1. Executive verdict
The spine prototype runs end-to-end on localhost and stores scored opportunities, but Turso history is inflated by re-run duplicates (48 opportunity rows versus 8 dedup URLs) and Sheets failures can be masked as skipped. Wave 1 makes Turso writes safe and idempotent, marks every ingested URL regardless of score, and surfaces Sheets errors explicitly. Wave 2 adds webhook authentication and tightens observability. This plan does not port to online n8n, add Phase 2 sources, or replace Claude, Turso, or the n8n stack.
2. Verification ledger
Audit source: n8n-judge adversarial review (no standalone file in repo; IDs preserved from session output). Each finding re-opened in build-spine-workflow.mjs and 002-signal-spine-news/workflow.json on 2026-07-05.
| ID | Audit | Verdict | Justification |
|---|---|---|---|
| S2-1 | BLOCKER | CONFIRMED | Webhook node has no authentication parameter; path nice-spine-run is public when workflow active. |
| S3-1 | BLOCKER | CONFIRMED | Build Opportunity Upsert concatenates LLM/RSS text into SQL; esc() only doubles single quotes. |
| T2-1 | BLOCKER | CONFIRMED | Build Processed URLs reads Gate Scored Opps (score>=40); sub-40 ingested URLs never marked. |
| O4-1 | BLOCKER | PARTIAL | All triggers reach Respond node, but n8n docs state Respond is ignored when no webhook trigger fired. |
| F2-1 | HIGH | CONFIRMED | Append Opportunity Board has onError continueErrorOutput but zero outbound connections in connections object. |
| F2-2 | HIGH | CONFIRMED | Post Digest to Teams main output is empty array; error branch unwired. |
| F4-1 | HIGH | PARTIAL | RSS (30s) and Claude (180s) have timeouts; Sheets and Teams HTTP nodes lack timeout options. |
| F3-1 | HIGH | CONFIRMED | Turso Mark Processed uses insert on url PRIMARY KEY; re-run without dedup clear causes UNIQUE violation. |
| T2-2 | HIGH | CONFIRMED | No run-level idempotency; duplicate webhook POST same day creates new opportunity_id suffixes and digest_log rows. |
| T4-1 | HIGH | PARTIAL | Read-then-write race on processed_signals is theoretical at current single-operator volume. |
| D2-1 | HIGH | CONFIRMED | Run Summary, buildProcessed, filterTurso use $('Node Name') cross-references. |
| S4-1 | HIGH | PARTIAL | RSS text flows into Claude prompt; no Agent tools so no RCE, but scores can be manipulated. |
| F7-1 | MEDIUM | CONFIRMED | parseOpps falls through to heuristic items when Claude JSON parse fails; no explicit failure flag. |
| T1-1 | MEDIUM | CONFIRMED | workflow.settings has no timezone field; schedule uses instance GENERIC_TIMEZONE. |
| T3-1 | MEDIUM | PARTIAL | anthropicEnabled/teamsWebhookUrl live in staticData set at deploy; race risk is low for daily schedule. |
| P3-1 | MEDIUM | CONFIRMED | saveDataSuccessExecution: all on 40-node daily workflow. |
| O5-1 | MEDIUM | PARTIAL | 003 export template has YOUR_TEAMS_WEBHOOK_URL; prototype-deploy.mjs binds live URL at deploy time. |
| D6-1 | MEDIUM | PARTIAL | Merge Score Paths append mode works in current tests; version-sensitive hang risk not reproduced. |
| P1-1 | LOW | CONFIRMED | Execute Workflow 004 mode each runs per signal; acceptable at 25 items. |
| V-001 | HIGH | CONFIRMED | Run Summary sets sheets_skipped true when Append errors; conflates failure with intentional skip. |
Totals: CONFIRMED 12, PARTIAL 8, REFUTED 0, UNVERIFIABLE 1 (D6-1 hang under alternate n8n versions).
