docs: update STATUS.md for 2026-06-07 triage cycle #232

- 28 agent-ready issues reviewed (27 previously known + new #231)
- Issue #231 triaged: @qa-engineer — VIN Decoder metrics live-cluster
  verification; BLOCKED on #218 (Flux not active)
- kustomize build flux/ PASS
- 0 open PRs

ROADMAP.md

@@ -6,7 +6,7 @@ Cross-repo milestones. Per-API phases live in each API repo's ROADMAP.md.
 
 ## Phase 0 — Orientation (one-time)
 - [x] Audit cluster: nodes, namespaces, ingress, Flux state → `docs/cluster-audit.md` (issue #36 — closed ✅)
-- [ ] Add Flux GitRepository + Kustomization watching `leeworks-agents/api-company` — issue #2 (Talos PR implementation: issue #187)
+- [ ] Add Flux GitRepository + Kustomization watching `leeworks-agents/api-company` — issue #218 (fork PR #399 merged to leeworks-agents/Talos; awaiting operator merge of 0xWheatyz/Talos PR #14)
 - [ ] Deploy `gitea-act-runner` in cluster via Flux HelmRelease (`flux/gitea-runner/`) — issue #3
 - [ ] Stand up `registry.leeworks.dev` (container registry) — required before any API CI works — issue #4
 - [ ] Validate ESO HelmRelease deployment and ExternalSecret sync for all 4 API namespaces — issue #178

STATUS.md

@@ -1,6 +1,6 @@
 # Company Status
 
-_Last updated: 2026-06-06_
+_Last updated: 2026-06-07_
 
 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
@@ -24,7 +24,49 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **VIN Decoder manifests:** `flux/vin-decoder/` — Flux HelmRelease + Kustomization committed (issue #140)
 - **Alertmanager:** `flux/monitoring/helmrelease.yaml` — enabled with Slack receiver config (`gatus-slack-webhook` secret); PR #212 open (issue #210)
 
-## Completed This Cycle (2026-06-06 — Sprint Planning Cycle #221)
+## Completed This Cycle (2026-06-07 — Triage Cycle #232)
+
+- **Triage** — All 28 open `agent-ready` issues reviewed and commented with current status (2026-06-07).
+  - **All issues confirmed blocked** on the same critical-path operator tasks: #47 (create `0xWheatyz/api-company`), #218 (merge Talos PR #14), #33/#106/#150 (DNS).
+  - **No agent-implementable work found** — all open issues are either manual operator tasks or gated on Flux/cluster activation; kubectl unreachable from agent environment.
+  - **1 new issue triaged** — #231 commented with @qa-engineer assessment; BLOCKED on #218.
+  - **0 new issues created** — no gaps found; all ROADMAP items remain grounded in open issues.
+  - **0 issues closed** — no stale issues.
+  - **0 label changes** — all existing labels correct.
+  - **0 open PRs** — nothing to review or merge.
+  - **`kustomize build flux/` = PASS** — no manifest regressions.
+- **Critical path unchanged:** (1) Operator creates `0xWheatyz/api-company` (#47), (2) Operator merges `0xWheatyz/Talos` PR #14 (#218), (3) Operator configures DNS for all 8 subdomains (#33, #106, #150).
+
+## Completed Previous Cycle (2026-06-06 — Sprint Planning Cycle #227)
+
+
+
+- **Sprint Planning** — Full ROADMAP cross-reference + backlog triage completed (2026-06-06).
+  - **ROADMAP cross-reference:** All 18 unchecked items confirmed grounded in open issues — **zero gaps**.
+    - Phase 0: #3, #4, #66, #76–#83, #126–#128, #173, #178, #179, #203, #218 — all tracked.
+    - Phase 4: #7, #8, #174 — all tracked.
+    - Phase 5: #30 — tracked.
+    - Phase 6: #19, #33, #44, #106, #116, #139, #150, #151, #161, #166, #167 — all tracked.
+  - **Staleness check:** Oldest open issue is #3 / #4 from 2026-05-18 (19 days) — **below 30-day threshold; zero closures**.
+  - **Label audit:** All priority/complexity labels confirmed correct from cycle #221 audit — **zero changes**.
+  - **0 new issues created** — no roadmap gaps found.
+  - **0 issues closed** — no stale issues.
+  - **0 label changes** — all existing labels correct.
+  - **`kustomize build flux/` = PASS** — no manifest regressions.
+- **Critical path unchanged:** (1) Operator creates `0xWheatyz/api-company` (#47), (2) Operator merges `0xWheatyz/Talos` PR #14 (#218), (3) Operator configures DNS for all 8 subdomains (#33, #106, #150).
+
+## Completed Previous Cycle (2026-06-06 — Triage Cycle #226)
+
+- **Triage** — All 28 open `agent-ready` issues reviewed and commented with current status (2026-06-06).
+  - **All issues confirmed blocked** on the same critical-path operator tasks: #47 (create `0xWheatyz/api-company`), #218 (merge Talos PR #14), #33/#106/#150 (DNS).
+  - **No agent-implementable work found** — all open issues are either manual operator tasks or gated on Flux/cluster activation.
+  - **0 new issues created** — no gaps found; all ROADMAP items are grounded in open issues.
+  - **0 issues closed** — no issues are stale or resolvable by agent action.
+  - **0 PRs open** — nothing to review or merge.
+  - **`kustomize build flux/` = PASS** — no manifest regressions.
+- **Current critical path unchanged:** (1) Operator creates `0xWheatyz/api-company` (#47), (2) Operator merges `0xWheatyz/Talos` PR #14 (#218), (3) Operator configures DNS for all 8 subdomains (#33, #106, #150).
+
+## Completed Previous Cycle (2026-06-06 — Sprint Planning Cycle #221)
 
