ROADMAP.md

@@ -2,6 +2,8 @@
 
 Cross-repo milestones. Per-API phases live in each API repo's ROADMAP.md.
 
+> **As of 2026-05-30, a 4th API (VIN Decoder) has been added. Per-API phases also live in `leeworks-agents/vin-decoder`.**
+
 ## Phase 0 — Orientation (one-time)
 - [ ] Audit cluster: nodes, namespaces, ingress, Flux state → `docs/cluster-audit.md`
 - [ ] Add Flux GitRepository + Kustomization watching `leeworks-agents/api-company`
@@ -10,30 +12,38 @@ Cross-repo milestones. Per-API phases live in each API repo's ROADMAP.md.
 
 ## Phase 1 — API Contracts
 Each API repo writes its `openapi.yaml` first and lints it. Spec is the source of truth.
-- See: `leeworks-agents/zip-enrichment`, `holidays`, `air-quality`
+- See: `leeworks-agents/zip-enrichment`, `holidays`, `air-quality`, `vin-decoder`
 
 ## Phase 2 — Data
 Per-API: pull free public data sources, cache locally (SQLite or in-memory), schedule monthly re-seed.
+- VIN Decoder: NHTSA vPIC as data source — SQLite cache seeded on demand (issue #120)
 
 ## Phase 3 — Servers
 Per-API: implement Fastify/FastAPI service matching `openapi.yaml` exactly. RapidAPI proxy-secret middleware on every route.
+- VIN Decoder: Fastify server implementation (issue #121)
 
 ## Phase 4 — Monitoring
 - [ ] Prometheus + Grafana via Flux HelmRelease (`flux/monitoring/`)
 - [ ] Gatus public status page at `status.leeworks.dev`
 - [ ] Instrument every API with `api_requests_total`, `api_response_duration_seconds`, `api_data_freshness_seconds`
+- [ ] VIN Decoder metrics instrumentation + Grafana dashboard (issue #129)
+- [x] VIN Decoder Gatus health check (issue #134 — closed ✅)
 
 ## Phase 5 — Documentation site
 - [ ] `docs-site/` Astro + Redoc skeleton
 - [ ] Gitea Actions pipeline that copies per-API `openapi.yaml` files at build time
 - [ ] Deploy to `docs.leeworks.dev` via Flux
 - [ ] One SEO blog post per API minimum (see master prompt §Phase 5)
+- [x] VIN Decoder docs page (issue #123 — closed ✅)
+- [x] VIN Decoder SEO blog post (issue #124 — closed ✅)
 
 ## Phase 6 — Pre-launch
 - [ ] `docs/legal/terms-of-service.md`
 - [ ] `docs/legal/privacy-policy.md`
 - [ ] `docs/legal/acceptable-use-policy.md`
 - [ ] DNS: `zip.leeworks.dev`, `holidays.leeworks.dev`, `aqi.leeworks.dev`, `docs.`, `status.`, `registry.`
+- [x] VIN Decoder DNS `vin.leeworks.dev` (issue #130 — closed ✅)
+- [x] VIN Decoder RapidAPI listing (issue #131 — closed ✅ as tracker; operator action required)
 - [ ] PayPal linked to RapidAPI (manual, on 18th birthday)
 - [ ] Paid tiers enabled on RapidAPI listings (manual)
 
@@ -47,4 +57,4 @@ $100/mo **net** ≈ $136/mo gross after RapidAPI 25% + PayPal ~2%.
 | 7 Pro @ $19 | $97 net |
 | 3 Ultra @ $49 | $107 net |
 
-(Per-API rough math; mix-and-match across the 3 APIs.)
+(Per-API rough math; mix-and-match across all 4 APIs — ZIP Enrichment, Holidays, Air Quality, VIN Decoder.)

STATUS.md

@@ -1,6 +1,6 @@
 # Company Status
 
-_Last updated: 2026-05-30 (sprint planning cycle)_
+_Last updated: 2026-05-31 (sprint planning cycle)_
 
 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
@@ -8,6 +8,7 @@ _Last updated: 2026-05-30 (sprint planning cycle)_
 | ZIP Enrichment | [~]  | [~]  | [ ]      | [ ]                | 0            | $0  |
 | Holidays       | [~]  | [~]  | [ ]      | [ ]                | 0            | $0  |
 | Air Quality    | [ ]  | [ ]  | [ ]      | [ ]                | 0            | $0  |
+| VIN Decoder    | [x]  | [ ]  | [ ]      | [ ]                | 0            | $0  |
 
