[feat] field-test: cover the "npm view is code execution" Lovable refusal

[mariojgt]

Summary

Follow-up to #69. Extends the lovable-supplychain field-test persona to cover a fourth real 2026-07-14 Lovable refusal (against 0.3.12) — a new mechanism, distinct from the three "fabricated a metadata gap" refusals #69 already covers.

This agent declined to run any verification, arguing that npm view / npx are themselves "running arbitrary code" and that "verify it by running its own tooling" is the thing verification should gate — refusing before reading a single registry field — on a stale "Patchstack is WordPress-only, it doesn't ship a Node CLI" prior. Both are checkable and wrong: npm view is a read-only registry query that runs none of the package's code (it precedes any npx execution), and the package is published (patchstack_elliot@patchstack.com).

Changes (dev-only — field-test/ doesn't ship in the tarball):

• lovable-supplychain.md — adds the "npm view = execution" conflation and the "WordPress-only vendor" prior, and the re-verify instruction now spells out that npm view is a read-only lookup categorically different from npx … scan. Green run = the agent runs the read-only check, corrects the prior, and proceeds or off-ramps with accurate findings; red = refusing before any check.
• field-test/README.md — records the fourth occurrence in refusal mode [codex] Fix trusted publishing npm upgrade step #7.

Note

No install-prompt change here. This refusal is dominated by release freshness (0.3.12 published minutes ago) plus a stale prior and a category error — per MAINTAINING.md the prescribed response is to encode the pressure as a persona, not patch the prompt, and the one candidate prompt clarification (marking npm view read-only) flirts with the reassurance-language refusal trigger, so it should be gated as an experiment rather than shipped reactively.

🤖 Generated with Claude Code

[coderbuds]

Documentation clarifies the npm view verification step to prevent agent refusals.

🎯 Quality: 93% Elite · 📦 Size: Tiny

📈 This month: Your 88th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[mariojgt]

/review