From f50a6e76ee582341d031b2bdce732be7f494db59 Mon Sep 17 00:00:00 2001
From: Alexey Martemyanov <mallexxx@gmail.com>
Date: Thu, 14 May 2026 14:03:36 +0600
Subject: [PATCH] [2026-05-14] personal-os-sync-pipeline: add token management
 section

---
 wiki/personal-os-sync-pipeline.md | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/wiki/personal-os-sync-pipeline.md b/wiki/personal-os-sync-pipeline.md
index 590ce9c9..938e9a73 100644
--- a/wiki/personal-os-sync-pipeline.md
+++ b/wiki/personal-os-sync-pipeline.md
@@ -78,13 +78,28 @@ UPDATE sync_state SET cursor = null, full_sync_at = null WHERE key = 'my_tasks';
 ```
 Then run `node sync.js`.
 
+## Token Management
+
+`ASANA_API_KEY` lives in two places — both must be in sync:
+- `~/.zprofile` — source of truth (`export ASANA_API_KEY="..."`)
+- `~/.config/personal-os/env` — loaded by `run-pipeline.sh` via `. ~/.config/personal-os/env`
+
+If the token is rotated in Asana, update `.zprofile` first, then sync to env:
+```bash
+NEW_TOKEN=$(grep ASANA_API_KEY ~/.zprofile | sed 's/export ASANA_API_KEY="//;s/"//');
+echo "export ASANA_API_KEY=$NEW_TOKEN" > ~/.config/personal-os/env
+```
+Verify: `curl -s -o /dev/null -w "%{http_code}" "https://app.asana.com/api/1.0/users/me" -H "Authorization: Bearer $NEW_TOKEN"` → should return `200`.
+
+Symptom of stale token: `data-pipeline` and `inbox-check` cron jobs get paused (Hermes auto-pauses on repeated failures), `status.md` stops updating.
+
 ## Files
 
 - `~/Developer/personal-os/sync.js` — main sync script
 - `~/Developer/personal-os/generate-status.js` — status generation
 - `~/Developer/personal-os/asana.js` — thin Asana API client
 - `~/Developer/personal-os/config.json` — workspace GID, user GID, section GIDs
-- `~/.config/personal-os/env` — ASANA_API_KEY, POSTGRES_URL
+- `~/.config/personal-os/env` — ASANA_API_KEY (sync from .zprofile when rotating)
 
 ## Related