Account: Sam Aguiar Injury Lawyers (3813916687) under MCC 8676599345
Mode: READ-ONLY by force; no mutations possible. Auto-pause-on-compromise guardrail DISABLED (API unreachable).
Window targeted: Last 7 = 2026-04-24 → 2026-04-30 vs prior 7 = 2026-04-17 → 2026-04-23.
Outcome: BLOCKED-ENV (5th consecutive day). OAuth refresh token still rejected: invalid_grant: Token has been expired or revoked.
Day 5 of the same blocker. The GOOGLE_ADS_REFRESH_TOKEN in .credentials/vault.env is still the same revoked token (1//05BEqrn7OFJT… prefix, length 103) that was rejected on 04-26, 04-27, 04-28, 04-29, and 04-30. Vault file mtime moved to 2026-04-30 10:15 (Sam touched the file yesterday) but the refresh token value itself did not change. Network path, MCC override, dev token, client id/secret are all fine. This is a credential rotation issue that only Sam can complete (vault writes are blocked for Claude per CLAUDE.md).
| Check | Status | Note |
|---|---|---|
| Vault present | PASS | mtime 2026-04-30 10:15 |
| Refresh token rotated since 04-25 | FAIL | Same 1//05BEqrn7OFJT… prefix; len 103 |
| OAuth pre-flight self-test | FAIL | invalid_grant: Token has been expired or revoked. |
| GAQL pull | NOT RUN | blocked on auth |
| Compromise-detection guardrail | DISABLED | API unreachable |
Cloud-runner credential set (SAIL_GOOGLE_ADS_REFRESH_TOKEN) |
MISSING | Cloud cutover still single-pointed on Mac vault |
[07:18:52] start campaign-health
[07:18:52] customer=3813916687 login=8676599345
[07:18:52] last_7=2026-04-24..2026-04-30 prior_7=2026-04-17..2026-04-23
[07:18:52] ERROR build_client: ('invalid_grant: Token has been expired or revoked.', ...)
| Campaign | Status | 04-24 cost | Conv | CPA | Live flags |
|---|---|---|---|---|---|
| --- | --- | ---: | ---: | ---: | --- |
| 23723841732 a - SAIL - Car Accidents 2026 | ENABLED | $920.93 | 1.0 | $920.93 | high: 4-day zero-conv streak; med: budget IS lost 27.4%; med: rank IS lost 30.6% |
| 23729092958 a - SAIL - Accidentes (Spanish) 2026 | ENABLED | $1,839.10 | 5.0 | $367.82 | high: CPC spike +499.5% WoW; med: budget IS lost 30.7%; med: rank IS lost 20.2% |
| 23729092712 a - SAIL - Brand Protection 2026 | ENABLED | $184.80 | 6.0 | $30.80 | high: CPC spike +50.5% WoW; med: budget IS lost 55.1%; med: rank IS lost 27.5% |
If the Car Accidents primary continued at the 04-24 tempo, plausible weekly waste is $2,800–$3,400 at zero or near-zero conversions. Cannot confirm without API.
GOOGLE_ADS_REFRESH_TOKEN in vault.env AND google-ads.yaml. Step-by-step in the local report at /Users/samaguiar/Documents/Codex/google-ads/campaign-health/2026-05-01.md.