OPERAND STUDIO
TELEMETRY PENDING · SMS LEAD INTAKE

Firstline SMS — every inbound lead answered in seconds.

An SMS lead receiver and qualifier on n8n: inbound texts verified, deduplicated, qualified against a deterministic rule table, and answered automatically. Built and hardened into a reusable base package.

SITUATION

Leads arrive by text. Replies arrived hours later.

Service businesses win work by SMS — a customer texts, and whoever answers first usually gets the job. But the text lands while the operator is on a job, driving, or asleep, and the reply goes out when the phone is next in hand. By then the lead is cold.
BOTTLENECK

A human phone as the single point of failure.

Everything rode on one handset, held together by attention:
SYSTEM

Two workflows — a fast path that answers, a decision child that qualifies.

An 11-node inbound processor owns the webhook and acknowledges every message immediately. A 4-node decision child qualifies each lead asynchronously against a deterministic rule table — decision work never blocks the acknowledgment, and the dispatch between the two is a deliberate socket for add-on packages.
Two workflows. The 11-node inbound processor is the fast path: a webhook receives the SMS, HMAC signature verification rejects unauthenticated requests with a 401, a STOP guard honours opt-outs, a dedup guard blocks replays, and a session is looked up or created — then work is dispatched to the child and a signed acknowledgment returns to the caller. The 4-node decision child runs asynchronously so decision work never blocks the acknowledgment: a rule table qualifies the lead, session state updates, and the reply is delivered to the sender. Add-on packages plug into the dispatch socket.
THE INBOUND PATH, IN ORDER
  • HMAC-SHA256 signature verification on every request, with ±5 minutes of timestamp skew tolerance. Unauthenticated traffic exits on a 401 reject branch — fail-closed.
  • Message parsing: sender, text, and message ID lifted from the payload.
  • Opt-out guard: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, and QUIT honoured automatically — compliance enforced in the pipe, not by memory.
  • Deduplication guard: per-message-ID replay protection, so a re-delivered webhook cannot double-process a lead.
  • Session lookup: every conversation is a database row keyed to the phone number — a state machine that survives across messages.
  • Dispatch to the decision child, then a signed response back to the caller.

The child qualifies each lead against a deterministic rule table — keyword and intent matching, contact completeness, urgency signals — picks a templated, SMS-appropriate reply, updates the session state and last-message timestamp, and delivers the reply to the sender through the SMS provider's API.

Signed both directions

HMAC-SHA256 verification on every inbound request, signed responses out. Auth fails closed — unauthenticated traffic gets a 401.

Zero embedded secrets

Workflow definitions carry credential references only — nothing to leak in an export.

Provider-agnostic

SMS provider and database are parameters. The system swaps providers without rework.

OUTCOME

Measured, not promised.

Every lead the system handles is written to a queryable session table — phone number, qualification, the rule it matched, and the inbound and reply timestamps. That record is the measurement instrument; the outcome section publishes from it, not from claims.
TELEMETRY PENDING

The numbers land here when the observation window closes: median inbound-to-reply latency, the share of leads answered after hours, opt-outs honoured, and duplicate deliveries suppressed — pulled straight from the session table. Until then this section stays deliberately empty. No invented figures, ever.

PACKAGES

A base brick other packages stack onto.

The receiver and qualifier is the base — deployed per client as-is, providers parameterised. The decision-child dispatch is a deliberate socket: add-on packages plug in there without touching the base.
Firstline — receiver / qualifier (BASE)This system — rule-based intake, qualification, and automated reply. Deployable per client without rework.BASE
Readout — LLM enrichment (ADD-ON)One LLM pass plugged into the same dispatch socket — intent, band refinement, a suggested reply. The base stays untouched.ADD-ON
Talk about your lead intake →View the components on GitHub →