v0.5.0 — Silent-failure detection + workflow promotion

n8n tells you the run succeeded. The run did not succeed.

That is the failure class this release is built around: a node errored under Continue-On-Fail, or quietly stopped producing data, and the execution still lands in the green pile with nothing to alert on. v0.5 catches those, catches the node that never ran at all, and adds a way to move a workflow between environments without guessing at credentials.

Added

• Silent-failure detection (green but broken runs). On OpenTelemetry ingest, AgeniusDesk reads output shape rather than status. It unions the three places n8n records a demoted error and classifies each node's output volume against that node's own recent history, so a steady producer that had input and dropped to zero (or far below its normal band) is flagged, while cold-start nodes and habitually-empty pollers stay quiet. Drop cascades are suppressed to the origin node, so one root cause is one alert instead of fifteen. Detected failures land in the same errors pipeline as everything else under their own Silent failure class: a dedicated Overview card, tiles on Insights and the Observe strip, a SILENT badge with jump-to-trace in the Errors feed, and a distinct amber block on the Execution Timeline. Tunable per instance with AGD_HEALTH_*.

  Requires the instance to be exporting OpenTelemetry to AgeniusDesk. Instances AgeniusDesk provisions are auto-wired; for one you connected by URL, enable n8n's native OTel export.

• Dead-man's switch: the node that should have run but didn't. The output-shape detectors cannot see a node that produced no span, because there is nothing to read. On a completed green run this diffs the workflow's declared nodes against the spans that actually landed, and flags one that had input available but never ran and that historically runs in nearly every execution. Graph-aware, so a node legitimately skipped downstream of an empty node is treated as a cascade victim rather than a dead node.

• Workflow promotion across instances (dev to staging to prod). The open-source answer to n8n Enterprise environments. A preflight reports every credential each workflow binds, whether the target ships that type, and duplicate-name collisions, before anything is written. Credential auto-provision reuses a credential already mirrored onto the target or creates one from the Secrets store, running through the same SSRF, instance-scope, and URL-repoint guardrails as the manual mirror route. Ambiguity is surfaced, never guessed, and provisioning is idempotent by reuse rather than delete-and-recreate, so an already-promoted workflow never has its credential id pulled out from under it. Because n8n binds a node credential by both id and name, activation is refused when a mapped credential has no name on the target rather than importing something that fails on its first run.

Security

• The assistant asks before it acts. It reads content you do not control (n8n error and execution payloads, RAG hits, MCP output), so a prompt injection buried in any of it could previously steer a state-changing tool call during an ordinary chat turn. Those calls no longer execute mid-turn: they return as a proposal on an approval card, operator-gated, CSRF-checked, single-use, and expiring. The gate lives in a shared dispatch path so it covers both the OpenAI-compatible and Anthropic tool loops, and the card renders on all six chat surfaces. MCP tools are classified per server from the server's own readOnlyHint annotations, and a tool that cannot be classified fails closed. AGD_ASSISTANT_AUTORUN=true restores unattended execution for a headless install.

• Public API keys gain expiry, scoping, and a rate limit. A key can now carry an expiry, be scoped to an IP, instance, or workflow, and is subject to a per-key token bucket. Every field is optional and absent means unrestricted, so keys you already issued keep working.

• One self-signed n8n no longer disables certificate checking for the whole fleet. TLS verification moved from a global switch to a per-instance tls_verify.

• The unauthenticated ingest paths are rate limited and bounded. Per-IP limits on the webhook and OTLP receivers, prune-before-insert so the span row cap is a real ceiling under sustained load, and span-attribute size bounds.

Plus a defense-in-depth batch: a central audit sink, promoted secrets no longer copied into os.environ, same-origin CORS default, constant-time MCP ping compare, deploy-time Docker HostConfig re-check, and separated password/TOTP lockout counters.

Fixed

• Traces are attributed to the instance that produced them. n8n's OTel export carries no attribute naming the AgeniusDesk instance it was configured under, only an opaque hash, and the old matcher never resolved it, so every trace fell back to whichever instance you were viewing. In a multi-instance fleet that mis-attributed executions and error rates, and broke cost and health enrichment outright: enrichment fetched run-data from the active instance, which does not hold a foreign instance's execution, so it read empty and wrote $0 cost / no health. Resolution is now two-tier, a deterministic resource attribute on provisioned instances plus a one-time learn step for external ones, and an exporter that cannot yet be placed parks in a stable bucket instead of landing on the active instance.

• Cost and silent-failure enrichment fetch run-data from the trace's owning instance, so a non-active instance's spend and health are no longer silently empty.

• Aggregate Spend counts every run, not just traces you opened. Cost enrichment ran lazily on trace open while health enrichment already ran on ingest, so a full day of runs could show $0.0000 Spend while any individual waterfall showed real dollars. Pricing now happens as runs land.

• Community module views no longer load with dead JavaScript. The sandboxed iframe made a view's own module.js a cross-origin fetch, and the static route sent no Access-Control-Allow-Origin, so the browser blocked the script silently and the view came up with no behavior and no error.

• Assistant provider keys resolve however you named your secrets, rather than only the convention name.

Upgrade notes

The assistant now gates state-changing tool calls by default (AGD_ASSISTANT_AUTORUN=true restores the old behavior). AGD_TLS_VERIFY is superseded by the per-instance tls_verify field. New per-IP and per-key rate limits apply to the ingest and public API paths; defaults sit well above normal single-fleet traffic.

Full detail in the CHANGELOG. Silent-failure detection is written up in docs/architecture/silent-failure-detection.md; promotion has a new guide at docs/guide/promote.md.