chore: point Cloudflare releases at FindAny/ghfind

.github/CODEOWNERS

@@ -1,12 +1,7 @@
 # Code owners for ghfind.
 #
-# Every pull request targeting a protected branch (main) requires an approval
-# from one of the owners listed here, because the branch ruleset enables
-# "Require review from Code Owners" with 1 required approval.
-#
-# GitHub never counts a pull request author's own approval, so listing all
-# three core maintainers means every PR has to be cross-reviewed by one of the
-# other two: whoever opens it cannot be the one who unblocks it.
+# Pull request reviews are optional; required status checks still gate merges.
+# Code owners identify the maintainers and remain available for requested reviews.
 #
 # Syntax: <path pattern>  <@owner ...>   (last matching line wins)
 

.github/workflows/deploy-apps-production.yml

@@ -22,7 +22,7 @@ permissions:
 jobs:
   deploy:
     if: >-
-      github.repository == 'hikariming/ghfind' &&
+      github.repository == 'FindAny/ghfind' &&
       ((github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') ||
        (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'))
     runs-on: ubuntu-latest

.github/workflows/deploy-cf-dev.yml

@@ -29,13 +29,13 @@ concurrency:
 jobs:
   deploy:
     name: Build and deploy to Cloudflare Workers (dev)
-    if: ${{ github.repository == 'hikariming/ghfind' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'dev' && github.event.workflow_run.repository.full_name == 'hikariming/ghfind' }}
+    if: ${{ github.repository == 'FindAny/ghfind' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'dev' && github.event.workflow_run.repository.full_name == 'FindAny/ghfind' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env:
       CI: "true"
       NEXT_TELEMETRY_DISABLED: "1"
-      EXPECTED_REPOSITORY: hikariming/ghfind
+      EXPECTED_REPOSITORY: FindAny/ghfind
       EXPECTED_ACCOUNT_ID: 8f19bebe359e4ec1a24c68c5f49c1584
       RELEASE_SHA: ${{ github.event.workflow_run.head_sha }}
       CF_VERSION_TAG: dev-${{ github.event.workflow_run.head_sha }}

.github/workflows/deploy-cf-production.yml

@@ -20,7 +20,7 @@ jobs:
     outputs:
       current: ${{ steps.authorization.outputs.current }}
     name: Require exact main CI and complete dual-profile E2E
-    if: ${{ github.repository == 'hikariming/ghfind' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.repository.full_name == 'hikariming/ghfind' }}
+    if: ${{ github.repository == 'FindAny/ghfind' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.repository.full_name == 'FindAny/ghfind' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -304,7 +304,7 @@ jobs:
   deploy-bot:
     name: Deploy bot after its legacy SCORE backend
     needs: [deploy]
-    if: ${{ github.repository == 'hikariming/ghfind' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.repository.full_name == 'hikariming/ghfind' }}
+    if: ${{ github.repository == 'FindAny/ghfind' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.repository.full_name == 'FindAny/ghfind' }}
     environment: Production
     concurrency:
       group: ghfind-bot-production

.github/workflows/feed-capacity.yml

@@ -19,7 +19,7 @@ concurrency:
 jobs:
   capacity:
     name: Synthetic 10 RPS and deletion recovery
-    if: ${{ github.repository == 'hikariming/ghfind' }}
+    if: ${{ github.repository == 'FindAny/ghfind' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     env:
@@ -60,9 +60,9 @@ jobs:
           [[ "$RELEASE_SHA" =~ ^[0-9a-f]{40}$ ]]
           test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
           git merge-base --is-ancestor "$RELEASE_SHA" origin/main
-          gh api --method GET repos/hikariming/ghfind/actions/workflows/ci.yml/runs \
+          gh api --method GET repos/FindAny/ghfind/actions/workflows/ci.yml/runs \
             -f head_sha="$RELEASE_SHA" -f status=success -f per_page=20 \
-            --jq '.workflow_runs | any(.head_repository.full_name == "hikariming/ghfind" and .conclusion == "success")' | jq -e '. == true'
+            --jq '.workflow_runs | any(.head_repository.full_name == "FindAny/ghfind" and .conclusion == "success")' | jq -e '. == true'
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod

.github/workflows/feed-catalog-reconcile.yml

@@ -45,7 +45,7 @@ concurrency:
 jobs:
   reconcile:
     name: Bounded production catalog reconciliation
-    if: ${{ github.repository == 'hikariming/ghfind' }}
+    if: ${{ github.repository == 'FindAny/ghfind' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
@@ -81,7 +81,7 @@ jobs:
       - name: Validate bounded operator inputs
         run: |
           set -euo pipefail
-          test "$GITHUB_REPOSITORY" = "hikariming/ghfind"
+          test "$GITHUB_REPOSITORY" = "FindAny/ghfind"
           test "$CLOUDFLARE_ACCOUNT_ID" = "$EXPECTED_ACCOUNT_ID"
           test -n "$FEED_ADMIN_SECRET"
           case "$BOOTSTRAP_CREDENTIAL" in true|false) ;; *) echo "bootstrap_credential must be boolean" >&2; exit 1 ;; esac