3. Resolved UNVERIFIED items
| Claim | Source | Accessed | Confirmed behavior |
|---|---|---|---|
| Webhook auth options | n8n Webhook node docs | 2026-07-05 | Basic auth, Header auth, JWT auth, and None are supported on webhook triggers. |
| Respond without webhook | n8n Respond to Webhook docs | 2026-07-05 | If Respond executes but no webhook started the run, n8n ignores the Respond node. |
| Turso parameterized queries | 006-turso-smoke-test/workflow.json + repo | 2026-07-05 | Turso node executeQuery accepts ? placeholders with queryParameters expression list. |
| INSERT OR REPLACE semantics | SQLite INSERT docs | 2026-07-05 | INSERT OR REPLACE uses conflict resolution; PRIMARY KEY violation replaces the existing row. |
| Idempotent retries | Stripe idempotent requests | 2026-07-05 | Safe retries require a stable idempotency key so duplicate requests do not duplicate side effects. |
4. Refuted and unverifiable findings
Refuted
None. The judge did not emit findings that were fully disproven. O4-1 severity was downgraded from BLOCKER to PARTIAL rather than refuted.
Unverifiable
D6-1 (Merge Score Paths hang): Would require executing schedule trigger with Claude disabled and only one merge input on n8n 2.22.6 live instance. Current validate pass and successful webhook runs provide no evidence of hang.
Data impact (quantified 2026-07-05)
processed_signals: 8 rows opportunities: 48 rows (36 on 2026-07-04, 12 on 2026-07-05) digest_log: 35 rows Ratio opportunities/processed_urls: 6:1 (re-runs + multi-URL clusters)
5. Practice references
- OWASP, Query Parameterization Cheat Sheet, cheatsheetseries.owasp.org, 2026-07-05. Never interpolate untrusted input into SQL strings; use bound parameters.
- Stripe, Idempotent requests, docs.stripe.com, 2026-07-05. Retries and duplicate triggers need stable keys to avoid duplicate writes.
- SQLite, INSERT statement, sqlite.org, 2026-07-05. PRIMARY KEY conflicts resolve via INSERT OR REPLACE or INSERT OR IGNORE.
- AWS, Exponential Backoff and Jitter, aws.amazon.com/blogs, 2026-07-05. Retries should use backoff with jitter to avoid thundering herds.
- Google SRE, Monitoring Distributed Systems (golden signals), sre.google, 2026-07-05. Alert on symptoms (errors, latency) with low noise.
- Michael Feathers, Working Effectively with Legacy Code. Write characterization tests before changing behavior.
- n8n, Webhook node documentation, docs.n8n.io, 2026-07-05. Authenticate webhook triggers before production exposure.
- Twelve-Factor App, Config, 12factor.net/config, 2026-07-05. Store secrets in environment, not workflow JSON exports.
6. How to fix
Wave 0: Safety nets (no runtime behavior change)
W0-1: Spine response characterization fixture S
Maps: baseline lock. Evidence: verify-sandbox-full-path.mjs exists but no frozen Run Summary JSON.
Practice: [6] Feathers characterization tests.
Change: Add scripts/spine-summary.fixture.test.mjs that loads pinned execution output and asserts field schema (status, opportunities_stored_turso, sheets_rows_appended).
Acceptance: node scripts/spine-summary.fixture.test.mjs exits 0 without n8n running.
Risk: None. Deps: none.
W0-2: SQL upsert golden-file test S
Maps: S3-1 prep. Evidence: build-spine-workflow.mjs L325-333 string-built query.
Practice: [1] parameterization.
Change: Unit test that feeds opportunity with why_it_matters: "O'Brien said '; DROP TABLE" and asserts parameterized query contains no raw apostrophe breakout.
Acceptance: Test fails on current generator output, passes after F-S3-1 lands.
Risk: None. Deps: none.
Wave 1: Data integrity
F-S3-1: Parameterized Turso opportunity upsert M
Maps: S3-1. Evidence: Build Opportunity Upsert builds _upsert_query via template literal; Turso Store executes it.
Practice: [1] OWASP parameterization.
Change: Replace Code-built query with static SQL using ? placeholders (pattern from 006-turso-smoke-test). Set queryParameters to expression binding all 15 fields. Remove esc() concatenation entirely.
INSERT OR REPLACE INTO opportunities (...) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
Acceptance: W0-2 test passes; manual inject string in why_it_matters stores correctly in Turso.
Risk: Turso node binding order mismatch. Contain with fixture row round-trip. Deps: W0-2.
F-F3-1: Idempotent processed_signals write S
Maps: F3-1. Evidence: Turso Mark Processed operation insert on url PRIMARY KEY.
Practice: [3] SQLite INSERT OR IGNORE.
