Eingehende Bewerber-Triage mit n8n

# Inbound applicant triage — n8n flow

This flow listens for Ashby `application.created` webhooks, scores each application against a per-role rubric using Claude (Sonnet 4.6 by default), and routes the result to one of three Slack channels: `#fast-track`, `#review-needed`, `#surfaced-not-rejected`. It never auto-rejects. The recruiter is the sole rejection authority.

This README covers import, credentials, the rubric file format, the fairness pre-flight, and the dry-run procedure.

## Import

1. Open n8n → Workflows → Import from file → pick `inbound-applicant-triage-n8n.json`.
2. Set workflow timezone (top of the canvas) to your team's working timezone for sane audit-log timestamps. The default is UTC.
3. Do not enable the workflow yet. Configure credentials and rubrics first; complete the dry-run; only then flip to enabled.

## Credentials (three required)

### `PLACEHOLDER_ASHBY_CRED_ID` — Ashby API key

- Ashby admin → Settings → API → Generate new API key. Pick *read* scope only; the flow does not write back to Ashby.
- In n8n, create an HTTP Basic Auth credential. Username = the API key. Password = empty.
- Bind the credential to the `Fetch Candidate (Ashby)` node.

### `PLACEHOLDER_ANTHROPIC_CRED_ID` — Anthropic API key

- console.anthropic.com → API Keys → Create Key. Restrict by IP if your n8n is behind a fixed egress.
- In n8n, create a credential of type "Anthropic API". Paste the key.
- Bind to the `Claude Score` node. The model is set to `claude-sonnet-4-6` in the request body — change it there if you want to test other models.

### `PLACEHOLDER_SLACK_CRED_ID` — Slack bot token

- Create (or reuse) a Slack app with the `chat:write` scope. Install to the workspace. Invite the bot into `#fast-track`, `#review-needed`, `#surfaced-not-rejected`.
- In n8n, create a Slack credential with the bot token (`xoxb-…`).
- Bind to all three Slack nodes.

### Webhook signing secret

The `Verify Signature` node reads `ASHBY_WEBHOOK_SECRET` from the n8n environment. Set it in your n8n container env (or in n8n Cloud's variables panel). Get the value from Ashby admin → Settings → Webhooks → the secret shown when you create the webhook destination. **Do not skip this.** The webhook URL is internet-reachable; without signature verification anyone can post fake applications to your Slack and your audit log.

## Rubric file format

The flow expects one rubric file per role, at `${RUBRIC_DIR}/<role-slug>.json` (default `RUBRIC_DIR=/data/rubrics`). The `role_slug` comes from Ashby's job-slug field. If a rubric is missing, the flow halts with `missing_rubric` and the application stays in the ATS for manual triage.

A working rubric looks like this. Copy it, replace every value, and save as `<role-slug>.json`:

```json
{
  "role": "Senior Backend Engineer (Distributed Systems)",
  "level": "Senior IC (L5)",
  "version": "2026-05-01",
  "dimensions": {
    "skill_match": {
      "must_have": [
        "Production Go or Rust experience (3y+)",
        "Owned a distributed-system migration from monolith"
      ],
      "anchors": {
        "5": "Led a multi-team migration with measurable latency / cost outcomes named in the resume",
        "4": "Owned a service rewrite with measurable outcomes named",
        "3": "Contributed to a distributed-system codebase, no clear ownership signal",
        "2": "Distributed-system exposure but no production ownership",
        "1": "No evidence in the resume of distributed-system work"
      }
    },
    "level_fit": {
      "must_have": [
        "Senior IC scope: cross-team influence, mentors juniors, owns a service end-to-end"
      ],
      "anchors": {
        "5": "Staff or Senior Staff title at a peer-tier company; cross-org scope named",
        "4": "Senior IC at a peer company with explicit ownership scope",
        "3": "Senior title but scope ambiguous; or strong mid-level signal",
        "2": "Mid-level scope only",
        "1": "Junior or new-grad scope"
      }
    },
    "location_fit": {
      "must_have": ["US Pacific or Mountain time zone", "Authorized to work in the US without sponsorship"],
      "anchors": {
        "5": "Same metro as the office",
        "4": "Same time zone, remote",
        "3": "±2 hours, remote",
        "2": "Outside ±2 hours but within US, remote",
        "1": "Time-zone offset >5 hours, or no work auth"
      }
    },
    "response_likelihood": {
      "must_have": [],
      "anchors": {
        "5": "Cover letter cites the company / role specifically; resume updated <30 days ago",
        "4": "Generic cover letter but resume updated <60 days ago",
        "3": "No cover letter; resume updated <90 days ago",
        "2": "Resume updated 90-180 days ago",
        "1": "Resume staler than 180 days, or referral via an exec contact (different workflow)"
      }
    }
  }
}
```

