docs: update STATUS.md for 2026-06-06 triage cycle (#226)

- Triaged all 27 open agent-ready issues; all confirmed blocked on operator
  tasks (create 0xWheatyz/api-company #47, merge Talos PR #14 #218, DNS #33)
- 0 new issues, 0 closures, 0 PRs, kustomize build flux/ = PASS
- Added Completed This Cycle entry for Triage Cycle #226

ROADMAP.md

@@ -32,6 +32,7 @@ Per-API: implement Fastify/FastAPI service matching `openapi.yaml` exactly. Rapi
 - [ ] Verify VIN Decoder metrics endpoint and ServiceMonitor scrape config — issue #174
 - [x] VIN Decoder metrics instrumentation + Grafana dashboard (issue #129 — closed ✅)
 - [x] VIN Decoder Gatus health check (issue #134 — closed ✅)
+- [x] Enable Alertmanager in kube-prometheus-stack + configure Slack receiver for SLO alerts (issue #210 — closed ✅)
 
 ## Phase 5 — Documentation site
 - [x] `docs-site/` Astro + Redoc skeleton (issue #28 — closed ✅)

STATUS.md

@@ -1,6 +1,6 @@
 # Company Status
 
-_Last updated: 2026-06-05_
+_Last updated: 2026-06-06_
 
 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
@@ -22,8 +22,58 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **API service manifests:** `flux/zip-enrichment/`, `flux/holidays/`, `flux/air-quality/` scaffolded (PR #48, closes #46)
 - **Image automation:** `flux/image-automation/` — ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
 - **VIN Decoder manifests:** `flux/vin-decoder/` — Flux HelmRelease + Kustomization committed (issue #140)
+- **Alertmanager:** `flux/monitoring/helmrelease.yaml` — enabled with Slack receiver config (`gatus-slack-webhook` secret); PR #212 open (issue #210)
 
-## Completed This Cycle (2026-06-05 — Sprint Planning Cycle #206)
+## Completed This Cycle (2026-06-06 — Triage Cycle #226)
+
+- **Triage** — All 27 open `agent-ready` issues reviewed and commented with current status (2026-06-06).
+  - **All issues confirmed blocked** on the same critical-path operator tasks: #47 (create `0xWheatyz/api-company`), #218 (merge Talos PR #14), #33/#106/#150 (DNS).
+  - **No agent-implementable work found** — all open issues are either manual operator tasks or gated on Flux/cluster activation.
+  - **0 new issues created** — no gaps found; all ROADMAP items are grounded in open issues.
+  - **0 issues closed** — no issues are stale or resolvable by agent action.
+  - **0 PRs open** — nothing to review or merge.
+  - **`kustomize build flux/` = PASS** — no manifest regressions.
+- **Current critical path unchanged:** (1) Operator creates `0xWheatyz/api-company` (#47), (2) Operator merges `0xWheatyz/Talos` PR #14 (#218), (3) Operator configures DNS for all 8 subdomains (#33, #106, #150).
+
+## Completed Previous Cycle (2026-06-06 — Sprint Planning Cycle #221)
+
+- **#221** — STATUS.md updated for 2026-06-06 sprint planning cycle (this entry). Last-updated date confirmed 2026-06-06.
+- **0 new issues created** — all ROADMAP unchecked items confirmed grounded in open issues (35 open issues, zero gaps).
+- **0 issues closed** — oldest open issue is #3 from 2026-05-18 (19 days < 30-day stale threshold).
+- **3 label changes:**
+  - #106 (grafana.leeworks.dev DNS): added `blocked` label (missing despite dependency on #47)
+  - #150 (vin.leeworks.dev DNS): added `blocked` label (missing despite dependency on #47)
+  - #203 (ClusterIssuer verification): downgraded P1 → P2 (gated on DNS #33, not a first-order blocker)
+- **Critical path unchanged:** Operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#218) to activate Flux, (3) configure DNS (#33, #106, #150).
+- **`kustomize build flux/` = PASS** — no manifest regressions.
+
+## Completed Previous Cycle (2026-06-06 — Docs Cycle #219)
+
+- **#219** — STATUS.md Current Blockers updated: removed closed issues #187 and #90; replaced with open issue #218 (Operator: merge 0xWheatyz/Talos upstream PR #14 to activate Flux GitOps for api-company). Critical Path item 2 updated to reference #218. `kustomize build flux/` = PASS.
+
+## Completed Previous Cycle (2026-06-05 — Sprint Planning Cycle #215)
+
+- **#215** — STATUS.md updated for 2026-06-05 sprint planning cycle (this entry). Last-updated date confirmed 2026-06-05.
+- **1 new issue created:** #214 (ROADMAP.md Phase 4 Alertmanager annotation — documentation gap filed).
+- **0 issues closed** — no stale issues; oldest open issue is #2 from 2026-05-18 (18 days < 30-day threshold).
+- **0 label/priority changes** — all existing labels confirmed correct.
+- **ROADMAP cross-reference:** all unchecked items confirmed grounded in open issues; 1 new documentation gap found and filed (#214 — Alertmanager / Slack receiver missing from ROADMAP.md Phase 4).
+- **Critical path unchanged:** Operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150).
+- **`kustomize build flux/` = PASS** — no regressions.
+- **0 open PRs** — nothing to review or merge.
+
+## Completed Previous Cycle (2026-06-05 — Sprint Planning Cycle #211)
+
+- **#211** — STATUS.md updated for 2026-06-05 sprint planning cycle (this entry). Last-updated date confirmed 2026-06-05.
+- **1 new issue implemented:** #210 (Enable Alertmanager + Slack receiver — gap identified by roadmap cross-reference); PR #212 opened to `leeworks-agents/api-company` with `kustomize build flux/` = PASS.
+- **0 issues closed** — oldest open issue is #2 from 2026-05-18 (18 days old — under 30-day stale threshold).
+- **0 label changes** — all priority/complexity labels confirmed correct.
+- **ROADMAP cross-reference:** 18 unchecked items confirmed grounded in open issues; 1 new gap found and filed (#210 — Alertmanager was missing from roadmap coverage).
+- **Current Blockers unchanged:** Operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150).
+- **`kustomize build flux/` = PASS** — no regressions.
+- **1 open PR** — PR #212 (Alertmanager enable + Slack receiver): `kustomize build flux/` PASS; pending merge.
+
+## Completed Previous Cycle (2026-06-05 — Sprint Planning Cycle #206)
 
