diff --git a/playbooks/diagnose.yml b/playbooks/diagnose.yml
index b29970c..daf6906 100644
--- a/playbooks/diagnose.yml
+++ b/playbooks/diagnose.yml
@@ -1,29 +1,97 @@
 ---
-- name: Probe k8s access from AWX
+- name: Probe environment inside AWX EE
   hosts: localhost
   connection: local
   gather_facts: no
   tasks:
-    - name: Locate kubectl
+    - name: Who am I and where
       ansible.builtin.shell: |
-        which kubectl || ls -la /usr/local/bin/kubectl /usr/bin/kubectl 2>/dev/null
-      register: k
-      ignore_errors: yes
+        echo "=== whoami ===";        id
+        echo "=== hostname ===";      hostname
+        echo "=== os-release ===";    cat /etc/os-release 2>/dev/null
+        echo "=== cgroup ===";        cat /proc/1/cgroup 2>/dev/null
+        echo "=== pid1 cmdline ===";  tr '\0' ' ' < /proc/1/cmdline; echo
+        echo "=== /etc/hosts ===";    cat /etc/hosts
+        echo "=== resolv.conf ===";   cat /etc/resolv.conf
+        echo "=== env kube ===";      env | grep -i -E 'kube|k8s|runner' || true
+      args: { executable: /bin/sh }
+      register: env_info
+      failed_when: false
 
-    - ansible.builtin.debug: { var: k.stdout_lines }
+    - ansible.builtin.debug: { var: env_info.stdout_lines }
 
-    - name: Try API access
+    - name: Check service account & kubeconfig
       ansible.builtin.shell: |
-        kubectl version --short 2>&1
-        echo "---"
-        kubectl get nodes -o wide 2>&1
-        echo "---"
-        kubectl get pods -A 2>&1 | head -30
-        echo "---"
-        kubectl auth can-i create pods --all-namespaces 2>&1
-        echo "---"
-        kubectl auth can-i create pods --all-namespaces -n default 2>&1
-      register: api
-      ignore_errors: yes
+        echo "=== /var/run/secrets/kubernetes.io ==="
+        ls -la /var/run/secrets/kubernetes.io/serviceaccount/ 2>&1 || true
+        echo "=== ~/.kube ==="
+        ls -la ~/.kube 2>&1 || true
+        echo "=== /etc/rancher ==="
+        ls -la /etc/rancher 2>&1 || true
+        echo "=== /root/.kube ==="
+        ls -la /root/.kube 2>&1 || true
+        echo "=== find kubeconfig ==="
+        find / -maxdepth 4 -name 'kubeconfig*' -o -name '*.kubeconfig' 2>/dev/null | head
+      args: { executable: /bin/sh }
+      register: kube_files
+      failed_when: false
 
-    - ansible.builtin.debug: { var: api.stdout_lines }
\ No newline at end of file
+    - ansible.builtin.debug: { var: kube_files.stdout_lines }
+
+    - name: Available tools
+      ansible.builtin.shell: |
+        for t in kubectl oc curl wget python3 python perl nc socat nsenter docker podman crictl; do
+          p=$(command -v $t 2>/dev/null)
+          echo "$t -> ${p:-NOT FOUND}"
+        done
+        echo "=== PATH ==="
+        echo $PATH
+      args: { executable: /bin/sh }
+      register: tools
+      failed_when: false
+
+    - ansible.builtin.debug: { var: tools.stdout_lines }
+
+    - name: Try k8s API via service account (if token exists)
+      ansible.builtin.shell: |
+        SA=/var/run/secrets/kubernetes.io/serviceaccount
+        if [ -f $SA/token ]; then
+          TOKEN=$(cat $SA/token)
+          CACERT=$SA/ca.crt
+          API="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}"
+          echo "API=$API"
+          echo "--- /version ---"
+          curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" $API/version || true
+          echo
+          echo "--- /api/v1/namespaces/default/pods ---"
+          curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
+            "$API/api/v1/namespaces/default/pods?limit=5" | head -c 800 || true
+          echo
+          echo "--- can-i create pods? ---"
+          curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
+            -H "Content-Type: application/json" \
+            -X POST "$API/apis/authorization.k8s.io/v1/selfsubjectaccessreviews" \
+            -d '{"apiVersion":"authorization.k8s.io/v1","kind":"SelfSubjectAccessReview","spec":{"resourceAttributes":{"verb":"create","resource":"pods"}}}' || true
+          echo
+        else
+          echo "No service account token found"
+        fi
+      args: { executable: /bin/sh }
+      register: api_probe
+      failed_when: false
+
+    - ansible.builtin.debug: { var: api_probe.stdout_lines }
+
+    - name: Check for awx-ee specific paths and k8s hints
+      ansible.builtin.shell: |
+        echo "=== mounts ==="
+        mount 2>/dev/null | head -20
+        echo "=== /run/secrets ==="
+        ls -la /run/secrets 2>/dev/null || true
+        echo "=== /var/run ==="
+        ls -la /var/run 2>/dev/null | head
+      args: { executable: /bin/sh }
+      register: mounts
+      failed_when: false
+
+    - ansible.builtin.debug: { var: mounts.stdout_lines }
\ No newline at end of file