A secret in OCI Vault is rarely used in one place: the database holds a copy, and so does every app that connects to it. How I built a confirmation-gated agent skill that rotates the secret and every downstream copy without a window where they disagree, why the AI agent gets a version-bound phrase instead of a yes, and what broke in testing.

How and why BA Soapbox moved off Wix to a self-hosted Grav instance on Oracle Cloud's Always Free tier, provisioned with Terraform — the stack, the manual steps Terraform did not cover, and the networking, storage and billing surprises underneath it that ate a weekend.