vibeflow-n8n/docs/release-audit.md

Release audit — v0.9.0 candidate

Target release: 2026-07-24

Decision

APTO COM RESSALVAS for the Friday release, pending merge, tag, and released-install checks listed below.

No blocking defect remains in the reviewed static-analysis boundary. Vibeflow can verify structural evidence in an exported workflow, but it cannot enforce authorization, amount limits, counterparty identity, audit durability, or recovery behavior in the executing systems.

QA evidence

• 36 automated tests pass, including safe and unsafe support workflows and a fully contracted refund workflow.
• The unsafe refund fixture detects an ordinary HTTP node as a money outcome and produces VF010, VF012, and VF013.
• The contracted refund fixture exits 0 in normal and --locked modes.
• Text, JSON, SARIF, configuration validation, package packing, and CLI exit behavior are exercised.
• npm run verify, npm audit --omit=dev, JSON parsing, and git diff --check pass locally.
• The package remains dependency-free and targets Node.js 20+.

Red Team

The first v0.9 implementation was hardened after adversarial review. Regression tests now cover:

1. ordinary HTTP refunds that would evade a dangerous-node-only policy;
2. read-only refund queries, preventing an obvious classifier false positive;
3. named or disconnected approval, amount, counterparty, audit, and idempotency controls;
4. constant approval conditions and decorative amount values;
5. read-only or fail-open audit nodes, including an audit error branch that still reaches the action;
6. fail-open idempotency nodes and idempotency error branches that still reach the side effect;
7. prototype-like contract keys, self-referential notification/recovery evidence, and audit-like labels used to hide a money action;
8. connected error paths that terminate without a recognized operator notification.

The graph checks use actual main edges, require dominating controls, and reject evidence that reaches the action after the control itself fails.

Guardião security review

In scope

• local CLI parsing of untrusted workflow/configuration JSON;
• graph and parameter analysis;
• text, JSON, and SARIF output;
• npm package contents, GitHub Action boundary, and Codex plugin instructions.

Controls confirmed

• no runtime dependencies, telemetry, hosted service, or live n8n mutation;
• no workflow expressions or embedded code are evaluated;
• no URLs found in a workflow are contacted;
• file, node, edge, contract, vocabulary, and finding budgets are bounded;
• terminal text is sanitized and prototype-like contract keys are handled as data;
• the GitHub Action uses locked policy mode so a pull request cannot disable its own built-in checks;
• examples contain credential references and reserved invalid domains, not live secrets.

Residual limitations

• an exported graph cannot prove a referenced credential, approval identity, SQL policy, external API limit, notification, or compensation works at runtime;
• custom/community nodes may need explicit impact declarations or new regression-backed adapters;
• repository owners may intentionally weaken policy outside --locked mode;
• remote Node 20/22/24 CI passed; released npx/plugin installation can only be confirmed after the candidate is tagged.

Release blockers

• Pull request CI passes on Node.js 20, 22, and 24.
• Release commit is merged without unrelated changes.
• v0.9.0 tag and GitHub release are published on 2026-07-24.
• Released CLI and Codex plugin install paths are smoke-tested.

Final gate

There are zero known critical or high security findings in the candidate. The release remains APTO COM RESSALVAS until the remaining remote gates above are complete; a failed gate blocks publication or requires an immediate corrective release.