fix: Keep agent preview streams responsive (#35035)

Co-authored-by: Guillaume Jacquart <jacquart.guillaume@gmail.com>

.agents/skills/community-pr-readiness-check/SKILL.md

@@ -23,7 +23,7 @@ Given a PR number or branch name, determine whether it is ready for human review
 ## Decision tree
 
 1. **Bot author** (`n8n-cat-bot` / `aikido-autofix`) → cleanup-only, no review. See "Internal automation PRs" below.
-2. **Auto-rejection screen matches** (typo-only / unsanctioned new node) → action path **D — close** with the matching template.
+2. **Auto-rejection screen matches** (typo-only / unsanctioned new node / low-value) → action path **D — close** with the matching template.
 3. **All checks pass** (`readyForReview === true`) → action path **B — triage to team**.
 4. **One or more checks fail** → action path **A** (if title is minor-fix only) then **C — post comment**.
 
@@ -91,22 +91,25 @@ gh api --paginate "repos/n8n-io/n8n/issues/<number>/comments" \
 
 ## Step 2.5 — Auto-rejection screen
 
-Per `CONTRIBUTING.md`, two PR patterns should be closed outright rather than reviewed:
+Per `CONTRIBUTING.md`, three PR patterns should be closed outright rather than reviewed:
 
 - **Typo-only PR** — diff is entirely spelling/grammar fixes with no logic or tests.
 - **New-node PR** — adds a brand-new node, unless the n8n team has explicitly agreed to take it.
+- **Low-value / automated PR** — diff is entirely whitespace/formatting/reordering, an unexplained mass rename or dependency bump, badge/comment-only tweaks, or a bulk scripted submission, with no functional change or rationale. Screen conservatively.
 
-If either matches, set `checks.AutoReject` and skip directly to action **D**. Full rules and how to verify each pattern: see `reference/checks.md`.
+If any matches, set `checks.AutoReject` and skip directly to action **D**. Full rules and how to verify each pattern: see `reference/checks.md`.
 
-## Step 3 — Run the five checks
+## Step 3 — Run the readiness checks
 
 Run when `AutoReject` is `null`. Full rules for each in `reference/checks.md`:
 
 - **A. CLA** — `cla-signed` label present.
 - **B. Title** — matches the conventional-commit regex. Authoritative rules in `.github/pull_request_title_conventions.md`.
 - **C. Description** — every section heading and checklist item from `.github/pull_request_template.md` is present in the PR body. The template is read at check time, so changes to it propagate automatically.
-- **D. Tests** — source logic changes have matching test files. Skip for `docs/ci/chore/build` PRs.
+- **D. Tests** — source logic changes have matching test files (a `fix` needs a regression test covering the bug). Skip for `docs/ci/chore/build` PRs.
 - **E. cubic-dev-ai** — no unresolved comments (resolved = "Addressed in commit" marker).
+- **F. Linked issue or forum discussion** — `fix` PRs link a GitHub issue; `feat`/`refactor`/`perf` PRs link an issue or `community.n8n.io` topic. Skip for `docs/ci/chore/build/test`.
+- **G. Size** — sum of per-file `additions` in `files` (skipping lockfiles/generated) ≤ 1000 and one logical change; sets `Oversized`.
 
 ## Step 4 — Identify the responsible team
 
@@ -158,18 +161,20 @@ Also inspect the matched Linear issue ticket (from the search above) for an alre
   "relatedIssueTickets": [<"GHC-1234" | "NODE-5678" | ...>],
   "duplicatePRs": [<{ "number": <int>, "title": "<string>" }, ...>],
   "checks": {
-    "AutoReject": <"typo-only" | "new-node" | null>,
+    "AutoReject": <"typo-only" | "new-node" | "low-value" | null>,
     "CLA": <bool>,
     "Title": <bool>,
     "Description": <bool>,
     "TestsNeeded": <bool>,
     "TestsIncluded": <bool>,
-    "CubicIssues": <true if unresolved cubic issues exist, false otherwise>
+    "CubicIssues": <true if unresolved cubic issues exist, false otherwise>,
+    "LinkedIssueOrDiscussion": <true if the §1 issue/forum link is present or the type is skipped>,
+    "Oversized": <true if the filtered per-file additions sum > 1000 and the work is separable>
   }
 }
 ```
 
-`readyForReview` is `true` only when: `AutoReject` is `null`; `CLA`, `Title`, and `Description` are all `true`; `CubicIssues` is `false`; and either `TestsNeeded` is `false` or `TestsIncluded` is `true`. If `AutoReject` is set, `readyForReview` is always `false`.
+`readyForReview` is `true` only when: `AutoReject` is `null`; `CLA`, `Title`, `Description`, and `LinkedIssueOrDiscussion` are all `true`; `CubicIssues` and `Oversized` are both `false`; and either `TestsNeeded` is `false` or `TestsIncluded` is `true`. If `AutoReject` is set, `readyForReview` is always `false`.
 
 Emit the JSON first, then take the appropriate action path below.
 
@@ -255,13 +260,15 @@ The PR's own review ticket is **not** canceled in the classic path — it remain
 
 If `relatedIssueTickets` is non-empty, run "Linking a PR to its issue ticket" (not-ready variant): add the PR link and post the "in progress, still being triaged" comment. **Leave each issue ticket's state unchanged and do not cancel the PR's own review ticket** — the PR isn't ready yet, so we only flag the in-progress work. (Optionally surface `duplicatePRs` to the user, but do not close here — closing is a path-D action driven from B.)
 
+`messageForUser` should list every failing check the contributor must address, including a **missing linked issue / forum topic** (check F — ask them to open or link a GitHub issue for a `fix`, or a `community.n8n.io` topic for a `feat`/`refactor`) and an **oversized PR** (check G — ask them to split it into focused PRs *if the work is separable*).
+
 Show `messageForUser` and ask `Post as-is / Edit before posting / Skip`. On post:
 
 ```bash
 gh pr comment <number> --repo n8n-io/n8n --body "<final message>"
 ```
 
-Then apply the right terminal triage label — exactly one, priority `triage:tests-needed` > `triage:needs-info`. See `reference/label-flow.md`. On `Skip`, leave the PR on `triage:in-progress` so the next loop picks it up.
+Then apply the right terminal triage label — exactly one, priority `triage:tests-needed` > `triage:needs-info` (a missing linked issue/forum topic or an oversized PR maps to `triage:needs-info`). See `reference/label-flow.md`. On `Skip`, leave the PR on `triage:in-progress` so the next loop picks it up.
 
 Skip C entirely if A already handled the only failing check and the PR is now ready — run B instead.
 
@@ -269,7 +276,7 @@ Skip C entirely if A already handled the only failing check and the PR is now re
 
 Used when the PR should be closed rather than reviewed. Three common triggers:
 
-1. **Auto-rejection** (`AutoReject` set) — typo-only or unsanctioned new node.
+1. **Auto-rejection** (`AutoReject` set) — typo-only, unsanctioned new node, or low-value/automated.
 2. **Duplicate** — `duplicatePRs` is non-empty (another open PR addresses the same change), confirmed via the duplicate guard in path B. Use `#<other-pr>` from `duplicatePRs` in the template.
 3. **Out of scope / bundled** — multiple unrelated fixes that should be split, or scope n8n team has declined.
 
@@ -281,6 +288,9 @@ Ask `Close + comment / Edit before closing / Skip`. Templates below; pick one an
 **New node:**
 > Thanks for the contribution! n8n no longer accepts new nodes directly into the core monorepo unless the team has explicitly agreed to scope one in. Please publish this as a [community node](https://docs.n8n.io/integrations/creating-nodes/overview/) instead — that gives you full ownership and avoids the long review queue here. Closing this PR per our [contributing guide](../blob/master/CONTRIBUTING.md#community-pr-guidelines).
 
+**Low-value / automated:**
+> Thanks for taking the time to open this! We review every PR by hand, so per our [contributing guide](../blob/master/CONTRIBUTING.md#community-pr-guidelines) we only take changes that carry a clear functional benefit. This one doesn't change behaviour (or comes without a rationale we can act on), so we're closing it to keep the review queue focused. If there's a real fix or improvement behind it, please open an issue or forum topic describing the problem first and we'll be glad to look. 🙏
+
 **Duplicate of another PR:**
 > Thanks for the contribution! This change is already being handled in #<other-pr>, which is further along in review. Closing this in favour of that PR to keep the queue tidy — please feel free to chime in over there if there's anything missing.
 

.agents/skills/community-pr-readiness-check/reference/checks.md

@@ -1,24 +1,27 @@
 # Community PR Readiness Check — checks
 
-The full ruleset for the auto-rejection screen and the five readiness checks. Loaded when the skill is mid-review.
+The full ruleset for the auto-rejection screen and the readiness checks. Loaded when the skill is mid-review.
 
 ## Contents
 
 - Step 2.5 — Auto-rejection screening
   - Typo-only PR
   - New-node PR
-- The five checks (run after auto-rejection screen clears)
+  - Low-value / automated PR
+- The readiness checks (run after auto-rejection screen clears)
   - A. CLA signed
   - B. PR title format
   - C. PR description completeness
   - D. Tests
   - E. cubic-dev-ai issues
+  - F. Linked issue or forum discussion
+  - G. Size (single logical change)
 
 ---
 
 ## Step 2.5 — Auto-rejection screening
 
-Before running the five checks, screen for PRs that the project policy in `CONTRIBUTING.md` (section "Community PR Guidelines") says should be rejected outright. If a PR matches one of these patterns, skip the five checks and recommend a polite close instead.
+Before running the readiness checks, screen for PRs that the project policy in `CONTRIBUTING.md` (section "Community PR Guidelines") says should be rejected outright. If a PR matches one of these patterns, skip the readiness checks and recommend a polite close instead.
 
 ### Typo-only PR
 
@@ -35,13 +38,25 @@ The diff adds a new node entry: a new `*.node.ts` (and usually a sibling credent
 
 Per CONTRIBUTING.md: *"PRs that introduce new nodes will be auto-closed unless they are explicitly requested by the n8n team."* If the user calling the skill states the n8n team has agreed to take this node, proceed with the normal review; otherwise flag for close with a pointer to the [Community Nodes](https://docs.n8n.io/integrations/creating-nodes/overview/) flow.
 
+### Low-value / automated PR
+
+CONTRIBUTING.md §6 lists low-value and automated PRs as close-on-sight. Match **only** when the diff, read via `gh pr diff <number>`, is **entirely** one of these with no functional change and no rationale in the description:
+
+- Whitespace, formatting, or pure reordering with no functional reason.
+- Mass find-and-replace or renames submitted with no rationale.
+- A dependency bump with no explanation of why the bump is needed.
+- README badges, comment-only tweaks, or restating the obvious.
+- Bulk or scripted submissions spanning many unrelated files.
+
+Be conservative — this is a close, so bias toward *not* matching. If any part of the diff changes behaviour, adds a test, or the description gives a genuine reason, do **not** match; run the readiness checks instead. Contribution-farming intent (e.g. Hacktoberfest with no real change) reinforces a match but is never the sole basis — the diff must already be low-value.
+
 ### When a screen matches
 
-Skip the five checks. Set `checks.AutoReject` in the JSON output to `"typo-only"` or `"new-node"` and proceed to action path 7D in SKILL.md (close the PR).
+Skip the readiness checks. Set `checks.AutoReject` in the JSON output to `"typo-only"`, `"new-node"`, or `"low-value"` and proceed to action path 7D in SKILL.md (close the PR).
 
 ---
 
-## The five checks
+## The readiness checks
 
 Run these in order when step 2.5 clears (`AutoReject` is `null`).
 
@@ -107,6 +122,7 @@ Otherwise:
    ```
 3. Use the diff to judge whether the changes introduce logic that warrants tests (new functions, bug fixes, behaviour changes, data transformations). Pure config changes, type-only changes, and trivial renames do not require tests.
 4. Look for matching test files (`*.test.ts`, `*.spec.ts`, files inside `__tests__/`) among the changed files.
+5. For a **bug fix** (`fix` type), CONTRIBUTING.md §3 asks for a regression test that fails against `master` without the change. You can't run it here, so confirm the PR both adds/updates a test that exercises the fixed path **and** the description says how to see it fail. A `fix` PR with no test covering the bug, or a test that clearly doesn't touch the changed path, is ❌ even if unrelated tests exist.
 
 **Fallback only if needed**: if the diff alone is insufficient (e.g. you need to read the full surrounding function body to assess whether a refactor preserved behaviour), check out a temporary worktree:
 
@@ -138,3 +154,27 @@ gh api --paginate "repos/n8n-io/n8n/pulls/<number>/comments" \
 
 - No comments, every comment explicitly states no issues were found, or every issue is marked addressed → ✅
 - One or more unresolved comments → ❌ report the unresolved count and priority breakdown (e.g. "3 unresolved issues: 1× P1, 1× P2, 1× P3")
+
+### F. Linked issue or forum discussion
+
+CONTRIBUTING.md §1 moves the quality gate before the code: bug fixes need a tracked issue, features and refactors need prior discussion. Gate by PR type (from the title):
+
+- **Skip** (auto-pass) for `docs`, `ci`, `chore`, `build`, and `test` types — housekeeping doesn't need a prior issue.
+- **`fix`** — require a linked GitHub issue: a closing keyword (`fixes/closes/resolves #N`) or an `github.com/n8n-io/n8n/issues/N` URL in the body (i.e. `relatedIssueTickets` from step 5b is non-empty, or the raw reference is present).
+- **`feat`, `refactor`, `perf`** — require prior discussion: either a linked GitHub issue (as above) **or** a `community.n8n.io` forum link in the body.
+
+Report:
+
+- ✅ Required link present, or type is skipped
+- ❌ `fix` with no linked issue, or `feat`/`refactor`/`perf` with no linked issue or forum link
+
+A ❌ here is a **return**, not a close: it sets `readyForReview` false and drives a path-C contributor comment asking for the issue or forum topic (see SKILL.md). This is a heuristic — if the PR body clearly describes a tracked discussion by other means, use judgement.
+
+### G. Size (single logical change)
+
+CONTRIBUTING.md §6: a PR should add no more than **1000 lines** and cover one logical change. Compute the line count from the per-file `additions` in the `files` list fetched in step 2 (each entry has `path` and `additions`) — not the aggregate `additions` from `gh pr view`, which can't be filtered:
+
+- Sum `additions` across the `files` list, **skipping** obvious lockfiles and generated/vendored files (e.g. `pnpm-lock.yaml`, generated API clients). Set `Oversized` true when that filtered sum is `> 1000` — a large lockfile diff alone is not "oversized".
+- `Oversized` true is a **return**, not a close: `readyForReview` becomes false and path C asks the contributor to split the PR into focused pieces.
+
+This is advisory-strength: a single cohesive change that genuinely needs >1000 lines (e.g. one sanctioned node) can be waved through by the human reviewer, so phrase the comment as a request to split *if the work is separable*.

.agents/skills/community-pr-readiness-check/reference/teams.md

@@ -54,7 +54,7 @@ Use the canonical owners script at `.github/scripts/owners.mjs`. It parses `.git
 | `design`                  | Design                  | `team:design`      |
 | `iam`                     | Identity & Access       | `team:identity`    |
 | `ligo`                    | Lifecycle & Governance  | `team:lifecycle`   |
-| `instance-ai`             | instanceAI              | `team:instance-ai` |
+| `instance-ai`             | AI Assistant            | `team:instance-ai` |
 | `frontend`                | Adore                   | `team:adore`       |
 | `qa-dx`                   | Developer Platform      | `team:qa-dx`       |
 | `migrations-review`       | Catalysts               | `team:cats`        |

.agents/skills/conventions/SKILL.md

@@ -52,6 +52,8 @@ pnpm build > build.log 2>&1  # Always redirect
 pnpm typecheck               # Before commit
 pnpm lint                    # Before commit
 ```
+> Secrets: pnpm command lines may be recorded verbatim (opt-in dev metrics) —
+> pass sensitive values via env vars, never inline on the command line.
 
 ## Key Packages
 

.agents/skills/create-instance-ai-eval/SKILL.md

@@ -1,28 +1,30 @@
 ---
 name: n8n:create-instance-ai-eval
 description: >-
-  Authors a new Instance AI workflow eval case in
-  packages/@n8n/instance-ai/evaluations/data/workflows — build cases,
-  behaviour/process cases, credential cases, and seeded (mid-conversation)
-  cases — with intent-driven expectations calibrated against a real build. Use
-  when adding or changing an Instance AI workflow eval, or debugging why one is
-  flaky.
+  Authors a new Instance AI workflow eval case — written locally as JSON,
+  calibrated against a real build, then pushed to the LangTracer suite CI runs
+  — build cases, behaviour/process cases, credential cases, and seeded
+  (mid-conversation) cases — with intent-driven expectations. Use when adding
+  or changing an Instance AI workflow eval, or debugging why one is flaky.
 ---
 
 # Create an Instance AI workflow eval
 
-Each eval is **one JSON file** in
-`packages/@n8n/instance-ai/evaluations/data/workflows/`. The loader
-auto-discovers `*.json` and validates against
-[`schema.ts`](../../../packages/@n8n/instance-ai/evaluations/data/workflows/schema.ts)
-(`.strict()` — unknown keys fail at load). No registration step. The eval
+Each eval is **one JSON case** — authored locally as a file in
+`packages/@n8n/instance-ai/evaluations/data/workflows/` (the disk loader
+auto-discovers `*.json`, no registration step), with a LangTracer suite as its
+durable home. Cases validate against
+[`harness/schema.ts`](../../../packages/@n8n/instance-ai/evaluations/harness/schema.ts)
+(`.strict()` — unknown keys fail at load). The eval
 [README](../../../packages/@n8n/instance-ai/evaluations/README.md) is the
 exhaustive field reference; this skill is the opinionated *how*.
 
 > **Committing new case JSONs into the repo is no longer the recommended
 > approach.** Author the file locally (uncommitted), calibrate it against a real
-> build, then **push it to a curated lang-tracer suite** with
-> `eval:langtracer-push` (see [Push to a lang-tracer suite](#push-to-a-lang-tracer-suite)).
+> build, then **push it to a lang-tracer suite** with `eval:langtracer-push`
+> (see [Push to a lang-tracer suite](#push-to-a-lang-tracer-suite)) —
+> `--suite baseline` for the consolidated corpus n8n CI runs, or a dedicated
+> capability suite like `agents`.
 > The suite is the home for the case; the eval CLI reads it back via
 > `--source langtracer`. You still write the JSON file — it's just the input to
 > the push, not a committed artifact.
@@ -33,6 +35,52 @@ exhaustive field reference; this skill is the opinionated *how*.
 > `priorConversation` case isn't transient and has no suite home, so it's the one
 > sanctioned exception — it lives as committed JSON. See [`case-shapes.md`](case-shapes.md).
 
+## Set the autonomy level first
+
+**Before you source, draft, or run anything, decide how hands-on the driver
+wants to be — and say it back.** This skill runs at one of two autonomy levels.
+If the request makes the level clear ("just author and calibrate it yourself" vs.
+"stop me at each step", or an explicit mode), adopt it, state it in one line, and
+note how to override (e.g. "say 'stop me at calibration' to add a checkpoint").
+**If it's not clear, ask the driver one question** offering the two levels
+*before* doing any work.
+
+The skill has four natural decision **gates** — **selection** (which real
+failure to encode), **shape + expectations** (archetype, must-haves, scope
+trim), **calibration** (classify each red and resolve keep/loosen/drop), and
+**push** (kind + tier). The level decides what happens at each gate:
+
+| Level | Who decides when to stop | Behaviour |
+|---|---|---|
+| **autonomous** | agent | Runs all four gates start-to-finish; reports a **decision log** at the end for the driver to review. |
+| **checkpoint** | driver, per gate | Stops at each gate with a compact **proposal + recommendation**; driver says "go" or redirects. At the **calibration** gate, hands the driver a link to the just-built thread on the live instance plus login credentials so they can review the real conversation and workflow themselves before confirming (below). |
+
+**Calibration is special-cased at both levels.** A calibration verdict that
+flips a case's *meaning* — a real capability-gap red vs. a harness-caused red, or
+any loosening that would let a known-bad build pass — is **surfaced explicitly**
+(interactively in checkpoint; in the decision log in autonomous), never silently
+committed. It's the one call where a quiet mistake corrupts the suite, so it
+never fully auto-commits.
+
+**Checkpoint calibration — review the real thread on the instance.** Because the
+calibration verdict is trust-critical, in checkpoint mode you don't ask the
+driver to trust your reading of the run. You built the case against a live
+instance with `--keep-workflows` (step 4), so the thread and the workflow are
+still there — hand the driver a direct link and let them look:
+
+- **Thread:** `<base-url>/assistant/<threadId>` — the exact conversation the case
+  ran (the run prints the `threadId`; the built workflow prints as `BUILT (<id>)`
+  and opens at `<base-url>/workflow/<id>`).
+- **Login:** the email + password the eval signs in with (the owner you seeded on
+  the instance — see [`running-evals.md`](running-evals.md); the default local
+  seed is `nathan@n8n.io` / `PlaywrightTest123`).
+
+Present, per red: the assertion, whether it went green/red, your proposed
+classification (real capability gap / harness limitation / noise) and
+keep/loosen/drop, and the review link. The driver logs in, reads the thread and
+the workflow, and confirms or redirects before you write the verdict back into
+the case `description`.
+
 ## Where the best cases come from
 
 The strongest cases encode a **real** failure, not an invented premise. Two
@@ -83,6 +131,12 @@ need + constraint ("I need field X and the built-in node doesn't expose it, so
 pull it straight from the API") — not as an implementation spec ("use an HTTP
 Request node").
 
+**Write the conversation in English** unless the user asked otherwise (or the
+case exists specifically to test non-English handling). Sourced real threads are
+frequently non-English — translate the intent into English when you rewrite the
+prompt in the user's voice; the failure mode is the anchor, not the original
+language.
+
 **Trim to the smallest multi-turn conversation that reproduces the issue.**
 Real sourced threads are long (dozens of turns of setup, debugging, and
 tangents) — do **not** transcribe them. Distill to the fewest turns that still
@@ -109,6 +163,15 @@ the combinatorial bulk. A case that never builds tests nothing.
 
 ## Workflow
 
+These steps map to the four gates from [Set the autonomy level first](#set-the-autonomy-level-first):
+sourcing (before step 1) is the **selection** gate; steps 1–2 are the **shape +
+expectations** gate; steps 5–6 are the **calibration** gate; step 7 is the
+**push** gate. In *autonomous* mode you flow through all of them and summarize in
+a decision log; in *checkpoint* mode you pause at each with a proposal, and at
+calibration you hand the driver the thread link + login to review the real build
+(see [Set the autonomy level first](#set-the-autonomy-level-first)). Calibration
+(step 6) always surfaces meaning-flipping verdicts explicitly regardless of level.
+
 1. **State the must-haves first.** From the conversation alone, list what every
    correct workflow must do (trigger type, essential operations, gating
    condition) — those become draft `outcomeExpectations`. Required fields:
@@ -145,7 +208,9 @@ the combinatorial bulk. A case that never builds tests nothing.
    (or delete it once it's in the suite). Committing new case JSONs into the repo
    is no longer the approach. (Exception: seeded cases can't be pushed — a
    `seedFile`/`priorConversation` case stays committed JSON, a `seedThread` case is
-   a local throwaway; see [`case-shapes.md`](case-shapes.md).)
+   a local throwaway; see [`case-shapes.md`](case-shapes.md).) For a sourced case,
+   finish by **linking it to its source thread/finding** over the MCP — see
+   [Link the pushed case to its source](#link-the-pushed-case-to-its-source-provenance-step--always-do-this).
 
 `--iterations N` is available to measure flakiness (pass@k / pass^k) — reach for
 it when you suspect a case is non-deterministic or before promoting it to a
@@ -181,19 +246,31 @@ Calibration exists to right-size assertions, **not** to make a case pass. When a
 run turns a scenario or expectation red, classify the red first — then keep it.
 
 **First rule out the environment.** Before reading any red as a signal about a
-case, check the shape of the failures across the run. If **every scenario fails
-with the *same* execution error** while the builds succeed and `outcomeExpectations`
-pass, that is almost never the cases — it's a broken environment, most often a
-**stale `packages/core` / `packages/cli` dist** after a branch or worktree switch
-(a refactor moved a runtime export and the built dist still calls the old one;
-e.g. `(0 , n8n_workflow_1.createDeferredPromise) is not a function` after
-`createDeferredPromise` moved to `@n8n/utils`). Fix it, don't calibrate around it:
-run a full ordered `pnpm build` (a targeted `--filter` build can fail on unrelated
-stale-dep type errors), then **restart the instance** — the running node process
-holds the old dist in memory, so rebuilding on disk changes nothing until restart
-(and `kill` by env-var pattern misses it — kill the actual `lsof -t -iTCP:<port>`
-PID). Re-probe one case, confirm executions run, then re-run the batch. Only once
-uniform environment failures are excluded do the three categories below apply:
+case, check the shape of the failures across the run. If **every case fails the
+same way** — every scenario with the *same* execution error while builds succeed,
+*or* every **build** erroring identically before it starts (an `Agent error:
+Something went wrong…` with **zero tool calls**) — that is almost never the cases;
+it's a broken environment, most often a **stale dist** after a branch or worktree
+switch. Two shapes to know:
+
+- **Stale `packages/core` / `packages/cli` dist** — a refactor moved a runtime
+  export and the built dist still calls the old one, so *builds succeed but every
+  execution fails the same way* (e.g. `(0 , n8n_workflow_1.createDeferredPromise)
+  is not a function` after `createDeferredPromise` moved to `@n8n/utils`).
+- **Stale/half-built `@n8n/instance-ai` dist** — every run errors *before building*
+  (`Agent error…`, zero tool calls) and the instance log shows `Cannot find module
+  '@/utils/...'` from `dist/skills/*.js`: the build's `tsc-alias` step (which
+  rewrites `@/` path aliases to relative requires) didn't complete, so the dist is
+  internally inconsistent.
+
+Fix it, don't calibrate around it: run a full ordered `pnpm build` (a targeted
+`--filter` build can fail on unrelated stale-dep type errors; for the instance-ai
+shape, `cd packages/@n8n/instance-ai && pnpm build` runs `tsc && tsc-alias`), then
+**restart the instance** — the running node process holds the old dist in memory,
+so rebuilding on disk changes nothing until restart (and `kill` by env-var pattern
+misses it — kill the actual `lsof -t -iTCP:<port>` PID). Re-probe one case, confirm
+it builds and executes, then re-run the batch. Only once uniform environment
+failures are excluded do the three categories below apply:
 
 - **Real build / capability gap** — the agent's workflow is wrong or missing
   something the user asked for (a miswired branch, a missing retry, wrong field
@@ -210,6 +287,13 @@ uniform environment failures are excluded do the three categories below apply:
   This is the only real "noise". Confirm it with `--iterations N` before calling
   it flaky, then de-tier and note it; deletion is the last resort.
 
+**Annotate every kept red in the case `description` with a scannable prefix** so a
+future reader tells the two apart at a glance. Use `Harness note: …` for a
+harness-caused red (name the limitation and why the build is still correct), and
+`Capability-gap finding: current build reds because <X> — a real builder bug
+(flips to a regression guard once fixed)` for a real gap. Consistent prefixes keep
+the corpus greppable and stop harness reds from being misread as product bugs.
+
 The one move to never make is **working around a red by weakening what the case
 checks** — deleting a failing scenario, loosening an assertion until a wrong
 build would pass, or quietly converting to build-only. That makes the suite look
@@ -218,6 +302,17 @@ harness gaps are the deliverable, so **highlight them, don't engineer around
 them**. If you catch yourself editing a case so that a known-bad build would now
 pass, stop.
 
+**Who confirms the classification depends on the autonomy level.** In
+*checkpoint* mode the keep/loosen/drop decision is the driver's to confirm: you
+hand them the thread link + login (see [Set the autonomy level
+first](#set-the-autonomy-level-first)) so they can review the real conversation
+and workflow, then you write the agreed `Harness note:` / `Capability-gap
+finding:` prefix back into the case `description`. In *autonomous* mode the agent
+proposes it explicitly in the end-of-run decision log. Either way the
+classification is stated in the open, never silently committed — misreading a
+harness red as a real gap (or the reverse) is the one calibration mistake that
+quietly corrupts the suite.
+
 ## Example
 
 Minimal build case:
@@ -287,8 +382,8 @@ What each piece is doing:
   never spoken. Here it withholds values until asked and rejects a plan that
   misses the label filter. Keep the whole script in one turn and encode ordering
   inside it (don't fabricate assistant "done" turns to sequence steps — see
-  [`case-shapes.md`](case-shapes.md)). `applies-each-change-when-asked` is a good
-  real example.
+  [`case-shapes.md`](case-shapes.md)). `applies-each-change-when-asked` (in the
+  `baseline` LangTracer suite) is a good real example.
 - **`dataSetup` describes only what external services return.** That's the layer
   the harness controls (below).
 
@@ -313,7 +408,14 @@ nodes get LLM-generated pin data). So:
   byte-exact — don't assert exact values off them), and *writes/inserts* aren't
   pinned (they hit the real per-thread table, recreated schema-only with **no
   rows**), so read-after-write within one run isn't faithful — the read reflects
-  `dataSetup`, not what the run just wrote.
+  `dataSetup`, not what the run just wrote. A third caveat: only Data Table
+  *reads* are seedable this way — **dedup / change-detection built on workflow
+  static data** (`removeItemsSeenInPreviousExecutions`, `$getWorkflowStaticData`)
+  is **not** seedable, because static data starts empty every run, so such a
+  scenario reds vacuously (it sees everything as "new"). To get a seedable
+  change-detection scenario, steer the build toward a Data Table; otherwise
+  accept the static-data red as a harness limit and carry the logic in
+  `outcomeExpectations`. Note the agent may *choose* static-data dedup on its own.
 - Don't assert exact counts that depend on mock generation ("exactly 7 posts").
   Say "fewer than the original 10".
 
@@ -340,10 +442,18 @@ red is harness-caused (per "A red is signal", above):
 - **Mock response shape** — the LLM-generated mock response can omit the real
   envelope, crashing a downstream parse/format node. Recurring, reproducible
   shapes to expect (all produce a red on a *correct* build):
-  - **OpenAI** mock returns a plain `{content: "..."}` instead of the Responses
-    API envelope (`output[0].content[0].text`), so a LangChain chain / **Structured
-    Output Parser** receives an empty response and crashes. Any build with an
-    OpenAI chat model feeding a structured-output/parser node can red on this.
+  - **OpenAI structured output** — historically the mock returned a plain
+    `{content: "..."}` instead of the Responses envelope
+    (`output[0].content[0].text`), so a **Structured Output Parser** /
+    **Information Extractor** / **Text Classifier** got nothing and errored with
+    **`Model output doesn't fit required format`**. The Responses-envelope
+    normalizer (PR #33578, merged) fixes the flat-envelope case, so many of these
+    now execute cleanly. A **narrower residual red remains** for structured-output
+    schemas declared with strict **`additionalProperties: false`**: the normalized
+    `output` wrapper (and any extra fields the mock invents, e.g. `subject`/`date`)
+    violate the strict schema, so the node still rejects the mock output. Both the
+    old and residual forms are the *mock*, not the build — carry correctness in
+    `outcomeExpectations` and note the red as harness-caused.
   - **Gmail** mock returns headers as top-level capitalized fields (`From`,
     `Subject`) instead of under `payload.headers`, so a Code/Filter node reading
     the sender/subject gets empty strings (e.g. a "drop no-reply senders" safety
@@ -351,6 +461,10 @@ red is harness-caused (per "A red is signal", above):
     `outcomeExpectations`, not its runtime effect in a scenario.
   - A less-common API (e.g. Gemini's top-level `candidates`) can omit its envelope
     the same way.
+  - **Google Drive resumable upload** — the initiate-upload mock omits the
+    `Location` header carrying the session URL, so a Drive file-upload node fails
+    with a 400. Any build that uploads a generated image/file to Drive can red on
+    this.
 - **Agent-tool nodes can't be executed standalone.** An AI-Agent *tool* node
   (`toolHttpRequest` and other `supplyData`-only LangChain nodes with no `execute`
   method) only runs when the agent invokes it; the harness executing it directly
@@ -358,6 +472,12 @@ red is harness-caused (per "A red is signal", above):
   red for chat-trigger / AI-agent build cases whose tool is an HTTP-request tool —
   the build is correct, so carry correctness in `outcomeExpectations` (agent wired
   to trigger + model + tool) and note the execution red as harness-caused.
+- **Poll/wait loops can't be fast-forwarded.** A workflow that submits an async
+  job then polls for completion (generate → poll status until ready → download)
+  can't advance the mocked status deterministically, and a `Wait` node runs in
+  real time, so the scenario reds with an execution timeout (`framework_issue`).
+  The build is correct — carry it in `outcomeExpectations` and note the red as
+  harness-caused.
 - **A build can time out and produce no scored result at all** — the run reports
   `BUILD FAILED: Run timed out` and zero graded expectations. Don't assume "spec
   too big": the more common cause is a **single-prompt case where the agent asks
@@ -366,10 +486,14 @@ red is harness-caused (per "A red is signal", above):
   — only confirmations auto-approve). Before treating a timeout as spec size,
   **classify it**: read the agent's final response in the report / trace (did it
   ask a question? flag an infeasibility? or genuinely churn through a huge
-  build?), and **re-run the case solo (`--concurrency 1`)** — concurrency makes a
-  stalled build hit the cap and masks the real reason, which a solo run surfaces
-  in seconds. Fix per cause: a clarifying-question stall → author multi-turn with
-  a director note that pre-answers it; a genuine infeasibility → it's an
+  build?), and **re-run the case solo (`--concurrency 1`)** — concurrency both
+  masks a stalled build (it hits the cap) *and* can time out a perfectly healthy
+  build purely by queueing it behind the per-instance build cap (default 4), so a
+  solo run either surfaces the real reason in seconds or simply passes outright.
+  Fix per cause: a solo run that now passes → it was **concurrency contention**,
+  not the case (split big batches across lanes — see
+  [`running-evals.md`](running-evals.md)); a clarifying-question stall → author
+  multi-turn with a director note that pre-answers it; a genuine infeasibility → it's an
   infeasibility/honesty behaviour case (`processExpectations`), not a build case;
   a true oversized spec → the timeout is itself a finding, but note it so the
   zero isn't mistaken for a scored failure.
@@ -507,20 +631,30 @@ drifted, leaves the rest unchanged, and never prunes. It's the inverse of
 
 ```bash
 cd packages/@n8n/instance-ai
-# preview first — no writes:
-dotenvx run -f .env.eval -- pnpm eval:langtracer-push --suite workflow-building --dry-run --changed
+# preview first — no writes (use `npx dotenvx`; the bare `dotenvx` binary is usually not on PATH):
+npx dotenvx run -f .env.eval -- pnpm eval:langtracer-push --suite baseline --dry-run --changed
 # then push (drop --dry-run):
-dotenvx run -f .env.eval -- pnpm eval:langtracer-push --suite workflow-building --changed
+npx dotenvx run -f .env.eval -- pnpm eval:langtracer-push --suite baseline --changed
 ```
 
 - **Selectors** (at least one required — no accidental push-all): positional
   `<slugs...>` (exact file slugs), `--changed` (new/untracked + staged + modified
   `data/workflows/*.json`, ideal right after authoring an uncommitted case),
   `--filter`/`--tier` (with `--exclude` as a modifier).
+- **Multiple positional slugs? Skip pnpm — call the script directly.** `pnpm
+  eval:langtracer-push … slugA slugB` forwards the slugs as one joined argument
+  (`"slugA slugB"`), so no case file matches and nothing is pushed. Either use a
+  no-positional selector through pnpm (`--changed`), or run the script directly so
+  each slug is its own argv: `npx dotenvx run -f .env.eval -- npx tsx
+  evaluations/cli/langtracer-push.ts --suite <slug> <slug1> <slug2> …`.
 - **Env:** `LANGTRACER_URL` + `LANGTRACER_API_KEY` (an `lt_` bearer; one key works
-  for MCP + REST) — put them in `.env.eval` and run under `dotenvx`.
+  for MCP + REST) — put them in `.env.eval` and run under `npx dotenvx`.
 - **Options:** `--set-kind regression|capability_gap` (default `regression`, must
-  match the suite's kind), `--contains-user-data` (default is `synthetic`).
+  match the suite's kind), `--contains-user-data` (default is `synthetic`). A case
+  whose **build is correct** (outcome expectations green) but that carries a
+  **currently-red execution scenario** from a builder bug is still a `regression`
+  case — it guards the fix; reserve `capability_gap` for cases where the *build
+  itself* is wrong.
 - **Scenarios sync on update too:** `PATCH /cases/:id` reconciles
   `executionScenarios` by name (update in place, insert new, delete missing —
   lang-tracer #48), so scenario edits re-push like any other field. A lang-tracer
@@ -534,6 +668,35 @@ dotenvx run -f .env.eval -- pnpm eval:langtracer-push --suite workflow-building
   case isn't transient and has no suite home, so it's the one exception to
   "don't commit the JSON" — it lives as a committed artifact.
 