.github/workflows/feed-diagnose.yml

@@ -19,7 +19,7 @@ concurrency:
 jobs:
   diagnose:
     name: Bounded synthetic query diagnosis
-    if: ${{ github.repository == 'hikariming/ghfind' }}
+    if: ${{ github.repository == 'FindAny/ghfind' }}
     runs-on: ubuntu-24.04
     # Bounded preflight/execution steps leave time for evidence upload and cleanup.
     timeout-minutes: 25
@@ -61,9 +61,9 @@ jobs:
           [[ "$RELEASE_SHA" =~ ^[0-9a-f]{40}$ ]]
           test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
           git merge-base --is-ancestor "$RELEASE_SHA" origin/main
-          gh api --method GET repos/hikariming/ghfind/actions/workflows/ci.yml/runs \
+          gh api --method GET repos/FindAny/ghfind/actions/workflows/ci.yml/runs \
             -f head_sha="$RELEASE_SHA" -f status=success -f per_page=20 \
-            --jq '.workflow_runs | any(.head_repository.full_name == "hikariming/ghfind" and .conclusion == "success")' | jq -e '. == true'
+            --jq '.workflow_runs | any(.head_repository.full_name == "FindAny/ghfind" and .conclusion == "success")' | jq -e '. == true'
       - uses: actions/setup-go@v5
         timeout-minutes: 3
         with:

.github/workflows/feed-governance.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   validate:
-    if: ${{ github.repository == 'hikariming/ghfind' && github.ref == 'refs/heads/main' }}
+    if: ${{ github.repository == 'FindAny/ghfind' && github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     outputs:
@@ -52,14 +52,14 @@ jobs:
           [[ "$RELEASE_SHA" =~ ^[0-9a-f]{40}$ ]]
           test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
           git merge-base --is-ancestor "$RELEASE_SHA" origin/main
-          gh api --method GET repos/hikariming/ghfind/actions/workflows/ci.yml/runs \
+          gh api --method GET repos/FindAny/ghfind/actions/workflows/ci.yml/runs \
             -f head_sha="$RELEASE_SHA" -f status=success -f per_page=20 \
-            --jq '.workflow_runs | any(.head_repository.full_name == "hikariming/ghfind" and .conclusion == "success")' | jq -e '. == true'
+            --jq '.workflow_runs | any(.head_repository.full_name == "FindAny/ghfind" and .conclusion == "success")' | jq -e '. == true'
           echo "sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"
       - name: Require an actually protected operations environment
         run: |
           set -euo pipefail
-          gh api repos/hikariming/ghfind/environments/Feed%20staging%20operations > "$RUNNER_TEMP/feed-governance-environment.json"
+          gh api repos/FindAny/ghfind/environments/Feed%20staging%20operations > "$RUNNER_TEMP/feed-governance-environment.json"
           node --input-type=module - <<'JS'
           import {readFileSync} from 'node:fs';
           const env=JSON.parse(readFileSync(`${process.env.RUNNER_TEMP}/feed-governance-environment.json`,'utf8'));

.github/workflows/feed-operator.yml

@@ -41,7 +41,7 @@ concurrency:
 
 jobs:
   validate:
-    if: ${{ github.repository == 'hikariming/ghfind' && github.ref == 'refs/heads/main' }}
+    if: ${{ github.repository == 'FindAny/ghfind' && github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     outputs:
@@ -65,14 +65,14 @@ jobs:
           [[ "$RELEASE_SHA" =~ ^[0-9a-f]{40}$ ]]
           test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
           git merge-base --is-ancestor "$RELEASE_SHA" origin/main
-          gh api --method GET repos/hikariming/ghfind/actions/workflows/ci.yml/runs \
+          gh api --method GET repos/FindAny/ghfind/actions/workflows/ci.yml/runs \
             -f head_sha="$RELEASE_SHA" -f status=success -f per_page=20 \
-            --jq '.workflow_runs | any(.head_repository.full_name == "hikariming/ghfind" and .conclusion == "success")' | jq -e '. == true'
+            --jq '.workflow_runs | any(.head_repository.full_name == "FindAny/ghfind" and .conclusion == "success")' | jq -e '. == true'
           echo "sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"
       - name: Require an actually protected operations environment
         run: |
           set -euo pipefail
-          gh api repos/hikariming/ghfind/environments/Feed%20staging%20operations > "$RUNNER_TEMP/feed-operator-environment.json"
+          gh api repos/FindAny/ghfind/environments/Feed%20staging%20operations > "$RUNNER_TEMP/feed-operator-environment.json"
           node --input-type=module - <<'JS'
           import {readFileSync} from 'node:fs';
           const env=JSON.parse(readFileSync(`${process.env.RUNNER_TEMP}/feed-operator-environment.json`,'utf8'));

