Rebuild Vibeflow as an n8n safety gate

docs/release-audit.md

@@ -0,0 +1,54 @@
+# Release audit — v0.8.0
+
+Date: 2026-07-22
+
+## Decision
+
+**APTO COM RESSALVAS** for the first public executable release.
+
+No blocking defect remains in the reviewed static-analysis boundary. The remaining caveats require runtime or node-specific knowledge that an exported JSON gate cannot prove.
+
+## QA evidence
+
+- 26 automated tests pass, including one safe and one intentionally unsafe workflow.
+- The safe fixture produces zero findings; the unsafe fixture produces VF001-VF009.
+- Text, JSON, and SARIF output paths are exercised.
+- Node 20, 22, and 24 are required in CI; local verification used the available Node runtime and the remote matrix is the release gate.
+- JSON/YAML parsing, package dry-run, official skill/plugin validators, `npm audit`, and `git diff --check` are part of the final gate.
+
+## Red Team
+
+The first implementation was rejected. Regression tests now cover the reproduced bypasses:
+
+- declared webhook authentication without the matching credential reference;
+- literal secrets in raw headers, URLs, expressions, pinned data, and static data;
+- disconnected, nominal, or non-gating idempotency controls;
+- parallel AI paths that bypass a kill switch, inverted or constant conditions, and decorative Code/NoOp nodes;
+- resource connections misread as control flow and fabricated connection shapes;
+- disconnected or cyclic error handling;
+- read-only HTTP requests mislabeled as handoff;
+- excessive or non-numeric timeouts and unsafe retry settings;
+- policy weakening from an untrusted checkout;
+- terminal-control injection, deep JSON, excessive nodes/edges/files/config terms, finding amplification, and quadratic traversal.
+
+At the 5,000-node limit, the corrected linear traversal completed the synthetic chain in tens of milliseconds on the development machine. Finding truncation always adds blocking VF000.
+
+## Supply chain
+
+- GitHub-owned actions are pinned to full verified commit SHAs.
+- Checkout credentials are not persisted; workflow permissions are `contents: read`.
+- Jobs have a ten-minute timeout and package installation ignores scripts.
+- The package has no runtime dependencies and uses a publish allowlist.
+- The bundled action always enables `--locked`.
+
+The first merge SHA must replace mutable self-references in the README and Codex skill before the release tag is created.
+
+## Residual limitations
+
+- Static analysis cannot prove a referenced credential exists or works.
+- SQL and IF checks are high-confidence structural evidence, not runtime execution proofs.
+- An HTTP POST labeled as a ticket or handoff may still fail or target the wrong service.
+- Unknown community nodes may require a new side-effect adapter and regression fixture.
+- Repository owners must still review changes to the CI workflow itself.
+
+The official Codex Security workspace was opened, but its setup was never submitted through the app interface; no result from that scanner is claimed here. The release decision is based on the direct QA, independent Red Team, supply-chain review, and regression evidence above.