diff --git a/playbooks/test-connection.yml b/playbooks/test-connection.yml
index 9bbedca..4a41c17 100644
--- a/playbooks/test-connection.yml
+++ b/playbooks/test-connection.yml
@@ -1,79 +1,72 @@
 ---
 # ============================================================================
-# test-connection.yml — diagnostic playbook (makes NO changes to any host)
-# ============================================================================
-# Confirms the Semaphore pipeline works end to end:
-#   1. Repo pulled OK over SSH  -> list files in the checked-out repo
-#   2. Infisical reachable + auth works -> login + read secret KEYS (not values)
-#
-# Runs entirely on the Semaphore runner (localhost). No target hosts touched.
-#
-# Requires (Semaphore Variable Group 'infisical-dev' as env vars):
-#   INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET, INFISICAL_PROJECT_ID
-#   INFISICAL_URL (default http://192.168.122.41:8080), INFISICAL_ENV_SLUG (default dev)
-#
-# Usage: Task Template -> playbook playbooks/test-connection.yml, env infisical-dev
+# test-connection.yml — diagnostic (no host changes). Confirms repo pull +
+# Infisical auth. Reads Infisical creds from EITHER env vars OR ansible vars,
+# so it works regardless of which Semaphore Variable-Group section they're in.
 # ============================================================================
 
 - name: "Semaphore diagnostics — repo + Infisical"
   hosts: localhost
   gather_facts: false
   vars:
-    infisical_url: "{{ lookup('env','INFISICAL_URL') | default('http://192.168.122.41:8080', true) }}"
-    infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default('dev', true) }}"
+    # Accept creds from env var OR extra/ansible var (whichever Semaphore provides)
+    infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') | default(INFISICAL_CLIENT_ID | default(''), true) }}"
+    infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') | default(INFISICAL_CLIENT_SECRET | default(''), true) }}"
+    infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') | default(INFISICAL_PROJECT_ID | default(''), true) }}"
+    infisical_url: "{{ lookup('env','INFISICAL_URL') | default(INFISICAL_URL | default('http://192.168.122.41:8080'), true) }}"
+    infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default(INFISICAL_ENV_SLUG | default('dev'), true) }}"
 
   tasks:
-    # ---------- 1. REPO CHECK (proves SSH clone worked) ----------
-    - name: "[repo] Where is the checked-out repo?"
-      ansible.builtin.set_fact:
-        repo_dir: "{{ playbook_dir | dirname }}"
-
-    - name: "[repo] List files in the repository"
+    - name: "[repo] Locate + list repo files"
       ansible.builtin.find:
-        paths: "{{ repo_dir }}"
-        recurse: true
+        paths: "{{ playbook_dir | dirname }}"
         excludes: ".git"
+        recurse: false
       register: repo_files
 
-    - name: "[repo] Repo contents"
+    - name: "[repo] Repo pulled OK"
       ansible.builtin.debug:
-        msg: >-
-          Repo pulled OK at {{ repo_dir }} —
-          {{ repo_files.files | map(attribute='path') | map('regex_replace', '^'+repo_dir+'/', '') | list }}
+        msg: "Repo at {{ playbook_dir | dirname }} — files: {{ repo_files.files | map(attribute='path') | map('basename') | list }}"
 
-    # ---------- 2. INFISICAL CHECK (proves auth + read works) ----------
-    - name: "[infisical] Auth vars present?"
+    # DIAGNOSTIC: show what channels actually carried the value (lengths only, no secrets)
+    - name: "[diag] Which channel carried INFISICAL_CLIENT_ID?"
+      ansible.builtin.debug:
+        msg:
+          - "env var length: {{ lookup('env','INFISICAL_CLIENT_ID') | length }}"
+          - "ansible var defined: {{ INFISICAL_CLIENT_ID is defined }}"
+          - "resolved id length: {{ infisical_client_id | length }}"
+
+    - name: "[infisical] Auth vars present (via env or var)?"
       ansible.builtin.assert:
         that:
-          - lookup('env','INFISICAL_CLIENT_ID') | length > 0
-          - lookup('env','INFISICAL_CLIENT_SECRET') | length > 0
-          - lookup('env','INFISICAL_PROJECT_ID') | length > 0
-        fail_msg: "Missing INFISICAL_CLIENT_ID / _SECRET / _PROJECT_ID (set them in the Variable Group)."
-        success_msg: "Infisical auth vars present."
+          - infisical_client_id | length > 0
+          - infisical_client_secret | length > 0
+          - infisical_project_id | length > 0
+        fail_msg: >-
+          Infisical creds not reaching the playbook via EITHER env vars or ansible vars.
+          Check the Variable Group values are non-empty and the group is attached.
 
-    - name: "[infisical] Log in (universal auth)"
+    - name: "[infisical] Log in"
       infisical.vault.login:
         url: "{{ infisical_url }}"
         auth_method: universal_auth
-        universal_auth_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') }}"
-        universal_auth_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') }}"
+        universal_auth_client_id: "{{ infisical_client_id }}"
+        universal_auth_client_secret: "{{ infisical_client_secret }}"
       register: infisical_login
 
-    - name: "[infisical] Read secrets from project/env"
+    - name: "[infisical] Read secrets"
       infisical.vault.read_secrets:
         login_data: "{{ infisical_login.login_data }}"
-        project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') }}"
+        project_id: "{{ infisical_project_id }}"
         env_slug: "{{ infisical_env_slug }}"
         path: "/"
         as_dict: true
       register: infisical_secrets
 
-    - name: "[infisical] Show which secret KEYS are visible (values hidden)"
+    - name: "[infisical] Secret keys visible (values hidden)"
       ansible.builtin.debug:
-        msg: >-
-          Infisical OK ({{ infisical_url }}, env={{ infisical_env_slug }}) —
-          secret keys available: {{ infisical_secrets.secrets.keys() | list }}
+        msg: "Infisical OK (env={{ infisical_env_slug }}) — keys: {{ infisical_secrets.secrets.keys() | list }}"
 
     - name: "[result] ALL CHECKS PASSED"
       ansible.builtin.debug:
-        msg: "SSH repo pull ✓  |  Infisical auth + read ✓  — pipeline is ready."
+        msg: "SSH repo pull ✓ | Infisical auth + read ✓ — pipeline ready."