The rubric is hashed (SHA-256, first 16 hex chars) per scoring run and the hash goes into the audit log. If you edit the rubric, the next score for the same application would have a different hash — the diff is visible in the audit log, not invisible.

## Fairness pre-flight (do not edit to make biased rubrics pass)

The `Load Rubric + Pre-Flight` node scans the rubric for these patterns and halts the flow if any match:

- `school[_-]?tier`
- `name[_-]?based`
- `employment[_-]?gap`
- `photo`
- `age`
- `pregnan(t|cy)`
- `culture[_-]?fit` (when standalone — without behavioral anchors it functions as a class proxy)

If you see a `rubric_failed_fairness_preflight` halt, do not edit the regex list. Edit the rubric: rewrite the dimension to score on observable behavior, not the proxy. School-prestige scoring in particular is the most common bias-amplification path in AI screening; rewriting it to score on technical depth and ownership signal closes the gap without losing fit-prediction power.

If your team needs to score on a dimension this list flags, that is exactly the kind of decision a NYC LL 144 bias audit (or EU AI Act conformity assessment for EU-resident candidates) is meant to surface. Get the audit done; do not edit the pre-flight away.

## Routing thresholds

Default in `Parse + Route`:

- `aggregate >= 16` → `#fast-track`
- `aggregate 12-15` → `#review-needed`
- `aggregate < 12` → `#surfaced-not-rejected`

Aggregate range is 4-20 (four dimensions, 1-5 each). The 12-15 band is the "discretion buffer" — applications close to either threshold go to recruiter review, not to either tail. Tune after a week of data.

EU-resident applicants with `aggregate >= 16` are forced to `#review-needed` rather than `#fast-track`, so the recruiter can confirm the AI-screening notice was served before any automated decision is recorded against the candidate.

## Dry-run procedure

1. Pick a role you sourced manually in the past 4-8 weeks. Export the application list from Ashby.
2. Replay each application by triggering the webhook manually (n8n → "Execute workflow" with a sample webhook payload — Ashby's webhook test panel can resend recent events).
3. Compare the flow's `#fast-track` bucket to your actual screen-pass list. The screen-pass set should be a subset of `#fast-track` ∪ `#review-needed`.
4. If your manual screen-passes are landing in `#surfaced-not-rejected`, the rubric anchors are too strict. Tune the anchors before raising the threshold; raising the threshold without re-anchoring just shifts the calibration error.
5. If `#fast-track` includes obvious mis-fits, the rubric is too loose on a dimension. Look at the per-dimension scores in the audit log and find the dimension with consistent over-scoring.

Only switch the workflow `active: true` after the dry-run looks right.

## First-run sanity check

After enabling, watch the next three real applications in the Slack channels:

1. Confirm the per-dimension evidence quotes the resume verbatim. If it doesn't (paraphrased or invented), the model is hallucinating; check that `Claude Score` is on Sonnet 4.6 and not a smaller model.
2. Confirm the `rubric_sha` matches the hash you'd compute locally. Mismatch means the wrong file is loading.
3. Confirm the audit log line shows up at `${AUDIT_DIR}/<YYYY-MM>.jsonl`. No file = the audit append is silently failing and you're operating without the audit trail that NYC LL 144 / EU AI Act requires.

## Known limits

- The flow scores against the resume + Ashby form data only. It does not parse PDFs that were not parsed by Ashby's intake (some legacy PDFs come through with empty `parsedText`). For those, `resume_text` is empty and `skill_match` will land at 1.
- The webhook handler does not implement an explicit dedupe table; n8n's own execution history is the dedupe surface. If your n8n is restarted mid-execution and Ashby re-fires the webhook, you may see a duplicate scoring run. Add a Redis-backed dedupe in front of `Verify Signature` if this matters for your audit posture.
- The flow assumes one application per webhook event. Bulk-imported applications fire one webhook each; if Ashby ever batches, the `Verify Signature` node would need to fan out.