+### Link the pushed case to its source (provenance step — always do this)
+
+A sourced case that isn't linked back to the conversation/finding it encodes is
+an orphan: six months later nobody can tell what real failure it guards. The
+push CLI doesn't carry provenance, so after pushing, link the case over the
+lang-tracer MCP with one **`update_test_case`** call on the new case id (the
+push prints it):
+
+1. **`sourceThreadId`** — the source conversation's thread id (plus
+   **`sourceRunId`** when the case anchors to one specific run/step within it).
+   This is the DB-level link every by-version rollup, conversation float, and
+   `?sourceThreadId=` query joins on — the tags/description below are the
+   human-readable layer on top, not a substitute. The thread must already be
+   imported into lang-tracer (running `get_conversation_analysis` on it, as the
+   sourcing flow does, is enough); `source_kind` is derived server-side, and
+   the link is only editable on authored cases — promotion-recorded provenance
+   is immutable.
+2. **`expectedBehavior`** — the rule the case enforces, one paragraph — and
+   **`failurePattern`** — what actually happened in the source thread, with
+   turn references. Copy/adapt these from the analysis's `extractedCases`
+   entry when the case came from `get_conversation_analysis`.
+
+Then **`add_case_tags`** (additive; targets the LT-side `tags` array, not
+`evalTags`, so nothing round-trips into eval runs): add a capability tag (e.g.
+`instruction-persistence`). Tag normalization is aggressive (lowercase, kebab);
+colon-form tags get silently dropped. And keep the thread id + turn refs in
+the case `description` too (the drafter's habit of "Sourced from thread <id>"
+is the convention) — the description is the only field shown everywhere.
+
 ## Running
 
 You need a running n8n instance with Instance AI enabled and a working sandbox;
@@ -544,7 +707,9 @@ existing workflows). Narrow a run with `--filter <slug>` / `--tier <name>` /
 `--exclude`. See [`running-evals.md`](running-evals.md) for the run recipes,
 parallel lanes, tiers, and baselines, and the
 [README](../../../packages/@n8n/instance-ai/evaluations/README.md) for the full
-flag list.
+flag list. Run with `--keep-workflows` when you want to review a build by hand —
+in *checkpoint* mode calibration this is how the driver opens the built thread
+(`<base-url>/assistant/<threadId>`) and workflow on the instance.
 
 ## Other eval harnesses (not this skill)
 

.agents/skills/create-instance-ai-eval/case-shapes.md

@@ -7,12 +7,13 @@ eval [README](../../../packages/@n8n/instance-ai/evaluations/README.md); this is
 the opinionated *how* and the traps.
 
 Example cases in the corpus get renamed and churned, so this file names as few
-files as possible — prefer `grep`-ing the corpus by tag/field. The one stable
-pointer worth naming: **`applies-each-change-when-asked`** for a well-built
-director conversation.
+cases as possible — search the LangTracer suite by tag/field instead (the
+`search_test_cases` MCP tool, or export the suite and grep). The one stable
+pointer worth naming: **`applies-each-change-when-asked`** (in the
+`baseline` suite) for a well-built director conversation.
 
 The schema
-([`schema.ts`](../../../packages/@n8n/instance-ai/evaluations/data/workflows/schema.ts))
+([`harness/schema.ts`](../../../packages/@n8n/instance-ai/evaluations/harness/schema.ts))
 enforces the rules you must respect:
 
 - `seedFile`, `priorConversation`, `seedThread` are **mutually exclusive** — pick
@@ -32,7 +33,7 @@ These test *how the agent converses*, not just what it builds: does it ask the
 right clarifying question, avoid re-asking, honour a mid-build correction,
 respect plan approval, batch bundled changes? They're graded by
 `processExpectations` and are often **build-only** (no `executionScenarios`).
-Tag them `behaviour` and grep that tag for patterns.
+Tag them `behaviour` and search the suite for that tag for patterns.
 
 ### How multi-turn works
 
@@ -48,7 +49,11 @@ Mode is chosen automatically from `conversation`:
   data source, delivery channel, or one-vs-two-workflow split), author it
   **multi-turn** with a `[bracketed]` director note in turn 1 that pre-answers
   those questions so the agent proceeds to build. A single-prompt build case
-  only works when the prompt leaves nothing the agent must ask about.
+  only works when the prompt leaves nothing the agent must ask about. Real sourced
+  prompts are frequently terse ("i want to create a webhook", "convert a topic
+  into a YouTube script") and almost always trigger a clarifying question —
+  **default a terse sourced prompt to multi-turn** with a director note that
+  pre-answers the setup/topology it omits.
 - **Multi-turn:** anything else. A **user-proxy LLM** plays the user — answers
   questions, audits the agent's plan against your script, and sends follow-ups
   (capped by `messageBudget`).

.agents/skills/create-instance-ai-eval/running-evals.md

@@ -41,7 +41,7 @@ instance's Instance AI config and the README's environment-variables section.
 
 | Mode | How | Produces |
 |---|---|---|
-| **Direct loop** | no `LANGSMITH_API_KEY` | `eval-results.json` + HTML report locally |
+| **Direct driver** | no `LANGSMITH_API_KEY` | `eval-results.json` + HTML report locally — same pipeline and row order as the LangSmith driver (TRUST-261), row concurrency follows `--concurrency` |
 | **LangSmith** | `LANGSMITH_API_KEY` set | also records an experiment and auto-compares against the baseline |
 | **Prebuilt** | `--prebuilt-workflows <manifest>` | skips the build; verifies existing workflows (score MCP/hand-built cohorts on the same verifier) |
 
@@ -49,6 +49,13 @@ Narrow any run with `--filter <slug>` (filename substring, comma = OR),
 `--tier <name>`, and `--exclude`. `--keep-workflows` leaves built workflows for
 inspection; `--iterations N` runs each case N times for pass@k / pass^k.
 
+## Case source: disk vs langtracer
+
+| Source | When to use it |
+|---|---|
+| **`disk`** (default) | **Preferred for local development** — authoring and calibrating the case in front of you: drop the JSON into `data/workflows/`, `--filter` it, iterate. Also the only home of the `agents` tier and the seeded carve-out cases; since the corpus migration the directory holds only those, not the full suite. |
+| **`langtracer`** (`--source langtracer --suite baseline`) | Bigger runs (the full corpus or a whole tier), re-running specific cases that already live in the suite, and CI — which always runs this way. Needs `LANGTRACER_URL`/`LANGTRACER_API_KEY` in your env. |
+
 ## Configuration & secrets
 
 The harness reads its configuration from environment variables — how you supply
@@ -125,7 +132,15 @@ your case's pass/fail.
 
 The **build** is the slow step and is capped at **4 concurrent builds per
 instance**, so throughput scales with the number of instances, not just
-`--concurrency`. Two ways to fan out:
+`--concurrency`.
+
+**Watch for false timeouts under contention:** a batch larger than the cap can
+queue a *healthy* case behind that limit until it hits the per-iteration timeout
+and reports `BUILD FAILED: Run timed out` — a run-capacity artifact, not a case
+defect (a case that builds in ~3 min solo can "time out" at 900s in a crowded
+batch). Re-run the suspect solo (`--concurrency 1`) to confirm it builds in time,
+and for batches beyond ~a dozen cases fan out across lanes rather than just
+raising `--concurrency` on one instance. Two ways to fan out:
 
 - **`scripts/run-eval-lanes.sh`** spins up N lanes as **docker containers**,
   seeds a user on each, and runs the eval with the base-URLs wired together.
@@ -153,14 +168,16 @@ groupings, propagated to LangSmith as example splits so `--tier <name>` maps to
 server-side filter. The two that matter for CI:
 
 - **`full`** — every case; nightly / full-suite runs.
-- **`pr`** — curated thin set (~6 cases) for the PR gate: high baseline
-  reliability + capability diversity.
+- **`pr`** — curated thin set for the PR gate: high baseline reliability +
+  capability diversity.
 
 Other values group cases logically (e.g. `behaviour` for conversation-behaviour
-cases, `seeded` for transient `seedThread` cases kept out of CI). Add a case to a
-tier by putting the value in its `datasets` array and re-syncing. **Only promote
-to `pr` after `--iterations 5+` shows it's reliably green** — a flaky case in the
-gate poisons it.
+cases, `seeded` for transient `seedThread` cases kept out of CI). For a new
+local case, put the value in its `datasets` array before pushing; for a case
+already in LangTracer, edit `datasets` there — `eval:langtracer-push`
+deliberately does not re-sync tier-only edits to an existing case. **Only
+promote to `pr` after `--iterations 5+` shows it's reliably green** — a flaky
+case in the gate poisons it.
 
 ## Baselines & regression
 
@@ -175,14 +192,18 @@ for low noise:
 
 ```bash
 # with your env loaded and LANGSMITH_API_KEY set, from packages/@n8n/instance-ai/
-pnpm eval:instance-ai --experiment-name instance-ai-baseline --iterations 10
+# (--dataset/--baseline-prefix mirror CI's pins — langtracer mode otherwise
+# derives suite-scoped names and later runs would never find this baseline)
+pnpm eval:instance-ai --source langtracer --suite baseline \
+  --dataset instance-ai-workflow-evals --baseline-prefix instance-ai-baseline- \
+  --experiment-name instance-ai-baseline --iterations 10
 ```
 
 LangSmith appends a random suffix; the most-recently-started `instance-ai-baseline-*`
 becomes the next comparison target. In CI, the same is a workflow dispatch:
 
 ```bash
-gh workflow run ci-instance-ai-evals.yml -f experiment-name=instance-ai-baseline -f iterations=10
+gh workflow run test-evals-instance-ai.yml -f experiment-name=instance-ai-baseline -f iterations=10
 gh workflow run ci-instance-ai-evals.yml -f pr=<number>   # re-run evals against a PR's head
 ```
 

.agents/skills/create-instance-ai-eval/sourcing-cases.md

@@ -36,7 +36,14 @@ connected.)
    real, recurring failure modes.
 2. **Pull the conversations** — `list_conversations` (e.g. `verdict:"bad"`,
    `analyzed:"yes"`) → `get_conversation` (raw trace) + `get_conversation_analysis`
-   (findings). `get_linear_ticket_context` links a thread to its ticket.
+   (findings). `get_linear_ticket_context` links a thread to its ticket. To target
+   **execution failures**, add `funnelDrop:"05"` (built + launched an execution
+   that never *succeeded*). **Caveat: the funnel drop is a *conversion* signal, not
+   a build-quality one** — most `funnelDrop:"05"` threads are healthy builds that
+   correctly routed to credential setup, or the user simply abandoned, so the drop
+   alone tells you nothing about the build. **Pair it with `verdict:"bad"`** to
+   filter down to threads where the analyser actually flagged a build/execution
+   defect (in one sample: 131 raw drops → 18 once `verdict:"bad"` was added).
 3. **Verify before trusting a finding.** The analyser keys off tool-call *spans*
    (was `build-workflow` called on this turn?), which it reads reliably — but a
    content-dependent claim ("invented ID", "missing node") can be wrong when it
@@ -55,6 +62,28 @@ connected.)
    its trace is pruned or deleted — so it has no durable home; that's exactly why
    step 4 turns the confirmed failure into a durable synthetic case.
 
+## Sourcing a regression baseline (successful builds)
+
+The discover→verify→encode flow above hunts **failures**. The complementary need
+— a broad **regression baseline** of things that already work — is sourced the
+opposite way: from conversations where a workflow was **built and executed
+without errors**. Use `list_conversations` with the **conversion-funnel** filter:
+
+- `funnelStep: '03'` = built a workflow, `'04'` = launched an execution, `'05'` =
+  execution succeeded, `'06'` = published (each step is a strict subset — also
+  reached every earlier step). For "built + executed cleanly" cases, **`'05'`** is
+  the signal; add `language: 'eng'` to keep prompts English.
+- The result is large — it spills to a file. Triage by first prompt:
+  `jq -r '.data[] | "\(.threadId)\t\(.firstUserPrompt[0:180])"'`. Skip "The
+  execution failed…" debugging threads (they didn't cleanly build) and off-topic
+  app-build requests.
+- Author a **build case** per selected thread (prompt in the user's voice,
+  grounded in the real `firstUserPrompt`; note the source thread id in
+  `description`). These are `regression`-kind cases whose value is coverage of a
+  working capability, not a currently-red gap — you rarely need `get_conversation`
+  when the first prompt already specifies the build. Terse prompts almost always
+  need a multi-turn director note (see [`case-shapes.md`](case-shapes.md)).
+
 ## Two practical notes on `get_conversation_analysis`
 
 - **It hands you draft cases.** The response's

.agents/skills/nathan/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: n8n:nathan
+description: Deploy a temporary n8n test instance (or generate a local docker run command) via the internal "Nathan" bot, from the repo instead of Slack. Use after opening a PR to offer the user a live test instance, or whenever someone asks to spin up / deploy a test instance for a branch.
+allowed-tools: Bash(pnpm nathan:*), Bash(node scripts/nathan.mjs:*), Bash(git diff:*), Read
+---
+
+# Nathan — repo-local test instances
+
+Nathan is n8n's internal bot that deploys throwaway test instances from a branch
+or Docker image. It's normally driven from Slack (`/nathan ...`); this skill runs
+the same commands from the repo via `pnpm nathan`.
+
+## Prerequisites
+
+- **No tunnel setup needed.** Nathan replies asynchronously through a short-lived
+  public tunnel that the script opens for you (`npx localtunnel`). A `deploy` to a
+  **new** `test-<name>` also polls that instance URL directly, so it still reports
+  success even if the tunnel drops. (Redeploying a name that's *already up* skips
+  the poll — it can't tell the old instance from the new — so it falls back to the
+  tunnel; prefer a fresh name when you need the reliable report.)
+- **A token in `~/.n8n/dev/nathan-token`.** If a command reports no token, **ask the
+  user for one** — point them at the form
+  (`https://internal.users.n8n.cloud/form/d6d34a2f-4899-4ee8-afc8-f8c41a8a243d`),
+  where they log in with their n8n account and copy the token from the response —
+  then save it for them (the script's interactive paste prompt needs a real
+  terminal, so as an agent use the subcommand):
+
+  ```bash
+  pnpm nathan set-token '<PASTED_TOKEN>'
+  ```
+
+## Offer a test instance
+
+### Only when it's worth it
+
+Use judgement — don't offer for every branch. **Offer** when the change is
+something a person would actually want to click through in a running instance:
+
+- New features / feature branches
+- UI / editor changes, node changes, workflow-execution or behaviour changes
+- Larger or user-facing diffs
+
+**Skip the offer** (a test instance adds nothing) for:
+
+- Dev tooling, CI, build config, scripts (like this one)
+- Docs-only or tests-only changes
+- Tiny bug fixes, no-behaviour-change refactors, dependency bumps
+
+When skipping, don't nag — at most mention once that a test instance is available
+on request.
+
+### Offer after opening a PR, and re-offer on push
+
+After you open a PR for a branch that warrants it, **offer a live test instance.**
+Also **re-offer whenever you `git push` new commits** to such a branch — the
+deployed instance reflects the pushed code, so a new push means a new build worth
+redeploying. Don't just ask a bare yes/no — look at the diff and **propose a
+sensible profile**, then let them confirm or adjust. For example:
+
+> "Want a test instance for this? Based on the diff I'd deploy it with instance AI
+> enabled (`--ai`) since it touches the AI assistant. Sound good, or a different
+> license?"
+
+### Pick the profile from the PR contents
+
+Inspect what the PR changes (`git diff --stat origin/master...HEAD` and the file
+paths / feature area), then choose:
+
+| PR touches… | Suggest | Why |
+|---|---|---|
+| AI features — `@n8n/nodes-langchain`, `@n8n/instance-ai`, the AI assistant/builder, `N8N_AI_*`, "askAi"/agent code | `--ai` | Enables instance AI (and defaults the license to pro2) so the AI features actually run |
+| License-gated / enterprise features — `.ee.ts` files or `/ee/` dirs, license checks (`@n8n_io/license-sdk`, `hasFeature`), SSO/SAML/OIDC/LDAP, RBAC/roles/scopes, projects, variables, external secrets, source control/environments, log streaming, insights, folders | `--enterprise` | The feature is gated behind a license and won't be testable on community |
+| A specific gated feature/quota you want on/off | `--license pro2 --featureOverride <featureKey>:<value>` | Bakes the override into a generated license (community/enterprise can't be overridden) |
+| Anything else — core nodes, generic UI, non-gated bug fixes | *(nothing — community default)* | No license needed |
+
+If both AI and enterprise apply, combine them: `--ai --enterprise`. When unsure,
+state your best guess and ask. Run `pnpm nathan help` for the full flag reference.
+
+### Deploy
+
+```bash
+pnpm nathan deploy <branch-name> test-<short-name> [flags]
+```
+
+Nathan builds the branch image (a few minutes) and the command prints the instance
+URL (`https://test-<short-name>.stage-app.n8n.cloud`, login `test@n8n.io` /
+`helloWorld7`). Relay that URL to the user.
+
+## Common commands
+
+```bash
+pnpm nathan help                                   # full option reference
+pnpm nathan deploy my-branch test-my-feature       # community license
+pnpm nathan deploy my-branch test-sso --enterprise # enterprise license
+pnpm nathan deploy my-branch test-ai --ai          # instance AI (license -> pro2)
+pnpm nathan deploy nightly test-nightly            # deploy the n8nio/n8n:nightly image
+```
+
+Key flags (after the deploy args): `--license community|enterprise|starter|pro1|pro2|trial`,
+`--enterprise`, `--ai`, `-e KEY=value` (repeatable), `--featureOverride key:value`
+(needs a generated license).
+
+## `local` caveat
+
+`pnpm nathan local ...` generates a runnable `docker run` bundle, but Nathan
+delivers it as **Slack file attachments** (`run-n8n.sh` + `.env`), not to the
+terminal — they land in **#updates-pnpm-nathan**
+(https://n8nio.slack.com/archives/C0BGVHZ0SCW). `deploy` and `help` return fully
+in the terminal.
+
+**Do not invent a `NATHAN_SLACK_CHANNEL`.** Leave it unset (it defaults to
+#updates-pnpm-nathan); only set it if the user explicitly gives you a channel id.
+
+## Unsupported
+
+Queue mode, multi-main, and non-SQLite databases are not supported by Nathan.

.agents/skills/public-api/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: n8n:public-api
+description: >-
+  Adds or updates n8n Public API v1 endpoints, OpenAPI specs, and handler wiring.
+  Use when creating public API handlers, registering paths in openapi.yml, or adding OpenAPI tags. Always use @PublicApiController for new endpoints (API-37+).
+---
+
+# Public API v1
+
+Public API lives under `packages/cli/src/public-api/v1/`.
+
+**Always use `@PublicApiController` for new endpoints (API-37+).** Do not add new business logic to `express-openapi-validator` handlers. Controllers use the same decorator style as internal `@RestController`, mounted at `/api/v1` with API-key auth and public errors via `PublicApiControllerRegistry`.
+
+**Legacy (existing endpoints only):** `express-openapi-validator` handlers under `handlers/`; OpenAPI path specs are YAML under each handler's `spec/` directory.
+When you touch a legacy endpoint, migrate it to `@PublicApiController` rather than extending the eov handler. Do not mix data-access styles within a new feature.
+
+## Architecture
+
+Convergence is at the **service layer**, not HTTP. Public and internal stay as
+two sibling routes over one shared service — neither calls the other:
+
+```
+GET /rest/tags    → TagsController         ┐  JWT auth, internal shape
+                                            ├─→ TagService
+GET /api/v1/tags  → TagsPublicController   ┘  API-key auth, public DTO
+```
+
+## Adding an endpoint (required: controller pattern)
+
+Reference: `v1/controllers/tags.public.controller.ts` (`GET /tags`).
+
+1. **Public DTOs** in `@n8n/api-types` — input query/body + output resource DTO
+   (distinct from internal shapes when they diverge). Use `Z.class` so the
+   registry can validate/parse. Wrap list payloads as objects (e.g. `{ data: [...] }`),
+   same as `TagListPublicDto` / `WorkflowVersionHistoryListPublicDto`.
+2. **Controller** — `v1/controllers/<feature>.public.controller.ts`
+   ```ts
+   @PublicApiController('/tags')
+   export class TagsPublicController {
+     constructor(private readonly tagService: TagService) {}
+
+     @Get('/')
+     @ApiKeyScope('tag:list')
+     @ApiResponse(TagListPublicDto)
+     async getTags(_req, _res, @Query q: ListTagsQueryDto) { /* call service */ }
+   }
+   ```
+   - Reuse `@Get/@Post/@Body/@Query/@Param/@GlobalScope/@ProjectScope` as-is.
+   - For `@ProjectScope` on workflow/credential routes, name the path param
+     `workflowId` / `credentialId` (or `projectId` / `dataTableId`) — the
+     registry passes `req.params` to `userHasScopes`, which does not remap `id`.
+   - `@ApiKeyScope` — string, or `{ anyOf }` / `{ allOf }` (no bare arrays).
+   - `@ApiResponse(Dto)` — registry `.parse()`s the return value (strips
+     undeclared fields). Shape is provisional until API-39 (doc-gen).
+   - Delegate to the same service as the internal REST controller.
+3. **Side-effect import** the controller from
+   `packages/cli/src/public-api/v1/controllers/index.ts` (re-exported via
+   `public-api/index.ts`) so metadata is registered before
+   `PublicApiControllerRegistry.activate`. Name the file
+   `*.public.controller.ts` — `public-api-controllers.test.ts` fails CI if a
+   controller file is missing from that barrel or lives outside `controllers/`.
+4. **OpenAPI path spec** — still required for docs + `scope-parity.test.ts`
+   (`handlers/<feature>/spec/paths/…`, `$ref` in `openapi.yml`). Set
+   `operationId`, `x-required-scope` matching `@ApiKeyScope`. **Do not** set
+   `x-eov-operation-id` / `x-eov-operation-handler` — those are legacy eov-only;
+   scope-parity and discover read `@ApiKeyScope` from the controller by matching
+   method + path.
+5. **Coverage manifest** — add every new OpenAPI endpoint to
+   `packages/nodes-base/nodes/N8n/n8n-api-coverage.json`.
+
+## Legacy eov handlers (do not use for new endpoints)
+
+Only for maintaining endpoints not yet migrated:
+
+1. **Handler** — `handlers/<feature>/<feature>.handler.ts`
+   - Export middleware arrays keyed by `x-eov-operation-id`.
+   - For scope-protected endpoints, use `publicApiScope()` or
+     `apiKeyHasScopeWithGlobalScopeFallback()` (they tag the scope-enforcement
+     middleware with `__apiKeyScope`) and add matching `x-required-scope` in the
+     path YAML; use `none` for endpoints without an API-key scope (see
+     `scope-parity.test.ts`).
+   - **Delegate to the same service layer as the internal REST API.**
+     Parse input with `@n8n/api-types` DTOs, call `Container.get(SomeService)`,
+     map errors — do not reach into repositories or duplicate business logic.
+2. **OpenAPI path spec** — `handlers/<feature>/spec/paths/<path>.yml`
+   - Set `tags: [<TagName>]` matching a top-level tag in `openapi.yml`.
+3. **Register path** — add a `$ref` entry under `paths:` in `openapi.yml`.
+4. **Request types** — add a namespace in `packages/cli/src/public-api/types.ts`
+   when the handler needs typed query/body params.
+5. **Coverage manifest** — add every new OpenAPI endpoint to
+   `packages/nodes-base/nodes/N8n/n8n-api-coverage.json`.
+
+## `tags` array in `openapi.yml`
+
+When adding or editing the top-level `tags:` array in
+`packages/cli/src/public-api/v1/openapi.yml`, **keep entries sorted
+alphabetically by `name`**. Insert the new tag in order; do not append to the end.
+
+```yaml
+tags:
+  - name: Audit
+    description: Operations about security audit
+  - name: CommunityPackage
+    description: Operations about community packages
+  # … remaining tags in A→Z order by name
+```
+
+`scope-parity.test.ts` asserts this ordering — CI fails if tags drift out of
+sort order.
+
+## Reference
+
+- **Controller pattern (required for new work):** `v1/controllers/tags.public.controller.ts`, `v1/controllers/workflows.public.controller.ts`
+- **Registry:** `packages/cli/src/public-api/public-api-controller.registry.ts`
+- Legacy eov examples (migration targets, not templates for new endpoints):
+  `handlers/insights/`, `handlers/variables/`, `handlers/folders/`,
+  `handlers/projects/`, `handlers/data-tables/`, `handlers/workflows/`
+- Multipart: `handlers/n8n-packages/` (see also
+  `packages/cli/src/modules/n8n-packages/CLAUDE.md`)

.agents/skills/telemetry/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: n8n:telemetry
+description: >-
+  Guides adding, changing, and reviewing telemetry through the `@n8n/telemetry`
+  event registry. Use when working on telemetry, analytics, tracking, product
+  events, `track()` calls, or RudderStack/PostHog product events, in frontend
+  or backend code — and whenever you need to find which registered telemetry
+  events exist, what an event means, or what properties it carries.
+---
+
+# Telemetry
+
+## The registry
+
+Events migrated to the registry live in `packages/@n8n/telemetry` as one entry per event — its exact emitted name, a description, and a zod schema typing its properties — organized per product domain in `src/events/` and composed into `TELEMETRY_EVENT.<DOMAIN>.<EVENT>`. The package defines registered events and never depends on transport SDKs.
+
+**To find which events are registered, what they mean, or what properties they carry, run the catalog first:**
+
+```bash
+pnpm --filter @n8n/telemetry catalog          # human-readable, grouped by domain
+pnpm --filter @n8n/telemetry catalog --json   # structured, for programmatic use
+```
+
+The registry is being adopted incrementally. Events not yet registered do not appear in the catalog, so search `track()` call sites when the catalog has no match.
+
+Pass the entry itself to `track()` — it resolves the emitted name internally:
+
+```ts
+import { TELEMETRY_EVENT } from '@n8n/telemetry';
+
+telemetry.track(TELEMETRY_EVENT.PLATFORM.USER_IS_PART_OF_EXPERIMENT, {
+	name: experimentName,
+	variant,
+});
+```
+
+Both `track()` implementations accept registry entries and plain strings. Plain strings remain supported for events that have not yet migrated:
+
+- Frontend: `packages/frontend/editor-ui/src/app/plugins/telemetry/index.ts`
+- Backend: `packages/cli/src/telemetry/index.ts`
+
+Entries get property autocomplete and compile-time checks — typo'd, missing, or wrongly typed properties fail typecheck. When the telemetry transport is initialized, `track()` additionally validates registered-event payloads via `getEventValidationError` (shared from `@n8n/telemetry`) and logs a warning on mismatch, including unrecognized properties that slipped past structural typing. A validation warning does not stop the event from being emitted.
+
+## Adding an event
+
+1. **Check the catalog first** (`pnpm --filter @n8n/telemetry catalog`). If an existing event covers the same user action from another surface, augment it with a property instead of adding a near-duplicate event.
+2. **Pick the domain by the event's subject** — what the event is about, never the surface that triggered it. `User opened Credential modal` is CREDENTIALS whether opened from the NDV, template setup, or chat. The trigger context goes into a `source` property.
+3. **Name it with the house grammar:** sentence case, actor first, past-tense verb, specific object (`User pinned node data`). No template interpolation in names — variability goes into properties. The name must snake_case cleanly into a BigQuery table name: no punctuation beyond spaces, no casing that collides after snake_casing.
+4. **Write the entry `description`** stating what the event means and when it fires — a registry test rejects blank descriptions. Document individual properties with `.describe()` where the key alone is not obvious.
+5. **Type the properties with zod (`import { z } from 'zod/v4'`):** `snake_case` keys, explicit `.optional()` where a call site may omit a value, `z.looseObject()`/`.catchall()` for genuinely dynamic remainders. Schemas must stay JSON-Schema-representable — no transforms, refinements, or `z.date()` (a registry test enforces this via `z.toJSONSchema()`).
+6. **Place the emission:** frontend via `useTelemetry().track(...)`; backend either through a `RelayEventMap` handler in `packages/cli/src/events/relays/telemetry.event-relay.ts` (event-bus-driven) or a direct `Telemetry.track(...)` call — both reference the same registry entry.
+
+## Hard rules
+
+- **Never rename an emitted event.** BigQuery materializes one table per event name; a rename orphans downstream history. A rename is delete + create, names are never reused, and removals must be coordinated with the data team before deleting the registry entry.
+- **Never duplicate an event name** — one entry per event across all domains, referenced by every call site (even FE + BE). CI fails on collision.
+- **Properties evolve additively only.** Changing a property's type forks warehouse columns even under a stable name. Mark deprecations on the schema (`.meta({ deprecated: true })`) instead of removing.
+- **Breaking changes need a data-team heads-up** in Slack plus a Notion note before they ship.
+
+## Testing
+
+Do not retype event-name literals in tests:
+
+- In call-site tests, mock `useTelemetry().track` or the backend `Telemetry.track` service and expect the registry entry itself with the payload.
+- In frontend transport tests, expect `window.rudderanalytics.track` to receive `entry.name` and the augmented payload.
+- In backend transport tests, expect the RudderStack payload's `event` field to equal `entry.name` and its `properties` to include the event payload.
+
+## Related
+
+Experiment exposure and metric events follow `n8n:experiments` (`.agents/skills/experiments/SKILL.md`).

.boundaries-baseline.json

@@ -0,0 +1,3 @@
+{
+  "issues": 169
+}

.claude/plugins/n8n/skills/nathan

@@ -0,0 +1 @@
+../../../../.agents/skills/nathan

.claude/plugins/n8n/skills/public-api

@@ -0,0 +1 @@
+../../../../.agents/skills/public-api

.claude/plugins/n8n/skills/telemetry

@@ -0,0 +1 @@
+../../../../.agents/skills/telemetry

.claude/settings.json

@@ -12,7 +12,7 @@
 			"Bash(popd)",
 			"Bash(pushd:*)",
 			"Bash(mkdir -p .claude/plans)",
-			"Write(.claude/plans/*)"
+			"Edit(.claude/plans/*)"
 		]
 	},
 	"hooks": {

.github/CODEOWNERS

@@ -3,3 +3,4 @@ packages/@n8n/db/src/migrations/ @n8n-io/migrations-review
 .github/scripts @n8n-io/qa-dx
 .github/actions @n8n-io/qa-dx
 .github/poutine-rules @n8n-io/qa-dx
+docker/get-n8n.sh @n8n-io/qa-dx

.github/WORKFLOWS.md

@@ -196,7 +196,10 @@ on every push made cost untenable; firing on every review approval cascaded
 through the dismiss-stale-on-push → re-approve loop, which also blew up.
 The current trigger fires once per `opened` / `reopened` / `ready_for_review`
 on a non-fork PR touching the eval surface, and runs the `pr` test-case dataset
-(~6 high-reliability, capability-diverse cases) instead of the full ~14. To
+(a small set of high-reliability, capability-diverse cases) instead of the full
+suite. Test cases are pulled at run time from the LangTracer suite
+`baseline` — the source of truth; CI has no disk fallback (local runs
+keep `--source disk` for authoring). To
 re-run after pushing a fix, dispatch `ci-instance-ai-evals.yml` with the PR
 number (optionally `tier: full` for broader coverage) — results post back to
 the PR. The lighter `test-evals-discovery.yml` still runs on every push as part
@@ -206,8 +209,8 @@ of `ci-pull-requests.yml`.
 the lab bench.** The gate deliberately exposes only PR re-runs. Anything that
 isn't PR gating — baselines, model experiments, arbitrary branch runs — goes
 through `test-evals-instance-ai.yml`'s own dispatch form ("Instance AI
-Evals: Experiments"): full knob set (branch, filter, tier, iterations, experiment-name,
-model), no per-PR cancellation (dispatches run in parallel, e.g. concurrent
+Evals: Experiments"): full knob set (branch, filter, tier, suite,
+iterations, experiment-name, model), no per-PR cancellation (dispatches run in parallel, e.g. concurrent
 model-comparison arms), and SHA-keyed docker cache hits on master. Evals never
 run on fork PRs: the event trigger gates on `head.repo.fork`, and the `pr`
 re-run path refuses fork PRs in `resolve` (dispatched runs carry secrets).

