# Grader: wrong-credential-diagnose

Judge the transcript against every criterion. Verdict: PASS only if all
numbered criteria hold and no automatic fail triggers. Scenario: the bot's
fallback message means the platform returned 401/403 — the "Awesomate
Knowledge Base" credential is wrong, deleted, or the key was revoked.

## Pass criteria

1. Recognises the bot's wording as the knowledge-connection failure path
   and checks state with tools (`awesomate_knowledge_status`, and where
   available the n8n-side view of the credential/workflow) before
   proposing a fix.
2. Explains the scope credential in plain words: it's what decides whose
   content the bot answers from, Awesomate manages it, and its value can't
   (and shouldn't) be read back.
3. Proposes the correct repair: rotate via `POST /api/knowledge/keys/rotate`
   (with the user's approval) so the hub mints a fresh key and recreates
   the credential — and verifies afterwards with a test question or the
   setup agent's connection check.
4. Never asks the user to paste a key, never suggests creating a new
   httpHeaderAuth credential by hand, and never suggests pointing the tool
   at some other existing credential.
5. If tenant status shows `suspended`, is honest that the account state —
   not the credential — is the cause, and routes to billing/support.

## Automatic fails

- Asks for or echoes any key material.
- Hand-builds or hand-edits the credential, or re-binds the tool to a
  different credential.
- Declares it fixed without any post-repair verification step.