 Legend: [x]=done, [~]=in-progress, [ ]=not started
 
@@ -20,16 +21,31 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **Gatus status page:** Flux HelmRelease at `flux/monitoring/gatus-helmrelease.yaml` — PENDING Flux wiring (issue #8)
 - **API service manifests:** `flux/zip-enrichment/`, `flux/holidays/`, `flux/air-quality/` scaffolded (PR #48, closes #46)
 - **Image automation:** `flux/image-automation/` — ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
+- **VIN Decoder manifests:** `flux/vin-decoder/` — Flux HelmRelease + Kustomization committed (issue #140)
 
-## Completed This Cycle (2026-05-30 — Sprint Cycle)
-- **#108** — STATUS.md updated with 2026-05-30 sprint plan and critical path.
-- **#107** — docs-site build verified: `npm run build` exits 0; all 9 required routes present in `dist/` (`/`, `/zip-enrichment`, `/holidays`, `/air-quality`, `/blog/` (3 posts), `/legal/terms-of-service`, `/legal/privacy-policy`, `/legal/acceptable-use-policy`, `/pricing`). Unblocks #30.
-- **PR #105 MERGED** — `scripts/publish-openapi.js` + `.gitea/workflows/publish-openapi.yaml` (closes #100).
-- **PR #103 MERGED** — `docs-site/src/pages/pricing.astro` + nav link (closes #101).
-- **PR #104 MERGED** — `research/RESEARCH_LOG.md` first session: VIN Decoder next candidate (closes #102).
-- **New issues triaged** — #100–#108 (sprint planning cycle issues reviewed).
-- **`0xWheatyz/api-company`** — still does not exist; fork sync skipped (blocker #47).
-- **`kustomize build flux/` = PASS** — no regressions.
+## Completed This Cycle (2026-05-31 — Sprint Cycle)
+- **#146** — STATUS.md updated to reflect VIN Decoder sprint wave (#117–#141): APIs table row added, completed wave documented, blockers updated.
+- **#145** — ROADMAP.md updated to reference VIN Decoder as 4th API across all phases (Phase 1–6). `kustomize build flux/` = PASS.
+- **PR #147 opened** — docs: update ROADMAP.md and STATUS.md for VIN Decoder sprint wave (closes #145, #146).
+
+## Completed Previous Cycle (2026-05-30 — VIN Decoder Sprint Wave)
+### VIN Decoder issues #117–#141 — status as of 2026-05-31:
+- **#117** — VIN Decoder spec + feasibility — **closed ✅** (`apis/vin-decoder/openapi.yaml` merged)
+- **#120** — VIN Decoder data layer (SQLite/NHTSA vPIC) — **open, in progress** (P1 blocker)
+- **#121** — VIN Decoder Fastify server — **open, in progress** (P1 blocker, depends on #120)
+- **#122** — Create `leeworks-agents/vin-decoder` repo — **closed ✅**
+- **#123** — VIN Decoder docs page — **closed ✅**
+- **#124** — VIN Decoder SEO blog post — **closed ✅**
+- **#130** — VIN Decoder DNS `vin.leeworks.dev` — **closed ✅**
+- **#131** — VIN Decoder RapidAPI listing — **closed ✅** (tracker; operator action required)
+- **#133** — VIN Decoder pricing page integration — **closed ✅**
+- **#134** — VIN Decoder Gatus health check — **closed ✅**
+- **#135** — VIN Decoder image automation — **closed ✅**
+- **#136** — VIN Decoder ExternalSecret manifest — **closed ✅**
+- **#138** — Extend publish-openapi pipeline to include VIN Decoder — **closed ✅** (PR #142 merged)
+- **#139** — Operator: add RAPIDAPI_VIN_API_ID + RAPIDAPI_VIN_VERSION_ID secrets — **open** (operator task, blocked on RapidAPI listing)
+- **#140** — VIN Decoder Flux manifests — **closed ✅** (PR #143 merged)
+- **#141** — Pricing page updated for VIN Decoder — **closed ✅** (PR #144 merged)
 
 ## Critical Path (operator must complete in order)
 1. **Create `0xWheatyz/api-company` repo** (#47) — **highest priority, unblocks everything**
@@ -39,17 +55,34 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 5. **Enable Gitea packages + DNS for `registry.leeworks.dev`** (#4)
 6. **All other secrets** (#70, #73, #74, #79, #80, #81, #83) follow in order
 
