mcp: session-notes — Vault Push Token Fix Verification 2026-05-16

Sources/Homelab/2026-05-17-vault-create-artifact-verification-2026-05-16.md

@@ -0,0 +1,47 @@
+---
+created: '2026-05-17'
+path: Sources/Homelab
+project: postgres-consolidation-reflection-layer
+tags:
+- mcp
+- embeddings
+- automation
+- pgvector
+type: session-notes
+---
+
+## Outcome
+
+End-to-end verification of vault MCP create_artifact after the full diagnostic + fix chain: search_path override removed from db.py connection pool (commit 051c3ba), letting the vault_mcp role's default `wiki, public` apply naturally. Goal: confirm the dual-write lands a markdown file in the vault repo AND a row in petalbrain.wiki.artifacts AND chunked rows in petalbrain.public.embeddings.
+
+## Topics Covered
+
+The full chain of fixes for this single end-to-end write:
+- Renamed mcp_server → vault_mcp package (rename worker)
+- Fixed artifacts subsystem imports (rename completion worker)
+- Hidden artifact tools (mistake) then re-exposed + hidden save_note shim
+- Fixed create_artifact wrapper dispatch (was pointing at save_note_impl)
+- Added missing HERBYLAB_DATABASE_URL env var
+- Removed search_path = herbylab override in connection pool's configure hook
+- Multiple container rebuilds with --no-cache to defeat image caching
+
+If this artifact lands successfully, six iterations of architectural debugging culminated in a working vault MCP write surface.
+
+## Key Learnings
+
+When debugging MCP integration paths, work upward through the stack systematically:
+1. MCP transport (auth + tool dispatch)
+2. Wrapper layer (param translation + delegation target)
+3. Env config (every env var referenced by every code path)
+4. Database state (schemas, roles, search_path defaults)
+5. Code-level overrides (session-level SET commands, SQLAlchemy connect_args, hardcoded schema names in MetaData)
+
+Issues at any layer can mask issues at another. The "rebuild fixed it" theory was tempting at each step but only the layer 5 fix actually unblocked the write.
+
+## Follow-ons
+
+- [ ] Worker verifies wiki.artifacts row exists for this entry with correct schema
+- [ ] Worker verifies public.embeddings has chunked rows with source_schema='wiki', source_table='artifacts' (or 'notes', depending on routing)
+- [ ] Worker confirms chunk_text non-NULL and chunk_token_count ≤ 512
+- [ ] If success: vault MCP write surface considered operational end-to-end
+- [ ] Address the three out-of-scope items the worker flagged: tests/conftest.py:59 search_path SET, alembic/env.py:41 SCHEMA constant, HERBYLAB_DATABASE_URL env var name

Sources/Homelab/2026-05-17-vault-push-final-verification-2026-05-16.md

@@ -0,0 +1,30 @@
+---
+created: '2026-05-17'
+path: Sources/Homelab
+project: postgres-consolidation-reflection-layer
+tags:
+- mcp
+- automation
+- git
+type: session-notes
+---
+
+## Outcome
+
+Final-final verification of the vault MCP push path after fixing the git config parser semicolon trap (commit cd3c88f). If this returns pushed: true, the queued b578f458 plus this new commit should both land on origin, closing out the full end-to-end write surface debugging chain that started with the create_artifact body/content error.
+
+## Topics Covered
+
+The semicolon trap: git config values treat `;` as comment delimiter unless the entire value is wrapped in double quotes. Inner `"..."` quotes get stripped by the parser as inline quoted segments. So the f-string helper `!f() { echo "username=lovebug"; echo "password=$VAULT_PUSH_TOKEN"; }; f` got stored as `!f() { echo username=lovebug` — unterminated function, no credentials returned, push fails with "could not read Username".
+
+Fix is one line: rewrite the helper as `!echo username=$VAULT_PUSH_USER && echo password=$VAULT_PUSH_TOKEN`. No semicolons, no inner quotes, `&&` isn't special to git config.
+
+## Key Learnings
+
+Git config has its own mini-parser separate from how shells interpret quoting. `;` is a comment delimiter in config values. `"..."` quotes get stripped (their contents kept). Always validate the parsed form, not just the string you wrote.
+
+## Follow-ons
+
+- [ ] If pushed: true: vault write surface complete end-to-end
+- [ ] If pushed: false: collect the actual git push error from the new container logs
+- [ ] Wrap session — major architectural debugging chain closed

Sources/Homelab/2026-05-17-vault-push-token-fix-verification-2026-05-16.md

@@ -0,0 +1,27 @@
+---
+created: '2026-05-17'
+path: Sources/Homelab
+project: postgres-consolidation-reflection-layer
+tags:
+- mcp
+- automation
+- git
+type: session-notes
+---
+
+## Outcome
+
+Retesting after Travis corrected the gitea PAT in `.env`. The previous failures were not a code issue — the helper wiring was correct, gitea was returning "Authentication failed" because the wrong token was in env. If this returns `pushed: true`, the queued commits (`b578f458`, `ca2c8e93`) plus this new one should all land on origin.
+
+## Topics Covered
+
+The full debugging chain ended at the cheapest possible bug: wrong env value. All the architectural fixes (HTTPS URL rewrite, credential helper, semicolon trap fix) were correct. The thing that was actually broken was the token itself.
+
+## Key Learnings
+
+When a credential helper says "Authentication failed" and the wiring is verifiable, check the credential value FIRST before assuming code issues. `curl -u "user:$TOKEN" https://gitea/api/v1/user` is a 5-second test.
+
+## Follow-ons
+
+- [ ] If pushed: true, close out the vault push fix completely
+- [ ] Mark the architectural debugging chain done

Sources/Homelab/2026-05-17-vault-push-verification-2026-05-16.md

@@ -0,0 +1,31 @@
+---
+created: '2026-05-17'
+path: Sources/Homelab
+project: postgres-consolidation-reflection-layer
+tags:
+- mcp
+- automation
+- git
+type: session-notes
+---
+
+## Outcome
+
+Final verification of the vault MCP write path after wiring `VAULT_PUSH_TOKEN` + `VAULT_GIT_HTTPS_URL` and rewriting the vault repo's origin to HTTPS at first push. If this artifact returns `pushed: true`, the end-to-end write surface (filesystem + git commit + git push + Postgres dual-write + chunked embeddings) is operational.
+
+## Topics Covered
+
+The full push fix:
+- gitea PAT generated for lovebug user with write:repository scope
+- VAULT_PUSH_TOKEN + VAULT_GIT_HTTPS_URL added to deployed .env
+- `_ensure_https_remote` helper in git_writer.py rewrites origin URL + configures credential.helper on first push
+- Credential helper reads $VAULT_PUSH_TOKEN at push time — token never lands in .git/config
+
+## Key Learnings
+
+The credential helper pattern keeps the secret out of any persisted file while still letting git push work non-interactively. The helper string in .git/config is just the recipe (`!f() { echo "username=..."; echo "password=$VAULT_PUSH_TOKEN"; }; f`); the env var resolves at runtime.
+
+## Follow-ons
+
+- [ ] If pushed: true: vault MCP write surface complete, the previous pending commit (5fb0ce2) plus this new one should both be on origin
+- [ ] If pushed: false: surface the actual git push error from vault container logs