{
  "name": "Inbound applicant triage",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "ashby-application-created",
        "responseMode": "lastNode",
        "options": {
          "rawBody": true
        }
      },
      "id": "2a2a2a2a-0001-0000-0000-000000000001",
      "name": "Ashby Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [240, 400],
      "webhookId": "ashby-application-created",
      "notesInFlow": true,
      "notes": "Receives Ashby application.created webhooks. The `rawBody: true` option preserves the byte-exact body that the next node hashes for signature verification — Express-style body parsing alters whitespace and breaks HMAC."
    },
    {
      "parameters": {
        "jsCode": "// Verify Ashby's HMAC-SHA256 webhook signature.\n// Ashby sends `Ashby-Signature` header containing the hex digest of\n// HMAC-SHA256(secret, raw_body). Mismatch → halt with audit log entry.\nconst crypto = require('crypto');\n\nconst secret = $env.ASHBY_WEBHOOK_SECRET;\nif (!secret) {\n  throw new Error('ASHBY_WEBHOOK_SECRET not set; refusing to process unverified webhook.');\n}\n\nconst headers = $json.headers || {};\nconst providedSig = headers['ashby-signature'] || headers['Ashby-Signature'];\nconst rawBody = $json.body || '';\n\nif (!providedSig) {\n  return [{ json: { status: 'rejected_no_signature', headers_seen: Object.keys(headers) } }];\n}\n\nconst expected = crypto.createHmac('sha256', secret).update(rawBody, 'utf8').digest('hex');\n\n// Constant-time compare to avoid timing-attack leakage on signature.\nconst providedBuf = Buffer.from(providedSig, 'hex');\nconst expectedBuf = Buffer.from(expected, 'hex');\nconst sigOk = providedBuf.length === expectedBuf.length && crypto.timingSafeEqual(providedBuf, expectedBuf);\n\nif (!sigOk) {\n  return [{ json: { status: 'rejected_bad_signature' } }];\n}\n\n// Parse the verified body into the event payload.\nlet payload;\ntry {\n  payload = JSON.parse(rawBody);\n} catch (e) {\n  return [{ json: { status: 'rejected_unparseable_body', error: e.message } }];\n}\n\nreturn [{\n  json: {\n    status: 'verified',\n    application_id: payload.data?.application?.id,\n    candidate_id: payload.data?.candidate?.id,\n    job_id: payload.data?.job?.id,\n    role_slug: payload.data?.job?.slug,\n    received_at: new Date().toISOString(),\n  }\n}];"
      },
      "id": "2a2a2a2a-0001-0000-0000-000000000002",
      "name": "Verify Signature",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [460, 400],
      "notesInFlow": true,
      "notes": "Validates the Ashby HMAC signature on the raw body and parses the payload. Halts with a structured rejection record on signature mismatch — these are surfaced to the audit log and never proceed to scoring."
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "conditions": [
            {
              "leftValue": "={{ $json.status }}",
              "rightValue": "verified",
              "operator": {
                "type": "string",
                "operation": "equals"
              }
            }
          ],
          "combinator": "and"
        },
        "options": {}
      },
      "id": "2a2a2a2a-0001-0000-0000-000000000003",
      "name": "Verified?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [680, 400]
    },
    {
      "parameters": {
        "method": "POST",
        "url": "https://api.ashbyhq.com/candidate.info",
        "authentication": "predefinedCredentialType",
        "nodeCredentialType": "httpBasicAuth",
        "sendHeaders": true,
        "headerParameters": {
          "parameters": [
            { "name": "Accept", "value": "application/json" },
            { "name": "Content-Type", "value": "application/json" }
          ]
        },
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={\n  \"id\": \"{{ $json.candidate_id }}\",\n  \"includeApplicationFormSubmissions\": true\n}",
        "options": {
          "response": {
            "response": {
