Skip to content

Implementation Log: ANU-14 - Embed the Bento editor, AI Assistant, and shared preview

2026-07-27 - Plan approval

The user explicitly approved ImplementationPlan SHA-256 05713A34E3B442E7C87234E3DFFC8B57F58D047AA5DD7F9440685CAFE2E5487F in a subsequent message. This satisfies the repository's post-plan approval gate.

2026-07-27 - Downstream artifact readiness gate

The first approved-plan step verified the current local anuva-bento checkout:

  • branch: main
  • current head and origin/main: bef9c3f49fe1d7018b495f3987ba4657d358ff10
  • ANU-12 merge: c72925ef513012cb5ef56d6fdea2f5e930ef4fe9
  • ANU-11 merge: 42dbb0a

Read-only inspection of the merged contract, editor bridge, editor shell, and template implementation confirmed the three plan-listed gaps remain:

  1. The closed editor host-command union is load, apply-operations, save-accepted, save-rejected, and diagnostics. It has no host request-save command, so the CMS cannot trigger validated debounced autosave over the message protocol.
  2. The host protocol has no command to focus a stable scene/slide and surface after loading the full aggregate.
  3. The editor load command requires template families, but the static editor handoff contains no deterministic host-loadable Signal/Paper catalog artifact. The catalog exists only inside the Bento-owned source/runtime.

The readiness gate therefore failed. No CMS implementation code, configuration, migration, test, durable behavior documentation, or dependency artifact was changed. The approved plan explicitly forbids iframe DOM scraping, synthetic keyboard saves, use of the private same-origin debug adapter, hand-written template duplication, or a CMS-private fork of Bento-owned behavior.

Blocked dependency and next action

ANU-14 needs a reviewed Bento-owned follow-up artifact that:

  • adds host-requested validated save;
  • adds stable scene/slide plus surface focus;
  • packages or returns the exact validated template-family catalog; and
  • supplies updated contract/editor versions, manifests, checksums, license, and notices for CMS provenance.

Creating or modifying that cross-repository Bento work is outside ANU-14's anuvax-cms authority. Product Main must decide how to create and approve the follow-up. If its protocol or package boundary materially changes the approved ANU-14 plan, this repository will update and re-preview the plan and obtain fresh user approval before CMS implementation continues.

2026-07-28 - Readiness gate resolved

The user reported the updated artifact and explicitly asked implementation to continue. Read-only inspection of anuva-bento main found reviewed ANU-18 merged as 8dd5c4ff8a8a9760f845b2fc43c34ae6a940e07e. The artifact adds editor protocol and artifact 1.1.0, contract package 1.1.0, host-requested save, stable focus, and a checksummed packaged template catalog while retaining presentation contract/player 1.0.0 and renderer 1.0.8-anuva-renderer.1.

The editor manifest SHA-256 is 27db22300a9e471d24c474879ace7fbdbe1e3b6f3e7e9aad197e4e463d86088b; the template catalog SHA-256 is 63f487f7f65d3d62ce0b6cf395aca2b4db4daeac04a6fa6f4a14f159f56cb440; the unchanged player manifest SHA-256 is df806b6541cf5bffa1803917a0628d9079bef75109cac979e4275f7630c50042. This resolves the exact readiness gate without materially changing the approved CMS plan.

2026-07-28 - Implementation

  • Vendored the exact 1.1.0 contract/editor and exact 1.0.0 player boundary with provenance, licenses, notices, output tracing, allowlisted authenticated serving, and per-file integrity checks.
  • Added authenticated same-origin asset streaming with workspace, media type, redirect, and SHA-256 enforcement.
  • Extended immutable compilation revisions with unique revision/request keys, editor triggers, author/source metadata, and operation attribution.
  • Added presentation_editor_drafts, generated Payload types, fake-Payload uniqueness support, and production migration 20260728_030000_add_bento_editor_authoring.
  • Added the editor session service and server actions for load, serialized manual/autosave, idempotent retry, durable recovery, and explicit conflict discard/replace.
  • Added the responsive Bento host with exact origin/source/protocol checks, selected-scene focus, live status, dirty-state disclosure, and focus-return dialog behavior.
  • Added a Mastra structured-output Bento operation boundary, metering, selected-slide scope validation, proposal review, atomic editor execution, and safe revision attribution.
  • Added a three-surface exact-player saved-revision preview driven by one absolute Web clock and blocked until every surface reports asset readiness.

2026-07-28 - Verification

  • pnpm generate:types: passed.
  • pnpm lint: passed, 459 files checked.
  • pnpm test:int: passed, 22 files and 126 tests.
  • pnpm test:e2e: passed, 6 Chromium tests after rerunning outside the managed network sandbox so the test server could reach local Postgres.
  • pnpm typecheck: passed after restoring the repository's frozen dependency graph.
  • Focused Bento tests: 12 passed for artifact provenance/serving, revision/idempotency/conflict/draft behavior, and AI operation safety.

2026-07-28 - Model configuration follow-up

At the user's request, the shared Mastra text-generation and web-search defaults now use gpt-5.6-terra. The installed Mastra provider-registry snapshot did not yet list the GPT-5.6 family, so the target was additionally verified against the current official OpenAI API model catalog before the configuration changed.

Verification passed with pnpm lint, pnpm typecheck, and pnpm test:int (22 files and 126 tests). Metering and orchestration test traces recorded openai/gpt-5.6-terra.

2026-07-28 - Acceptance review

The PR acceptance pass found and resolved four host-boundary defects without modifying the reviewed Bento runtime bytes:

  • AI apply-layout proposals now require an exact family and surface-layout match from the packaged catalog before contract materialization.
  • presentation_editor_drafts access and create/update hooks now enforce both workspace and authenticated-user ownership, preventing another workspace member from reading or spoofing a user's recoverable draft through Payload.
  • Editor and player bridge payloads now pass closed runtime message validators after the existing origin/source checks. Complete save envelopes are contract-validated before they enter the save queue.
  • Saved preview players now receive load from each iframe's native load event. This matches Player 1.0.0, whose versioned ready lifecycle event is emitted during the load command, and removes a host/player readiness deadlock.

The byte-exact editor entry point is marked binary in .gitattributes so Git diff checks do not reinterpret its reviewed CRLF bytes. A new Playwright test loads the real packaged editor and all three player surfaces through their versioned bridges and verifies ready, accepted load response, and assets-ready.

Final acceptance verification:

  • pnpm lint: passed, 461 files checked.
  • pnpm typecheck: passed.
  • pnpm test:int: passed, 23 files and 131 tests.
  • pnpm test:e2e: passed, 7 Chromium tests, including the real packaged Bento editor/Main/Companion/Emphasis bridge check.
  • Focused Bento tests: 12 passed for provenance/serving, message validation, revision/idempotency/conflict/draft behavior, and AI operation safety.