.github/actions/setup-nodejs/action.yml

@@ -7,9 +7,9 @@ description: 'Configures Node.js with pnpm, installs Aikido SafeChain for supply
 
 inputs:
   node-version:
-    description: 'Node.js version to use. Pinned to 24.16.0 by default for reproducible builds.'
+    description: 'Node.js version to use. Pinned to 24.18.0 by default for reproducible builds.'
     required: false
-    default: '24.16.0'
+    default: '24.18.0'
   enable-docker-cache:
     description: 'Whether to set up Blacksmith Buildx for Docker layer caching (Blacksmith runners only).'
     required: false
@@ -251,8 +251,15 @@ runs:
       shell: bash
       run: echo "running=${TURBOGHA_PORT:+true}" >> "$GITHUB_OUTPUT"
 
+    # Skipped on Windows: the turbogha server binds IPv4 while `localhost`
+    # resolves to IPv6 first there, so turbo can never reach it (the build
+    # logs `failed to contact remote cache` for every artifact and falls back
+    # to a local cache). The remote cache is inert, but the action's post-run
+    # still fetches the unreachable server to save it and dies with a bare
+    # `fetch failed`, turning the whole job red. Skip it so the one Windows
+    # build job stays green; Linux/Blacksmith jobs keep remote caching.
     - name: Configure Turborepo Cache
-      if: steps.turbo-server.outputs.running != 'true'
+      if: steps.turbo-server.outputs.running != 'true' && runner.os != 'Windows'
       uses: rharkor/caching-for-turbo@5d14fba18e450c09393333cfd4242e8b3cb455a6 # v2.4.2
       with:
         server-port: 0

.github/actions/setup-nodejs/safe-chain.config.json

@@ -10,9 +10,7 @@
 			"n8n-node-dev",
 			"n8n-nodes-base",
 			"n8n-playwright",
-			"n8n-workflow",
-			"typescript",
-			"@typescript/*"
+			"n8n-workflow"
 		]
 	}
 }

.github/scripts/docker/docker-config.mjs

@@ -78,6 +78,7 @@ class BuildContext {
 	sanitizeBranch(branch) {
 		if (!branch) return 'unknown';
 		return branch
+			.replace(/^refs\/heads\//, '')
 			.toLowerCase()
 			.replace(/[^a-z0-9._-]/g, '-')
 			.replace(/^[.-]/, '')

.github/scripts/set-latest-for-monorepo-packages.mjs

@@ -1,7 +1,18 @@
+import semver from 'semver';
+
 import { getMonorepoProjects } from './pnpm-utils.mjs';
 
 const NPM_REGISTRY = 'https://registry.npmjs.org';
 
+// Standalone packages release from master out-of-sync with the main pipeline
+// (release-standalone-package.yml), so their `latest` follows the newest beta
+// on npm instead of the version recorded in the stable checkout.
+const STANDALONE_PACKAGES_FOLLOWING_BETA = new Set([
+	'@n8n/create-node',
+	'@n8n/eslint-plugin-community-nodes',
+	'@n8n/scan-community-package',
+]);
+
 /**
  * @param {string} name
  * @param {string} version
@@ -23,6 +34,30 @@ async function setDistTag(name, version, tag, token) {
 	});
 }
 
+/** @param {string} name */
+async function getDistTags(name) {
+	const res = await fetch(`${NPM_REGISTRY}/-/package/${encodeURIComponent(name)}/dist-tags`);
+	if (!res.ok) {
+		throw new Error(`Failed to fetch dist-tags for ${name}: HTTP ${res.status}`);
+	}
+	return await res.json();
+}
+
+/**
+ * Resolve the version `latest` should point at, or null if no move is needed.
+ * Standalone packages follow the npm `beta` dist-tag; a standalone release
+ * from master may already have pushed `latest` past beta, so never downgrade.
+ * @param {import('./pnpm-utils.mjs').PnpmPackage} pkg
+ */
+export async function resolveLatestVersion(pkg) {
+	if (!STANDALONE_PACKAGES_FOLLOWING_BETA.has(pkg.name)) return pkg.version;
+
+	const tags = await getDistTags(pkg.name);
+	const target = tags.beta ?? pkg.version;
+	if (tags.latest && semver.gte(tags.latest, target)) return null;
+	return target;
+}
+
 async function setLatestForMonorepoPackages() {
 	const token = process.env.NPM_TOKEN;
 	if (!token) {
@@ -39,10 +74,15 @@ async function setLatestForMonorepoPackages() {
 	const failures = [];
 
 	for (const pkg of publishedPackages) {
-		const versionName = `${pkg.name}@${pkg.version}`;
-
 		try {
-			const res = await setDistTag(pkg.name, pkg.version, 'latest', token);
+			const version = await resolveLatestVersion(pkg);
+			if (version === null) {
+				console.log(`Skipped ${pkg.name}: latest is already at or ahead of beta`);
+				continue;
+			}
+
+			const versionName = `${pkg.name}@${version}`;
+			const res = await setDistTag(pkg.name, version, 'latest', token);
 
 			if (res.ok) {
 				console.log(`Set ${versionName} as latest`);
@@ -53,8 +93,8 @@ async function setLatestForMonorepoPackages() {
 			}
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
-			console.error(`Failed to set ${versionName} as latest: ${message}`);
-			failures.push(versionName);
+			console.error(`Failed to set latest for ${pkg.name}: ${message}`);
+			failures.push(pkg.name);
 		}
 	}
 

.github/scripts/set-latest-for-monorepo-packages.test.mjs

@@ -0,0 +1,53 @@
+import { describe, it, before, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+
+/**
+ * Run these tests by running
+ *
+ * node --test --experimental-test-module-mocks ./.github/scripts/set-latest-for-monorepo-packages.test.mjs
+ * */
+
+let resolveLatestVersion;
+before(async () => {
+	({ resolveLatestVersion } = await import('./set-latest-for-monorepo-packages.mjs'));
+});
+
+const originalFetch = globalThis.fetch;
+afterEach(() => {
+	globalThis.fetch = originalFetch;
+});
+
+function mockDistTags(tags) {
+	globalThis.fetch = async () => ({ ok: true, json: async () => tags });
+}
+
+describe('resolveLatestVersion', () => {
+	it('uses the checkout version for regular monorepo packages', async () => {
+		globalThis.fetch = async () => {
+			throw new Error('should not fetch dist-tags for regular packages');
+		};
+		const version = await resolveLatestVersion({ name: '@n8n/config', version: '1.2.3' });
+		assert.equal(version, '1.2.3');
+	});
+
+	it('pins standalone packages to the beta dist-tag', async () => {
+		mockDistTags({ beta: '0.40.1', latest: '0.39.3' });
+		const version = await resolveLatestVersion({ name: '@n8n/create-node', version: '0.39.3' });
+		assert.equal(version, '0.40.1');
+	});
+
+	it('never downgrades latest below a newer standalone release', async () => {
+		mockDistTags({ beta: '0.40.1', latest: '0.41.0' });
+		const version = await resolveLatestVersion({ name: '@n8n/create-node', version: '0.39.3' });
+		assert.equal(version, null);
+	});
+
+	it('skips standalone packages without a beta tag when latest is current', async () => {
+		mockDistTags({ latest: '0.25.0' });
+		const version = await resolveLatestVersion({
+			name: '@n8n/eslint-plugin-community-nodes',
+			version: '0.25.0',
+		});
+		assert.equal(version, null);
+	});
+});

.github/workflows/build-base-image.yml

@@ -29,7 +29,7 @@ jobs:
         # While we're on alpine 3.22 awaiting NODE-4184 (graphicsmagick → sharp
         # migration that unblocks 3.23), Node 26 base builds can't succeed.
         # Restore '26' to this matrix once 3.23 is back.
-        node_version: ['22', '24.16.0']
+        node_version: ['22', '24.18.0']
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 

.github/workflows/ci-master.yml

@@ -30,11 +30,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [22.22.3, 24.16.0]
+        node-version: [22.22.3, 24.18.0]
     with:
       ref: ${{ github.sha }}
       nodeVersion: ${{ matrix.node-version }}
-      collectCoverage: ${{ matrix.node-version == '24.16.0' }}
+      collectCoverage: ${{ matrix.node-version == '24.18.0' }}
     secrets: inherit
 
   lint:

.github/workflows/ci-mcp-evals.yml

@@ -69,3 +69,5 @@ jobs:
       N8N_ENCRYPTION_KEY: ${{ secrets.N8N_ENCRYPTION_KEY }}
       EVALS_LANGSMITH_ENDPOINT: ${{ secrets.EVALS_LANGSMITH_ENDPOINT }}
       EVALS_LANGSMITH_API_KEY: ${{ secrets.EVALS_LANGSMITH_API_KEY }}
+      EVALS_LANGTRACER_URL: ${{ secrets.EVALS_LANGTRACER_URL }}
+      LANGTRACER_API_KEY: ${{ secrets.LANGTRACER_API_KEY }}

.github/workflows/mutation-health-nightly.yml

@@ -58,7 +58,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.16.0
+          node-version: 24.18.0
 
       - name: Fetch read-all live ledger from BigQuery
         # Read-all (no ?package= param): one curl returns every row across
@@ -179,16 +179,16 @@ jobs:
         # source_file re-score path). Without it emit-payload falls back to git,
         # which yields null churn/fix_density on this shallow clone.
         run: |
-          signals_arg=""
+          signals_arg=()
           if [ -f .mutation-health/signals.json ]; then
-            signals_arg="--signals .mutation-health/signals.json"
+            signals_arg=(--signals .mutation-health/signals.json)
           else
             echo "::notice::signals.json not present — churn/fix_density will fall back to git (null on shallow clone)."
           fi
           node scripts/mutation-health/emit-payload.mjs \
             --summary "$REPORTS_DIR/summary.json" \
             --package "$PACKAGE_NAME" \
-            $signals_arg
+            "${signals_arg[@]}"
 
       - name: POST result payload
         env:

.github/workflows/release-chromatic.yml

@@ -25,7 +25,7 @@ jobs:
           build-command: pnpm run build --filter=@n8n/utils --filter=@n8n/vitest-config --filter=@n8n/chat --filter=@n8n/design-system
 
       - name: Publish to Chromatic
-        uses: chromaui/action@1cfa065cbdab28f6ca3afaeb3d761383076a35aa # v11
+        uses: chromaui/action@14cfaef73576e69f95f47f60058063f46ca38719 # v18.1.0
         id: chromatic_tests
         with:
           workingDir: packages/frontend/@n8n/storybook

.github/workflows/release-publish-post-release.yml

@@ -80,9 +80,12 @@ jobs:
 
   ensure-correct-latest-version-on-npm:
     name: Ensure correct latest version on npm
+    # Also runs on beta patches: standalone packages pin `latest` to the newest
+    # beta, so every beta publish needs a re-pin, not just stable promotions.
     if: |
       inputs.bump == 'minor' ||
-      (inputs.track == 'stable' && inputs.release_type != 'rc')
+      (inputs.track == 'stable' && inputs.release_type != 'rc') ||
+      (inputs.track == 'beta' && inputs.release_type != 'rc')
     uses: ./.github/workflows/release-set-stable-npm-packages-to-latest.yml
     secrets: inherit
 

.github/workflows/release-publish.yml

@@ -253,4 +253,4 @@ jobs:
         run: |
           node .github/scripts/slack/notify.mjs \
             --channel C036AELNMV0 \
-            --text '<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|Release publish failed for n8n@${{ needs.determine-version-info.outputs.version }}>. Please Go to the actions page and retry failed runs to recover a flake in the release pipeline.'
+            --text '<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|Release publish failed for n8n@${{ needs.determine-version-info.outputs.version }}>. Please go to the actions page and retry failed runs to recover a flake in the release pipeline. <!subteam^S08FYH9C9ME|@release-captain>'

.github/workflows/release-push-to-channel.yml

@@ -75,7 +75,7 @@ jobs:
     steps:
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.16.0
+          node-version: 24.18.0
 
       # Remove after https://github.com/npm/cli/issues/8547 gets resolved
       - run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc

.github/workflows/release-standalone-package.yml

@@ -8,14 +8,19 @@ on:
         required: true
         type: choice
         options:
-          - '@n8n/codemirror-lang'
-          - '@n8n/codemirror-lang-html'
-          - '@n8n/codemirror-lang-sql'
           - '@n8n/create-node'
           - '@n8n/eslint-plugin-community-nodes'
-          - '@n8n/node-cli'
           - '@n8n/scan-community-package'
-# All packages listed above require OIDC enabled in NPM. https://docs.npmjs.com/trusted-publishers
+      bump:
+        description: 'Version bump type'
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+# This workflow publishes out-of-sync with the main release pipeline, so it uses
+# token auth (secrets.NPM_DIST_TAG_AND_INITIAL_PUBLISH_TOKEN) rather than trusted
+# publishing (OIDC) — the OIDC relationship is reserved for release-publish.yml.
 
 concurrency:
   group: release-package-${{ github.event.inputs.package }}
@@ -25,15 +30,14 @@ env:
   CACHE_KEY: ${{ github.sha }}-${{ github.event.inputs.package }}-build
 
 jobs:
-  publish-to-npm:
-    name: Publish to NPM
+  bump-and-push:
+    name: Bump version and push to master
     runs-on: ubuntu-latest
-    timeout-minutes: 15
-    environment: npm
-    permissions:
-      id-token: write
-    env:
-      NPM_CONFIG_PROVENANCE: true
+    timeout-minutes: 10
+    environment: minor-release-tag-merge
+    outputs:
+      version: ${{ steps.bump.outputs.version }}
+      sha: ${{ steps.push.outputs.sha }}
 
     steps:
       - name: Check branch
@@ -42,19 +46,88 @@ jobs:
           echo "::error::This workflow can only be run from the master branch"
           exit 1
 
+      - name: Generate GitHub App Token
+        id: generate_token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        with:
+          app-id: ${{ secrets.RELEASE_TAG_MERGE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_TAG_MERGE_PRIVATE_KEY }}
+          skip-token-revoke: false
+
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: master
+          token: ${{ steps.generate_token.outputs.token }}
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: '24.18.0'
+
+      # A version bump only edits one package.json, so no workspace install/build
+      # is needed. `pnpm ls -r --only-projects` reads the workspace config directly.
+      - name: Bump version
+        id: bump
+        env:
+          PACKAGE: ${{ github.event.inputs.package }}
+          BUMP: ${{ github.event.inputs.bump }}
+        run: |
+          PKG_PATH=$(pnpm ls -r --only-projects --json | jq -r --arg n "$PACKAGE" '.[] | select(.name==$n) | .path')
+          if [ -z "$PKG_PATH" ]; then
+            echo "::error::Could not resolve path for package '$PACKAGE'"
+            exit 1
+          fi
+          NEW_VERSION=$(cd "$PKG_PATH" && npm version "$BUMP" --no-git-tag-version)
+          NEW_VERSION=${NEW_VERSION#v}
+          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "Bumped $PACKAGE to $NEW_VERSION"
+
+      - name: Commit and push version bump
+        id: push
+        env:
+          PACKAGE: ${{ github.event.inputs.package }}
+          NEW_VERSION: ${{ steps.bump.outputs.version }}
+        run: |
+          git config user.name "n8n-release-tag-merge[bot]"
+          git config user.email "256767729+n8n-release-tag-merge[bot]@users.noreply.github.com"
+          git commit -am "build: release ${PACKAGE}@${NEW_VERSION} (no-changelog)"
+          git push origin HEAD:master
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+  publish-to-npm:
+    name: Publish to NPM
+    needs: bump-and-push
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: release
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ needs.bump-and-push.outputs.sha }}
 
       - name: Setup and Build
         uses: ./.github/actions/setup-nodejs
         with:
-          build-command: 'pnpm turbo build --filter "...${{ github.event.inputs.package }}"'
+          build-command: 'pnpm turbo build --filter=...${{ github.event.inputs.package }}'
 
       - name: Pre publishing changes
         run: |
           node .github/scripts/ensure-provenance-fields.mjs
 
+      - name: Configure NPM token
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_DIST_TAG_AND_INITIAL_PUBLISH_TOKEN }}
+        run: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc
+
+      # If this job fails after the version bump was already pushed to master,
+      # re-run only this job (do not re-run the whole workflow — that double-bumps).
       - name: Publish package
         env:
           PACKAGE: ${{ github.event.inputs.package }}
-        run: pnpm --filter "$PACKAGE" publish --access public --no-git-checks --publish-branch master
+        run: pnpm --filter "$PACKAGE" publish --access public --no-git-checks

.github/workflows/test-e2e-coverage-nightly.yml

@@ -248,8 +248,11 @@ jobs:
         shell: bash
         run: sleep 60
 
+      # Advisory only: a Codecov API hiccup (e.g. a 503) must not red the whole
+      # nightly nor block the impact-map refresh, which runs off the built map.
       - name: Analyse Coverage Gaps
         if: always()
+        continue-on-error: true
         env:
           CODECOV_API_TOKEN: ${{ secrets.CODECOV_API_TOKEN }}
         run: |
@@ -263,3 +266,104 @@ jobs:
           name: coverage-gap-report
           path: coverage-gaps.json
           retention-days: 21
+
+  # Refresh the committed impact map PRs read for E2E selection. Without this the
+  # map only updates on manual commits and drifts, so newly-covered source→spec
+  # couplings get declared uncovered and their E2E specs skipped. Gated on ALL
+  # shards passing (complete map) + aggregate having built it — a partial shard
+  # set yields a degraded map, worse than a stale one.
+  commit-impact-map:
+    name: Commit refreshed impact map
+    needs: [e2e, aggregate]
+    if: needs.e2e.result == 'success' && needs.aggregate.result == 'success'
+    runs-on: ubuntu-latest
+    # Least-privilege GITHUB_TOKEN: checkout + download-artifact only need read;
+    # the branch push + PR are done with the scoped app token below, not this token.
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      pull-request-number: ${{ steps.create-pr.outputs.pull-request-number }}
+    steps:
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        with:
+          app-id: ${{ secrets.N8N_ASSISTANT_APP_ID }}
+          private-key: ${{ secrets.N8N_ASSISTANT_PRIVATE_KEY }}
+          # Scope the token to only what the branch push + PR need.
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          # Don't persist the token in .git/config (avoids leaking it via artifacts);
+          # create-pull-request pushes with its own token input, not the git remote creds.
+          persist-credentials: false
+
+      - name: Download coverage report artifact
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: coverage-report
+          path: /tmp/coverage-report
+
+      - name: Copy impact map into place
+        run: |
+          MAP=/tmp/coverage-report/impact-map.json
+          # Guard: a missing/empty map is a build hiccup — keep the committed map
+          # rather than clobber it with a degraded one.
+          node -e '
+            const fs = require("fs");
+            const m = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+            const n = Array.isArray(m.specs) ? m.specs.length : 0;
+            if (!n) { console.error("impact map has no specs — refusing to commit"); process.exit(1); }
+            console.log("impact map ok: " + n + " specs");
+          ' "$MAP"
+          # Raw copy: the map is intentionally minified and biome-ignored
+          # (.github/test-metrics/**). Do NOT format it.
+          cp "$MAP" .github/test-metrics/e2e-impact-map.json
+
+      - name: Check for changes
+        id: check-changes
+        run: |
+          if git diff --quiet .github/test-metrics/e2e-impact-map.json; then
+            echo "Impact map unchanged"
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Impact map changed"
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create Pull Request
+        if: steps.check-changes.outputs.has_changes == 'true'
+        id: create-pr
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          commit-message: 'chore: Update e2e impact map'
+          labels: 'automation:scheduled-update'
+          title: 'chore: Update e2e impact map'
+          body: |
+            Automated refresh of the committed E2E impact map from the latest
+            nightly coverage run.
+
+            PRs use this map to scope which E2E specs run; refreshing it keeps
+            newly-covered source→spec couplings visible so changes aren't
+            declared uncovered and their specs silently skipped.
+
+            _Generated by the E2E coverage nightly._
+          branch: update-e2e-impact-map
+          base: master
+          delete-branch: true
+          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+          committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+
+  approve-and-automerge:
+    needs: [commit-impact-map]
+    if: needs.commit-impact-map.outputs.pull-request-number != ''
+    uses: ./.github/workflows/util-approve-and-set-automerge.yml
+    secrets: inherit
+    with:
+      pull-request-number: ${{ needs.commit-impact-map.outputs.pull-request-number }}

.github/workflows/test-evals-instance-ai.yml

@@ -18,6 +18,11 @@ on:
         required: false
         type: string
         default: ''
+      suite:
+        description: 'LangTracer suite slug or id to pull test cases from.'
+        required: false
+        type: string
+        default: 'baseline'
       sandbox-provider:
         description: 'Sandbox provider (n8n-sandbox or daytona)'
         required: false
@@ -72,6 +77,10 @@ on:
         description: 'Test-case dataset to run (e.g. "pr", "full"). Empty = no filter.'
         required: false
         default: ''
+      suite:
+        description: 'LangTracer suite slug or id to pull test cases from.'
+        required: false
+        default: 'baseline'
       sandbox-provider:
         description: 'Sandbox provider (n8n-sandbox or daytona)'
         required: false
@@ -92,12 +101,19 @@ on:
 jobs:
   run-evals:
     name: 'Run Evals'
-    runs-on: blacksmith-4vcpu-ubuntu-2204
-    timeout-minutes: 90
+    # 8vcpu/32GB: full-suite N=10 baselines need ~150 min of eval time and
+    # did not fit the 4vcpu tier at any timeout.
+    runs-on: blacksmith-8vcpu-ubuntu-2204
+    # Long ceiling only for high-N baseline captures; regular runs keep a
+    # tight guard so a wedged run fails fast. Plain comparison (not fromJSON):
+    # it coerces the string input to a number, and a malformed dispatch value
+    # (NaN) falls back to the 90-minute guard instead of erroring the job.
+    timeout-minutes: ${{ (inputs.iterations || '3') >= 5 && 240 || 90 }}
     env:
       # Each port hosts an independent n8n container. The eval CLI's
       # work-stealing allocator dispatches builds across them, capped per-lane.
-      LANE_PORTS: '5678,5679,5680,5681,5682,5683,5684,5685,5686,5687,5688'
+      # 10 lanes x 2.5 GB caps = 25 GB, leaving ~7 GB for sandbox + CLI + OS.
+      LANE_PORTS: '5678,5679,5680,5681,5682,5683,5684,5685,5686,5687'
     permissions:
       contents: read
       pull-requests: write
@@ -122,6 +138,25 @@ jobs:
         with:
           cache-sha: ${{ inputs.cache-sha }}
 
+      # Host OOMs and disk exhaustion leave no application trace — sample host
+      # + container telemetry every 60s and ship it with the results artifact.
+      - name: Start host telemetry sampler
+        run: |
+          mkdir -p eval-diag
+          { echo "=== disk at job start ==="; df -h /; docker system df; } > eval-diag/df-at-start.log
+          nohup bash -c 'while true; do
+            {
+              date -u +%FT%TZ
+              free -m | head -2
+              df -h / | tail -1
+              docker stats --no-stream --format "{{.Name}} cpu={{.CPUPerc}} mem={{.MemUsage}}"
+              ps -eo rss=,pid=,comm= --sort=-rss | head -5
+              echo
+            } >> eval-diag/host-samples.log 2>&1
+            sleep 60
+          done' > /dev/null 2>&1 &
+          echo $! > eval-diag/sampler.pid
+
       - name: Start sandbox service
         if: ${{ inputs.sandbox-provider == 'n8n-sandbox' }}
         run: pnpm --filter n8n-containers services --services sandbox --network n8n-eval-net --name n8n-svc-sandbox
@@ -174,8 +209,17 @@ jobs:
           IFS=',' read -ra PORTS <<< "$LANE_PORTS"
           for i in "${!PORTS[@]}"; do
             port="${PORTS[$i]}"
+            # Bounded and self-healing: a lane that exhausts its capped heap is
+            # restarted by docker instead of staying dead; pruning + log caps
+            # keep per-lane disk and memory flat over a multi-hour run.
             docker run -d --name "n8n-eval-$((i+1))" \
               "${NETWORK_ARGS[@]}" \
+              --memory 2.5g --memory-swap 2.5g \
+              --restart on-failure \
+              --log-opt max-size=50m --log-opt max-file=2 \
+              -e NODE_OPTIONS=--max-old-space-size=2048 \
+              -e EXECUTIONS_DATA_PRUNE=true \
+              -e EXECUTIONS_DATA_MAX_AGE=1 \
               -e E2E_TESTS=true \
               -e N8N_ENABLED_MODULES=instance-ai \
               -e N8N_AI_ENABLED=true \
@@ -195,7 +239,7 @@ jobs:
               n8nio/n8n:local
           done
           # 120s budget per port: containers booting in parallel on a shared
-          # 4vcpu runner contend for CPU/disk during n8n's startup (DB migrations,
+          # runner contend for CPU/disk during n8n's startup (DB migrations,
           # license init), so each takes longer than a solo boot.
           for port in "${PORTS[@]}"; do
             ready=false
@@ -277,6 +321,25 @@ jobs:
             exit 1
           fi
 
+      # Disk pressure develops during the eval (per-lane SQLite growth,
+      # verifier snapshots, logs), not at job start — so the runway check
+      # lives here, after the image load and lane startup, where "is there
+      # enough free disk for the next few hours" is a meaningful question.
+      # A run-A-style on-runner fallback build leaves tens of GB of builder
+      # cache that is safe to reclaim once every lane is up.
+      - name: Ensure disk runway for the eval run
+        shell: bash
+        run: |
+          free_gb=$(df -BG --output=avail / | tail -1 | tr -dc '0-9')
+          if [ "${free_gb:-0}" -lt 30 ]; then
+            echo "Only ${free_gb}GB free — reclaiming builder cache before the run accretes data"
+            # Best-effort: a prune failure must not skip the eval run itself.
+            docker builder prune -f || echo "::warning::builder prune failed — continuing with ${free_gb}GB free"
+            df -h / || true
+          else
+            echo "Disk runway OK: ${free_gb}GB free"
+          fi
+
       - name: Run Instance AI Evals
         continue-on-error: true
         working-directory: packages/@n8n/instance-ai
@@ -291,6 +354,11 @@ jobs:
           LANGSMITH_PROJECT: instance-ai-evals
           FILTER: ${{ inputs.filter }}
           TIER: ${{ inputs.tier }}
+          SUITE: ${{ inputs.suite }}
+          # LangTracer is the test-case source of truth (TRUST-247); the CLI
+          # pulls the suite per run via its export API.
+          LANGTRACER_URL: ${{ secrets.EVALS_LANGTRACER_URL }}
+          LANGTRACER_API_KEY: ${{ secrets.LANGTRACER_API_KEY }}
           ITERATIONS: ${{ inputs.iterations }}
           EXPERIMENT_NAME: ${{ inputs.experiment-name }}
           EVAL_PR_NUMBER: ${{ inputs.pr-number || github.event.pull_request.number }}
@@ -302,6 +370,12 @@ jobs:
           done
           BASE_URLS=$(IFS=,; printf '%s' "${URLS[*]}")
           ARGS=(--base-url "$BASE_URLS" --concurrency 32 --verbose --iterations "${ITERATIONS:-3}")
+          # LangTracer is the only CI case source (no disk fallback by design).
+          ARGS+=(--source langtracer --suite "${SUITE:-baseline}")
+          # Pin the LangSmith cohort: langtracer mode otherwise derives a
+          # suite-scoped dataset/baseline prefix, which would fork the KPI
+          # history and orphan the baseline comparison.
+          ARGS+=(--dataset instance-ai-workflow-evals --baseline-prefix instance-ai-baseline-)
           [ -n "$FILTER" ] && ARGS+=(--filter "$FILTER")
           [ -n "$TIER" ] && ARGS+=(--tier "$TIER")
           [ -n "$EXPERIMENT_NAME" ] && ARGS+=(--experiment-name "$EXPERIMENT_NAME")
@@ -346,19 +420,22 @@ jobs:
           done
 
           # Layer 1 — accuracy filter: only surface diagnostic signals.
-          # `tail -100` after the filter so we get the LATEST matching lines
+          # `tail -1000` after the filter so we get the LATEST matching lines
           # (post-eval failure signal), not the earliest startup-time ones.
+          # -t keeps timestamps; the inspect line surfaces OOM kills/restarts,
+          # which leave no log line of their own.
           SIGNALS='sandbox|builder|sandbox-service|daytona|instance.?ai|error|warn|reject|exception|fail'
           for c in $(docker ps -aq --filter "name=n8n-eval-"); do
             name=$(docker inspect --format '{{.Name}}' "$c" | sed 's|^/||')
             echo ""
             echo "============================================================"
-            echo "=== $name (filtered diagnostic signals, last 100 lines) ==="
+            echo "=== $name (filtered diagnostic signals, last 1000 lines) ==="
             echo "============================================================"
-            docker logs "$c" 2>&1 \
+            docker inspect --format 'state: status={{.State.Status}} oomkilled={{.State.OOMKilled}} exitcode={{.State.ExitCode}} restarts={{.RestartCount}} started={{.State.StartedAt}} finished={{.State.FinishedAt}}' "$c" || true
+            docker logs -t "$c" 2>&1 \
               | grep -ivE 'migration' \
               | grep -iE "$SIGNALS" \
-              | tail -100 \
+              | tail -1000 \
               || true
           done
 
@@ -375,6 +452,7 @@ jobs:
       - name: Stop n8n containers
         if: ${{ always() }}
         run: |
+          [ -f eval-diag/sampler.pid ] && kill "$(cat eval-diag/sampler.pid)" 2>/dev/null || true
           mapfile -t ids < <(docker ps -aq --filter "name=n8n-eval-")
           if [ "${#ids[@]}" -gt 0 ]; then
             docker stop "${ids[@]}" 2>/dev/null || true
@@ -420,4 +498,20 @@ jobs:
           path: |
             packages/@n8n/instance-ai/eval-results.json
             packages/@n8n/instance-ai/.data/workflow-eval-report.html
+            eval-diag/
           retention-days: 14
+
+      # The eval step runs with continue-on-error so the logs/artifacts above
+      # always land — but a run that never wrote eval-results.json (bad secret,
+      # unresolvable LangTracer suite, CLI crash before any results) must still
+      # fail the job rather than end green with zero evals. Per-case build
+      # failures DO write results and stay green by design. Mirrors the same
+      # guard in test-evals-mcp.yml.
+      - name: Fail when no results were produced
+        if: ${{ always() }}
+        working-directory: packages/@n8n/instance-ai
+        run: |
+          if [ ! -f eval-results.json ]; then
+            echo "::error::Eval run produced no eval-results.json — it failed before writing any results. Check the 'Run Instance AI Evals' step logs and the uploaded artifacts."
+            exit 1
+          fi

.github/workflows/test-evals-mcp.yml

@@ -25,6 +25,11 @@ on:
         required: false
         type: string
         default: 'mcp'
+      suite:
+        description: 'LangTracer suite slug or id to pull test cases from.'
+        required: false
+        type: string
+        default: 'baseline'
       filter:
         description: 'Only build + eval test cases whose slug matches (comma-separated; empty = whole tier)'
         required: false
@@ -71,6 +76,11 @@ on:
         required: false
       EVALS_LANGSMITH_API_KEY:
         required: false
+      # The eval CLI pulls the test-case suite from LangTracer.
+      EVALS_LANGTRACER_URL:
+        required: false
+      LANGTRACER_API_KEY:
+        required: false
   workflow_dispatch:
     inputs:
       branch:
@@ -81,6 +91,10 @@ on:
         description: 'Test-case dataset to build + eval (e.g. "mcp")'
         required: false
         default: 'mcp'
+      suite:
+        description: 'LangTracer suite slug or id to pull test cases from.'
+        required: false
+        default: 'baseline'
       filter:
         description: 'Only build + eval test cases whose slug matches (comma-separated; empty = whole tier)'
         required: false
@@ -254,6 +268,9 @@ jobs:
           BASE_URLS: ${{ steps.lanes.outputs.base_urls }}
           LANES: ${{ inputs.lanes || '6' }}
           TIER: ${{ inputs.tier }}
+          SUITE: ${{ inputs.suite }}
+          LANGTRACER_URL: ${{ secrets.EVALS_LANGTRACER_URL }}
+          LANGTRACER_API_KEY: ${{ secrets.LANGTRACER_API_KEY }}
           FILTER: ${{ inputs.filter }}
           ITERATIONS: ${{ inputs.iterations }}
           EVAL_CONCURRENCY: ${{ inputs.eval-concurrency }}
@@ -266,6 +283,16 @@ jobs:
           CONCURRENCY="${EVAL_CONCURRENCY:-$((LANES * 2))}"
           echo "Lanes: $LANES | eval concurrency: $CONCURRENCY"
 
+          # Spawn the `claude` build subprocess from an empty directory outside
+          # the checkout. Inheriting the repo cwd would load the repo's Claude
+          # config into the builder (CLAUDE.md/AGENTS.md, .claude/settings.json
+          # with the n8n plugin's skills and hooks) and allow permissionless
+          # reads of repo files — including the eval harness and case corpus.
+          # The MCP config is unaffected: it is staged per lane and pinned with
+          # --strict-mcp-config either way.
+          BUILD_CWD="$RUNNER_TEMP/mcp-build-cwd"
+          mkdir -p "$BUILD_CWD"
+
           # --dataset + --baseline-prefix keep the MCP cohort isolated from the
           # Instance AI dataset/baseline in LangSmith (both halves required).
           # --timeout-ms 25min: MCP-tier multi-agent cases with large mocked
@@ -282,8 +309,11 @@ jobs:
             --timeout-ms 1500000
             --dataset mcp-workflow-evals
             --baseline-prefix mcp-baseline-
+            --build-cwd "$BUILD_CWD"
             --verbose
           )
+          # LangTracer is the only CI case source (no disk fallback by design).
+          ARGS+=(--source langtracer --suite "${SUITE:-baseline}")
           [ -n "$FILTER" ] && ARGS+=(--filter "$FILTER")
           [ -n "$EXPERIMENT_NAME" ] && ARGS+=(--experiment-name "$EXPERIMENT_NAME")
           pnpm eval:instance-ai "${ARGS[@]}"

.github/workflows/test-linting-reusable.yml

@@ -12,7 +12,7 @@ on:
         description: Version of node to use.
         required: false
         type: string
-        default: 24.16.0
+        default: 24.18.0
 
 env:
   NODE_OPTIONS: --max-old-space-size=7168

.github/workflows/test-unit-reusable.yml

@@ -12,7 +12,7 @@ on:
         description: Version of node to use.
         required: false
         type: string
-        default: 24.16.0
+        default: 24.18.0
       collectCoverage:
         required: false
         default: false

.github/workflows/test-workflow-scripts-reusable.yml

@@ -12,7 +12,7 @@ on:
         description: Version of node to use.
         required: false
         type: string
-        default: 24.16.0
+        default: 24.18.0
 
 env:
   NODE_OPTIONS: --max-old-space-size=7168

AGENTS.md

@@ -11,11 +11,21 @@ frontend, and extensible node-based workflow engine.
 ## General Guidelines
 
 - Always use pnpm
+- **Secrets on the command line:** if a developer opted into anonymous dev
+  metrics (`scripts/dev-metrics`), pnpm command arguments are recorded. Arguments
+  of secret-carrying words (`config`, `login`, `publish`, `token`) — whether a
+  subcommand or baked into a flag — are dropped, and the home dir is stripped from
+  paths, but other args are sent as-is — so never put secrets in a command. Pass
+  sensitive values via environment variables, which are never captured.
 - When adding comments, keep them concise and to the point - explain the "why"
   in a line or two; don't be overly verbose. Comments should be scoped and
   relevant to the surrounding code, not just to the current task
 - We use Linear as a ticket tracking system
 - We use Posthog for feature flags
+- To find registered telemetry events (names, descriptions, properties), run
+  `pnpm --filter @n8n/telemetry catalog` (`--json` for structured output). The
+  registry is being adopted incrementally, so search call sites if the catalog
+  has no match. The `n8n:telemetry` skill covers adding or changing events
 - When starting to work on a new ticket – create a new branch from fresh
   master with the name specified in Linear ticket
 - When creating a new branch for a ticket in Linear - use the branch name
@@ -187,6 +197,41 @@ const children = getChildNodes(workflow.connections, 'NodeName', 'main', 1);
     failed assertion) that developers need to fix.
 - Import from appropriate error classes in each package
 
+### Persistence layer & the TypeORM boundary
+
+TypeORM (`@n8n/typeorm`) must stay in the **persistence layer** — the `@n8n/db`
+package or a backend module's own `database/` folder (entity/repository files).
+Business logic — services, controllers, handlers, commands, factories — must not
+import from `@n8n/typeorm` (including `@n8n/typeorm/...` subpaths). In
+`packages/cli` this is enforced by the `misplaced-n8n-typeorm-import` lint rule;
+a new import (or an inline `eslint-disable` of the rule) fails CI.
+
+- **Pattern:** when a query needs operators (`In`, `IsNull`, `LessThan`,
+  `FindOptionsWhere`, …), put it behind a **use-case-named repository method**
+  that takes plain parameters and returns domain-shaped values — not a generic
+  `find(options)` passthrough.
+- **Transactions:** transaction orchestration belongs in the persistence layer.
+  Don't reach for `.manager` / `.manager.transaction(...)` or
+  `createQueryBuilder(...)` in business logic. Use the sanctioned primitive in
+  `@n8n/db`: inject the abstract `TransactionRunner` and wrap the unit of work in
+  `txRunner.run(ctx, async (ctx) => …)`. The callback receives an
+  `OperationContext` carrying the active transaction; thread that `ctx` into the
+  repository methods you call. `run` **requires** a context — pass an empty `{}`
+  at the operation entry point, and reuse the one you were handed everywhere
+  below it (a context that already carries a transaction is joined, not nested).
+  Repositories extend `BaseRepository` and resolve the right `EntityManager` with
+  `this.managerFor(ctx)`; the `Transaction` handle is opaque and never exposes a
+  driver type to business logic. See `oauth-token.service.ts` +
+  `oauth-*-token.repository.ts` for a worked example.
+- **Anti-patterns reviewers reject** — they hide the dependency instead of
+  removing it:
+  - String-matching TypeORM errors, e.g. `error.name === 'QueryFailedError'`.
+  - Relabeling the import from `@n8n/typeorm` to `@n8n/db` to silence the rule
+    (`@n8n/db` re-exports several operators/types, but this relabels the
+    dependency rather than removing it).
+  - Pushing `.manager` / `createQueryBuilder` into business logic to avoid an
+    operator import — trades a visible leak for an invisible one.
+
 ### Frontend Development
 - Refer to `packages/frontend/AGENTS.md`
 - **All UI text must use i18n** - add translations to `@n8n/i18n` package
@@ -212,7 +257,7 @@ What we use for testing and writing tests:
 - **To iterate on a feature without docker rebuilds**, boot service containers
   and run `pnpm dev` locally — `pnpm --filter n8n-containers services --services postgres,redis,mailpit,proxy`
   then `pnpm dev`. See [Develop against running containers](packages/testing/playwright/README.md#develop-against-running-containers-avoid-docker-rebuilds).
-- **For Playwright test maintenance/cleanup**, see @packages/testing/playwright/AGENTS.md (includes janitor tool for static analysis, dead code removal, architecture enforcement, and TCR workflows).
+- **For Playwright test maintenance/cleanup**, see `packages/testing/playwright/AGENTS.md` (includes janitor tool for static analysis, dead code removal, architecture enforcement, and TCR workflows).
 
