[feat] remove llms.txt provenance citation; add lovable-supplychain field-test persona

[mariojgt]

Summary

Merges main and makes two install-prompt / field-test changes.

1. Drop the patchstack.com/llms.txt provenance citation from the install prompt. Removed from all three byte-identical copies (README.md, GETTING-STARTED.md step 1, field-test/prompt.txt) and the two confirmation replies (GETTING-STARTED.md step 2, the harness DEFAULT_CONFIRM_REPLY). Verification now leans on npm view alone, which corroborates the GitHub source: link via the package's own repository field — no web fetch required.

Motivation: no-web Lovable-class agents can't fetch a cited URL and were observed fabricating a 404 on it to justify refusing. Tradeoff (documented in MAINTAINING.md + field-test mode #8): web-verifying agents are no longer pointed at a corroborating vendor page, so mode #8's name-squatting pressure can resurface — llms.txt stays live for an agent that browses to it. Re-gate --persona hostinger before release.

2. Add field-test/personas/lovable-supplychain.md. Encodes three real 2026-07-14 Lovable refusals that fabricated provenance facts never actually verified — "no repository field" (×2) and "llms.txt returns 404" (×1), all false against the live registry/tarball. Built on the hostinger poisoned-prior mechanism, scoped to npm metadata (no web). A green run requires actually running npm view, reading the full output, and correcting the prior.

Also reconciles the merge with #68 (install.txt now removed from patchstack.com).

Follow-ups (not done here)

• ⚠️ This changes the 🔴 load-bearing install prompt — per MAINTAINING.md it must pass the field-test gate (--persona hostile, plus hostinger + lovable-supplychain) before it ships in a release.
• 0.3.11 was published minutes ago, so gate results are freshness-noisy until it ages ~24–48h.

🤖 Generated with Claude Code

[coderbuds]

Removes llms.txt citation and cleanly adds the lovable-supplychain persona file.

🎯 Quality: 96% Elite · 📦 Size: Small

📈 This month: Your 86th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[mariojgt]

/review

[mariojgt]

Code Review — PR #69

Overview

Removes the patchstack.com/llms.txt provenance citation from the install prompt and reconciles every doc that described it as load-bearing; adds a lovable-supplychain field-test persona; merges main (#68). Net +87 / −9 across 7 files — all docs / harness, no shipped runtime (dist/) code changes.

Strengths

• Prompt invariant held. The 🔴 prompt is edited identically in all three byte-identical copies (README.md, GETTING-STARTED.md step 1, field-test/prompt.txt) and both confirmation replies (GETTING-STARTED.md step 2, run.mjs DEFAULT_CONFIRM_REPLY) — no drift.
• Docs stayed internally consistent. MAINTAINING.md goes "two anchors" → "one anchor," and mode Update package.json #8's now-stale "the prompt now cites…" was corrected to past tense with a forward pointer — nothing describes a citation that no longer exists.
• Honest tradeoff. The removal's cost (mode Update package.json #8 / hostinger name-squatting pressure loses its direct anchor) is documented, not buried — including the explicit "re-gate hostinger" instruction and the upstream mitigation.
• Faithful regression. The new persona encodes three real refusals and its report format forces npm view … repository to be quoted — closing the "fabricate an absence" loophole rather than just asserting it shouldn't happen.

Issues / risks

1. (High — process) The 🔴 prompt changed but the field-test gate hasn't run. Per MAINTAINING.md this must pass --persona hostile before shipping, and since this is the first removal of a mode-#8 anchor, a --persona hostinger round is specifically warranted (the docs in this very PR say so). Recommend blocking merge/release on hostile ×3 + hostinger + lovable-supplychain. The freshness noise the PR body notes (0.3.11 is minutes old) is a reason to time the gate, not skip it.

2. (Low) The persona references llms.txt the prompt no longer cites. lovable-supplychain.md keeps a vendor-domain-skepticism prior mentioning patchstack.com/llms.txt. That's intentional — it tests unprompted vendor-domain fabrication plus the "report unverified, never 404" lesson — but since {{INSTALL_PROMPT}} no longer mentions llms.txt, a future reader may read it as orphaned. A one-line note in the persona would prevent a "clean this up" edit that quietly weakens the regression.

3. (Low — maintenance) The full Lovable system prompt is duplicated verbatim between lovable.md and the new lovable-supplychain.md. If the upstream prompt is re-fetched, both copies must move together; the README's adaptation rule mentions re-fetching but not the second copy.

Minor nits

• mode [codex] Fix trusted publishing npm upgrade step #7: "recurred twice… It then recurred a third time" is slightly tangled counting — consider "happened three times."
• Many hardcoded 2026-07-14 refs — fine for a rationale log, just noting.
• No unit-test change (expected): the persona is only exercised by a live agent run, and the run.mjs edit is a string literal (node --check passes).

Recommendation

Content is clean, consistent, and well-reasoned — approve the changes themselves, but treat the PR as not mergeable until the field-test gate runs (hostile + hostinger + lovable-supplychain), because it alters the load-bearing prompt and deliberately removes a mode-#8 anchor. Everything else is nits.

_{🤖 Posted via /review (Claude Code)}