Change: Switch to executeQuery with INSERT OR IGNORE INTO processed_signals (url, headline, source_type) VALUES (?,?,?) and queryParameters per item. Or set node onError continueRegularOutput.
Acceptance: prototype-rerun-spine.mjs twice without clear-dedup does not error at Mark Processed.
Risk: Low. Deps: none.
F-T2-1: Mark all ingested URLs after scoring M
Maps: T2-1. Evidence: buildProcessed reads Gate Scored Opps only.
Practice: [2] idempotency; mark inputs once consumed regardless of output score.
Change: Build Processed URLs from Filter New vs Turso fresh signals (all URLs sent to Claude), not from scored opps. Still run after scoring completes so failed Claude path can use heuristic output.
Acceptance: Run with all heuristic scores 52; processed_signals count increases by RSS item count even when zero opps score 60.
Risk: Marks URLs even if Turso opp write fails. Wire Mark Processed after opp write succeeds (current order preserved). Deps: F-F3-1.
F-F2-1: Wire Sheets error branch + honest summary M
Maps: F2-1, V-001. Evidence: Append Opportunity Board absent from connections; Run Summary L212-214 treats zero success items as sheets_skipped.
Practice: [5] SRE symptom alerting; distinguish error vs skip.
Change: Connect Append error output (main index 1) to a new Set node stamping sheets_error true, then merge into Run Summary path. Add sheets_error and sheets_error_message fields; set sheets_skipped only when node did not execute.
Acceptance: Force 403 on Sheets append; Run Summary returns sheets_error true and status not PASS if Turso wrote but Sheets failed.
Risk: Parallel branch timing. Use Merge node with append. Deps: W0-1.
Wave 2: Reliability and validity
F-S2-1: Webhook header authentication S
Maps: S2-1. Evidence: Webhook parameters lack authentication key.
Practice: [7] n8n webhook auth; [8] secrets in env.
Change: Add Header Auth credential to Webhook node (X-NiCE-Spine-Secret). Store secret in .env SPINE_WEBHOOK_SECRET; update prototype-wake-up.mjs and verify scripts to send header.
Acceptance: POST without header returns 403; POST with header returns Run Summary JSON.
Risk: Breaks existing curl tests until scripts updated. Deps: none.
F-F2-2: Wire Teams error branch S
Maps: F2-2. Evidence: Post Digest to Teams connections main is empty.
Practice: [5] golden signals errors.
Change: Wire Teams error output to Run Summary merge; expose teams_error boolean explicitly (not inferred from post object absence).
Acceptance: Invalid webhook URL yields teams_error true and teams_posted false in summary.
Risk: Low. Deps: F-F2-1 merge pattern.
F-F4-1: HTTP timeouts on Sheets and Teams S
Maps: F4-1 (partial). Evidence: Append and Post nodes lack options.timeout.
Practice: [4] bounded retry with timeout.
Change: Add options.timeout 60000 to Sheets and Teams HTTP nodes in build-spine-workflow.mjs.
Acceptance: workflow.json contains timeout 60000 on both nodes after rebuild.
Risk: None. Deps: none.
F-O4-1: Split Respond node to webhook-only path M
Maps: O4-1 (partial). Evidence: Run Summary always connects to Respond; schedule/manual share path.
Practice: author judgment (clarity over n8n ignore behavior).
Change: Add IF node after Run Summary: respond only when $workflow.triggerNode === 'Webhook — Spine Run' (or duplicate summary leaf for schedule/manual without Respond).
Acceptance: Manual trigger execution log shows no Respond node execution; webhook still returns JSON body.
Risk: Expression API varies by n8n version. Fall back to separate leaf nodes. Deps: none.
Wave 3: Remainder
F-F7-1: Claude parse failure flag S
Maps: F7-1. Change: When fromClaude exists but opps empty after salvage, emit _claude_parse_failed on Run Summary scorer field.
Acceptance: Pinned garbage Claude response yields scorer claude_parse_failed.
F-T1-1: Explicit workflow timezone S
Maps: T1-1. Change: Set settings.timezone to Europe/Belgrade (or team TZ) in generator.
Acceptance: workflow.json contains timezone key.
F-P3-1: Reduce execution data retention S
Maps: P3-1. Change: saveDataSuccessExecution: none after Wave 1 stable.
Acceptance: Successful runs do not persist all node I/O in n8n DB.