              "neverError": false,
              "responseFormat": "json"
            }
          }
        }
      },
      "id": "2a2a2a2a-0001-0000-0000-000000000004",
      "name": "Fetch Candidate (Ashby)",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [900, 320],
      "credentials": {
        "httpBasicAuth": {
          "id": "PLACEHOLDER_ASHBY_CRED_ID",
          "name": "Ashby API key (read scope)"
        }
      },
      "notesInFlow": true,
      "notes": "Ashby is POST-only, even for reads. The basic-auth credential uses the API key as the username with an empty password — see _README.md."
    },
    {
      "parameters": {
        "jsCode": "// Load the role rubric from disk and run the fairness pre-flight against it.\n// Halts if no rubric exists for the role, or if the rubric contains protected-class proxies.\nconst fs = require('fs');\nconst path = require('path');\nconst crypto = require('crypto');\n\nconst RUBRIC_DIR = $env.RUBRIC_DIR || '/data/rubrics';\nconst FORBIDDEN_PATTERNS = [\n  /school[\\s_-]?tier/i,\n  /name[\\s_-]?based/i,\n  /employment[\\s_-]?gap/i,\n  /photo/i,\n  /age/i,\n  /pregnan(t|cy)/i,\n  /culture[\\s_-]?fit/i, // requires behavioral anchors — flagged as a class proxy when standalone\n];\n\nconst input = $input.first().json;\nconst webhookCtx = $('Verify Signature').item.json;\nconst roleSlug = webhookCtx.role_slug;\n\nif (!roleSlug) {\n  return [{ json: { status: 'halted', reason: 'missing_role_slug' } }];\n}\n\nconst rubricPath = path.join(RUBRIC_DIR, `${roleSlug}.json`);\nif (!fs.existsSync(rubricPath)) {\n  return [{ json: { status: 'halted', reason: 'missing_rubric', role_slug: roleSlug, expected_path: rubricPath } }];\n}\n\nconst rubricRaw = fs.readFileSync(rubricPath, 'utf8');\nconst rubric = JSON.parse(rubricRaw);\nconst rubricSha = crypto.createHash('sha256').update(rubricRaw).digest('hex').slice(0, 16);\n\n// Fairness pre-flight: scan rubric for forbidden patterns.\nconst rubricFlat = JSON.stringify(rubric);\nconst violations = [];\nfor (const pat of FORBIDDEN_PATTERNS) {\n  const m = rubricFlat.match(pat);\n  if (m) violations.push(m[0]);\n}\nif (violations.length > 0) {\n  return [{ json: { status: 'halted', reason: 'rubric_failed_fairness_preflight', violations, rubric_sha: rubricSha } }];\n}\n\n// Deterministic pre-filter: check work auth + recently-rejected.\nconst candidate = input.results?.candidate || {};\nconst application = input.results?.applications?.[0] || {};\nconst formData = input.results?.applicationFormSubmissions?.[0]?.formData || {};\n\nconst workAuth = formData.work_authorization || formData.workAuthorization || 'unknown';\nconst location = candidate.location?.locationSummary || 'unknown';\nconst applicationStatus = application.status || 'unknown';\n\n// Simple hard filters; tune in real deployments.\nif (applicationStatus === 'archived') {\n  return [{ json: { status: 'halted', reason: 'application_already_archived' } }];\n}\n\nreturn [{\n  json: {\n    status: 'ready_for_scoring',\n    application_id: webhookCtx.application_id,\n    candidate_id: webhookCtx.candidate_id,\n    role_slug: roleSlug,\n    rubric,\n    rubric_sha: rubricSha,\n    candidate_name_first: candidate.firstName || 'Candidate',\n    location,\n    work_auth: workAuth,\n    resume_text: candidate.resumeFileHandle?.parsedText || application.resumeFileHandle?.parsedText || '',\n    form_data: formData,\n    is_eu_candidate: /^(AT|BE|BG|HR|CY|CZ|DK|EE|FI|FR|DE|GR|HU|IE|IT|LV|LT|LU|MT|NL|PL|PT|RO|SK|SI|ES|SE)\\b/i.test(location),\n  }\n}];"
      },
      "id": "2a2a2a2a-0001-0000-0000-000000000005",
      "name": "Load Rubric + Pre-Flight",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [1120, 320],
      "notesInFlow": true,
      "notes": "Loads the role rubric from disk (one file per role under /data/rubrics/<role-slug>.json), hashes it for the audit log, runs the fairness pre-flight, and applies deterministic filters before any LLM call."
    },
