**Proposed product fix, pending merge.** This recorded run uses compiler source at commit `b7556e0ed1164186435816fa2ab7fd9c73aee069`. The product PR reference in manifest.json requires private source access. The unmodified compiler baseline is retained in `baseline/` when included. No released-product or production-deployment claim is made.

# Reproduce the invoice workflow proof

This package contains a real compiler export and a real isolated n8n CLI run with
fictional input data. Read `manifest.json` and `run-result.json` for the result;
an engine `success` status must not be confused with a passing business rule.

## Replay the included native workflow

Docker and Python's standard library are enough to replay the included workflow.
No ProcessScout account, product repository or source access is needed:

```sh
docker pull docker.n8n.io/n8nio/n8n:2.39.10
python run-sandbox.py --output replay-result
```

This imports the published `sandbox-harness.json` into a disposable offline n8n
container, captures real output, and checks all five invoice results. It exits 0
only when the engine completes and the expected business-rule outputs match.
It does not rebuild the native artifact from Workflow IR.

## Rebuild with licensed product source access

- An authorized local checkout of the ProcessScout product repository
  (`betterwrk-discover`) at the commit recorded in `manifest.json`.
- That product's Python environment, with its dependencies installed.
- Docker with the n8n 2.39.10 image available.

No product code changes, product API calls, external credentials, live accounts,
or production services are needed. The product checkout is only imported/read;
Python bytecode writes are disabled. Every run creates a disposable container
with `--network none`, no published ports, dropped Linux capabilities, and a
read-only mount of this package. The container's generated local n8n database,
local account identifiers, and encryption configuration disappear on removal.

## Rebuild command

From the downloaded package directory, use your product Python interpreter:

```sh
docker pull docker.n8n.io/n8nio/n8n:2.39.10
python reproduce.py --product-repo path/to/betterwrk-discover --output rerun
```

The source version of the script is named `generate.py`; the downloadable copy is
`reproduce.py`. Both perform the same work. The command exits 0 when the proof
package was captured successfully, even when the recorded workflow acceptance
result is `failed`. Inspect the printed `business_rule_status`, and do not infer
workflow correctness from the generator's process exit code.

The generation steps are: validate the authored IR with `WorkflowIRDocument`,
call the real `N8nWorkflowCompiler.analyze` and `.compile`, aggregate findings
with `build_fidelity_report`, preserve the compiler content, add a separate CLI
harness, and invoke `n8n import:workflow` followed by `n8n execute --rawOutput`.
The harness skips the generated schedule trigger. All generated node parameters
and preexisting connections are unchanged. No compiler result is hand-repaired.

Runtime output is parsed separately from expected fixture results. The CLI can
report success for a workflow that produces the wrong output. Acceptance requires
matching both the invoice ID and queue for every fixture. Timestamp fields,
ephemeral IDs and execution timings vary across runs; native artifact digests are
deterministic for the same fixture and compiler source.

## Inspect

- `source-notes.md` → `decision.md` → `workflow-ir.json` → `n8n-workflow.json`
- `compiler-artifact.json`: compiler metadata and canonical digests
- `fidelity-report.json`: unaltered product fidelity report
- `validation.json`: schema, fidelity, harness, and observed acceptance checks
- `run-result.json`: expected versus actual outputs
- `sandbox-harness.json`: the exact imported CLI test wrapper
- `n8n-execution.json` and `n8n-cli.log`: actual local runtime evidence
- `branch-diagnostic-*`: a separate amount-only IF mapping diagnostic
- `runtime-environment.json`: image ID, digest, commands and limits
- `SHA256SUMS`: file integrity hashes (not a signature or attestation)

Verify downloaded file integrity with:

```sh
shasum -a 256 -c SHA256SUMS
```

Synthetic evidence and authored IR are identified as such. The actual compiler
and local engine execution are real. This package does not claim automated
evidence extraction, human signoff, product deployment, a working scheduled
integration, or a production outcome. No credentials were provided or needed.