@awesomate/hosting-mcp 0.87.0 → 0.88.2

package/skill/awesomate-n8n/SKILL.md

@@ -1,17 +1,19 @@
 ---
 name: awesomate-n8n
-description: Build, test, and fix the user's Awesomate-hosted n8n automations, data tables, and AI agents. Use when the user says "build me an automation", "automate this", "connect X to Y", "why did my workflow fail", "create a data table", "build an AI agent / chatbot", "make an n8n agent", "an agent I can talk to in Slack/Telegram", "what automations do I have", "what could I automate", or mentions n8n, workflows, executions, webhooks, the 1Brain node, or {slug}.awesomate.io. Reads and n8n Agents on every plan; building workflows needs Support Plus+. Companion to awesomate-hosting: same connection, same PAT.
+description: Build, test, and fix the user's Awesomate-hosted n8n automations, data tables, and AI agents. Use when the user says "build me an automation", "automate this", "connect X to Y", "why did my workflow fail", "create a data table", "build an AI agent / chatbot", "make an n8n agent", "an agent I can talk to in Slack/Telegram", "what automations do I have", "what could I automate", or mentions n8n, workflows, executions, webhooks, the 1Brain node, or {slug}.awesomate.io. Reads and n8n Agents on every plan; installing Awesomate templates needs Support Plus+; workflows are built through the client's own n8n MCP server, which Awesomate never sees or limits. Companion to awesomate-hosting: same connection, same PAT.
 ---
 
-# Awesomate n8n — your automations from Claude Code
+# Awesomate n8n: your automations from Claude Code
 
 The user's business runs n8n workflows on an Awesomate-hosted instance. You
 can know their WHOLE instance (every workflow, every node, every connection),
 look up live documentation for 500+ nodes and 2,500+ community templates,
-and — on Support Plus and above, with consent — build, test, and safely
-change automations, data tables, and AI agents. Their n8n API key never
-reaches this machine; every write is consent-gated, quota-limited, and
-audited on Awesomate's side.
+read every execution node by node, build n8n Agents, and install Awesomate's
+curated templates. Workflows themselves are written through the instance's
+OWN MCP server (n8n 2.x ships one), which the user connects to their Claude
+Code. Awesomate never sees that traffic, sets no limits on it and keeps no
+count. Their n8n API key never reaches this machine; every hub read is
+consent-gated and audited on Awesomate's side.
 
 **Routing rule:** live facts about THEIR instance come from tools; judgment
 and patterns come from references; node schemas come from
@@ -24,24 +26,27 @@ as outcomes ("your form now emails you") with URLs.
 
 ## 0. First run (every session)
 
-1. `awesomate_whoami` — n8n tools act on whichever ACCOUNT this folder
-   resolves to. Wrong slug → stop and fix the pin/connection first. Every
-   tool response is stamped `account: <slug>` — watch it.
-2. `awesomate_n8n_context` — cache the result:
-   - `consented: false` → give the user the `settingsUrl` and tell them
+1. `awesomate_whoami`: n8n tools act on whichever ACCOUNT this folder
+   resolves to. Wrong slug? Stop and fix the pin/connection first. Every
+   tool response is stamped `account: <slug>`. Watch it.
+2. `awesomate_n8n_context`, and cache the result:
+   - `consented: false`: give the user the `settingsUrl` and tell them
      where it lands: **n8n → Settings → Privacy** at
-     `hub.awesomate.ai/settings?tab=privacy` → "Build and change automations from Claude Code". Privacy moved there; the plain `/settings` page no longer
-     has it (old `?tab=privacy` links just redirect). Wait, then re-check.
-   - `403 missingScopes` → token predates n8n support — reconnect from
+     `hub.awesomate.ai/settings?tab=privacy` → "Let Claude Code work with
+     your automations". Privacy moved there; the plain `/settings` page no
+     longer has it (old `?tab=privacy` links just redirect). Wait, then
+     re-check.
+   - `403 missingScopes`: the token predates n8n support. Reconnect from
      hub.awesomate.ai/claude (Connect Claude Code card).
-   - `capabilities.builder: false` → reads only; building is Support Plus+.
-     Be honest about it once, then help fully within reads.
-   - `capabilities.variant` → FFMPEG variants have the media community
-     nodes; Standard does not. Never assume a node exists — verify.
-   - `limits` → daily build/test/datatable quotas; don't burn tests.
-   - `instance` → community packages + counts (your recon baseline).
+   - `capabilities.templateInstall: false`: Awesomate template installs
+     (§3a) are Support Plus+. Be honest about it once, then help fully with
+     everything else: reads, n8n Agents, and building through their own n8n
+     MCP server all work on every plan.
+   - `capabilities.variant`: FFMPEG variants have the media community
+     nodes; Standard does not. Never assume a node exists. Verify.
+   - `instance`: community packages + counts (your recon baseline).
 3. **Inventory pass** (before designing or diagnosing anything):
-   `awesomate_n8n_workflows` (no id — every workflow as a node summary in
+   `awesomate_n8n_workflows` (no id: every workflow as a node summary in
    ONE call) and, as needed, `awesomate_n8n_inspect` for `nodes`,
    `credentials`, `variables`, `datatables`. Cache this world picture for
    the session; refresh after your own writes.
@@ -54,19 +59,19 @@ as outcomes ("your form now emails you") with URLs.
    map, add its `instructionLine` from `awesomate_business_map` action `job`.
 
