felipe/vibeflow-n8n
1
0
Fork 0
mirror of https://github.com/domfelipe/vibeflow-n8n.git synced 2026-08-07 06:16:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Record v0.9 CI evidence

Browse source
This commit is contained in:
Felipe Domingues 2026-07-22 13:57:44 -03:00
parent bb581ab7f8
commit 7852157486
3 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/codex-for-oss-application.md
View file

@ -105,7 +105,7 @@ Refresh this section on 2026-07-24 immediately before submission. Current candid
- public repository with MIT license;
- `v0.9.0` release candidate, with v0.8.0 already public;
- 36 local adversarial tests; remote Node.js 20, 22, and 24 CI remains a release gate;
- 36 adversarial tests passing locally and in remote Node.js 20, 22, and 24 CI;
- dependency-free CLI, GitHub Action, and installable Codex plugin;
- 3 prior maintainer PRs merged with green CI; add the v0.9 PR after merge;
- 2 stars, 0 forks, and no verified external contributor yet;

2
docs/launch.md
View file

@ -8,7 +8,7 @@ Target: Friday, 2026-07-24
- [x] Safe and unsafe refund fixtures are reproducible.
- [x] Local `npm run verify` and `npm audit --omit=dev` pass.
- [x] QA, adversarial Red Team, and Guardião reviews are documented.
- [ ] Pull request CI passes on Node.js 20, 22, and 24.
- [x] Pull request CI passes on Node.js 20, 22, and 24.
- [ ] Release commit is merged and tagged `v0.9.0`.
- [ ] Released CLI and pinned Codex marketplace install successfully.
- [ ] GitHub release is published on Friday.

8
docs/release-audit.md
View file

@ -4,7 +4,7 @@ Target release: 2026-07-24
## Decision
**APTO COM RESSALVAS** for the Friday release, pending the remote CI and released-install checks listed below.
**APTO COM RESSALVAS** for the Friday release, pending merge, tag, and released-install checks listed below.
No blocking defect remains in the reviewed static-analysis boundary. Vibeflow can verify structural evidence in an exported workflow, but it cannot enforce authorization, amount limits, counterparty identity, audit durability, or recovery behavior in the executing systems.
@ -56,15 +56,15 @@ The graph checks use actual `main` edges, require dominating controls, and rejec
- an exported graph cannot prove a referenced credential, approval identity, SQL policy, external API limit, notification, or compensation works at runtime;
- custom/community nodes may need explicit impact declarations or new regression-backed adapters;
- repository owners may intentionally weaken policy outside `--locked` mode;
- remote Node 20/22/24 CI and released `npx`/plugin installation can only be confirmed after the candidate is pushed and tagged.
- remote Node 20/22/24 CI passed; released `npx`/plugin installation can only be confirmed after the candidate is tagged.
## Release blockers
- [ ] Pull request CI passes on Node.js 20, 22, and 24.
- [x] Pull request CI passes on Node.js 20, 22, and 24.
- [ ] Release commit is merged without unrelated changes.
- [ ] `v0.9.0` tag and GitHub release are published on 2026-07-24.
- [ ] Released CLI and Codex plugin install paths are smoke-tested.
## Final gate
There are zero known critical or high security findings in the local candidate. The release remains **APTO COM RESSALVAS** until the four remote gates above are complete; a failed gate blocks publication or requires an immediate corrective release.
There are zero known critical or high security findings in the candidate. The release remains **APTO COM RESSALVAS** until the remaining remote gates above are complete; a failed gate blocks publication or requires an immediate corrective release.