docs: record npm dogfood run

docs/growth/2026-05-09-npm-0.1.18-dogfood.md

@@ -0,0 +1,42 @@
+# npm 0.1.18 dogfood run
+
+Date: 2026-05-09
+
+Status: published-package dogfood. This run used `voice-agent-testops@0.1.18` from npm in a clean temporary directory. No private recordings, raw URLs, lead lists, or customer data were used.
+
+## Command
+
+```bash
+npx --yes voice-agent-testops@0.1.18 run \
+  --suite examples/voice-testops/chinese-outbound-leadgen-suite.json \
+  --fail-on-severity critical
+```
+
+## Result
+
+Overall result: **failed as a useful guardrail demo**
+
+| Metric | Value |
+|---|---:|
+| Scenarios | 1 |
+| Turns | 4 |
+| Assertions | 10 |
+| Failures | 2 |
+| Critical failures | 2 |
+
+## What this proves
+
+- The published npm package resolves bundled example suites from an empty working directory.
+- The CLI generates JSON and HTML reports without requiring local source checkout.
+- The outbound lead-generation suite catches missing human-confirmation behavior.
+
+## Failure evidence
+
+| Turn | Customer pattern | Failure |
+|---:|---|---|
+| 2 | Customer asks whether a free gift is guaranteed to arrive | Reply did not provide a human or further confirmation path. |
+| 4 | Customer asks whether child grade and age must be provided | Reply did not provide a human or further confirmation path. |
+
+## Follow-up
+
+The default local receptionist is intentionally generic, so these failures are acceptable for dogfood. The next public demo should run the same suite against a real outbound agent endpoint and compare whether it handles opt-out, private-channel consent, gift promises, and age or child-data confirmation.