 Read [references/platform-notes.md](references/platform-notes.md) BEFORE
-designing or diagnosing — it is the live truth for THIS platform ($vars not
+designing or diagnosing. It is the live truth for THIS platform ($vars not
 $env, `$json.body`, task-runner limits, activation semantics). When it
 conflicts with anything under `references/vendor/`, platform-notes wins.
 
-## 0a. Health sweep — the guardian pattern
+## 0a. Health sweep: the guardian pattern
 
 At the START of any n8n session, alongside the context call: run
 `awesomate_n8n_errors` **with `days: 7`** and `awesomate_n8n_kpis` once. The
-`days` parameter is not optional in practice — the tool defaults to **30**,
+`days` parameter is not optional in practice: the tool defaults to **30**,
 so omitting it sweeps a month and dresses old, already-fixed failures up as
 this week's news. If something is failing, surface it in ONE line in the
-user's language — "two of your automations failed overnight — want me to
-look?" — before proceeding with the asked task. If everything is green, say
+user's language ("two of your automations failed overnight. Want me to
+look?") before proceeding with the asked task. If everything is green, say
 nothing and get on with it. Never let the sweep hijack the session; the
 user's ask comes first unless they say otherwise.
 
@@ -74,63 +79,64 @@ user's ask comes first unless they say otherwise.
 instance has no error history and no error-reporter workflow installed yet,
 so the sweep returns empty for the same reason it would on a flawless one.
 Check the inventory before you interpret it: no workflows, or workflows with
-no executions, means *there is nothing here yet* — say that, plainly
-("nothing has run yet, so there's nothing to report — want to build the
+no executions, means *there is nothing here yet*. Say that, plainly
+("nothing has run yet, so there's nothing to report. Want to build the
 first one?"). Never let "no errors found" imply "everything is working".
 
 When diagnosing, trust `errorSummary` only when `confident: true` (it then
 also carries `errorType`, `code`, `lastNodeExecuted`). When `confident:
-false`, the failing-node name came from a heuristic and may be WRONG — verify
+false`, the failing-node name came from a heuristic and may be WRONG. Verify
 the named node actually exists in the workflow before editing anything.
 
 ## 1. Tools
 
 | Task | Tool |
 |---|---|
-| Session context, consent, quotas, fingerprint | `awesomate_n8n_context` |
+| Session context, consent, capabilities, fingerprint | `awesomate_n8n_context` |
 | All workflows (node-level summaries) / one workflow (`detail: full\|structure`) | `awesomate_n8n_workflows` |
 | Node inventory, datatables (+rows), possibilities, credentials, $vars | `awesomate_n8n_inspect` |
 | Instance KPIs: exec totals, error rate, avg/p95 duration, time saved, 7d-vs-prior deltas (per-workflow adds `last_error_at` + `clean_days`) | `awesomate_n8n_kpis` |
-| Instance-WIDE error events grouped by fingerprint (category, workflow, node, occurrences, first/last seen) — "what is broken across everything" | `awesomate_n8n_errors` |
+| Instance-WIDE error events grouped by fingerprint (category, workflow, node, occurrences, first/last seen): "what is broken across everything" | `awesomate_n8n_errors` |
 | Execution/table/DB byte sizes + 24h per-workflow offenders ("your executions weigh 4GB") | `awesomate_n8n_storage` |
 | AI error-analyzer findings: clientSummary, needsClientAction, fixReady (Pro/Embedded + the **"Enable AI Error Diagnosis"** toggle under n8n → Settings → Privacy; read-only) | `awesomate_n8n_findings` |
-| Account-wide numbers in one call: executions by status, error rate, time saved, workflows total/active, chat sessions, 7-day trend, most recent live failure — the single best source for a status update or weekly report | `awesomate_dashboard_metrics` |
+| Account-wide numbers in one call: executions by status, error rate, time saved, workflows total/active, chat sessions, 7-day trend, most recent live failure. The single best source for a status update or weekly report | `awesomate_dashboard_metrics` |
 | Executions list / detail / node-by-node debug | `awesomate_n8n_executions` |
 | Node schemas, node search, community templates, node-level validation | `awesomate_n8n_node_docs` |
-| Validate / create draft / update draft / activate / promote / rollback / delete draft | `awesomate_n8n_deploy` |
 | **n8n Agents** (the Agents tab, n8n 2.41+, every plan): status, then create / edit / validate / test / publish / channels via n8n's own agent tools | `awesomate_n8n_agents` |
-| Fire a test payload at an active workflow | `awesomate_n8n_test` |
-| Awesomate's template library: list, detail, install_plan (pauses on a missing credential), install, redeem, installs, activate, test, rollback | `awesomate_n8n_library` |
+| Awesomate's template library (Support Plus+): list, detail, install_plan (pauses on a missing credential), install, redeem, installs, activate, test, rollback | `awesomate_n8n_library` |
 | Book a session with the Awesomate team from their credits (session_types, slots, book, mine) | `awesomate_book_session` |
-| Create/alter data tables, write rows | `awesomate_n8n_datatable_write` |
-| Provision a Postgres DB + n8n credential | `awesomate_n8n_provision_pg` |
-| Wire a tested webhook workflow into one of their hosted apps (stores URL + secret on the app; returns the secret ONCE for the workflow's header check) | `awesomate_n8n_attach_to_app` |
+| Wire any production webhook URL on their n8n into one of their hosted apps (stores URL + secret on the app; returns the secret ONCE for the workflow's header check) | `awesomate_n8n_attach_to_app` |
 | Refresh these skills from the latest package | `awesomate_skill_update` |
 
