Rebuild Vibeflow as an n8n safety gate

docs/codex-for-oss-application.md

@@ -0,0 +1,53 @@
+# Codex for Open Source application gate
+
+Application: <https://openai.com/pt-BR/form/codex-for-oss/>
+
+## Current position
+
+Vibeflow is public, MIT-licensed, owned by its principal maintainer, and aligned with Codex maintainer workflows. Version 0.8.0 establishes active engineering evidence but does not manufacture adoption.
+
+Do not submit until the live evidence section is refreshed and contains external usage.
+
+## Practical submission gate
+
+These are internal quality targets, not official OpenAI thresholds:
+
+- a tagged public release with green CI;
+- at least three unrelated external users or teams with verifiable feedback;
+- at least one external issue, discussion, or pull request with maintainer activity;
+- current traffic, clone, installation, or dependent-project evidence;
+- no confidential information in the application.
+
+## Live evidence
+
+Refresh immediately before submission:
+
+- GitHub stars: `[refresh]`
+- forks: `[refresh]`
+- unique clones in the latest available period: `[refresh]`
+- releases and latest release date: `[refresh]`
+- external contributors: `[refresh]`
+- external users or public references: `[refresh]`
+- maintainer examples: `[refresh issues, reviews, and releases]`
+
+## Form draft
+
+### Role
+
+Principal maintainer.
+
+### Why is this repository eligible?
+
+> Vibeflow is an MIT-licensed safety gate for AI-generated n8n workflows. It catches embedded secrets, unsafe webhooks, missing kill switches, human handoffs, idempotency, error paths, timeouts, and risky retries before deployment. It is maintained as a dependency-free CLI, GitHub Action, and Codex plugin. [Add refreshed external usage evidence before submitting.]
+
+### How will API credits be used?
+
+> Credits will support OSS maintenance: generate adversarial workflow fixtures, run reproducible policy evaluations, review contributed rules in pull requests, explain regressions, and prepare release reports. They will not fund a hosted commercial runtime or process private customer workflows.
+
+### Anything else?
+
+> Vibeflow comes from production lessons operating conversational automations in Brazil. It is deliberately interoperable with n8n and existing MCP tooling: it does not replace builders, it checks their output. The project ships without telemetry and keeps workflow analysis local.
+
+## Final verification
+
+Before submitting, confirm the GitHub profile and repository are public, replace every `[refresh]` marker, verify each form answer remains under 500 characters, and use accurate current evidence only.