the full `api-company` stack live.  
-**Last updated:** 2026-05-26  
+**Last updated:** 2026-06-01  
 **Closes:** leeworks-agents/api-company#50

 ---
@@ -165,6 +165,7 @@ Repos to configure:
 - `leeworks-agents/zip-enrichment`
 - `leeworks-agents/holidays`
 - `leeworks-agents/air-quality`
+- `leeworks-agents/vin-decoder` (see also Phase 4-A Step 4)

 **For each repo:** Repo → Settings → Actions → Secrets → Add Secret
 - **Name:** `GITEA_TOKEN`
@@ -186,9 +187,9 @@ kubectl create secret generic gitea-image-automation-token \

 ---

-## Phase 4 — DNS for API services (issue #33)
+## Phase 4 — DNS for API services (issues #33, #106, #150)

-Add DNS A records for all seven leeworks.dev subdomains (all point to the same
+Add DNS A records for **all eight** leeworks.dev subdomains (all point to the same
 cluster ingress IP):

 | Hostname                | Target                 |
@@ -196,6 +197,7 @@ cluster ingress IP):
 | `zip.leeworks.dev`      | `<cluster ingress IP>` |
 | `holidays.leeworks.dev` | `<cluster ingress IP>` |
 | `aqi.leeworks.dev`      | `<cluster ingress IP>` |
+| `vin.leeworks.dev`      | `<cluster ingress IP>` |
 | `docs.leeworks.dev`     | `<cluster ingress IP>` |
 | `grafana.leeworks.dev`  | `<cluster ingress IP>` |
 | `status.leeworks.dev`   | `<cluster ingress IP>` |
@@ -204,7 +206,7 @@ cluster ingress IP):
 Verify DNS propagation:

 ```bash
-for host in zip holidays aqi docs grafana status registry; do
+for host in zip holidays aqi vin docs grafana status registry; do
  echo -n "${host}.leeworks.dev: "
  dig ${host}.leeworks.dev +short
 done
@@ -215,6 +217,76 @@ propagates (typically minutes, up to 48 h).

 ---

+---
+
+## Phase 4-A — VIN Decoder namespace setup (issues #126, #127, #128, #139)
+
+Before VIN Decoder pods can start, the following manual steps are required.
+Do these alongside Phase 3 (they are independent of the DNS batch):
+
+### Step 4A-1 — Create `vin-decoder` namespace
+
+```bash
+kubectl create namespace vin-decoder --dry-run=client -o yaml | kubectl apply -f -
+```
+
+### Step 4A-2 — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace (issue #127)
+
+Reuse the same Gitea token with `read:packages` scope from secrets checklist item #8.
+
+```bash
+kubectl create secret docker-registry gitea-registry \
+  --namespace=vin-decoder \
+  --docker-server=registry.leeworks.dev \
+  --docker-username=leeworks-agents \
+  --docker-password=<GITEA_TOKEN_WITH_READ_PACKAGES> \
+  --docker-email=agent@leeworks.dev
+```
+
+Verify:
+```bash
+kubectl get secret gitea-registry -n vin-decoder -o jsonpath='{.type}'
+# Expected: kubernetes.io/dockerconfigjson
+```
+
+### Step 4A-3 — Create `rapidapi-proxy-secret` in `vin-decoder` namespace (issue #128)
+
+**Now (placeholder — unblocks deploy testing):**
+```bash
+kubectl create secret generic rapidapi-proxy-secret \
+  --namespace=vin-decoder \
+  --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING
+```
+
+**After VIN Decoder is listed on RapidAPI (Phase 5), update with real secret:**
+```bash
+kubectl create secret generic rapidapi-proxy-secret \
+  -n vin-decoder \
+  --from-literal=X-RapidAPI-Proxy-Secret=<VIN_RAPIDAPI_PROXY_SECRET> \
+  --save-config --dry-run=client -o yaml | kubectl apply -f -
+```
+
+### Step 4A-4 — Add `GITEA_TOKEN` Actions secret to `leeworks-agents/vin-decoder` repo (issue #126)
+
+Gitea → `leeworks-agents/vin-decoder` → Settings → Secrets and Variables → Actions
+- **Name:** `GITEA_TOKEN`
+- **Value:** Gitea personal access token with `write:packages` scope
+
+Verify it appears in the repo's Actions Secrets list before the next push to `main`.
+
+### Step 4A-5 — Add RapidAPI VIN secrets to `leeworks-agents/api-company` Actions (issue #139)
+
+> **Blocked** — requires VIN Decoder to be listed on RapidAPI first (issue #131 tracker; operator action required).
+
+Once the VIN Decoder listing is live:
+
+Gitea → `leeworks-agents/api-company` → Settings → Secrets and Variables → Actions
+
+| Secret name               | Where to find it |
+|---------------------------|------------------|
+| `RAPIDAPI_VIN_API_ID`     | RapidAPI dashboard → VIN Decoder listing → Overview |
+| `RAPIDAPI_VIN_VERSION_ID` | RapidAPI dashboard → VIN Decoder listing → Versions tab |
+
 ## Phase 5 — RapidAPI + PayPal (issue #44, #19)

 > **Blocked on operator being 18+ for PayPal.** Complete when eligible.
@@ -241,8 +313,25 @@ kubectl create secret generic rapidapi-proxy-secret \
 kubectl create secret generic rapidapi-proxy-secret \
  -n air-quality \
  --from-literal=X-RapidAPI-Proxy-Secret=<VALUE>
+
+# vin-decoder (updates the placeholder secret from Phase 4-A Step 3)
+kubectl create secret generic rapidapi-proxy-secret \
+  -n vin-decoder \
+  --from-literal=X-RapidAPI-Proxy-Secret=<VIN_VALUE> \
+  --save-config --dry-run=client -o yaml | kubectl apply -f -
 ```