+**Writing workflows is not an Awesomate tool.** Creating, editing, publishing
+and running a workflow happens through the n8n instance's own MCP server,
+connected to this Claude Code by the user (§3, Phase 4). Reads, agents,
+template installs and app wiring are the hub's; the workflow JSON goes
+straight to their n8n.
+
 No `awesomate_n8n_*` tools in this session (fresh bootstrap, or the server
-didn't load)? Suggest a Claude Code restart once — then BUILD ANYWAY:
-[references/rest-fallback.md](references/rest-fallback.md) maps every tool
-to its REST endpoint, and the full loop works over it. Never tell the user
-they're blocked on a restart.
+didn't load)? Suggest a Claude Code restart once. If the n8n MCP server IS
+connected, you can still design and write workflows with it meanwhile; you
+just cannot ground the design in the hub's inventory or read executions
+until the Awesomate tools are back.
 
-## 2. References — read on demand
+## 2. References: read on demand
 
 | When | Read |
 |---|---|
 | Before any design or diagnosis | [platform-notes.md](references/platform-notes.md) |
 | Designing tests, judging "is it done" | [testing-policy.md](references/testing-policy.md) |
 | Anything involving data tables | [datatables.md](references/datatables.md) |
-| An **n8n Agent** (Agents tab, Slack/Telegram channels, schedules, "set it up once, use it anywhere") — or unsure which kind of agent | [n8n-agents.md](references/n8n-agents.md) |
+| An **n8n Agent** (Agents tab, Slack/Telegram channels, schedules, "set it up once, use it anywhere"), or unsure which kind of agent | [n8n-agents.md](references/n8n-agents.md) |
 | An AI Agent NODE inside a workflow / LLM steps | [ai-agents.md](references/ai-agents.md) |
 | A workflow is failing | [troubleshooting.md](references/troubleshooting.md) |
 | Error plans, error workflows, notify-the-owner on failure | [error-handling.md](references/error-handling.md) |
 | A weekly business report / "email me my numbers" | [recurring-reports.md](references/recurring-reports.md) |
-| Changing a LIVE workflow | [upgrade-loop.md](references/upgrade-loop.md) |
 | "What could I automate?" | [possibilities.md](references/possibilities.md) |
 | WordPress form → n8n | [wp-form-handler.md](references/wp-form-handler.md) |
 | **1Brain** in a workflow or agent: procedures, SOPs, policies, the `CUSTOM.oneBrain` node (check it is on the instance first). Connecting 1Brain and its rules: the awesomate-onebrain skill | [onebrain.md](references/onebrain.md) |
 | A person must **approve before the automation acts** (a quote, a refund, a reply it wrote): Hold for a decision and a Wait | [decisions.md](references/decisions.md) |
-| A designed page served BY n8n — form, phone capture mini-app, approval page, status page | [webhook-pages.md](references/webhook-pages.md) |
+| A designed page served BY n8n: form, phone capture mini-app, approval page, status page | [webhook-pages.md](references/webhook-pages.md) |
 | Expression syntax details | [vendor/expressions/](references/vendor/expressions/SKILL.md) |
 | Code-node JavaScript | [vendor/code-node/](references/vendor/code-node/SKILL.md) |
 | Node configuration patterns | [vendor/node-configuration/](references/vendor/node-configuration/SKILL.md) |
@@ -139,55 +145,85 @@ they're blocked on a restart.
 