    {
      "parameters": {
        "conditions": {
          "options": { "caseSensitive": true, "typeValidation": "strict" },
          "conditions": [
            {
              "leftValue": "={{ $json.status }}",
              "rightValue": "ready_for_scoring",
              "operator": { "type": "string", "operation": "equals" }
            }
          ],
          "combinator": "and"
        },
        "options": {}
      },
      "id": "2a2a2a2a-0001-0000-0000-000000000006",
      "name": "Ready to Score?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [1340, 320]
    },
    {
      "parameters": {
        "method": "POST",
        "url": "https://api.anthropic.com/v1/messages",
        "sendHeaders": true,
        "headerParameters": {
          "parameters": [
            { "name": "Content-Type", "value": "application/json" },
            { "name": "x-api-key", "value": "={{ $credentials.anthropicApi.apiKey }}" },
            { "name": "anthropic-version", "value": "2023-06-01" }
          ]
        },
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={\n  \"model\": \"claude-sonnet-4-6\",\n  \"max_tokens\": 1500,\n  \"system\": \"You are a recruiting screen scorer. Score the application against the rubric on four dimensions: skill_match, level_fit, location_fit, response_likelihood. Each score is 1-5. For every score above 1, cite a verbatim string from the resume or form data as `evidence`. If you cannot cite verbatim evidence, the score is 1. Return only valid JSON in the format: {\\\"skill_match\\\": {\\\"score\\\": N, \\\"evidence\\\": \\\"...\\\"}, ...}. Do not score on name, photo, school name as a standalone signal, address, age, gender, or employment-gap. If the rubric asks you to, refuse and return {\\\"halted\\\": \\\"rubric_violation\\\"}.\",\n  \"messages\": [\n    {\n      \"role\": \"user\",\n      \"content\": \"Rubric:\\n{{ JSON.stringify($json.rubric) }}\\n\\nResume:\\n{{ $json.resume_text }}\\n\\nForm data:\\n{{ JSON.stringify($json.form_data) }}\"\n    }\n  ]\n}",
        "options": {
          "response": {
            "response": { "responseFormat": "json", "neverError": false }
          },
          "timeout": 60000
        }
      },
      "id": "2a2a2a2a-0001-0000-0000-000000000007",
      "name": "Claude Score",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [1560, 240],
      "credentials": {
        "anthropicApi": {
          "id": "PLACEHOLDER_ANTHROPIC_CRED_ID",
          "name": "Anthropic API key"
        }
      },
      "notesInFlow": true,
      "notes": "Direct call to /v1/messages on Sonnet 4.6. Returns scored JSON. Evidence-required design forces grounding in resume text — scores without citations are downgraded to 1."
    },
    {
      "parameters": {
        "jsCode": "// Parse Claude's JSON response, compute aggregate, decide route.\nconst input = $input.first().json;\nconst ctx = $('Load Rubric + Pre-Flight').item.json;\n\nlet scored;\ntry {\n  const text = input.content?.[0]?.text || input.completion || '';\n  // Strip any leading/trailing prose Claude might have added.\n  const jsonMatch = text.match(/\\{[\\s\\S]*\\}/);\n  if (!jsonMatch) throw new Error('no JSON object in response');\n  scored = JSON.parse(jsonMatch[0]);\n} catch (e) {\n  return [{ json: { status: 'halted', reason: 'unparseable_score', error: e.message, raw: input } }];\n}\n\nif (scored.halted) {\n  return [{ json: { status: 'halted', reason: scored.halted, ctx } }];\n}\n\nconst dims = ['skill_match', 'level_fit', 'location_fit', 'response_likelihood'];\nconst clean = {};\nlet aggregate = 0;\nfor (const d of dims) {\n  const score = Number(scored[d]?.score) || 1;\n  const evidence = scored[d]?.evidence || '';\n  // Evidence requirement: empty evidence → score 1 regardless of model output.