vibeflow-n8n/docs/community-launch-v0.9.md

Community launch pack — v0.9.0

Publish only after the public v0.9.0 release URL works.

Feedback provenance

The v0.9 scope came from the public original r/n8n launch thread, not a speculative roadmap.

Community feedback	v0.9 response
Separate dangerous nodes from dangerous outcomes	VF010 and VF011 classify money, customer, privileged, and destructive-data actions.
Require idempotency, approval, amount/counterparty limits, and durable audit	outcomeContracts verifies graph evidence for those controls.
Error paths can exist but notify nobody	VF012 requires an operator-visible failure path.
Writes need rollback or replay stories	VF013 requires compensation, rollback, or replay evidence.
Static checks cannot replace runtime guardrails	The CLI and documentation explicitly preserve that boundary.

Captured on 2026-07-22: the thread had 3 votes and several substantive comments. Treat the comments as product evidence; do not present the vote count as broad adoption.

Reddit — r/n8n

Title

I built your feedback into Vibeflow v0.9: outcome-aware preflight checks for n8n workflows

Post

I shared Vibeflow here earlier and two pieces of feedback changed the direction of the project:

1. A dangerous outcome is not the same thing as a dangerous node. A normal HTTP node can still issue a refund, send a payment, notify a customer, change access, or delete data.
2. A connected error branch is not enough if it silently terminates, and a write is not production-ready without a rollback, compensation, or replay story.

That feedback is now implemented in Vibeflow v0.9.

Vibeflow is a local, dependency-free preflight checker for exported n8n workflow JSON. The new release adds:

• VF010: blocks money and privileged actions without an outcome contract;
• VF011: warns about uncontracted customer communications and destructive writes;
• VF012: detects error paths that notify nobody;
• VF013: requires compensation, rollback, or replay evidence.

For a contracted action, the checker verifies structural evidence in the workflow graph:

• an atomic idempotency claim cannot be bypassed;
• a durable audit write happens before the action;
• approval, amount, and counterparty checks have real allow/deny branches;
• the failure notification is connected to the action's error output;
• recovery is represented in the graph.

The important boundary: this is static preflight, not runtime enforcement. The payment/customer system must still enforce authorization, limits, counterparties, durable audit, and recovery at runtime.

There is a reproducible unsafe refund workflow and a passing contracted version in the repository:

https://github.com/domfelipe/vibeflow-n8n

Release: https://github.com/domfelipe/vibeflow-n8n/releases/tag/v0.9.0

I am especially looking for anonymized examples of:

• a real-world action the classifier misses;
• a false positive where the workflow is demonstrably safe;
• a control that looks present in JSON but can still be bypassed;
• a recovery pattern that does not fit compensate/rollback/replay.

Please remove credentials and customer data before sharing workflow fragments. The best reports will become paired unsafe/safe regression fixtures.

Short reply to the original commenters

Your distinction between dangerous nodes and dangerous outcomes became the core of v0.9. The release now detects ordinary HTTP/database/message nodes by impact and validates idempotency, approval, amount/counterparty limits, durable audit, operator-visible failures, and recovery evidence. I kept runtime enforcement explicitly outside the claim. Thank you — this materially improved the project.

GitHub Discussion

Title

Vibeflow v0.9: help test outcome contracts against real n8n workflows

Body

Vibeflow v0.9 adds outcome-aware preflight policies for money, customer, privileged, and destructive-data actions. The implementation was driven by community feedback that ordinary nodes can still produce dangerous real-world outcomes.

Please test an exported workflow and report anonymized false positives, missed actions, bypassable controls, or recovery patterns. Useful reports need a minimal unsafe case, the expected safe case, and the exported JSON fields that distinguish them.

• Release: https://github.com/domfelipe/vibeflow-n8n/releases/tag/v0.9.0
• Demo: https://github.com/domfelipe/vibeflow-n8n/blob/v0.9.0/docs/demo.md
• False-positive report: https://github.com/domfelipe/vibeflow-n8n/issues/new?template=false-positive.yml
• Policy proposal: https://github.com/domfelipe/vibeflow-n8n/issues/new?template=rule-proposal.yml

Never attach credentials, customer data, or a private production workflow.

Evidence rules

• Do not ask for artificial stars, forks, or empty PRs.
• Record only public, attributable usage or anonymized audit outcomes.
• Convert actionable feedback into an issue and paired unsafe/safe fixture.
• Never publish customer workflow names, IDs, node names, credentials, or infrastructure identifiers.