Greenhorn / literal onboarding audit

vis-timeline-1ea88beb

DEAD END
visjs/vis-timeline @ e04fdef4 2026-07-18 15:57:44 UTC Codex · gpt-5.6-terra (build default) GPT-5.6 Luna · Azure AI Foundry (build default) Transcript JSON

Documentation finding

The literal path stopped here.

Then, the project can be build running: $ npm run build
npm run buildAMBIGUOUSAMBIGUOUS

The command itself is documented, but its stated prerequisite is unresolved in the supplied state.

SHELL RECEIVED: NO

Evidence, in order

Command lifecycles

A proposed command, its independent ruling, and its Docker result share one step. Nothing is silently skipped.

  1. 1

    Documentation scope

    Greenhorn loaded docs

    Documentation scope

    Loaded 3 documentation files (depth ≤2, cap 6; external links disabled).

  2. 2

    Command lifecycle

    Codex proposedGPT-5.6 ruledDocker executed
    npm installLICENSEDFRICTION
    Documentation evidenceTo install all dependencies and build the library, run `npm install` in the root of the project.

    The documentation explicitly names the proposed command and its required root-project context; the supplied state confirms the repository is an npm-managed Node project.

    Literal readings considered
    • The proposed command is explicitly documented for installing all project dependencies in the repository root.
    • The state identifies this as an npm-managed Node project.

    SHELL RECEIVED: YESAccepted command reached the isolated Docker executor.

    Docker resultexit 0
    Show command output
    > vis-timeline@0.0.0-no-version prepare
> husky

fatal: not in a git directory

added 1229 packages, and audited 1373 packages in 2m

246 packages are looking for funding
  run `npm fund` for details

14 vulnerabilities (4 low, 2 moderate, 8 high)

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

npm warn deprecated whatwg-encoding@3.1.1: Use @exodus/bytes instead for a more spec-conformant and faster implementation
npm warn deprecated stable@0.1.8: Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility
npm warn deprecated sliced@1.0.1: Unsupported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated folktale@2.3.2: This package is no longer actively maintained. Only security patches will be provided, if needed. Consider switching to fp-ts.
npm warn deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
npm warn deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm warn deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm warn deprecated @babel/plugin-proposal-object-rest-spread@7.20.7: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-object-rest-spread instead.
npm warn deprecated debug@4.1.1: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm notice
npm notice New major version of npm available! 10.9.8 -> 12.0.1
npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.0.1
npm notice To update run: npm install -g npm@12.0.1
npm notice
  3. 3

    Command lifecycle

    Codex proposedGPT-5.6 ruledShell blocked
    npm run buildAMBIGUOUSAMBIGUOUS
    Documentation evidenceThen, the project can be build running: $ npm run build

    The command itself is documented, but its stated prerequisite is unresolved in the supplied state.

    Literal readings considered
    • The command is explicitly documented for building the library from source.
    • The documentation requires running npm install first, but the supplied state does not establish that dependencies are installed.

    SHELL RECEIVED: NOBlocked before any shell process was created.

Documentation corpus

What the newcomer could read

  • README.mdlocal
  • LICENSE.Apache-2.0.txtlocal
  • LICENSE.MIT.txtlocal
Depth cap
≤2 links
Document cap
6 files
External links
Disabled
Corpus limit hit
No

Environment & boundary

How the run was contained

Source
https://github.com/visjs/vis-timeline
Revision
e04fdef4a4b82f99b0e7ff09da3dc02a182859f4
Executor
docker
Contract enforcer
GPT-5.6 Luna · Azure AI Foundry (build default)
Read the isolation statement

Ubuntu 24.04 container, new filesystem state, source copied inside at run start. Codex reasons in a separate empty host scratch directory; the Azure GPT-5.6 key stays on the host. Only accepted commands reach the container shell.

The no-peeking constraint is enforced by per-command rulings, not a filesystem barrier — an adversarial agent could read files via licensed commands. Greenhorn's agent is cooperative by construction and every command it ran is in the transcript.

Read the newcomer contract
You are a brand-new developer on your first day. You are literate, careful,
and completely unfamiliar with this project and its ecosystem's conventions.
1. Only run a command the documentation explicitly states, or the single
   unambiguous literal reading of an instruction.
2. Ambiguous instruction (multiple reasonable readings)? Do not choose.
   Halt that path and record every reading you see.
3. On failure: read the error, re-read the docs for a documented remedy.
   Never debug from your own knowledge.
4. Never install/configure/invoke anything the docs never mentioned.
5. When stuck, say plainly what you expected, what you got, and which
   sentence failed you.
6. Undocumented environment values (keys, URLs) = dead end. Never invent.
Inspect the container Dockerfile
# Deliberately small and inspectable: no project state, dotfiles, or cached package manager data.
FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl git \
 && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 && apt-get install -y --no-install-recommends nodejs \
 && rm -rf /var/lib/apt/lists/* /root/.npm

WORKDIR /workspace
ENTRYPOINT []