Add kaggle/KAGGLE_SETUP.md

kaggle/KAGGLE_SETUP.md

@@ -5,20 +5,20 @@
 - **Internet:** On
 - **Language:** Python
 
-## 2. Secrets (Add-ons → Secrets → Attach to notebook)
-| Secret name | Value |
-|-------------|--------|
-| `HF_TOKEN` | same as local `.env` |
-| `WANDB_API_KEY` | same as local `.env` |
-| `LANGFUSE_PUBLIC_KEY` | same as local `.env` |
-| `LANGFUSE_SECRET_KEY` | same as local `.env` |
-| `LANGFUSE_HOST` | `https://cloud.langfuse.com` (optional) |
+## 2. Secrets (API path — recommended)
 
-Kaggle does **not** allow uploading secrets via API from this machine — paste once in the UI.
+Kaggle **cannot** create/attach User Secrets via API. We use a **private dataset** instead:
 
-**Attach toggles:** After creating each secret, open the notebook’s Secrets panel and ensure the **switch is ON** next to every label. Creating a secret without attaching it causes `HTTP Error 400` / `ConnectionError` on `get_secret`.
+```bash
+python scripts/push_kaggle_secrets_dataset.py   # uploads saqlain22/deepagents-rl-secrets (private)
+kaggle kernels push -p notebooks/               # attaches it via dataset_sources + enable_gpu
+```
+
+Notebook loads `/kaggle/input/.../secrets.json` first, then falls back to Add-ons → Secrets if present.
+
+**Do not** make `deepagents-rl-secrets` public.
 
-**OpenTelemetry / google-adk warnings:** The notebook uninstalls `google-adk` (unused). Safe to ignore if you still see a residual pip conflict message after that.
+**OpenTelemetry / google-adk warnings:** Notebook uninstalls unused `google-adk`.
 
 ## 3. Checkpoint / observability contract
 Every `save_steps` (default 5):