 - **#206** — STATUS.md updated for 2026-06-05 sprint planning cycle (this entry). Last-updated date set to 2026-06-05.
 - **Completed outcomes from 2026-06-04 sprint planning cycle recorded:**
@@ -122,7 +172,7 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **PR #160 closed** — had merge conflicts and ROADMAP.md regressions (unchecked completed items). Clean fix applied here.
 - **`kustomize build flux/` = PASS** — no regressions.
 
-## Current Blockers (as of 2026-06-04)
+## Current Blockers (as of 2026-06-06)
 
 In dependency order — operator tasks unless noted:
 
@@ -133,8 +183,7 @@ In dependency order — operator tasks unless noted:
 5. **P1 #83** — Configure `GITEA_TOKEN` Actions secret in zip-enrichment, holidays, air-quality repos (operator)
 6. **P1 #126** — Configure `GITEA_TOKEN` Actions secret in vin-decoder repo (operator — depends on #122 ✅)
 7. **P1 #127** — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace (operator)
-8. **P1 #187** — Merge upstream PR #14 on 0xWheatyz/Talos to activate Flux for api-company (operator) — Fork PR #399 already MERGED to leeworks-agents/Talos; upstream PR #14 is the critical gate; unblocks #2, #3, #4, #66 chain
-9. **P1 #90** — Wire Flux GitRepository + Kustomization for api-company in `0xWheatyz/Talos` (superseded by #187; upstream PR #14 pending operator merge)
+8. **P1 #218** — Operator: merge 0xWheatyz/Talos upstream PR #14 to activate Flux GitOps for api-company — Fork PR #399 already MERGED to leeworks-agents/Talos; upstream PR #14 is the critical gate; unblocks #2, #3, #4, #66 chain (replaces closed #187 and #90)
 10. **P2 #80** — Create `gitea-image-automation-token` secret in `flux-system` namespace (operator) — enables Flux image automation
 11. **P2 #173** — Create ESO source secrets in `external-secrets` namespace for RapidAPI proxy-secret syncing (operator) — blocks ESO sync
 12. **P2 #174** — VIN Decoder metrics instrumentation in `leeworks-agents/vin-decoder` repo (agent task, depends on #18 deploy)
@@ -181,7 +230,7 @@ In dependency order — operator tasks unless noted:
 See **Current Blockers** section above for the full ordered list as of 2026-06-01.
 
