felipe/vibeflow-n8n
1
0
Fork 0
mirror of https://github.com/domfelipe/vibeflow-n8n.git synced 2026-08-07 06:56:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Record v0.9 CI evidence

Browse source
This commit is contained in:
Felipe Domingues 2026-07-22 13:57:44 -03:00
parent bb581ab7f8
commit 7852157486
3 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/codex-for-oss-application.md
View file

@ -105,7 +105,7 @@ Refresh this section on 2026-07-24 immediately before submission. Current candid
- public repository with MIT license; - public repository with MIT license;
- `v0.9.0` release candidate, with v0.8.0 already public; - `v0.9.0` release candidate, with v0.8.0 already public;
- 36 local adversarial tests; remote Node.js 20, 22, and 24 CI remains a release gate; - 36 adversarial tests passing locally and in remote Node.js 20, 22, and 24 CI;
- dependency-free CLI, GitHub Action, and installable Codex plugin; - dependency-free CLI, GitHub Action, and installable Codex plugin;
- 3 prior maintainer PRs merged with green CI; add the v0.9 PR after merge; - 3 prior maintainer PRs merged with green CI; add the v0.9 PR after merge;
- 2 stars, 0 forks, and no verified external contributor yet; - 2 stars, 0 forks, and no verified external contributor yet;

2
docs/launch.md
View file

@ -8,7 +8,7 @@ Target: Friday, 2026-07-24
- [x] Safe and unsafe refund fixtures are reproducible. - [x] Safe and unsafe refund fixtures are reproducible.
- [x] Local `npm run verify` and `npm audit --omit=dev` pass. - [x] Local `npm run verify` and `npm audit --omit=dev` pass.
- [x] QA, adversarial Red Team, and Guardião reviews are documented. - [x] QA, adversarial Red Team, and Guardião reviews are documented.
- [ ] Pull request CI passes on Node.js 20, 22, and 24. - [x] Pull request CI passes on Node.js 20, 22, and 24.
- [ ] Release commit is merged and tagged `v0.9.0`. - [ ] Release commit is merged and tagged `v0.9.0`.
- [ ] Released CLI and pinned Codex marketplace install successfully. - [ ] Released CLI and pinned Codex marketplace install successfully.
- [ ] GitHub release is published on Friday. - [ ] GitHub release is published on Friday.

8
docs/release-audit.md
View file

@ -4,7 +4,7 @@ Target release: 2026-07-24
## Decision ## Decision
**APTO COM RESSALVAS** for the Friday release, pending the remote CI and released-install checks listed below. **APTO COM RESSALVAS** for the Friday release, pending merge, tag, and released-install checks listed below.
No blocking defect remains in the reviewed static-analysis boundary. Vibeflow can verify structural evidence in an exported workflow, but it cannot enforce authorization, amount limits, counterparty identity, audit durability, or recovery behavior in the executing systems. No blocking defect remains in the reviewed static-analysis boundary. Vibeflow can verify structural evidence in an exported workflow, but it cannot enforce authorization, amount limits, counterparty identity, audit durability, or recovery behavior in the executing systems.
@ -56,15 +56,15 @@ The graph checks use actual `main` edges, require dominating controls, and rejec
- an exported graph cannot prove a referenced credential, approval identity, SQL policy, external API limit, notification, or compensation works at runtime; - an exported graph cannot prove a referenced credential, approval identity, SQL policy, external API limit, notification, or compensation works at runtime;
- custom/community nodes may need explicit impact declarations or new regression-backed adapters; - custom/community nodes may need explicit impact declarations or new regression-backed adapters;
- repository owners may intentionally weaken policy outside `--locked` mode; - repository owners may intentionally weaken policy outside `--locked` mode;
- remote Node 20/22/24 CI and released `npx`/plugin installation can only be confirmed after the candidate is pushed and tagged. - remote Node 20/22/24 CI passed; released `npx`/plugin installation can only be confirmed after the candidate is tagged.
## Release blockers ## Release blockers
- [ ] Pull request CI passes on Node.js 20, 22, and 24. - [x] Pull request CI passes on Node.js 20, 22, and 24.
- [ ] Release commit is merged without unrelated changes. - [ ] Release commit is merged without unrelated changes.
- [ ] `v0.9.0` tag and GitHub release are published on 2026-07-24. - [ ] `v0.9.0` tag and GitHub release are published on 2026-07-24.
- [ ] Released CLI and Codex plugin install paths are smoke-tested. - [ ] Released CLI and Codex plugin install paths are smoke-tested.
## Final gate ## Final gate
There are zero known critical or high security findings in the local candidate. The release remains **APTO COM RESSALVAS** until the four remote gates above are complete; a failed gate blocks publication or requires an immediate corrective release. There are zero known critical or high security findings in the candidate. The release remains **APTO COM RESSALVAS** until the remaining remote gates above are complete; a failed gate blocks publication or requires an immediate corrective release.