root_cause_category: "missing_credential_isolation"

required_keywords:
  - "credential"
  - "in-process"
  - "proxy"
  - "isolation"
  - "outbound call"

required_evidence_sources:
  - "hermes_credential_state"

optimal_trajectory:
  - "get_hermes_credential_state"
  - "get_hermes_session_log"
  - "get_hermes_runtime_state"

max_investigation_loops: 2

forbidden_categories:
  - "user_error"
  - "unknown"
  - "healthy"

forbidden_keywords:
  - "real secret"
  - "expected behavior"
  - "user mistake"

model_response: |
  The root cause is missing_credential_isolation.

  Hermes kept credentials in process memory and used them directly for outbound calls instead of isolating them behind a credential proxy daemon or KMS-backed boundary.

  The fixture uses only synthetic redacted token placeholders, but the control gap is clear: credential handling is in-process rather than isolated.