Rebuild Vibeflow as an n8n safety gate

.github/DISCUSSION_TEMPLATE/ideas.yml

@@ -1,20 +0,0 @@
-title: Ideas
-labels: [ideas]
-body:
-  - type: textarea
-    id: summary
-    attributes:
-      label: Idea summary
-      description: What would you like to see in Vibeflow n8n?
-    validations:
-      required: true
-  - type: textarea
-    id: problem
-    attributes:
-      label: Problem
-      description: What problem would this solve?
-  - type: textarea
-    id: sketch
-    attributes:
-      label: Proposed approach
-      description: Share a rough implementation idea or usage example.

.github/DISCUSSION_TEMPLATE/show-and-tell.yml

@@ -1,15 +0,0 @@
-title: Show and tell
-labels: [show-and-tell]
-body:
-  - type: textarea
-    id: built
-    attributes:
-      label: What did you build?
-      description: Share the workflow, recipe, or automation you created with Vibeflow n8n.
-    validations:
-      required: true
-  - type: textarea
-    id: notes
-    attributes:
-      label: Notes
-      description: What worked well, what was tricky, and what should improve?

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,22 @@
+name: Bug report
+description: Report incorrect CLI behavior
+title: "bug: "
+labels: [bug]
+body:
+  - type: textarea
+    attributes:
+      label: Minimal workflow
+      description: Attach an anonymized workflow or the smallest JSON that reproduces the problem. Never include credentials.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Command and output
+      render: shell
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: Vibeflow and Node.js versions
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,28 +0,0 @@
----
-name: Bug report
-about: Report a problem in behavior, docs, examples, or packaging
----
-
-## Summary
-
-Describe the bug.
-
-## Expected behavior
-
-What should have happened?
-
-## Actual behavior
-
-What happened instead?
-
-## Where it appears
-
-- [ ] docs
-- [ ] prompt / skill behavior
-- [ ] examples
-- [ ] client guide
-- [ ] recipes
-
-## Additional context
-
-Add logs, screenshots, or reproduction notes.

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
-blank_issues_enabled: true
+blank_issues_enabled: false
 contact_links:
-  - name: Questions and setup help
-    url: https://github.com/OWNER/REPO/discussions
-    about: Use Discussions for setup questions, ideas, and help requests.
+  - name: Private security report
+    url: https://github.com/domfelipe/vibeflow-n8n/security/advisories/new
+    about: Report vulnerabilities and sensitive findings privately.

.github/ISSUE_TEMPLATE/false-positive.yml

@@ -0,0 +1,23 @@
+name: False positive
+description: Report a policy finding that should not fire
+title: "false-positive: "
+labels: [false-positive]
+body:
+  - type: input
+    attributes:
+      label: Rule ID
+      placeholder: VF006
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Anonymized workflow fragment
+      description: Include relevant nodes and connections without secrets or customer data.
+      render: json
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Why the workflow is safe
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,20 +0,0 @@
----
-name: Feature request
-about: Suggest an improvement, new recipe, or new client support idea
----
-
-## Summary
-
-Describe the improvement.
-
-## Why it matters
-
-What problem does it solve?
-
-## Proposed shape
-
-Describe your preferred implementation.
-
-## Additional context
-
-Links, examples, or related tools.

.github/ISSUE_TEMPLATE/good-first-issue.md

@@ -1,25 +0,0 @@
----
-name: Good first issue
-about: Template for starter tasks to help new contributors join the project.
-title: "[good first issue] "
-labels: ["good first issue"]
-assignees: []
----
-
-## Goal
-
-Describe the task in one or two sentences.
-
-## Why it matters
-
-Explain how this improves the project.
-
-## Acceptance criteria
-
-- [ ]
-- [ ]
-- [ ]
-
-## Helpful context
-
-Add links, files, or examples that make this easier to complete.

.github/ISSUE_TEMPLATE/rule-proposal.yml

@@ -0,0 +1,33 @@
+name: Policy rule proposal
+description: Propose a deterministic check backed by exported workflow JSON
+title: "rule: "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: failure
+    attributes:
+      label: Production failure
+      description: What concrete failure would this rule prevent?
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Static evidence
+      description: Which exported JSON fields prove the unsafe and safe cases?
+    validations:
+      required: true
+  - type: textarea
+    id: fixtures
+    attributes:
+      label: Minimal fixtures
+      description: Paste anonymized unsafe and safe examples, or link to a branch containing them.
+    validations:
+      required: true
+  - type: textarea
+    id: false-positives
+    attributes:
+      label: False-positive boundary
+      description: When should this rule deliberately stay silent?
+    validations:
+      required: true

.github/labels-suggested.md

@@ -1,17 +0,0 @@
-# Suggested labels
-
-Create these labels after launch:
-
-- good first issue
-- help wanted
-- documentation
-- recipes
-- schemas
-- design
-- release
-- ideas
-- show-and-tell
-- client:codex
-- client:claude-code
-- client:opencode
-- client:openclaude

.github/pull_request_template.md

@@ -1,14 +1,11 @@
-## What changed
+## Risk addressed
 
-Describe the main changes in this PR.
+Describe the workflow failure or false positive this change addresses.
 
-## Why
+## Evidence
 
-Explain the problem or improvement.
-
-## Checklist
-
-- [ ] Docs updated if behavior changed
-- [ ] Examples updated if needed
-- [ ] Changelog updated if user-visible
-- [ ] No unsafe assumptions introduced
+- [ ] Added or updated a minimal unsafe fixture.
+- [ ] Added a safe fixture or regression test.
+- [ ] `npm run verify` passes.
+- [ ] No credentials or customer data are included.
+- [ ] Policy and Codex documentation match the implementation.

.github/release-checklist.md

@@ -1,10 +0,0 @@
-# Release checklist
-
-- bump `VERSION`
-- update `CHANGELOG.md`
-- verify README links
-- verify placeholder endpoints are clearly marked
-- test one workflow recipe end to end
-- create Git tag
-- publish GitHub release notes
-- announce supported clients and best-effort clients clearly

.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: CI
+
+on:
+  push:
+    branches: [main, "codex/**"]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Node ${{ matrix.node-version }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [20, 22, 24]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - run: npm test
+      - run: npm run check
+      - run: npm pack --dry-run
+
+  integration:
+    name: GitHub Action and policy fixtures
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+      - name: Exercise the local GitHub Action
+        uses: ./
+        with:
+          path: examples/safe-support-agent.workflow.json
+          output: vibeflow.sarif
+      - name: Ensure unsafe fixture is rejected
+        run: |
+          if node bin/vibeflow.mjs check examples/unsafe-support-agent.workflow.json --format sarif --output unsafe.sarif; then
+            echo "Unsafe fixture unexpectedly passed"
+            exit 1
+          fi
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: vibeflow-sarif
+          path: |
+            vibeflow.sarif
+            unsafe.sarif

.github/workflows/markdown-lint.yml

@@ -1,16 +0,0 @@
-name: Markdown Check
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  markdown-check:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: List markdown files
-        run: |
-          find . -type f \( -name "*.md" -o -name "VERSION" \) | sort