Sources/Homelab/2026-05-17-vault-create-artifact-verification-2026-05-16.md

@@ -1,47 +0,0 @@
----
-created: '2026-05-17'
-path: Sources/Homelab
-project: postgres-consolidation-reflection-layer
-tags:
-- mcp
-- embeddings
-- automation
-- pgvector
-type: session-notes
----
-
-## Outcome
-
-End-to-end verification of vault MCP create_artifact after the full diagnostic + fix chain: search_path override removed from db.py connection pool (commit 051c3ba), letting the vault_mcp role's default `wiki, public` apply naturally. Goal: confirm the dual-write lands a markdown file in the vault repo AND a row in petalbrain.wiki.artifacts AND chunked rows in petalbrain.public.embeddings.
-
-## Topics Covered
-
-The full chain of fixes for this single end-to-end write:
-- Renamed mcp_server → vault_mcp package (rename worker)
-- Fixed artifacts subsystem imports (rename completion worker)
-- Hidden artifact tools (mistake) then re-exposed + hidden save_note shim
-- Fixed create_artifact wrapper dispatch (was pointing at save_note_impl)
-- Added missing HERBYLAB_DATABASE_URL env var
-- Removed search_path = herbylab override in connection pool's configure hook
-- Multiple container rebuilds with --no-cache to defeat image caching
-
-If this artifact lands successfully, six iterations of architectural debugging culminated in a working vault MCP write surface.
-
-## Key Learnings
-
-When debugging MCP integration paths, work upward through the stack systematically:
-1. MCP transport (auth + tool dispatch)
-2. Wrapper layer (param translation + delegation target)
-3. Env config (every env var referenced by every code path)
-4. Database state (schemas, roles, search_path defaults)
-5. Code-level overrides (session-level SET commands, SQLAlchemy connect_args, hardcoded schema names in MetaData)
-
-Issues at any layer can mask issues at another. The "rebuild fixed it" theory was tempting at each step but only the layer 5 fix actually unblocked the write.
-
-## Follow-ons
-
-- [ ] Worker verifies wiki.artifacts row exists for this entry with correct schema
-- [ ] Worker verifies public.embeddings has chunked rows with source_schema='wiki', source_table='artifacts' (or 'notes', depending on routing)
-- [ ] Worker confirms chunk_text non-NULL and chunk_token_count ≤ 512
-- [ ] If success: vault MCP write surface considered operational end-to-end
-- [ ] Address the three out-of-scope items the worker flagged: tests/conftest.py:59 search_path SET, alembic/env.py:41 SCHEMA constant, HERBYLAB_DATABASE_URL env var name

Sources/Homelab/2026-05-17-vault-push-final-verification-2026-05-16.md

@@ -1,30 +0,0 @@
----
-created: '2026-05-17'
-path: Sources/Homelab
-project: postgres-consolidation-reflection-layer
-tags:
-- mcp
-- automation
-- git
-type: session-notes
----
-
-## Outcome
-
-Final-final verification of the vault MCP push path after fixing the git config parser semicolon trap (commit cd3c88f). If this returns pushed: true, the queued b578f458 plus this new commit should both land on origin, closing out the full end-to-end write surface debugging chain that started with the create_artifact body/content error.
-
-## Topics Covered
-
-The semicolon trap: git config values treat `;` as comment delimiter unless the entire value is wrapped in double quotes. Inner `"..."` quotes get stripped by the parser as inline quoted segments. So the f-string helper `!f() { echo "username=lovebug"; echo "password=$VAULT_PUSH_TOKEN"; }; f` got stored as `!f() { echo username=lovebug` — unterminated function, no credentials returned, push fails with "could not read Username".
-
-Fix is one line: rewrite the helper as `!echo username=$VAULT_PUSH_USER && echo password=$VAULT_PUSH_TOKEN`. No semicolons, no inner quotes, `&&` isn't special to git config.
-
-## Key Learnings
-
-Git config has its own mini-parser separate from how shells interpret quoting. `;` is a comment delimiter in config values. `"..."` quotes get stripped (their contents kept). Always validate the parsed form, not just the string you wrote.
-
-## Follow-ons
-
-- [ ] If pushed: true: vault write surface complete end-to-end
-- [ ] If pushed: false: collect the actual git push error from the new container logs
-- [ ] Wrap session — major architectural debugging chain closed

Sources/Homelab/2026-05-17-vault-push-token-fix-verification-2026-05-16.md

@@ -1,27 +0,0 @@
----
-created: '2026-05-17'
-path: Sources/Homelab
-project: postgres-consolidation-reflection-layer
-tags:
-- mcp
-- automation
-- git
-type: session-notes
----
-
-## Outcome
-
-Retesting after Travis corrected the gitea PAT in `.env`. The previous failures were not a code issue — the helper wiring was correct, gitea was returning "Authentication failed" because the wrong token was in env. If this returns `pushed: true`, the queued commits (`b578f458`, `ca2c8e93`) plus this new one should all land on origin.
-
-## Topics Covered
-
-The full debugging chain ended at the cheapest possible bug: wrong env value. All the architectural fixes (HTTPS URL rewrite, credential helper, semicolon trap fix) were correct. The thing that was actually broken was the token itself.
-
-## Key Learnings
-
-When a credential helper says "Authentication failed" and the wiring is verifiable, check the credential value FIRST before assuming code issues. `curl -u "user:$TOKEN" https://gitea/api/v1/user` is a 5-second test.
-
-## Follow-ons
-
-- [ ] If pushed: true, close out the vault push fix completely
-- [ ] Mark the architectural debugging chain done

Sources/Homelab/2026-05-17-vault-push-verification-2026-05-16.md

@@ -1,31 +0,0 @@
----
-created: '2026-05-17'
-path: Sources/Homelab
-project: postgres-consolidation-reflection-layer
-tags:
-- mcp
-- automation
-- git
-type: session-notes
----
-
-## Outcome
-
-Final verification of the vault MCP write path after wiring `VAULT_PUSH_TOKEN` + `VAULT_GIT_HTTPS_URL` and rewriting the vault repo's origin to HTTPS at first push. If this artifact returns `pushed: true`, the end-to-end write surface (filesystem + git commit + git push + Postgres dual-write + chunked embeddings) is operational.
-
-## Topics Covered
-
-The full push fix:
-- gitea PAT generated for lovebug user with write:repository scope
-- VAULT_PUSH_TOKEN + VAULT_GIT_HTTPS_URL added to deployed .env
-- `_ensure_https_remote` helper in git_writer.py rewrites origin URL + configures credential.helper on first push
-- Credential helper reads $VAULT_PUSH_TOKEN at push time — token never lands in .git/config
-
-## Key Learnings
-
-The credential helper pattern keeps the secret out of any persisted file while still letting git push work non-interactively. The helper string in .git/config is just the recipe (`!f() { echo "username=..."; echo "password=$VAULT_PUSH_TOKEN"; }; f`); the env var resolves at runtime.
-
-## Follow-ons
-
-- [ ] If pushed: true: vault MCP write surface complete, the previous pending commit (5fb0ce2) plus this new one should both be on origin
-- [ ] If pushed: false: surface the actual git push error from vault container logs