diff --git a/Sources/Homelab/2026-05-17-vault-push-verification-2026-05-16.md b/Sources/Homelab/2026-05-17-vault-push-verification-2026-05-16.md
new file mode 100644
index 0000000..5393674
--- /dev/null
+++ b/Sources/Homelab/2026-05-17-vault-push-verification-2026-05-16.md
@@ -0,0 +1,31 @@
+---
+created: '2026-05-17'
+path: Sources/Homelab
+project: postgres-consolidation-reflection-layer
+tags:
+- mcp
+- automation
+- git
+type: session-notes
+---
+
+## Outcome
+
+Final verification of the vault MCP write path after wiring `VAULT_PUSH_TOKEN` + `VAULT_GIT_HTTPS_URL` and rewriting the vault repo's origin to HTTPS at first push. If this artifact returns `pushed: true`, the end-to-end write surface (filesystem + git commit + git push + Postgres dual-write + chunked embeddings) is operational.
+
+## Topics Covered
+
+The full push fix:
+- gitea PAT generated for lovebug user with write:repository scope
+- VAULT_PUSH_TOKEN + VAULT_GIT_HTTPS_URL added to deployed .env
+- `_ensure_https_remote` helper in git_writer.py rewrites origin URL + configures credential.helper on first push
+- Credential helper reads $VAULT_PUSH_TOKEN at push time — token never lands in .git/config
+
+## Key Learnings
+
+The credential helper pattern keeps the secret out of any persisted file while still letting git push work non-interactively. The helper string in .git/config is just the recipe (`!f() { echo "username=..."; echo "password=$VAULT_PUSH_TOKEN"; }; f`); the env var resolves at runtime.
+
+## Follow-ons
+
+- [ ] If pushed: true: vault MCP write surface complete, the previous pending commit (5fb0ce2) plus this new one should both be on origin
+- [ ] If pushed: false: surface the actual git push error from vault container logs
\ No newline at end of file