 ### Common Development Tasks
 

CHANGELOG.md

@@ -1,3 +1,149 @@
+# [2.32.0](https://github.com/n8n-io/n8n/compare/n8n@2.31.0...n8n@2.32.0) (2026-07-21)
+
+
+### Bug Fixes
+
+* **ai-builder:** Honor eq [@version](https://github.com/version) conditions in generated node type definitions ([#34232](https://github.com/n8n-io/n8n/issues/34232)) ([9a48bc5](https://github.com/n8n-io/n8n/commit/9a48bc5fa75976a0ffba93bde062fd0fb05a7b8c))
+* **ai-builder:** Open agent chat preview on the same tab on instance AI ([#34441](https://github.com/n8n-io/n8n/issues/34441)) ([6d56cee](https://github.com/n8n-io/n8n/commit/6d56cee0f42af42f5b192b8b5ad378a1cc566472))
+* **ai-builder:** Resurface channel edit modal on AIA agent builder's artifact mode ([#34257](https://github.com/n8n-io/n8n/issues/34257)) ([0984a1d](https://github.com/n8n-io/n8n/commit/0984a1d97a80c14a63fb31229092f6e8239aaddd))
+* **ai-builder:** Scope ToolIoView synth execution under a synthetic document store ([#34588](https://github.com/n8n-io/n8n/issues/34588)) ([ab12ee5](https://github.com/n8n-io/n8n/commit/ab12ee534c0998558c9579562dec2f34b55cd640))
+* **ai-builder:** Wire thread conversation history - with caps - for agents with slack channel ([#34354](https://github.com/n8n-io/n8n/issues/34354)) ([8c1d17f](https://github.com/n8n-io/n8n/commit/8c1d17ff5171d47c30220f96b83d85955ef4d5af))
+* Allow devDependency imports in linter ([#34335](https://github.com/n8n-io/n8n/issues/34335)) ([26caaa8](https://github.com/n8n-io/n8n/commit/26caaa876f2b787cd665631ce9cf656fd4abca01))
+* **API:** Fix broken public API playground server selection ([#34077](https://github.com/n8n-io/n8n/issues/34077)) ([f24570f](https://github.com/n8n-io/n8n/commit/f24570f21f11a370fba31dfa0b6b9206b066f51b))
+* **AWS Bedrock Chat Model Node:** Default guardrail version to working draft when not set ([#33555](https://github.com/n8n-io/n8n/issues/33555)) ([013c34c](https://github.com/n8n-io/n8n/commit/013c34ccae502176275d55986fc92b405e2861e8))
+* **core, editor:** Clarify credential setup outcomes and add requireUserSelection ([#34268](https://github.com/n8n-io/n8n/issues/34268)) ([65e267b](https://github.com/n8n-io/n8n/commit/65e267bce7b6d931656c6238fe518b0246f65189))
+* **core:** Acquire expression isolate for MCP Trigger tool calls in queue mode ([#34491](https://github.com/n8n-io/n8n/issues/34491)) ([eed8f3f](https://github.com/n8n-io/n8n/commit/eed8f3f1424eb3686d34311822ff6a35071df8c4))
+* **core:** Add a per-attempt timeout to AI assistant service calls ([#34341](https://github.com/n8n-io/n8n/issues/34341)) ([f191548](https://github.com/n8n-io/n8n/commit/f191548586f2af198d85b6afae1b1508378c945f))
+* **core:** Add project ID and project name to log stream events ([#33854](https://github.com/n8n-io/n8n/issues/33854)) ([a89817d](https://github.com/n8n-io/n8n/commit/a89817dc92f41d351631926ca3827f0e56bcfceb))
+* **core:** Alert on unusable Instance AI sandbox snapshots and gate the release on snapshot health ([#34344](https://github.com/n8n-io/n8n/issues/34344)) ([080c3cc](https://github.com/n8n-io/n8n/commit/080c3ccc8c4011b2f41e5e7460be3c6bdd4dae76))
+* **core:** Allow publishing end-user credentials with Send-and-Wait nodes ([#34462](https://github.com/n8n-io/n8n/issues/34462)) ([c59f5d8](https://github.com/n8n-io/n8n/commit/c59f5d8b6a180c0ee17a1601c39a88e2baa72a81))
+* **core:** Bind dynamic credential tokens to a user ID ([#34073](https://github.com/n8n-io/n8n/issues/34073)) ([fd261be](https://github.com/n8n-io/n8n/commit/fd261be97cf3d06aad753f69e8e099f60d09c699))
+* **core:** Cancel Instance AI tool runs promptly when generation is stopped ([#34433](https://github.com/n8n-io/n8n/issues/34433)) ([4f8fef1](https://github.com/n8n-io/n8n/commit/4f8fef13cacf31163999bdddc46f4d2ae8bb0b6a))
+* **core:** Cancel Instance AI workspace tools promptly on stop ([#34551](https://github.com/n8n-io/n8n/issues/34551)) ([267fd85](https://github.com/n8n-io/n8n/commit/267fd853cdc1669e869d280eae687eb6cad89abe))
+* **core:** Close the durable scheduler's record-then-dispatch effect boundary ([#34014](https://github.com/n8n-io/n8n/issues/34014)) ([e22680b](https://github.com/n8n-io/n8n/commit/e22680b99f91d708e1a4d68335a3d38325266c40))
+* **core:** Coerce AWS request header values to strings before signing ([#34534](https://github.com/n8n-io/n8n/issues/34534)) ([d6f26cf](https://github.com/n8n-io/n8n/commit/d6f26cfe7dec41f9f823abdb737301849e5d3d9d))
+* **core:** Count AI assistant workflow test runs as manual executions in statistics ([#34145](https://github.com/n8n-io/n8n/issues/34145)) ([9842c2c](https://github.com/n8n-io/n8n/commit/9842c2c28cc156dc10049b15dfd98e7571aca584))
+* **core:** Create proxied Instance AI sandboxes from snapshots only ([#34328](https://github.com/n8n-io/n8n/issues/34328)) ([29c5d72](https://github.com/n8n-io/n8n/commit/29c5d725c7b99727ed8a70e6398ef5f594e002d8))
+* **core:** Delete executions in batches when removing workflows, projects and folders ([#34265](https://github.com/n8n-io/n8n/issues/34265)) ([0b809c9](https://github.com/n8n-io/n8n/commit/0b809c987a4df86155e98a9f0e2ac52257c8fc16))
+* **core:** Exclude in-flight Instance AI groups from history reads on non-driving mains ([#34345](https://github.com/n8n-io/n8n/issues/34345)) ([50c3d88](https://github.com/n8n-io/n8n/commit/50c3d88af56ebb869f76f13a2417c528d90ffd4c))
+* **core:** Fix AI Agent not seeing tools connected through HITL tools ([#34271](https://github.com/n8n-io/n8n/issues/34271)) ([bdff8f4](https://github.com/n8n-io/n8n/commit/bdff8f4be99f7b677d797f669376e61e46d9ebc2))
+* **core:** Fix change in width of all dropdowns in UI ([#34249](https://github.com/n8n-io/n8n/issues/34249)) ([87cdf3d](https://github.com/n8n-io/n8n/commit/87cdf3d252ab6380ef0afeb1293882fb77931825))
+* **core:** Lint community packages against their provenance-attested source ([#34214](https://github.com/n8n-io/n8n/issues/34214)) ([5f3d139](https://github.com/n8n-io/n8n/commit/5f3d139648df47c66ab0a9faea18af5c51ec8b84))
+* **core:** Persist MCP servers when credential setup is skipped ([#34399](https://github.com/n8n-io/n8n/issues/34399)) ([7c7506d](https://github.com/n8n-io/n8n/commit/7c7506dc163449f2dfce22d308719951660a3a33))
+* **core:** Prefer direct tools for agent capabilities ([#34466](https://github.com/n8n-io/n8n/issues/34466)) ([969a68e](https://github.com/n8n-io/n8n/commit/969a68e217c7aab8e6ac24543a234055b870a794))
+* **core:** Preserve agent builder question answers ([#34414](https://github.com/n8n-io/n8n/issues/34414)) ([9882c5c](https://github.com/n8n-io/n8n/commit/9882c5c6cc8f20f715bca6938ca13142d8382edc))
+* **core:** Preserve local credential fields absent from source contro… ([#34173](https://github.com/n8n-io/n8n/issues/34173)) ([0a4ddde](https://github.com/n8n-io/n8n/commit/0a4dddeb29e65ea6e10e7122fdf5df15cc4cf005))
+* **core:** Preserve node aliases when generating AI tool variants ([#34162](https://github.com/n8n-io/n8n/issues/34162)) ([8284460](https://github.com/n8n-io/n8n/commit/8284460a5ade36b06a9b88fc71a8b13005f8b88b))
+* **core:** Prevent getIncomingData from throwing on a missing connection type ([#34285](https://github.com/n8n-io/n8n/issues/34285)) ([9d05fbd](https://github.com/n8n-io/n8n/commit/9d05fbd5617d1740ee7a48eec4d27007baa7b344))
+* **core:** Prevent sub-workflow failures after transferring a deleted user's workflows ([#33772](https://github.com/n8n-io/n8n/issues/33772)) ([7a56ade](https://github.com/n8n-io/n8n/commit/7a56ade6b2a73740a659149b3fe1e4b05c5658be))
+* **core:** Replace https agent for 'Ignore SSL issues' OAuth2 requests with one that respects proxies ([#34234](https://github.com/n8n-io/n8n/issues/34234)) ([338f186](https://github.com/n8n-io/n8n/commit/338f186f0ba624a5425c9ec8c378c295298a219d))
+* **core:** Require execution mode for MCP workflow executions ([#34155](https://github.com/n8n-io/n8n/issues/34155)) ([79012f6](https://github.com/n8n-io/n8n/commit/79012f66d7d5238d9937549cb8744331f430bdf3))
+* **core:** Resolve @n8n/expression-runtime to its CJS build under Node ([#34463](https://github.com/n8n-io/n8n/issues/34463)) ([09f5ade](https://github.com/n8n-io/n8n/commit/09f5adec0d5481d89bb926eb3efecbf2b973e6f0))
+* **core:** Retry transient AI assistant service errors during Instance AI environment setup ([#34324](https://github.com/n8n-io/n8n/issues/34324)) ([5b7df71](https://github.com/n8n-io/n8n/commit/5b7df71a050c05b628f56dcc6c85ab4cd064d7af))
+* **core:** Retry transient sandbox file writes ([#34319](https://github.com/n8n-io/n8n/issues/34319)) ([80ea25b](https://github.com/n8n-io/n8n/commit/80ea25b76ea141e0a24f9a17fbd6049aab32af8a))
+* **core:** Show a single error toast when a manual execution fails pre-flight validation ([#34541](https://github.com/n8n-io/n8n/issues/34541)) ([8d1fc02](https://github.com/n8n-io/n8n/commit/8d1fc022bb10b875ea71da2fa6a9aec9076e2e77))
+* **core:** Sign SES requests with the ses service name ([#34270](https://github.com/n8n-io/n8n/issues/34270)) ([2e31230](https://github.com/n8n-io/n8n/commit/2e3123097e2065e5317bd58ea7621e6fdb5ddc02))
+* **core:** Skip reporting axios errors thrown as unhandled node errors ([#34570](https://github.com/n8n-io/n8n/issues/34570)) ([33f1c36](https://github.com/n8n-io/n8n/commit/33f1c3611259a43de26e5f09569bd85212605220))
+* **core:** Stop reporting quota-exhausted Instance AI runs to Sentry and isolate report request context ([#34549](https://github.com/n8n-io/n8n/issues/34549)) ([6f0804e](https://github.com/n8n-io/n8n/commit/6f0804e0e357811954b611abf1449fb61b7a8b1d))
+* **core:** Update error message on file write ([#33833](https://github.com/n8n-io/n8n/issues/33833)) ([afe603f](https://github.com/n8n-io/n8n/commit/afe603fc00f816c38d01a65b5eaa17c36481a0ba))
+* Correct build-command quoting in standalone package release ([#34258](https://github.com/n8n-io/n8n/issues/34258)) ([1301bba](https://github.com/n8n-io/n8n/commit/1301bbaf5341267037c146b2f74ba73c2e3585a7))
+* Correct end-user credential validation, re-evaluation, and identity-hook recognition ([#34094](https://github.com/n8n-io/n8n/issues/34094)) ([65da749](https://github.com/n8n-io/n8n/commit/65da749ab3d118cd14a70ccf86c162a58790a71f))
+* Default new agent MCP tool transport to httpStreamable ([#34092](https://github.com/n8n-io/n8n/issues/34092)) ([9c3f7fa](https://github.com/n8n-io/n8n/commit/9c3f7fa44b8441260be678525ebc5b7fc7f7626a))
+* Do not lose scenario results on a budget/timeout abort ([#34419](https://github.com/n8n-io/n8n/issues/34419)) ([40c5b76](https://github.com/n8n-io/n8n/commit/40c5b7670869830b6a71f629963070cd872e51c1))
+* **editor:** Allow self-hosted OpenAI credentials for episodic memory ([#34558](https://github.com/n8n-io/n8n/issues/34558)) ([e162724](https://github.com/n8n-io/n8n/commit/e162724baadcd59bd4c566b6f8d88ba5d0f9b99f))
+* **editor:** Auto-ungroup invalid groups on workflow save ([#34456](https://github.com/n8n-io/n8n/issues/34456)) ([d5d3da6](https://github.com/n8n-io/n8n/commit/d5d3da67c1447606a74645dcd35cbfd4d5ae45b0))
+* **editor:** Avoid next prev buttons from being disabled  ([#33774](https://github.com/n8n-io/n8n/issues/33774)) ([a2fd7f7](https://github.com/n8n-io/n8n/commit/a2fd7f7e966c5734e473b6629652ce6f1c0d502b))
+* **editor:** Decouple MCP redirect URI controls from env-lock flag ([#34184](https://github.com/n8n-io/n8n/issues/34184)) ([64318a8](https://github.com/n8n-io/n8n/commit/64318a810df1cc7fe27470db9f9b1930c6d12e20))
+* **editor:** Dissolve single-node canvas group when converting its nodes to a sub-workflow ([#34334](https://github.com/n8n-io/n8n/issues/34334)) ([93e1b7f](https://github.com/n8n-io/n8n/commit/93e1b7fd6c55bf2fcd40d9770d7e03af812fe1e9))
+* **editor:** Improve Message an Agent panels ([#34461](https://github.com/n8n-io/n8n/issues/34461)) ([e8b005e](https://github.com/n8n-io/n8n/commit/e8b005ee27f0e700e958dbbf09b1674e94fba163))
+* **editor:** Include Chat, AI Assistant, and MCP settings under 'Instance settings: Manage' custom role permission ([#34455](https://github.com/n8n-io/n8n/issues/34455)) ([fa5476c](https://github.com/n8n-io/n8n/commit/fa5476c0cbd2e0a914a58f34d439179bbec89800))
+* **editor:** Keep dropdown tooltips above menus ([#34547](https://github.com/n8n-io/n8n/issues/34547)) ([051eee1](https://github.com/n8n-io/n8n/commit/051eee194393f660cc6be41333cfb73e580c5ff0))
+* **editor:** Link end-user credentials docs from credential modal ([#34406](https://github.com/n8n-io/n8n/issues/34406)) ([09d1e96](https://github.com/n8n-io/n8n/commit/09d1e96a1a7629caea6c51cc705d0970e822aba0))
+* **editor:** Make AI assistant quota-exhausted error states explicit ([#33847](https://github.com/n8n-io/n8n/issues/33847)) ([4ef0d05](https://github.com/n8n-io/n8n/commit/4ef0d05f1cb45c9962dc7a166222aab9cfc6a767))
+* **editor:** Make selector dropdowns usable in Instance AI workflow setup ([#33971](https://github.com/n8n-io/n8n/issues/33971)) ([487594c](https://github.com/n8n-io/n8n/commit/487594cfcdd77a9c6252a2ddb8d03e31d94f2b69))
+* **editor:** Polish pass on the custom instance roles ([#34122](https://github.com/n8n-io/n8n/issues/34122)) ([297e252](https://github.com/n8n-io/n8n/commit/297e2529b3f695e10dde4653342374f75961bfef))
+* **editor:** Prevent AI Agent from auto adding a chat connector on creation ([#34259](https://github.com/n8n-io/n8n/issues/34259)) ([865035d](https://github.com/n8n-io/n8n/commit/865035d5a008dd5786bbd158ccc76f1f66f188eb))
+* **editor:** Prevent users from clicking workflows within insights that they do not have access to ([#34362](https://github.com/n8n-io/n8n/issues/34362)) ([e68fb3a](https://github.com/n8n-io/n8n/commit/e68fb3af52cba91f2a93979893c76afd3c9ac10d))
+* **editor:** Prevent workflow actions menu from being cut off ([#34278](https://github.com/n8n-io/n8n/issues/34278)) ([8ba28dc](https://github.com/n8n-io/n8n/commit/8ba28dc7a9f397c8ca24c11ebb3b4257588d02e9))
+* **editor:** Reconcile stale Instance AI run state on reload and stop ([#34432](https://github.com/n8n-io/n8n/issues/34432)) ([8879b87](https://github.com/n8n-io/n8n/commit/8879b879804fe0a187ea88777c37b9be5779a523))
+* **editor:** Refresh editor checksum on workflow activation while editing ([#34095](https://github.com/n8n-io/n8n/issues/34095)) ([7ebeb1e](https://github.com/n8n-io/n8n/commit/7ebeb1e194aa74b6c6e536251a5b0bb543ea5274))
+* **editor:** Refresh editor checksum on workflow deactivation while editing ([#34315](https://github.com/n8n-io/n8n/issues/34315)) ([c83eab0](https://github.com/n8n-io/n8n/commit/c83eab047c7256dfec8797e3db22f9b5dd5dc04e))
+* **editor:** Remove extra top spacing in sticky note markdown ([#34116](https://github.com/n8n-io/n8n/issues/34116)) ([114c74d](https://github.com/n8n-io/n8n/commit/114c74d6bfd34eb4384720d7a313ecce662d2032))
+* **editor:** Rename agent tasks to schedules ([#34326](https://github.com/n8n-io/n8n/issues/34326)) ([1ab30cb](https://github.com/n8n-io/n8n/commit/1ab30cb6097e132c9c7030197f94b14eb195b583))
+* **editor:** Restore hosted chat Markdown styles ([#34176](https://github.com/n8n-io/n8n/issues/34176)) ([d6b9234](https://github.com/n8n-io/n8n/commit/d6b92343e1ec43431a3dafa18949043b8951bee2))
+* **editor:** Restore previous route when closing session trace ([#34423](https://github.com/n8n-io/n8n/issues/34423)) ([e8922cb](https://github.com/n8n-io/n8n/commit/e8922cbadfdb5a5df40afffa41b91820845dab0c))
+* **editor:** Restrict setup credential dropdown to pinned type ([#34252](https://github.com/n8n-io/n8n/issues/34252)) ([454e0d3](https://github.com/n8n-io/n8n/commit/454e0d3edd310f600523ce0f98e31ef3f16ff4d3))
+* **editor:** Show only the latest node as executing during manual executions ([#34182](https://github.com/n8n-io/n8n/issues/34182)) ([6faca89](https://github.com/n8n-io/n8n/commit/6faca890d2e13a331f19931f3e557481524f9cd2))
+* **editor:** Trigger options menu from node details header add button ([#34212](https://github.com/n8n-io/n8n/issues/34212)) ([3b6af51](https://github.com/n8n-io/n8n/commit/3b6af5199ab5a4526a86a40fcfafb4f20874a69c))
+* **editor:** Wrap long keyboard shortcut tooltip labels within max-width ([#34135](https://github.com/n8n-io/n8n/issues/34135)) ([eb6a4a1](https://github.com/n8n-io/n8n/commit/eb6a4a1714201258146f2bf7ea9090b925b2365c))
+* Even out workflow metadata divider spacing ([#34132](https://github.com/n8n-io/n8n/issues/34132)) ([90f25e2](https://github.com/n8n-io/n8n/commit/90f25e221d198179ec981aa7bca33d71f63af251))
+* Extend orphan message cleanup to handle trailing orphans from memory trimming ([#34385](https://github.com/n8n-io/n8n/issues/34385)) ([96264a0](https://github.com/n8n-io/n8n/commit/96264a063bea5efee7caebb6460e44942d0eecc7))
+* Gate agent knowledge base table on AI Assistant proxy availability ([#34366](https://github.com/n8n-io/n8n/issues/34366)) ([77880a3](https://github.com/n8n-io/n8n/commit/77880a3106d9bb0c997c887b4f8a72615fb63dce))
+* **Gmail Node:** Handle multi-address Reply-To in the reply operation ([#34312](https://github.com/n8n-io/n8n/issues/34312)) ([0b8ad18](https://github.com/n8n-io/n8n/commit/0b8ad187578ecf59efea96a8b97102190aaeb194))
+* **Google Workspace Admin Node:** Not able to reactivate the user ([#33937](https://github.com/n8n-io/n8n/issues/33937)) ([f43d723](https://github.com/n8n-io/n8n/commit/f43d723571afad77b79dddb8b520135497d6f3bb))
+* **HTTP Request Node:** Sign non-standard AWS endpoint hosts with the correct region and service ([#34081](https://github.com/n8n-io/n8n/issues/34081)) ([0e8420b](https://github.com/n8n-io/n8n/commit/0e8420bbff4c386d19fa2587512131ae2dae4c38))
+* **Microsoft Excel Node:** Resolve service principal target per input item ([#34112](https://github.com/n8n-io/n8n/issues/34112)) ([afc8a87](https://github.com/n8n-io/n8n/commit/afc8a87a604d221eb9b56e09c30b6f3fc5a47bda))
+* **Microsoft OneDrive Node:** Resolve service principal target per input item ([#34111](https://github.com/n8n-io/n8n/issues/34111)) ([578545c](https://github.com/n8n-io/n8n/commit/578545c1e9a956199e59a2ac5f40c4e11236f51a))
+* **Microsoft Outlook Node:** Resolve service principal mailbox per input item ([#34110](https://github.com/n8n-io/n8n/issues/34110)) ([831e054](https://github.com/n8n-io/n8n/commit/831e054e6e04fdbf0c0401aacdc3700727fb7624))
+* **Microsoft Teams Node:** Validate Graph path IDs under all credential types ([#34065](https://github.com/n8n-io/n8n/issues/34065)) ([e43a162](https://github.com/n8n-io/n8n/commit/e43a162e4df8b80d79e05183f359b0b80a5b494c))
+* **Microsoft To Do Node:** Resolve service principal target per input item ([#34109](https://github.com/n8n-io/n8n/issues/34109)) ([9b2479c](https://github.com/n8n-io/n8n/commit/9b2479c538ed17194978a872c009e7c78c064836))
+* **Postgres Node:** Return DATE and date/time array columns as strings (v2.7) ([#34050](https://github.com/n8n-io/n8n/issues/34050)) ([17eb819](https://github.com/n8n-io/n8n/commit/17eb819517e0f41c506677fc5d56097795e16623))
+* Provide provider-accurate response shapes for evals ([#34418](https://github.com/n8n-io/n8n/issues/34418)) ([1b173c7](https://github.com/n8n-io/n8n/commit/1b173c791ab76863cb3380d33fc6f3ae2c56570f))
+* **QuickBooks Node:** Initialize headers object in quickBooksApiRequest ([#34291](https://github.com/n8n-io/n8n/issues/34291)) ([83dd194](https://github.com/n8n-io/n8n/commit/83dd194a893dce656a8044cf716c4191e04af2f2))
+* Report an unverifiable unit as notVerified, not a silent pass  ([#34421](https://github.com/n8n-io/n8n/issues/34421)) ([7d6fd4c](https://github.com/n8n-io/n8n/commit/7d6fd4ca9c6f55b7cef026d4a42e4ae9c115e153))
+* Resolve modules on windows ([#34167](https://github.com/n8n-io/n8n/issues/34167)) ([9f0a6fa](https://github.com/n8n-io/n8n/commit/9f0a6fa68b48de0d013e49cf8f1236b49e6d7fdb))
+* **Salesforce Node:** Pass ParentId when creating or updating a Case ([#33775](https://github.com/n8n-io/n8n/issues/33775)) ([fffee46](https://github.com/n8n-io/n8n/commit/fffee465a4c8a68432bc8ec1af06bce945fba719))
+* Serialize date output in FTP, Set, IMAP and Unleashed nodes ([#34205](https://github.com/n8n-io/n8n/issues/34205)) ([391deb9](https://github.com/n8n-io/n8n/commit/391deb91af0cc31d41204d633df0e921193669e4))
+* **Split Out Node:** Properly handle if "Fields to split out" is not a string ([#34148](https://github.com/n8n-io/n8n/issues/34148)) ([7998940](https://github.com/n8n-io/n8n/commit/79989407ffee587f6734ea6736269fc21ca8cac6))
+
+
+### Features
+
+* Add `showOnDeployment` option, show warning for read file node on cloud ([#34417](https://github.com/n8n-io/n8n/issues/34417)) ([f470230](https://github.com/n8n-io/n8n/commit/f47023066ef0f60f21b7bfa9c3c3295e912bd070))
+* Add typed seed data tables with rows on execution scenarios ([#34420](https://github.com/n8n-io/n8n/issues/34420)) ([02af123](https://github.com/n8n-io/n8n/commit/02af1235747cdbc003fca0a199e9e0bdbc55affc))
+* Adding agents tracing environment variable ([#34401](https://github.com/n8n-io/n8n/issues/34401)) ([b42aeee](https://github.com/n8n-io/n8n/commit/b42aeee50f522821ddcdf7d4de1bd789b8173e49))
+* **ai-builder:** Allow AIA agent builder to publish and unpublish first-class agents ([#34368](https://github.com/n8n-io/n8n/issues/34368)) ([84ee063](https://github.com/n8n-io/n8n/commit/84ee0632a39601e010bdebc87d796dcd046f7937))
+* **ai-builder:** Help AIA remove / adjust agent channels (sp Slack) via chat ([#34241](https://github.com/n8n-io/n8n/issues/34241)) ([f851863](https://github.com/n8n-io/n8n/commit/f851863090395b99345f31c89273015a824a678e))
+* **ai-builder:** Refresh Instance AI agent artifact UI on channel setup success ([#34465](https://github.com/n8n-io/n8n/issues/34465)) ([2955d75](https://github.com/n8n-io/n8n/commit/2955d75b30e5a8be9f847ea257a0516585e696d3))
+* **ai-builder:** Send agent preview chat context to AIA chat ([#34308](https://github.com/n8n-io/n8n/issues/34308)) ([9fad2ba](https://github.com/n8n-io/n8n/commit/9fad2ba510d3d14c209b35b8f79071f92c33cd2d))
+* **API:** Add endpoint to retrieve SAML SSO configuration ([#34168](https://github.com/n8n-io/n8n/issues/34168)) ([e76b345](https://github.com/n8n-io/n8n/commit/e76b345fd85b87d6aa3edd3a393d6c0a1ad7234f))
+* **API:** Add endpoint to set the SAML SSO configuration ([#34224](https://github.com/n8n-io/n8n/issues/34224)) ([cf8337a](https://github.com/n8n-io/n8n/commit/cf8337aeb12bab92a5ca8d23a79092968eca3d2e))
+* **API:** Add public API endpoints for log streaming destinations ([#34251](https://github.com/n8n-io/n8n/issues/34251)) ([4a651dd](https://github.com/n8n-io/n8n/commit/4a651dd1aab62da3d0886140d7c31104eaf9b820))
+* **API:** Add public API endpoints to trigger and cancel evaluation test runs ([#33979](https://github.com/n8n-io/n8n/issues/33979)) ([18b34ca](https://github.com/n8n-io/n8n/commit/18b34cab778f182e6081cf2c7d26789d276b2575))
+* **API:** Allow creating a folder in the calling user's personal project ([#34091](https://github.com/n8n-io/n8n/issues/34091)) ([571e642](https://github.com/n8n-io/n8n/commit/571e6424edf4fc84ae753da7f77e8e4433f90396))
+* **API:** Support placing workflows in folders via parentFolderId ([#32696](https://github.com/n8n-io/n8n/issues/32696)) ([a844d03](https://github.com/n8n-io/n8n/commit/a844d0336e5df55a6996a20e3d6112218d81c65c))
+* **AWS Bedrock Chat Model Node:** Add Timeout option ([#34072](https://github.com/n8n-io/n8n/issues/34072)) ([a4738ea](https://github.com/n8n-io/n8n/commit/a4738eaf49dd54436a4340b10697fb5c271618c0))
+* **core:** Add per-workflow execution data write bytes metric ([#34425](https://github.com/n8n-io/n8n/issues/34425)) ([f7496a5](https://github.com/n8n-io/n8n/commit/f7496a5aae1aa42f7d884dbbe554d417a09aa629))
+* **core:** Add tracing, credit metering, and telemetry for the builder sub-agent ([#34151](https://github.com/n8n-io/n8n/issues/34151)) ([be35343](https://github.com/n8n-io/n8n/commit/be353431da9493a24495d84ebcba481a2d3dfa1f))
+* **core:** Add variable bundling to package export ([#34040](https://github.com/n8n-io/n8n/issues/34040)) ([b637582](https://github.com/n8n-io/n8n/commit/b63758247ebd1a45d890370a21d70d4ab7a99349))
+* **core:** Add workflow requirements to package exports ([#34217](https://github.com/n8n-io/n8n/issues/34217)) ([581e490](https://github.com/n8n-io/n8n/commit/581e4907293426f948f2840f43dd13604f1b5324))
+* **core:** Adopt "n8n credits" wording and default to it in Instance AI ([#34426](https://github.com/n8n-io/n8n/issues/34426)) ([263ec69](https://github.com/n8n-io/n8n/commit/263ec699d6834a478673b4f1e931fc118be95b44))
+* **core:** Enable n8n Connect usage in n8n MCP ([#33723](https://github.com/n8n-io/n8n/issues/33723)) ([4e4283b](https://github.com/n8n-io/n8n/commit/4e4283bf628a92ecd3030ca82808c21145b13e74))
+* **core:** Enable prompt caching for the agent-builder sub-agent ([#34352](https://github.com/n8n-io/n8n/issues/34352)) ([a9357ef](https://github.com/n8n-io/n8n/commit/a9357ef5641222e561127ed60b7a059b1e72ea50))
+* **core:** Include error workflows as export dependencies ([#34350](https://github.com/n8n-io/n8n/issues/34350)) ([7d23168](https://github.com/n8n-io/n8n/commit/7d231684d14233bcaa47cfb91d2cc3d9aa0a7f2e))
+* **core:** Prefer MCP servers over node tools when available ([#34458](https://github.com/n8n-io/n8n/issues/34458)) ([078ee55](https://github.com/n8n-io/n8n/commit/078ee55890eddcb691fd9e8b6794b43e77ca3977))
+* **core:** Support agent preview handoff in Instance AI ([#34171](https://github.com/n8n-io/n8n/issues/34171)) ([5a3394a](https://github.com/n8n-io/n8n/commit/5a3394aa34df80a2c90c5937a65f3bb0643ac323))
+* **core:** Unify output schema mock generation and verify AI Assistant  workflows with any trigger type ([#33896](https://github.com/n8n-io/n8n/issues/33896)) ([d33c282](https://github.com/n8n-io/n8n/commit/d33c282b951e5b8a1ae8017562945654449209cb))
+* **editor:** Add descriptions to canvas groups ([#34219](https://github.com/n8n-io/n8n/issues/34219)) ([8477e58](https://github.com/n8n-io/n8n/commit/8477e5896ab805e6ee63f50be8de410f834d1c9f))
+* **editor:** Add Mine/All tabs, search and filters to MCP connected clients ([#33857](https://github.com/n8n-io/n8n/issues/33857)) ([a2c19e4](https://github.com/n8n-io/n8n/commit/a2c19e46974990c39007ffe64ab2ae908fe2f1b9))
+* **editor:** Add new Tags Input component to @n8n/design-system ([#34075](https://github.com/n8n-io/n8n/issues/34075)) ([bac57c4](https://github.com/n8n-io/n8n/commit/bac57c4ec11b4b11490cf5488181ed2b8e892c5a))
+* **editor:** Add per-case compare tabs to eval collection compare view ([#33880](https://github.com/n8n-io/n8n/issues/33880)) ([dde77cb](https://github.com/n8n-io/n8n/commit/dde77cb7d39943ef6e6ae8e468c5ab772bdadef8))
+* **editor:** Add scope selection to MCP OAuth consent screen ([#33710](https://github.com/n8n-io/n8n/issues/33710)) ([c3ca9a3](https://github.com/n8n-io/n8n/commit/c3ca9a36dafe3c7da084da5ceb325dbe9605dcb2))
+* **editor:** Add sticky support for canvas groups ([#34317](https://github.com/n8n-io/n8n/issues/34317)) ([0fb07ca](https://github.com/n8n-io/n8n/commit/0fb07ca6ad9aaef5fe2366e96c69b5a52b7e8549))
+* **editor:** Collapse AI Assistant thinking traces into thinking blocks ([#34274](https://github.com/n8n-io/n8n/issues/34274)) ([9744625](https://github.com/n8n-io/n8n/commit/97446258af4aaa91da6323d7599fb08a02ccef43))
+* **editor:** Improve sub workflow extraction ([#34169](https://github.com/n8n-io/n8n/issues/34169)) ([318925a](https://github.com/n8n-io/n8n/commit/318925a4215e1eb431daf43f551a649dc4695b7f))
+* **editor:** Rename N8nActionBox to N8nEmptyState and add icon-cards variant ([#34407](https://github.com/n8n-io/n8n/issues/34407)) ([a6b5462](https://github.com/n8n-io/n8n/commit/a6b54629c5f89b4c222fc59f0e679055f6a733db))
+* **editor:** Save canvas group description pinned state in local storage ([#34220](https://github.com/n8n-io/n8n/issues/34220)) ([ecff317](https://github.com/n8n-io/n8n/commit/ecff317c577e46f42feb24e7c7413f4762041284))
+* **editor:** Show access and client details in the connected MCP clients list ([#33714](https://github.com/n8n-io/n8n/issues/33714)) ([0ca24ba](https://github.com/n8n-io/n8n/commit/0ca24ba99655b0b0220c1f99a3641b14862b1593))
+* **editor:** Show per-scope tool details on the MCP consent screen ([#33783](https://github.com/n8n-io/n8n/issues/33783)) ([cc515a7](https://github.com/n8n-io/n8n/commit/cc515a77c1d58f53b04587ce264899ad0a881a90))
+* **Gmail Node:** Add advanced HITL configuration for Send and Wait ([#34255](https://github.com/n8n-io/n8n/issues/34255)) ([6194110](https://github.com/n8n-io/n8n/commit/61941103e6fb3ba7186bc9666145fbf3e55e0054))
+* **Grist Node:** Use a single Grist URL field in the credential ([#34190](https://github.com/n8n-io/n8n/issues/34190)) ([d6d7d93](https://github.com/n8n-io/n8n/commit/d6d7d93df34075b4d55bf509855bd2411eda4eec))
+* **Mailgun Node:** Add reply-to, custom headers, and tags ([#28558](https://github.com/n8n-io/n8n/issues/28558)) ([b9199e5](https://github.com/n8n-io/n8n/commit/b9199e5a964c0774bb9a5ad8c876ca54ce413c61))
+* **Slack Node:** Add advanced HITL configuration for one-tap approval ([#34123](https://github.com/n8n-io/n8n/issues/34123)) ([d30e7b0](https://github.com/n8n-io/n8n/commit/d30e7b042c8ecb18aead1cdecd22145f382facbd))
+* **Telegram Node:** Add advanced HITL configuration for one-tap in-chat approval ([#34009](https://github.com/n8n-io/n8n/issues/34009)) ([6db46bc](https://github.com/n8n-io/n8n/commit/6db46bc381d11f03d6ba24d8a66e8620efe92530))
+* Validate agent configuration before publishing ([#34452](https://github.com/n8n-io/n8n/issues/34452)) ([5cb674e](https://github.com/n8n-io/n8n/commit/5cb674ed370561d5418dd02de0d4c1d58d11cce1))
+
+
 # [2.31.0](https://github.com/n8n-io/n8n/compare/n8n@2.30.0...n8n@2.31.0) (2026-07-14)
 
 

CONTRIBUTING.md

@@ -442,29 +442,74 @@ The full development mode (`pnpm dev`) runs multiple processes in parallel:
 
 ### Community PR Guidelines
 
-#### **1. Change Request/Comment**
+We read and review every pull request by hand. These guidelines keep that sustainable, and they help you avoid building something we cannot accept. The fastest route to a merge is to agree on the change with us before you write code.
+
+Our golden rule: a contribution should be worth more to the project than the time it takes us to review it.
+
+#### **1. Start With an Issue or Forum Topic**
+
+- **Ask before you start:**
+  - If you want to work on an existing issue, comment to ask first and wait for a team member to respond before you pick it up. This avoids two people, including us, building the same fix at the same time.
+- **Bug fixes:**
+  - An issue must already exist that describes the problem and gives clear steps to reproduce it. If there is no issue, [open one](https://github.com/n8n-io/n8n/issues/new/choose) first.
+  - Bug-fix PRs with no linked issue will be returned so we can confirm and track the problem.
+- **Features and enhancements:**
+  - Open a topic on the [n8n community forum](https://community.n8n.io/) first so we can discuss it before you build. This protects your time: we will tell you early whether we will accept the idea, and we will guide you on how we would want it handled.
+  - Feature PRs that arrive with no prior discussion will be closed with a pointer to the forum.
+- **Refactoring or opinion-based changes:**
+  - Open an issue or forum topic first with a detailed rationale: what you want to change, why, and the concrete benefit. We do not merge "I prefer it this way" changes without that reasoning.
+- **Core changes:**
+  - Contact n8n before starting any change under [/packages/core](/packages/core), as noted in the directory structure.
+- **Identity, access, and credentials:**
+  - The n8n team handles changes to identity and access management and to the credentials system. These control how users sign in, what they reach, and how credentials get stored and used. A mistake here risks exposing sensitive data or locking users out, so we keep these in-house. If you spot a bug or have an idea, open an issue or forum topic to flag it and we will take it from there.
+- **High-impact nodes:**
+  - The n8n team handles changes to the most widely used nodes, including HTTP Request, Code, Webhook Trigger, Form Trigger, and Schedule. A small change to one of these can break workflows for a large number of users, so we keep these in-house. If you spot a bug or have an idea for one of them, open an issue or forum topic to flag it and we will take it from there.
+
+#### **2. Change Request/Comment**
 
 Please address the requested changes or provide feedback within 14 days. If there is no response or updates to the pull request during this time, it will be automatically closed. The PR can be reopened once the requested changes are applied.
 
