P0 Critical Workflows Implementation Plan

P0 Critical Workflows - Implementation Plan

Date: December 26, 2025 Status: Ready for Implementation Total P0 Workflows: 15 Estimated Effort: 168 hours (4.2 weeks with 2 engineers)

---

Executive Summary

This plan outlines the implementation strategy for 15 P0 (Critical) workflows required for CODITECT Pilot Launch. These workflows are essential for production readiness and must be completed before public launch.

Implementation Phases:

• Phase 1A: User Authentication (2 workflows, 14 hours) - Week 1
• Phase 1B: Billing Operations (4 workflows, 40 hours) - Week 1-2
• Phase 1C: Workstation Management (5 workflows, 64 hours) - Week 2-3
• Phase 1D: Security & Operations (4 workflows, 50 hours) - Week 3-4

---

Phase 1A: User Authentication (Week 1)

WF-009: Email Verification Flow

Priority: P0 | Effort: 8 hours | Dependencies: WF-001

n8n Workflow: /workflows/n8n/WF-009-email-verification.json Narrative: /workflows/narratives/WF-009-email-verification.md

Nodes (8):

1. Webhook Trigger (GET /verify-email?token=xxx)
2. Validate Token (PostgreSQL SELECT)
3. Check Expiration (< 24 hours)
4. Update User (SET email_verified = TRUE)
5. Generate Access Token (JWT)
6. Send Confirmation Email
7. Publish Event (Pub/Sub: user.verified)
8. Redirect to Dashboard

Success Criteria:

• ✅ Token validation < 500ms
• ✅ Email sent within 60 seconds
• ✅ 99.9% success rate

---

WF-010: Password Reset Flow

Priority: P0 | Effort: 6 hours | Dependencies: None

n8n Workflow: /workflows/n8n/WF-010-password-reset.json Narrative: /workflows/narratives/WF-010-password-reset.md

Nodes (9):

1. Webhook Trigger (POST /reset-password)
2. Validate Email (PostgreSQL SELECT)
3. Generate Reset Token (UUID)
4. Store Token (PostgreSQL INSERT, expires 1 hour)
5. Send Reset Email (with link)
6. Token Validation Endpoint (GET /reset?token=xxx)
7. Update Password (Firebase Auth)
8. Invalidate Token
9. Send Confirmation Email

Success Criteria:

• ✅ Token expires after 1 hour
• ✅ Password strength validation
• ✅ Audit log created

---

Phase 1B: Billing Operations (Week 1-2)

WF-021: Subscription Upgrade

Priority: P0 | Effort: 12 hours | Dependencies: WF-002, WF-006

n8n Workflow: /workflows/n8n/WF-021-subscription-upgrade.json Narrative: /workflows/narratives/WF-021-subscription-upgrade.md

Nodes (11):

1. Webhook Trigger (POST /upgrade-subscription)
2. Get Current Subscription (Stripe API)
3. Calculate Prorated Amount
4. Create Stripe Invoice Item
5. Update Subscription (Stripe)
6. Process Payment
7. Update Database (PostgreSQL)
8. Trigger Workstation Resize (Pub/Sub)
9. Send Upgrade Confirmation Email
10. Log Billing Event
11. Return Success Response

Success Criteria:

• ✅ Proration calculated correctly
• ✅ Immediate tier upgrade
• ✅ Workstation resources increased

---

WF-023: Subscription Cancellation

Priority: P0 | Effort: 10 hours | Dependencies: WF-007

n8n Workflow: /workflows/n8n/WF-023-subscription-cancellation.json Narrative: /workflows/narratives/WF-023-subscription-cancellation.md

Nodes (12):

1. Webhook Trigger (POST /cancel-subscription)
2. Show Retention Offer (discount modal)
3. Capture Cancellation Reason
4. Schedule Cancellation (end of billing period)
5. Update Stripe Subscription (cancel_at_period_end)
6. Update Database Status
7. Send Cancellation Email
8. Create Follow-up Task (check in 30 days)
9. Preserve Data (flag for 90 days)
10. Notify Admin (Slack)
11. Track Churn Metric (Analytics)
12. Return Confirmation

Success Criteria:

• ✅ Access until period end
• ✅ Data retained 90 days
• ✅ Winback email sent

---

WF-024: Payment Method Update

Priority: P0 | Effort: 8 hours | Dependencies: WF-006

n8n Workflow: /workflows/n8n/WF-024-payment-method-update.json Narrative: /workflows/narratives/WF-024-payment-method-update.md

