The SkanAG Azure DevOps PAT is already saved for the host user ax_julian in /home/ax_julian/.azure/azuredevops/personalAccessTokens (mode 0600). Run Azure DevOps commands as ax_julian. Codex shell commands may run as root, whose Azure credential home is different. An authentication error from a root-run az devops command does not establish that the PAT is missing or expired.
Read-only check from a root-run session:
runuser -u ax_julian -- az devops project show \
--organization https://dev.azure.com/SkanAG \
--project AI-Platform --query '{name:name,state:state}' -o json
As of 2026-09-29 this returned AI-Platform / wellFormed. A separate read-only REST call using the stored PAT returned HTTP 200. Do not print, paste, log, or copy the token into a repository.
TheWell-Backend and TheWell-Frontend have a repository-local Git credential helper at /home/ax_julian/.local/bin/azure-devops-git-credential and credential.useHttpPath=true. The helper reads the existing PAT only for HTTPS URLs under dev.azure.com/SkanAG/AI-Platform/_git/, only when run as ax_julian. It does not create another token or write credentials to Git config. From a root-run session, use:
cd /home/ax_julian/TheWell-Backend
runuser -u ax_julian -- env GIT_TERMINAL_PROMPT=0 git ls-remote origin refs/heads/dev
The same command works in TheWell-Frontend. If another AI-Platform checkout needs Git access, configure its local credential.helper to that executable and credential.useHttpPath=true; keep the remote URL free of token values. The helper source is maintained in ProfileBackups/ax_julian/host/bin/azure-devops-git-credential.
az devops as root: wrong user's credential store. Run as ax_julian before diagnosing token validity.git password prompt or could not read Password: that checkout has no applicable credential helper, even when the Azure DevOps CLI PAT works. Configure the local helper above.AADSTS50173 from az account get-access-token: the cached Microsoft Entra sign-in grant was revoked. This does not invalidate an independently verified Azure DevOps PAT.If the PAT itself fails a read-only Azure DevOps call, rotate it under SkanAG Azure DevOps user settings and run az devops login --organization https://dev.azure.com/SkanAG as ax_julian, entering the token at the interactive prompt. Do not send it in chat or put it on a command line. The tenant has device authentication disabled; use browser interaction for Microsoft Entra sign-in when that separate identity is needed.
Verified 2026-09-29: existing PAT reads AI-Platform; Git reads DEV refs in both TheWell repositories through the helper. Owner: ax_julian host administrator. The token remains in the existing restricted Azure DevOps CLI store; the helper stores no secret. Recheck read access and expiration when authentication later changes.