Measurement setup: the one-time grants only Rafael can make

What it is: the click-by-click checklist that arms Google Search Console data in the weekly search report. Persona scenario: Monday morning, the weekly report lands in Slack; today its Google section says "unmeasured". Twenty minutes on this page and next Monday it says clicks, impressions, and average position for every article.

Current state (2026-09-03)

Done: GSC property verified by DNS TXT. GA4 tag live on the site (G-ZX4LWWWLJL). Bing reached via IndexNow on every publish. Weekly report runs without Google data (rankings via DataForSEO, live status, AI answer checks).

Waiting on you: the sitemap submission. Search Console API access is done; see Part 1.

Corrected 7 September 2026

Parts 1 and 2 used to describe a dedicated service account named gsc-weekly-report and a key file at /home/claude/.astrarad-gsc-sa.json. Neither was ever created. What actually happened is that the booking card's service account was reused, and it works. The old instructions are replaced below rather than left standing beside the truth.

Part 1: Service account (done, nothing to do)

Search Console is read by the same service account the booking card uses:

Account: booking-card@astrarad-505911.iam.gserviceaccount.com in project astrarad-505911.
Key on this server: /home/claude/.secrets/astrarad-booking-card.json, mode 640.
How the report finds it: GSC_SERVICE_ACCOUNT_JSON in ~/.env holds the path to that file, not the JSON. seo/weekly-search-report.py is the only reader; it arms itself when the path exists and prints "unarmed" when it does not.
Access: granted on sc-domain:astrarad.com as siteFullUser. Verified again on 7 September 2026, after the Google Workspace tenant move, and it survived: Search Console permissions are granted on the property, not inside the Workspace.

One key does two jobs. Rotating booking-card breaks the booking card and the weekly search report at the same time. If you ever want them separated, mint a second account then and repoint GSC_SERVICE_ACCOUNT_JSON; do not rotate the shared one without expecting both to stop.

Part 2: Grant it access in Search Console (done)

Open search.google.com/search-console, pick the astrarad.com property.
Settings, then Users and permissions. booking-card@astrarad-505911.iam.gserviceaccount.com is listed with Full permission. Nothing to add.

Part 3: Submit the sitemap (1 minute, overdue)

In the same property: Sitemaps (left menu), enter sitemap.xml, Submit. This has never been done; Google currently discovers pages only by crawling.

Part 4: Bing Webmaster Tools (optional, 5 minutes)

Bing Webmaster Tools is the only free view of Copilot AI citations. Open bing.com/webmasters, choose Import from Google Search Console after Part 2, or verify by DNS like Google. IndexNow already feeds Bing on every publish, so this is reporting access only.

What happens after

The Monday 07:30 weekly report (Slack #development-status) gains: clicks, impressions, CTR, and average position for the last 7 and 28 days, plus per-article rows for the 40-keyword batch. No code change and no restart needed; the script checks for the key file on every run.