Broker OP_SERVICE_ACCOUNT_TOKEN deleted — finance credential lane blocked

[chitcommit]

Summary

The broker's 1Password service account is deleted. OP_SERVICE_ACCOUNT_TOKEN returns (403) Forbidden (Service Account Deleted) on every read. This blocks the entire ChittyFinance/Mercury credential lane — no cold-source reads, no secret propagation, no fan-out.

This is a re-confirmation (same session, later check) of the root blocker captured in the prior diagnosis. The operator was previously asked to re-issue the service account; as of this check it has NOT been restored. Filing per the fail-closed protocol instead of re-routing a credential paste request back to the operator.

Live evidence (2026-06-10, read-only)

• op vault list (service-account path, Connect unset): (403) Forbidden (Service Account Deleted): The Service Account used in this integration has been deleted.
• Connect fallback token reaches only 2 vaults: ChittyOS-Core (oxwo63jlcbo66c7kwx67lquw4i) + ChittyOS (pdn5ncm6ozne24gjsrl6sy3ju4). JWT vts claim confirms 2 vault grants.
• ChittyMCP finance_list_entities → password authentication failed for user 'neondb_owner' (consumer chittyagent-finance still down).

Vaults required but UNREACHABLE under current Connect token

• synthetic-shared — holds cold NEON DSN (DATABASE_URL / NEON_DB_CHITTYFINANCE) for the finance Neon restore
• Connect Serv - Production — authoritative MERCURY_API_KEYS
• Claude-Code Tools — dev copy of Mercury keys

Requested fix (OPERATOR action — 1Password admin console only)

Re-issue OP_SERVICE_ACCOUNT_TOKEN for the broker, scoped to read on:
synthetic-shared, Connect Serv - Production, ChittyOS-Core, ChittyOS, Claude-Code Tools.
Then update the broker env (OP_SERVICE_ACCOUNT_TOKEN) — do not paste the token into chat.

Blocked downstream work (resumes once token restored)

1. NEON restore — re-provision chittyagent-finance NEON_DATABASE_URL from cold (op://synthetic-shared/DATABASE_URL/credential, fallback op://synthetic-shared/NEON_DB_CHITTYFINANCE/credential) via op run / provisioner. Pre-check: live host must resolve to solitary-rice-14149088 us-west-2 before any reset (neondb_owner is the default owner in every Neon project — a blind reset elsewhere is destructive). Also check second worker chittyfinance (secret DATABASE_URL) for same drift.
2. Mercury mapping — read MERCURY_API_KEYS field labels from Connect Serv - Production (authoritative) vs Claude-Code Tools (dev). Produce label→slug table; identify which 3 of 7 businesses are missing (4 deployed: ARIBIA, CHICAGO_FURNISHED, CHITTY_SERVICES, IT_CAN_BE + generic MERCURY_API_TOKEN). Fan out missing keys via op run + wrangler secret put --env production.
3. Session 401s — re-check whether memory/PolicyBundle 401s share this root cause once Neon is restored.

References

• Prior diagnosis (durable): /home/ubuntu/.ops/credential-lane-diagnosis-2026-06-10.md
• Related: ops: 1Password Connect token is read-only — blocks chico-keys from mirroring chittyregister secrets to cold store #244 (Connect token read-only), secret_bind path blocked: orchestrator→connect 401 + SA scope gap + Tailscale SSH gap #239 (SA scope gap + 401), 1Password op://ChittyOS/chittyconnect-prod credential field is empty — next rotation will fail #220 (chittyconnect-prod credential field empty), CL proxy blocked: ChittyOS-Integrations vault not accessible to Connect token #232 (vault-not-accessible pattern)

🤖 Generated with Claude Code

[chitcommit]

Security note — active OP_CONNECT_TOKEN inadvertently emitted to session output

During Step 0 diagnosis, a debug echo using the ${VAR:+YES}${VAR:-NO} idiom unintentionally printed full env values to the session transcript — including the active OP_CONNECT_TOKEN (it was successfully used against GET /v1/vaults this session) and the already-deleted OP_SERVICE_ACCOUNT_TOKEN.

Recommend: rotate the 1Password Connect token/credential alongside the OP_SERVICE_ACCOUNT_TOKEN re-issue. The deleted SA token is inert; the Connect token is live and should be treated as exposed.

This is a 1Password admin-console action (operator-only) — no credential value needs to be pasted into chat.