---
created: '2026-07-10'
path: Sources/Dev
project: pbs-staging-n8n-full-transfer
tags:
- pbs
- n8n
- automation
- staging
- docker
type: project-plan
---

## Goal

Staging (Linode, `n8n.pbs-staging.herbylab.dev`, 139.144.16.8) is running an **older generation** of the PBS n8n workflows than the sandbox (`n8n.pbs.herbylab.dev`, box `pbswp-test` / 10.0.21.101). The intent was to push all sandbox work to Linode for real testing; that transfer never happened. This run moves the **full current-gen set (21 workflows)** onto staging, rebinds every credential to the staging values, brings the reply pipeline + hold/flush live (plumbing-verified, not live-post), and cleanly parks the stale old-gen so its credentials aren't lost.

Done = current-gen reply pipeline + hold/flush ACTIVE and plumbing-verified on staging; all other current-gen workflows imported inactive; stale old-gen renamed `-bk` and deactivated.

## Locked Decisions

- **Everything transfers** — all 21 sandbox workflows, including the monitoring/observability stack.
- **No wipe.** Stale old-gen is renamed `<name>-bk` and **deactivated** (renaming alone won't stop active triggers/webhook collisions). n8n credential objects are separate and untouched, so no creds are lost.
- **Credentials come from `/opt/backups/pbs-wp/staging.md`.** Imports rebind to the staging credential objects; sandbox cred values never land on staging.
- **Meta webhook path:** set current-gen `insta-webhook-new` to the **same path** the Meta subscription already points at (old `insta-webhooko`) so no FB-console change is needed. If it can't take that path → HALT + document.
- **Activation:** reply pipeline (`Sub-instra-reply-handle-new`, `instra-reel-cache-new`, `insta-webhook-new`, `PostPBSUpdate_new`, `SendPBSChat_New`, gchat) + `PBS: Flush Held Comments` / `PBS: Held Comments TTL Sweep` → ACTIVE. Everything else (monitoring stack, duplicate `PBS: Google Chat Notify`) → INACTIVE.
- **Verification bar = plumbing** (webhook GET handshake, credential resolution, node wiring, mock-payload run through the reply sub-workflow). **No live IG posts** — that's Travis's home-machine job.
- **Hub DB already reconciled** (confirmed this run: staging hub schema diff = 0 missing tables/columns, `held_comments` present). No DB push needed for the hub. Monitoring-stack tables (metrics/auth/security) are NOT in the hub schema and are deferred with the inactive monitoring workflows.

## Open Items

- [ ] Monitoring/observability stack has DB + host deps not present on staging → import inactive, build deps in a later run.
- [ ] Sandbox has a **duplicate** `PBS: Google Chat Notify (Sub-Workflow)` (two IDs) — import the canonical one, park the other.
- [ ] Sub-workflow (`executeWorkflow`) references point at sandbox IDs → must be re-pointed to new staging IDs post-import.
- [ ] Confirm `wordpress-install` `staging-deploy` pins `github_repo_version: staging` (carried from prior run).

## Phases

1. **Export** — pull all 21 current-gen workflows from sandbox n8n (read-only, via `docker exec n8n n8n export:workflow`), stage JSON in `/tmp` scratch on herbys-dev.
2. **Transform** — per workflow: strip/rebind credential references to staging credential objects (values from staging.md); re-point `executeWorkflow` sub-workflow IDs; normalize webhook path for `insta-webhook-new` → old `insta-webhooko` path.
3. **Park stale** — rename staging old-gen (`Sub-Instagram-Reply-Handler`, `Insta-Reel-Cache`, `insta-webhooko`, `PostPBSUpdate`, `SendPBSChat`, `sub-gchat`) to `<name>-bk` and deactivate. Leave junk (My workflow 1/2/3, etc.) as-is unless it collides.
4. **Import** — push current-gen JSON into staging n8n; rebind credentials to staging objects; fix sub-workflow ID refs now that new IDs exist.
5. **Activate + verify** — activate reply pipeline + hold/flush; webhook GET handshake; mock-payload run; credential resolution check. Everything else stays inactive.
6. **Report** — thread checkpoint with final inventory (active/inactive/parked), any halts, and the live-test handoff for Travis.

## Notes

- Sandbox n8n has no public API key stored; access is via SSH to `pbswp-test` + `docker exec n8n n8n ...` CLI. Staging n8n has the API key in staging.md (JWT).
- n8n exports do NOT carry credentials — imported workflows land with dangling credential refs that must be rebound to staging's credential objects by hand/script.
- Rollback is trivial: stale old-gen is renamed, not deleted; re-activating it + deactivating the new gen restores the prior state.
- Related threads: `pbs-staging-n8n-cutover` (1003), `pbs-staging-hub-deploy` (1004), `pbs-hold-and-flush` (1002).
- Run governed by `lovebug-unattended` skill, custom tier. Contract written to the run's Trellis thread.