+Also configure VIN Decoder pricing tiers on RapidAPI (issue #151):
+
+| Tier  | Monthly Price | Request Limit  | Rate Limit  |
+|-------|---------------|----------------|-------------|
+| Free  | $0            | 100 req/mo     | 5 req/min   |
+| Basic | $9            | 5,000 req/mo   | 60 req/min  |
+| Pro   | $19           | 20,000 req/mo  | 200 req/min |
+| Ultra | $49           | 100,000 req/mo | 500 req/min |
+
+Confirm VIN Decoder revenue flows through the same PayPal account as the other 3 APIs.
+
 ---

 ## Quick Verification Checklist
@@ -287,12 +376,22 @@ Phase 2: Service secrets (runner-token, grafana-admin, gatus-webhook, registry)

 Phase 3: CI secrets + image-automation token
    └─► images build, push, and auto-update → API services deploy
+    (includes leeworks-agents/vin-decoder GITEA_TOKEN — Step 3-A)

-Phase 4: DNS records
+Phase 4: DNS records (8 subdomains including vin.leeworks.dev)
    └─► HTTPS certs issued → public URLs go live

-Phase 5: RapidAPI + PayPal
-    └─► revenue enabled
+Phase 4-A: VIN Decoder namespace setup (#126, #127, #128)
+    4A-1: vin-decoder namespace created
+    4A-2: gitea-registry imagePullSecret in vin-decoder (#127)
+    4A-3: rapidapi-proxy-secret placeholder in vin-decoder (#128)
+    4A-4: GITEA_TOKEN Actions secret in vin-decoder repo (#126)
+    4A-5: RAPIDAPI_VIN_API_ID + RAPIDAPI_VIN_VERSION_ID Actions secrets (#139)
+          [blocked on VIN Decoder RapidAPI listing]
+    └─► VIN Decoder pods start; CI can push images
+
+Phase 5: RapidAPI + PayPal (all 4 APIs including VIN Decoder; issue #151)
+    └─► revenue enabled for all 4 APIs
 ```

 ---
@@ -11,6 +11,7 @@ Use this checklist as the final go-live gate — run through every item the day
  - [ ] `zip-enrichment` pod `READY=1/1` (`kubectl get pods -n zip-enrichment`)
  - [ ] `holidays` pod `READY=1/1` (`kubectl get pods -n holidays`)
  - [ ] `air-quality` pod `READY=1/1` (`kubectl get pods -n air-quality`)
+  - [ ] `vin-decoder` pod `READY=1/1` (`kubectl get pods -n vin-decoder`)
 - [ ] `docs-site` pod Running and READY (`kubectl get pods -n docs-site`)
 - [ ] Prometheus scraping all three API services (check Prometheus Targets UI)
 - [ ] Grafana dashboard accessible at `grafana.leeworks.dev`
@@ -25,8 +26,9 @@ Use this checklist as the final go-live gate — run through every item the day
 - [ ] `docs.leeworks.dev` → cluster ingress IP
 - [ ] `status.leeworks.dev` → cluster ingress IP
 - [ ] `registry.leeworks.dev` → cluster ingress IP
+- [ ] `vin.leeworks.dev` → cluster ingress IP (`dig vin.leeworks.dev +short` + `curl -I https://vin.leeworks.dev`)
 - [ ] `grafana.leeworks.dev` → cluster ingress IP
- [ ] TLS certificates issued for all 7 subdomains (`kubectl get certificates -A`)
+- [ ] TLS certificates issued for all 8 subdomains (`kubectl get certificates -A`)

 ---

@@ -38,9 +40,12 @@ Use this checklist as the final go-live gate — run through every item the day
 - [ ] `GET /zip/{zip}` returns correct data for a sample ZIP code (e.g. `curl https://zip.leeworks.dev/zip/10001`)
 - [ ] `GET /holidays/{year}` returns correct data (e.g. `curl https://holidays.leeworks.dev/holidays/2026`)
 - [ ] `GET /aqi/{city}` returns correct data (e.g. `curl https://aqi.leeworks.dev/aqi/New%20York`)
+- [ ] `GET /v1/health` returns HTTP 200 on **vin-decoder** (`curl https://vin.leeworks.dev/v1/health`)
+- [ ] `GET /v1/decode?vin=1HGCM82633A004352` returns correct make/model/year data
+- [ ] Request **without** `X-RapidAPI-Proxy-Secret` returns HTTP 403 on **vin-decoder** (`curl https://vin.leeworks.dev/v1/decode?vin=1HGCM82633A004352`)
 - [ ] Request **without** `X-RapidAPI-Proxy-Secret` returns HTTP 403 on all three APIs
 - [ ] `docs.leeworks.dev/pricing` loads correctly
- [ ] `status.leeworks.dev` shows all three APIs as **UP**
+- [ ] `status.leeworks.dev` shows all **four** APIs as **UP**

 ---

@@ -50,6 +55,8 @@ Use this checklist as the final go-live gate — run through every item the day
 - [ ] `docs/legal/privacy-policy.md` committed and reachable at `docs.leeworks.dev/legal/privacy-policy`
 - [ ] `docs/legal/acceptable-use-policy.md` committed and reachable at `docs.leeworks.dev/legal/acceptable-use-policy`
 - [ ] All three APIs listed on RapidAPI with **Free + 3 paid tiers** (leeworks-agents/api-company#44)
+- [ ] VIN Decoder listed on RapidAPI with Free + 3 paid tiers (leeworks-agents/api-company#131)
+- [ ] `rapidapi-proxy-secret` updated with real RapidAPI value in `vin-decoder` namespace (leeworks-agents/api-company#128)
 - [ ] PayPal linked to RapidAPI (leeworks-agents/api-company#19)
 - [ ] `rapidapi-proxy-secret` updated with **real** RapidAPI values in all 3 namespaces (leeworks-agents/api-company#81)

@@ -70,7 +77,7 @@ Use this checklist as the final go-live gate — run through every item the day
 flux get all

 # Check API pod health
-for ns in zip-enrichment holidays air-quality docs-site; do
+for ns in zip-enrichment holidays air-quality vin-decoder docs-site; do
  echo "=== $ns ==="
  kubectl get pods -n $ns
 done
@@ -78,13 +85,13 @@ done
 # Verify TLS certs
 kubectl get certificates -A

-# Check all 7 DNS subdomains
-for sub in zip holidays aqi docs status registry grafana; do
+# Check all 8 DNS subdomains
+for sub in zip holidays aqi vin docs status registry grafana; do
  echo "$sub.leeworks.dev -> $(dig $sub.leeworks.dev +short)"
 done

 # Smoke test health endpoints
-for svc in "zip.leeworks.dev/health" "holidays.leeworks.dev/health" "aqi.leeworks.dev/health"; do
+for svc in "zip.leeworks.dev/health" "holidays.leeworks.dev/health" "aqi.leeworks.dev/health" "vin.leeworks.dev/v1/health"; do
  echo "$svc: $(curl -s -o /dev/null -w '%{http_code}' https://$svc)"
 done

@@ -193,6 +193,77 @@ air quality, AQI, PM2.5, PM10, air pollution, smog, ozone, nitrogen dioxide, env

 ---

+---
+
+## 4. VIN Decoder API
+
+### API Name
+VIN Decoder API
+
+### Tagline
+Decode any vehicle VIN into make, model, year, engine, and trim — powered by NHTSA vPIC.
+
+### Short Description (≤ 300 chars)
+Decode any 17-character Vehicle Identification Number into structured vehicle data: make, model, year, trim, body style, engine specs, transmission, and assembly plant. Backed by the NHTSA vPIC public database with 90-day result caching.