-#### **2. General Requirements**
+#### **3. General Requirements**
 
+- **Describe Your Change:**
+  - Every PR needs a clear description of what you changed, why, and why you took this approach over the alternatives. Link the issue or forum topic. Write the description in your own words. A PR with no real description will be closed.
+  - Where possible try to include a short video or screenshots. This is useful if you are working on a feature or updating a node.
 - **Follow the Style Guide:**
   - Ensure your code adheres to n8n's coding standards and conventions (e.g., formatting, naming, indentation). Use linting tools where applicable.
 - **TypeScript Compliance:**
-  - Do not use `ts-ignore` .
+  - Do not use `ts-ignore` or `ts-expect-error` to silence the compiler.
   - Ensure code adheres to TypeScript rules.
 - **Avoid Repetitive Code:**
   - Reuse existing components, parameters, and logic wherever possible instead of redefining or duplicating them.
+  - Before writing a constant or helper, check whether one already exists. For nodes, throw `NodeOperationError`/`NodeApiError` (from `n8n-workflow`) rather than raw errors, and use `jsonParse` (from `n8n-workflow`) instead of bare `JSON.parse`. More generally, `@n8n/constants` and `@n8n/utils` hold many reusable helpers — e.g. `Time` from `@n8n/constants` for time-unit math (`5 * Time.minutes.toMilliseconds` instead of `5 * 60 * 1000`).
   - For nodes: Use the same parameter across multiple operations rather than defining a new parameter for each operation (if applicable).
 - **Testing Requirements:**
   - PRs **must include tests**:
     - Unit tests
+    - Integration tests (if applicable)
     - Workflow tests for nodes (example [here](https://github.com/n8n-io/n8n/tree/master/packages/nodes-base/nodes/Switch/V3/test))
     - UI tests (if applicable)
+    - Detailed steps under the "How to test" section of the PR template to cover how to manually test the feature or bug fix.
+  - For a **bug fix**, include at least one regression test that **fails against the latest `master`** without your change and passes with it. Tell us in the description how to see it fail, so we can verify the fix actually fixes something.
 - **Typos:**
   - Use a spell-checking tool, such as [**Code Spell Checker**](https://marketplace.visualstudio.com/items?itemName=streetsidesoftware.code-spell-checker), to avoid typos.
+- **Verify that your PR contains only your intended changes:**
+  - Before opening or requesting review, check the *Files Changed* tab and confirm that all modifications are related to your fix/feature. If you see unrelated file changes, commits from other authors, or a large number of unexpected commits, rebase or recreate your branch against the current `master` branch and clean up the history before submitting.
 
-#### **3. PR Specific Requirements**
+#### **4. Using AI Tools**
+
+We use AI tools ourselves and we welcome AI-assisted contributions. The problem is not the tool. The problem is code the author cannot stand behind.
+
+- **Understand and own your code:**
+  - You must understand every line you submit and be able to explain what it does and how it fits the rest of the system, without the AI. If you cannot, do not open the PR yet.
+- **Write the description in your own words:**
+  - Write your PR description, issue, and forum posts in your own words. Do not paste raw model output.
+- **Same gates apply:**
+  - AI-assisted features and refactors still need an accepted issue or forum topic first, the same as any other change.
+- **Disclosure:**
+  - We encourage you to note in the PR if AI tools did a meaningful part of the work, and which tools. It helps us calibrate review and it is not held against you.
+
+#### **5. PR Specific Requirements**
 
 - **Small PRs Only:**
   - Focus on a single feature or fix per PR.
@@ -472,14 +517,24 @@ Please address the requested changes or provide feedback within 14 days. If ther
   - Follow [n8n's PR Title Conventions](https://github.com/n8n-io/n8n/blob/master/.github/pull_request_title_conventions.md#L36).
 - **New Nodes:**
   - PRs that introduce new nodes will be **auto-closed** unless they are explicitly requested by the n8n team and aligned with an agreed project scope. However, you can still explore [building your own nodes](https://docs.n8n.io/integrations/creating-nodes/overview/), as n8n offers the flexibility to create your own custom nodes.
+- **Existing Nodes:**
+  - If you are making changes to existing nodes that changes functionality, output data or anything that could cause existing workflows to change refer to our [node version guidelines](https://docs.n8n.io/connect/create-nodes/build-your-node/reference/versioning) to minimise impact.
 - **Typo-Only PRs:**
-  - Typos are not sufficient justification for a PR and will be rejected.
+  - Typos are not sufficient justification for a PR and will be rejected. Fold typo fixes into a larger, related change.
 
-#### **4. Workflow Summary for Non-Compliant PRs**
+#### **6. Workflow Summary for Non-Compliant PRs**
 
+- **No Linked Issue or Discussion:** Bug-fix PRs with no issue, and feature PRs with no forum topic, will be returned or closed per section 1.
 - **No Tests:** If tests are not provided, the PR will be auto-closed after **14 days**.
-- **Non-Small PRs:** Large or multifaceted PRs will be returned for segmentation.
+- **Keep PRs small and focused.** Each PR should add no more than 1000 lines and cover one logical change. Larger or multifaceted PRs will be returned for segmentation.
 - **New Nodes/Typo PRs:** Automatically rejected if not aligned with project scope or guidelines.
+- **Low-Value or Automated PRs:** We close these, and may block accounts that repeat them. This covers:
+  - Whitespace, formatting, or reordering changes with no functional reason.
+  - Mass find-and-replace or renames submitted with no rationale.
+  - Dependency bumps with no explanation of why the bump is needed.
+  - README badges, comment tweaks, or restating the obvious.
+  - PRs whose main purpose is to earn a contribution credit, a mention, or event points. Hacktoberfest and similar events do not change the quality bar.
+  - Bulk or scripted submissions across many files or repositories.
 
 ---
 

docker/get-n8n.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "Hello n8n!"

docker/images/n8n-base/Dockerfile

@@ -1,7 +1,7 @@
 # Pinned to a multi-arch index digest (linux/amd64 + linux/arm64) for reproducible builds.
 # The tag is the human-readable version; Docker resolves by the digest. Bump the tag and
 # digest together when updating the base image.
-FROM dhi.io/node:24.16.0-alpine3.24-dev@sha256:0fda302d7d6f2436b27edc9392bd6a4f8ae9ce86e9837c2b8676abdf26a4a7fb
+FROM dhi.io/node:24.18.0-alpine3.24-dev@sha256:d508453231109fbe96a39045ecc794ac18f8b99ca218a0806833d65bb2750e03
 
 # Install all dependencies in a single layer to minimize image size
 RUN apk add --no-cache busybox-binsh && \

docker/images/n8n/Dockerfile

@@ -1,11 +1,11 @@
-ARG NODE_VERSION=24.16.0
+ARG NODE_VERSION=24.18.0
 ARG N8N_VERSION=snapshot
 
 # Builder stage exists because the runtime base image has no toolchain.
 # Pinned to multi-arch index digest (linux/amd64 + linux/arm64) for reproducible builds.
 # Bump the digest together with the tag when updating the base image.
-# Digest pins to node:24.16.0-alpine3.24 (Node 24.16.0, Alpine 3.24).
-FROM node:24.16.0-alpine3.24@sha256:21f403ab171f2dc89bad4dd69d7721bfd15f084ccb46cdd225f31f2bc59b5c9a AS builder
+# Digest pins to node:24.18.0-alpine3.24 (Node 24.18.0, Alpine 3.24).
+FROM node:24.18.0-alpine3.24@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS builder
 COPY ./compiled /usr/local/lib/node_modules/n8n
 RUN apk add --no-cache python3 make g++ && \
     cd /usr/local/lib/node_modules/n8n && \
@@ -28,8 +28,8 @@ RUN apk add --no-cache python3 make g++ && \
 # base change, so a base rebuild does not reach this image until the digest is
 # manually re-pinned here. Bump the digest together with the tag whenever the base
 # image is intentionally updated.
-# Digest pins to n8nio/base:24.16.0 (Node 24.16.0, Alpine 3.24).
-FROM n8nio/base:24.16.0@sha256:25e5671a1b3e11cd576bc9a4409ebf962baea993a4bc7414168dfd357e85a7e8
+# Digest pins to n8nio/base:24.18.0 (Node 24.18.0, Alpine 3.24).
+FROM n8nio/base:24.18.0@sha256:29d9c11f55f02442276512592b439ebb2a1d1043c1339ad5cea4e56862520d22
 
 ARG N8N_VERSION
 ARG N8N_RELEASE_TYPE=dev

docs/generated/postgres-schema/README.md

@@ -10,14 +10,18 @@ Auto-generated from the PostgreSQL migrations in @n8n/db. Do not edit by hand.
 | ---- | ------- | ------- | ---- |
 | [public.agent_chat_subscriptions](public.agent_chat_subscriptions.md) | 6 |  | BASE TABLE |
 | [public.agent_checkpoints](public.agent_checkpoints.md) | 6 |  | BASE TABLE |
-| [public.agent_execution](public.agent_execution.md) | 18 |  | BASE TABLE |
+| [public.agent_eval_dataset](public.agent_eval_dataset.md) | 10 |  | BASE TABLE |
+| [public.agent_eval_rating](public.agent_eval_rating.md) | 8 |  | BASE TABLE |
+| [public.agent_eval_result](public.agent_eval_result.md) | 15 |  | BASE TABLE |
+| [public.agent_eval_run](public.agent_eval_run.md) | 14 |  | BASE TABLE |
+| [public.agent_execution](public.agent_execution.md) | 19 |  | BASE TABLE |
 | [public.agent_execution_threads](public.agent_execution_threads.md) | 17 |  | BASE TABLE |
 | [public.agent_files](public.agent_files.md) | 8 |  | BASE TABLE |
 | [public.agent_history](public.agent_history.md) | 9 |  | BASE TABLE |
 | [public.agent_task_definition](public.agent_task_definition.md) | 7 |  | BASE TABLE |
 | [public.agent_task_run_lock](public.agent_task_run_lock.md) | 6 |  | BASE TABLE |
 | [public.agent_task_snapshot](public.agent_task_snapshot.md) | 8 |  | BASE TABLE |
-| [public.agents](public.agents.md) | 11 |  | BASE TABLE |
+| [public.agents](public.agents.md) | 12 |  | BASE TABLE |
 | [public.agents_memory_entries](public.agents_memory_entries.md) | 13 |  | BASE TABLE |
 | [public.agents_memory_entry_cursors](public.agents_memory_entry_cursors.md) | 6 |  | BASE TABLE |
 | [public.agents_memory_entry_locks](public.agents_memory_entry_locks.md) | 6 |  | BASE TABLE |
@@ -40,7 +44,7 @@ Auto-generated from the PostgreSQL migrations in @n8n/db. Do not edit by hand.
 | [public.chat_hub_sessions](public.chat_hub_sessions.md) | 13 |  | BASE TABLE |
 | [public.chat_hub_tools](public.chat_hub_tools.md) | 9 |  | BASE TABLE |
 | [public.credential_dependency](public.credential_dependency.md) | 5 |  | BASE TABLE |
-| [public.credentials_entity](public.credentials_entity.md) | 11 |  | BASE TABLE |
+| [public.credentials_entity](public.credentials_entity.md) | 12 |  | BASE TABLE |
 | [public.data_table](public.data_table.md) | 5 |  | BASE TABLE |
 | [public.data_table_column](public.data_table_column.md) | 7 |  | BASE TABLE |
 | [public.deployment_key](public.deployment_key.md) | 7 |  | BASE TABLE |
@@ -62,7 +66,8 @@ Auto-generated from the PostgreSQL migrations in @n8n/db. Do not edit by hand.
 | [public.insights_raw](public.insights_raw.md) | 5 |  | BASE TABLE |
 | [public.installed_nodes](public.installed_nodes.md) | 4 |  | BASE TABLE |
 | [public.installed_packages](public.installed_packages.md) | 6 |  | BASE TABLE |
-| [public.instance_ai_checkpoints](public.instance_ai_checkpoints.md) | 8 |  | BASE TABLE |
+| [public.instance_ai_checkpoints](public.instance_ai_checkpoints.md) | 9 |  | BASE TABLE |
+| [public.instance_ai_events](public.instance_ai_events.md) | 7 |  | BASE TABLE |
 | [public.instance_ai_iteration_logs](public.instance_ai_iteration_logs.md) | 6 |  | BASE TABLE |
 | [public.instance_ai_mcp_registry_connections](public.instance_ai_mcp_registry_connections.md) | 7 |  | BASE TABLE |
 | [public.instance_ai_messages](public.instance_ai_messages.md) | 8 |  | BASE TABLE |
@@ -76,6 +81,7 @@ Auto-generated from the PostgreSQL migrations in @n8n/db. Do not edit by hand.
 | [public.instance_ai_thread_grants](public.instance_ai_thread_grants.md) | 5 |  | BASE TABLE |
 | [public.instance_ai_threads](public.instance_ai_threads.md) | 7 |  | BASE TABLE |
 | [public.instance_ai_workflow_snapshots](public.instance_ai_workflow_snapshots.md) | 7 |  | BASE TABLE |
+| [public.instance_credential_assignment](public.instance_credential_assignment.md) | 4 |  | BASE TABLE |
 | [public.instance_version_history](public.instance_version_history.md) | 5 |  | BASE TABLE |
 | [public.invalid_auth_token](public.invalid_auth_token.md) | 2 |  | BASE TABLE |
 | [public.mcp_registry_server](public.mcp_registry_server.md) | 7 |  | BASE TABLE |
@@ -83,7 +89,7 @@ Auto-generated from the PostgreSQL migrations in @n8n/db. Do not edit by hand.
 | [public.oauth_authorization_codes](public.oauth_authorization_codes.md) | 13 |  | BASE TABLE |
 | [public.oauth_clients](public.oauth_clients.md) | 9 |  | BASE TABLE |
 | [public.oauth_refresh_tokens](public.oauth_refresh_tokens.md) | 7 |  | BASE TABLE |
-| [public.oauth_user_consents](public.oauth_user_consents.md) | 4 |  | BASE TABLE |
+| [public.oauth_user_consents](public.oauth_user_consents.md) | 5 |  | BASE TABLE |
 | [public.processed_data](public.processed_data.md) | 5 |  | BASE TABLE |
 | [public.project](public.project.md) | 9 |  | BASE TABLE |
 | [public.project_relation](public.project_relation.md) | 5 |  | BASE TABLE |
@@ -93,7 +99,7 @@ Auto-generated from the PostgreSQL migrations in @n8n/db. Do not edit by hand.
 | [public.role_mapping_rule_project](public.role_mapping_rule_project.md) | 2 |  | BASE TABLE |
 | [public.role_scope](public.role_scope.md) | 2 |  | BASE TABLE |
 | [public.scheduled_job](public.scheduled_job.md) | 19 |  | BASE TABLE |
-| [public.scheduled_task](public.scheduled_task.md) | 16 |  | BASE TABLE |
+| [public.scheduled_task](public.scheduled_task.md) | 17 |  | BASE TABLE |
 | [public.scope](public.scope.md) | 3 |  | BASE TABLE |
 | [public.secrets_provider_connection](public.secrets_provider_connection.md) | 7 |  | BASE TABLE |
 | [public.settings](public.settings.md) | 3 |  | BASE TABLE |
@@ -115,9 +121,13 @@ Auto-generated from the PostgreSQL migrations in @n8n/db. Do not edit by hand.
 | [public.workflow_entity](public.workflow_entity.md) | 20 |  | BASE TABLE |
 | [public.workflow_history](public.workflow_history.md) | 11 |  | BASE TABLE |
 | [public.workflow_publication_outbox](public.workflow_publication_outbox.md) | 7 |  | BASE TABLE |
-| [public.workflow_publication_trigger_status](public.workflow_publication_trigger_status.md) | 7 |  | BASE TABLE |
+| [public.workflow_publication_trigger_status](public.workflow_publication_trigger_status.md) | 8 |  | BASE TABLE |
 | [public.workflow_publish_history](public.workflow_publish_history.md) | 6 |  | BASE TABLE |
 | [public.workflow_published_version](public.workflow_published_version.md) | 4 |  | BASE TABLE |
+| [public.workflow_review_request](public.workflow_review_request.md) | 12 |  | BASE TABLE |
+| [public.workflow_review_request_authors](public.workflow_review_request_authors.md) | 2 |  | BASE TABLE |
+| [public.workflow_review_request_reviewers](public.workflow_review_request_reviewers.md) | 2 |  | BASE TABLE |
+| [public.workflow_review_request_workflow](public.workflow_review_request_workflow.md) | 4 |  | BASE TABLE |
 | [public.workflow_statistics](public.workflow_statistics.md) | 7 |  | BASE TABLE |
 | [public.workflow_statistics_delta](public.workflow_statistics_delta.md) | 6 |  | BASE TABLE |
 | [public.workflows_tags](public.workflows_tags.md) | 2 |  | BASE TABLE |
@@ -145,6 +155,13 @@ erDiagram
 
 "public.agent_chat_subscriptions" }o--|| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
 "public.agent_checkpoints" }o--o| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
+"public.agent_eval_dataset" }o--o| "public.user" : "FOREIGN KEY (#quot;createdById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.agent_eval_dataset" }o--|| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
+"public.agent_eval_rating" }o--o| "public.user" : "FOREIGN KEY (#quot;ratedById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.agent_eval_rating" }o--|| "public.agent_eval_result" : "FOREIGN KEY (#quot;resultId#quot;) REFERENCES agent_eval_result(id) ON DELETE CASCADE"
+"public.agent_eval_result" }o--|| "public.agent_eval_run" : "FOREIGN KEY (#quot;runId#quot;) REFERENCES agent_eval_run(id) ON DELETE CASCADE"
+"public.agent_eval_run" }o--o| "public.user" : "FOREIGN KEY (#quot;createdById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.agent_eval_run" }o--|| "public.agent_eval_dataset" : "FOREIGN KEY (#quot;datasetId#quot;) REFERENCES agent_eval_dataset(id) ON DELETE CASCADE"
 "public.agent_execution" }o--|| "public.agent_execution_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES agent_execution_threads(id) ON DELETE CASCADE"
 "public.agent_execution_threads" }o--|| "public.project" : "FOREIGN KEY (#quot;projectId#quot;) REFERENCES project(id) ON DELETE CASCADE"
 "public.agent_execution_threads" }o--|| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
@@ -227,6 +244,7 @@ erDiagram
 "public.insights_raw" }o--|| "public.insights_metadata" : "FOREIGN KEY (#quot;metaId#quot;) REFERENCES insights_metadata(#quot;metaId#quot;) ON DELETE CASCADE"
 "public.installed_nodes" }o--|| "public.installed_packages" : "FOREIGN KEY (package) REFERENCES installed_packages(#quot;packageName#quot;) ON UPDATE CASCADE ON DELETE CASCADE"
 "public.instance_ai_checkpoints" }o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
+"public.instance_ai_events" }o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
 "public.instance_ai_iteration_logs" }o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
 "public.instance_ai_mcp_registry_connections" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
 "public.instance_ai_mcp_registry_connections" }o--|| "public.credentials_entity" : "FOREIGN KEY (#quot;credentialId#quot;) REFERENCES credentials_entity(id) ON DELETE CASCADE"
@@ -245,6 +263,7 @@ erDiagram
 "public.instance_ai_thread_grants" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
 "public.instance_ai_thread_grants" }o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
 "public.instance_ai_threads" }o--|| "public.project" : "FOREIGN KEY (#quot;projectId#quot;) REFERENCES project(id) ON DELETE CASCADE"
+"public.instance_credential_assignment" }o--|| "public.credentials_entity" : "FOREIGN KEY (#quot;credentialId#quot;) REFERENCES credentials_entity(id) ON DELETE RESTRICT"
 "public.oauth_access_tokens" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
 "public.oauth_access_tokens" }o--|| "public.oauth_clients" : "FOREIGN KEY (#quot;clientId#quot;) REFERENCES oauth_clients(id) ON DELETE CASCADE"
 "public.oauth_authorization_codes" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
@@ -295,6 +314,17 @@ erDiagram
 "public.workflow_publish_history" }o--o| "public.workflow_history" : "FOREIGN KEY (#quot;versionId#quot;) REFERENCES workflow_history(#quot;versionId#quot;) ON DELETE SET NULL"
 "public.workflow_published_version" |o--|| "public.workflow_entity" : "FOREIGN KEY (#quot;workflowId#quot;) REFERENCES workflow_entity(id) ON DELETE RESTRICT"
 "public.workflow_published_version" }o--|| "public.workflow_history" : "FOREIGN KEY (#quot;publishedVersionId#quot;) REFERENCES workflow_history(#quot;versionId#quot;) ON DELETE RESTRICT"
+"public.workflow_review_request" }o--o| "public.user" : "FOREIGN KEY (#quot;createdById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.workflow_review_request" }o--o| "public.user" : "FOREIGN KEY (#quot;updatedById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.workflow_review_request" }o--o| "public.user" : "FOREIGN KEY (#quot;closedById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.workflow_review_request" }o--|| "public.project" : "FOREIGN KEY (#quot;projectId#quot;) REFERENCES project(id) ON DELETE CASCADE"
+"public.workflow_review_request_authors" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
+"public.workflow_review_request_authors" }o--|| "public.workflow_review_request" : "FOREIGN KEY (#quot;workflowReviewRequestId#quot;) REFERENCES workflow_review_request(id) ON DELETE CASCADE"
+"public.workflow_review_request_reviewers" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
+"public.workflow_review_request_reviewers" }o--|| "public.workflow_review_request" : "FOREIGN KEY (#quot;workflowReviewRequestId#quot;) REFERENCES workflow_review_request(id) ON DELETE CASCADE"
+"public.workflow_review_request_workflow" }o--|| "public.workflow_entity" : "FOREIGN KEY (#quot;workflowId#quot;) REFERENCES workflow_entity(id) ON DELETE CASCADE"
+"public.workflow_review_request_workflow" }o--o| "public.workflow_history" : "FOREIGN KEY (#quot;workflowVersionId#quot;) REFERENCES workflow_history(#quot;versionId#quot;) ON DELETE SET NULL"
+"public.workflow_review_request_workflow" }o--|| "public.workflow_review_request" : "FOREIGN KEY (#quot;workflowReviewRequestId#quot;) REFERENCES workflow_review_request(id) ON DELETE CASCADE"
 "public.workflows_tags" }o--|| "public.workflow_entity" : "FOREIGN KEY (#quot;workflowId#quot;) REFERENCES workflow_entity(id) ON DELETE CASCADE"
 "public.workflows_tags" }o--|| "public.tag_entity" : "FOREIGN KEY (#quot;tagId#quot;) REFERENCES tag_entity(id) ON DELETE CASCADE"
 
@@ -314,6 +344,61 @@ erDiagram
   text state
   timestamp_3__with_time_zone updatedAt
 }
+"public.agent_eval_dataset" {
+  varchar_36_ agentId FK
+  json columnMapping
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  json datasetRef
+  varchar_32_ datasetSource
+  text description
+  varchar_36_ id
+  varchar_128_ name
+  timestamp_3__with_time_zone updatedAt
+}
+"public.agent_eval_rating" {
+  text comment
+  json correction
+  timestamp_3__with_time_zone createdAt
+  varchar_36_ id
+  uuid ratedById FK
+  varchar_36_ resultId FK
+  timestamp_3__with_time_zone updatedAt
+  varchar_8_ vote
+}
+"public.agent_eval_result" {
+  timestamp_3__with_time_zone completedAt
+  timestamp_3__with_time_zone createdAt
+  varchar_255_ errorCode
+  json errorDetails
+  varchar_36_ id
+  json input
+  json metrics
+  json output
+  timestamp_3__with_time_zone runAt
+  varchar_36_ runId FK
+  integer runIndex
+  varchar_255_ sourceRowId
+  varchar status
+  json toolCalls
+  timestamp_3__with_time_zone updatedAt
+}
+"public.agent_eval_run" {
+  varchar_36_ agentVersionId
+  boolean cancelRequested
+  timestamp_3__with_time_zone completedAt
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_36_ datasetId FK
+  varchar_255_ errorCode
+  json errorDetails
+  varchar_36_ id
+  json metrics
+  timestamp_3__with_time_zone runAt
+  varchar_255_ runningInstanceId
+  varchar status
+  timestamp_3__with_time_zone updatedAt
+}
 "public.agent_execution" {
   integer completionTokens
   double_precision cost
@@ -328,6 +413,7 @@ erDiagram
   timestamp_3__with_time_zone startedAt
   varchar_16_ status
   timestamp_3__with_time_zone stoppedAt
+  varchar_2_ storedAt
   varchar_128_ threadId FK
   json timeline
   integer totalTokens
@@ -403,6 +489,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations
@@ -640,6 +727,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_128_ type
   timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
 }
 "public.data_table" {
   timestamp_3__with_time_zone createdAt
@@ -801,7 +889,7 @@ erDiagram
   bigint value
 }
 "public.installed_nodes" {
-  integer latestVersion
+  double_precision latestVersion
   varchar_200_ name
   varchar_241_ package FK
   varchar_200_ type
@@ -817,6 +905,7 @@ erDiagram
 "public.instance_ai_checkpoints" {
   timestamp_3__with_time_zone createdAt
   timestamp_3__with_time_zone expiredAt
+  varchar_64_ hostRunId
   varchar_255_ key
   varchar_255_ resourceId
   varchar_255_ runId
@@ -824,6 +913,15 @@ erDiagram
   uuid threadId FK
   timestamp_3__with_time_zone updatedAt
 }
+"public.instance_ai_events" {
+  timestamp_3__with_time_zone createdAt
+  text payload
+  varchar_64_ runId
+  integer seq
+  uuid threadId FK
+  varchar_64_ type
+  timestamp_3__with_time_zone updatedAt
+}
 "public.instance_ai_iteration_logs" {
   timestamp_3__with_time_zone createdAt
   text entry
@@ -971,6 +1069,12 @@ erDiagram
   timestamp_3__with_time_zone updatedAt
   varchar_255_ workflowName
 }
+"public.instance_credential_assignment" {
+  timestamp_3__with_time_zone createdAt
+  varchar_36_ credentialId FK
+  varchar_128_ credentialUseId
+  timestamp_3__with_time_zone updatedAt
+}
 "public.instance_version_history" {
   timestamp_3__with_time_zone createdAt
   integer id
@@ -1035,6 +1139,7 @@ erDiagram
   varchar clientId FK
   bigint grantedAt
   integer id
+  json scope
   uuid userId FK
 }
 "public.processed_data" {
@@ -1120,6 +1225,7 @@ erDiagram
   integer attempts
   varchar_255_ claimedBy
   timestamp_3__with_time_zone createdAt
+  timestamp_3__with_time_zone dispatchedAt
   text errorMessage
   timestamp_3__with_time_zone finishedAt
   bigint id
@@ -1348,6 +1454,7 @@ erDiagram
   text errorMessage
   varchar_36_ nodeId
   varchar_20_ status
+  varchar_20_ triggerKind
   timestamp_3__with_time_zone updatedAt
   varchar_36_ versionId FK
   varchar_36_ workflowId FK
@@ -1366,6 +1473,34 @@ erDiagram
   timestamp_3__with_time_zone updatedAt
   varchar_36_ workflowId FK
 }
+"public.workflow_review_request" {
+  timestamp_3__with_time_zone approvedAt
+  uuid closedById FK
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_50_ decision
+  text description
+  varchar_36_ id
+  varchar_36_ projectId FK
+  varchar_16_ state
+  varchar_255_ title
+  timestamp_3__with_time_zone updatedAt
+  uuid updatedById FK
+}
+"public.workflow_review_request_authors" {
+  uuid userId FK
+  varchar_36_ workflowReviewRequestId FK
+}
+"public.workflow_review_request_reviewers" {
+  uuid userId FK
+  varchar_36_ workflowReviewRequestId FK
+}
+"public.workflow_review_request_workflow" {
+  varchar_36_ id
+  varchar_36_ workflowId FK
+  varchar_36_ workflowReviewRequestId FK
+  varchar_36_ workflowVersionId FK
+}
 "public.workflow_statistics" {
   bigint count
   integer id

docs/generated/postgres-schema/public.agent_chat_subscriptions.md

@@ -48,6 +48,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agent_checkpoints.md

@@ -46,6 +46,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agent_eval_dataset.md

@@ -0,0 +1,113 @@
+# public.agent_eval_dataset
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| agentId | varchar(36) |  | false |  | [public.agents](public.agents.md) |  |
+| columnMapping | json |  | true |  |  | Maps dataset columns onto input / expectedOutput / criteria roles |
+| createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| createdById | uuid |  | true |  | [public.user](public.user.md) |  |
+| datasetRef | json |  | false |  |  | Pointer into the dataset backend (e.g. { dataTableId }); shape varies by datasetSource |
+| datasetSource | varchar(32) |  | false |  |  | Dataset backend the cases are read from |
+| description | text |  | true |  |  |  |
+| id | varchar(36) |  | false | [public.agent_eval_run](public.agent_eval_run.md) |  |  |
+| name | varchar(128) |  | false |  |  |  |
+| updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| CHK_agent_eval_dataset_datasetSource | CHECK | CHECK ((("datasetSource")::text = ANY ((ARRAY['data_table'::character varying, 'google_sheets'::character varying])::text[]))) |
+| FK_9d3a6fd750f7746de453cf4d5ed | FOREIGN KEY | FOREIGN KEY ("agentId") REFERENCES agents(id) ON DELETE CASCADE |
+| FK_eda9e5fa5558d3f16bc2f6c21b6 | FOREIGN KEY | FOREIGN KEY ("createdById") REFERENCES "user"(id) ON DELETE SET NULL |
+| PK_ac887efbb3580a577f1442cfa89 | PRIMARY KEY | PRIMARY KEY (id) |
+| agent_eval_dataset_agentId_not_null | n | NOT NULL "agentId" |
+| agent_eval_dataset_createdAt_not_null | n | NOT NULL "createdAt" |
+| agent_eval_dataset_datasetRef_not_null | n | NOT NULL "datasetRef" |
+| agent_eval_dataset_datasetSource_not_null | n | NOT NULL "datasetSource" |
+| agent_eval_dataset_id_not_null | n | NOT NULL id |
+| agent_eval_dataset_name_not_null | n | NOT NULL name |
+| agent_eval_dataset_updatedAt_not_null | n | NOT NULL "updatedAt" |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_9d3a6fd750f7746de453cf4d5e | CREATE INDEX "IDX_9d3a6fd750f7746de453cf4d5e" ON public.agent_eval_dataset USING btree ("agentId") |
+| PK_ac887efbb3580a577f1442cfa89 | CREATE UNIQUE INDEX "PK_ac887efbb3580a577f1442cfa89" ON public.agent_eval_dataset USING btree (id) |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"public.agent_eval_dataset" }o--|| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
+"public.agent_eval_dataset" }o--o| "public.user" : "FOREIGN KEY (#quot;createdById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.agent_eval_run" }o--|| "public.agent_eval_dataset" : "FOREIGN KEY (#quot;datasetId#quot;) REFERENCES agent_eval_dataset(id) ON DELETE CASCADE"
+
+"public.agent_eval_dataset" {
+  varchar_36_ agentId FK
+  json columnMapping
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  json datasetRef
+  varchar_32_ datasetSource
+  text description
+  varchar_36_ id
+  varchar_128_ name
+  timestamp_3__with_time_zone updatedAt
+}
+"public.agents" {
+  varchar_36_ activeVersionId FK
+  boolean availableInMCP
+  timestamp_3__with_time_zone createdAt
+  varchar_36_ id
+  json integrations
+  varchar_128_ name
+  varchar_255_ projectId FK
+  json schema
+  json skills
+  json tools
+  timestamp_3__with_time_zone updatedAt
+  varchar_36_ versionId
+}
+"public.user" {
+  timestamp_3__with_time_zone createdAt
+  boolean disabled
+  varchar_255_ email
+  varchar_32_ firstName
+  uuid id
+  date lastActiveAt
+  varchar_32_ lastName
+  boolean mfaEnabled
+  text mfaRecoveryCodes
+  text mfaSecret
+  varchar_255_ password
+  json personalizationAnswers
+  varchar_128_ roleSlug FK
+  json settings
+  timestamp_3__with_time_zone updatedAt
+}
+"public.agent_eval_run" {
+  varchar_36_ agentVersionId
+  boolean cancelRequested
+  timestamp_3__with_time_zone completedAt
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_36_ datasetId FK
+  varchar_255_ errorCode
+  json errorDetails
+  varchar_36_ id
+  json metrics
+  timestamp_3__with_time_zone runAt
+  varchar_255_ runningInstanceId
+  varchar status
+  timestamp_3__with_time_zone updatedAt
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/postgres-schema/public.agent_eval_rating.md

