# PR#86: The Secrets of the Coding Agents Have One Place

> **WARNING:** This document describes only the change applied in this PR.
> It may already be outdated once the next PR is merged.
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

## Problem

The secrets of the coding agents moved on 2026-10-07 from `~/.config/pr-agent-test/secrets.env`
to `~/.config/ai-coding-agents/secrets.env`; the old path is a symlink since then.
`docs/agentic-workflow.md` names the new path, but `docs/betrieb-git.javagil.de.md` still names the old one,
also for the backups of the branch protection rules.

On 2026-10-11 the token of `ai-reviewer` reached the transcript of a coding session.
The operations guide does not say how to replace that token.

## Non-Goals

- No change of werkrevisor's code or configuration.

## Solution

- `docs/betrieb-git.javagil.de.md` names `~/.config/ai-coding-agents/secrets.env`
  and `~/.config/ai-coding-agents/backups/` for the backups of the branch protection rules.
- The table of secrets names the machine configs of all reviewed repositories as place of `GITEA_BOT_TOKEN`,
  instead of the one of werkprobe.
- A new section says how to replace the token of `ai-reviewer`.
- Werkbaum: `#ops.secrets` and `#ops.rotate`; `#ops.basecommit` is deployed.
- Version 0.32.12.

## Open Questions

None.

## Additional Changes

Done outside the repository, so not part of the diff:

- On the workstation, `taiga.refresh` and the backups moved to the new directory, `~/bin/taiga` reads the new path,
  and the symlink and the directory `~/.config/pr-agent-test/` are gone.
  No `origin/main` of the repositories under `~/Projekte` names the old path any more.
- The token of `ai-reviewer` was replaced as the new section says:
  in `secrets.env` and the five machine configs on mih09; the old token is revoked and answers HTTP 401.
  The 120 older backups of the machine configs on mih09 hold the new token too, so a rollback still works.