Instructor walkthrough

Use the same tested reference migration and reports as the manual exercise; each track includes the complete app. Skill installation should create Claude, Codex, Gemini, Cursor and Copilot instruction files for the pinned CLI. The install command changes project files but does not itself scan or remediate dependencies. Inspect files rather than promising automatic assistant compliance.

The correct plan cites the actual report, identifies both direct findings, checks the axios transitive path, distinguishes version matching from exploitability, and proposes manager-specific commands for review. Accept alternate fixes backed by tests and a complete rescan. Do not grade an AI provider's wording.

After critique, use solution/REMEDIATION.md in the selected manager track to compare the worked migration. A clean historical report is not proof the current live scan is clean.

No-account path: distribute the labeled sample response with the student kit. Its claims about follow-redirects, deleting lockfiles, npm on every track, and skipping tests are deliberately wrong. Use sample-response-critique.md for the debrief.