vibeflow-n8n/docs/codex-for-oss-application.md

Codex for Open Source — submission pack

Application: https://openai.com/pt-BR/form/codex-for-oss/

Program overview: https://developers.openai.com/community/codex-for-oss

Program terms: https://learn.chatgpt.com/docs/codex-for-oss-terms

Prepared: 2026-07-22

Recommendation

Submit in English, even through the PT-BR form. OpenAI publishes no language requirement and no evidence that language changes selection odds. English is recommended only to reduce translation friction for a global technical review.

Submit immediately after the v0.9.0 release on 2026-07-24. Do not wait for arbitrary star, fork, or PR targets. Vibeflow's strongest evidence is its Codex-native engineering, first real 92-node audit, and a public maintenance loop that turned community feedback into tested policy features.

Copy-and-paste form

First name

Felipe

Last name

Domingues

Email

[FILL PRIVATELY: email associated with the ChatGPT account]

GitHub username

domfelipe

GitHub repository URL

https://github.com/domfelipe/vibeflow-n8n

Maintainer role

Select: Principal maintainer.

Why is this repository eligible?

Recount before submission; keep under 500 characters.

Vibeflow is an MIT-licensed safety gate for AI-generated n8n workflows, rebuilt end-to-end with Codex. It audited a real 92-node workflow in read-only mode, finding 3 blocking risks and 57 warnings. Community feedback then shaped v0.9: outcome-aware checks for refunds, customer actions, silent failures, audit, idempotency, approval, limits, and recovery.

Interests

Select both:

• Codex Security
• API credits for my project

OpenAI Organization ID

[FILL PRIVATELY: org-...]

Use the organization that should receive the API credits. Confirm it in the OpenAI Platform before submitting; do not place it in this public document.

How will API credits be used?

Character count: 390/500.

API credits would power OSS maintenance workflows: turn anonymized failures into adversarial fixtures, evaluate new policies, reproduce false positives, review contributed rules, triage issues, and generate release audits. Codex would assist these workflows; the Vibeflow scanner will remain local, dependency-free, telemetry-free, and will not upload or process private customer workflows.

Anything else we should know?

Recount before submission; keep under 500 characters.

Vibeflow is a public case study in Codex-native OSS development. Codex drove the project from product repositioning through implementation, adversarial review, remediation, CI, plugin packaging, releases, a real-workflow audit, and the v0.9 response to user feedback. Adoption is early, but the engineering, maintenance history, and real-world evidence are public and reproducible.

PT-BR review translation

These translations are for review only. Paste the English versions above into the form.

Repository eligibility

Vibeflow é um gate MIT de segurança para workflows n8n gerados por IA, reconstruído de ponta a ponta com Codex. Ele auditou em modo somente leitura um workflow real de 92 nós, encontrando 3 riscos bloqueantes e 57 avisos. O feedback da comunidade então moldou a v0.9: checks de resultados reais para reembolsos, ações com clientes, falhas silenciosas, auditoria, idempotência, aprovação, limites e recuperação.

API-credit use

Os créditos financiariam fluxos de manutenção OSS: transformar falhas anonimizadas em fixtures adversariais, avaliar novas políticas, reproduzir falsos positivos, revisar regras contribuídas, triar issues e gerar auditorias de release. O Codex auxiliaria esses fluxos; o scanner Vibeflow permanecerá local, sem dependências ou telemetria, e não enviará nem processará workflows privados de clientes.

Additional context

Vibeflow é um estudo de caso público de desenvolvimento open source nativo em Codex. O Codex conduziu o projeto desde o reposicionamento e implementação até revisão adversarial, correções, CI, plugin, releases, auditoria de workflow real e a resposta da v0.9 ao feedback de usuários. A adoção ainda é inicial, mas a engenharia, o histórico de manutenção e a evidência real são públicos e reproduzíveis.

Evidence map

Use these links only if OpenAI requests verification; the form has no dedicated evidence field.

• Public MIT repository: https://github.com/domfelipe/vibeflow-n8n
• Executable release after Friday launch: https://github.com/domfelipe/vibeflow-n8n/releases/tag/v0.9.0
• Reproducible demo: https://github.com/domfelipe/vibeflow-n8n/blob/main/docs/demo.md
• Release and Red Team audit: https://github.com/domfelipe/vibeflow-n8n/blob/main/docs/release-audit.md
• CI history: https://github.com/domfelipe/vibeflow-n8n/actions/workflows/ci.yml
• Launch discussion: https://github.com/domfelipe/vibeflow-n8n/discussions/3
• Engineering PRs: https://github.com/domfelipe/vibeflow-n8n/pulls?q=is%3Apr+is%3Amerged

Evidence snapshot

Refresh this section on 2026-07-24 immediately before submission. Current candidate evidence:

• public repository with MIT license;
• v0.9.0 release candidate, with v0.8.0 already public;
• 36 adversarial tests passing locally and in remote Node.js 20, 22, and 24 CI;
• dependency-free CLI, GitHub Action, and installable Codex plugin;
• 3 prior maintainer PRs merged with green CI; add the v0.9 PR after merge;
• 2 stars, 0 forks, and no verified external contributor yet;
• first real audit: anonymized 92-node workflow, 3 blocking findings, 57 warnings, no workflow mutation;
• Codex used across product repositioning, implementation, review, Red Team, remediation, packaging, CI, release, real-workflow audit, and the community-feedback-driven v0.9 cycle.

Do not describe maintainer PRs, the maintainer's own workflow, clones, or unattributed stars as external adoption.

Confidentiality boundary

Do not submit or link the full real-workflow audit. Application materials must not include:

• client, clinic, or workflow names;
• remote workflow IDs, version IDs, hashes, or timestamps;
• node names that reveal business logic;
• private workflow JSON, credentials, customer data, or infrastructure identifiers.

The approved public description is: “a real, production-scale 92-node conversational workflow audited in read-only mode.”

Submission checklist

• Repository is public and not archived.
• GitHub username is public.
• Role is principal maintainer.
• Repository URL is correct.
• Both requested benefits are selected.
• All narrative answers are under 500 characters.
• Real-workflow evidence is anonymized.
• Early adoption is described honestly.
• Insert the exact ChatGPT-account email.
• Insert and verify the OpenAI Organization ID.
• Re-read the current Program Terms immediately before submission.
• Save the confirmation page and submission timestamp privately.

After submission

Continue collecting organic evidence without delaying the application:

1. publish the v0.9 follow-up in r/n8n;
2. invite users to report anonymized false positives and missed unsafe cases;
3. respond to every issue or discussion with reproducible evidence;
4. keep releases, CI, and the public maintenance trail current;
5. never request artificial stars, forks, or empty PRs.

OpenAI reviews applications continuously. If additional evidence is requested, provide a fresh public snapshot and the anonymized outcome of subsequent real-world audits.