[2026-05-14] personal-os-sync-pipeline: add token management section

wiki/personal-os-sync-pipeline.md

@@ -78,13 +78,28 @@ UPDATE sync_state SET cursor = null, full_sync_at = null WHERE key = 'my_tasks';
 ```
 Then run `node sync.js`.
 
+## Token Management
+
+`ASANA_API_KEY` lives in two places — both must be in sync:
+- `~/.zprofile` — source of truth (`export ASANA_API_KEY="..."`)
+- `~/.config/personal-os/env` — loaded by `run-pipeline.sh` via `. ~/.config/personal-os/env`
+
+If the token is rotated in Asana, update `.zprofile` first, then sync to env:
+```bash
+NEW_TOKEN=$(grep ASANA_API_KEY ~/.zprofile | sed 's/export ASANA_API_KEY="//;s/"//');
+echo "export ASANA_API_KEY=$NEW_TOKEN" > ~/.config/personal-os/env
+```
+Verify: `curl -s -o /dev/null -w "%{http_code}" "https://app.asana.com/api/1.0/users/me" -H "Authorization: Bearer $NEW_TOKEN"` → should return `200`.
+
+Symptom of stale token: `data-pipeline` and `inbox-check` cron jobs get paused (Hermes auto-pauses on repeated failures), `status.md` stops updating.
+
 ## Files
 
 - `~/Developer/personal-os/sync.js` — main sync script
 - `~/Developer/personal-os/generate-status.js` — status generation
 - `~/Developer/personal-os/asana.js` — thin Asana API client
 - `~/Developer/personal-os/config.json` — workspace GID, user GID, section GIDs
-- `~/.config/personal-os/env` — ASANA_API_KEY, POSTGRES_URL
+- `~/.config/personal-os/env` — ASANA_API_KEY (sync from .zprofile when rotating)
 
 ## Related