Merge pull request #5 from domfelipe/codex/codex-for-oss-application

Prepare Codex for OSS submission pack

docs/codex-for-oss-application.md

@@ -1,53 +1,153 @@
-# Codex for Open Source application gate
+# Codex for Open Source — submission pack
 
 Application: <https://openai.com/pt-BR/form/codex-for-oss/>
 
-## Current position
+Program overview: <https://developers.openai.com/community/codex-for-oss>
 
-Vibeflow is public, MIT-licensed, owned by its principal maintainer, and aligned with Codex maintainer workflows. Version 0.8.0 establishes active engineering evidence but does not manufacture adoption.
+Program terms: <https://learn.chatgpt.com/docs/codex-for-oss-terms>
 
-**Current decision: do not submit.** The release is live, but the external-usage gate is not yet met.
+Prepared: 2026-07-22
 
-## Practical submission gate
+## Recommendation
 
-These are internal quality targets, not official OpenAI thresholds:
+Submit in **English**, even through the PT-BR form. OpenAI publishes no language requirement and no evidence that language changes selection odds. English is recommended only to reduce translation friction for a global technical review.
 
-- a tagged public release with green CI;
-- at least three unrelated external users or teams with verifiable feedback;
-- at least one external issue, discussion, or pull request with maintainer activity;
-- current traffic, clone, installation, or dependent-project evidence;
-- no confidential information in the application.
+Submit now. Stars, forks, downloads, repository usage, ecosystem importance, and active maintenance are evaluation signals, not published minimum thresholds. Vibeflow's strongest evidence is its Codex-native engineering and its first real 92-node audit, not early popularity metrics.
 
-## Live evidence snapshot
+## Copy-and-paste form
 
-Captured from GitHub on 2026-07-22 immediately after release:
+### First name
 
-- GitHub stars: 1; ownership is not attributed, so it is not counted as external adoption.
-- forks: 0.
-- traffic: 2 unique clones in the available 14-day window, both before release and not attributable to external users.
-- releases: 1; `v0.8.0` published on 2026-07-22.
-- external contributors: 0.
-- external users or independent public references: 0 verified.
-- maintainer evidence: [PR #1](https://github.com/domfelipe/vibeflow-n8n/pull/1), [PR #2](https://github.com/domfelipe/vibeflow-n8n/pull/2), [release v0.8.0](https://github.com/domfelipe/vibeflow-n8n/releases/tag/v0.8.0), and [launch discussion #3](https://github.com/domfelipe/vibeflow-n8n/discussions/3).
+`Felipe`
 
-## Form draft
+### Last name
 
-### Role
+`Domingues`
 
-Principal maintainer.
+### Email
+
+`[FILL PRIVATELY: email associated with the ChatGPT account]`
+
+### GitHub username
+
+`domfelipe`
+
+### GitHub repository URL
+
+`https://github.com/domfelipe/vibeflow-n8n`
+
+### Maintainer role
+
+Select: **Principal maintainer**.
 
 ### Why is this repository eligible?
 
-> Vibeflow is an MIT-licensed safety gate for AI-generated n8n workflows. It catches embedded secrets, unsafe webhooks, missing kill switches, human handoffs, idempotency, error paths, timeouts, and risky retries before deployment. It is maintained as a dependency-free CLI, GitHub Action, and Codex plugin. External usage evidence is not yet sufficient, so submission is intentionally deferred.
+Character count: **420/500**.
+
+> Vibeflow is an MIT-licensed safety and contract gate for AI-generated n8n workflows, rebuilt end-to-end with Codex. Its v0.8.0 plugin audited a real 92-node workflow in read-only mode and produced provenance-backed results: 3 blocking AI-safety findings, 57 prioritized warnings, and concrete revalidation gates. It fills a growing n8n need: deterministic pre-production checks for workflows created by people or agents.
+
+### Interests
+
+Select both:
+
+- **Codex Security**
+- **API credits for my project**
+
+### OpenAI Organization ID
+
+`[FILL PRIVATELY: org-...]`
+
+Use the organization that should receive the API credits. Confirm it in the OpenAI Platform before submitting; do not place it in this public document.
 
 ### How will API credits be used?
 
-> Credits will support OSS maintenance: generate adversarial workflow fixtures, run reproducible policy evaluations, review contributed rules in pull requests, explain regressions, and prepare release reports. They will not fund a hosted commercial runtime or process private customer workflows.
+Character count: **390/500**.
 
-### Anything else?
+> API credits would power OSS maintenance workflows: turn anonymized failures into adversarial fixtures, evaluate new policies, reproduce false positives, review contributed rules, triage issues, and generate release audits. Codex would assist these workflows; the Vibeflow scanner will remain local, dependency-free, telemetry-free, and will not upload or process private customer workflows.
 
-> Vibeflow comes from production lessons operating conversational automations in Brazil. It is deliberately interoperable with n8n and existing MCP tooling: it does not replace builders, it checks their output. The project ships without telemetry and keeps workflow analysis local.
+### Anything else we should know?
 
-## Final verification
+Character count: **431/500**.
 
