v0.3.1: Antwort auf die zweite Review-Runde

Fixed

Response to the second 3-agent code review pass (analyst + critic + research, all three completed this time).

• Honesty fix in every template README and the top-level README. v0.3.0 said "These five patterns ship in the workflow.json". They don't. They are documented as drop-in code-node snippets in internal style guide. The current workflow.json ships the happy path. The patterns are opt-in additions you wire in for hardened production. Fixed every template README to say so explicitly. The roadmap entry for v0.4.0 commits to wiring the four production-patterns as opt-in nodes inside the default workflow.json so they're one click away rather than one paste away.
• Error-handling syntax (Critic v2 P1.1). The previous claim "use {{ $error.message }}" was flat wrong. $error does not exist as an n8n expression context. Fixed to {{ $json.error.message }} for the inline error pin (downstream of "Continue (using error output)") and noted that {{ $json.execution.error.message }} is the separate, also-valid syntax for the Error Trigger Workflow (Workflow Settings → Error Workflow). Both are documented in the n8n Docs. The wrong claim appeared in eight places: internal style guide, top-level README, changelog, and three template READMEs. All eight fixed and verified.
• HMAC timingSafeEqual length-guard (Critic v2 P1.4). crypto.timingSafeEqual throws RangeError if the two buffers differ in length, which an attacker can trigger with a one-character signature, turning the workflow into a free DoS vector. internal style guide HMAC snippet now does an explicit if (sigBuf.length !== expBuf.length) throw new Error('HMAC verification failed') before the timing-safe compare. Snippet also covers Stripe's t=<timestamp>,v1=<hmac> format with the recommendation to use stripe.webhooks.constructEvent from the SDK rather than re-implementing the parsing.
• Idempotency disclaimer (Critic v2 P1.2). internal style guide idempotency snippet now spells out that $getWorkflowStaticData('global') is not atomic and not cluster-aware. Two concurrent executions with the same key can both pass the dedup check in the millisecond window between read and write. Two n8n workers behind a load balancer don't share the static-data map at all. Default in-memory pattern is good enough for single-instance dev / small production loads. Production-empfehlung: Redis SET NX with EX 300 NX (atomic, cluster-aware, cleans up via TTL). Snippet provided.
• Rate-limit disclaimer (Critic v2 P1.3). internal style guide rate-limit snippet expanded with three improvements: (a) explicit TOCTOU note (we may overshoot the limit by ~5% under concurrent fires), (b) MAX_BUCKETS = 5000 cap on the in-memory map with eviction of expired entries to prevent unbounded memory growth, (c) production recommendation to handle rate-limiting at the reverse proxy (Nginx limit_req_zone, Cloudflare WAF, AWS WAF, Traefik RateLimit middleware) for atomic + cluster-aware + faster behavior. The Code-Node pattern remains as defense-in-depth or for setups without a reverse proxy.
• Em-dashes in cover.md files (Analyst v2 finding). Four cover.md files (templates 01/02/03 + _TEMPLATE) had one em-dash each that the v0.2.0 sweep missed. Cleaned. CI em-dash guard in .github/workflows/validate-workflows.yml now covers cover.md too.
• meta field in workflow.json (Analyst v2 finding). The the internal style guide forbids meta because the n8n Public API rejects it on POST /api/v1/workflows. v0.2.0 templates still had meta: { templateId: "..." } left over. Stripped from all three templates. The validate-workflows CI now blocks meta field presence on PR.

Added

• "How we compare to other public n8n template repos" section in the top-level README. Thirteen-row capability matrix that makes the production-patterns gap visible at first scroll. Driven by the research-agent finding that no competitor ships these patterns.
• FAQ section in the top-level README with eight questions covering memory dependency, multi-provider rationale, n8n version floor, Cloud compatibility, cost-per-execution, production-readiness honesty, contribution flow, sticky-note verbosity, and security-issue reporting.
• Distribution status table in the top-level README. Explicit list of which channels we are on (GitHub repo, topics, social preview, discussions) and which we hold back until v0.4.0 ships the production patterns as wired-in nodes (n8n.io/workflows, awesome-n8n-templates, dev.to, Reddit, LinkedIn). Honesty about the maturity gap up front.

Notes

• v0.3.1 is a patch release because no template's behavior changed, only documentation and internal style guide snippets. v0.4.0 will be the next minor and will move the four opt-in production patterns from documented snippets into actual nodes inside the default workflow.json (off by default with sticky-note enable instructions). That is the version we submit to n8n.io and awesome-n8n-templates.