+
+### Long Description
+
+Unlock the full story behind any Vehicle Identification Number with a single API call.
+
+**What you get per VIN:**
+- Make, model, model year, and trim level
+- Body class (Sedan, SUV, Pickup, etc.) and drive type (FWD, RWD, AWD, 4WD)
+- Engine displacement (CC and litres) and cylinder count
+- Primary fuel type (Gasoline, Diesel, Electric, Hybrid, etc.)
+- Transmission style (Automatic, Manual, CVT) and speed count
+- Assembly plant city, state, and country
+- Full manufacturer name and NHTSA vehicle type classification
+- NHTSA decode error code and text for non-standard VINs
+
+**Data source:** NHTSA Product Information Catalog and Vehicle Listing (vPIC) — US federal government public-domain data, always current. No licensing fees.
+
+**Coverage:** Model years 1981–present. All major domestic and import manufacturers registered with NHTSA.
+
+**Caching:** Decoded VINs are cached for 90 days in a local SQLite store. The `X-Cache: HIT/MISS` response header tells you whether the result came from cache or a live NHTSA lookup.
+
+**Use cases:**
+- Used-car marketplaces — enrich listings with decoded specs at scale
+- Insurance platforms — auto-populate vehicle details from VIN at quote time
+- Fleet management — maintain structured vehicle inventories without manual entry
+- Automotive valuation tools — feed year/make/model/trim into pricing algorithms
+- Recall & warranty systems — match VINs to manufacturer service campaigns
+- Registration & titling apps — validate and enrich VIN data in DMV workflows
+
+**Endpoints:**
+- `GET /v1/decode` — decode a single VIN
+- `POST /v1/batch` — decode up to 50 VINs in one request
+- `GET /v1/health` — service health check (no auth required)
+
+### Category
+Data / Automotive / Transportation
+
+### Plan Table
+
+| Tier | Price/month | Requests/month | Rate limit |
+|------|-------------|----------------|------------|
+| Free | $0 | 100 req/mo | 5 req/min |
+| Basic | $9 | 5,000 req/mo | 60 req/min |
+| Pro | $19 | 20,000 req/mo | 200 req/min |
+| Ultra | $49 | 100,000 req/mo | 500 req/min |
+
+### Endpoint Descriptions
+
+| Endpoint | Description |
+|----------|-------------|
+| `GET /v1/decode?vin={vin}` | Decodes a single 17-character VIN. Returns structured vehicle attributes including make, model, year, engine, body, drivetrain, and plant info. Optional `?raw=true` includes the full NHTSA vPIC response. |
+| `POST /v1/batch` | Accepts a JSON body with a `vins` array (1–50 VINs). Returns one decoded result (or error) per VIN in input order, plus aggregate counts for `cached_count` and `error_count`. |
+| `GET /v1/health` | Returns service status, uptime, cache stats (entries, hit rate, size), and NHTSA upstream reachability. No `X-RapidAPI-Proxy-Secret` required. |
+
+### Keywords
+VIN decoder, vehicle identification number, car lookup, NHTSA, make model year, automotive API, vehicle data, VIN lookup, auto specs, fleet management
+
+---
+
 ## Tagline Length Validation

 Run to confirm all taglines are ≤ 120 characters:
@@ -12,13 +12,16 @@ Follow this list top-to-bottom; each step unblocks the next.
 - [ ] 1. `gitea-leeworks-agents-token` (flux-system) — unblocks Flux GitRepository auth
 - [ ] 2. `gitea-runner-token` (gitea-runner) — unblocks Gitea Actions runner registration
 - [ ] 3. `grafana-admin` (monitoring) — unblocks Grafana login
- [ ] 4. `gatus-slack-webhook` (monitoring) — unblocks Gatus alert notifications
+- [ ] 4. `gatus-slack-webhook` (monitoring) — unblocks Gatus alert notifications AND Alertmanager Slack SLO alerts
 - [ ] 5. `GITEA_TOKEN` in each API repo's Actions Secrets — unblocks CI image push
 - [ ] 6. Gitea packages enabled + DNS record for `registry.leeworks.dev` — unblocks image push to registry
 - [ ] 7. Add api-company Flux source + kustomization to 0xWheatyz/Talos — unblocks all GitOps reconciliation
 - [ ] 8. `gitea-registry` (zip-enrichment, holidays, air-quality, docs-site) — imagePullSecret for pods pulling from `registry.leeworks.dev`
 - [ ] 9. `gitea-image-automation-token` (flux-system) — write-scoped token for Flux ImageUpdateAutomation to push image-tag commits
 - [ ] 10. `rapidapi-proxy-secret` (zip-enrichment, holidays, air-quality) — RapidAPI Proxy Secret for server-side request validation
+- [ ] 11. `GITEA_TOKEN` Actions secret in `leeworks-agents/vin-decoder` repo — enables CI image push for VIN Decoder (leeworks-agents/api-company#126)
+- [ ] 12. `gitea-registry` imagePullSecret in `vin-decoder` namespace — enables pod image pulls from `registry.leeworks.dev` (leeworks-agents/api-company#127)
+- [ ] 13. `rapidapi-proxy-secret` in `vin-decoder` namespace — enables RapidAPI proxy-secret header validation (leeworks-agents/api-company#128)

 ---

@@ -89,9 +92,12 @@ Grafana will be accessible at `https://grafana.leeworks.dev` (login: `admin` / `
 |-----------|-------|
 | Name      | `gatus-slack-webhook` |
 | Namespace | `monitoring` |
-| Purpose   | Gatus posts downtime alerts to a Slack channel via incoming webhook |
+| Purpose   | Gatus posts downtime alerts to a Slack channel via incoming webhook. Also mounted by Alertmanager (`alertmanagerSpec.secrets`) to send SLO / firing-alert Slack notifications. |
 | Source    | Slack → Your workspace → Apps → Incoming Webhooks → Add to Slack → copy webhook URL |
-| Unblocks  | Issue #8 (Gatus status page at `status.leeworks.dev`) |
+| Unblocks  | Issue #8 (Gatus status page at `status.leeworks.dev`); Alertmanager Slack receiver (issue #210) |
+| Consumers | **Two components** share this secret: (1) **Gatus** (`flux/monitoring/gatus-helmrelease.yaml`) — public status-page alerts; (2) **Alertmanager** (`flux/monitoring/helmrelease.yaml` via `alertmanagerSpec.secrets`) — SLO / firing-alert Slack notifications |
+
+> **Note (dual consumer):** Creating this one secret (`gatus-slack-webhook` in the `monitoring` namespace) unblocks **both** Gatus alert delivery AND Alertmanager's Slack receiver. The Alertmanager configuration references this secret at `global.slack_api_url_file: /etc/alertmanager/secrets/gatus-slack-webhook/url` (enabled in PR #212 / issue #210).

