| 2026-07-31 00:00 UTC | GMAIL_TOOLS_GCP_OAUTH_CLIENT_ID + GMAIL_TOOLS_GCP_OAUTH_CLIENT_SECRET (secrets/gmail-tools.env.sops) | bootstrap, follow-up — issue #4721 part [B]. The earlier bootstrap run (branch merged as PR #4762) skipped these 2 keys because it looked for the source file at the wrong path (gmail-tools\gcp-oauth.keys.json, which does not exist). Verified the correct hardcoded path by reading auth.js in the gmail-tools repo: path.join(process.env.USERPROFILE || process.env.HOME, '.gmail-mcp', 'gcp-oauth.keys.json'). Confirmed present at C:\Users\konar\.gmail-mcp\gcp-oauth.keys.json (409 bytes). Extracted only the client_id/client_secret fields (never the full file contents) into $env:VAL_* vars and added via scripts\sops-set.ps1 -Pairs batch write. | claude (secret-manager, Windows desktop session) | SOPS secrets/gmail-tools.env.sops ✅ canary OK, both keys confirmed present by name · branch secrets/4721-gmail-tools-oauth-client → PR to main · Distribution beyond SOPS: N/A (dev-workstation-only credential, not CI/server-deployed) · issue #4721 left untouched per delegation instructions — other parts of that issue are still open |
| 2026-07-31 00:00 UTC | NEW FILE — secrets/gmail-tools.env.sops bootstrap: GMAIL_TOOLS_OAUTH_TOKEN, GMAIL_TOOLS_CALENDAR_SA_KEY, GMAIL_TOOLS_SHEETS_CONFIG, QUEUE_API_URL, QUEUE_API_KEY | bootstrap — issue #4721 part [B], gmail-tools ecosystem onboarding (dispatch-queue credentials for radieu/gmail-tools). Copied the three JSON blob values verbatim (minified to single-line via ConvertFrom-Json | ConvertTo-Json -Compress, never printed) from local workstation files (C:\code_2026\gmail-tools\credentials\{token,calendar-sa-key,sheets-config}.json). QUEUE_API_URL set to the existing shared dispatcher URL (not a secret). QUEUE_API_KEY is a brand-new value, generated fresh via New-RandomHex -bytes 32 (32-byte/64-hex-char random token) — did not exist anywhere before this entry. Skipped — source file missing: GMAIL_TOOLS_GCP_OAUTH_CLIENT_ID / GMAIL_TOOLS_GCP_OAUTH_CLIENT_SECRET (C:\code_2026\gmail-tools\gcp-oauth.keys.json does not exist on this workstation; not present in gmail-tools/.env.local either — only Dropbox keys found there). File written via module-scoped Write-SopsFileContent (not sops-set.ps1, since the file did not exist yet — Test-Path precheck in that CLI blocks bootstrap-from-scratch; called the same tested/canary/rollback-verified function directly, per .claude/hooks/pre-bash-safety-windows.ps1’s documented exception list). .sops.yaml needed no change — already covered by the generic 6-recipient secrets/.*\.env\.sops$ rule. | claude (secret-manager, Windows desktop session) | SOPS secrets/gmail-tools.env.sops ✅ canary OK, 6/6 age recipients confirmed via Get-SopsRecipientCount · key names verified present (5/5 expected minus the 2 skipped) · PR pending → main · secrets-sync.yml: not yet configured for this new file (deployment target undecided — gmail-tools has no server/Vercel consumer yet, tracked on #4721) · GMAIL_TOOLS_GCP_OAUTH_CLIENT_ID/SECRET still outstanding — needs a human to locate or re-download gcp-oauth.keys.json from Google Cloud Console before part [B] is fully complete |
| 2026-07-31 00:00 UTC | #4724, #2715 | GMAIL_TOOLS_TELEGRAM_BOT_TOKEN (secrets/gmail-tools.env.sops) | new-credential add — gmail-tools onboarding follow-up for the n8n google-worker-bot Telegram workflow; value sourced from developer workstation scratch file D:\code_2026\p24-infra\.env.local key telegram_bot_gmail_assitant (emergency-fallback-style source, not p24-infra-managed) | claude (secret-manager) |
| 2026-07-31 00:00 UTC | #4785 | n8n vault SSH credentials bms-4-root-ssh (W8fOGECM0UwCagjd) + vps-i1-root-ssh (EXatXoTcRtlCr3FM) — re-pointed to the radieu-root-2026-06-27 ed25519 key (/home/claude-runner/.ssh/vps_root_key on bms-4). Not a SOPS key — n8n vault only. | Both credentials referenced a removed claude-runner key (/home/claude-runner/.ssh/id_ed25519); every SSH-to-bms-4 workflow failed All configured authentication methods failed (gmail-tools exec 270023; blocked #4724). | claude (secret-manager worker, bms-4) |