F-T2-2: Daily run idempotency key M
Maps: T2-2. Practice: [2]. Change: At run start, check Turso run_log table for date+trigger; skip side effects if already completed.
Acceptance: Second webhook same calendar day returns status ALREADY_RAN without new digest_log row.
7. What to extend (ranked by value/effort)
| Rank | Extension | Repo evidence | MVP | Full | Effort | Value |
|---|---|---|---|---|---|---|
| 1 | Real Teams channel | TEAMS_WEBHOOK_URL still httpbin; digest_log channel pending-teams | Swap URL in .env | Native Teams node + OAuth | S/M | Ops team sees real digests |
| 2 | Confirm Sheets rows end-to-end | Sheets API enabled; spine re-run blocker in TODO.md | One prototype-rerun with sheets_skipped false | Row count reconciliation job | S | Human board matches Turso |
| 3 | GSC ingest branch | 003-phase2-multi-source.md planned | HTTP pull + map to 004 | OAuth + pagination | L | Search Demand trigger fidelity |
| 4 | Weekly security audit workflow | 012-weekly-security-audit in n8n-io-curated | Import template unmodified | Adapt checks for spine webhooks | M | Catch auth drift before online port |
| 5 | Port to online n8n | TODO.md blocker; local IDs in connections.md | Import + credential rebind | CI validate + deploy pipeline | M | Production schedule 07:00 |
| 6 | Prompt injection hardening | S4-1 partial; RSS in prompt | Truncate body_text to 500 chars | Separate system message + schema validator | S/M | Score integrity under adversarial RSS |
| 7 | Reddit ingestion activation | 005-reddit-ingestion exists; OAuth blocked in plan | Manual trigger test | Merge into spine before dedup | L | Richer Conversation trigger signal |
8. Implementation sequence
| Wave | Items | Dependencies | Exit criterion |
|---|---|---|---|
| 0 | W0-1, W0-2 | none | Both fixture tests pass on current code (W0-2 expected fail documents baseline) |
| 1 | F-S3-1, F-F3-1, F-T2-1, F-F2-1 | W0-2 before F-S3-1; F-F3-1 before F-T2-1 | prototype-rerun without dedup clear completes; SQL inject test passes; Sheets error visible in summary |
| 2 | F-S2-1, F-F2-2, F-F4-1, F-O4-1 | F-F2-1 before F-F2-2 | Webhook requires secret; manual run skips Respond; all HTTP nodes have timeout |
| 3 | F-F7-1, F-T1-1, F-P3-1, F-T2-2, extensions 1-2 | Wave 2 complete | Second same-day webhook returns ALREADY_RAN; real Teams post received |
9. Verification suite
| Test | Maps to | Type |
|---|---|---|
| validate-workflows.mjs (8/8) | regression gate | existing |
| credential-config.fixture.test.mjs | deploy binding | existing |
| spine-summary.fixture.test.mjs | W0-1 | new |
| sql-upsert-injection.test.mjs | W0-2, F-S3-1 | new |
| prototype-rerun-spine.mjs (no dedup clear x2) | F-F3-1 | existing extended |
| verify-sandbox-full-path.mjs with bad Sheets cred | F-F2-1, V-001 | existing extended |
| curl webhook without/with SPINE_WEBHOOK_SECRET | F-S2-1 | new script |
| turso-row-counts.mjs before/after Wave 1 | F-T2-1 | existing |
10. Change budget
Deliberately not changed:
- Stack: No migration from n8n to another orchestrator, no replacement of Turso with Postgres, no message broker for dedup.
- Scoring model: Claude HTTP Request stays; no swap to OpenAI or n8n Agent node in this remediation.
- Ingest scope: Google News RSS only; Reddit/GSC/YouTube branches remain Phase 2.
- Merge Score Paths: D6-1 partial and not reproduced; replacing merge deferred until hang observed.
- Cross-node $('') refactor: D2-1 confirmed but large blast radius; deferred to dedicated refactor after Wave 2.
- Online n8n port: Extension rank 5, not a fix wave item.
- Microservices / Kubernetes: Banned by proportionality filter; single workflow graph remains.
Tempting refactors rejected: Converting entire spine to sub-workflows (substantial rewire for marginal gain at 25 items/day); replacing HTTP Sheets with native Google Sheets node (works today via HTTP + service account); adding Data Tables for dedup (Turso already fulfills machine layer).