.github/workflows/feed-production-pause.yml

@@ -24,7 +24,7 @@ concurrency:
 jobs:
   protection:
     name: Verify manual main context and existing production protections
-    if: ${{ github.repository == 'hikariming/ghfind' && github.ref == 'refs/heads/main' }}
+    if: ${{ github.repository == 'FindAny/ghfind' && github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -54,7 +54,7 @@ jobs:
   pause:
     name: Verify exact candidate, pause Web and read back actual containment
     needs: [protection]
-    if: ${{ github.repository == 'hikariming/ghfind' && github.ref == 'refs/heads/main' }}
+    if: ${{ github.repository == 'FindAny/ghfind' && github.ref == 'refs/heads/main' }}
     environment: Production
     runs-on: ubuntu-latest
     timeout-minutes: 12

.github/workflows/feed-production-projection-replay.yml

@@ -14,7 +14,7 @@ concurrency:
   cancel-in-progress: false
 jobs:
   protection:
-    if: ${{ github.repository == 'hikariming/ghfind' && github.ref == 'refs/heads/main' }}
+    if: ${{ github.repository == 'FindAny/ghfind' && github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:

.github/workflows/feed-staging.yml

@@ -32,7 +32,7 @@ concurrency:
 jobs:
   protection:
     name: Verify actual repository release protections
-    if: ${{ github.repository == 'hikariming/ghfind' }}
+    if: ${{ github.repository == 'FindAny/ghfind' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     # No environment reference: GitHub must not silently create an unprotected
@@ -63,7 +63,7 @@ jobs:
   deploy:
     name: Validate and deploy isolated Feed staging
     needs: [protection]
-    if: ${{ github.repository == 'hikariming/ghfind' }}
+    if: ${{ github.repository == 'FindAny/ghfind' }}
     environment: Feed staging
     runs-on: ubuntu-latest
     timeout-minutes: 60

.github/workflows/repair-prod-web.yml

@@ -28,7 +28,7 @@ concurrency:
 jobs:
   repair:
     name: Deploy paused web and populate incremental cache
-    if: ${{ github.repository == 'hikariming/ghfind' && github.ref == 'refs/heads/main' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'failure') }}
+    if: ${{ github.repository == 'FindAny/ghfind' && github.ref == 'refs/heads/main' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'failure') }}
     environment: Production
     runs-on: ubuntu-latest
     timeout-minutes: 30

docs/operations/cloudflare-deployment-runbook.md

@@ -37,15 +37,15 @@ production Workers, D1, R2, or Secrets.
 
 ## Canonical GitHub source and CI ownership
 
-`hikariming/ghfind` is the only canonical production repository. Production is
+`FindAny/ghfind` is the only canonical production repository. Production is
 not connected to a personal fork or to a Cloudflare dashboard Git integration;
 the binding is enforced by the upstream workflow itself:
 
 ```text
 upstream/main commit
   -> CI push run succeeds
   -> Deploy production (Cloudflare) workflow_run on that exact SHA
-  -> provenance guard confirms hikariming/ghfind + main
+  -> provenance guard confirms FindAny/ghfind + main
   -> deploy ghfind in Beiming's account
 ```
 

docs/operations/feed-github-protection.md

@@ -4,16 +4,16 @@
 
 2026-09-09 用户更新：保留仓库的 squash 选项，本次 PR 使用 rebase 合入。是否允许其他 PR 使用 squash 不属于部署门禁；脚本不修改已有合并方式。准确 SHA CI、真实 CF E2E、required checks 和环境保护要求继续有效。
 
-目标固定为 `hikariming/ghfind`、ruleset `18206694`（`Protect main`）。当前账号具有 PR bypass 能力，但远端环境写入已返回 `403 Must have admin rights to Repository`；这不等于拥有仓库配置权限。2026-09-09 的只读核验也未返回 `bypass_actors`，该字段因缺少 ruleset 写权限而被 GitHub 隐藏，不能解释为没有 bypass 配置。[GitHub ruleset API](https://docs.github.com/en/rest/repos/rules#get-a-repository-ruleset)
+目标固定为 `FindAny/ghfind`、ruleset `18206694`（`Protect main`）。当前账号具有 PR bypass 能力，但远端环境写入已返回 `403 Must have admin rights to Repository`；这不等于拥有仓库配置权限。2026-09-09 的只读核验也未返回 `bypass_actors`，该字段因缺少 ruleset 写权限而被 GitHub 隐藏，不能解释为没有 bypass 配置。[GitHub ruleset API](https://docs.github.com/en/rest/repos/rules#get-a-repository-ruleset)
 