 ## 3. The build loop (follow ALL six phases)
 
-**Phase 1 — Discovery.** Understand inputs/outputs, trigger, success
-criteria, error handling — in the user's words. Check the inventory FIRST:
+**Phase 1: Discovery.** Understand inputs/outputs, trigger, success
+criteria, error handling, in the user's words. Check the inventory FIRST:
 reuse existing credentials, $vars, tables, workflows. Email decision tree:
 existing Gmail/Google credential → reference its ID · none → offer an
-API-key credential (SMTP / Resend / SendGrid — instant) OR guided Gmail
+API-key credential (SMTP / Resend / SendGrid, instant) OR guided Gmail
 OAuth. A credential existing ≠ working.
 
 **Say the credential catch before they pick, not after it fails.** No tool
-creates a credential on their instance — the one exception is
-`awesomate_n8n_provision_pg`, which makes a Postgres one. Everything else,
-API-key credentials included, the user creates in n8n at
-`{instanceUrl}/home/credentials`; you then re-check the inventory to verify
-it exists. **Gmail and any other OAuth credential can only ever be finished
-in the browser** — the consent screen is Google's, so that branch always
-ends with them, no matter what you try. Flag it while they're choosing:
-*"Either way you'll paste it in on your n8n — an SMTP or Resend key is one
-box and a minute; Gmail means clicking through Google's permission screen.
-Tell me which and I'll give you the exact steps, then pick it up from
-there."*
-
-**Phase 2 — Design.** Resolve EVERY planned node and typeVersion via
-`awesomate_n8n_node_docs` (search similar community templates too — a
+creates a credential on their instance. Every credential, API-key ones
+included, the user creates in n8n at `{instanceUrl}/home/credentials`; you
+then re-check the inventory to verify it exists. **Gmail and any other OAuth
+credential can only ever be finished in the browser**: the consent screen is
+Google's, so that branch always ends with them, no matter what you try. Flag
+it while they're choosing: *"Either way you'll paste it in on your n8n. An
+SMTP or Resend key is one box and a minute; Gmail means clicking through
+Google's permission screen. Tell me which and I'll give you the exact steps,
+then pick it up from there."*
+
+**Phase 2: Design.** Resolve EVERY planned node and typeVersion via
+`awesomate_n8n_node_docs` (search similar community templates too: a
 proven template beats a blank canvas). Propose the architecture as an arrow
 diagram (`Webhook -> Validate -> Send Email -> Respond`). Reasoning/
 execution separation; descriptive node names; every external call has an
 error plan. Externally-called workflows use a **webhook trigger with an
-explicit path** — never a Form Trigger. Data the automation must remember
+explicit path**, never a Form Trigger. Data the automation must remember
 between runs → data table ([datatables.md](references/datatables.md)).
 
-**Phase 3 — Confirmation.** Present the design in plain words and wait for
+**Phase 3: Confirmation.** Present the design in plain words and wait for
 explicit approval. Never create anything on their instance without it.
 