\n  const finalScore = (score > 1 && evidence.trim().length > 0) ? Math.min(5, Math.max(1, score)) : 1;\n  clean[d] = { score: finalScore, evidence: evidence.slice(0, 200) };\n  aggregate += finalScore;\n}\n\nlet route;\nif (aggregate >= 16) route = 'fast-track';\nelse if (aggregate >= 12) route = 'review-needed';\nelse route = 'surfaced-not-rejected';\n\n// EU-candidate override: AI-screening notice must be confirmed before fast-track.\nif (ctx.is_eu_candidate && route === 'fast-track') {\n  route = 'review-needed';\n}\n\nreturn [{\n  json: {\n    status: 'scored',\n    application_id: ctx.application_id,\n    candidate_id: ctx.candidate_id,\n    candidate_name_first: ctx.candidate_name_first,\n    role_slug: ctx.role_slug,\n    rubric_sha: ctx.rubric_sha,\n    is_eu_candidate: ctx.is_eu_candidate,\n    scores: clean,\n    aggregate,\n    route,\n    scored_at: new Date().toISOString(),\n  }\n}];"
      },
      "id": "2a2a2a2a-0001-0000-0000-000000000008",
      "name": "Parse + Route",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [1780, 240],
      "notesInFlow": true,
      "notes": "Parses Claude's JSON, enforces the evidence-required guarantee (empty evidence → score 1), computes aggregate, picks the Slack channel by band. EU-resident applicants are forced to #review-needed even on fast-track scores until the AI-screening notice is confirmed."
    },
    {
      "parameters": {
        "rules": {
          "values": [
            {
              "conditions": {
                "options": { "caseSensitive": true, "typeValidation": "strict" },
                "conditions": [
                  {
                    "leftValue": "={{ $json.route }}",
                    "rightValue": "fast-track",
                    "operator": { "type": "string", "operation": "equals" }
                  }
                ],
                "combinator": "and"
              },
              "outputKey": "fast-track"
            },
            {
              "conditions": {
                "options": { "caseSensitive": true, "typeValidation": "strict" },
                "conditions": [
                  {
                    "leftValue": "={{ $json.route }}",
                    "rightValue": "review-needed",
                    "operator": { "type": "string", "operation": "equals" }
                  }
                ],
                "combinator": "and"
              },
              "outputKey": "review-needed"
            },
            {
              "conditions": {
                "options": { "caseSensitive": true, "typeValidation": "strict" },
                "conditions": [
                  {
                    "leftValue": "={{ $json.route }}",
                    "rightValue": "surfaced-not-rejected",
                    "operator": { "type": "string", "operation": "equals" }
                  }
                ],
                "combinator": "and"
              },
              "outputKey": "surfaced"
            }
          ]
        },
        "options": { "fallbackOutput": "extra" }
      },
      "id": "2a2a2a2a-0001-0000-0000-000000000009",
      "name": "Route by Aggregate",
      "type": "n8n-nodes-base.switch",
      "typeVersion": 3,
      "position": [2000, 240]
    },
    {
      "parameters": {
        "method": "POST",
        "url": "https://slack.com/api/chat.postMessage",
        "authentication": "predefinedCredentialType",
        "nodeCredentialType": "slackApi",
        "sendHeaders": true,
        "headerParameters": {
          "parameters": [{ "name": "Content-Type", "value": "application/json; charset=utf-8" }]
        },
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={\n  \"channel\": \"#fast-track\",\n  \"text\": \"Fast-track: {{ $json.candidate_name_first }} — {{ $json.role_slug }} (agg {{ $json.aggregate }}/20)\",\n  \"blocks\": [\n    { \"type\": \"section\", \"text\": { \"type\": \"mrkdwn\", \"text\": \"*Fast-track* — `{{ $json.role_slug }}` — aggregate *{{ $json.aggregate }}/20*\\n*Candidate:* {{ $json.candidate_name_first }}\\n*Skill {{ $json.scores.skill_match.score }}/5:* {{ $json.scores.skill_match.evidence }}\\n*Level {{ $json.scores.level_fit.score }}/5:* {{ $json.scores.level_fit.evidence }}\\n*Location {{ $json.scores.location_fit.score }}/5:* {{ $json.scores.location_fit.evidence }}\\n*Response {{ $json.scores.response_likelihood.score }}/5:* {{ $json.scores.response_likelihood.evidence }}\\n<https://app.ashbyhq.com/candidates/{{ $json.candidate_id }}|Open in Ashby> · rubric `{{ $json.rubric_sha }}`\" } }\n  ]\n}",
