M44: harden release integrity and assurance

n8n/workflows/MANIFEST.md

@@ -1,6 +1,6 @@
 # n8n workflow manifest
 
-Source of truth for the four canonical Fleet Ops n8n workflows. Definitions in this
+Source of truth for the five canonical Fleet Ops n8n workflows. Definitions in this
 directory are cleaned exports of the live workflows on `https://n8n.itworx.tech` —
 credential values are never embedded; nodes reference named n8n credentials instead. Run
 `n8n/workflows/check_drift.py` to compare a live workflow against its repo definition.
@@ -108,3 +108,17 @@ runs from the editor. This is a known limitation of the live-validation evidence
 round: the mock-data path exercises the same nodes/logic and the real Fleet Ops
 endpoint, but a fully automatic (schedule- or webhook-triggered) failure cascading into
 this handler was not observed live.
+
+## 5. Fleet Ops — Alert Receiver
+
+| Field | Value |
+|---|---|
+| File | `fleet-ops-alert-receiver.json` |
+| Purpose | Receive validated Alertmanager firing/resolved notifications and route them to the watched owner mailbox. |
+| Trigger | Production webhook, `POST /webhook/mobilityops-alerts`, Header Auth (`Fleet Ops Webhook Trigger Token`) |
+| Required credentials | `Fleet Ops Webhook Trigger Token` (Header Auth); `M365 n8n Shared Mailbox` (Microsoft Outlook OAuth2) |
+| Live workflow ID | `mobilityops-alert-receiver` |
+| Active status | Imported inactive by default; production deployment must publish it before enabling Alertmanager. |
+| Error Workflow | `Fleet Ops — Workflow Error Handler` (wired) |
+| Safety | Strict Alertmanager payload shape, bounded to 25 alerts and bounded text fields. |
+| Checksum (sha256) | `3672ad3d14b65c603c8c3f2067197cc50372e9d4c2fc314d1c9b6aaf3ecef444` |