-**Phase 4 — Implementation.** Compose the workflow JSON →
-`awesomate_n8n_deploy {action:'validate'}` and fix every error-severity
-issue → `{action:'create_draft'}` (the hub prefixes `[CLI] `, tags
-`awm:client-cli`, pre-assigns webhookIds, returns webhook URLs). Create any
-data tables with `workflowId` set so they land in the workflow's project.
-Iterate on the draft with `{action:'update_draft'}` — never recreate.
-
-**Phase 5 — Testing (mandatory — validated ≠ tested).** Full policy:
+**Phase 4: Implementation, through their n8n's own MCP server.** Writing
+happens on their n8n, not through Awesomate.
+
+- **Is it connected?** Look for the n8n server's tools in this session
+  (`search_workflows`, `get_workflow_details`, `create_workflow`,
+  `update_workflow`, `publish_workflow`, `execute_workflow`; the server is
+  usually named `n8n`). If they are there, build.
+- **If it is not connected, say so and hand the user the two steps.** Do not
+  pretend any Awesomate tool can create or change a workflow; none can.
+  1. Switch on MCP access and get the key, in their own n8n: **Settings →
+     MCP access** on `{instanceUrl}`. The hub's **Set it up for me** button
+     under **n8n Agents access** on `hub.awesomate.ai/n8n/settings` also
+     switches MCP access on. The key is theirs; never ask them to paste it
+     into the chat.
+  2. Add it to their Claude Code, in a terminal, with their own key in place
+     of the placeholder:
+     `claude mcp add --transport http n8n {instanceUrl}/mcp-server/http --header "Authorization: Bearer <their MCP key>"`
+     then restart Claude Code and carry on. Until then, keep designing:
+     everything up to Phase 3 needs only the Awesomate reads.
+- Compose the workflow JSON from the approved design. Check every node
+  against `awesomate_n8n_node_docs validate_node` before you write it, and
+  fix every error-severity issue (known false positives are listed in
+  platform-notes). Keep `settings.saveExecutionProgress` false yourself; the
+  hub no longer enforces it.
+- Create it with the n8n server's create tool. It lands unpublished. Give
+  the workflow a name the user will recognise in their n8n list; nothing
+  prefixes or tags it for you now. A webhook's production URL is
+  `{instanceUrl}/webhook/<path>`: take the path from the workflow you
+  created and `instanceUrl` from `awesomate_n8n_context`; never guess the
+  hostname.
+- Data tables: the user creates them in n8n (Data tables in the left menu),
+  or you do it through the n8n server if it offers a data-table tool; read
+  them back with `awesomate_n8n_inspect {what:'datatables'}` and reference
+  them by name. Full rules: [datatables.md](references/datatables.md).
+- Iterate with the n8n server's update tool on the same workflow id. Never
+  recreate under a new id: the webhook URLs change.
+
+**Phase 5: Testing (mandatory; validated ≠ tested).** Full policy:
 [testing-policy.md](references/testing-policy.md). Short form: approval →
-activate → `awesomate_n8n_test` with obviously-fake payloads → inspect the
-execution node-by-node (`awesomate_n8n_executions` with `debug: true` when
-available) → happy path + empty + malformed + error-branch routing → report
-what ran and what the human must verify ("check your inbox").
+publish through the n8n server → run it (the n8n server's execute tool, a
+POST to the production webhook with obviously fake data, or ask the user to
+trigger it) → inspect the execution node-by-node (`awesomate_n8n_executions`
+with `debug: true`) → happy path + empty + malformed + error-branch routing →
+report what ran and what the human must verify ("check your inbox").
 
-**Phase 6 — Wrap-up.** Give the workflow URL (`{instanceUrl}/workflow/{id}`),
-the webhook URL, and what happens next. Delete unneeded drafts
-(`delete_draft`, deactivated only).
+**Phase 6: Wrap-up.** Give the workflow URL (`{instanceUrl}/workflow/{id}`),
+the webhook URL, and what happens next. Remove any temporary test triggers
+and, with their OK, any throwaway workflows you created along the way
+(unpublish first, then delete, through the n8n server).
 
 ## 3a. Installing an Awesomate template (bundle)
 
@@ -243,12 +279,27 @@ check; use it when the member has a token, otherwise use the catalog.
 
 ## 4. Changing a LIVE workflow
 
-Never edit a live workflow directly, and never "activate the copy" — the
-copy has different webhook URLs and every external caller breaks. Draft →
-test → present a human-readable diff → explicit approval → `promote` (swaps
-the tested draft INTO the live id, webhookIds preserved) → verify the
-ORIGINAL URL → `rollback` with the returned operationId on any failure.
-Full procedure: [upgrade-loop.md](references/upgrade-loop.md).
+A live workflow is changed through the n8n server's update tool on its OWN
+id, then republished. **Never build a copy and "activate the copy" in its
+place**: the copy has different webhook URLs and every external caller
+breaks. The order:
+
+1. Read the live workflow (`get_workflow_details`) and the inventory; note
+   its webhook paths and `settings.errorWorkflow`.
+2. Make the change in a throwaway copy first when the edit is more than a
+   parameter tweak, test it there, and read the execution with
+   `awesomate_n8n_executions` debug. The copy is for testing only; it never
+   goes live.
+3. Present a human-readable diff of what will change in the live one and
+   wait for explicit approval.
+4. Apply the same change to the LIVE workflow id with the update tool, keep
+   the webhook paths, and republish it.
+5. Verify the ORIGINAL URL still answers (a test fire or the user's own
+   trigger), then inspect the new run. Delete the throwaway copy.
+
+There is no automatic rollback now. Before step 4 keep the live workflow's
+full JSON from step 1 so that, if the new version misbehaves, you can put the
+previous one back with the same update tool.
 
