Skip to content

Implementation Log: ANU-9 - Anuva Bento Downstream Bootstrap

Timeline

Time Change or decision Evidence
2026-07-24 05:14 UTC Upstream released Bento v1.0.8. Tag v1.0.8
2026-07-24 06:28 UTC Created the empty private independent downstream. Shoonya-Game-Technologies/anuva-bento
2026-07-24 06:29 UTC Imported normal upstream branches and tags once. main and v1.0.8 resolve to 0c9600d220668a6f447bbd2edf3567558b3652ea
2026-07-24 06:30 UTC Cloned the private downstream and disabled upstream pushes. origin private; upstream fetch-only
2026-07-24 06:31 UTC Verified the unmodified upstream baseline. Build passed; 45,362 convergence checks passed
2026-07-24 06:32 UTC Verified the Windows-equivalent single-file build. 593,771-byte artifact
2026-07-24 06:33 UTC GitHub rejected private branch protection on the current organization plan. HTTP 403; no visibility or unsafe workaround attempted
2026-07-24 06:34 UTC Created the first downstream Anuva workflow branch. codex/anu-9-bootstrap-anuva-workflow
2026-07-24 06:46 UTC Verified every Anuva-authored preview page against a fresh strict build. Bento preview
2026-07-24 06:49 UTC Rehearsed the tagged upstream-sync process without changing any remote ref. v1.0.8, local main, upstream main, and origin main all 0c9600d220668a6f447bbd2edf3567558b3652ea
2026-07-24 06:55 UTC Verified the public route and Cloudflare Access boundary. Authenticated HTTP 200; unauthenticated HTTP 302 Access challenge
2026-07-24 07:04 UTC Published the first Anuva-authored commit through a draft review PR. Bento PR #1; commit 536771f
2026-07-24 07:08 UTC Product Main published the guarded ANU-9 draft PR and moved the Linear child to In Review. Product Main PR #13
2026-07-24 07:26 UTC Girish explicitly accepted the private-repository branch-protection limitation for ANU-9. PR-only/no-force-push/no-deletion policy remains mandatory
2026-07-24 07:26 UTC Evaluated a local Git pre-push hook as defense in depth. Clone-local and bypassable with git push --no-verify; not equivalent to GitHub enforcement and not added by ANU-9
2026-07-24 07:29 UTC Marked Bento PR #1 and Product Main PR #13 ready for review. Bento PR #1; Product Main PR #13

Deviations and limitations

  • GitHub rejected only public-upstream hidden refs/pull/* during the one-time import. Normal branches, tags, history, main, and v1.0.8 imported successfully. The mirror push will not be retried.
  • Upstream npm run build:single uses POSIX environment syntax. The exact build steps pass with PowerShell environment syntax; upstream source remains unchanged.
  • Private-repository branch protection requires a higher GitHub plan. PR-only, no-force-push, and no-deletion remain documented policy but are not yet technically enforced.

Verification runs

Check Result
npm ci Passed; 0 reported vulnerabilities
npm run build Passed
node ..\scripts\test-sync.ts Passed; 45,362 checks
Windows single-file build steps Passed
Product-source git status before bootstrap Clean
Strict MkDocs and recursive index validation Passed
Branch-specific HTTPS preview Passed; all pages HTTP 200 and matched strict build
Cloudflare Access Passed; unauthenticated request redirected to Access
Anuva CLI context Passed; repository anuva-bento, port 4005
Downstream skill validation Passed; six skills
Upstream sync rehearsal Passed; selected tag already equal to main, disposable branch removed
git diff --check Passed