Completion Report: ANU-9 - Anuva Bento Downstream Bootstrap
Status: Ready for review; verification passed, both PRs are published, and the branch-protection limitation is accepted.
Delivery links
Delivered scope
- Private ancestry-preserving downstream and exact upstream provenance.
- Normal Anuva repository workflow, documentation, and evidence structure.
- No Bento product behavior changes.
Acceptance evidence
| Acceptance area | Evidence |
|---|---|
| Private independent repository | GitHub reports private visibility, isFork: false, Issues and wiki disabled |
| Preserved provenance | main and v1.0.8 are 0c9600d220668a6f447bbd2edf3567558b3652ea; MIT license and notices retained |
| Unmodified upstream baseline | npm ci, normal build, 45,362 sync checks, and Windows-equivalent single-file build passed before bootstrap files |
| Safe remotes | origin is private; upstream fetches public Bento and has push URL DISABLED |
| Normal Anuva workflow | Root instructions, six validated skills, prompts, templates, process docs, and change evidence are present |
| CLI repository context | anuva context show --json resolves anuva-bento and docs port 4005 |
| Documentation | Recursive index validation and strict MkDocs passed; all branch-specific HTTPS pages matched the strict build |
| Preview security | Authenticated preview returned HTTP 200; unauthenticated request received the Cloudflare Access redirect |
| Sync safety | Disposable branch proved v1.0.8 was already equal to main; no remote ref changed and the branch was removed |
| Product behavior | No upstream product source file was modified |
Accepted limitation
The current GitHub organization plan does not support branch protection for this private repository. Girish accepted this limitation for ANU-9 on 2026-07-24. The repository's PR-only/no-force-push/no-deletion policy remains mandatory.
A local pre-push hook can reduce accidental pushes from a configured clone, but
it is not remote enforcement: hooks are clone-local and git push --no-verify
bypasses pre-push. Adding a shared hook/bootstrap mechanism is therefore a
separate, optional defense-in-depth change rather than ANU-9 acceptance evidence.
Ready-to-merge declaration
Ready for PR review. Product Main synchronization is published in PR #13 and the limitation decision is recorded. Merge still requires explicit review/merge approval.