        "options": {}
      },
      "id": "2a2a2a2a-0001-0000-0000-00000000000a",
      "name": "Slack Fast-Track",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [2220, 120],
      "credentials": {
        "slackApi": {
          "id": "PLACEHOLDER_SLACK_CRED_ID",
          "name": "Slack bot token (chat:write)"
        }
      }
    },
    {
      "parameters": {
        "method": "POST",
        "url": "https://slack.com/api/chat.postMessage",
        "authentication": "predefinedCredentialType",
        "nodeCredentialType": "slackApi",
        "sendHeaders": true,
        "headerParameters": {
          "parameters": [{ "name": "Content-Type", "value": "application/json; charset=utf-8" }]
        },
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={\n  \"channel\": \"#review-needed\",\n  \"text\": \"Review: {{ $json.candidate_name_first }} — {{ $json.role_slug }} (agg {{ $json.aggregate }}/20{{ $json.is_eu_candidate ? ' · EU candidate — confirm AI-screening notice' : '' }})\",\n  \"blocks\": [\n    { \"type\": \"section\", \"text\": { \"type\": \"mrkdwn\", \"text\": \"*Review needed* — `{{ $json.role_slug }}` — aggregate *{{ $json.aggregate }}/20*{{ $json.is_eu_candidate ? '\\n:eu: *EU candidate — confirm AI-screening notice was served before any decision*' : '' }}\\n*Candidate:* {{ $json.candidate_name_first }}\\n*Skill {{ $json.scores.skill_match.score }}/5:* {{ $json.scores.skill_match.evidence }}\\n*Level {{ $json.scores.level_fit.score }}/5:* {{ $json.scores.level_fit.evidence }}\\n*Location {{ $json.scores.location_fit.score }}/5:* {{ $json.scores.location_fit.evidence }}\\n*Response {{ $json.scores.response_likelihood.score }}/5:* {{ $json.scores.response_likelihood.evidence }}\\n<https://app.ashbyhq.com/candidates/{{ $json.candidate_id }}|Open in Ashby> · rubric `{{ $json.rubric_sha }}`\" } }\n  ]\n}",
        "options": {}
      },
      "id": "2a2a2a2a-0001-0000-0000-00000000000b",
      "name": "Slack Review",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [2220, 240],
      "credentials": {
        "slackApi": {
          "id": "PLACEHOLDER_SLACK_CRED_ID",
          "name": "Slack bot token (chat:write)"
        }
      }
    },
    {
      "parameters": {
        "method": "POST",
        "url": "https://slack.com/api/chat.postMessage",
        "authentication": "predefinedCredentialType",
        "nodeCredentialType": "slackApi",
        "sendHeaders": true,
        "headerParameters": {
          "parameters": [{ "name": "Content-Type", "value": "application/json; charset=utf-8" }]
        },
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={\n  \"channel\": \"#surfaced-not-rejected\",\n  \"text\": \"Surfaced (not rejected): {{ $json.candidate_name_first }} — {{ $json.role_slug }} (agg {{ $json.aggregate }}/20)\",\n  \"blocks\": [\n    { \"type\": \"section\", \"text\": { \"type\": \"mrkdwn\", \"text\": \"*Below threshold — surfaced for review, not auto-rejected* — `{{ $json.role_slug }}` — aggregate *{{ $json.aggregate }}/20*\\n*Candidate:* {{ $json.candidate_name_first }}\\nReason for low score is in the per-dimension evidence below. Recruiter is the sole rejection authority.\\n*Skill {{ $json.scores.skill_match.score }}/5:* {{ $json.scores.skill_match.evidence }}\\n*Level {{ $json.scores.level_fit.score }}/5:* {{ $json.scores.level_fit.evidence }}\\n*Location {{ $json.scores.location_fit.score }}/5:* {{ $json.scores.location_fit.evidence }}\\n*Response {{ $json.scores.response_likelihood.score }}/5:* {{ $json.scores.response_likelihood.evidence }}\\n<https://app.ashbyhq.com/candidates/{{ $json.candidate_id }}|Open in Ashby> · rubric `{{ $json.rubric_sha }}`\" } },\n    { \"type\": \"actions\", \"elements\": [ { \"type\": \"button\", \"text\": { \"type\": \"plain_text\", \"text\": \"Promote to #review-needed\" }, \"url\": \"https://app.ashbyhq.com/candidates/{{ $json.candidate_id }}\" } ] }\n  ]\n}",