 1. **Create `0xWheatyz/api-company` repo** (#47) — **highest priority, unblocks everything**
-2. **Add api-company Flux source to Talos** (#90) — needs Talos PR, reference manifests at `flux/api-company-source/`
+2. **Merge upstream Talos PR #14 to activate Flux for api-company** (#218) — manifests already committed; operator must merge 0xWheatyz/Talos PR #14
 3. **Create `gitea-leeworks-agents-token` secret** in `flux-system` (#76)
 4. **Create `gitea-runner-token` secret** in `gitea-runner` (#77)
 5. **Enable Gitea packages + DNS for `registry.leeworks.dev`** (#4)

docs/secrets-checklist.md

@@ -12,7 +12,7 @@ Follow this list top-to-bottom; each step unblocks the next.
 - [ ] 1. `gitea-leeworks-agents-token` (flux-system) — unblocks Flux GitRepository auth
 - [ ] 2. `gitea-runner-token` (gitea-runner) — unblocks Gitea Actions runner registration
 - [ ] 3. `grafana-admin` (monitoring) — unblocks Grafana login
-- [ ] 4. `gatus-slack-webhook` (monitoring) — unblocks Gatus alert notifications
+- [ ] 4. `gatus-slack-webhook` (monitoring) — unblocks Gatus alert notifications AND Alertmanager Slack SLO alerts
 - [ ] 5. `GITEA_TOKEN` in each API repo's Actions Secrets — unblocks CI image push
 - [ ] 6. Gitea packages enabled + DNS record for `registry.leeworks.dev` — unblocks image push to registry
 - [ ] 7. Add api-company Flux source + kustomization to 0xWheatyz/Talos — unblocks all GitOps reconciliation
@@ -92,9 +92,12 @@ Grafana will be accessible at `https://grafana.leeworks.dev` (login: `admin` / `
 |-----------|-------|
 | Name      | `gatus-slack-webhook` |
 | Namespace | `monitoring` |
-| Purpose   | Gatus posts downtime alerts to a Slack channel via incoming webhook |
+| Purpose   | Gatus posts downtime alerts to a Slack channel via incoming webhook. Also mounted by Alertmanager (`alertmanagerSpec.secrets`) to send SLO / firing-alert Slack notifications. |
 | Source    | Slack → Your workspace → Apps → Incoming Webhooks → Add to Slack → copy webhook URL |
-| Unblocks  | Issue #8 (Gatus status page at `status.leeworks.dev`) |
+| Unblocks  | Issue #8 (Gatus status page at `status.leeworks.dev`); Alertmanager Slack receiver (issue #210) |
+| Consumers | **Two components** share this secret: (1) **Gatus** (`flux/monitoring/gatus-helmrelease.yaml`) — public status-page alerts; (2) **Alertmanager** (`flux/monitoring/helmrelease.yaml` via `alertmanagerSpec.secrets`) — SLO / firing-alert Slack notifications |
+
+> **Note (dual consumer):** Creating this one secret (`gatus-slack-webhook` in the `monitoring` namespace) unblocks **both** Gatus alert delivery AND Alertmanager's Slack receiver. The Alertmanager configuration references this secret at `global.slack_api_url_file: /etc/alertmanager/secrets/gatus-slack-webhook/url` (enabled in PR #212 / issue #210).
 
 ```bash
 kubectl create secret generic gatus-slack-webhook \
@@ -266,7 +269,7 @@ kubectl create secret generic rapidapi-proxy-secret \
 1 (gitea-leeworks-token) → Flux can pull this repo over HTTPS
 2 (gitea-runner-token)   → runner online → CI runs
 3 (grafana-admin)        → Grafana login works
-4 (gatus-slack-webhook)  → Gatus alerting works
+4 (gatus-slack-webhook)  → Gatus alerting works + Alertmanager Slack SLO alerts
 5 + 6 (GITEA_TOKEN + registry packages) → CI pushes images → API services deploy
 8 (gitea-registry)       → pods can pull images from registry.leeworks.dev → services start
 9 (gitea-image-automation-token) → Flux ImageUpdateAutomation pushes tag-update commits