 ## 预期变化
 
 | 配置 | 必须达到的状态 |
 | --- | --- |
-| Protect main | 保留原有分支范围、active 状态、所有合并方式、review 条件、其他 rules 和 bypass actors；确认本次 PR 可以使用 `rebase` |
+| Protect main | 保留原有分支范围、active 状态、所有合并方式、其他 rules 和 bypass actors；必须开 PR，但 required approvals 为 `0`，作者可在 checks 通过后自行合并；确认本次 PR 可以使用 `rebase` |
 | Required checks | `Application checks`、`Feed storage contracts`、`Feed runtime builds`、`Complete local Feed E2E`；来源固定为已核验的 GitHub Actions integration `15368`；strict 模式 |
 | Feed staging | 自定义 branch policy，仅 `main` 和 `codex/feed-*`；不允许 tag；不新增人工等待 |
-| Feed staging operations | 仅 `main`；新增环境时 reviewer 为仓库 owner `hikariming`（User ID `23065064`） |
+| Feed staging operations | 仅 `main`；新增环境时 reviewer 为个人管理员 `hikariming`（User ID `23065064`）；仓库 owner 为 `FindAny` 组织 |
 | Production | 仅 `main`；不新增 reviewer 或 wait timer，正常发布仍由 CI→staging→Production 自动推进 |
 
 脚本检查本地 CI 配置中四个 job 都会在 PR 上报告结果，不选择只在 push 上执行的聚合任务作为 required check。完整本地 E2E 通过后才能推候选分支；准确 HEAD CI、PR merge 兼容性及真实 CF E2E 仍必须通过后才能合入。配置脚本不能替代这些验收。
@@ -63,6 +63,6 @@ node scripts/feed-github-protection.mjs --verify-existing "$RUNNER_TEMP/feed-git
 
 只有该 job 成功，声明 `Feed staging` 环境的部署 job 才能运行。这样 GitHub 不会因为 workflow 提及了一个缺失环境，就先自动创建没有保护的空环境。
 
-该模式只执行 GET，不要求管理员身份，也不要求看到被隐藏的 bypass actors。它核验 active 的固定 ruleset、原有 PR review 约束、允许本次 PR 使用 rebase、来源固定的四个 strict required checks、三个环境的精确 branch allowlist，以及 operations 的 owner reviewer。仓库可以同时允许 squash 和 merge commit。既有更严格的 review、wait timer、额外 status checks 和保护规则不会被改写。
+该模式只执行 GET，不要求管理员身份，也不要求看到被隐藏的 bypass actors。它核验 active 的固定 ruleset、必须开 PR 且 required approvals 为 `0`、允许本次 PR 使用 rebase、来源固定的四个 strict required checks、三个环境的精确 branch allowlist，以及 operations 的 owner reviewer。仓库可以同时允许 squash 和 merge commit。既有 reviewer、wait timer、额外 status checks 和保护规则不会被改写；审核人数或其他固定策略漂移会失败。
 
 成功输出 `ghfind-github-protection-verification-v1` 证据，包含核验时间、状态 hash、checks 和环境策略；不包含 bypass 列表。任何缺失、策略不符或 403 等读取错误都会失败，且不生成可用的通过证据。`--verify-existing` 不能与 `--apply`、计划输入或其他输出选项混用。

docs/operations/feed-platform-prerequisites.md

@@ -48,11 +48,11 @@ Read back configuration after administrator changes; these commands do not
 retrieve secret values:
 
 ```sh
-gh api repos/hikariming/ghfind/rulesets/18206694
-gh api repos/hikariming/ghfind/environments --jq \
+gh api repos/FindAny/ghfind/rulesets/18206694
+gh api repos/FindAny/ghfind/environments --jq \
   '{environments:[.environments[]|{name,protection_rules,deployment_branch_policy}]}'
-gh secret list --repo hikariming/ghfind
-gh run list --repo hikariming/ghfind --workflow ci.yml --limit 5
+gh secret list --repo FindAny/ghfind
+gh run list --repo FindAny/ghfind --workflow ci.yml --limit 5
 ```
 
 Save the resulting settings, check-run URL and tested rejection cases in the