Account: Sam Aguiar Injury Lawyers (3813916687) under MCC 8676599345

Mode: READ-ONLY by force; no mutations possible. Auto-pause-on-compromise guardrail DISABLED (API unreachable).

Window targeted: Last 7 = 2026-04-24 → 2026-04-30 vs prior 7 = 2026-04-17 → 2026-04-23.

Outcome: BLOCKED-ENV (5th consecutive day). OAuth refresh token still rejected: invalid_grant: Token has been expired or revoked.

TL;DR

Day 5 of the same blocker. The GOOGLE_ADS_REFRESH_TOKEN in .credentials/vault.env is still the same revoked token (1//05BEqrn7OFJT… prefix, length 103) that was rejected on 04-26, 04-27, 04-28, 04-29, and 04-30. Vault file mtime moved to 2026-04-30 10:15 (Sam touched the file yesterday) but the refresh token value itself did not change. Network path, MCC override, dev token, client id/secret are all fine. This is a credential rotation issue that only Sam can complete (vault writes are blocked for Claude per CLAUDE.md).

Status table

Check Status Note
Vault present PASS mtime 2026-04-30 10:15
Refresh token rotated since 04-25 FAIL Same 1//05BEqrn7OFJT… prefix; len 103
OAuth pre-flight self-test FAIL invalid_grant: Token has been expired or revoked.
GAQL pull NOT RUN blocked on auth
Compromise-detection guardrail DISABLED API unreachable
Cloud-runner credential set (SAIL_GOOGLE_ADS_REFRESH_TOKEN) MISSING Cloud cutover still single-pointed on Mac vault

OAuth pre-flight result (today)

[07:18:52] start campaign-health
[07:18:52] customer=3813916687 login=8676599345
[07:18:52] last_7=2026-04-24..2026-04-30 prior_7=2026-04-17..2026-04-23
[07:18:52] ERROR build_client: ('invalid_grant: Token has been expired or revoked.', ...)

Carry-forward state from last good pull (2026-04-24, now 7 days stale)

Campaign Status 04-24 cost Conv CPA Live flags
--- --- ---: ---: ---: ---
23723841732 a - SAIL - Car Accidents 2026 ENABLED $920.93 1.0 $920.93 high: 4-day zero-conv streak; med: budget IS lost 27.4%; med: rank IS lost 30.6%
23729092958 a - SAIL - Accidentes (Spanish) 2026 ENABLED $1,839.10 5.0 $367.82 high: CPC spike +499.5% WoW; med: budget IS lost 30.7%; med: rank IS lost 20.2%
23729092712 a - SAIL - Brand Protection 2026 ENABLED $184.80 6.0 $30.80 high: CPC spike +50.5% WoW; med: budget IS lost 55.1%; med: rank IS lost 27.5%

If the Car Accidents primary continued at the 04-24 tempo, plausible weekly waste is $2,800–$3,400 at zero or near-zero conversions. Cannot confirm without API.

Recommendations queued for the moment auth is restored

  1. Rotate GOOGLE_ADS_REFRESH_TOKEN in vault.env AND google-ads.yaml. Step-by-step in the local report at /Users/samaguiar/Documents/Codex/google-ads/campaign-health/2026-05-01.md.
  2. Pull live snapshot immediately after rotation.
  3. Compromise audit on first live pull (geo, language, daily budgets, account email vs 04-24 baseline).
  4. Pause Car Accidents 2026 if zero-conv streak ≥ 7 days AND WoW conv ≤ 1.
  5. Raise Brand Protection daily budget +25-40% until budget-lost IS < 10% (highest-ROI dollar in the account).
  6. Investigate Spanish CPC spike ($6.26 → $37.53 WoW). Pull bidding-strategy history + auction insights + QS.