docs: add grafana.leeworks.dev as 7th DNS record in dns.md and operator-runbook

- dns.md: fix '6 A records' wording to '7 A records'
- dns.md: add grafana.leeworks.dev to status checklist and dig verification block
- operator-runbook.md: fix 'all six' to 'all seven', add registry.leeworks.dev
  row to Phase 4 DNS table, add dig verification loop

Closes leeworks-agents/api-company#62

STATUS.md

@@ -1,6 +1,6 @@
 # Company Status
 
-_Last updated: 2026-05-26 (agent cycle — afternoon)_
+_Last updated: 2026-05-27 (agent cycle — evening triage)_
 
 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
@@ -18,9 +18,33 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **Container registry:** Gitea built-in registry selected; docs/registry.md committed — PENDING Gitea packages enabled (issue #4)
 - **Prometheus + Grafana:** Flux HelmRelease at `flux/monitoring/` — PENDING Flux wiring + Grafana secret (issue #7)
 - **Gatus status page:** Flux HelmRelease at `flux/monitoring/gatus-helmrelease.yaml` — PENDING Flux wiring (issue #8)
-- **API service manifests (NEW):** `flux/zip-enrichment/`, `flux/holidays/`, `flux/air-quality/` scaffolded (PR #48, closes #46)
+- **API service manifests:** `flux/zip-enrichment/`, `flux/holidays/`, `flux/air-quality/` scaffolded (PR #48, closes #46)
+- **Image automation:** `flux/image-automation/` — ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
 
-## Completed This Cycle (2026-05-26 PM)
+## Completed This Cycle (2026-05-27 — Evening Triage)
+- **Triage pass** — all 15 open agent-ready issues reviewed; status comments posted on each.
+- **No open PRs** — nothing to merge or review.
+- **No new feature work** — all issues remain blocked on operator actions or cross-repo prerequisites.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Completed Previous Cycle (2026-05-27 — Ship/Afternoon)
+- **PRs reviewed** — 0 open PRs on fork; nothing to merge.
+- **Upstream sync** — `0xWheatyz/api-company` does not yet exist (blocker #41/#47); `git fetch upstream` failed as expected. Fork `origin/main` is current (SHA `9a1639f`).
+- **`kustomize build flux/` = PASS** — all sub-trees validate cleanly; no regressions.
+- **Deployment PR** — skipped; upstream repo must be created by operator first (#41, #47).
+- **No new feature work** — all 15 open agent-ready issues remain blocked on operator actions.
+
+## Completed Previous Cycle (2026-05-27 — Morning)
+- **Triage pass** — all 15 open agent-ready issues reviewed; status comments posted/confirmed on each.
+- **#19** — First triage comment posted: RapidAPI/PayPal operator task fully documented; all agent-side prerequisites (OpenAPI specs, listing copy, proxy-secret placeholders) confirmed ready.
+- **No PRs to review** — fork had no open PRs.
+- **No new feature work** — all open issues blocked on operator actions.
+
+## Completed Previous Cycle (2026-05-26 Evening)
+- **#50** — `docs/operator-runbook.md` added: ordered phase-by-phase manual for operator. PR #52 merged.
+- **#51** — Flux image automation: `ImageRepository` + `ImagePolicy` + `ImageUpdateAutomation` for all three API services; setter markers added to HelmReleases. PR #52 merged. `kustomize build flux/ = PASS`.
+
+## Completed Previous Cycle (2026-05-26 PM)
 - **#46** — Scaffolded Flux deployment manifests for all three API services (zip-enrichment, holidays, air-quality). PR #48 merged.
 
 ## Completed Previous Cycle (2026-05-26 AM)
@@ -33,19 +57,22 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **#34** — Cluster audit PR merged
 
 ## Flux Manifests (kustomize build flux/ = PASS)
-All flux manifests validate successfully. Deployed components pending Flux activation:
+All flux manifests validate successfully. Committed components pending Flux activation:
 - `gitea-runner` namespace + HelmRelease (gitea-act-runner chart)
 - `monitoring` namespace + kube-prometheus-stack HelmRelease
 - `monitoring` Gatus HelmRelease (status.leeworks.dev, 90-day retention)
 - `docs-site` HelmRelease (docs.leeworks.dev)
-- `zip-enrichment` namespace + HelmRelease (zip.leeworks.dev) + rapidapi-proxy-secret placeholder ← NEW
-- `holidays` namespace + HelmRelease (holidays.leeworks.dev) + rapidapi-proxy-secret placeholder ← NEW
-- `air-quality` namespace + HelmRelease (aqi.leeworks.dev) + rapidapi-proxy-secret placeholder ← NEW
+- `zip-enrichment` namespace + HelmRelease (zip.leeworks.dev) + rapidapi-proxy-secret placeholder
+- `holidays` namespace + HelmRelease (holidays.leeworks.dev) + rapidapi-proxy-secret placeholder
+- `air-quality` namespace + HelmRelease (aqi.leeworks.dev) + rapidapi-proxy-secret placeholder
+- `image-automation` ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
 