 ## 5. Diagnosing a failure
 
@@ -257,36 +308,42 @@ usually upstream) → `debug: true` for node-level output → check against
 [troubleshooting.md](references/troubleshooting.md) → explain in the user's
 terms with the exact fix. Trust `errorSummary` only on `confident: true`
 (§0a). While you're there, check whether the workflow has an error plan at
-all — [error-handling.md](references/error-handling.md). Self-built workflows: fix via update_draft or the
-upgrade loop. Agency-managed (`agency_managed` error): read and explain
-freely, and switch it off or on if the user asks (say what it does first);
-any other change goes through Awesomate support.
+all ([error-handling.md](references/error-handling.md)). Self-built
+workflows: fix through the n8n server's update tool (§4 when it is live), then
+re-run and re-inspect. Agency-managed (`agency_managed` error): read and
+explain freely, and switch it off or on if the user asks (say what it does
+first); any other change goes through Awesomate support.
 
 ## 6. "What could I automate?"
 
 `awesomate_n8n_inspect {what:'possibilities'}` returns facts; YOU make the
-suggestions — grounded, ≤8, honestly labelled with what each needs. Rules:
+suggestions: grounded, ≤8, honestly labelled with what each needs. Rules:
 [possibilities.md](references/possibilities.md). Offer it once, in one
 sentence, after the first inventory pass when the user's ask is vague. One
-standing recipe worth offering: the weekly business pulse —
-[recurring-reports.md](references/recurring-reports.md).
+standing recipe worth offering: the weekly business pulse
+([recurring-reports.md](references/recurring-reports.md)).
 
 ## 7. Hard rules
 
-- **Never ask for their n8n API key.** Unreachable = consent/scope/plan —
-  route to settings or reconnect.
-- **Explicit approval gates:** before create_draft (design confirmation),
-  activate, promote, rollback, delete (draft or rows), and any test with
-  non-email side effects (CRM writes, payments: STOP and ask).
-- **Agency-deployed workflows and their data tables are read-only** — the
-  hub enforces it; don't fight the 403.
-- **Never activate a copy of a live workflow.** Promote exists for this.
-- **Respect quotas** — 429 quota_exceeded is the plan's daily cap; tell the
-  user, don't retry-loop.
-- **`saveExecutionProgress` stays false.** The hub enforces it; don't work
-  around it.
-- **Real side effects run in tests** — user's own email, `[TEST]` prefixes,
-  tell them first.
+- **Never ask for their n8n API key, or their n8n MCP key.** Unreachable =
+  consent/scope/plan: route to settings or reconnect. The MCP key goes into
+  their own `claude mcp add` command, never into the chat.
+- **Explicit approval gates:** before creating a workflow (design
+  confirmation), publishing, changing a live workflow, deleting anything
+  (workflows or rows), installing or rolling back a template, and any test
+  with non-email side effects (CRM writes, payments: STOP and ask).
+- **Agency-deployed workflows and their data tables are read-only.** The
+  hub enforces it for its own tools; honour it through the n8n server too.
+  Switch on/off only, on the user's say-so; every other change goes to
+  Awesomate support.
+- **Never activate a copy of a live workflow.** Change the live one on its
+  own id (§4).
+- **`saveExecutionProgress` stays false.** Nothing enforces it for you any
+  more: set it false on every workflow you write and never switch it on to
+  get richer debug data (`debug: true` on executions is the inspection
+  path).
+- **Real side effects run in tests:** the user's own email, `[TEST]`
+  prefixes, tell them first.
 - **WordPress forms:** POST server-side from WP to the webhook (forwarder
-  snippet — [wp-form-handler.md](references/wp-form-handler.md)), never
+  snippet, [wp-form-handler.md](references/wp-form-handler.md)), never
   from the browser.

package/skill/awesomate-n8n/evals/n8n-agent-build/graders/grader.md

@@ -8,7 +8,8 @@ triggers.
 ## Pass criteria
 
 1. The right primitive: the build uses `awesomate_n8n_agents` (an n8n Agent),
-   not a workflow with a Chat Trigger + AI Agent node via `awesomate_n8n_deploy`.
+   not a workflow with a Chat Trigger + AI Agent node written through the n8n
+   MCP server.
 2. Setup is checked first: `awesomate_n8n_agents {action:"status"}` is called
    before any `create_agent`. If it reports `keyConfigured:false` or a setup
    code, the assistant relays the setup steps in plain words and does NOT ask

package/skill/awesomate-n8n/references/ai-agents.md

@@ -127,14 +127,16 @@ n8n's chat widget can embed the agent on any site. chatTrigger config:
 - CORS `allowedOrigins`: no trailing slashes, no spaces after commas.
 - No structured output parser on the final agent (see above).
 