 ```bash
 kubectl create secret generic gatus-slack-webhook \
@@ -194,6 +200,68 @@ done
 ```


+### 11. `GITEA_TOKEN` Actions secret in `leeworks-agents/vin-decoder`
+
+| Field    | Value |
+|----------|-------|
+| Name     | `GITEA_TOKEN` |
+| Scope    | Gitea Actions Secret — set in repo Settings |
+| Purpose  | CI workflow pushes container image to `registry.leeworks.dev/vin-decoder/api:<sha>` |
+| Source   | Gitea token with `write:packages` scope (reuse from item #5 if it has `write:packages`) |
+| Tracked  | leeworks-agents/api-company#126 |
+| Unblocks | CI image push for VIN Decoder |
+
+Path: **Gitea → leeworks-agents/vin-decoder → Settings → Secrets → `GITEA_TOKEN`**
+
+---
+
+### 12. `gitea-registry` imagePullSecret in `vin-decoder` namespace
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `gitea-registry` |
+| Namespace | `vin-decoder` |
+| Type      | `kubernetes.io/dockerconfigjson` |
+| Purpose   | Allows VIN Decoder pods to pull images from `registry.leeworks.dev` without ImagePullBackOff |
+| Tracked   | leeworks-agents/api-company#127 |
+
+```bash
+kubectl create namespace vin-decoder --dry-run=client -o yaml | kubectl apply -f -
+kubectl create secret docker-registry gitea-registry \
+  --namespace=vin-decoder \
+  --docker-server=registry.leeworks.dev \
+  --docker-username=leeworks-agents \
+  --docker-password=<GITEA_TOKEN_WITH_READ_PACKAGES> \
+  --docker-email=agent@leeworks.dev
+```
+
+---
+
+### 13. `rapidapi-proxy-secret` in `vin-decoder` namespace
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `rapidapi-proxy-secret` |
+| Namespace | `vin-decoder` |
+| Purpose   | VIN Decoder validates `X-RapidAPI-Proxy-Secret` header; returns HTTP 403 if missing/wrong |
+| Source    | RapidAPI dashboard → VIN Decoder listing → Settings → Security → Proxy Secret |
+| Tracked   | leeworks-agents/api-company#128 |
+
+```bash
+# Placeholder (unblocks deploy testing):
+kubectl create secret generic rapidapi-proxy-secret \
+  --namespace=vin-decoder \
+  --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING
+
+# Update with real value after RapidAPI listing (#131) is live:
+kubectl create secret generic rapidapi-proxy-secret \
+  -n vin-decoder \
+  --from-literal=X-RapidAPI-Proxy-Secret=<VIN_RAPIDAPI_PROXY_SECRET> \
+  --save-config --dry-run=client -o yaml | kubectl apply -f -
+```
+
+---
+
 ## Dependency Order