Nodes (9):

1. Webhook Trigger (POST /update-payment-method)
2. Create Stripe SetupIntent
3. Return Client Secret
4. Client Confirms (Stripe Elements)
5. Webhook: setup_intent.succeeded
6. Attach Payment Method to Customer
7. Set as Default
8. Retry Failed Invoices (if any)
9. Send Confirmation Email

Success Criteria:

• ✅ PCI DSS compliant (no card data touches server)
• ✅ Auto-retry past-due invoices
• ✅ $1 auth verification

---

WF-025: Failed Payment Retry & Grace Period

Priority: P0 | Effort: 10 hours | Dependencies: WF-007

n8n Workflow: /workflows/n8n/WF-025-payment-failure-recovery.json Narrative: /workflows/narratives/WF-025-payment-failure-recovery.md

Nodes (14):

1. Webhook Trigger (Stripe: invoice.payment_failed)
2. Increment Retry Count
3. Update Subscription Status (past_due)
4. Wait 3 Days → Retry Payment
5. If Failed → Wait 5 Days → Retry
6. If Failed → Wait 7 Days → Final Retry
7. Send Dunning Emails (3 tiers)
8. If 3 Failures → Suspend Service
9. Update Database (subscription_status = suspended)
10. Send Final Notice Email
11. Schedule Offboarding (30 days)
12. Notify Admin (high-value customers)
13. Track Recovery Metrics
14. Log All Attempts

Success Criteria:

• ✅ 3 retry attempts (Smart Retries)
• ✅ 40% recovery rate
• ✅ Grace period 14 days total

---

Phase 1C: Workstation Management (Week 2-3)

WF-031: Workstation Start (from Stopped)

Priority: P0 | Effort: 10 hours | Dependencies: WF-003

n8n Workflow: /workflows/n8n/WF-031-workstation-start.json Narrative: /workflows/narratives/WF-031-workstation-start.md

Nodes (10):

1. Webhook Trigger (POST /workstation/start)
2. Validate User Has Access
3. Check Subscription Active
4. Get Workstation Config (PostgreSQL)
5. Start Workstation (GCP API)
6. Poll Status (every 5s, max 2 min)
7. Update Database Status (running)
8. Generate Access URL (signed)
9. Send "Workstation Ready" Notification
10. Return Access URL

Success Criteria:

• ✅ Start time < 90 seconds
• ✅ 99.5% success rate
• ✅ Access URL valid 8 hours

---

WF-032: Workstation Stop (Manual)

Priority: P0 | Effort: 8 hours | Dependencies: WF-003

n8n Workflow: /workflows/n8n/WF-032-workstation-stop.json Narrative: /workflows/narratives/WF-032-workstation-stop.md

Nodes (8):

1. Webhook Trigger (POST /workstation/stop)
2. Validate User Has Access
3. Check for Unsaved Work (optional warning)
4. Stop Workstation (GCP API)
5. Poll Status (every 5s, max 1 min)
6. Update Database Status (stopped)
7. Log Stop Event (with reason)
8. Return Success

Success Criteria:

• ✅ Graceful shutdown
• ✅ Data persistence verified
• ✅ Cost savings logged

---

WF-037: Workstation Deletion

Priority: P0 | Effort: 12 hours | Dependencies: WF-032

n8n Workflow: /workflows/n8n/WF-037-workstation-deletion.json Narrative: /workflows/narratives/WF-037-workstation-deletion.md

Nodes (13):

1. Webhook Trigger (DELETE /workstation/{id})
2. Validate Admin Permission
3. Check Workstation Stopped (if not, stop first)
4. Create Final Backup (GCS snapshot)
5. Verify Backup Complete
6. Delete Persistent Disk (GCP API)
7. Delete Workstation Config (GCP API)
8. Update Database (status = deleted)
9. Archive Metadata (keep 90 days)
10. Send Deletion Confirmation Email
11. Publish Event (Pub/Sub: workstation.deleted)
12. Log Deletion (audit trail)
13. Return Success

Success Criteria:

