Workflows

Workflows (17 n8n workflows)

All workflows run with a 120s timeout, 3× retry, and a full trace_log per signal. Status transitions call SECURITY DEFINER RPCs — no workflow writes tickets.status directly (see Security-Model).

File	Trigger	Function
intake_receiver.json	Webhook (UI or Jira)	5-signal reasoning → auto / one-touch / escalate
chat_assistant.json	Webhook /chat	Ask assistant — scope gate → pre-fetched DB bundle → Claude (read-only)
board_action.json	Webhook /board-action	Server-side money/budget/user writes off the privileged JWT
supplier_reply_handler.json	IMAP	Reads supplier email → schema-validated guard → queues a draft (no auto-send)
docusign_sign.json	Webhook (Sign button)	DocuSign JWT Grant → embedded signing URL
docusign_callback.json	DocuSign event	Envelope signed → ticket approved, legal doc updated
contract_watcher.json	Daily 07:00	Expiring contracts → auto-renew or agent brief
reorder_trigger.json	Daily	Reorder candidates → place order or escalate
hyperscaler_monitor.json	Daily 06:00	Cloud positions → anomaly + overspend alerts
supplier_onboarding.json	Webhook	4 parallel compliance agents → docs + board ticket
invoice_processor.json	IMAP	Parse invoice → 3-way match → payment instruction → ERP queue
delivery_confirmation.json	Webhook	confirm_delivery RPC → PO delivered, SLA check
asset_depreciation.json	Monthly 1st 06:00	Depreciation engine → warranty alerts → replacement tickets
llm_consumption.json	Daily 06:30	AI spend tracking per team/model → anomaly tickets
rag_embedder.json	Every 6h	Legal docs → OpenAI embeddings → document_embeddings
dispatch_drain.json	Scheduled	Drains the dispatch_queue outbox → email / ERP / Slack via RPCs
vps_monitor.json	Scheduled	VPS health → alert ticket on anomaly

---

Detail on the core workflows

intake_receiver — the heart of the system

• Trigger: POST /webhook/intake
• Pre-Check Gate (sync, deterministic): >€100k → escalate; > manager authority → one-touch; CC overrun → one-touch; supplier not green → compliance flag.
• Claude Reason (claude-sonnet-4-6, max 1500 tokens) → 5-signal JSON. Pre-check override re-enforced after the model.
• Route by Disposition (switch): auto_execute / one_touch / escalate.
• Writes: POST /tickets, /decisions, /trace_log (5 rows), /rpc/approve_and_commit, PATCH /tickets. SMTP PO email on auto-execute; Jira PROC issue on escalate.

contract_watcher

• Trigger: 0 7 * * 1-5 (Mon–Fri 07:00)
• Fetches the contracts_expiring view (≤90 days). clean → auto-renew; price_increase / volume_change / scope_change → Claude reasons → auto-execute or one-touch; manual_required → Claude reasons → Jira escalation.

invoice_processor

• Trigger: IMAP poll (INVOICES mailbox, unseen)
• Claude extracts invoice data → match_invoice RPC (3-way: invoice vs PO vs delivery, ±2% tolerance). Matched → create_payment_instruction → erp_sync_queue. Mismatch → one-touch ticket.

supplier_onboarding

• Trigger: POST /webhook/supplier-onboarding {supplier_id}
• 4 Claude agents in parallel: Lawyer (NDA + legal risk) · GDPR (DPA + data residency + SCC) · InfoSec (0–100 score, TOMs, ISO 27001 gap) · LkSG/Ethics (supply-chain risk, sanctions, COC). Results → compliance_checks + legal_documents. Docs needed → signature_required ticket.

hyperscaler_monitor

• Trigger: 0 6 * * 1-5
• Detects overshoot (projected > committed), undershoot (< 80%), idle (idle_resources_eur > 5000), low reservation use (< 0.75). Claude reasons per anomaly.

asset_depreciation

• Trigger: monthly 1st 06:00
• Monthly depreciation for active assets → asset_depreciation_log. Alerts at 90/30-day warranty expiry and EOL (book value < 10% or warranty expired + rising incidents).