felipe/vibeflow-n8n
1
0
Fork 0
mirror of https://github.com/domfelipe/vibeflow-n8n.git synced 2026-08-07 04:16:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Record v0.9 release evidence

Browse source
This commit is contained in:
Felipe Domingues 2026-07-23 13:00:53 -03:00
parent 7552eeca7c
commit a89001f738
5 changed files with 26 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

2
CHANGELOG.md
View file

@ -1,6 +1,6 @@
# Changelog
## 0.9.0 - 2026-07-24
## 0.9.0 - 2026-07-23
- Added outcome-aware policies VF010-VF013 for money, customer, privileged, and destructive-data actions.
- Added structurally verified outcome contracts for approval, durable audit, idempotency, amount and counterparty limits, failure notification, and recovery.

14
docs/codex-for-oss-application.md
View file

@ -14,7 +14,7 @@ Official form rechecked: 2026-07-22
Submit in **English**, even through the PT-BR form. OpenAI publishes no language requirement and no evidence that language changes selection odds. English is recommended only to reduce translation friction for a global technical review.
Submit immediately after the v0.9.0 release on 2026-07-24. Do not wait for arbitrary star, fork, or PR targets. Vibeflow's strongest evidence is its Codex-native engineering, first real 92-node audit, and a public maintenance loop that turned community feedback into tested policy features.
Submit now that v0.9.0 is public. Do not wait for arbitrary star, fork, or PR targets. Vibeflow's strongest evidence is its Codex-native engineering, first real 92-node audit, and a public maintenance loop that turned community feedback into tested policy features.
## Copy-and-paste form
@ -94,7 +94,7 @@ These translations are for review only. Paste the English versions above into th
Use these links only if OpenAI requests verification; the form has no dedicated evidence field.
- Public MIT repository: <https://github.com/domfelipe/vibeflow-n8n>
- Executable release after Friday launch: <https://github.com/domfelipe/vibeflow-n8n/releases/tag/v0.9.0>
- Executable release: <https://github.com/domfelipe/vibeflow-n8n/releases/tag/v0.9.0>
- Reproducible demo: <https://github.com/domfelipe/vibeflow-n8n/blob/main/docs/demo.md>
- Release and Red Team audit: <https://github.com/domfelipe/vibeflow-n8n/blob/main/docs/release-audit.md>
- CI history: <https://github.com/domfelipe/vibeflow-n8n/actions/workflows/ci.yml>
@ -104,14 +104,14 @@ Use these links only if OpenAI requests verification; the form has no dedicated
## Evidence snapshot
Refresh this section on 2026-07-24 immediately before submission. Current candidate evidence:
Captured on 2026-07-23 after release:
- public repository with MIT license;
- `v0.9.0` release candidate, with v0.8.0 already public;
- public `v0.9.0` release, with v0.8.0 preserved in release history;
- 36 adversarial tests passing locally and in remote Node.js 20, 22, and 24 CI;
- dependency-free CLI, GitHub Action, and installable Codex plugin;
- 5 maintainer PRs merged with green CI, including the v0.9 implementation PR;
- 2 stars, 0 forks, and no verified external contributor yet;
- 7 maintainer PRs merged with green CI, including the v0.9 implementation and release-evidence PR;
- 4 stars, 0 forks, and no verified external contributor yet;
- public r/n8n launch thread with several substantive comments that directly shaped VF010-VF013;
- first real audit: anonymized 92-node workflow, 3 blocking findings, 57 warnings, no workflow mutation;
- Codex used across product repositioning, implementation, review, Red Team, remediation, packaging, CI, release, real-workflow audit, and the community-feedback-driven v0.9 cycle.
@ -133,7 +133,7 @@ The approved public description is: **“a real, production-scale 92-node conver
- [x] Repository is public and not archived.
- [x] GitHub username is public.
- [x] Role is principal maintainer.
- [x] Role is primary maintainer.
- [x] Repository URL is correct.
- [x] Both requested benefits are selected.
- [x] All narrative answers are under 500 characters.