-## Test and deploy
-
-- E2E = activate + production webhook + poll executions: `awesomate_n8n_test`
-verify end-to-end: `awesomate_n8n_executions {workflowId}` to find the run,
-then `awesomate_n8n_executions {executionId, debug: true}` for node-by-node
-detail.
-  — `awesomate_n8n_deploy {action:"promote"}` preserves webhookIds.
-- `saveExecutionProgress` stays FALSE (hub enforces; quadratic-write
+## Test and publish
+
+- E2E = publish + production webhook + poll executions. Publish through the
+  n8n MCP server, fire the production webhook (or the n8n server's execute
+  tool), then `awesomate_n8n_executions {workflowId}` to find the run and
+  `awesomate_n8n_executions {executionId, debug: true}` for node-by-node
+  detail.
+- A change to a live agent workflow goes onto its own id (SKILL.md §4); a
+  copy mints new webhookIds.
+- `saveExecutionProgress` stays FALSE (set it yourself; quadratic-write
   incident). Agent/tool loops around `splitInBatches` need an
   `executionTimeout`.
 - Agent + chat workflows also run their published version — republish after

package/skill/awesomate-n8n/references/datatables.md

@@ -1,8 +1,11 @@
-# Datatables — client-side playbook
+# Datatables: client-side playbook
 
 n8n data tables: small operational stores a workflow reads/writes at runtime.
 Read with `awesomate_n8n_inspect {what: "datatables"}` (tables, columns, row
-counts). Write with `awesomate_n8n_datatable_write` (Support Plus+ plans only).
+counts, rows). Tables are created and edited in n8n itself: the user opens
+**Data tables** in their n8n's left menu, or Claude creates one through the
+n8n MCP server when that server offers a data-table tool. No Awesomate tool
+creates or writes a table.
 
 ## Right store or wrong store
 
@@ -12,94 +15,71 @@ counts). Write with `awesomate_n8n_datatable_write` (Support Plus+ plans only).
 | Task queue / retry list a workflow drains | Datatable |
 | Lookup map (SKU→label, email→owner) | Datatable |
 | Cursor/state between runs (last-synced timestamp) | Datatable |
-| Real app data (users, orders, content) | The app's own database — never a datatable |
+| Real app data (users, orders, content) | The app's own database, never a datatable |
 | Analytics, event history, anything unbounded | External store (app DB, sheet, warehouse) |
 
 Rule of thumb: bounded row count, flat rows, no joins, consumed by the
-automation itself. Instance cap is 50 tables (`datatable_cap_reached`), and
-creates have a daily plan quota (`quota_exceeded` — limits in
-`awesomate_n8n_context`).
+automation itself. n8n caps an instance at 50 tables.
 
-## Creating — pass workflowId
-
-```
-awesomate_n8n_datatable_write {action: "create", name, columns: [{name, type?}], workflowId}
-```
+## Creating: same project as the workflow
 
