That all works for me.
I approve.
I suggest CR 2.
My reasoning for CR 2:
- 19 hp
- Immune to crits, sneak attack, etc.
- Free attacks on anyone within 5 feet and those attacking it without a reach weapon
- It could potentially make 6 attacks (plus 6 tendrils) if a creature approaches and attacks it, before the attackers' next turn!
Eh? Didn't we limit it to 4 attacks per 5 ft. square, how would it get 6 attacks?
Besides, its attacks do pretty crummy damage - it'll almost always be taking more damage than its spines dish out.
Anyhow, the big problem is anyone with a ranged or reach attack can easily kill one from a safe distance with negligible risk to themselves. I think that deserves a low CR.