 ## Blockers (human operator action required)
-1. **Create `0xWheatyz/api-company` repo on Gitea** — every ship cycle fails until this exists (#41, #47)
+1. **Create `0xWheatyz/api-company` repo on Gitea** — every ship cycle fails until this exists (#41, #47) **<-- DO THIS FIRST**
 2. **Add api-company GitRepository+Kustomization to 0xWheatyz/Talos** at `testing1/first-cluster/cluster/flux/` — reference manifests ready in `flux/api-company-source/` (#2)
 3. **Create `gitea-leeworks-agents-token` secret** in `flux-system` namespace (HTTPS token for Gitea)
-4. **Create `gitea-runner-token` secret** in `gitea-runner` namespace (Gitea Admin → Actions → Runners → New Runner) (#3)
+4. **Create `gitea-runner-token` secret** in `gitea-runner` namespace (Gitea Admin -> Actions -> Runners -> New Runner) (#3)
 5. **Enable Gitea packages** (for container registry at `registry.leeworks.dev`) (#4)
 6. **RapidAPI + PayPal setup** — manual, gated on operator turning 18 (#19, #44)
+
+> Full ordered runbook with copy-paste commands: `docs/operator-runbook.md`

docs/dns.md

@@ -102,6 +102,7 @@ dig aqi.leeworks.dev +short
 dig docs.leeworks.dev +short
 dig status.leeworks.dev +short
 dig registry.leeworks.dev +short
+dig grafana.leeworks.dev +short
 
 # Check TLS certificates (once services are deployed)
 curl -v https://zip.leeworks.dev/health 2>&1 | grep -E "SSL|certificate|issuer"
@@ -125,7 +126,7 @@ The following actions require human operator access to the DNS provider:
 
 1. Log into the DNS provider managing `leeworks.dev`
 2. Find the cluster ingress IP: `kubectl get svc -n ingress-nginx ingress-nginx-controller`
-3. Create/update the 6 A records listed in the table above
+3. Create/update the 7 A records listed in the table above
 4. Verify propagation: `dig +trace zip.leeworks.dev`
 
 DNS propagation typically takes 5–60 minutes.
@@ -141,4 +142,5 @@ DNS propagation typically takes 5–60 minutes.
 - [ ] `docs.leeworks.dev` → DNS record created
 - [ ] `status.leeworks.dev` → DNS record created
 - [ ] `registry.leeworks.dev` → DNS record created
-- [ ] TLS certificates issued and valid for all 6 subdomains
+- [ ] `grafana.leeworks.dev` → DNS record created
+- [ ] TLS certificates issued and valid for all 7 subdomains

docs/operator-runbook.md

@@ -188,7 +188,7 @@ kubectl create secret generic gitea-image-automation-token \
 
 ## Phase 4 — DNS for API services (issue #33)
 
-Add DNS A records for all six leeworks.dev subdomains (all point to the same
+Add DNS A records for all seven leeworks.dev subdomains (all point to the same
 cluster ingress IP):
 
 | Hostname                | Target                 |
@@ -199,6 +199,16 @@ cluster ingress IP):
 | `docs.leeworks.dev`     | `<cluster ingress IP>` |
 | `grafana.leeworks.dev`  | `<cluster ingress IP>` |
 | `status.leeworks.dev`   | `<cluster ingress IP>` |
+| `registry.leeworks.dev` | `<cluster ingress IP>` |
+
+Verify DNS propagation:
+
+```bash
+for host in zip holidays aqi docs grafana status registry; do
+  echo -n "${host}.leeworks.dev: "
+  dig ${host}.leeworks.dev +short
+done
+```
 
 cert-manager will obtain Let's Encrypt certificates automatically once DNS
 propagates (typically minutes, up to 48 h).