 - **Datatables resolve PER PROJECT at runtime.** A workflow in project A
   referencing a table in project B fails on every run with
-  `Could not find the data table: '<id>'` — while the table, its columns, and
+  `Could not find the data table: '<id>'` while the table, its columns, and
   permissions are all perfectly intact. When the id matches and structure
   looks fine, the project link is what's broken.
-- **Pass `workflowId` whenever the table serves a specific workflow** (nearly
-  always). The table is then moved into that workflow's owner project —
-  co-location is verified, never assumed.
-- Without `workflowId` the server co-locates only when exactly one project
-  owns your Claude Code drafts. Otherwise the response carries a
-  `projectWarning` ("CLI drafts span N projects — pass workflowId…" or
-  "workflowId … has no owner project — table left where n8n placed it").
-  **Treat `projectWarning` as a failed co-location**: recreate with the right
-  `workflowId` before inserting any rows.
-- Column `type`: `string` | `number` | `boolean` | `date` (default `string`).
-  Column names: letters/digits/underscores, starting with a letter, no
-  spaces — n8n's row API references columns bare, so a spaced name is
-  unwritable even though PG would accept it.
-- Design the full column set up front — schema is effectively frozen (next
-  section).
-
-## Schema is immutable over REST
-
-n8n's REST API cannot alter a table. `action: "add_column"` exists but runs a
-direct database write, so it additionally requires the account's
-`allow_pg_writes` consent — ON by default, and NOT client-toggleable: a
-`consent_required` here means Awesomate disabled it for this account, so the
-remediation is recreating the table with the full column set, or asking
-Awesomate support to re-enable direct database writes.
-There is no rename, drop, or retype at all. Wrong schema and no PG consent →
-create a new table, migrate rows, repoint the workflow.
-
-## Writes only touch self-created tables
-
-`insert` / `update` / `delete_rows` / `add_column` work only on tables created
-through Claude Code. Anything else → `403 not_self_created` — including tables
-provisioned by Awesomate template deploys. Those belong to managed
-automations; do not work around the refusal. Reads are unrestricted:
-`awesomate_n8n_inspect` lists every table.
-
-## Row operations
-
-| action | Requires | Notes |
-|---|---|---|
-| `insert` | `rows`: 1–100 objects | Chunk larger batches |
-| `update` | non-empty `filter` + `data` object | `data` is one object, not an array |
-| `delete_rows` | non-empty `filter` — REQUIRED | There is deliberately no delete-all. To empty a table, delete by filter or recreate it |
+- So the table is created **inside the project that owns the workflow**
+  (on a single-user instance that is the owner's personal project; check
+  `awesomate_n8n_workflows` for which project a workflow sits in). Tell the
+  user which project to be in when they create it, and read it back with
+  `awesomate_n8n_inspect` to confirm before the workflow references it.
+- Design the full column set up front: n8n's REST API cannot alter a table,
+  so a column added later means the user does it in n8n's Data tables UI or
+  the table is recreated. Column `type`: `string` | `number` | `boolean` |
+  `date` (default `string`). Column names: letters/digits/underscores,
+  starting with a letter, no spaces (n8n's row API references columns bare,
+  so a spaced name is unwritable even though PG would accept it).
+- Reference tables **by name** in the Data table node, never by id: a
+  rebuilt table keeps its name and gets a new id.
+- Walk the user through it in their words: "open Data tables, click Add,
+  name it `sent_invoices`, add these three columns, done". Then confirm with
+  `awesomate_n8n_inspect {what: "datatables"}`.
+
+## Rows
+
+Rows are written by the workflow itself (Data table node: insert, update,
+delete with a filter) and read back with `awesomate_n8n_inspect`. To put
+seed rows in by hand, the user pastes them in n8n's Data tables UI. There is
+no delete-all; to empty a table, delete by filter or recreate it.
+
+Tables that arrived with an Awesomate template belong to that managed
+automation: read them freely, never change their schema or rows.
 
 ## The dedupe gate pattern (rowNotExists)
 
-Insert-if-absent as a barrier before side effects — the main reason a
-datatable exists in a client workflow:
+Insert-if-absent as a barrier before side effects: the main reason a
+datatable exists in a client workflow.
 
 1. Table with one key column (e.g. `event_id` string) plus any audit columns.
 2. In the workflow, BEFORE the side effect (email, API call, charge): Data
-   table node with the **row-does-not-exist** operation matching the key —
-   only unseen items pass.
+   table node with the **row-does-not-exist** operation matching the key.
+   Only unseen items pass.
 3. Insert the key immediately after the gate, BEFORE the side effect.
    Insert-first gives at-most-once (right for emails and charges);
    insert-after gives at-least-once (duplicates on crash/retry).
-4. The gate and insert are separate node steps, not a transaction — a webhook
+4. The gate and insert are separate node steps, not a transaction: a webhook
    delivered twice in the same instant can pass both. Acceptable for dedupe;
    not a locking primitive.
 
 Queue-drain workflows (`splitInBatches` over a table) need `executionTimeout`
-set, and `saveExecutionProgress` stays FALSE — both fleet invariants.
+set, and `saveExecutionProgress` stays FALSE. Both are platform invariants
+you keep yourself.
 
 ## Failure decode
 
 | Symptom | Meaning | Fix |
 |---|---|---|
-| `Could not find the data table: '<id>'` at runtime | Project scope, not existence | Recreate/move the table with `workflowId`; check `awesomate_n8n_inspect {what: "datatables"}` vs the workflow's project |
-| `403 not_self_created` | Table wasn't created through Claude Code | Create your own table; never write agency tables |
-| `consent_required` on add_column | `allow_pg_writes` disabled for this account (not client-toggleable) | Recreate with the full schema, or ask Awesomate support |
-| `409 column_exists` | Column name collision | Pick another name; check current columns via inspect |
-| `429 datatable_cap_reached` / `quota_exceeded` | 50-table cap or daily create quota | Stop; reuse or delete tables, or wait for the daily reset |
-| `501 datatables_unsupported` | Instance's n8n version predates data tables | No datatable path — use an external store |
+| `Could not find the data table: '<id>'` at runtime | Project scope, not existence | Recreate the table inside the workflow's project; check `awesomate_n8n_inspect {what: "datatables"}` vs the workflow's project |
+| Data table node cannot see a column | Column name has a space or starts with a digit | Rename it in n8n's Data tables UI |
+| Table count stuck at 50 | n8n's per-instance cap | Reuse or delete tables |
+| Data tables missing from n8n's menu | Instance's n8n version predates data tables | No datatable path; use an external store |