---
created: '2026-05-17'
path: Sources/Homelab
project: postgres-consolidation-reflection-layer
tags:
- mcp
- automation
- git
type: session-notes
---

## Outcome

Final verification of the vault MCP write path after wiring `VAULT_PUSH_TOKEN` + `VAULT_GIT_HTTPS_URL` and rewriting the vault repo's origin to HTTPS at first push. If this artifact returns `pushed: true`, the end-to-end write surface (filesystem + git commit + git push + Postgres dual-write + chunked embeddings) is operational.

## Topics Covered

The full push fix:
- gitea PAT generated for lovebug user with write:repository scope
- VAULT_PUSH_TOKEN + VAULT_GIT_HTTPS_URL added to deployed .env
- `_ensure_https_remote` helper in git_writer.py rewrites origin URL + configures credential.helper on first push
- Credential helper reads $VAULT_PUSH_TOKEN at push time — token never lands in .git/config

## Key Learnings

The credential helper pattern keeps the secret out of any persisted file while still letting git push work non-interactively. The helper string in .git/config is just the recipe (`!f() { echo "username=..."; echo "password=$VAULT_PUSH_TOKEN"; }; f`); the env var resolves at runtime.

## Follow-ons

- [ ] If pushed: true: vault MCP write surface complete, the previous pending commit (5fb0ce2) plus this new one should both be on origin
- [ ] If pushed: false: surface the actual git push error from vault container logs