Public-source evidence case · 22 August 2026

A real n8n change, with the missing evidence left visible.

Two consecutive public workflow revisions from n8n's Apache-2.0 Self-hosted AI Starter Kit were compared in the live browser-local ReleaseGuard. This is not a customer workflow.

Delivery status: DRAFT
Policy result: Human review required
Staging evidence: Not run
Package verification: 13/13 files

Open the DRAFT HTML report Open the free local tool

Source and reproducibility

The record is bound to two real upstream revisions with named commits and hashes.

The source is the public Self-hosted AI Starter Kit repository under the n8n organisation. The workflow is in an Apache-2.0 repository; raw workflow exports are not republished in this case bundle.

Open the upstream repository github.comOpen the real commit diff github.comOpen the Apache-2.0 licence github.com

The upstream commit changes the Basic LLM Chain node typeVersion from 1.3 to 1.7. ReleaseGuard recorded that configuration change as CR-001.

Baseline file SHA-256: b30e7bcbcb1b1a3fd4f82c9ddc2afdc68fa296ee5014580504f8126808e55f48
Candidate file SHA-256: e4e3112000b61db5fed114b026b000912b90ff832f163c3e7cc0d839bb1b7bad
Baseline canonical fingerprint: 733b3cbe0f85cb611895365ce3b7b69ecb8ed4165a3be8643fbf7a47598b1919
Candidate canonical fingerprint: 0d10a827199c10311c0b6bc18feb3e7e1fb33baf9d79f3c8b24f0ea0459a20b7

What did ReleaseGuard find?

Automatic signals, preliminary review notes, and missing evidence remain separate.

The Basic LLM Chain configuration changedThe node typeVersion moved from 1.3 → 1.7; the connection and node counts did not change.Automatic change record · review

Structured model-output validation is not visible in the exportDownstream use and the required output contract cannot be established without runtime evidence.Medium · environment evidence needed

A workflow-level failure route is not visible in the exportThe candidate has no errorWorkflow setting or explicit failure-handling node.Low · human sign-off pending

No candidate-bound staging receipt was suppliedNo Ollama call, credential use, external action, or production access was performed.Runtime · NOT-RUN

The downloadable package passed the independent verifierAll 13 files listed in the manifest matched their expected SHA-256 values.Integrity verified · not customer approval

Live tool record

These screens come from the live browser run with the same public files.

ReleaseGuard result for a real public-source workflow change — Live result: one change record, two open findings, and staging evidence NOT-RUN.

ReleaseGuard DRAFT package verification — Live verifier: 13 files passed; the package stayed DRAFT because human validation is incomplete.

Download and verify

The reports are visibly marked DRAFT; the ZIP manifest carries a SHA-256 value for every artifact.

Browser-readable reportSingle file · DRAFT Six-page A4 reportVisual QA complete · DRAFT ReleaseGuard evidence package13 artifacts · SHA-256 manifest Public case manifestSource commits, hashes, and boundaries

Public ZIP SHA-256: 6f0ca201176ca27f1fbb533161c8755d4664f29a31edf42405e9a8e0daca3613
Public PDF SHA-256: d41ce5eca8aa5fb6ecff6dc67dff0d832f7b7932d1b998e4a9fb16f850157e8d

What does this case not establish?

Using a real source does not turn unobserved or unrun evidence into fact.

This is a static baseline/candidate comparison, not a model-behaviour test.
Production credential permissions, n8n instance settings, RBAC, and the published-workflow identity were not observed.
Named independent human sign-off is incomplete for both findings, so the package is not CLIENT-READY.
This case is not a pentest, vulnerability verdict, compliance result, certificate, security guarantee, or n8n endorsement.