• ✅ Final backup created
• ✅ All resources deleted
• ✅ Metadata archived 90 days

---

WF-038: Workstation Access URL Generation

Priority: P0 | Effort: 8 hours | Dependencies: WF-003

n8n Workflow: /workflows/n8n/WF-038-workstation-access-url.json Narrative: /workflows/narratives/WF-038-workstation-access-url.md

Nodes (7):

1. Webhook Trigger (GET /workstation/{id}/access-url)
2. Validate User Has Access (RBAC)
3. Check Workstation Running
4. Get Workstation Details (PostgreSQL)
5. Generate Signed URL (GCP IAM, TTL 8 hours)
6. Log Access Attempt (audit)
7. Return Access URL

Success Criteria:

• ✅ URL generation < 200ms
• ✅ Signed URLs expire 8 hours
• ✅ Access logged for compliance

---

WF-039: Workstation Idle Detection & Warning

Priority: P0 | Effort: 16 hours | Dependencies: WF-003, WF-032

n8n Workflow: /workflows/n8n/WF-039-idle-detection.json Narrative: /workflows/narratives/WF-039-idle-detection.md

Nodes (12):

1. Scheduled Trigger (every 30 minutes)
2. Query Running Workstations (PostgreSQL)
3. Get CPU/Network Metrics (GCP Monitoring, last 2 hours)
4. Calculate Idle Score (CPU < 5%, Network < 1MB)
5. If Idle > 2 hours → Send Warning Notification
6. Wait 30 Minutes for Response
7. If No Activity → Stop Workstation (WF-032)
8. Send "Workstation Stopped" Email
9. Update Database
10. Log Idle Event
11. Track Cost Savings (Analytics)
12. Return Summary Report

Success Criteria:

• ✅ Detect idle within 30 min
• ✅ 30 min warning before auto-stop
• ✅ 20-30% cost reduction

---

Phase 1D: Security & Operations (Week 3-4)

WF-054: GDPR Data Export (User Request)

Priority: P0 | Effort: 14 hours | Dependencies: WF-007 (existing)

n8n Workflow: /workflows/n8n/WF-054-gdpr-data-export.json Narrative: /workflows/narratives/WF-054-gdpr-data-export.md

Nodes (13):

1. Webhook Trigger (POST /gdpr/export)
2. Validate User Identity (2FA required)
3. Create Export Job (PostgreSQL)
4. Query User Data (users, orgs, workstations)
5. Query Activity Logs (last 12 months)
6. Query Billing History
7. Compile JSON Export
8. Encrypt Export (AES-256)
9. Upload to GCS (user-specific bucket, 30-day TTL)
10. Generate Signed Download URL
11. Send Export Ready Email
12. Log GDPR Request (audit)
13. Return Download Link

Success Criteria:

• ✅ Export within 48 hours (GDPR compliance)
• ✅ Encrypted at rest and in transit
• ✅ Auto-delete after 30 days

---

WF-055: Security Incident Detection & Alert

Priority: P0 | Effort: 18 hours | Dependencies: None

n8n Workflow: /workflows/n8n/WF-055-security-incident-detection.json Narrative: /workflows/narratives/WF-055-security-incident-detection.md

Nodes (15):

1. Pub/Sub Trigger (Topic: security-events)
2. Parse Event Type (login anomaly, API abuse, etc.)
3. Check Severity (Low, Medium, High, Critical)
4. If Critical → Lock Account Immediately
5. If High → Challenge with 2FA
6. Query Recent Activity (last 24 hours)
7. Calculate Threat Score (ML model)
8. Create Incident Record (PostgreSQL)
9. Send Alert Email to User
10. Send Alert to Security Team (Slack/PagerDuty)
11. Log Security Event (immutable audit log)
12. If Automated Response → Execute (block IP, etc.)
13. Track Incident Metrics
14. Update Security Dashboard
15. Return Incident ID

Success Criteria:

• ✅ Detection within 1 minute
• ✅ Alert sent < 5 seconds
• ✅ Auto-remediation for known threats

---

WF-066: Incident Response & Communication

Priority: P0 | Effort: 10 hours | Dependencies: WF-055

n8n Workflow: /workflows/n8n/WF-066-incident-response.json Narrative: /workflows/narratives/WF-066-incident-response.md

Nodes (11):

1. Webhook Trigger (POST /incident/{id}/update)
2. Validate Admin Access
3. Update Incident Status (PostgreSQL)
4. Assess Impact (affected users, workstations)
5. Create Status Page Update
6. Send Email to Affected Users
7. Post to Status Page (status.coditect.ai)
8. Send Internal Alert (Slack #incidents)
9. Track Resolution Time (SLA)
10. When Resolved → Post-mortem Created
11. Return Updated Status