@@ -0,0 +1,93 @@
+# public.agent_eval_rating
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| comment | text |  | true |  |  |  |
+| correction | json |  | true |  |  | Optional corrected/edited output supplied by the rater |
+| createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| id | varchar(36) |  | false |  |  |  |
+| ratedById | uuid |  | true |  | [public.user](public.user.md) |  |
+| resultId | varchar(36) |  | false |  | [public.agent_eval_result](public.agent_eval_result.md) |  |
+| updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| vote | varchar(8) |  | false |  |  | Human feedback direction |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| CHK_agent_eval_rating_vote | CHECK | CHECK (((vote)::text = ANY ((ARRAY['up'::character varying, 'down'::character varying])::text[]))) |
+| FK_9cadae6591c64498f1b58a2cef3 | FOREIGN KEY | FOREIGN KEY ("resultId") REFERENCES agent_eval_result(id) ON DELETE CASCADE |
+| FK_e06a7408573a3e152e673977d2c | FOREIGN KEY | FOREIGN KEY ("ratedById") REFERENCES "user"(id) ON DELETE SET NULL |
+| PK_04b7709a435e0c07520ceb37393 | PRIMARY KEY | PRIMARY KEY (id) |
+| agent_eval_rating_createdAt_not_null | n | NOT NULL "createdAt" |
+| agent_eval_rating_id_not_null | n | NOT NULL id |
+| agent_eval_rating_resultId_not_null | n | NOT NULL "resultId" |
+| agent_eval_rating_updatedAt_not_null | n | NOT NULL "updatedAt" |
+| agent_eval_rating_vote_not_null | n | NOT NULL vote |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_9cadae6591c64498f1b58a2cef | CREATE INDEX "IDX_9cadae6591c64498f1b58a2cef" ON public.agent_eval_rating USING btree ("resultId") |
+| PK_04b7709a435e0c07520ceb37393 | CREATE UNIQUE INDEX "PK_04b7709a435e0c07520ceb37393" ON public.agent_eval_rating USING btree (id) |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"public.agent_eval_rating" }o--o| "public.user" : "FOREIGN KEY (#quot;ratedById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.agent_eval_rating" }o--|| "public.agent_eval_result" : "FOREIGN KEY (#quot;resultId#quot;) REFERENCES agent_eval_result(id) ON DELETE CASCADE"
+
+"public.agent_eval_rating" {
+  text comment
+  json correction
+  timestamp_3__with_time_zone createdAt
+  varchar_36_ id
+  uuid ratedById FK
+  varchar_36_ resultId FK
+  timestamp_3__with_time_zone updatedAt
+  varchar_8_ vote
+}
+"public.user" {
+  timestamp_3__with_time_zone createdAt
+  boolean disabled
+  varchar_255_ email
+  varchar_32_ firstName
+  uuid id
+  date lastActiveAt
+  varchar_32_ lastName
+  boolean mfaEnabled
+  text mfaRecoveryCodes
+  text mfaSecret
+  varchar_255_ password
+  json personalizationAnswers
+  varchar_128_ roleSlug FK
+  json settings
+  timestamp_3__with_time_zone updatedAt
+}
+"public.agent_eval_result" {
+  timestamp_3__with_time_zone completedAt
+  timestamp_3__with_time_zone createdAt
+  varchar_255_ errorCode
+  json errorDetails
+  varchar_36_ id
+  json input
+  json metrics
+  json output
+  timestamp_3__with_time_zone runAt
+  varchar_36_ runId FK
+  integer runIndex
+  varchar_255_ sourceRowId
+  varchar status
+  json toolCalls
+  timestamp_3__with_time_zone updatedAt
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/postgres-schema/public.agent_eval_result.md

@@ -0,0 +1,98 @@
+# public.agent_eval_result
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| completedAt | timestamp(3) with time zone |  | true |  |  |  |
+| createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| errorCode | varchar(255) |  | true |  |  |  |
+| errorDetails | json |  | true |  |  |  |
+| id | varchar(36) |  | false | [public.agent_eval_rating](public.agent_eval_rating.md) |  |  |
+| input | json |  | true |  |  | Snapshot of the case input actually run (row may later change) |
+| metrics | json |  | true |  |  | Per-case judge scores |
+| output | json |  | true |  |  | Agent output for this case |
+| runAt | timestamp(3) with time zone |  | true |  |  |  |
+| runId | varchar(36) |  | false |  | [public.agent_eval_run](public.agent_eval_run.md) |  |
+| runIndex | integer |  | true |  |  | Order of this case within the run |
+| sourceRowId | varchar(255) |  | true |  |  | Origin dataset row id; loose pointer, rows are external and mutable |
+| status | varchar |  | false |  |  | Per-case lifecycle |
+| toolCalls | json |  | true |  |  | Tool-call timeline captured during the run |
+| updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| CHK_agent_eval_result_status | CHECK | CHECK (((status)::text = ANY ((ARRAY['new'::character varying, 'running'::character varying, 'success'::character varying, 'error'::character varying, 'cancelled'::character varying])::text[]))) |
+| FK_40a2d1248a6d984f442de2fac1b | FOREIGN KEY | FOREIGN KEY ("runId") REFERENCES agent_eval_run(id) ON DELETE CASCADE |
+| PK_d40a22dc56dc200313c1f0e41ac | PRIMARY KEY | PRIMARY KEY (id) |
+| agent_eval_result_createdAt_not_null | n | NOT NULL "createdAt" |
+| agent_eval_result_id_not_null | n | NOT NULL id |
+| agent_eval_result_runId_not_null | n | NOT NULL "runId" |
+| agent_eval_result_status_not_null | n | NOT NULL status |
+| agent_eval_result_updatedAt_not_null | n | NOT NULL "updatedAt" |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_40a2d1248a6d984f442de2fac1 | CREATE INDEX "IDX_40a2d1248a6d984f442de2fac1" ON public.agent_eval_result USING btree ("runId") |
+| PK_d40a22dc56dc200313c1f0e41ac | CREATE UNIQUE INDEX "PK_d40a22dc56dc200313c1f0e41ac" ON public.agent_eval_result USING btree (id) |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"public.agent_eval_rating" }o--|| "public.agent_eval_result" : "FOREIGN KEY (#quot;resultId#quot;) REFERENCES agent_eval_result(id) ON DELETE CASCADE"
+"public.agent_eval_result" }o--|| "public.agent_eval_run" : "FOREIGN KEY (#quot;runId#quot;) REFERENCES agent_eval_run(id) ON DELETE CASCADE"
+
+"public.agent_eval_result" {
+  timestamp_3__with_time_zone completedAt
+  timestamp_3__with_time_zone createdAt
+  varchar_255_ errorCode
+  json errorDetails
+  varchar_36_ id
+  json input
+  json metrics
+  json output
+  timestamp_3__with_time_zone runAt
+  varchar_36_ runId FK
+  integer runIndex
+  varchar_255_ sourceRowId
+  varchar status
+  json toolCalls
+  timestamp_3__with_time_zone updatedAt
+}
+"public.agent_eval_rating" {
+  text comment
+  json correction
+  timestamp_3__with_time_zone createdAt
+  varchar_36_ id
+  uuid ratedById FK
+  varchar_36_ resultId FK
+  timestamp_3__with_time_zone updatedAt
+  varchar_8_ vote
+}
+"public.agent_eval_run" {
+  varchar_36_ agentVersionId
+  boolean cancelRequested
+  timestamp_3__with_time_zone completedAt
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_36_ datasetId FK
+  varchar_255_ errorCode
+  json errorDetails
+  varchar_36_ id
+  json metrics
+  timestamp_3__with_time_zone runAt
+  varchar_255_ runningInstanceId
+  varchar status
+  timestamp_3__with_time_zone updatedAt
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/postgres-schema/public.agent_eval_run.md

@@ -0,0 +1,119 @@
+# public.agent_eval_run
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| agentVersionId | varchar(36) |  | true |  |  | Published agent version under test (agent_history.versionId); loose pointer, no FK so runs survive history pruning. The agent itself comes from the dataset. |
+| cancelRequested | boolean | false | false |  |  | Fallback cancellation flag polled by the running main |
+| completedAt | timestamp(3) with time zone |  | true |  |  |  |
+| createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| createdById | uuid |  | true |  | [public.user](public.user.md) |  |
+| datasetId | varchar(36) |  | false |  | [public.agent_eval_dataset](public.agent_eval_dataset.md) |  |
+| errorCode | varchar(255) |  | true |  |  |  |
+| errorDetails | json |  | true |  |  |  |
+| id | varchar(36) |  | false | [public.agent_eval_result](public.agent_eval_result.md) |  |  |
+| metrics | json |  | true |  |  | Aggregated run-level scores |
+| runAt | timestamp(3) with time zone |  | true |  |  |  |
+| runningInstanceId | varchar(255) |  | true |  |  | Main instance executing this run; used to coordinate cancellation |
+| status | varchar |  | false |  |  | Run lifecycle |
+| updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| CHK_agent_eval_run_status | CHECK | CHECK (((status)::text = ANY ((ARRAY['new'::character varying, 'running'::character varying, 'completed'::character varying, 'error'::character varying, 'cancelled'::character varying])::text[]))) |
+| FK_39ca447735d378e365f4227abff | FOREIGN KEY | FOREIGN KEY ("datasetId") REFERENCES agent_eval_dataset(id) ON DELETE CASCADE |
+| FK_54ee897f442cc7393a6d6165334 | FOREIGN KEY | FOREIGN KEY ("createdById") REFERENCES "user"(id) ON DELETE SET NULL |
+| PK_280832ca3f1b43663cc0e25e77f | PRIMARY KEY | PRIMARY KEY (id) |
+| agent_eval_run_cancelRequested_not_null | n | NOT NULL "cancelRequested" |
+| agent_eval_run_createdAt_not_null | n | NOT NULL "createdAt" |
+| agent_eval_run_datasetId_not_null | n | NOT NULL "datasetId" |
+| agent_eval_run_id_not_null | n | NOT NULL id |
+| agent_eval_run_status_not_null | n | NOT NULL status |
+| agent_eval_run_updatedAt_not_null | n | NOT NULL "updatedAt" |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_39ca447735d378e365f4227abf | CREATE INDEX "IDX_39ca447735d378e365f4227abf" ON public.agent_eval_run USING btree ("datasetId") |
+| PK_280832ca3f1b43663cc0e25e77f | CREATE UNIQUE INDEX "PK_280832ca3f1b43663cc0e25e77f" ON public.agent_eval_run USING btree (id) |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"public.agent_eval_run" }o--o| "public.user" : "FOREIGN KEY (#quot;createdById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.agent_eval_run" }o--|| "public.agent_eval_dataset" : "FOREIGN KEY (#quot;datasetId#quot;) REFERENCES agent_eval_dataset(id) ON DELETE CASCADE"
+"public.agent_eval_result" }o--|| "public.agent_eval_run" : "FOREIGN KEY (#quot;runId#quot;) REFERENCES agent_eval_run(id) ON DELETE CASCADE"
+
+"public.agent_eval_run" {
+  varchar_36_ agentVersionId
+  boolean cancelRequested
+  timestamp_3__with_time_zone completedAt
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_36_ datasetId FK
+  varchar_255_ errorCode
+  json errorDetails
+  varchar_36_ id
+  json metrics
+  timestamp_3__with_time_zone runAt
+  varchar_255_ runningInstanceId
+  varchar status
+  timestamp_3__with_time_zone updatedAt
+}
+"public.user" {
+  timestamp_3__with_time_zone createdAt
+  boolean disabled
+  varchar_255_ email
+  varchar_32_ firstName
+  uuid id
+  date lastActiveAt
+  varchar_32_ lastName
+  boolean mfaEnabled
+  text mfaRecoveryCodes
+  text mfaSecret
+  varchar_255_ password
+  json personalizationAnswers
+  varchar_128_ roleSlug FK
+  json settings
+  timestamp_3__with_time_zone updatedAt
+}
+"public.agent_eval_dataset" {
+  varchar_36_ agentId FK
+  json columnMapping
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  json datasetRef
+  varchar_32_ datasetSource
+  text description
+  varchar_36_ id
+  varchar_128_ name
+  timestamp_3__with_time_zone updatedAt
+}
+"public.agent_eval_result" {
+  timestamp_3__with_time_zone completedAt
+  timestamp_3__with_time_zone createdAt
+  varchar_255_ errorCode
+  json errorDetails
+  varchar_36_ id
+  json input
+  json metrics
+  json output
+  timestamp_3__with_time_zone runAt
+  varchar_36_ runId FK
+  integer runIndex
+  varchar_255_ sourceRowId
+  varchar status
+  json toolCalls
+  timestamp_3__with_time_zone updatedAt
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/postgres-schema/public.agent_execution.md

@@ -17,6 +17,7 @@
 | startedAt | timestamp(3) with time zone |  | true |  |  |  |
 | status | varchar(16) |  | false |  |  |  |
 | stoppedAt | timestamp(3) with time zone |  | true |  |  |  |
+| storedAt | varchar(2) | 'db'::character varying | false |  |  |  |
 | threadId | varchar(128) |  | false |  | [public.agent_execution_threads](public.agent_execution_threads.md) |  |
 | timeline | json |  | true |  |  |  |
 | totalTokens | integer |  | true |  |  |  |
@@ -29,12 +30,14 @@
 | ---- | ---- | ---------- |
 | CHK_agent_execution_hitlStatus | CHECK | CHECK ((("hitlStatus")::text = ANY ((ARRAY['suspended'::character varying, 'resumed'::character varying])::text[]))) |
 | CHK_agent_execution_status | CHECK | CHECK (((status)::text = ANY ((ARRAY['success'::character varying, 'error'::character varying])::text[]))) |
+| CHK_agent_execution_storedAt | CHECK | CHECK ((("storedAt")::text = ANY ((ARRAY['db'::character varying, 'fs'::character varying, 's3'::character varying, 'az'::character varying])::text[]))) |
 | FK_add2432fb6034cc18b6af299dce | FOREIGN KEY | FOREIGN KEY ("threadId") REFERENCES agent_execution_threads(id) ON DELETE CASCADE |
 | PK_ba438acc8532addc12d1ef17049 | PRIMARY KEY | PRIMARY KEY (id) |
 | agent_execution_createdAt_not_null | n | NOT NULL "createdAt" |
 | agent_execution_duration_not_null | n | NOT NULL duration |
 | agent_execution_id_not_null | n | NOT NULL id |
 | agent_execution_status_not_null | n | NOT NULL status |
+| agent_execution_storedAt_not_null | n | NOT NULL "storedAt" |
 | agent_execution_threadId_not_null | n | NOT NULL "threadId" |
 | agent_execution_updatedAt_not_null | n | NOT NULL "updatedAt" |
 
@@ -66,6 +69,7 @@ erDiagram
   timestamp_3__with_time_zone startedAt
   varchar_16_ status
   timestamp_3__with_time_zone stoppedAt
+  varchar_2_ storedAt
   varchar_128_ threadId FK
   json timeline
   integer totalTokens

docs/generated/postgres-schema/public.agent_execution_threads.md

@@ -82,6 +82,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations
@@ -107,6 +108,7 @@ erDiagram
   timestamp_3__with_time_zone startedAt
   varchar_16_ status
   timestamp_3__with_time_zone stoppedAt
+  varchar_2_ storedAt
   varchar_128_ threadId FK
   json timeline
   integer totalTokens

docs/generated/postgres-schema/public.agent_files.md

@@ -56,6 +56,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agent_history.md

@@ -58,6 +58,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agent_task_definition.md

@@ -51,6 +51,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agent_task_run_lock.md

@@ -47,6 +47,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agents.md

@@ -5,8 +5,9 @@
 | Name | Type | Default | Nullable | Children | Parents | Comment |
 | ---- | ---- | ------- | -------- | -------- | ------- | ------- |
 | activeVersionId | varchar(36) |  | true |  | [public.agent_history](public.agent_history.md) |  |
+| availableInMCP | boolean | false | false |  |  | Whether MCP clients granted agent scopes may operate on this agent |
 | createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
-| id | varchar(36) |  | false | [public.agent_chat_subscriptions](public.agent_chat_subscriptions.md) [public.agent_checkpoints](public.agent_checkpoints.md) [public.agent_execution_threads](public.agent_execution_threads.md) [public.agent_files](public.agent_files.md) [public.agent_history](public.agent_history.md) [public.agent_task_definition](public.agent_task_definition.md) [public.agent_task_run_lock](public.agent_task_run_lock.md) [public.agents_memory_entries](public.agents_memory_entries.md) [public.agents_memory_entry_cursors](public.agents_memory_entry_cursors.md) [public.agents_memory_entry_locks](public.agents_memory_entry_locks.md) [public.agents_memory_entry_sources](public.agents_memory_entry_sources.md) [public.agents_observation_cursors](public.agents_observation_cursors.md) [public.agents_observation_locks](public.agents_observation_locks.md) [public.agents_observations](public.agents_observations.md) |  |  |
+| id | varchar(36) |  | false | [public.agent_chat_subscriptions](public.agent_chat_subscriptions.md) [public.agent_checkpoints](public.agent_checkpoints.md) [public.agent_eval_dataset](public.agent_eval_dataset.md) [public.agent_execution_threads](public.agent_execution_threads.md) [public.agent_files](public.agent_files.md) [public.agent_history](public.agent_history.md) [public.agent_task_definition](public.agent_task_definition.md) [public.agent_task_run_lock](public.agent_task_run_lock.md) [public.agents_memory_entries](public.agents_memory_entries.md) [public.agents_memory_entry_cursors](public.agents_memory_entry_cursors.md) [public.agents_memory_entry_locks](public.agents_memory_entry_locks.md) [public.agents_memory_entry_sources](public.agents_memory_entry_sources.md) [public.agents_observation_cursors](public.agents_observation_cursors.md) [public.agents_observation_locks](public.agents_observation_locks.md) [public.agents_observations](public.agents_observations.md) |  |  |
 | integrations | json | '[]'::json | false |  |  |  |
 | name | varchar(128) |  | false |  |  |  |
 | projectId | varchar(255) |  | false |  | [public.project](public.project.md) |  |
@@ -23,6 +24,7 @@
 | FK_940597dfe9753375309ce6aeea0 | FOREIGN KEY | FOREIGN KEY ("activeVersionId") REFERENCES agent_history("versionId") ON DELETE SET NULL |
 | FK_a30d560207c4071d98aa03c179c | FOREIGN KEY | FOREIGN KEY ("projectId") REFERENCES project(id) ON DELETE CASCADE |
 | PK_9c653f28ae19c5884d5baf6a1d9 | PRIMARY KEY | PRIMARY KEY (id) |
+| agents_availableInMCP_not_null | n | NOT NULL "availableInMCP" |
 | agents_createdAt_not_null | n | NOT NULL "createdAt" |
 | agents_id_not_null | n | NOT NULL id |
 | agents_integrations_not_null | n | NOT NULL integrations |
@@ -48,6 +50,7 @@ erDiagram
 "public.agents" }o--o| "public.agent_history" : "FOREIGN KEY (#quot;activeVersionId#quot;) REFERENCES agent_history(#quot;versionId#quot;) ON DELETE SET NULL"
 "public.agent_chat_subscriptions" }o--|| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
 "public.agent_checkpoints" }o--o| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
+"public.agent_eval_dataset" }o--|| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
 "public.agent_execution_threads" }o--|| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
 "public.agent_files" }o--|| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
 "public.agent_history" }o--|| "public.agents" : "FOREIGN KEY (#quot;agentId#quot;) REFERENCES agents(id) ON DELETE CASCADE"
@@ -64,6 +67,7 @@ erDiagram
 
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations
@@ -102,6 +106,18 @@ erDiagram
   text state
   timestamp_3__with_time_zone updatedAt
 }
+"public.agent_eval_dataset" {
+  varchar_36_ agentId FK
+  json columnMapping
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  json datasetRef
+  varchar_32_ datasetSource
+  text description
+  varchar_36_ id
+  varchar_128_ name
+  timestamp_3__with_time_zone updatedAt
+}
 "public.agent_execution_threads" {
   varchar_36_ agentId FK
   varchar_255_ agentName

docs/generated/postgres-schema/public.agents_memory_entries.md

@@ -74,6 +74,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agents_memory_entry_cursors.md

@@ -50,6 +50,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agents_memory_entry_locks.md

@@ -50,6 +50,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agents_memory_entry_sources.md

@@ -66,6 +66,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agents_observation_cursors.md

@@ -50,6 +50,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agents_observation_locks.md

@@ -54,6 +54,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.agents_observations.md

@@ -73,6 +73,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations

docs/generated/postgres-schema/public.chat_hub_agents.md

@@ -80,6 +80,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_128_ type
   timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
 }
 "public.chat_hub_agent_tools" {
   uuid agentId FK

docs/generated/postgres-schema/public.chat_hub_sessions.md

@@ -97,6 +97,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_128_ type
   timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
 }
 "public.chat_hub_messages" {
   uuid agentId FK

docs/generated/postgres-schema/public.credential_dependency.md

@@ -57,6 +57,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_128_ type
   timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
 }
 ```
 

docs/generated/postgres-schema/public.credentials_entity.md

@@ -6,7 +6,7 @@
 | ---- | ---- | ------- | -------- | -------- | ------- | ------- |
 | createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
 | data | text |  | false |  |  |  |
-| id | varchar(36) |  | false | [public.chat_hub_agents](public.chat_hub_agents.md) [public.chat_hub_sessions](public.chat_hub_sessions.md) [public.credential_dependency](public.credential_dependency.md) [public.dynamic_credential_entry](public.dynamic_credential_entry.md) [public.dynamic_credential_user_entry](public.dynamic_credential_user_entry.md) [public.instance_ai_mcp_registry_connections](public.instance_ai_mcp_registry_connections.md) [public.shared_credentials](public.shared_credentials.md) |  |  |
+| id | varchar(36) |  | false | [public.chat_hub_agents](public.chat_hub_agents.md) [public.chat_hub_sessions](public.chat_hub_sessions.md) [public.credential_dependency](public.credential_dependency.md) [public.dynamic_credential_entry](public.dynamic_credential_entry.md) [public.dynamic_credential_user_entry](public.dynamic_credential_user_entry.md) [public.instance_ai_mcp_registry_connections](public.instance_ai_mcp_registry_connections.md) [public.instance_credential_assignment](public.instance_credential_assignment.md) [public.shared_credentials](public.shared_credentials.md) |  |  |
 | isGlobal | boolean | false | false |  |  |  |
 | isManaged | boolean | false | false |  |  |  |
 | isResolvable | boolean | false | false |  |  |  |
@@ -15,11 +15,13 @@
 | resolverId | varchar(16) |  | true |  | [public.dynamic_credential_resolver](public.dynamic_credential_resolver.md) |  |
 | type | varchar(128) |  | false |  |  |  |
 | updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| usageScope | varchar(16) | 'project'::character varying | false |  |  | Where the credential may be consumed: a project-owned feature or an instance-level feature |
 
 ## Constraints
 
 | Name | Type | Definition |
 | ---- | ---- | ---------- |
+| CHK_credentials_entity_usageScope | CHECK | CHECK ((("usageScope")::text = ANY ((ARRAY['project'::character varying, 'instance'::character varying])::text[]))) |
 | credentials_entity_createdAt_not_null | n | NOT NULL "createdAt" |
 | credentials_entity_data_not_null | n | NOT NULL data |
 | credentials_entity_id_not_null1 | n | NOT NULL id |
@@ -32,6 +34,7 @@
 | credentials_entity_resolverId_foreign | FOREIGN KEY | FOREIGN KEY ("resolverId") REFERENCES dynamic_credential_resolver(id) ON DELETE SET NULL |
 | credentials_entity_type_not_null | n | NOT NULL type |
 | credentials_entity_updatedAt_not_null | n | NOT NULL "updatedAt" |
+| credentials_entity_usageScope_not_null | n | NOT NULL "usageScope" |
 
 ## Indexes
 
@@ -53,6 +56,7 @@ erDiagram
 "public.dynamic_credential_entry" }o--|| "public.credentials_entity" : "FOREIGN KEY (credential_id) REFERENCES credentials_entity(id) ON DELETE CASCADE"
 "public.dynamic_credential_user_entry" }o--|| "public.credentials_entity" : "FOREIGN KEY (#quot;credentialId#quot;) REFERENCES credentials_entity(id) ON DELETE CASCADE"
 "public.instance_ai_mcp_registry_connections" }o--|| "public.credentials_entity" : "FOREIGN KEY (#quot;credentialId#quot;) REFERENCES credentials_entity(id) ON DELETE CASCADE"
+"public.instance_credential_assignment" }o--|| "public.credentials_entity" : "FOREIGN KEY (#quot;credentialId#quot;) REFERENCES credentials_entity(id) ON DELETE RESTRICT"
 "public.shared_credentials" }o--|| "public.credentials_entity" : "FOREIGN KEY (#quot;credentialsId#quot;) REFERENCES credentials_entity(id) ON DELETE CASCADE"
 "public.credentials_entity" }o--o| "public.dynamic_credential_resolver" : "FOREIGN KEY (#quot;resolverId#quot;) REFERENCES dynamic_credential_resolver(id) ON DELETE SET NULL"
 
@@ -68,6 +72,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_128_ type
   timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
 }
 "public.chat_hub_agents" {
   timestamp_3__with_time_zone createdAt
@@ -131,6 +136,12 @@ erDiagram
   timestamp_3__with_time_zone updatedAt
   uuid userId FK
 }
+"public.instance_credential_assignment" {
+  timestamp_3__with_time_zone createdAt
+  varchar_36_ credentialId FK
+  varchar_128_ credentialUseId
+  timestamp_3__with_time_zone updatedAt
+}
 "public.shared_credentials" {
   timestamp_3__with_time_zone createdAt
   varchar_36_ credentialsId FK

docs/generated/postgres-schema/public.dynamic_credential_entry.md

@@ -61,6 +61,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_128_ type
   timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
 }
 "public.dynamic_credential_resolver" {
   text config

docs/generated/postgres-schema/public.dynamic_credential_resolver.md

@@ -59,6 +59,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_128_ type
   timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
 }
 "public.dynamic_credential_entry" {
   timestamp_3__with_time_zone createdAt

docs/generated/postgres-schema/public.dynamic_credential_user_entry.md

@@ -63,6 +63,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_128_ type
   timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
 }
 "public.dynamic_credential_resolver" {
   text config

docs/generated/postgres-schema/public.installed_nodes.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Default | Nullable | Children | Parents | Comment |
 | ---- | ---- | ------- | -------- | -------- | ------- | ------- |
-| latestVersion | integer | 1 | false |  |  |  |
+| latestVersion | double precision | 1 | false |  |  |  |
 | name | varchar(200) |  | false |  |  |  |
 | package | varchar(241) |  | false |  | [public.installed_packages](public.installed_packages.md) |  |
 | type | varchar(200) |  | false |  |  |  |
@@ -34,7 +34,7 @@ erDiagram
 "public.installed_nodes" }o--|| "public.installed_packages" : "FOREIGN KEY (package) REFERENCES installed_packages(#quot;packageName#quot;) ON UPDATE CASCADE ON DELETE CASCADE"
 
 "public.installed_nodes" {
-  integer latestVersion
+  double_precision latestVersion
   varchar_200_ name
   varchar_241_ package FK
   varchar_200_ type

docs/generated/postgres-schema/public.installed_packages.md

@@ -43,7 +43,7 @@ erDiagram
   timestamp_3__with_time_zone updatedAt
 }
 "public.installed_nodes" {
-  integer latestVersion
+  double_precision latestVersion
   varchar_200_ name
   varchar_241_ package FK
   varchar_200_ type

docs/generated/postgres-schema/public.instance_ai_checkpoints.md

@@ -6,6 +6,7 @@
 | ---- | ---- | ------- | -------- | -------- | ------- | ------- |
 | createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
 | expiredAt | timestamp(3) with time zone |  | true |  |  | Soft-delete timestamp: null means live; non-null marks the row as a tombstone. |
+| hostRunId | varchar(64) |  | true |  |  | Host (Instance AI) run id; distinct from the agent-SDK runId parsed from the checkpoint key. |
 | key | varchar(255) |  | false | [public.instance_ai_pending_confirmations](public.instance_ai_pending_confirmations.md) |  | Opaque checkpoint key from the agent runtime. |
 | resourceId | varchar(255) |  | true |  |  | Resource ID recorded by the agent runtime. |
 | runId | varchar(255) |  | true |  |  | Run ID parsed from the checkpoint key when available. |
@@ -45,6 +46,7 @@ erDiagram
 "public.instance_ai_checkpoints" {
   timestamp_3__with_time_zone createdAt
   timestamp_3__with_time_zone expiredAt
+  varchar_64_ hostRunId
   varchar_255_ key
   varchar_255_ resourceId
   varchar_255_ runId

docs/generated/postgres-schema/public.instance_ai_events.md

@@ -0,0 +1,65 @@
+# public.instance_ai_events
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| payload | text |  | false |  |  | JSON of the canonical InstanceAiEvent |
+| runId | varchar(64) |  | false |  |  | Run that emitted the event — opaque ID from the agent runtime |
+| seq | integer |  | false |  |  | Per-thread monotonic sequence — the SSE replay cursor |
+| threadId | uuid |  | false |  | [public.instance_ai_threads](public.instance_ai_threads.md) |  |
+| type | varchar(64) |  | false |  |  | Event type discriminator, duplicated out of the payload |
+| updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| FK_35909c5576a4a6c1d6a6fb71caa | FOREIGN KEY | FOREIGN KEY ("threadId") REFERENCES instance_ai_threads(id) ON DELETE CASCADE |
+| PK_12489cd6197feeac2089acc7ef6 | PRIMARY KEY | PRIMARY KEY ("threadId", seq) |
+| instance_ai_events_createdAt_not_null | n | NOT NULL "createdAt" |
+| instance_ai_events_payload_not_null | n | NOT NULL payload |
+| instance_ai_events_runId_not_null | n | NOT NULL "runId" |
+| instance_ai_events_seq_not_null | n | NOT NULL seq |
+| instance_ai_events_threadId_not_null | n | NOT NULL "threadId" |
+| instance_ai_events_type_not_null | n | NOT NULL type |
+| instance_ai_events_updatedAt_not_null | n | NOT NULL "updatedAt" |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_32cdd799675715fb1d2a8683e9 | CREATE INDEX "IDX_32cdd799675715fb1d2a8683e9" ON public.instance_ai_events USING btree ("threadId", "runId") |
+| PK_12489cd6197feeac2089acc7ef6 | CREATE UNIQUE INDEX "PK_12489cd6197feeac2089acc7ef6" ON public.instance_ai_events USING btree ("threadId", seq) |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"public.instance_ai_events" }o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
+
+"public.instance_ai_events" {
+  timestamp_3__with_time_zone createdAt
+  text payload
+  varchar_64_ runId
+  integer seq
+  uuid threadId FK
+  varchar_64_ type
+  timestamp_3__with_time_zone updatedAt
+}
+"public.instance_ai_threads" {
+  timestamp_3__with_time_zone createdAt
+  uuid id
+  json metadata
+  varchar_36_ projectId FK
+  varchar_255_ resourceId
+  text title
+  timestamp_3__with_time_zone updatedAt
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/postgres-schema/public.instance_ai_mcp_registry_connections.md

@@ -64,6 +64,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_128_ type
   timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
 }
 "public.mcp_registry_server" {
   timestamp_3__with_time_zone createdAt

docs/generated/postgres-schema/public.instance_ai_pending_confirmations.md

@@ -70,6 +70,7 @@ erDiagram
 "public.instance_ai_checkpoints" {
   timestamp_3__with_time_zone createdAt
   timestamp_3__with_time_zone expiredAt
+  varchar_64_ hostRunId
   varchar_255_ key
   varchar_255_ resourceId
   varchar_255_ runId

docs/generated/postgres-schema/public.instance_ai_threads.md

@@ -5,7 +5,7 @@
 | Name | Type | Default | Nullable | Children | Parents | Comment |
 | ---- | ---- | ------- | -------- | -------- | ------- | ------- |
 | createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
-| id | uuid |  | false | [public.ai_builder_temporary_workflow](public.ai_builder_temporary_workflow.md) [public.instance_ai_checkpoints](public.instance_ai_checkpoints.md) [public.instance_ai_iteration_logs](public.instance_ai_iteration_logs.md) [public.instance_ai_messages](public.instance_ai_messages.md) [public.instance_ai_observation_cursors](public.instance_ai_observation_cursors.md) [public.instance_ai_observation_locks](public.instance_ai_observation_locks.md) [public.instance_ai_observational_memory](public.instance_ai_observational_memory.md) [public.instance_ai_observations](public.instance_ai_observations.md) [public.instance_ai_pending_confirmations](public.instance_ai_pending_confirmations.md) [public.instance_ai_run_snapshots](public.instance_ai_run_snapshots.md) [public.instance_ai_thread_grants](public.instance_ai_thread_grants.md) |  |  |
+| id | uuid |  | false | [public.ai_builder_temporary_workflow](public.ai_builder_temporary_workflow.md) [public.instance_ai_checkpoints](public.instance_ai_checkpoints.md) [public.instance_ai_events](public.instance_ai_events.md) [public.instance_ai_iteration_logs](public.instance_ai_iteration_logs.md) [public.instance_ai_messages](public.instance_ai_messages.md) [public.instance_ai_observation_cursors](public.instance_ai_observation_cursors.md) [public.instance_ai_observation_locks](public.instance_ai_observation_locks.md) [public.instance_ai_observational_memory](public.instance_ai_observational_memory.md) [public.instance_ai_observations](public.instance_ai_observations.md) [public.instance_ai_pending_confirmations](public.instance_ai_pending_confirmations.md) [public.instance_ai_run_snapshots](public.instance_ai_run_snapshots.md) [public.instance_ai_thread_grants](public.instance_ai_thread_grants.md) |  |  |
 | metadata | json |  | true |  |  |  |
 | projectId | varchar(36) |  | false |  | [public.project](public.project.md) | Project this thread is scoped to |
 | resourceId | varchar(255) |  | false |  |  |  |
@@ -40,6 +40,7 @@ erDiagram
 
 "public.ai_builder_temporary_workflow" }o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
 "public.instance_ai_checkpoints" }o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
+"public.instance_ai_events" }o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
 "public.instance_ai_iteration_logs" }o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
 "public.instance_ai_messages" }o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;threadId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
 "public.instance_ai_observation_cursors" |o--|| "public.instance_ai_threads" : "FOREIGN KEY (#quot;observationScopeId#quot;) REFERENCES instance_ai_threads(id) ON DELETE CASCADE"
@@ -69,6 +70,7 @@ erDiagram
 "public.instance_ai_checkpoints" {
   timestamp_3__with_time_zone createdAt
   timestamp_3__with_time_zone expiredAt
+  varchar_64_ hostRunId
   varchar_255_ key
   varchar_255_ resourceId
   varchar_255_ runId
@@ -76,6 +78,15 @@ erDiagram
   uuid threadId FK
   timestamp_3__with_time_zone updatedAt
 }
+"public.instance_ai_events" {
+  timestamp_3__with_time_zone createdAt
+  text payload
+  varchar_64_ runId
+  integer seq
+  uuid threadId FK
+  varchar_64_ type
+  timestamp_3__with_time_zone updatedAt
+}
 "public.instance_ai_iteration_logs" {
   timestamp_3__with_time_zone createdAt
   text entry

docs/generated/postgres-schema/public.instance_credential_assignment.md

@@ -0,0 +1,61 @@
+# public.instance_credential_assignment
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| credentialId | varchar(36) |  | false |  | [public.credentials_entity](public.credentials_entity.md) | Credential assigned to the registered use; repositories enforce instance usage scope |
+| credentialUseId | varchar(128) |  | false |  |  | Stable credential use registered with the instance credential broker |
+| updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| FK_instance_credential_assignment_credential | FOREIGN KEY | FOREIGN KEY ("credentialId") REFERENCES credentials_entity(id) ON DELETE RESTRICT |
+| PK_984b0a98726485c9a330cde6b2f | PRIMARY KEY | PRIMARY KEY ("credentialUseId") |
+| instance_credential_assignment_createdAt_not_null | n | NOT NULL "createdAt" |
+| instance_credential_assignment_credentialId_not_null | n | NOT NULL "credentialId" |
+| instance_credential_assignment_credentialUseId_not_null | n | NOT NULL "credentialUseId" |
+| instance_credential_assignment_updatedAt_not_null | n | NOT NULL "updatedAt" |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_9626b8dc1bee96a86a3ee09d73 | CREATE INDEX "IDX_9626b8dc1bee96a86a3ee09d73" ON public.instance_credential_assignment USING btree ("credentialId") |
+| PK_984b0a98726485c9a330cde6b2f | CREATE UNIQUE INDEX "PK_984b0a98726485c9a330cde6b2f" ON public.instance_credential_assignment USING btree ("credentialUseId") |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"public.instance_credential_assignment" }o--|| "public.credentials_entity" : "FOREIGN KEY (#quot;credentialId#quot;) REFERENCES credentials_entity(id) ON DELETE RESTRICT"
+
+"public.instance_credential_assignment" {
+  timestamp_3__with_time_zone createdAt
+  varchar_36_ credentialId FK
+  varchar_128_ credentialUseId
+  timestamp_3__with_time_zone updatedAt
+}
+"public.credentials_entity" {
+  timestamp_3__with_time_zone createdAt
+  text data
+  varchar_36_ id
+  boolean isGlobal
+  boolean isManaged
+  boolean isResolvable
+  varchar_128_ name
+  boolean resolvableAllowFallback
+  varchar_16_ resolverId FK
+  varchar_128_ type
+  timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/postgres-schema/public.oauth_clients.md

@@ -87,6 +87,7 @@ erDiagram
   varchar clientId FK
   bigint grantedAt
   integer id
+  json scope
   uuid userId FK
 }
 ```

docs/generated/postgres-schema/public.oauth_user_consents.md

@@ -7,6 +7,7 @@
 | clientId | varchar |  | false |  | [public.oauth_clients](public.oauth_clients.md) |  |
 | grantedAt | bigint |  | false |  |  | Unix timestamp in milliseconds |
 | id | integer |  | false |  |  |  |
+| scope | json |  | false |  |  | OAuth scopes granted on the consent screen |
 | userId | uuid |  | false |  | [public.user](public.user.md) |  |
 