 - **#221** — STATUS.md updated for 2026-06-06 sprint planning cycle (this entry). Last-updated date confirmed 2026-06-06.
 - **0 new issues created** — all ROADMAP unchecked items confirmed grounded in open issues (35 open issues, zero gaps).

docs/secrets-checklist.md

@@ -12,7 +12,7 @@ Follow this list top-to-bottom; each step unblocks the next.
 - [ ] 1. `gitea-leeworks-agents-token` (flux-system) — unblocks Flux GitRepository auth
 - [ ] 2. `gitea-runner-token` (gitea-runner) — unblocks Gitea Actions runner registration
 - [ ] 3. `grafana-admin` (monitoring) — unblocks Grafana login
-- [ ] 4. `gatus-slack-webhook` (monitoring) — unblocks Gatus alert notifications
+- [ ] 4. `gatus-slack-webhook` (monitoring) — unblocks Gatus alert notifications AND Alertmanager Slack SLO alerts
 - [ ] 5. `GITEA_TOKEN` in each API repo's Actions Secrets — unblocks CI image push
 - [ ] 6. Gitea packages enabled + DNS record for `registry.leeworks.dev` — unblocks image push to registry
 - [ ] 7. Add api-company Flux source + kustomization to 0xWheatyz/Talos — unblocks all GitOps reconciliation
@@ -92,9 +92,12 @@ Grafana will be accessible at `https://grafana.leeworks.dev` (login: `admin` / `
 |-----------|-------|
 | Name      | `gatus-slack-webhook` |
 | Namespace | `monitoring` |
-| Purpose   | Gatus posts downtime alerts to a Slack channel via incoming webhook |
+| Purpose   | Gatus posts downtime alerts to a Slack channel via incoming webhook. Also mounted by Alertmanager (`alertmanagerSpec.secrets`) to send SLO / firing-alert Slack notifications. |
 | Source    | Slack → Your workspace → Apps → Incoming Webhooks → Add to Slack → copy webhook URL |
-| Unblocks  | Issue #8 (Gatus status page at `status.leeworks.dev`) |
+| Unblocks  | Issue #8 (Gatus status page at `status.leeworks.dev`); Alertmanager Slack receiver (issue #210) |
+| Consumers | **Two components** share this secret: (1) **Gatus** (`flux/monitoring/gatus-helmrelease.yaml`) — public status-page alerts; (2) **Alertmanager** (`flux/monitoring/helmrelease.yaml` via `alertmanagerSpec.secrets`) — SLO / firing-alert Slack notifications |
+
+> **Note (dual consumer):** Creating this one secret (`gatus-slack-webhook` in the `monitoring` namespace) unblocks **both** Gatus alert delivery AND Alertmanager's Slack receiver. The Alertmanager configuration references this secret at `global.slack_api_url_file: /etc/alertmanager/secrets/gatus-slack-webhook/url` (enabled in PR #212 / issue #210).
 
 ```bash
 kubectl create secret generic gatus-slack-webhook \
@@ -266,7 +269,7 @@ kubectl create secret generic rapidapi-proxy-secret \
 1 (gitea-leeworks-token) → Flux can pull this repo over HTTPS
 2 (gitea-runner-token)   → runner online → CI runs
 3 (grafana-admin)        → Grafana login works
-4 (gatus-slack-webhook)  → Gatus alerting works
+4 (gatus-slack-webhook)  → Gatus alerting works + Alertmanager Slack SLO alerts
 5 + 6 (GITEA_TOKEN + registry packages) → CI pushes images → API services deploy
 8 (gitea-registry)       → pods can pull images from registry.leeworks.dev → services start
 9 (gitea-image-automation-token) → Flux ImageUpdateAutomation pushes tag-update commits

flux/vin-decoder/helmrelease.yaml

@@ -37,7 +37,8 @@ spec:
                 - name: vin-decoder
                   image: registry.leeworks.dev/vin-decoder/api:latest # {"$imagepolicy": "flux-system:vin-decoder"}
                   ports:
-                    - containerPort: 3000
+                    - name: http
+                      containerPort: 3000
                   env:
                     - name: RAPIDAPI_PROXY_SECRET
                       valueFrom:
@@ -72,7 +73,8 @@ spec:
           selector:
             app: vin-decoder
           ports:
-            - port: 80
+            - name: http
+              port: 80
               targetPort: 3000
       - apiVersion: networking.k8s.io/v1
         kind: Ingress