Greenhorn / literal onboarding audit

superagent-7e370f9d

NO DOCUMENTED CHECKPOINT
visionmedia/superagent @ 3ef36761 2026-07-18 16:30:16 UTC Codex · gpt-5.6-terra (build default) GPT-5.6 Luna · Azure AI Foundry (build default) Transcript JSON

Run explanation

Setup ran clean; the README never defines done.

A documented setup action completed, but the documentation names no repository test, endpoint, or output marker that Greenhorn can independently verify.

Evidence, in order

Command lifecycles

A proposed command, its independent ruling, and its Docker result share one step. Nothing is silently skipped.

  1. 1

    Documentation scope

    Greenhorn loaded docs

    Documentation scope

    Loaded 1 documentation files (depth ≤2, cap 6; external links disabled).

  2. 2

    Command lifecycle

    Codex proposedGPT-5.6 ruledDocker executed
    npm install superagentLICENSEDFRICTION
    Documentation evidencenpm install superagent

    The documentation explicitly prints the proposed command, so it is licensed. No unsafe shell composition is present.

    Literal readings considered
    • The proposed command exactly matches the npm installation command printed under the Install section.
    • The repository is identified as an npm-managed Node project.

    SHELL RECEIVED: YESAccepted command reached the isolated Docker executor.

    Docker resultexit 0
    Show command output
    added 2060 packages, and audited 2118 packages in 52s

449 packages are looking for funding
  run `npm fund` for details

86 vulnerabilities (8 low, 22 moderate, 46 high, 10 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

npm warn deprecated formidable@1.0.14: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau
npm warn deprecated superagent@0.15.7: Please upgrade to superagent v10.2.2+, see release notes at https://github.com/forwardemail/superagent/releases/tag/v10.2.2 - maintenance is supported by Forward Email @ https://forwardemail.net
npm notice
npm notice New major version of npm available! 10.9.8 -> 12.0.1
npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.0.1
npm notice To update run: npm install -g npm@12.0.1
npm notice
  3. 3

    Literal stop

    Codex stopped

    Literal stop

    I expected the documented install command to establish a documented next step or success state. It exited 0, but the README gives multiple possible continuations—Node usage, Browser usage, or `npx browserslist`—and no sentence selects one; the Install section only states `npm install superagent`.

  4. 4

    Checkpoint assessment

    Greenhorn verified

    Checkpoint assessment

    No documented endpoint or successfully completed documented build/test command was available to verify the success claim.

Documentation corpus

What the newcomer could read

  • README.mdlocal
Depth cap
≤2 links
Document cap
6 files
External links
Disabled
Corpus limit hit
No

Environment & boundary

How the run was contained

Source
https://github.com/visionmedia/superagent
Revision
3ef367619fbb2a8d07082238892ae12dafe4b0b0
Executor
docker
Contract enforcer
GPT-5.6 Luna · Azure AI Foundry (build default)
Read the isolation statement

Ubuntu 24.04 container, new filesystem state, source copied inside at run start. Codex reasons in a separate empty host scratch directory; the Azure GPT-5.6 key stays on the host. Only accepted commands reach the container shell.

The no-peeking constraint is enforced by per-command rulings, not a filesystem barrier — an adversarial agent could read files via licensed commands. Greenhorn's agent is cooperative by construction and every command it ran is in the transcript.

Read the newcomer contract
You are a brand-new developer on your first day. You are literate, careful,
and completely unfamiliar with this project and its ecosystem's conventions.
1. Only run a command the documentation explicitly states, or the single
   unambiguous literal reading of an instruction.
2. Ambiguous instruction (multiple reasonable readings)? Do not choose.
   Halt that path and record every reading you see.
3. On failure: read the error, re-read the docs for a documented remedy.
   Never debug from your own knowledge.
4. Never install/configure/invoke anything the docs never mentioned.
5. When stuck, say plainly what you expected, what you got, and which
   sentence failed you.
6. Undocumented environment values (keys, URLs) = dead end. Never invent.
Inspect the container Dockerfile
# Deliberately small and inspectable: no project state, dotfiles, or cached package manager data.
FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl git \
 && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 && apt-get install -y --no-install-recommends nodejs \
 && rm -rf /var/lib/apt/lists/* /root/.npm

WORKDIR /workspace
ENTRYPOINT []