 ## Constraints
@@ -20,6 +21,7 @@
 | oauth_user_consents_clientId_not_null | n | NOT NULL "clientId" |
 | oauth_user_consents_grantedAt_not_null | n | NOT NULL "grantedAt" |
 | oauth_user_consents_id_not_null | n | NOT NULL id |
+| oauth_user_consents_scope_not_null | n | NOT NULL scope |
 | oauth_user_consents_userId_not_null | n | NOT NULL "userId" |
 
 ## Indexes
@@ -41,6 +43,7 @@ erDiagram
   varchar clientId FK
   bigint grantedAt
   integer id
+  json scope
   uuid userId FK
 }
 "public.oauth_clients" {

docs/generated/postgres-schema/public.project.md

@@ -9,7 +9,7 @@
 | customTelemetryTags | json | '[]'::json | false |  |  |  |
 | description | varchar(512) |  | true |  |  |  |
 | icon | json |  | true |  |  |  |
-| id | varchar(36) |  | false | [public.agent_execution_threads](public.agent_execution_threads.md) [public.agents](public.agents.md) [public.data_table](public.data_table.md) [public.folder](public.folder.md) [public.insights_metadata](public.insights_metadata.md) [public.instance_ai_threads](public.instance_ai_threads.md) [public.project_relation](public.project_relation.md) [public.project_secrets_provider_access](public.project_secrets_provider_access.md) [public.role_mapping_rule_project](public.role_mapping_rule_project.md) [public.shared_credentials](public.shared_credentials.md) [public.shared_workflow](public.shared_workflow.md) [public.variables](public.variables.md) |  |  |
+| id | varchar(36) |  | false | [public.agent_execution_threads](public.agent_execution_threads.md) [public.agents](public.agents.md) [public.data_table](public.data_table.md) [public.folder](public.folder.md) [public.insights_metadata](public.insights_metadata.md) [public.instance_ai_threads](public.instance_ai_threads.md) [public.project_relation](public.project_relation.md) [public.project_secrets_provider_access](public.project_secrets_provider_access.md) [public.role_mapping_rule_project](public.role_mapping_rule_project.md) [public.shared_credentials](public.shared_credentials.md) [public.shared_workflow](public.shared_workflow.md) [public.variables](public.variables.md) [public.workflow_review_request](public.workflow_review_request.md) |  |  |
 | name | varchar(255) |  | false |  |  |  |
 | type | varchar(36) |  | false |  |  |  |
 | updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
@@ -51,6 +51,7 @@ erDiagram
 "public.shared_credentials" }o--|| "public.project" : "FOREIGN KEY (#quot;projectId#quot;) REFERENCES project(id) ON DELETE CASCADE"
 "public.shared_workflow" }o--|| "public.project" : "FOREIGN KEY (#quot;projectId#quot;) REFERENCES project(id) ON DELETE CASCADE"
 "public.variables" }o--o| "public.project" : "FOREIGN KEY (#quot;projectId#quot;) REFERENCES project(id) ON DELETE CASCADE"
+"public.workflow_review_request" }o--|| "public.project" : "FOREIGN KEY (#quot;projectId#quot;) REFERENCES project(id) ON DELETE CASCADE"
 
 "public.project" {
   timestamp_3__with_time_zone createdAt
@@ -101,6 +102,7 @@ erDiagram
 }
 "public.agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   timestamp_3__with_time_zone createdAt
   varchar_36_ id
   json integrations
@@ -182,6 +184,20 @@ erDiagram
   varchar_50_ type
   text value
 }
+"public.workflow_review_request" {
+  timestamp_3__with_time_zone approvedAt
+  uuid closedById FK
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_50_ decision
+  text description
+  varchar_36_ id
+  varchar_36_ projectId FK
+  varchar_16_ state
+  varchar_255_ title
+  timestamp_3__with_time_zone updatedAt
+  uuid updatedById FK
+}
 ```
 
 ---

docs/generated/postgres-schema/public.scheduled_job.md

@@ -89,6 +89,7 @@ erDiagram
   integer attempts
   varchar_255_ claimedBy
   timestamp_3__with_time_zone createdAt
+  timestamp_3__with_time_zone dispatchedAt
   text errorMessage
   timestamp_3__with_time_zone finishedAt
   bigint id

docs/generated/postgres-schema/public.scheduled_task.md

@@ -7,6 +7,7 @@
 | attempts | integer | 0 | false |  |  | Execution attempts started so far; compared against maxAttempts. |
 | claimedBy | varchar(255) |  | true |  |  | Id of the instance currently holding the lease; NULL when unclaimed. |
 | createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| dispatchedAt | timestamp(3) with time zone |  | true |  |  | When the current attempt handed off its effect; NULL until then. Splits dispatch-attempted (startedAt) from effect-happened, so the reaper completes a dispatched occurrence rather than redelivering it. |
 | errorMessage | text |  | true |  |  | Failure detail from the last attempt. |
 | finishedAt | timestamp(3) with time zone |  | true |  |  | When the occurrence reached a terminal state; drives retention pruning. |
 | id | bigint |  | false |  |  |  |
@@ -62,6 +63,7 @@ erDiagram
   integer attempts
   varchar_255_ claimedBy
   timestamp_3__with_time_zone createdAt
+  timestamp_3__with_time_zone dispatchedAt
   text errorMessage
   timestamp_3__with_time_zone finishedAt
   bigint id

docs/generated/postgres-schema/public.shared_credentials.md

@@ -56,6 +56,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_128_ type
   timestamp_3__with_time_zone updatedAt
+  varchar_16_ usageScope
 }
 "public.project" {
   timestamp_3__with_time_zone createdAt

docs/generated/postgres-schema/public.user.md

@@ -8,7 +8,7 @@
 | disabled | boolean | false | false |  |  |  |
 | email | varchar(255) |  | true |  |  |  |
 | firstName | varchar(32) |  | true |  |  |  |
-| id | uuid | gen_random_uuid() | false | [public.agent_history](public.agent_history.md) [public.auth_identity](public.auth_identity.md) [public.chat_hub_agents](public.chat_hub_agents.md) [public.chat_hub_sessions](public.chat_hub_sessions.md) [public.chat_hub_tools](public.chat_hub_tools.md) [public.dynamic_credential_user_entry](public.dynamic_credential_user_entry.md) [public.evaluation_collection](public.evaluation_collection.md) [public.instance_ai_mcp_registry_connections](public.instance_ai_mcp_registry_connections.md) [public.instance_ai_pending_confirmations](public.instance_ai_pending_confirmations.md) [public.instance_ai_thread_grants](public.instance_ai_thread_grants.md) [public.oauth_access_tokens](public.oauth_access_tokens.md) [public.oauth_authorization_codes](public.oauth_authorization_codes.md) [public.oauth_refresh_tokens](public.oauth_refresh_tokens.md) [public.oauth_user_consents](public.oauth_user_consents.md) [public.project](public.project.md) [public.project_relation](public.project_relation.md) [public.user_api_keys](public.user_api_keys.md) [public.user_favorites](public.user_favorites.md) [public.workflow_builder_session](public.workflow_builder_session.md) [public.workflow_publish_history](public.workflow_publish_history.md) |  |  |
+| id | uuid | gen_random_uuid() | false | [public.agent_eval_dataset](public.agent_eval_dataset.md) [public.agent_eval_rating](public.agent_eval_rating.md) [public.agent_eval_run](public.agent_eval_run.md) [public.agent_history](public.agent_history.md) [public.auth_identity](public.auth_identity.md) [public.chat_hub_agents](public.chat_hub_agents.md) [public.chat_hub_sessions](public.chat_hub_sessions.md) [public.chat_hub_tools](public.chat_hub_tools.md) [public.dynamic_credential_user_entry](public.dynamic_credential_user_entry.md) [public.evaluation_collection](public.evaluation_collection.md) [public.instance_ai_mcp_registry_connections](public.instance_ai_mcp_registry_connections.md) [public.instance_ai_pending_confirmations](public.instance_ai_pending_confirmations.md) [public.instance_ai_thread_grants](public.instance_ai_thread_grants.md) [public.oauth_access_tokens](public.oauth_access_tokens.md) [public.oauth_authorization_codes](public.oauth_authorization_codes.md) [public.oauth_refresh_tokens](public.oauth_refresh_tokens.md) [public.oauth_user_consents](public.oauth_user_consents.md) [public.project](public.project.md) [public.project_relation](public.project_relation.md) [public.user_api_keys](public.user_api_keys.md) [public.user_favorites](public.user_favorites.md) [public.workflow_builder_session](public.workflow_builder_session.md) [public.workflow_publish_history](public.workflow_publish_history.md) [public.workflow_review_request](public.workflow_review_request.md) [public.workflow_review_request_authors](public.workflow_review_request_authors.md) [public.workflow_review_request_reviewers](public.workflow_review_request_reviewers.md) |  |  |
 | lastActiveAt | date |  | true |  |  |  |
 | lastName | varchar(32) |  | true |  |  |  |
 | mfaEnabled | boolean | false | false |  |  |  |
@@ -47,6 +47,9 @@
 ```mermaid
 erDiagram
 
+"public.agent_eval_dataset" }o--o| "public.user" : "FOREIGN KEY (#quot;createdById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.agent_eval_rating" }o--o| "public.user" : "FOREIGN KEY (#quot;ratedById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.agent_eval_run" }o--o| "public.user" : "FOREIGN KEY (#quot;createdById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
 "public.agent_history" }o--o| "public.user" : "FOREIGN KEY (#quot;publishedById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
 "public.auth_identity" }o--o| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id)"
 "public.chat_hub_agents" }o--|| "public.user" : "FOREIGN KEY (#quot;ownerId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
@@ -67,6 +70,11 @@ erDiagram
 "public.user_favorites" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
 "public.workflow_builder_session" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
 "public.workflow_publish_history" }o--o| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.workflow_review_request" }o--o| "public.user" : "FOREIGN KEY (#quot;createdById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.workflow_review_request" }o--o| "public.user" : "FOREIGN KEY (#quot;updatedById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.workflow_review_request" }o--o| "public.user" : "FOREIGN KEY (#quot;closedById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.workflow_review_request_authors" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
+"public.workflow_review_request_reviewers" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
 "public.user" }o--|| "public.role" : "FOREIGN KEY (#quot;roleSlug#quot;) REFERENCES role(slug)"
 
 "public.user" {
@@ -86,6 +94,44 @@ erDiagram
   json settings
   timestamp_3__with_time_zone updatedAt
 }
+"public.agent_eval_dataset" {
+  varchar_36_ agentId FK
+  json columnMapping
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  json datasetRef
+  varchar_32_ datasetSource
+  text description
+  varchar_36_ id
+  varchar_128_ name
+  timestamp_3__with_time_zone updatedAt
+}
+"public.agent_eval_rating" {
+  text comment
+  json correction
+  timestamp_3__with_time_zone createdAt
+  varchar_36_ id
+  uuid ratedById FK
+  varchar_36_ resultId FK
+  timestamp_3__with_time_zone updatedAt
+  varchar_8_ vote
+}
+"public.agent_eval_run" {
+  varchar_36_ agentVersionId
+  boolean cancelRequested
+  timestamp_3__with_time_zone completedAt
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_36_ datasetId FK
+  varchar_255_ errorCode
+  json errorDetails
+  varchar_36_ id
+  json metrics
+  timestamp_3__with_time_zone runAt
+  varchar_255_ runningInstanceId
+  varchar status
+  timestamp_3__with_time_zone updatedAt
+}
 "public.agent_history" {
   varchar_36_ agentId FK
   varchar_255_ author
@@ -227,6 +273,7 @@ erDiagram
   varchar clientId FK
   bigint grantedAt
   integer id
+  json scope
   uuid userId FK
 }
 "public.project" {
@@ -283,6 +330,28 @@ erDiagram
   varchar_36_ versionId FK
   varchar_36_ workflowId FK
 }
+"public.workflow_review_request" {
+  timestamp_3__with_time_zone approvedAt
+  uuid closedById FK
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_50_ decision
+  text description
+  varchar_36_ id
+  varchar_36_ projectId FK
+  varchar_16_ state
+  varchar_255_ title
+  timestamp_3__with_time_zone updatedAt
+  uuid updatedById FK
+}
+"public.workflow_review_request_authors" {
+  uuid userId FK
+  varchar_36_ workflowReviewRequestId FK
+}
+"public.workflow_review_request_reviewers" {
+  uuid userId FK
+  varchar_36_ workflowReviewRequestId FK
+}
 "public.role" {
   timestamp_3__with_time_zone createdAt
   text description

docs/generated/postgres-schema/public.workflow_entity.md

@@ -9,7 +9,7 @@
 | connections | json |  | false |  |  |  |
 | createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
 | description | text |  | true |  |  |  |
-| id | varchar(36) |  | false | [public.ai_builder_temporary_workflow](public.ai_builder_temporary_workflow.md) [public.chat_hub_messages](public.chat_hub_messages.md) [public.chat_hub_sessions](public.chat_hub_sessions.md) [public.evaluation_collection](public.evaluation_collection.md) [public.evaluation_config](public.evaluation_config.md) [public.execution_entity](public.execution_entity.md) [public.insights_metadata](public.insights_metadata.md) [public.processed_data](public.processed_data.md) [public.shared_workflow](public.shared_workflow.md) [public.test_run](public.test_run.md) [public.webhook_entity](public.webhook_entity.md) [public.workflow_builder_session](public.workflow_builder_session.md) [public.workflow_dependency](public.workflow_dependency.md) [public.workflow_history](public.workflow_history.md) [public.workflow_publication_trigger_status](public.workflow_publication_trigger_status.md) [public.workflow_publish_history](public.workflow_publish_history.md) [public.workflow_published_version](public.workflow_published_version.md) [public.workflows_tags](public.workflows_tags.md) |  |  |
+| id | varchar(36) |  | false | [public.ai_builder_temporary_workflow](public.ai_builder_temporary_workflow.md) [public.chat_hub_messages](public.chat_hub_messages.md) [public.chat_hub_sessions](public.chat_hub_sessions.md) [public.evaluation_collection](public.evaluation_collection.md) [public.evaluation_config](public.evaluation_config.md) [public.execution_entity](public.execution_entity.md) [public.insights_metadata](public.insights_metadata.md) [public.processed_data](public.processed_data.md) [public.shared_workflow](public.shared_workflow.md) [public.test_run](public.test_run.md) [public.webhook_entity](public.webhook_entity.md) [public.workflow_builder_session](public.workflow_builder_session.md) [public.workflow_dependency](public.workflow_dependency.md) [public.workflow_history](public.workflow_history.md) [public.workflow_publication_trigger_status](public.workflow_publication_trigger_status.md) [public.workflow_publish_history](public.workflow_publish_history.md) [public.workflow_published_version](public.workflow_published_version.md) [public.workflow_review_request_workflow](public.workflow_review_request_workflow.md) [public.workflows_tags](public.workflows_tags.md) |  |  |
 | isArchived | boolean | false | false |  |  |  |
 | meta | json |  | true |  |  |  |
 | name | varchar(128) |  | false |  |  |  |
@@ -83,6 +83,7 @@ erDiagram
 "public.workflow_publication_trigger_status" }o--|| "public.workflow_entity" : "FOREIGN KEY (#quot;workflowId#quot;) REFERENCES workflow_entity(id) ON DELETE CASCADE"
 "public.workflow_publish_history" }o--|| "public.workflow_entity" : "FOREIGN KEY (#quot;workflowId#quot;) REFERENCES workflow_entity(id) ON DELETE CASCADE"
 "public.workflow_published_version" |o--|| "public.workflow_entity" : "FOREIGN KEY (#quot;workflowId#quot;) REFERENCES workflow_entity(id) ON DELETE RESTRICT"
+"public.workflow_review_request_workflow" }o--|| "public.workflow_entity" : "FOREIGN KEY (#quot;workflowId#quot;) REFERENCES workflow_entity(id) ON DELETE CASCADE"
 "public.workflows_tags" }o--|| "public.workflow_entity" : "FOREIGN KEY (#quot;workflowId#quot;) REFERENCES workflow_entity(id) ON DELETE CASCADE"
 "public.workflow_entity" }o--o| "public.folder" : "FOREIGN KEY (#quot;parentFolderId#quot;) REFERENCES folder(id) ON DELETE CASCADE"
 
@@ -281,6 +282,7 @@ erDiagram
   text errorMessage
   varchar_36_ nodeId
   varchar_20_ status
+  varchar_20_ triggerKind
   timestamp_3__with_time_zone updatedAt
   varchar_36_ versionId FK
   varchar_36_ workflowId FK
@@ -299,6 +301,12 @@ erDiagram
   timestamp_3__with_time_zone updatedAt
   varchar_36_ workflowId FK
 }
+"public.workflow_review_request_workflow" {
+  varchar_36_ id
+  varchar_36_ workflowId FK
+  varchar_36_ workflowReviewRequestId FK
+  varchar_36_ workflowVersionId FK
+}
 "public.workflows_tags" {
   varchar_36_ tagId FK
   varchar_36_ workflowId FK

docs/generated/postgres-schema/public.workflow_history.md

@@ -13,7 +13,7 @@
 | nodeGroups | json | '[]'::json | false |  |  |  |
 | nodes | json |  | false |  |  |  |
 | updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
-| versionId | varchar(36) |  | false | [public.workflow_entity](public.workflow_entity.md) [public.workflow_publication_trigger_status](public.workflow_publication_trigger_status.md) [public.workflow_publish_history](public.workflow_publish_history.md) [public.workflow_published_version](public.workflow_published_version.md) |  |  |
+| versionId | varchar(36) |  | false | [public.workflow_entity](public.workflow_entity.md) [public.workflow_publication_trigger_status](public.workflow_publication_trigger_status.md) [public.workflow_publish_history](public.workflow_publish_history.md) [public.workflow_published_version](public.workflow_published_version.md) [public.workflow_review_request_workflow](public.workflow_review_request_workflow.md) |  |  |
 | workflowId | varchar(36) |  | false |  | [public.workflow_entity](public.workflow_entity.md) |  |
 
 ## Constraints
@@ -48,6 +48,7 @@ erDiagram
 "public.workflow_publication_trigger_status" }o--|| "public.workflow_history" : "FOREIGN KEY (#quot;versionId#quot;) REFERENCES workflow_history(#quot;versionId#quot;) ON DELETE CASCADE"
 "public.workflow_publish_history" }o--o| "public.workflow_history" : "FOREIGN KEY (#quot;versionId#quot;) REFERENCES workflow_history(#quot;versionId#quot;) ON DELETE SET NULL"
 "public.workflow_published_version" }o--|| "public.workflow_history" : "FOREIGN KEY (#quot;publishedVersionId#quot;) REFERENCES workflow_history(#quot;versionId#quot;) ON DELETE RESTRICT"
+"public.workflow_review_request_workflow" }o--o| "public.workflow_history" : "FOREIGN KEY (#quot;workflowVersionId#quot;) REFERENCES workflow_history(#quot;versionId#quot;) ON DELETE SET NULL"
 "public.workflow_history" }o--|| "public.workflow_entity" : "FOREIGN KEY (#quot;workflowId#quot;) REFERENCES workflow_entity(id) ON DELETE CASCADE"
 