 ```
@@ -201,7 +269,7 @@ done
 1 (gitea-leeworks-token) → Flux can pull this repo over HTTPS
 2 (gitea-runner-token)   → runner online → CI runs
 3 (grafana-admin)        → Grafana login works
-4 (gatus-slack-webhook)  → Gatus alerting works
+4 (gatus-slack-webhook)  → Gatus alerting works + Alertmanager Slack SLO alerts
 5 + 6 (GITEA_TOKEN + registry packages) → CI pushes images → API services deploy
 8 (gitea-registry)       → pods can pull images from registry.leeworks.dev → services start
 9 (gitea-image-automation-token) → Flux ImageUpdateAutomation pushes tag-update commits
@@ -40,6 +40,18 @@ spec:
 ---
 apiVersion: image.toolkit.fluxcd.io/v1beta2
 kind: ImagePolicy
+metadata:
+  name: vin-decoder
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: vin-decoder
+  policy:
+    semver:
+      range: ">=0.1.0"
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
 metadata:
  name: docs-site
  namespace: flux-system
@@ -35,6 +35,17 @@ spec:
 ---
 apiVersion: image.toolkit.fluxcd.io/v1beta2
 kind: ImageRepository
+metadata:
+  name: vin-decoder
+  namespace: flux-system
+spec:
+  image: registry.leeworks.dev/vin-decoder/api
+  interval: 5m
+  secretRef:
+    name: gitea-leeworks-agents-token
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
 metadata:
  name: docs-site
  namespace: flux-system
@@ -9,4 +9,5 @@ resources:
  - zip-enrichment
  - holidays
  - air-quality
+  - vin-decoder
  - image-automation
@@ -68,6 +68,15 @@ spec:
              description: "Air Quality API is down"
              send-on-resolved: true