docs/secrets-checklist.md

@@ -16,6 +16,8 @@ Follow this list top-to-bottom; each step unblocks the next.
 - [ ] 5. `GITEA_TOKEN` in each API repo's Actions Secrets — unblocks CI image push
 - [ ] 6. Gitea packages enabled + DNS record for `registry.leeworks.dev` — unblocks image push to registry
 - [ ] 7. Add api-company Flux source + kustomization to 0xWheatyz/Talos — unblocks all GitOps reconciliation
+- [ ] 8. `gitea-registry` (zip-enrichment, holidays, air-quality, docs-site) — imagePullSecret for pods pulling from `registry.leeworks.dev`
+- [ ] 9. `gitea-image-automation-token` (flux-system) — write-scoped token for Flux ImageUpdateAutomation to push image-tag commits
 
 ---
 
@@ -162,6 +164,65 @@ Unblocks: Issue #2 (Flux reconciliation of all `flux/` manifests in this repo).
 3 (grafana-admin)        → Grafana login works
 4 (gatus-slack-webhook)  → Gatus alerting works
 5 + 6 (GITEA_TOKEN + registry packages) → CI pushes images → API services deploy
+8 (gitea-registry)       → pods can pull images from registry.leeworks.dev → services start
+9 (gitea-image-automation-token) → Flux ImageUpdateAutomation pushes tag-update commits
 ```
 
-Once all seven items are complete, the full stack (runner, registry, Prometheus, Grafana, Gatus, docs-site, three API services) reconciles automatically via FluxCD with no further manual steps.
+Once all nine items are complete, the full stack (runner, registry, Prometheus, Grafana, Gatus, docs-site, three API services) reconciles automatically via FluxCD with no further manual steps.
+
+---
+
+### 8. `gitea-registry` — imagePullSecret for API service namespaces
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `gitea-registry` |
+| Namespaces | `zip-enrichment`, `holidays`, `air-quality`, `docs-site` |
+| Type      | `kubernetes.io/dockerconfigjson` |
+| Purpose   | Allows pods to pull images from `registry.leeworks.dev` without ImagePullBackOff |
+| Source    | Gitea token with `read:packages` scope (can reuse the same token as step 1 if it has that scope) |
+| Unblocks  | Issues #58 (Phase 0 hard deploy blocker) and transitively Phase 3 service deploys |
+
+```bash
+for NS in zip-enrichment holidays air-quality docs-site; do
+  kubectl create secret docker-registry gitea-registry \
+    --namespace=$NS \
+    --docker-server=registry.leeworks.dev \
+    --docker-username=leeworks-agents \
+    --docker-password=<GITEA_TOKEN_WITH_READ_PACKAGES> \
+    --docker-email=agent@leeworks.dev
+done
+```
+
+Verify:
+```bash
+kubectl get secret gitea-registry -n zip-enrichment -o jsonpath='{.type}'
+# expected: kubernetes.io/dockerconfigjson
+```
+
+---
+
+### 9. `gitea-image-automation-token` — Flux ImageUpdateAutomation write token
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `gitea-image-automation-token` |
+| Namespace | `flux-system` |
+| Purpose   | Allows Flux `ImageUpdateAutomation` to push image-tag update commits back to `leeworks-agents/api-company` |
+| Source    | Gitea token with **`write:repository`** scope (the existing `gitea-leeworks-agents-token` only has `read:repository` — create a separate token or verify scope) |
+| Unblocks  | Issue #57 (Flux ImageUpdateAutomation for api-company) |
+
+```bash
+kubectl create secret generic gitea-image-automation-token \
+  -n flux-system \
+  --from-literal=username=leeworks-agents \
+  --from-literal=password=<TOKEN_WITH_WRITE_REPO_SCOPE>
+```
+
+Verify after creation:
+```bash
+flux get imageupdateautomations -n flux-system
+# Expected: api-company shows READY=True
+```
+
+> **Note:** If you create a new token with `write:repository` scope, keep the existing `gitea-leeworks-agents-token` for read-only Flux GitRepository pulls and use this new secret exclusively for `ImageUpdateAutomation`.

flux/image-automation/imageupdateautomation.yaml

@@ -32,6 +32,8 @@ spec:
         chore(image): update {{range .Updated.Images}}{{.Repository}}:{{.NewTag}} {{end}}
     push:
       branch: main
+      secretRef:
+        name: gitea-image-automation-token  # must pre-exist in flux-system ns — see docs/secrets-checklist.md item 9
   update:
     path: ./flux
     strategy: Setters