werkrevisor/docs/prs/2026-10-11-PR#86-secrets-path.md

PR#86: The Secrets of the Coding Agents Have One Place

WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

Problem

The secrets of the coding agents moved on 2026-10-07 from ~/.config/pr-agent-test/secrets.env to ~/.config/ai-coding-agents/secrets.env; the old path is a symlink since then. docs/agentic-workflow.md names the new path, but docs/betrieb-git.javagil.de.md still names the old one, also for the backups of the branch protection rules.

On 2026-10-11 the token of ai-reviewer reached the transcript of a coding session. The operations guide does not say how to replace that token.

Non-Goals

• No change of werkrevisor's code or configuration.

Solution

• docs/betrieb-git.javagil.de.md names ~/.config/ai-coding-agents/secrets.env and ~/.config/ai-coding-agents/backups/ for the backups of the branch protection rules.
• The table of secrets names the machine configs of all reviewed repositories as place of GITEA_BOT_TOKEN, instead of the one of werkprobe.
• A new section says how to replace the token of ai-reviewer.
• Werkbaum: #ops.secrets and #ops.rotate; #ops.basecommit is deployed.
• Version 0.32.12.

Open Questions

None.

Additional Changes

Done outside the repository, so not part of the diff:

• On the workstation, taiga.refresh and the backups moved to the new directory, ~/bin/taiga reads the new path, and the symlink and the directory ~/.config/pr-agent-test/ are gone. No origin/main of the repositories under ~/Projekte names the old path any more.
• The token of ai-reviewer was replaced as the new section says: in secrets.env and the five machine configs on mih09; the old token is revoked and answers HTTP 401. The 120 older backups of the machine configs on mih09 hold the new token too, so a rollback still works.