mirror of
https://github.com/domfelipe/vibeflow-n8n.git
synced 2026-08-07 11:36:44 +00:00
f62a78faaf
Add VF010-VF013, structural outcome contracts, adversarial fixtures, documentation, and Friday release materials.
70 lines
3.7 KiB
Markdown
70 lines
3.7 KiB
Markdown
# Release audit — v0.9.0 candidate
|
|
|
|
Target release: 2026-07-24
|
|
|
|
## Decision
|
|
|
|
**APTO COM RESSALVAS** for the Friday release, pending merge, tag, and released-install checks listed below.
|
|
|
|
No blocking defect remains in the reviewed static-analysis boundary. Vibeflow can verify structural evidence in an exported workflow, but it cannot enforce authorization, amount limits, counterparty identity, audit durability, or recovery behavior in the executing systems.
|
|
|
|
## QA evidence
|
|
|
|
- 36 automated tests pass, including safe and unsafe support workflows and a fully contracted refund workflow.
|
|
- The unsafe refund fixture detects an ordinary HTTP node as a money outcome and produces VF010, VF012, and VF013.
|
|
- The contracted refund fixture exits 0 in normal and `--locked` modes.
|
|
- Text, JSON, SARIF, configuration validation, package packing, and CLI exit behavior are exercised.
|
|
- `npm run verify`, `npm audit --omit=dev`, JSON parsing, and `git diff --check` pass locally.
|
|
- The package remains dependency-free and targets Node.js 20+.
|
|
|
|
## Red Team
|
|
|
|
The first v0.9 implementation was hardened after adversarial review. Regression tests now cover:
|
|
|
|
1. ordinary HTTP refunds that would evade a dangerous-node-only policy;
|
|
2. read-only refund queries, preventing an obvious classifier false positive;
|
|
3. named or disconnected approval, amount, counterparty, audit, and idempotency controls;
|
|
4. constant approval conditions and decorative amount values;
|
|
5. read-only or fail-open audit nodes, including an audit error branch that still reaches the action;
|
|
6. fail-open idempotency nodes and idempotency error branches that still reach the side effect;
|
|
7. prototype-like contract keys, self-referential notification/recovery evidence, and audit-like labels used to hide a money action;
|
|
8. connected error paths that terminate without a recognized operator notification.
|
|
|
|
The graph checks use actual `main` edges, require dominating controls, and reject evidence that reaches the action after the control itself fails.
|
|
|
|
## Guardião security review
|
|
|
|
### In scope
|
|
|
|
- local CLI parsing of untrusted workflow/configuration JSON;
|
|
- graph and parameter analysis;
|
|
- text, JSON, and SARIF output;
|
|
- npm package contents, GitHub Action boundary, and Codex plugin instructions.
|
|
|
|
### Controls confirmed
|
|
|
|
- no runtime dependencies, telemetry, hosted service, or live n8n mutation;
|
|
- no workflow expressions or embedded code are evaluated;
|
|
- no URLs found in a workflow are contacted;
|
|
- file, node, edge, contract, vocabulary, and finding budgets are bounded;
|
|
- terminal text is sanitized and prototype-like contract keys are handled as data;
|
|
- the GitHub Action uses locked policy mode so a pull request cannot disable its own built-in checks;
|
|
- examples contain credential references and reserved invalid domains, not live secrets.
|
|
|
|
### Residual limitations
|
|
|
|
- an exported graph cannot prove a referenced credential, approval identity, SQL policy, external API limit, notification, or compensation works at runtime;
|
|
- custom/community nodes may need explicit impact declarations or new regression-backed adapters;
|
|
- repository owners may intentionally weaken policy outside `--locked` mode;
|
|
- remote Node 20/22/24 CI passed; released `npx`/plugin installation can only be confirmed after the candidate is tagged.
|
|
|
|
## Release blockers
|
|
|
|
- [x] Pull request CI passes on Node.js 20, 22, and 24.
|
|
- [ ] Release commit is merged without unrelated changes.
|
|
- [ ] `v0.9.0` tag and GitHub release are published on 2026-07-24.
|
|
- [ ] Released CLI and Codex plugin install paths are smoke-tested.
|
|
|
|
## Final gate
|
|
|
|
There are zero known critical or high security findings in the candidate. The release remains **APTO COM RESSALVAS** until the remaining remote gates above are complete; a failed gate blocks publication or requires an immediate corrective release.
|