Ops Vendor Inventory Sweep — 2026-05-19
Status: implementation note for the ops cockpit inventory sprint.
This sweep looked at three sources without copying secret values:
- Runtime code and
wrangler.tomlbindings. - Existing ops API data sources: health, FinOps, Cloudflare GraphQL, D1 ledgers.
- The local
~/.agent/secrets/inventory by filename, heading, env-var name, and endpoint domain only.
Production-critical vendors in the current architecture
| Vendor | Products / surfaces | Evidence source | Ops treatment |
|---|---|---|---|
| Cloudflare | Workers, service bindings, D1, R2, Durable Objects relay, Assets, Workers Analytics, AI Gateway | wrangler.toml, health probes, Cloudflare GraphQL, FinOps env |
Runtime binding rows, health rows, worker usage rows, quota budget rows, repo catalog rows |
| Deno Deploy | Secondary realtime relay | PUBLIC_RELAY_URLS, infra docs |
Runtime URL rows and repo catalog row |
| Koyeb | Typst compile service | TYPST_COMPILE_URL, infra docs |
Runtime URL row, health row, repo catalog row |
| Render | JobCache interface / broker host | JOBCACHE_API_URL, infra docs |
Runtime URL row and repo catalog row |
| CockroachDB | JobCache shared role/ad knowledge store | jobcache/ops/api/wrangler.toml, infra docs, secrets inventory |
Repo catalog row until JobCache ops API exposes live Cockroach readings |
| Axiom | Telemetry archive / future query adapter | telemetry code, ops env, secrets inventory | Provider-cost/readiness row plus repo catalog row |
| OpenAI / Anthropic | Optional admin cost APIs; optional AI providers | ops FinOps code, server key catalog, secrets inventory | Cost readiness rows and server-key rows |
| Groq, Mistral, NVIDIA, Google Gemini, Cohere, Cerebras, DeepInfra, OpenRouter, HuggingFace, Z.ai | Server-managed AI provider pool | KEY_CATALOG, D1 ai_usage, secrets inventory |
Server-key rows and auto provider-usage rows when seen in ai_usage |
| Google Maps | Commute/routing gateway | KEY_CATALOG, D1 gateway_log, secrets inventory |
Server-key row and auto gateway capability rows |
| Jina, TinyFish, Tavily, DeepL | Scraping / translation gateway providers | KEY_CATALOG, gateway conventions, secrets inventory |
Server-key rows and auto gateway rows when seen in gateway_log |
| Firecrawl, Browserbase, Grafana, Sentry, Backblaze B2, Pulumi, CircleCI, Google Cloud, Scaleway, Upstash, Telegram | Present in secrets inventory or adjacent infrastructure, not all bound to CareerVector ops runtime today | secrets inventory and repo references | Not shown as healthy unless bound, cataloged, or observed through runtime/API adapters |
Auto-registration rule implemented
GET /services/summary now builds one vendor-neutral inventory from adapters.
Rows can be cataloged or auto-registered:
health: D1, R2, relays, typst, MCP, JobCache health probes.finops_budget: budget resources from/finops/summary, including provider usage meters, cataloged service meters, and provider/type groupings.cloudflare_usage: every Worker script seen in Cloudflare usage breakdown.server_key_catalog: every server-managed key inKEY_CATALOG.managed_ai_gateway: Cloudflare AI Gateway readiness.runtime_env: D1/R2/service bindings, URL vars, relay URL arrays, and unknown vendor-like env keys.upstream_ops: sibling ops APIs, starting with JobCache health, scraper quotas, cost-per-ad readiness, and Cockroach-backed source-matrix readiness.usage_ledger: AI providers fromai_usageand provider/capability pairs fromgateway_log.repo_catalog: expected platform vendors that are not necessarily bound to the current Worker.
This means a new Cloudflare Worker, a new D1/R2/service binding, a new gateway provider/capability, or a newly active AI provider appears in Ops without a new Svelte component. If a new host only exists in another service, the preferred path is now: expose it from that service's ops API, bind that ops API into the CareerVector ops worker, and let the upstream adapter normalize it.
Remaining gaps
- JobCache is now consumed as a sibling ops API. The first pass reads health, Browserbase/Firecrawl quota readiness, cost-per-ad readiness, and the Cockroach-backed source matrix. Deeper corpus/freshness/source drill-down should stay inside JobCache ops and be summarized upward only when useful.
- Axiom is visible as configured/readiness today, but the normalized query adapter still needs real event-volume and anomaly readings.
- Provider cost APIs are only OpenAI/Anthropic/Axiom in this pass. Other AI vendors can be shown through key readiness and internal usage, but not vendor-reported spend until their billing APIs are wrapped.
- Per-product quota limits need explicit env/config policy. Usage rows and catalog rows are automatically discovered; hard limits should remain deliberate so Ops does not invent ceilings. Missing quotas can still raise FinOps event signals once usage is observed, and previous-period baselines can raise anomaly signals when current usage diverges mechanically.