-Before submitting, capture a fresh evidence snapshot, confirm the GitHub profile and repository remain public, verify each form answer remains under 500 characters, and use accurate current evidence only. Replace the deferral sentence only after the practical submission gate is met.
+> Vibeflow is a public case study in Codex-native OSS development. Codex helped reposition an old prototype, implement the CLI, run repeated Red Team reviews, fix regressions, package a GitHub Action and Codex plugin, open and merge PRs, and publish v0.8.0. Its first production-scale audit exposed workflow risks and analyzer limitations, creating a concrete maintenance backlog. Adoption is early; the engineering evidence is real.
+
+## PT-BR review translation
+
+These translations are for review only. Paste the English versions above into the form.
+
+### Repository eligibility
+
+> Vibeflow é um gate MIT de segurança e contratos para workflows n8n gerados por IA, reconstruído de ponta a ponta com Codex. O plugin v0.8.0 auditou em modo somente leitura um workflow real de 92 nós e produziu resultados com proveniência: 3 bloqueios de segurança de IA, 57 avisos priorizados e gates concretos de revalidação. Ele atende a uma necessidade crescente do ecossistema n8n: checks determinísticos antes da produção para workflows criados por pessoas ou agentes.
+
+### API-credit use
+
+> Os créditos financiariam fluxos de manutenção OSS: transformar falhas anonimizadas em fixtures adversariais, avaliar novas políticas, reproduzir falsos positivos, revisar regras contribuídas, triar issues e gerar auditorias de release. O Codex auxiliaria esses fluxos; o scanner Vibeflow permanecerá local, sem dependências ou telemetria, e não enviará nem processará workflows privados de clientes.
+
+### Additional context
+
+> Vibeflow é um estudo de caso público de desenvolvimento open source nativo em Codex. O Codex ajudou a reposicionar um protótipo antigo, implementar a CLI, executar Red Teams repetidos, corrigir regressões, empacotar uma GitHub Action e um plugin Codex, mesclar PRs e publicar a v0.8.0. A primeira auditoria em escala de produção revelou riscos do workflow e limitações do analisador, criando um backlog concreto. A adoção ainda é inicial; a evidência de engenharia é real.
+
+## Evidence map
+
+Use these links only if OpenAI requests verification; the form has no dedicated evidence field.
+
+- Public MIT repository: <https://github.com/domfelipe/vibeflow-n8n>
+- Executable release: <https://github.com/domfelipe/vibeflow-n8n/releases/tag/v0.8.0>
+- Reproducible demo: <https://github.com/domfelipe/vibeflow-n8n/blob/main/docs/demo.md>
+- Release and Red Team audit: <https://github.com/domfelipe/vibeflow-n8n/blob/main/docs/release-audit.md>
+- CI history: <https://github.com/domfelipe/vibeflow-n8n/actions/workflows/ci.yml>
+- Launch discussion: <https://github.com/domfelipe/vibeflow-n8n/discussions/3>
+- Engineering PRs: <https://github.com/domfelipe/vibeflow-n8n/pulls?q=is%3Apr+is%3Amerged>
+
+## Evidence snapshot
+
+Captured on 2026-07-22:
+
+- public repository with MIT license;
+- `v0.8.0` release;
+- 26 adversarial tests on Node.js 20, 22, and 24;
+- dependency-free CLI, GitHub Action, and installable Codex plugin;
+- 3 maintainer PRs merged with green CI;
+- 2 stars, 0 forks, and no verified external contributor yet;
+- first real audit: anonymized 92-node workflow, 3 blocking findings, 57 warnings, no workflow mutation;
+- Codex used across product repositioning, implementation, review, Red Team, remediation, packaging, CI, release, and real-workflow audit.
+
+Do not describe maintainer PRs, the maintainer's own workflow, clones, or unattributed stars as external adoption.
+
+## Confidentiality boundary
+
+Do not submit or link the full real-workflow audit. Application materials must not include:
+
+- client, clinic, or workflow names;
+- remote workflow IDs, version IDs, hashes, or timestamps;
+- node names that reveal business logic;
+- private workflow JSON, credentials, customer data, or infrastructure identifiers.
+
+The approved public description is: **“a real, production-scale 92-node conversational workflow audited in read-only mode.”**
+
+## Submission checklist
+
+- [x] Repository is public and not archived.
+- [x] GitHub username is public.
+- [x] Role is principal maintainer.
+- [x] Repository URL is correct.
+- [x] Both requested benefits are selected.
+- [x] All narrative answers are under 500 characters.
+- [x] Real-workflow evidence is anonymized.
+- [x] Early adoption is described honestly.
+- [ ] Insert the exact ChatGPT-account email.
+- [ ] Insert and verify the OpenAI Organization ID.
+- [ ] Re-read the current Program Terms immediately before submission.
+- [ ] Save the confirmation page and submission timestamp privately.
+
+## After submission
+
+Continue collecting organic evidence without delaying the application:
+
+1. publish the r/n8n post;
+2. invite users to report anonymized false positives and missed unsafe cases;
+3. respond to every issue or discussion with reproducible evidence;
+4. keep releases, CI, and the public maintenance trail current;
+5. never request artificial stars, forks, or empty PRs.
+
+OpenAI reviews applications continuously. If additional evidence is requested, provide a fresh public snapshot and the anonymized outcome of subsequent real-world audits.