diff --git a/CHANGELOG.md b/CHANGELOG.md index c1b485f..879396d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## 0.9.0 - 2026-07-24 +## 0.9.0 - 2026-07-23 - Added outcome-aware policies VF010-VF013 for money, customer, privileged, and destructive-data actions. - Added structurally verified outcome contracts for approval, durable audit, idempotency, amount and counterparty limits, failure notification, and recovery. diff --git a/docs/codex-for-oss-application.md b/docs/codex-for-oss-application.md index edfc161..49e7b9b 100644 --- a/docs/codex-for-oss-application.md +++ b/docs/codex-for-oss-application.md @@ -14,7 +14,7 @@ Official form rechecked: 2026-07-22 Submit in **English**, even through the PT-BR form. OpenAI publishes no language requirement and no evidence that language changes selection odds. English is recommended only to reduce translation friction for a global technical review. -Submit immediately after the v0.9.0 release on 2026-07-24. Do not wait for arbitrary star, fork, or PR targets. Vibeflow's strongest evidence is its Codex-native engineering, first real 92-node audit, and a public maintenance loop that turned community feedback into tested policy features. +Submit now that v0.9.0 is public. Do not wait for arbitrary star, fork, or PR targets. Vibeflow's strongest evidence is its Codex-native engineering, first real 92-node audit, and a public maintenance loop that turned community feedback into tested policy features. ## Copy-and-paste form @@ -94,7 +94,7 @@ These translations are for review only. Paste the English versions above into th Use these links only if OpenAI requests verification; the form has no dedicated evidence field. - Public MIT repository: -- Executable release after Friday launch: +- Executable release: - Reproducible demo: - Release and Red Team audit: - CI history: @@ -104,14 +104,14 @@ Use these links only if OpenAI requests verification; the form has no dedicated ## Evidence snapshot -Refresh this section on 2026-07-24 immediately before submission. Current candidate evidence: +Captured on 2026-07-23 after release: - public repository with MIT license; -- `v0.9.0` release candidate, with v0.8.0 already public; +- public `v0.9.0` release, with v0.8.0 preserved in release history; - 36 adversarial tests passing locally and in remote Node.js 20, 22, and 24 CI; - dependency-free CLI, GitHub Action, and installable Codex plugin; -- 5 maintainer PRs merged with green CI, including the v0.9 implementation PR; -- 2 stars, 0 forks, and no verified external contributor yet; +- 7 maintainer PRs merged with green CI, including the v0.9 implementation and release-evidence PR; +- 4 stars, 0 forks, and no verified external contributor yet; - public r/n8n launch thread with several substantive comments that directly shaped VF010-VF013; - first real audit: anonymized 92-node workflow, 3 blocking findings, 57 warnings, no workflow mutation; - Codex used across product repositioning, implementation, review, Red Team, remediation, packaging, CI, release, real-workflow audit, and the community-feedback-driven v0.9 cycle. @@ -133,7 +133,7 @@ The approved public description is: **“a real, production-scale 92-node conver - [x] Repository is public and not archived. - [x] GitHub username is public. -- [x] Role is principal maintainer. +- [x] Role is primary maintainer. - [x] Repository URL is correct. - [x] Both requested benefits are selected. - [x] All narrative answers are under 500 characters. diff --git a/docs/launch.md b/docs/launch.md index 8ab115a..a6cc2a0 100644 --- a/docs/launch.md +++ b/docs/launch.md @@ -1,6 +1,6 @@ # v0.9.0 launch checklist -Target: Friday, 2026-07-24 +Released: 2026-07-23 ## Release gate @@ -9,9 +9,11 @@ Target: Friday, 2026-07-24 - [x] Local `npm run verify` and `npm audit --omit=dev` pass. - [x] QA, adversarial Red Team, and Guardião reviews are documented. - [x] Pull request CI passes on Node.js 20, 22, and 24. -- [ ] Release commit is merged and tagged `v0.9.0`. -- [ ] Released CLI and pinned Codex marketplace install successfully. -- [ ] GitHub release is published on Friday. +- [x] Release commit is merged and tagged `v0.9.0`. +- [x] Released CLI and pinned Codex marketplace install successfully. +- [x] GitHub release is public and marked latest. + +Release: ## Positioning diff --git a/docs/release-audit.md b/docs/release-audit.md index aa4a4c7..31672ad 100644 --- a/docs/release-audit.md +++ b/docs/release-audit.md @@ -1,10 +1,10 @@ -# Release audit — v0.9.0 candidate +# Release audit — v0.9.0 -Target release: 2026-07-24 +Released: 2026-07-23 ## Decision -**APTO COM RESSALVAS** for the Friday release, pending merge, tag, and released-install checks listed below. +**APTO** within Vibeflow's documented static-preflight boundary. No blocking defect remains in the reviewed static-analysis boundary. Vibeflow can verify structural evidence in an exported workflow, but it cannot enforce authorization, amount limits, counterparty identity, audit durability, or recovery behavior in the executing systems. @@ -16,6 +16,9 @@ No blocking defect remains in the reviewed static-analysis boundary. Vibeflow ca - Text, JSON, SARIF, configuration validation, package packing, and CLI exit behavior are exercised. - `npm run verify`, `npm audit --omit=dev`, JSON parsing, and `git diff --check` pass locally. - The package remains dependency-free and targets Node.js 20+. +- The public `v0.9.0` tag resolves to release commit `7552eeca7cfdd56376eab2007988b81a9726fba4`. +- The released GitHub CLI package passes the safe refund fixture with zero findings and reports VF010, VF012, and VF013 for the unsafe refund fixture. +- The released Codex marketplace installs `vibeflow@vibeflow` version `0.9.0` in an isolated `CODEX_HOME`. ## Red Team @@ -56,15 +59,15 @@ The graph checks use actual `main` edges, require dominating controls, and rejec - an exported graph cannot prove a referenced credential, approval identity, SQL policy, external API limit, notification, or compensation works at runtime; - custom/community nodes may need explicit impact declarations or new regression-backed adapters; - repository owners may intentionally weaken policy outside `--locked` mode; -- remote Node 20/22/24 CI passed; released `npx`/plugin installation can only be confirmed after the candidate is tagged. +- remote Node 20/22/24 CI and released `npx`/plugin installation passed. ## Release blockers - [x] Pull request CI passes on Node.js 20, 22, and 24. -- [ ] Release commit is merged without unrelated changes. -- [ ] `v0.9.0` tag and GitHub release are published on 2026-07-24. -- [ ] Released CLI and Codex plugin install paths are smoke-tested. +- [x] Release commit is merged without unrelated changes. +- [x] `v0.9.0` tag and GitHub release are public. +- [x] Released CLI and Codex plugin install paths are smoke-tested. ## Final gate -There are zero known critical or high security findings in the candidate. The release remains **APTO COM RESSALVAS** until the remaining remote gates above are complete; a failed gate blocks publication or requires an immediate corrective release. +There are zero known critical or high security findings in the released static-analysis boundary. Runtime enforcement remains explicitly outside the product claim. diff --git a/docs/roadmap.md b/docs/roadmap.md index 91ce4ac..44791a6 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -4,7 +4,7 @@ Ship the executable reset: CLI, nine configurable policies, fixtures, tests, SARIF, GitHub Action, and Codex plugin. -## 0.9.0 — target 2026-07-24 +## 0.9.0 — shipped 2026-07-23 Separate dangerous nodes from dangerous outcomes. Add VF010-VF013, explicit outcome contracts, graph evidence for policy gates, safe/unsafe refund fixtures, and clear runtime boundaries.