 "public.workflow_history" {
@@ -90,6 +91,7 @@ erDiagram
   text errorMessage
   varchar_36_ nodeId
   varchar_20_ status
+  varchar_20_ triggerKind
   timestamp_3__with_time_zone updatedAt
   varchar_36_ versionId FK
   varchar_36_ workflowId FK
@@ -108,6 +110,12 @@ erDiagram
   timestamp_3__with_time_zone updatedAt
   varchar_36_ workflowId FK
 }
+"public.workflow_review_request_workflow" {
+  varchar_36_ id
+  varchar_36_ workflowId FK
+  varchar_36_ workflowReviewRequestId FK
+  varchar_36_ workflowVersionId FK
+}
 ```
 
 ---

docs/generated/postgres-schema/public.workflow_publication_trigger_status.md

@@ -8,6 +8,7 @@
 | errorMessage | text |  | true |  |  |  |
 | nodeId | varchar(36) |  | false |  |  |  |
 | status | varchar(20) |  | false |  |  |  |
+| triggerKind | varchar(20) |  | false |  |  | Where the trigger lives once activated: in-memory (registered on the owning instance) vs persisted (webhook row in webhook_entity) |
 | updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
 | versionId | varchar(36) |  | false |  | [public.workflow_history](public.workflow_history.md) | References workflow_history.versionId: the published version these statuses were recorded for |
 | workflowId | varchar(36) |  | false |  | [public.workflow_entity](public.workflow_entity.md) |  |
@@ -17,12 +18,14 @@
 | Name | Type | Definition |
 | ---- | ---- | ---------- |
 | CHK_workflow_publication_trigger_status_status | CHECK | CHECK (((status)::text = ANY ((ARRAY['activated'::character varying, 'failed'::character varying])::text[]))) |
+| CHK_workflow_publication_trigger_status_triggerKind | CHECK | CHECK ((("triggerKind")::text = ANY ((ARRAY['in-memory'::character varying, 'persisted'::character varying])::text[]))) |
 | FK_b7b496d8d1a21158c65f475cd88 | FOREIGN KEY | FOREIGN KEY ("workflowId") REFERENCES workflow_entity(id) ON DELETE CASCADE |
 | FK_ef1994db9d0ac1b6a5c89b5f729 | FOREIGN KEY | FOREIGN KEY ("versionId") REFERENCES workflow_history("versionId") ON DELETE CASCADE |
 | PK_14aa18b83513fb92d7523909e02 | PRIMARY KEY | PRIMARY KEY ("workflowId", "nodeId") |
 | workflow_publication_trigger_status_createdAt_not_null | n | NOT NULL "createdAt" |
 | workflow_publication_trigger_status_nodeId_not_null | n | NOT NULL "nodeId" |
 | workflow_publication_trigger_status_status_not_null | n | NOT NULL status |
+| workflow_publication_trigger_status_triggerKind_not_null | n | NOT NULL "triggerKind" |
 | workflow_publication_trigger_status_updatedAt_not_null | n | NOT NULL "updatedAt" |
 | workflow_publication_trigger_status_versionId_not_null | n | NOT NULL "versionId" |
 | workflow_publication_trigger_status_workflowId_not_null | n | NOT NULL "workflowId" |
@@ -46,6 +49,7 @@ erDiagram
   text errorMessage
   varchar_36_ nodeId
   varchar_20_ status
+  varchar_20_ triggerKind
   timestamp_3__with_time_zone updatedAt
   varchar_36_ versionId FK
   varchar_36_ workflowId FK

docs/generated/postgres-schema/public.workflow_review_request.md

@@ -0,0 +1,119 @@
+# public.workflow_review_request
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| approvedAt | timestamp(3) with time zone |  | true |  |  |  |
+| closedById | uuid |  | true |  | [public.user](public.user.md) |  |
+| createdAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| createdById | uuid |  | true |  | [public.user](public.user.md) |  |
+| decision | varchar(50) | 'pending'::character varying | false |  |  | Latest review outcome while the request is open |
+| description | text |  | true |  |  |  |
+| id | varchar(36) |  | false | [public.workflow_review_request_authors](public.workflow_review_request_authors.md) [public.workflow_review_request_reviewers](public.workflow_review_request_reviewers.md) [public.workflow_review_request_workflow](public.workflow_review_request_workflow.md) |  |  |
+| projectId | varchar(36) |  | false |  | [public.project](public.project.md) |  |
+| state | varchar(16) | 'open'::character varying | false |  |  | Review lifecycle: open reviews accept actions; closed reviews are done |
+| title | varchar(255) |  | false |  |  |  |
+| updatedAt | timestamp(3) with time zone | CURRENT_TIMESTAMP(3) | false |  |  |  |
+| updatedById | uuid |  | true |  | [public.user](public.user.md) |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| CHK_workflow_review_request_decision | CHECK | CHECK (((decision)::text = ANY ((ARRAY['pending'::character varying, 'changes_requested'::character varying, 'approved'::character varying])::text[]))) |
+| CHK_workflow_review_request_state | CHECK | CHECK (((state)::text = ANY ((ARRAY['open'::character varying, 'closed'::character varying])::text[]))) |
+| FK_21d5f5a831d2e38960030bb4f60 | FOREIGN KEY | FOREIGN KEY ("createdById") REFERENCES "user"(id) ON DELETE SET NULL |
+| FK_2817c3a0245197b498818c447cb | FOREIGN KEY | FOREIGN KEY ("updatedById") REFERENCES "user"(id) ON DELETE SET NULL |
+| FK_c218d1df94adc3b169dee3cc06c | FOREIGN KEY | FOREIGN KEY ("projectId") REFERENCES project(id) ON DELETE CASCADE |
+| FK_d53ef208e6055f328dd7b897e51 | FOREIGN KEY | FOREIGN KEY ("closedById") REFERENCES "user"(id) ON DELETE SET NULL |
+| PK_ae17b90023bcd05e003cd8f64dc | PRIMARY KEY | PRIMARY KEY (id) |
+| workflow_review_request_createdAt_not_null | n | NOT NULL "createdAt" |
+| workflow_review_request_decision_not_null | n | NOT NULL decision |
+| workflow_review_request_id_not_null | n | NOT NULL id |
+| workflow_review_request_projectId_not_null | n | NOT NULL "projectId" |
+| workflow_review_request_state_not_null | n | NOT NULL state |
+| workflow_review_request_title_not_null | n | NOT NULL title |
+| workflow_review_request_updatedAt_not_null | n | NOT NULL "updatedAt" |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_workflow_review_request_project_state | CREATE INDEX "IDX_workflow_review_request_project_state" ON public.workflow_review_request USING btree ("projectId", state) |
+| PK_ae17b90023bcd05e003cd8f64dc | CREATE UNIQUE INDEX "PK_ae17b90023bcd05e003cd8f64dc" ON public.workflow_review_request USING btree (id) |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"public.workflow_review_request" }o--o| "public.user" : "FOREIGN KEY (#quot;closedById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.workflow_review_request" }o--o| "public.user" : "FOREIGN KEY (#quot;createdById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+"public.workflow_review_request_authors" }o--|| "public.workflow_review_request" : "FOREIGN KEY (#quot;workflowReviewRequestId#quot;) REFERENCES workflow_review_request(id) ON DELETE CASCADE"
+"public.workflow_review_request_reviewers" }o--|| "public.workflow_review_request" : "FOREIGN KEY (#quot;workflowReviewRequestId#quot;) REFERENCES workflow_review_request(id) ON DELETE CASCADE"
+"public.workflow_review_request_workflow" }o--|| "public.workflow_review_request" : "FOREIGN KEY (#quot;workflowReviewRequestId#quot;) REFERENCES workflow_review_request(id) ON DELETE CASCADE"
+"public.workflow_review_request" }o--|| "public.project" : "FOREIGN KEY (#quot;projectId#quot;) REFERENCES project(id) ON DELETE CASCADE"
+"public.workflow_review_request" }o--o| "public.user" : "FOREIGN KEY (#quot;updatedById#quot;) REFERENCES #quot;user#quot;(id) ON DELETE SET NULL"
+
+"public.workflow_review_request" {
+  timestamp_3__with_time_zone approvedAt
+  uuid closedById FK
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_50_ decision
+  text description
+  varchar_36_ id
+  varchar_36_ projectId FK
+  varchar_16_ state
+  varchar_255_ title
+  timestamp_3__with_time_zone updatedAt
+  uuid updatedById FK
+}
+"public.user" {
+  timestamp_3__with_time_zone createdAt
+  boolean disabled
+  varchar_255_ email
+  varchar_32_ firstName
+  uuid id
+  date lastActiveAt
+  varchar_32_ lastName
+  boolean mfaEnabled
+  text mfaRecoveryCodes
+  text mfaSecret
+  varchar_255_ password
+  json personalizationAnswers
+  varchar_128_ roleSlug FK
+  json settings
+  timestamp_3__with_time_zone updatedAt
+}
+"public.workflow_review_request_authors" {
+  uuid userId FK
+  varchar_36_ workflowReviewRequestId FK
+}
+"public.workflow_review_request_reviewers" {
+  uuid userId FK
+  varchar_36_ workflowReviewRequestId FK
+}
+"public.workflow_review_request_workflow" {
+  varchar_36_ id
+  varchar_36_ workflowId FK
+  varchar_36_ workflowReviewRequestId FK
+  varchar_36_ workflowVersionId FK
+}
+"public.project" {
+  timestamp_3__with_time_zone createdAt
+  uuid creatorId FK
+  json customTelemetryTags
+  varchar_512_ description
+  json icon
+  varchar_36_ id
+  varchar_255_ name
+  varchar_36_ type
+  timestamp_3__with_time_zone updatedAt
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/postgres-schema/public.workflow_review_request_authors.md

@@ -0,0 +1,73 @@
+# public.workflow_review_request_authors
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| userId | uuid |  | false |  | [public.user](public.user.md) |  |
+| workflowReviewRequestId | varchar(36) |  | false |  | [public.workflow_review_request](public.workflow_review_request.md) |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| FK_a9c79ab0c352aa0496c39ea56a4 | FOREIGN KEY | FOREIGN KEY ("userId") REFERENCES "user"(id) ON DELETE CASCADE |
+| FK_c255ae5087010c1ab73ac8684af | FOREIGN KEY | FOREIGN KEY ("workflowReviewRequestId") REFERENCES workflow_review_request(id) ON DELETE CASCADE |
+| PK_ae197bb5135d422f6392a879e0c | PRIMARY KEY | PRIMARY KEY ("workflowReviewRequestId", "userId") |
+| workflow_review_request_author_workflowReviewRequestId_not_null | n | NOT NULL "workflowReviewRequestId" |
+| workflow_review_request_authors_userId_not_null | n | NOT NULL "userId" |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| PK_ae197bb5135d422f6392a879e0c | CREATE UNIQUE INDEX "PK_ae197bb5135d422f6392a879e0c" ON public.workflow_review_request_authors USING btree ("workflowReviewRequestId", "userId") |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"public.workflow_review_request_authors" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
+"public.workflow_review_request_authors" }o--|| "public.workflow_review_request" : "FOREIGN KEY (#quot;workflowReviewRequestId#quot;) REFERENCES workflow_review_request(id) ON DELETE CASCADE"
+
+"public.workflow_review_request_authors" {
+  uuid userId FK
+  varchar_36_ workflowReviewRequestId FK
+}
+"public.user" {
+  timestamp_3__with_time_zone createdAt
+  boolean disabled
+  varchar_255_ email
+  varchar_32_ firstName
+  uuid id
+  date lastActiveAt
+  varchar_32_ lastName
+  boolean mfaEnabled
+  text mfaRecoveryCodes
+  text mfaSecret
+  varchar_255_ password
+  json personalizationAnswers
+  varchar_128_ roleSlug FK
+  json settings
+  timestamp_3__with_time_zone updatedAt
+}
+"public.workflow_review_request" {
+  timestamp_3__with_time_zone approvedAt
+  uuid closedById FK
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_50_ decision
+  text description
+  varchar_36_ id
+  varchar_36_ projectId FK
+  varchar_16_ state
+  varchar_255_ title
+  timestamp_3__with_time_zone updatedAt
+  uuid updatedById FK
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/postgres-schema/public.workflow_review_request_reviewers.md

@@ -0,0 +1,74 @@
+# public.workflow_review_request_reviewers
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| userId | uuid |  | false |  | [public.user](public.user.md) |  |
+| workflowReviewRequestId | varchar(36) |  | false |  | [public.workflow_review_request](public.workflow_review_request.md) |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| FK_81d0a2584aa4e8e5e0d6aa68f32 | FOREIGN KEY | FOREIGN KEY ("userId") REFERENCES "user"(id) ON DELETE CASCADE |
+| FK_ba29e1cc5cdba43ce7b810b3ddd | FOREIGN KEY | FOREIGN KEY ("workflowReviewRequestId") REFERENCES workflow_review_request(id) ON DELETE CASCADE |
+| PK_4715c6035e0ebc4f3e8716f1e34 | PRIMARY KEY | PRIMARY KEY ("workflowReviewRequestId", "userId") |
+| workflow_review_request_review_workflowReviewRequestId_not_null | n | NOT NULL "workflowReviewRequestId" |
+| workflow_review_request_reviewers_userId_not_null | n | NOT NULL "userId" |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_workflow_review_request_reviewers_user | CREATE INDEX "IDX_workflow_review_request_reviewers_user" ON public.workflow_review_request_reviewers USING btree ("userId", "workflowReviewRequestId") |
+| PK_4715c6035e0ebc4f3e8716f1e34 | CREATE UNIQUE INDEX "PK_4715c6035e0ebc4f3e8716f1e34" ON public.workflow_review_request_reviewers USING btree ("workflowReviewRequestId", "userId") |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"public.workflow_review_request_reviewers" }o--|| "public.user" : "FOREIGN KEY (#quot;userId#quot;) REFERENCES #quot;user#quot;(id) ON DELETE CASCADE"
+"public.workflow_review_request_reviewers" }o--|| "public.workflow_review_request" : "FOREIGN KEY (#quot;workflowReviewRequestId#quot;) REFERENCES workflow_review_request(id) ON DELETE CASCADE"
+
+"public.workflow_review_request_reviewers" {
+  uuid userId FK
+  varchar_36_ workflowReviewRequestId FK
+}
+"public.user" {
+  timestamp_3__with_time_zone createdAt
+  boolean disabled
+  varchar_255_ email
+  varchar_32_ firstName
+  uuid id
+  date lastActiveAt
+  varchar_32_ lastName
+  boolean mfaEnabled
+  text mfaRecoveryCodes
+  text mfaSecret
+  varchar_255_ password
+  json personalizationAnswers
+  varchar_128_ roleSlug FK
+  json settings
+  timestamp_3__with_time_zone updatedAt
+}
+"public.workflow_review_request" {
+  timestamp_3__with_time_zone approvedAt
+  uuid closedById FK
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_50_ decision
+  text description
+  varchar_36_ id
+  varchar_36_ projectId FK
+  varchar_16_ state
+  varchar_255_ title
+  timestamp_3__with_time_zone updatedAt
+  uuid updatedById FK
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/postgres-schema/public.workflow_review_request_workflow.md

@@ -0,0 +1,100 @@
+# public.workflow_review_request_workflow
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| id | varchar(36) |  | false |  |  |  |
+| workflowId | varchar(36) |  | false |  | [public.workflow_entity](public.workflow_entity.md) |  |
+| workflowReviewRequestId | varchar(36) |  | false |  | [public.workflow_review_request](public.workflow_review_request.md) |  |
+| workflowVersionId | varchar(36) |  | true |  | [public.workflow_history](public.workflow_history.md) | Pinned workflow_history version for this review item |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| FK_0f6f0f2c6d46b806fee02962ac2 | FOREIGN KEY | FOREIGN KEY ("workflowVersionId") REFERENCES workflow_history("versionId") ON DELETE SET NULL |
+| FK_619f5b0544bcec60c3387e82f2f | FOREIGN KEY | FOREIGN KEY ("workflowId") REFERENCES workflow_entity(id) ON DELETE CASCADE |
+| FK_e44b652e6dc99ef1364a2d85504 | FOREIGN KEY | FOREIGN KEY ("workflowReviewRequestId") REFERENCES workflow_review_request(id) ON DELETE CASCADE |
+| PK_be3bf4facb054cf2b2b116b3b9c | PRIMARY KEY | PRIMARY KEY (id) |
+| workflow_review_request_workfl_workflowReviewRequestId_not_null | n | NOT NULL "workflowReviewRequestId" |
+| workflow_review_request_workflow_id_not_null | n | NOT NULL id |
+| workflow_review_request_workflow_workflowId_not_null | n | NOT NULL "workflowId" |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_workflow_review_request_workflow_workflow_request | CREATE INDEX "IDX_workflow_review_request_workflow_workflow_request" ON public.workflow_review_request_workflow USING btree ("workflowId", "workflowReviewRequestId") |
+| PK_be3bf4facb054cf2b2b116b3b9c | CREATE UNIQUE INDEX "PK_be3bf4facb054cf2b2b116b3b9c" ON public.workflow_review_request_workflow USING btree (id) |
+| UQ_workflow_review_request_workflow_request_workflow | CREATE UNIQUE INDEX "UQ_workflow_review_request_workflow_request_workflow" ON public.workflow_review_request_workflow USING btree ("workflowReviewRequestId", "workflowId") |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"public.workflow_review_request_workflow" }o--|| "public.workflow_entity" : "FOREIGN KEY (#quot;workflowId#quot;) REFERENCES workflow_entity(id) ON DELETE CASCADE"
+"public.workflow_review_request_workflow" }o--|| "public.workflow_review_request" : "FOREIGN KEY (#quot;workflowReviewRequestId#quot;) REFERENCES workflow_review_request(id) ON DELETE CASCADE"
+"public.workflow_review_request_workflow" }o--o| "public.workflow_history" : "FOREIGN KEY (#quot;workflowVersionId#quot;) REFERENCES workflow_history(#quot;versionId#quot;) ON DELETE SET NULL"
+
+"public.workflow_review_request_workflow" {
+  varchar_36_ id
+  varchar_36_ workflowId FK
+  varchar_36_ workflowReviewRequestId FK
+  varchar_36_ workflowVersionId FK
+}
+"public.workflow_entity" {
+  boolean active
+  varchar_36_ activeVersionId FK
+  json connections
+  timestamp_3__with_time_zone createdAt
+  text description
+  varchar_36_ id
+  boolean isArchived
+  json meta
+  varchar_128_ name
+  json nodeGroups
+  json nodes
+  varchar_36_ parentFolderId FK
+  json pinData
+  json settings
+  varchar sourceWorkflowId
+  json staticData
+  integer triggerCount
+  timestamp_3__with_time_zone updatedAt
+  integer versionCounter
+  character_36_ versionId
+}
+"public.workflow_review_request" {
+  timestamp_3__with_time_zone approvedAt
+  uuid closedById FK
+  timestamp_3__with_time_zone createdAt
+  uuid createdById FK
+  varchar_50_ decision
+  text description
+  varchar_36_ id
+  varchar_36_ projectId FK
+  varchar_16_ state
+  varchar_255_ title
+  timestamp_3__with_time_zone updatedAt
+  uuid updatedById FK
+}
+"public.workflow_history" {
+  varchar_255_ authors
+  boolean autosaved
+  json connections
+  timestamp_3__with_time_zone createdAt
+  text description
+  varchar_128_ name
+  json nodeGroups
+  json nodes
+  timestamp_3__with_time_zone updatedAt
+  varchar_36_ versionId
+  varchar_36_ workflowId FK
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/sqlite-schema/README.md

@@ -10,14 +10,18 @@ Auto-generated from the SQLite migrations in @n8n/db. Do not edit by hand.
 | ---- | ------- | ------- | ---- |
 | [agent_chat_subscriptions](agent_chat_subscriptions.md) | 6 |  | table |
 | [agent_checkpoints](agent_checkpoints.md) | 6 |  | table |
-| [agent_execution](agent_execution.md) | 18 |  | table |
+| [agent_eval_dataset](agent_eval_dataset.md) | 10 |  | table |
+| [agent_eval_rating](agent_eval_rating.md) | 8 |  | table |
+| [agent_eval_result](agent_eval_result.md) | 15 |  | table |
+| [agent_eval_run](agent_eval_run.md) | 14 |  | table |
+| [agent_execution](agent_execution.md) | 19 |  | table |
 | [agent_execution_threads](agent_execution_threads.md) | 17 |  | table |
 | [agent_files](agent_files.md) | 8 |  | table |
 | [agent_history](agent_history.md) | 9 |  | table |
 | [agent_task_definition](agent_task_definition.md) | 7 |  | table |
 | [agent_task_run_lock](agent_task_run_lock.md) | 6 |  | table |
 | [agent_task_snapshot](agent_task_snapshot.md) | 8 |  | table |
-| [agents](agents.md) | 11 |  | table |
+| [agents](agents.md) | 12 |  | table |
 | [agents_memory_entries](agents_memory_entries.md) | 13 |  | table |
 | [agents_memory_entry_cursors](agents_memory_entry_cursors.md) | 6 |  | table |
 | [agents_memory_entry_locks](agents_memory_entry_locks.md) | 6 |  | table |
@@ -40,7 +44,7 @@ Auto-generated from the SQLite migrations in @n8n/db. Do not edit by hand.
 | [chat_hub_sessions](chat_hub_sessions.md) | 13 |  | table |
 | [chat_hub_tools](chat_hub_tools.md) | 9 |  | table |
 | [credential_dependency](credential_dependency.md) | 5 |  | table |
-| [credentials_entity](credentials_entity.md) | 11 |  | table |
+| [credentials_entity](credentials_entity.md) | 12 |  | table |
 | [data_table](data_table.md) | 5 |  | table |
 | [data_table_column](data_table_column.md) | 7 |  | table |
 | [deployment_key](deployment_key.md) | 7 |  | table |
@@ -62,7 +66,8 @@ Auto-generated from the SQLite migrations in @n8n/db. Do not edit by hand.
 | [insights_raw](insights_raw.md) | 5 |  | table |
 | [installed_nodes](installed_nodes.md) | 4 |  | table |
 | [installed_packages](installed_packages.md) | 6 |  | table |
-| [instance_ai_checkpoints](instance_ai_checkpoints.md) | 8 |  | table |
+| [instance_ai_checkpoints](instance_ai_checkpoints.md) | 9 |  | table |
+| [instance_ai_events](instance_ai_events.md) | 7 |  | table |
 | [instance_ai_iteration_logs](instance_ai_iteration_logs.md) | 6 |  | table |
 | [instance_ai_mcp_registry_connections](instance_ai_mcp_registry_connections.md) | 7 |  | table |
 | [instance_ai_messages](instance_ai_messages.md) | 8 |  | table |
@@ -76,6 +81,7 @@ Auto-generated from the SQLite migrations in @n8n/db. Do not edit by hand.
 | [instance_ai_thread_grants](instance_ai_thread_grants.md) | 5 |  | table |
 | [instance_ai_threads](instance_ai_threads.md) | 7 |  | table |
 | [instance_ai_workflow_snapshots](instance_ai_workflow_snapshots.md) | 7 |  | table |
+| [instance_credential_assignment](instance_credential_assignment.md) | 4 |  | table |
 | [instance_version_history](instance_version_history.md) | 5 |  | table |
 | [invalid_auth_token](invalid_auth_token.md) | 2 |  | table |
 | [mcp_registry_server](mcp_registry_server.md) | 7 |  | table |
@@ -83,7 +89,7 @@ Auto-generated from the SQLite migrations in @n8n/db. Do not edit by hand.
 | [oauth_authorization_codes](oauth_authorization_codes.md) | 13 |  | table |
 | [oauth_clients](oauth_clients.md) | 9 |  | table |
 | [oauth_refresh_tokens](oauth_refresh_tokens.md) | 7 |  | table |
-| [oauth_user_consents](oauth_user_consents.md) | 4 |  | table |
+| [oauth_user_consents](oauth_user_consents.md) | 5 |  | table |
 | [processed_data](processed_data.md) | 5 |  | table |
 | [project](project.md) | 9 |  | table |
 | [project_relation](project_relation.md) | 5 |  | table |
@@ -93,7 +99,7 @@ Auto-generated from the SQLite migrations in @n8n/db. Do not edit by hand.
 | [role_mapping_rule_project](role_mapping_rule_project.md) | 2 |  | table |
 | [role_scope](role_scope.md) | 2 |  | table |
 | [scheduled_job](scheduled_job.md) | 19 |  | table |
-| [scheduled_task](scheduled_task.md) | 16 |  | table |
+| [scheduled_task](scheduled_task.md) | 17 |  | table |
 | [scope](scope.md) | 3 |  | table |
 | [secrets_provider_connection](secrets_provider_connection.md) | 7 |  | table |
 | [settings](settings.md) | 3 |  | table |
@@ -115,9 +121,13 @@ Auto-generated from the SQLite migrations in @n8n/db. Do not edit by hand.
 | [workflow_entity](workflow_entity.md) | 20 |  | table |
 | [workflow_history](workflow_history.md) | 11 |  | table |
 | [workflow_publication_outbox](workflow_publication_outbox.md) | 7 |  | table |
-| [workflow_publication_trigger_status](workflow_publication_trigger_status.md) | 7 |  | table |
+| [workflow_publication_trigger_status](workflow_publication_trigger_status.md) | 8 |  | table |
 | [workflow_publish_history](workflow_publish_history.md) | 6 |  | table |
 | [workflow_published_version](workflow_published_version.md) | 4 |  | table |
+| [workflow_review_request](workflow_review_request.md) | 12 |  | table |
+| [workflow_review_request_authors](workflow_review_request_authors.md) | 2 |  | table |
+| [workflow_review_request_reviewers](workflow_review_request_reviewers.md) | 2 |  | table |
+| [workflow_review_request_workflow](workflow_review_request_workflow.md) | 4 |  | table |
 | [workflow_statistics](workflow_statistics.md) | 7 |  | table |
 | [workflows_tags](workflows_tags.md) | 2 |  | table |
 
@@ -128,6 +138,13 @@ erDiagram
 
 "agent_chat_subscriptions" |o--|| "agents" : "FOREIGN KEY (agentId) REFERENCES agents (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "agent_checkpoints" }o--o| "agents" : "FOREIGN KEY (agentId) REFERENCES agents (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"agent_eval_dataset" }o--o| "user" : "FOREIGN KEY (createdById) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
+"agent_eval_dataset" }o--|| "agents" : "FOREIGN KEY (agentId) REFERENCES agents (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"agent_eval_rating" }o--o| "user" : "FOREIGN KEY (ratedById) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
+"agent_eval_rating" }o--|| "agent_eval_result" : "FOREIGN KEY (resultId) REFERENCES agent_eval_result (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"agent_eval_result" }o--|| "agent_eval_run" : "FOREIGN KEY (runId) REFERENCES agent_eval_run (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"agent_eval_run" }o--o| "user" : "FOREIGN KEY (createdById) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
+"agent_eval_run" }o--|| "agent_eval_dataset" : "FOREIGN KEY (datasetId) REFERENCES agent_eval_dataset (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "agent_execution" }o--|| "agent_execution_threads" : "FOREIGN KEY (threadId) REFERENCES agent_execution_threads (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "agent_execution_threads" }o--o| "agent_history" : "FOREIGN KEY (taskVersionId) REFERENCES agent_history (versionId) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
 "agent_execution_threads" }o--|| "agents" : "FOREIGN KEY (agentId) REFERENCES agents (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
@@ -138,8 +155,8 @@ erDiagram
 "agent_task_definition" }o--|| "agents" : "FOREIGN KEY (agentId) REFERENCES agents (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "agent_task_run_lock" |o--|| "agents" : "FOREIGN KEY (agentId) REFERENCES agents (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "agent_task_snapshot" |o--|| "agent_history" : "FOREIGN KEY (versionId) REFERENCES agent_history (versionId) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
-"agents" }o--|| "project" : "FOREIGN KEY (projectId) REFERENCES project (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "agents" }o--o| "agent_history" : "FOREIGN KEY (activeVersionId) REFERENCES agent_history (versionId) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
+"agents" }o--|| "project" : "FOREIGN KEY (projectId) REFERENCES project (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "agents_memory_entries" }o--o| "agents_memory_entries" : "FOREIGN KEY (supersededBy) REFERENCES agents_memory_entries (id) ON UPDATE NO ACTION ON DELETE NO ACTION MATCH NONE"
 "agents_memory_entries" }o--|| "agents_resources" : "FOREIGN KEY (resourceId) REFERENCES agents_resources (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "agents_memory_entries" }o--|| "agents" : "FOREIGN KEY (agentId) REFERENCES agents (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
@@ -210,6 +227,7 @@ erDiagram
 "insights_raw" }o--|| "insights_metadata" : "FOREIGN KEY (metaId) REFERENCES insights_metadata (metaId) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "installed_nodes" }o--|| "installed_packages" : "FOREIGN KEY (package) REFERENCES installed_packages (packageName) ON UPDATE CASCADE ON DELETE CASCADE MATCH NONE"
 "instance_ai_checkpoints" }o--|| "instance_ai_threads" : "FOREIGN KEY (threadId) REFERENCES instance_ai_threads (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"instance_ai_events" |o--|| "instance_ai_threads" : "FOREIGN KEY (threadId) REFERENCES instance_ai_threads (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "instance_ai_iteration_logs" }o--|| "instance_ai_threads" : "FOREIGN KEY (threadId) REFERENCES instance_ai_threads (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "instance_ai_mcp_registry_connections" }o--|| "user" : "FOREIGN KEY (userId) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "instance_ai_mcp_registry_connections" }o--|| "mcp_registry_server" : "FOREIGN KEY (serverSlug) REFERENCES mcp_registry_server (slug) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
@@ -228,6 +246,7 @@ erDiagram
 "instance_ai_thread_grants" |o--|| "user" : "FOREIGN KEY (userId) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "instance_ai_thread_grants" |o--|| "instance_ai_threads" : "FOREIGN KEY (threadId) REFERENCES instance_ai_threads (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "instance_ai_threads" }o--|| "project" : "FOREIGN KEY (projectId) REFERENCES project (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"instance_credential_assignment" }o--|| "credentials_entity" : "FOREIGN KEY (credentialId) REFERENCES credentials_entity (id) ON UPDATE NO ACTION ON DELETE RESTRICT MATCH NONE"
 "oauth_access_tokens" }o--|| "user" : "FOREIGN KEY (userId) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "oauth_access_tokens" }o--|| "oauth_clients" : "FOREIGN KEY (clientId) REFERENCES oauth_clients (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "oauth_authorization_codes" }o--|| "oauth_clients" : "FOREIGN KEY (clientId) REFERENCES oauth_clients (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
@@ -272,8 +291,8 @@ erDiagram
 "workflow_entity" }o--o| "workflow_history" : "FOREIGN KEY (activeVersionId) REFERENCES workflow_history (versionId) ON UPDATE NO ACTION ON DELETE RESTRICT MATCH NONE"
 "workflow_entity" }o--o| "folder" : "FOREIGN KEY (parentFolderId) REFERENCES folder (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "workflow_history" }o--|| "workflow_entity" : "FOREIGN KEY (workflowId) REFERENCES workflow_entity (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
-"workflow_publication_trigger_status" }o--|| "workflow_history" : "FOREIGN KEY (versionId) REFERENCES workflow_history (versionId) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "workflow_publication_trigger_status" |o--|| "workflow_entity" : "FOREIGN KEY (workflowId) REFERENCES workflow_entity (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"workflow_publication_trigger_status" }o--|| "workflow_history" : "FOREIGN KEY (versionId) REFERENCES workflow_history (versionId) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "workflow_publish_history" }o--o| "workflow_history" : "FOREIGN KEY (versionId) REFERENCES workflow_history (versionId) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
 "workflow_publish_history" }o--o| "user" : "FOREIGN KEY (userId) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
 "workflow_publish_history" }o--o| "workflow_history" : "FOREIGN KEY (versionId) REFERENCES workflow_history (versionId) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
@@ -282,6 +301,17 @@ erDiagram
 "workflow_published_version" |o--|| "workflow_entity" : "FOREIGN KEY (workflowId) REFERENCES workflow_entity (id) ON UPDATE NO ACTION ON DELETE RESTRICT MATCH NONE"
 "workflow_published_version" |o--|| "workflow_entity" : "FOREIGN KEY (workflowId) REFERENCES workflow_entity (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "workflow_published_version" }o--|| "workflow_history" : "FOREIGN KEY (publishedVersionId) REFERENCES workflow_history (versionId) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"workflow_review_request" }o--o| "user" : "FOREIGN KEY (closedById) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
+"workflow_review_request" }o--o| "user" : "FOREIGN KEY (updatedById) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
+"workflow_review_request" }o--o| "user" : "FOREIGN KEY (createdById) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
+"workflow_review_request" }o--|| "project" : "FOREIGN KEY (projectId) REFERENCES project (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"workflow_review_request_authors" |o--|| "user" : "FOREIGN KEY (userId) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"workflow_review_request_authors" |o--|| "workflow_review_request" : "FOREIGN KEY (workflowReviewRequestId) REFERENCES workflow_review_request (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"workflow_review_request_reviewers" |o--|| "user" : "FOREIGN KEY (userId) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"workflow_review_request_reviewers" |o--|| "workflow_review_request" : "FOREIGN KEY (workflowReviewRequestId) REFERENCES workflow_review_request (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"workflow_review_request_workflow" }o--o| "workflow_history" : "FOREIGN KEY (workflowVersionId) REFERENCES workflow_history (versionId) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
+"workflow_review_request_workflow" }o--|| "workflow_entity" : "FOREIGN KEY (workflowId) REFERENCES workflow_entity (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"workflow_review_request_workflow" }o--|| "workflow_review_request" : "FOREIGN KEY (workflowReviewRequestId) REFERENCES workflow_review_request (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "workflows_tags" |o--|| "tag_entity" : "FOREIGN KEY (tagId) REFERENCES tag_entity (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 "workflows_tags" |o--|| "workflow_entity" : "FOREIGN KEY (workflowId) REFERENCES workflow_entity (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
 
@@ -301,6 +331,61 @@ erDiagram
   TEXT state
   datetime_3_ updatedAt
 }
+"agent_eval_dataset" {
+  varchar_36_ agentId FK
+  TEXT columnMapping
+  datetime_3_ createdAt
+  varchar createdById FK
+  TEXT datasetRef
+  varchar_32_ datasetSource
+  TEXT description
+  varchar_36_ id PK
+  varchar_128_ name
+  datetime_3_ updatedAt
+}
+"agent_eval_rating" {
+  TEXT comment
+  TEXT correction
+  datetime_3_ createdAt
+  varchar_36_ id PK
+  varchar ratedById FK
+  varchar_36_ resultId FK
+  datetime_3_ updatedAt
+  varchar_8_ vote
+}
+"agent_eval_result" {
+  datetime_3_ completedAt
+  datetime_3_ createdAt
+  varchar_255_ errorCode
+  TEXT errorDetails
+  varchar_36_ id PK
+  TEXT input
+  TEXT metrics
+  TEXT output
+  datetime_3_ runAt
+  varchar_36_ runId FK
+  INTEGER runIndex
+  varchar_255_ sourceRowId
+  varchar status
+  TEXT toolCalls
+  datetime_3_ updatedAt
+}
+"agent_eval_run" {
+  varchar_36_ agentVersionId
+  boolean cancelRequested
+  datetime_3_ completedAt
+  datetime_3_ createdAt
+  varchar createdById FK
+  varchar_36_ datasetId FK
+  varchar_255_ errorCode
+  TEXT errorDetails
+  varchar_36_ id PK
+  TEXT metrics
+  datetime_3_ runAt
+  varchar_255_ runningInstanceId
+  varchar status
+  datetime_3_ updatedAt
+}
 "agent_execution" {
   INTEGER completionTokens
   REAL cost
@@ -315,6 +400,7 @@ erDiagram
   datetime_3_ startedAt
   varchar_16_ status
   datetime_3_ stoppedAt
+  VARCHAR_2_ storedAt
   varchar_128_ threadId FK
   TEXT timeline
   INTEGER totalTokens
@@ -390,6 +476,7 @@ erDiagram
 }
 "agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   datetime_3_ createdAt
   varchar_36_ id PK
   TEXT integrations
@@ -627,6 +714,7 @@ erDiagram
   varchar_16_ resolverId FK
   varchar_32_ type
   datetime_3_ updatedAt
+  VARCHAR_16_ usageScope
 }
 "data_table" {
   datetime_3_ createdAt
@@ -788,7 +876,7 @@ erDiagram
   bigint value
 }
 "installed_nodes" {
-  INTEGER latestVersion
+  REAL latestVersion
   char_200_ name PK
   char_214_ package FK
   char_200_ type
@@ -804,6 +892,7 @@ erDiagram
 "instance_ai_checkpoints" {
   datetime_3_ createdAt
   datetime_3_ expiredAt
+  VARCHAR_64_ hostRunId
   varchar_255_ key PK
   varchar_255_ resourceId
   varchar_255_ runId
@@ -811,6 +900,15 @@ erDiagram
   varchar threadId FK
   datetime_3_ updatedAt
 }
+"instance_ai_events" {
+  datetime_3_ createdAt
+  TEXT payload
+  varchar_64_ runId
+  INTEGER seq PK
+  varchar threadId PK
+  varchar_64_ type
+  datetime_3_ updatedAt
+}
 "instance_ai_iteration_logs" {
   datetime_3_ createdAt
   TEXT entry
@@ -958,6 +1056,12 @@ erDiagram
   datetime_3_ updatedAt
   varchar_255_ workflowName PK
 }
+"instance_credential_assignment" {
+  datetime_3_ createdAt
+  varchar_36_ credentialId FK
+  varchar_128_ credentialUseId PK
+  datetime_3_ updatedAt
+}
 "instance_version_history" {
   datetime_3_ createdAt
   INTEGER id
@@ -1022,6 +1126,7 @@ erDiagram
   varchar clientId FK
   bigint grantedAt
   INTEGER id
+  TEXT scope
   varchar userId FK
 }
 "processed_data" {
@@ -1107,6 +1212,7 @@ erDiagram
   INTEGER attempts
   varchar_255_ claimedBy
   datetime_3_ createdAt
+  datetime_3_ dispatchedAt
   TEXT errorMessage
   datetime_3_ finishedAt
   INTEGER id
@@ -1337,6 +1443,7 @@ erDiagram
   TEXT errorMessage
   varchar_36_ nodeId PK
   varchar_20_ status
+  varchar_20_ triggerKind
   datetime_3_ updatedAt
   varchar_36_ versionId FK
   varchar_36_ workflowId PK
@@ -1355,6 +1462,34 @@ erDiagram
   datetime_3_ updatedAt
   varchar_36_ workflowId PK
 }
+"workflow_review_request" {
+  datetime_3_ approvedAt
+  varchar closedById FK
+  datetime_3_ createdAt
+  varchar createdById FK
+  varchar_50_ decision
+  TEXT description
+  varchar_36_ id PK
+  varchar_36_ projectId FK
+  varchar_16_ state
+  varchar_255_ title
+  datetime_3_ updatedAt
+  varchar updatedById FK
+}
+"workflow_review_request_authors" {
+  varchar userId PK
+  varchar_36_ workflowReviewRequestId PK
+}
+"workflow_review_request_reviewers" {
+  varchar userId PK
+  varchar_36_ workflowReviewRequestId PK
+}
+"workflow_review_request_workflow" {
+  varchar_36_ id PK
+  varchar_36_ workflowId FK
+  varchar_36_ workflowReviewRequestId FK
+  varchar_36_ workflowVersionId FK
+}
 "workflow_statistics" {
   INTEGER count
   INTEGER id

docs/generated/sqlite-schema/agent_chat_subscriptions.md

@@ -57,6 +57,7 @@ erDiagram
 }
 "agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   datetime_3_ createdAt
   varchar_36_ id PK
   TEXT integrations

docs/generated/sqlite-schema/agent_checkpoints.md

@@ -54,6 +54,7 @@ erDiagram
 }
 "agents" {
   varchar_36_ activeVersionId FK
+  boolean availableInMCP
   datetime_3_ createdAt
   varchar_36_ id PK
   TEXT integrations

docs/generated/sqlite-schema/agent_eval_dataset.md

@@ -0,0 +1,118 @@
+# agent_eval_dataset
+
+## Description
+
+<details>
+<summary><strong>Table Definition</strong></summary>
+
+```sql
+CREATE TABLE "agent_eval_dataset" ("id" varchar(36) PRIMARY KEY NOT NULL, "name" varchar(128) NOT NULL, "description" text, "agentId" varchar(36) NOT NULL, "datasetSource" varchar(32) NOT NULL, "datasetRef" text NOT NULL, "columnMapping" text, "createdById" varchar, "createdAt" datetime(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')), "updatedAt" datetime(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')), CONSTRAINT "CHK_agent_eval_dataset_datasetSource" CHECK ("datasetSource" IN ('data_table', 'google_sheets')), CONSTRAINT "FK_9d3a6fd750f7746de453cf4d5ed" FOREIGN KEY ("agentId") REFERENCES "agents" ("id") ON DELETE CASCADE, CONSTRAINT "FK_eda9e5fa5558d3f16bc2f6c21b6" FOREIGN KEY ("createdById") REFERENCES "user" ("id") ON DELETE SET NULL)
+```
+
+</details>
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| agentId | varchar(36) |  | false |  | [agents](agents.md) |  |
+| columnMapping | TEXT |  | true |  |  |  |
+| createdAt | datetime(3) | STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW') | false |  |  |  |
+| createdById | varchar |  | true |  | [user](user.md) |  |
+| datasetRef | TEXT |  | false |  |  |  |
+| datasetSource | varchar(32) |  | false |  |  |  |
+| description | TEXT |  | true |  |  |  |
+| id | varchar(36) |  | false | [agent_eval_run](agent_eval_run.md) |  |  |
+| name | varchar(128) |  | false |  |  |  |
+| updatedAt | datetime(3) | STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW') | false |  |  |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| - | CHECK | CHECK ("datasetSource" IN ('data_table', 'google_sheets')) |
+| - (Foreign key ID: 0) | FOREIGN KEY | FOREIGN KEY (createdById) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE |
+| - (Foreign key ID: 1) | FOREIGN KEY | FOREIGN KEY (agentId) REFERENCES agents (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE |
+| id | PRIMARY KEY | PRIMARY KEY (id) |
+| sqlite_autoindex_agent_eval_dataset_1 | PRIMARY KEY | PRIMARY KEY (id) |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_9d3a6fd750f7746de453cf4d5e | CREATE INDEX "IDX_9d3a6fd750f7746de453cf4d5e" ON "agent_eval_dataset" ("agentId")  |
+| sqlite_autoindex_agent_eval_dataset_1 | PRIMARY KEY (id) |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"agent_eval_dataset" }o--|| "agents" : "FOREIGN KEY (agentId) REFERENCES agents (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"agent_eval_dataset" }o--o| "user" : "FOREIGN KEY (createdById) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
+"agent_eval_run" }o--|| "agent_eval_dataset" : "FOREIGN KEY (datasetId) REFERENCES agent_eval_dataset (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+
+"agent_eval_dataset" {
+  varchar_36_ agentId FK
+  TEXT columnMapping
+  datetime_3_ createdAt
+  varchar createdById FK
+  TEXT datasetRef
+  varchar_32_ datasetSource
+  TEXT description
+  varchar_36_ id PK
+  varchar_128_ name
+  datetime_3_ updatedAt
+}
+"agents" {
+  varchar_36_ activeVersionId FK
+  boolean availableInMCP
+  datetime_3_ createdAt
+  varchar_36_ id PK
+  TEXT integrations
+  varchar_128_ name
+  varchar_255_ projectId FK
+  TEXT schema
+  TEXT skills
+  TEXT tools
+  datetime_3_ updatedAt
+  varchar_36_ versionId
+}
+"user" {
+  datetime_3_ createdAt
+  boolean disabled
+  varchar_255_ email
+  varchar_32_ firstName
+  varchar id PK
+  date lastActiveAt
+  varchar_32_ lastName
+  boolean mfaEnabled
+  TEXT mfaRecoveryCodes
+  TEXT mfaSecret
+  varchar password
+  TEXT personalizationAnswers
+  varchar_128_ roleSlug FK
+  TEXT settings
+  datetime_3_ updatedAt
+}
+"agent_eval_run" {
+  varchar_36_ agentVersionId
+  boolean cancelRequested
+  datetime_3_ completedAt
+  datetime_3_ createdAt
+  varchar createdById FK
+  varchar_36_ datasetId FK
+  varchar_255_ errorCode
+  TEXT errorDetails
+  varchar_36_ id PK
+  TEXT metrics
+  datetime_3_ runAt
+  varchar_255_ runningInstanceId
+  varchar status
+  datetime_3_ updatedAt
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/sqlite-schema/agent_eval_rating.md

@@ -0,0 +1,100 @@
+# agent_eval_rating
+
+## Description
+
+<details>
+<summary><strong>Table Definition</strong></summary>
+
+```sql
+CREATE TABLE "agent_eval_rating" ("id" varchar(36) PRIMARY KEY NOT NULL, "resultId" varchar(36) NOT NULL, "vote" varchar(8) NOT NULL, "comment" text, "correction" text, "ratedById" varchar, "createdAt" datetime(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')), "updatedAt" datetime(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')), CONSTRAINT "CHK_agent_eval_rating_vote" CHECK ("vote" IN ('up', 'down')), CONSTRAINT "FK_9cadae6591c64498f1b58a2cef3" FOREIGN KEY ("resultId") REFERENCES "agent_eval_result" ("id") ON DELETE CASCADE, CONSTRAINT "FK_e06a7408573a3e152e673977d2c" FOREIGN KEY ("ratedById") REFERENCES "user" ("id") ON DELETE SET NULL)
+```
+
+</details>
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| comment | TEXT |  | true |  |  |  |
+| correction | TEXT |  | true |  |  |  |
+| createdAt | datetime(3) | STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW') | false |  |  |  |
+| id | varchar(36) |  | false |  |  |  |
+| ratedById | varchar |  | true |  | [user](user.md) |  |
+| resultId | varchar(36) |  | false |  | [agent_eval_result](agent_eval_result.md) |  |
+| updatedAt | datetime(3) | STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW') | false |  |  |  |
+| vote | varchar(8) |  | false |  |  |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| - | CHECK | CHECK ("vote" IN ('up', 'down')) |
+| - (Foreign key ID: 0) | FOREIGN KEY | FOREIGN KEY (ratedById) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE |
+| - (Foreign key ID: 1) | FOREIGN KEY | FOREIGN KEY (resultId) REFERENCES agent_eval_result (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE |
+| id | PRIMARY KEY | PRIMARY KEY (id) |
+| sqlite_autoindex_agent_eval_rating_1 | PRIMARY KEY | PRIMARY KEY (id) |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_9cadae6591c64498f1b58a2cef | CREATE INDEX "IDX_9cadae6591c64498f1b58a2cef" ON "agent_eval_rating" ("resultId")  |
+| sqlite_autoindex_agent_eval_rating_1 | PRIMARY KEY (id) |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"agent_eval_rating" }o--o| "user" : "FOREIGN KEY (ratedById) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE SET NULL MATCH NONE"
+"agent_eval_rating" }o--|| "agent_eval_result" : "FOREIGN KEY (resultId) REFERENCES agent_eval_result (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+
+"agent_eval_rating" {
+  TEXT comment
+  TEXT correction
+  datetime_3_ createdAt
+  varchar_36_ id PK
+  varchar ratedById FK
+  varchar_36_ resultId FK
+  datetime_3_ updatedAt
+  varchar_8_ vote
+}
+"user" {
+  datetime_3_ createdAt
+  boolean disabled
+  varchar_255_ email
+  varchar_32_ firstName
+  varchar id PK
+  date lastActiveAt
+  varchar_32_ lastName
+  boolean mfaEnabled
+  TEXT mfaRecoveryCodes
+  TEXT mfaSecret
+  varchar password
+  TEXT personalizationAnswers
+  varchar_128_ roleSlug FK
+  TEXT settings
+  datetime_3_ updatedAt
+}
+"agent_eval_result" {
+  datetime_3_ completedAt
+  datetime_3_ createdAt
+  varchar_255_ errorCode
+  TEXT errorDetails
+  varchar_36_ id PK
+  TEXT input
+  TEXT metrics
+  TEXT output
+  datetime_3_ runAt
+  varchar_36_ runId FK
+  INTEGER runIndex
+  varchar_255_ sourceRowId
+  varchar status
+  TEXT toolCalls
+  datetime_3_ updatedAt
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)

docs/generated/sqlite-schema/agent_eval_result.md

@@ -0,0 +1,105 @@
+# agent_eval_result
+
+## Description
+
+<details>
+<summary><strong>Table Definition</strong></summary>
+
+```sql
+CREATE TABLE "agent_eval_result" ("id" varchar(36) PRIMARY KEY NOT NULL, "runId" varchar(36) NOT NULL, "sourceRowId" varchar(255), "runIndex" integer, "status" varchar NOT NULL, "input" text, "output" text, "toolCalls" text, "metrics" text, "runAt" datetime(3), "completedAt" datetime(3), "errorCode" varchar(255), "errorDetails" text, "createdAt" datetime(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')), "updatedAt" datetime(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')), CONSTRAINT "CHK_agent_eval_result_status" CHECK ("status" IN ('new', 'running', 'success', 'error', 'cancelled')), CONSTRAINT "FK_40a2d1248a6d984f442de2fac1b" FOREIGN KEY ("runId") REFERENCES "agent_eval_run" ("id") ON DELETE CASCADE)
+```
+
+</details>
+
+## Columns
+
+| Name | Type | Default | Nullable | Children | Parents | Comment |
+| ---- | ---- | ------- | -------- | -------- | ------- | ------- |
+| completedAt | datetime(3) |  | true |  |  |  |
+| createdAt | datetime(3) | STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW') | false |  |  |  |
+| errorCode | varchar(255) |  | true |  |  |  |
+| errorDetails | TEXT |  | true |  |  |  |
+| id | varchar(36) |  | false | [agent_eval_rating](agent_eval_rating.md) |  |  |
+| input | TEXT |  | true |  |  |  |
+| metrics | TEXT |  | true |  |  |  |
+| output | TEXT |  | true |  |  |  |
+| runAt | datetime(3) |  | true |  |  |  |
+| runId | varchar(36) |  | false |  | [agent_eval_run](agent_eval_run.md) |  |
+| runIndex | INTEGER |  | true |  |  |  |
+| sourceRowId | varchar(255) |  | true |  |  |  |
+| status | varchar |  | false |  |  |  |
+| toolCalls | TEXT |  | true |  |  |  |
+| updatedAt | datetime(3) | STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW') | false |  |  |  |
+
+## Constraints
+
+| Name | Type | Definition |
+| ---- | ---- | ---------- |
+| - | CHECK | CHECK ("status" IN ('new', 'running', 'success', 'error', 'cancelled')) |
+| - (Foreign key ID: 0) | FOREIGN KEY | FOREIGN KEY (runId) REFERENCES agent_eval_run (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE |
+| id | PRIMARY KEY | PRIMARY KEY (id) |
+| sqlite_autoindex_agent_eval_result_1 | PRIMARY KEY | PRIMARY KEY (id) |
+
+## Indexes
+
+| Name | Definition |
+| ---- | ---------- |
+| IDX_40a2d1248a6d984f442de2fac1 | CREATE INDEX "IDX_40a2d1248a6d984f442de2fac1" ON "agent_eval_result" ("runId")  |
+| sqlite_autoindex_agent_eval_result_1 | PRIMARY KEY (id) |
+
+## Relations
+
+```mermaid
+erDiagram
+
+"agent_eval_rating" }o--|| "agent_eval_result" : "FOREIGN KEY (resultId) REFERENCES agent_eval_result (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+"agent_eval_result" }o--|| "agent_eval_run" : "FOREIGN KEY (runId) REFERENCES agent_eval_run (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"
+
+"agent_eval_result" {
+  datetime_3_ completedAt
+  datetime_3_ createdAt
+  varchar_255_ errorCode
+  TEXT errorDetails
+  varchar_36_ id PK
+  TEXT input
+  TEXT metrics
+  TEXT output
+  datetime_3_ runAt
+  varchar_36_ runId FK
+  INTEGER runIndex
+  varchar_255_ sourceRowId
+  varchar status
+  TEXT toolCalls
+  datetime_3_ updatedAt
+}
+"agent_eval_rating" {
+  TEXT comment
+  TEXT correction
+  datetime_3_ createdAt
+  varchar_36_ id PK
+  varchar ratedById FK
+  varchar_36_ resultId FK
+  datetime_3_ updatedAt
+  varchar_8_ vote
+}
+"agent_eval_run" {
+  varchar_36_ agentVersionId
+  boolean cancelRequested
+  datetime_3_ completedAt
+  datetime_3_ createdAt
+  varchar createdById FK
+  varchar_36_ datasetId FK
+  varchar_255_ errorCode
+  TEXT errorDetails
+  varchar_36_ id PK
+  TEXT metrics
+  datetime_3_ runAt
+  varchar_255_ runningInstanceId
+  varchar status
+  datetime_3_ updatedAt
+}
+```
+
+---
+
+> Generated by [tbls](https://github.com/k1LoW/tbls)