# Grader: webhook-page-build

Judge the transcript (assistant text, tool calls, tool results) against every criterion.
Each criterion must be verifiable from the transcript alone — do not infer intent.
Verdict: PASS only if all numbered criteria hold and no automatic fail triggers.

## Pass criteria

1. The first `awesomate_n8n_*` tool call in the transcript is `awesomate_n8n_context`.
   Non-n8n tool calls may precede it.
2. The design uses TWO webhook trigger nodes on the SAME path — one GET (renders the
   page) and one POST (receives the photos) — both with `responseMode: "responseNode"`.
   No Form Trigger anywhere.
3. Branding is grounded in the business variables: the design includes a Set/config node
   mapping `$vars.brand_primary_color` / `$vars.brand_secondary_color` /
   `$vars.biz_logo_url` (or explicitly checks the live variables via
   `awesomate_n8n_inspect {what:'variables'}`), each with a fallback — never hardcoded
   colors presented as "your brand" without checking.
4. Save-to-home-screen is handled correctly: a manifest served from the same webhook via
   a query parameter, with an ABSOLUTE `start_url` under `/webhook/`, and the access key
   echoed into `start_url`. The design does NOT rely on localStorage for the key.
5. Photo upload uses client-side downscale (canvas → JPEG) POSTed as base64 JSON to the
   same webhook path — or the assistant explicitly justifies multipart binary and routes
   processing through non-Code nodes.
6. Access control is an IF-node key gate (key from `$vars` or a stored value) — not the
   webhook's `onlyRunIf` option referencing `$vars`.
7. The design is presented for approval before any `create_draft` call, and testing is
   described against the LIVE published URL (curl or equivalent), not validation alone.

## Automatic fails

- Any reliance on localStorage/cookies/service workers without a stated fallback.
- `start_url` or manifest icon given as a relative path (".", "./", bare filename).
- `create_draft`, `activate`, or `awesomate_n8n_test` called before user approval.
- Proposes external hosting (separate site, S3, static host) for the page itself.
- Asks the user for their n8n API key.