+
+        - name: VIN Decoder API
+          url: https://vin.leeworks.dev/v1/health
+          interval: 1m
+          conditions:
+            - "[STATUS] == 200"
+            - "[RESPONSE_TIME] < 1000"
+          alerts:
+            - type: slack
        - name: Docs Site
          url: https://docs.leeworks.dev
          interval: 5m
@@ -9,7 +9,7 @@ data:
  api-dashboard.json: |
    {
      "annotations": { "list": [] },
-      "description": "Request rate, latency, error rate, and data freshness for zip-enrichment, holidays, and air-quality APIs",
+      "description": "Request rate, latency, error rate, and data freshness for zip-enrichment, holidays, air-quality, and vin-decoder APIs",
      "editable": true,
      "graphTooltip": 1,
      "panels": [
@@ -85,7 +85,25 @@ spec:
                action: replace
                target_label: kubernetes_pod_name
    alertmanager:
-      enabled: false  # Enable when alert routing is configured
+      enabled: true
+      config:
+        global:
+          slack_api_url_file: /etc/alertmanager/secrets/gatus-slack-webhook/url
+        route:
+          receiver: slack-api-alerts
+          group_by: [alertname, namespace]
+          group_wait: 30s
+          group_interval: 5m
+          repeat_interval: 4h
+        receivers:
+          - name: slack-api-alerts
+            slack_configs:
+              - channel: '#api-alerts'
+                title: '{{ .CommonAnnotations.summary }}'
+                text: '{{ range .Alerts }}{{ .Annotations.description }}{{ end }}'
+      alertmanagerSpec:
+        secrets:
+          - gatus-slack-webhook
    kubeStateMetrics:
      enabled: true
    nodeExporter:
@@ -8,3 +8,4 @@ resources:
  - gatus-helmrelease.yaml
  - grafana-dashboard-apis.yaml
  - prometheusrule-apis.yaml
+  - vin-decoder-dashboard.yaml
@@ -18,9 +18,9 @@ spec:
        - alert: APIHighErrorRate
          expr: |
            (
-              sum by (job) (rate(api_requests_total{status=~"5..", job=~"zip|holidays|air-quality"}[5m]))
+              sum by (job) (rate(api_requests_total{status=~"5..", job=~"zip|holidays|air-quality|vin-decoder"}[5m]))
              /
-              sum by (job) (rate(api_requests_total{job=~"zip|holidays|air-quality"}[5m]))
+              sum by (job) (rate(api_requests_total{job=~"zip|holidays|air-quality|vin-decoder"}[5m]))
            ) > 0.05
          for: 5m
          labels:
@@ -36,9 +36,9 @@ spec:
        - alert: APIHighErrorRate
          expr: |
            (
-              sum by (job) (rate(api_requests_total{status=~"5..", job=~"zip|holidays|air-quality"}[5m]))
+              sum by (job) (rate(api_requests_total{status=~"5..", job=~"zip|holidays|air-quality|vin-decoder"}[5m]))
              /
-              sum by (job) (rate(api_requests_total{job=~"zip|holidays|air-quality"}[5m]))
+              sum by (job) (rate(api_requests_total{job=~"zip|holidays|air-quality|vin-decoder"}[5m]))
            ) > 0.20
          for: 5m
          labels:
@@ -55,7 +55,7 @@ spec:
          expr: |
            histogram_quantile(
              0.95,
-              sum by (job, le) (rate(api_response_duration_seconds_bucket{job=~"zip|holidays|air-quality"}[5m]))
+              sum by (job, le) (rate(api_response_duration_seconds_bucket{job=~"zip|holidays|air-quality|vin-decoder"}[5m]))
            ) > 2
          for: 5m
          labels:
@@ -70,7 +70,7 @@ spec:
        # -------------------------------------------------------------------
        - alert: APIDataStale
          expr: |
-            api_data_freshness_seconds{job=~"zip|holidays|air-quality"} > 2592000
+            api_data_freshness_seconds{job=~"zip|holidays|air-quality|vin-decoder"} > 2592000
          for: 30m
          labels:
            severity: warning
@@ -84,7 +84,7 @@ spec:
        # -------------------------------------------------------------------
        - alert: APIDataCriticallyStale
          expr: |
-            api_data_freshness_seconds{job=~"zip|holidays|air-quality"} > 5184000
+            api_data_freshness_seconds{job=~"zip|holidays|air-quality|vin-decoder"} > 5184000
          for: 1h
          labels:
            severity: critical
@@ -98,9 +98,9 @@ spec:
        # -------------------------------------------------------------------
        - alert: APIDown
          expr: |
-            absent(up{job=~"zip|holidays|air-quality"} == 1)
+            absent(up{job=~"zip|holidays|air-quality|vin-decoder"} == 1)
            or
-            up{job=~"zip|holidays|air-quality"} == 0
+            up{job=~"zip|holidays|air-quality|vin-decoder"} == 0
          for: 2m
          labels:
            severity: critical
@@ -0,0 +1,161 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-dashboard-vin-decoder
+  namespace: monitoring
+  labels:
+    grafana_dashboard: "1"
+data:
+  vin-decoder-dashboard.json: |
+    {
+      "annotations": { "list": [] },
+      "description": "Request rate, latency, error rate, and cache hit ratio for the VIN Decoder API",
+      "editable": true,
+      "graphTooltip": 1,
+      "panels": [
+        {
+          "collapsed": false,
+          "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 },
+          "id": 1,
+          "title": "VIN Decoder — Request Rate",
+          "type": "row"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "prometheus" },
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "palette-classic" },
+              "custom": { "axisLabel": "requests/sec", "drawStyle": "line", "fillOpacity": 10, "lineWidth": 1, "showPoints": "never" },
+              "unit": "reqps"
+            },
+            "overrides": []
+          },
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 1 },
+          "id": 2,
+          "options": {
+            "legend": { "calcs": ["mean", "max"], "displayMode": "table", "placement": "bottom" },
+            "tooltip": { "mode": "multi" }
+          },
+          "targets": [
+            {
+              "expr": "sum by (route) (rate(api_requests_total{api=\"vin-decoder\"}[5m]))",
+              "legendFormat": "{{route}}",
+              "refId": "A"
+            }
+          ],
+          "title": "Request Rate by Route",
+          "type": "timeseries"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "prometheus" },
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "palette-classic" },
+              "custom": { "axisLabel": "", "drawStyle": "line", "fillOpacity": 10, "lineWidth": 1, "showPoints": "never" },
+              "unit": "percentunit"
+            },
+            "overrides": []
+          },
+          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 1 },
+          "id": 3,
+          "options": {
+            "legend": { "calcs": ["mean", "last"], "displayMode": "table", "placement": "bottom" },
+            "tooltip": { "mode": "multi" }
+          },
+          "targets": [
+            {
+              "expr": "sum(rate(api_requests_total{api=\"vin-decoder\",status_code=~\"5..\"}[5m])) / sum(rate(api_requests_total{api=\"vin-decoder\"}[5m]))",
+              "legendFormat": "5xx error rate",
+              "refId": "A"
+            }
+          ],
+          "title": "5xx Error Rate",
+          "type": "timeseries"
+        },
+        {
+          "collapsed": false,
+          "gridPos": { "h": 1, "w": 24, "x": 0, "y": 9 },
+          "id": 10,
+          "title": "VIN Decoder — Latency",
