Fourth straight day the daily Google Ads campaign-health pull is dark for the same reason: the OAuth refresh token in .credentials/vault.env is revoked at Google's end. Vault mtime has not advanced since 2026-04-28 04:12 UTC. Refresh token still has prefix 1//05BEq.... OAuth pre-flight returns 400 invalid_grant: Token has been expired or revoked. in <1 second.
Vault hook prevents Claude from writing the new token in for Sam. Sam must rotate the token himself by running generate_refresh_token.py (path: Repos/sail-googleads/generate_refresh_token.py) and pasting the new value into .credentials/vault.env.
Auto-pause-on-compromise guardrail has been dark for 96+ hours. API unreachable means budget/locale/lang/email tampering cannot be detected. If Sam's account had been compromised over the long weekend, this scheduler would have been incapable of detecting it.
POST <https://oauth2.googleapis.com/token>
client_id=765903... (len 71)
client_secret=... (len 35)
refresh_token=1//05B... (len 103)
grant_type=refresh_token
Response: HTTP 400
{"error": "invalid_grant", "error_description": "Token has been expired or revoked."}
| Campaign ID | Name | Last 7d cost | Conv | CPA | Live flags |
|---|---|---|---|---|---|
| --- | --- | ---: | ---: | ---: | --- |
| 23723841732 | a - SAIL - Car Accidents 2026 | $920.93 | 1 | $920.93 | high: 4-day zero-conv streak; med: budget IS lost 27.4%; med: rank IS lost 30.6% |
| 23729092958 | a - SAIL - Accidentes (Spanish) 2026 | $1,839.10 | 5 | $367.82 | high: CPC spike +499.5% WoW; med: budget IS lost 30.7% |
| 23729092712 | a - SAIL - Brand Protection 2026 | $184.80 | 6 | $30.80 | high: CPC spike +50.5%; med: budget IS lost 55.1% |
If Car Accidents primary's zero-conv streak continued at the same tempo, weekly spend with effectively no conversions could now exceed $2,500–$3,000.
Q1 — Token rotation path (PRIMARY BLOCKER)
generate_refresh_token.py now, pastes new GOOGLE_ADS_REFRESH_TOKEN into vault, re-runs the task. Restores all 5 daily Google Ads tasks.SAIL_GOOGLE_ADS_REFRESH_TOKEN for cloud runner today; leave Mac vault as-is.Q2 — Compromise-guardrail coverage during dark windows