Success Criteria:

• ✅ First response < 15 minutes
• ✅ Status page updated < 5 min
• ✅ Post-mortem within 48 hours

---

WF-072: Database Backup & Point-in-Time Recovery

Priority: P0 | Effort: 8 hours | Dependencies: None

n8n Workflow: /workflows/n8n/WF-072-database-backup.json Narrative: /workflows/narratives/WF-072-database-backup.md

Nodes (10):

1. Scheduled Trigger (daily 2am UTC)
2. Create PostgreSQL Snapshot (GCP Cloud SQL)
3. Verify Snapshot Success
4. Tag Snapshot (date, retention policy)
5. Test Restore (random snapshot weekly)
6. Delete Old Snapshots (> 30 days)
7. Upload Backup Logs to GCS
8. Send Backup Report Email (to ops team)
9. Update Backup Dashboard (Grafana)
10. Return Backup Summary

Success Criteria:

• ✅ Daily backups at 2am UTC
• ✅ 30-day retention
• ✅ Weekly restore test
• ✅ RPO < 24 hours, RTO < 4 hours

---

Implementation Schedule

Week 1: Authentication & Billing Foundations

Target: WF-009, WF-010, WF-021

• Day 1-2: Email Verification (WF-009)
• Day 3: Password Reset (WF-010)
• Day 4-5: Subscription Upgrade (WF-021)

Deliverables: 3 n8n JSONs, 3 narratives, testing complete

---

Week 2: Billing Operations & Workstation Start

Target: WF-023, WF-024, WF-025, WF-031, WF-032

• Day 1-2: Subscription Cancellation (WF-023)
• Day 2-3: Payment Method Update (WF-024)
• Day 3-4: Payment Retry (WF-025)
• Day 5: Workstation Start (WF-031)
• Day 5: Workstation Stop (WF-032)

Deliverables: 5 n8n JSONs, 5 narratives, integration testing

---

Week 3: Workstation Management & Security

Target: WF-037, WF-038, WF-039, WF-054

• Day 1-2: Workstation Deletion (WF-037)
• Day 2: Access URL Generation (WF-038)
• Day 3-4: Idle Detection (WF-039)
• Day 5: GDPR Export (WF-054)

Deliverables: 4 n8n JSONs, 4 narratives, security audit

---

Week 4: Security & Operations

Target: WF-055, WF-066, WF-072

• Day 1-3: Security Incident Detection (WF-055)
• Day 3-4: Incident Response (WF-066)
• Day 5: Database Backup (WF-072)

Deliverables: 3 n8n JSONs, 3 narratives, disaster recovery test

---

Success Metrics

Metric	Target	Measurement
Implementation Completion	100% of P0 workflows	15/15 workflows live
Code Coverage	80%+	Unit + integration tests
Performance	P95 latency < 3s	New Relic monitoring
Reliability	99.9% success rate	Error rate < 0.1%
Security	Zero breaches	Security audit pass

---

Resource Requirements

Resource	Quantity	Role
Backend Engineers	2	n8n workflow development, API integration
QA Engineers	1	Test automation, integration testing
DevOps Engineer	0.5	n8n deployment, monitoring setup
Product Manager	0.5	Requirements, acceptance criteria

Total Effort: 168 hours Timeline: 4 weeks Cost: ~$25,000 (fully loaded cost)

---

Risk Mitigation

Risk	Impact	Mitigation
Stripe API changes	High	Version pinning, webhook testing
GCP quota limits	Medium	Request increase proactively
Database migration issues	High	Blue-green deployment, rollback plan
Security vulnerabilities	Critical	Penetration testing, code review
Performance degradation	Medium	Load testing, auto-scaling

---

Next Steps

1. ✅ Review & Approve this implementation plan
2. ⏸️ Assign workflows to engineering team
3. ⏸️ Setup n8n production environment
4. ⏸️ Configure Stripe webhook endpoints
5. ⏸️ Begin Week 1 implementation (WF-009, WF-010, WF-021)

---

Plan Status: ✅ Ready for Implementation Approval Required: Product, Engineering, Security Start Date: TBD Target Completion: 4 weeks from start