diff --git a/.omp/AGENTS.md b/.omp/AGENTS.md
index c7be7d6..881f479 100644
--- a/.omp/AGENTS.md
+++ b/.omp/AGENTS.md
@@ -8,19 +8,15 @@
 
 ## Pushing to Gitea
 
-Credentials come from `rbw` (Bitwarden CLI) — no token in git config or any tracked file.
+Credentials come from `pass` — no token in git config or any tracked file.
 
-**rbw entry:** `api/gitea_token_AllExceptAdmin`
-
-> Note: the older `site_farsi` convention used `pass gitea/token_AllExceptAdmin`. That entry
-> exists but its GPG agent is not unlocked on this machine — `pass` blocks for ~60s and
-> returns empty. Use `rbw`.
+**Pass path:** `gitea/token_AllExceptAdmin`
 
 The credential helper is set locally in `.git/config` (never committed):
 
 ```
 credential.https://gitea.cap.nlogn.ir.helper=
-  !f() { echo username=fazel; echo password=$(rbw get "api/gitea_token_AllExceptAdmin" | head -1); }; f
+  !f() { echo username=fazel; echo password=$(pass gitea/token_AllExceptAdmin); }; f
 ```
 
 **Push command** (bypass proxy — Gitea is on the local network):
@@ -30,8 +26,34 @@ NO_PROXY="*" no_proxy="*" http_proxy="" https_proxy="" HTTP_PROXY="" HTTPS_PROXY
   git push gitea main
 ```
 
-If `rbw` is locked, `rbw unlock` first. To rotate: update in the Gitea UI, then
-`rbw edit "api/gitea_token_AllExceptAdmin"`. No git config change needed.
+### If `pass` returns an empty string
+
+The store is encrypted to `caci96@gmail.com`, whose secret key lives on an **OpenPGP
+smartcard** (`gpg --list-secret-keys --with-colons` shows serial `D276000124010304…`). When
+gpg-agent has no cached session and no pinentry can reach a terminal, `pass` blocks for ~60s
+and exits with empty stdout — it does *not* error. A credential helper wired to it then fails
+auth for no visible reason.
+
+Diagnose, do not guess:
+
+```bash
+export GPG_TTY=$(tty)
+gpg --batch --pinentry-mode error --decrypt ~/.password-store/gitea/token_AllExceptAdmin.gpg
+```
+
+Success means the agent is unlocked and `pass` will work. `Bad passphrase`/`No secret key`
+means insert the smartcard, or `export GPG_TTY=$(tty)` and re-run `pass` once interactively to
+satisfy pinentry.
+
+The same token is mirrored in `rbw` at `api/gitea_token_AllExceptAdmin` (verified
+byte-identical). It needs no smartcard, so it is the fallback when the card is unavailable:
+
+```
+!f() { echo username=fazel; echo password=$(rbw get "api/gitea_token_AllExceptAdmin" | head -1); }; f
+```
+
+To rotate: update in the Gitea UI, then `pass edit gitea/token_AllExceptAdmin` **and**
+`rbw edit "api/gitea_token_AllExceptAdmin"` so the two stay in sync. No git config change.
 
 ## What is NOT committed