10
docs/launch.md
View file

@ -1,6 +1,6 @@
# v0.9.0 launch checklist
Target: Friday, 2026-07-24
Released: 2026-07-23
## Release gate
@ -9,9 +9,11 @@ Target: Friday, 2026-07-24
- [x] Local `npm run verify` and `npm audit --omit=dev` pass.
- [x] QA, adversarial Red Team, and Guardião reviews are documented.
- [x] Pull request CI passes on Node.js 20, 22, and 24.
- [ ] Release commit is merged and tagged `v0.9.0`.
- [ ] Released CLI and pinned Codex marketplace install successfully.
- [ ] GitHub release is published on Friday.
- [x] Release commit is merged and tagged `v0.9.0`.
- [x] Released CLI and pinned Codex marketplace install successfully.
- [x] GitHub release is public and marked latest.
Release: <https://github.com/domfelipe/vibeflow-n8n/releases/tag/v0.9.0>
## Positioning

19
docs/release-audit.md
View file

@ -1,10 +1,10 @@
# Release audit — v0.9.0 candidate
# Release audit — v0.9.0
Target release: 2026-07-24
Released: 2026-07-23
## Decision
**APTO COM RESSALVAS** for the Friday release, pending merge, tag, and released-install checks listed below.
**APTO** within Vibeflow's documented static-preflight boundary.
No blocking defect remains in the reviewed static-analysis boundary. Vibeflow can verify structural evidence in an exported workflow, but it cannot enforce authorization, amount limits, counterparty identity, audit durability, or recovery behavior in the executing systems.
@ -16,6 +16,9 @@ No blocking defect remains in the reviewed static-analysis boundary. Vibeflow ca
- Text, JSON, SARIF, configuration validation, package packing, and CLI exit behavior are exercised.
- `npm run verify`, `npm audit --omit=dev`, JSON parsing, and `git diff --check` pass locally.
- The package remains dependency-free and targets Node.js 20+.
- The public `v0.9.0` tag resolves to release commit `7552eeca7cfdd56376eab2007988b81a9726fba4`.
- The released GitHub CLI package passes the safe refund fixture with zero findings and reports VF010, VF012, and VF013 for the unsafe refund fixture.
- The released Codex marketplace installs `vibeflow@vibeflow` version `0.9.0` in an isolated `CODEX_HOME`.
## Red Team
@ -56,15 +59,15 @@ The graph checks use actual `main` edges, require dominating controls, and rejec
- an exported graph cannot prove a referenced credential, approval identity, SQL policy, external API limit, notification, or compensation works at runtime;
- custom/community nodes may need explicit impact declarations or new regression-backed adapters;
- repository owners may intentionally weaken policy outside `--locked` mode;
- remote Node 20/22/24 CI passed; released `npx`/plugin installation can only be confirmed after the candidate is tagged.
- remote Node 20/22/24 CI and released `npx`/plugin installation passed.
## Release blockers
- [x] Pull request CI passes on Node.js 20, 22, and 24.
- [ ] Release commit is merged without unrelated changes.
- [ ] `v0.9.0` tag and GitHub release are published on 2026-07-24.
- [ ] Released CLI and Codex plugin install paths are smoke-tested.
- [x] Release commit is merged without unrelated changes.
- [x] `v0.9.0` tag and GitHub release are public.
- [x] Released CLI and Codex plugin install paths are smoke-tested.
## Final gate
There are zero known critical or high security findings in the candidate. The release remains **APTO COM RESSALVAS** until the remaining remote gates above are complete; a failed gate blocks publication or requires an immediate corrective release.
There are zero known critical or high security findings in the released static-analysis boundary. Runtime enforcement remains explicitly outside the product claim.

2
docs/roadmap.md
View file

@ -4,7 +4,7 @@
Ship the executable reset: CLI, nine configurable policies, fixtures, tests, SARIF, GitHub Action, and Codex plugin.
## 0.9.0 — target 2026-07-24
## 0.9.0 — shipped 2026-07-23
Separate dangerous nodes from dangerous outcomes. Add VF010-VF013, explicit outcome contracts, graph evidence for policy gates, safe/unsafe refund fixtures, and clear runtime boundaries.