felipe/vibeflow-n8n
1
0
Fork 0
mirror of https://github.com/domfelipe/vibeflow-n8n.git synced 2026-08-07 06:56:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add outcome-aware preflight contracts for v0.9 (#6)

Browse source 
Add VF010-VF013, structural outcome contracts, adversarial fixtures, documentation, and Friday release materials.
This commit is contained in:
Felipe Domingues 2026-07-22 13:58:46 -03:00 • committed by GitHub
parent b312f18251
commit f62a78faaf
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
23 changed files with 1107 additions and 95 deletions
Download patch file Download diff file Expand all files Collapse all files

32
docs/launch.md
View file

@ -1,22 +1,28 @@
# Launch checklist
# v0.9.0 launch checklist
Target: Friday, 2026-07-24
## Release gate
- [x] `npm run verify` passes on Node.js 20, 22, and 24 in CI.
- [x] Official skill and plugin validators pass.
- [x] Safe fixture exits 0; unsafe fixture exits 1.
- [x] SARIF is valid JSON and uploaded by CI.
- [x] Repository description and topics match the new product.
- [x] `v0.8.0` release notes match `CHANGELOG.md`.
- [x] Remote CLI and pinned Codex marketplace install successfully.
- [x] Private vulnerability reporting and Discussions are enabled.
- [x] VF010-VF013 implementation and configuration schema are complete.
- [x] Safe and unsafe refund fixtures are reproducible.
- [x] Local `npm run verify` and `npm audit --omit=dev` pass.
- [x] QA, adversarial Red Team, and Guardião reviews are documented.
- [x] Pull request CI passes on Node.js 20, 22, and 24.
- [ ] Release commit is merged and tagged `v0.9.0`.
- [ ] Released CLI and pinned Codex marketplace install successfully.
- [ ] GitHub release is published on Friday.
Release: <https://github.com/domfelipe/vibeflow-n8n/releases/tag/v0.8.0>
## Positioning
Launch discussion: <https://github.com/domfelipe/vibeflow-n8n/discussions/3>
The launch message is: **dangerous outcomes are not limited to dangerous nodes**.
A normal HTTP, database, or messaging node can refund money, contact a customer, change access, or destroy data. Vibeflow v0.9 adds a preflight contract for the controls that should surround those outcomes: atomic idempotency, approval, amount and counterparty limits, durable audit, operator-visible failure paths, and recovery.
## Announcement
> Vibeflow is now an executable safety gate for AI-generated n8n workflows. It checks exported JSON for secrets, exposed webhooks, missing kill switches and handoffs, idempotency, failure paths, timeouts, and unsafe retries. It is dependency-free, runs locally or in GitHub Actions, and includes a Codex plugin.
> Vibeflow v0.9 asks a more useful preflight question for generated n8n workflows: not only “is this valid JSON?” or “does it use a dangerous node?”, but “what can this workflow do in the real world if the input is messy or the model is wrong?”
>
> The new outcome contracts detect money, customer, privileged, and destructive-data actions — including ordinary HTTP nodes — and verify structural evidence for idempotency, approval, limits, durable audit, failure notification, and recovery. It is local, dependency-free, CI-friendly, and explicit about what still needs runtime enforcement.
Link to the repository and the safe/unsafe demo. Ask users for anonymized false-positive cases and real workflow fixtures, not stars alone.
Link to the repository and the safe/unsafe refund demo. Ask users for anonymized workflows, classifier false positives/negatives, and missing domain actions.