# Source Manifest Validator v0.1.1

Credential-free manual n8n template. Checks whether supplied source-review records cover every required claim; it does **not** establish that a claim is true or that a reviewer is authenticated.

Licence: **MIT** — see [LICENSE](n8n-source-manifest-validator-LICENSE.txt) and [licence scope](n8n-source-manifest-validator-NOTICE.md). The MIT grant covers this module’s workflow code and documentation; it does not grant rights to image fixtures or third-party marks. The premium product licence remains separate. Include the licence notice when redistributing the JSON.

Download: `/downloads/n8n-source-manifest-validator.json`; licence: `/downloads/n8n-source-manifest-validator-LICENSE.txt`; scope notice: `/downloads/n8n-source-manifest-validator-NOTICE.md`.

## Import and test

1. Download `workflow.json` (website download: `/downloads/n8n-source-manifest-validator.json`). Import into a **new** n8n workflow; inspect every node before executing. Keep it inactive.
2. Run the fictional demonstration. Expected final JSON: `status: source_manifest_valid`, one source, zero uncovered claims, `factual_accuracy_verified_by_code: false`.
3. Change the demonstration source's `verification_status` to `pending`; run again. The validator must stop with `Source has not been reviewed`.
4. Restore `verified`, rerun, and confirm the valid result. These are instructions, not a claim that your environment has been tested.
5. Replace the demonstration with genuinely reviewed records. In a real pipeline, connect trusted input to the validator instead of the demonstration node. Keep independent editorial approval before publishing.

## Input contract

- Nonempty string `content_id`; `required_claims`: 1–50 unique nonempty strings; `sources`: 1–50 source objects
- Each source: `url`, `title`, `claim`, `source_type: primary`, `verification_status: verified`, `verified_by`, and `checked_at` with explicit timezone
- Strings are trimmed and limited to 2,000 characters. Review timestamps cannot be in the future
- Every required claim must match at least one source entry's claim exactly after trimming. One claim per source entry; repeated source URLs are rejected
- Only clean HTTPS DNS-host URLs and plain ASCII paths. No credentials, query strings, fragments, ports, percent encoding, IP literals or dot segments. Hostnames are lowercased; a single trailing slash does not make a distinct URL

This is intentionally **not a general URL parser**. A public source may have a perfectly legitimate URL that this restricted contract rejects. Review a suitable canonical URL, or deliberately extend and retest the contract; never remove an important URL component merely to bypass the validator. The code does not fetch a URL, check DNS/reachability, verify primary-source classification, read evidence, authenticate people, or prove freshness/relevance. Human review records remain caller-supplied data.

## Safety and recovery

Manual trigger only; inactive export; no credentials, pinned results, external requests, model calls, scheduling or publishing. The validator emits an allowlisted manifest and errors on invalid data. Never enable a continue-on-error route that treats failures as approval. Correct the source record, re-review changed evidence and rerun. Follow your workspace's execution-data retention policy; do not put secrets in input fields.

## Verification evidence

The original v0.1.0 validator passed 21 local tests and valid/pending/restored live n8n tests in PR #54 on 29 September 2026. Version 0.1.1 adds stricter input/date coverage (78 local tests). A fresh isolated import on n8n 2.39.6 passed valid, pending-source rejection and restored-source recovery on 30 September 2026. It remained unpublished/manual-only. Those observations apply to the exact validator hash shown here, not every n8n environment. Local Node execution alone is not an n8n import test. Exact current results and export hashes are in `docs/free-workflow-candidates-2026-09-30.json`.

Run from the repository root: `node --test automation/editorial/source-manifest.test.cjs`.

Reference: [n8n export/import guide](https://docs.n8n.io/build/manage-workflows/export-and-import).

Live-test limitation: the n8n export-download step could not be completed in the test browser. The canonical template and deployed download are byte-checked separately; no post-save runtime-export audit is claimed.

Live-tested validator JavaScript SHA-256: `0a9743c935f93c3755bb652274785167fae9c6c14d81bd4e2fe2043edba8d3bc`. The release export changes the top-level version name only; executable nodes and sample input are unchanged.