Here's my first pass at the scope document for the agent workflow. Input: a GitHub repo URL plus the task description the learner says they finished. Output: a structured review with three fields — evidence_found (file paths and commits), criteria_met (pass or fail per rubric line), and one next_step suggestion. Success criteria: the agent's pass/fail matches a human reviewer on 8 of 10 sample submissions; every criteria_met entry cites at least one piece of evidence; the whole review completes in under two minutes. Non-goals: grading writing style, auto-merging code, or scoring effort. What failure case am I most likely to be missing in this contract?
#The receipts
Every message, exactly as it happened.
A real saved conversation between a learner and Hoolio: every attempt they sent and every hint they earned, in order. The markers in the margin point at the moments worth reading first.
Hint 1
Your output promises a pass/fail for each rubric line, but your input only supplies a repo URL and the learner’s task description. Where does the authoritative rubric come from, and what should the agent do when it is missing or conflicts with the task description?
#I started on the evidence checker. Here is the function so far: async function listEvidence(repoUrl: string) { const { owner, repo } = parseRepoUrl(repoUrl); const commits = await octokit.rest.repos.listCommits({ owner, repo, per_page: 25 }); return commits.data.map((c) => ({ sha: c.sha, message: c.commit.message })); } It works on public repos, but on a private test repo it throws RequestError [HttpError]: Not Found (404). I expected 401 or 403 for auth problems, so I'm confused about the 404. I think I need to pass an auth token but I'm not sure where it belongs or why GitHub answers 404 instead of 403.
#Hint 2
Look up GitHub REST API “authentication” and “404 Not Found for private resources.” Focus on how Octokit receives authentication when the client is constructed—not in `listCommits`—and why GitHub may conceal the existence of a private repository from an unauthenticated or unauthorized caller.
#