+          "type": "row"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "prometheus" },
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "palette-classic" },
+              "custom": { "axisLabel": "seconds", "drawStyle": "line", "fillOpacity": 5, "lineWidth": 1, "showPoints": "never" },
+              "unit": "s"
+            },
+            "overrides": []
+          },
+          "gridPos": { "h": 8, "w": 24, "x": 0, "y": 10 },
+          "id": 4,
+          "options": {
+            "legend": { "calcs": ["mean", "max"], "displayMode": "table", "placement": "bottom" },
+            "tooltip": { "mode": "multi" }
+          },
+          "targets": [
+            {
+              "expr": "histogram_quantile(0.50, sum by (route, le) (rate(api_response_duration_seconds_bucket{api=\"vin-decoder\"}[5m])))",
+              "legendFormat": "P50 {{route}}",
+              "refId": "A"
+            },
+            {
+              "expr": "histogram_quantile(0.95, sum by (route, le) (rate(api_response_duration_seconds_bucket{api=\"vin-decoder\"}[5m])))",
+              "legendFormat": "P95 {{route}}",
+              "refId": "B"
+            },
+            {
+              "expr": "histogram_quantile(0.99, sum by (route, le) (rate(api_response_duration_seconds_bucket{api=\"vin-decoder\"}[5m])))",
+              "legendFormat": "P99 {{route}}",
+              "refId": "C"
+            }
+          ],
+          "title": "Response Latency P50 / P95 / P99 by Route",
+          "type": "timeseries"
+        },
+        {
+          "collapsed": false,
+          "gridPos": { "h": 1, "w": 24, "x": 0, "y": 18 },
+          "id": 20,
+          "title": "VIN Decoder — Cache & Data Freshness",
+          "type": "row"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "prometheus" },
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "thresholds" },
+              "thresholds": {
+                "steps": [
+                  { "color": "green", "value": null },
+                  { "color": "yellow", "value": 2592000 },
+                  { "color": "red", "value": 5184000 }
+                ]
+              },
+              "unit": "s"
+            },
+            "overrides": []
+          },
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 19 },
+          "id": 5,
+          "options": { "reduceOptions": { "calcs": ["lastNotNull"] }, "orientation": "auto", "textMode": "auto", "colorMode": "background" },
+          "targets": [
+            {
+              "expr": "api_data_freshness_seconds{api=\"vin-decoder\"}",
+              "legendFormat": "data freshness",
+              "refId": "A"
+            }
+          ],
+          "title": "Data Freshness (seconds since last NHTSA fetch)",
+          "type": "stat"
+        }
+      ],
+      "refresh": "1m",
+      "schemaVersion": 38,
+      "tags": ["vin-decoder", "api-company"],
+      "title": "VIN Decoder API",
+      "uid": "vin-decoder-api",
+      "version": 1
+    }
@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: rapidapi-proxy-secret
+  namespace: vin-decoder
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: kubernetes-provider
+    kind: ClusterSecretStore
+  target:
+    name: rapidapi-proxy-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: X-RapidAPI-Proxy-Secret
+      remoteRef:
+        key: rapidapi-vin-decoder-source
+        property: X-RapidAPI-Proxy-Secret
@@ -0,0 +1,103 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vin-decoder
+  namespace: vin-decoder
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: raw
+      version: ">=0.2.0"
+      sourceRef:
+        kind: HelmRepository
+        name: bedag
+        namespace: flux-system
+      interval: 60m
+  values:
+    resources:
+      - apiVersion: apps/v1
+        kind: Deployment
+        metadata:
+          name: vin-decoder
+          namespace: vin-decoder
+        spec:
+          replicas: 1
+          selector:
+            matchLabels:
+              app: vin-decoder
+          template:
+            metadata:
+              labels:
+                app: vin-decoder
+            spec:
+              imagePullSecrets:
+                - name: gitea-registry
+              containers:
+                - name: vin-decoder
+                  image: registry.leeworks.dev/vin-decoder/api:latest # {"$imagepolicy": "flux-system:vin-decoder"}
+                  ports:
+                    - name: http
+                      containerPort: 3000
+                  env:
+                    - name: RAPIDAPI_PROXY_SECRET
+                      valueFrom:
+                        secretKeyRef:
+                          name: rapidapi-proxy-secret
+                          key: X-RapidAPI-Proxy-Secret
+                  resources:
+                    requests:
+                      cpu: 50m
+                      memory: 128Mi
+                    limits:
+                      cpu: 500m
+                      memory: 256Mi
+                  livenessProbe:
+                    httpGet:
+                      path: /v1/health
+                      port: 3000
+                    initialDelaySeconds: 10
+                    periodSeconds: 30
+                  readinessProbe:
+                    httpGet:
+                      path: /v1/health
+                      port: 3000
+                    initialDelaySeconds: 5
+                    periodSeconds: 10
+      - apiVersion: v1
+        kind: Service
+        metadata:
+          name: vin-decoder
+          namespace: vin-decoder
+        spec:
+          selector:
+            app: vin-decoder
+          ports:
+            - name: http
+              port: 80
+              targetPort: 3000
+      - apiVersion: networking.k8s.io/v1
+        kind: Ingress
+        metadata:
+          name: vin-decoder
+          namespace: vin-decoder
+          annotations:
+            cert-manager.io/cluster-issuer: letsencrypt-prod
+            nginx.ingress.kubernetes.io/ssl-redirect: "true"
+        spec:
+          ingressClassName: nginx
+          tls:
+            - hosts:
+                - vin.leeworks.dev
+              secretName: vin-decoder-tls
+          rules:
+            - host: vin.leeworks.dev
+              http:
+                paths:
+                  - path: /
+                    pathType: Prefix
+                    backend:
+                      service:
+                        name: vin-decoder
+                        port:
+                          number: 80
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - externalsecret.yaml
+  - helmrelease.yaml
+  - servicemonitor.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vin-decoder
@@ -0,0 +1,15 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: vin-decoder
+  namespace: vin-decoder
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app: vin-decoder
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: 30s
@@ -11,6 +11,8 @@
 *   RAPIDAPI_HOLIDAYS_VERSION_ID
 *   RAPIDAPI_AQI_API_ID
 *   RAPIDAPI_AQI_VERSION_ID
+ *   RAPIDAPI_VIN_API_ID
+ *   RAPIDAPI_VIN_VERSION_ID
 *
 * Usage: node scripts/publish-openapi.js
 */
@@ -45,6 +47,12 @@ const APIS = [
    apiId: process.env.RAPIDAPI_AQI_API_ID,
    versionId: process.env.RAPIDAPI_AQI_VERSION_ID,
  },
+  {
+    name: 'vin-decoder',
+    specPath: path.join(__dirname, '..', 'apis', 'vin-decoder', 'openapi.yaml'),
+    apiId: process.env.RAPIDAPI_VIN_API_ID,
+    versionId: process.env.RAPIDAPI_VIN_VERSION_ID,
+  },
 ];