        "options": {}
      },
      "id": "2a2a2a2a-0001-0000-0000-00000000000c",
      "name": "Slack Surfaced",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [2220, 360],
      "credentials": {
        "slackApi": {
          "id": "PLACEHOLDER_SLACK_CRED_ID",
          "name": "Slack bot token (chat:write)"
        }
      }
    },
    {
      "parameters": {
        "jsCode": "// Append one JSONL audit-log line per scored application.\n// No PII (no candidate name, no resume content). Just the route + scores + rubric hash.\nconst fs = require('fs');\nconst path = require('path');\n\nconst AUDIT_DIR = $env.AUDIT_DIR || '/data/audit';\nfs.mkdirSync(AUDIT_DIR, { recursive: true });\n\nconst input = $input.first().json;\nconst yyyymm = new Date().toISOString().slice(0, 7);\nconst auditPath = path.join(AUDIT_DIR, `${yyyymm}.jsonl`);\n\nconst entry = {\n  ts: new Date().toISOString(),\n  application_id: input.application_id,\n  role_slug: input.role_slug,\n  rubric_sha: input.rubric_sha,\n  scores: {\n    skill: input.scores.skill_match.score,\n    level: input.scores.level_fit.score,\n    location: input.scores.location_fit.score,\n    response: input.scores.response_likelihood.score,\n  },\n  aggregate: input.aggregate,\n  route: input.route,\n  is_eu_candidate: !!input.is_eu_candidate,\n  model: 'claude-sonnet-4-6',\n};\n\nfs.appendFileSync(auditPath, JSON.stringify(entry) + '\\n', 'utf8');\n\nreturn [{ json: { audit_appended: auditPath, entry } }];"
      },
      "id": "2a2a2a2a-0001-0000-0000-00000000000d",
      "name": "Audit Append",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [2480, 240],
      "notesInFlow": true,
      "notes": "One JSONL line per scored application. No PII. Retention should match the firm's audit policy (typically 2-7 years for hiring records)."
    }
  ],
  "connections": {
    "Ashby Webhook": {
      "main": [[{ "node": "Verify Signature", "type": "main", "index": 0 }]]
    },
    "Verify Signature": {
      "main": [[{ "node": "Verified?", "type": "main", "index": 0 }]]
    },
    "Verified?": {
      "main": [
        [{ "node": "Fetch Candidate (Ashby)", "type": "main", "index": 0 }],
        []
      ]
    },
    "Fetch Candidate (Ashby)": {
      "main": [[{ "node": "Load Rubric + Pre-Flight", "type": "main", "index": 0 }]]
    },
    "Load Rubric + Pre-Flight": {
      "main": [[{ "node": "Ready to Score?", "type": "main", "index": 0 }]]
    },
    "Ready to Score?": {
      "main": [
        [{ "node": "Claude Score", "type": "main", "index": 0 }],
        []
      ]
    },
    "Claude Score": {
      "main": [[{ "node": "Parse + Route", "type": "main", "index": 0 }]]
    },
    "Parse + Route": {
      "main": [[{ "node": "Route by Aggregate", "type": "main", "index": 0 }]]
    },
    "Route by Aggregate": {
      "main": [
        [{ "node": "Slack Fast-Track", "type": "main", "index": 0 }],
        [{ "node": "Slack Review", "type": "main", "index": 0 }],
        [{ "node": "Slack Surfaced", "type": "main", "index": 0 }]
      ]
    },
    "Slack Fast-Track": {
      "main": [[{ "node": "Audit Append", "type": "main", "index": 0 }]]
    },
    "Slack Review": {
      "main": [[{ "node": "Audit Append", "type": "main", "index": 0 }]]
    },
    "Slack Surfaced": {
      "main": [[{ "node": "Audit Append", "type": "main", "index": 0 }]]
    }
  },
  "settings": {
    "executionOrder": "v1",
    "timezone": "UTC",
    "saveExecutionProgress": true,
    "saveManualExecutions": true,
    "callerPolicy": "workflowsFromSameOwner"
  },
  "active": false,
  "versionId": "1"
}