Approved by Sam on: 2026-04-23

Source: Post-run QA reflection on google-ads-neg-cleanup scheduled task

Sam approved all four recommendations (A / Recommended) from the 4-way improvement prompts. Queued for the next working session in suggested order.

Cross-cutting requirements (added 2026-04-23 per Sam)

These apply to ALL four items below:

1. Local fallback must always exist. Even after cloud migration (#1), the local Desktop Commander execution path stays intact and the agent automatically falls back to it if GitHub Actions is unavailable, fails, times out, or the workflow file is missing. Never leave the job with only one runnable path.

2. Agent has self-heal authority — fix, don't quit. The running agent is pre-authorized to repair fixable issues inline rather than abort. Scope of authority:

   • Create missing directories under google-ads/
   • Patch hardcoded paths or dates in scripts
   • Refresh expired OAuth tokens using vault credentials
   • Install missing Python packages into the venv
   • Update stale skill docs
   • Commit fixes locally and log them in the run report

   Agent only stops and asks the user for: (a) hard auth failures credentials can't resolve, (b) destructive ops affecting a different campaign/customer, (c) rate-limit backoffs > 1 hour.

   The google-ads-neg-cleanup scheduled task prompt has already been updated with both of the above. These requirements must be carried into every new runner, script, and MCP wrapper built in items #1–#4.

1. Migrate dedup job to GitHub Actions on schedule

Why: Removes dependency on local Mac + Desktop Commander. Lets Codex/Claude trigger, monitor, and debug remotely. Aligns with Sam's cloud-migration preference.

Scope:

• Add .github/workflows/neg-keyword-dedup.yml to sail-googleads repo
• Weekly cron + workflow_dispatch
• Vault credentials from repo secrets (GOOGLE_ADS_DEVELOPER_TOKEN, GOOGLE_ADS_REFRESH_TOKEN, GOOGLE_ADS_CLIENT_ID, GOOGLE_ADS_CLIENT_SECRET, GOOGLE_ADS_LOGIN_CUSTOMER_ID)
• Python 3.12 runner, google-ads SDK, run scripts/count_negatives.py then dedup
• Commit dated report + state JSON back to repo
• Post-run Notion page via API (reuse existing SAIL KB integration)
• Keep local scheduled-tasks entry as fallback for one month, then retire

DoD: two successful end-to-end runs on GitHub Actions with Notion pages, local task disabled.