 /**
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Create the Gitea PATs the build-docs workflow needs and store them as action
+# secrets on leeworks-agents/api-company:
+#   - SIBLING_REPOS_TOKEN : read:repository  (clone the sibling API repos)
+#   - REGISTRY_TOKEN      : write:package + read:package
+#                           (push the docs-site image to gitea.leeworks.dev)
+#
+# Why this script exists:
+#   - The auto-injected GITEA_TOKEN is scoped to THIS repo only (can't read
+#     sibling repos) and has no package-registry scope (can't push images).
+#     GITEA_TOKEN is also a reserved secret name that cannot be overridden.
+#   - `tea` cannot CREATE a PAT (no such command), and Gitea's token-creation
+#     API requires BASIC AUTH (your password) — a token cannot mint a token.
+#   - `tea` CAN set the action secrets using its existing login.
+#
+# So: this prompts for your password ONCE, mints both PATs via the API, and
+# pipes each straight into `tea`. Token values are never written to disk.
+#
+# Usage:  bash scripts/setup-sibling-repos-token.sh
+set -euo pipefail
+
+GITEA_URL="https://gitea.leeworks.dev"
+GITEA_USER="0xWheatyz"
+REPO="leeworks-agents/api-company"
+# Unique per run (date + seconds + pid) so re-runs never collide with an
+# existing PAT name — Gitea returns 400 "token name has been used" otherwise.
+STAMP="$(date +%Y%m%d-%H%M%S)-$$"
+
+command -v curl >/dev/null || { echo "curl required"; exit 1; }
+command -v tea  >/dev/null || { echo "tea required";  exit 1; }
+command -v python3 >/dev/null || { echo "python3 required"; exit 1; }
+
+echo "Gitea user: $GITEA_USER  ($GITEA_URL)"
+read -r -s -p "Gitea password (for $GITEA_USER): " GITEA_PASS
+echo
+
+failures=0
+
+# mint_token <token-name> <json-scopes-array> <secret-name>
+mint_token() {
+  local token_name="$1" scopes="$2" secret_name="$3" body code pat
+  # Capture body + HTTP status separately so 4xx errors show the real message.
+  body="$(curl -sS -o - -w $'\n%{http_code}' -X POST \
+    -u "${GITEA_USER}:${GITEA_PASS}" \
+    -H 'Content-Type: application/json' \
+    -d "{\"name\":\"${token_name}\",\"scopes\":${scopes}}" \
+    "${GITEA_URL}/api/v1/users/${GITEA_USER}/tokens")"
+  code="${body##*$'\n'}"
+  body="${body%$'\n'*}"
+  if [ "$code" -lt 200 ] || [ "$code" -ge 300 ]; then
+    echo "  ✗ ${secret_name}: token API returned HTTP ${code}: ${body}" >&2
+    echo "    (401/403 = wrong password or 2FA; 400 = duplicate name or bad scope)" >&2
+    failures=$((failures+1)); return 1
+  fi
+  pat="$(printf '%s' "$body" | python3 -c 'import sys,json; print(json.load(sys.stdin)["sha1"])' 2>/dev/null || true)"
+  [ -n "$pat" ] || { echo "  ✗ ${secret_name}: could not parse token from: ${body}" >&2; failures=$((failures+1)); return 1; }
+  printf '%s' "$pat" | tea actions secrets create "$secret_name" --repo "$REPO" --stdin
+  echo "  ✓ ${secret_name} set (PAT '${token_name}')"
+}
+
+# Don't let one failure abort the rest.
+mint_token "sibling-repos-readonly-${STAMP}" '["read:repository"]'              "SIBLING_REPOS_TOKEN" || true
+mint_token "docs-registry-${STAMP}"          '["write:package","read:package"]' "REGISTRY_TOKEN"       || true
+
+unset GITEA_PASS
+echo "Done (${failures} failure(s)). Verify:  tea actions secrets list --repo ${REPO}"
+echo "Then re-run build-docs (push to main, or: tea actions workflows dispatch build-docs.yaml)"
+[ "$failures" -eq 0 ]