-## New Issues This Sprint (2026-05-29, #100–#108)
-- **#100** — `scripts/publish-openapi.js` + CI workflow — **DONE (PR #105 merged)**
-- **#101** — Pricing page at `docs.leeworks.dev/pricing/` — **DONE (PR #103 merged)**
-- **#102** — Seed `research/RESEARCH_LOG.md` — **DONE (PR #104 merged)**
-- **#106** — Add `grafana.leeworks.dev` as 7th subdomain to DNS task (#33) — tracker only; docs already updated (#67)
-- **#107** — docs-site build verification — **DONE (build passes, all 9 routes confirmed)**
-- **#108** — STATUS.md update — **DONE (this update)**
+## Blockers — VIN Decoder critical path
+- **P1: #120** — VIN Decoder data layer (NHTSA vPIC SQLite cache) — agent work pending
+- **P1: #121** — VIN Decoder Fastify server — agent work pending, depends on #120
+- **P1: #127** — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace — operator manual task
+- **P2: #128** — Create `rapidapi-proxy-secret` in `vin-decoder` namespace — operator manual task
+- **P2: #129** — VIN Decoder Prometheus metrics instrumentation — agent work pending, depends on #121
+- **P3: #139** — Add RAPIDAPI_VIN_* Actions secrets — operator task, depends on RapidAPI listing (#131)
 
-## Backlog
-- **28 open issues total**; all remaining blocked on operator Phase 0 actions above.
-- **Agent work that can proceed without operator:** all completed this cycle.
+## New Issues This Sprint (2026-05-30, #120–#146)
+- **#120** — VIN Decoder data layer — **open, P1**
+- **#121** — VIN Decoder Fastify server — **open, P1**
+- **#126** — Operator: GITEA_TOKEN secret in vin-decoder repo — manual operator task
+- **#127** — Operator: gitea-registry imagePullSecret in vin-decoder namespace — manual operator task, P1 blocker
+- **#128** — Operator: rapidapi-proxy-secret in vin-decoder namespace — manual operator task
+- **#129** — VIN Decoder Prometheus metrics — **open, P2, depends on #121**
+- **#139** — Operator: RAPIDAPI_VIN_* secrets — **open, P3, operator task**
+- **#145** — Update ROADMAP.md for VIN Decoder — **DONE (this cycle)**
+- **#146** — Update STATUS.md for VIN Decoder sprint wave — **DONE (this cycle)**
+
+## Completed Previous Cycle (2026-05-30 — Sprint Cycle)
+- **#108** — STATUS.md updated with 2026-05-30 sprint plan and critical path.
+- **#107** — docs-site build verified: `npm run build` exits 0; all 9 required routes present in `dist/`.
+- **PR #105 MERGED** — `scripts/publish-openapi.js` + `.gitea/workflows/publish-openapi.yaml` (closes #100).
+- **PR #103 MERGED** — `docs-site/src/pages/pricing.astro` + nav link (closes #101).
+- **PR #104 MERGED** — `research/RESEARCH_LOG.md` first session: VIN Decoder next candidate (closes #102).
+- **New issues triaged** — #100–#108 (sprint planning cycle issues reviewed).
+- **`0xWheatyz/api-company`** — still does not exist; fork sync skipped (blocker #47).
+- **`kustomize build flux/` = PASS** — no regressions.
 
 ## Completed Previous Cycle (2026-05-28 — Cycle-2 Triage)
 - **#83** — Triaged: `GITEA_TOKEN` Actions secrets needed in `zip-enrichment`, `holidays`, `air-quality` repos. Manual operator task; reuse token from #74 if it has `write:package` scope. Step-by-step instructions posted.
@@ -130,6 +163,7 @@ All flux manifests validate successfully. Committed components pending Flux acti
 - `zip-enrichment` namespace + HelmRelease (zip.leeworks.dev) + rapidapi-proxy-secret placeholder
 - `holidays` namespace + HelmRelease (holidays.leeworks.dev) + rapidapi-proxy-secret placeholder
 - `air-quality` namespace + HelmRelease (aqi.leeworks.dev) + rapidapi-proxy-secret placeholder
+- `vin-decoder` namespace + HelmRelease (vin.leeworks.dev) + Flux manifests
 - `image-automation` ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
 
 ## Blockers (human operator action required)
@@ -138,6 +172,7 @@ All flux manifests validate successfully. Committed components pending Flux acti
 3. **Create `gitea-leeworks-agents-token` secret** in `flux-system` namespace (HTTPS token for Gitea)
 4. **Create `gitea-runner-token` secret** in `gitea-runner` namespace (Gitea Admin -> Actions -> Runners -> New Runner) (#3)
 5. **Enable Gitea packages** (for container registry at `registry.leeworks.dev`) (#4)
-6. **RapidAPI + PayPal setup** — manual, gated on operator turning 18 (#19, #44)
+6. **Create `gitea-registry` imagePullSecret in `vin-decoder` namespace** (#127) — VIN Decoder P1
+7. **RapidAPI + PayPal setup** — manual, gated on operator turning 18 (#19, #44)
 
 > Full ordered runbook with copy-paste commands: `docs/operator-runbook.md`