[feat] provenance-led install prompt (install + check instructions)

[mariojgt]

Summary

Switches the install prompt to the provenance-led wording that avoided refusals on a real hosted-platform run (Horizon), replacing the verify-first prompt. Applied byte-identical across the three canonical copies:

• field-test/prompt.txt, README.md (install-prompt block), GETTING-STARTED.md (step 1)

New prompt:

Please install @patchstack/connect and please check the instructions.

npm: https://www.npmjs.com/package/@patchstack/connect
Repo: https://github.com/patchstack/connect
Publisher: Patchstack
Purpose: Scan project dependencies for known vulnerabilities in CI.
Version: latest

Also reconciled the immediately-adjacent prose that would otherwise contradict the new prompt: the "every clause is load-bearing" framing (it's now provenance-led, not clause-tuned), the claim-URL "when the agent finishes" promise, and step 2's "verification step" reference.

The tradeoff (deliberate, chosen)

• Win: leading with provenance metadata avoids the refusal, matching our own success-report finding.
• Cost: it does not command completion (scan → guide → build hooks + widget), so setup can end half-finished (the agent reads the instructions rather than carrying them out). The scan "what's left" nudge in [feat] surface remaining setup steps after scan + consistent guide labels #72 is the intended backstop. GETTING-STARTED step 2 is reworded to steer users through the half-finish.

⚠️ Doc debt this creates (not addressed here — needs a follow-up)

This prompt discards the adversarial design that other docs still describe:

• MAINTAINING.md (provenance-anchor rules) and field-test/README.md (the 9 refusal modes) document the old verify-first prompt — they're now partly inaccurate for the shipped prompt.
• The field-test/ personas assume the old flow (npm view first step, guide delegation), so a run will score this prompt red on the completion checks (hooksWired, widgetInstalled, claimUrlSurfaced) — expected, given the prompt no longer drives those.

Gating

🔴 load-bearing prompt change — needs a field-test re-gate before release. Given the completion-check reds above, judge a run by refusal reason (does it install without refusing?) rather than the raw scorecard.

🤖 Generated with Claude Code

[coderbuds]

Documentation-driven prompt clarifies provenance and update instructions across guides.

🎯 Quality: 100% Elite · 📦 Size: Small

📈 This month: Your 89th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[mariojgt]

/review

[ejntaylor]

Thanks for testing this. The provenance-led prompt gave us one useful Lovable success, but the follow-up Bolt tests showed it was not reliable as the universal flow: one run installed only and then invented generic CI token/workflow instructions, while three fresh chats refused, and the prompt intentionally left setup incomplete. PR #74 supersedes this with one explicit install && setup transaction, and commit 747549f preserves the provenance experiment and its results in the field-test history. Closing in favor of #74.