diff --git a/BEARING.md b/BEARING.md index ecc8252a..95ce37f6 100644 --- a/BEARING.md +++ b/BEARING.md @@ -14,7 +14,7 @@ timeline ## Current State -`v6.5.8` shipped on `2026-08-23`, and `v6.5.9` is under release review. +`v6.5.9` shipped on `2026-08-24`. Application asset, bundle, page, cache, expiry, witness, and repository-diagnostics APIs sit above mutable root sets and the low-level CAS pipeline. Direct bundle-reference reads and bounded @@ -94,7 +94,7 @@ What exists now: Plumbing 3.3.0 sessions pipeline independent blob, tree, metadata, and successful checked-ref waves while one-shot and older-capability fallbacks remain intact. -- **Compound workspace-admission candidate.** v6.5.9 adds one bounded +- **Compound workspace admission.** v6.5.9 adds one bounded `workspace.batch()` callback for dependency-ordered page and bundle waves. One private persistence scope stages every operation and one exact final generation retains their union. A 33-operation witness reduced 200 Git @@ -170,14 +170,14 @@ These were the active tensions from the previous bearing. All resolved. ## Next Horizon -With v6.5.8 shipped and the v6.5.9 candidate under release review, active work -is tracked in GitHub Issues and Milestones. Repo docs hold design and evidence -records, not the active queue. +With v6.5.9 shipped, active work is tracked in GitHub Issues and Milestones. +Repo docs hold design and evidence records, not the active queue. -The candidate design is +The completed release design is [0060-compound-workspace-admission](./docs/design/0060-compound-workspace-admission/compound-workspace-admission.md). -Its release goalpost is [#123](https://github.com/git-stunts/git-cas/issues/123) -in the [`v6.5.9` milestone](https://github.com/git-stunts/git-cas/milestone/19). +Its completed release goalpost is +[#123](https://github.com/git-stunts/git-cas/issues/123) in the +[`v6.5.9` milestone](https://github.com/git-stunts/git-cas/milestone/19). The broader horizon remains: diff --git a/STATUS.md b/STATUS.md index fd9fa845..7a1de6b5 100644 --- a/STATUS.md +++ b/STATUS.md @@ -1,8 +1,8 @@ # STATUS -**Last tagged release:** `v6.5.8` (`2026-08-23`) -**Current release state:** `v6.5.9` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow. -**Latest verification:** exact versioned candidate `5512acd4` passed 14/14 release-verifier stages with 7,147 observed tests across Node, Bun, Deno, and all three real-Git integration suites. +**Last tagged release:** `v6.5.9` (`2026-08-24`) +**Current release state:** `v6.5.9` is published to npm and GitHub Releases. +**Latest verification:** reviewed release merge `a16e31a9` passed 14/14 release-verifier stages with 7,147 observed tests; signed tag `v6.5.9` peels to that merge, and release workflow `32766297971` published the matching npm artifact plus final GitHub Release. **Playback truth:** `main` **Runtimes:** Node.js 22.x, Bun, Deno **Current planning method:** [WORKFLOW.md](./WORKFLOW.md) @@ -18,22 +18,22 @@ - The machine-facing `git cas agent` surface exists and now supports OS-keychain passphrase sources for vault-derived key flows, but parity and portability are still partial. -- **v6.5.9 candidate posture** — implementation PR - [#124](https://github.com/git-stunts/git-cas/pull/124) merged normally as - `eb8d6176`; release PR [#125](https://github.com/git-stunts/git-cas/pull/125) - reviews the versioned candidate. Exact candidate `5512acd4` passed all 14 - release-verifier stages with 7,147 observed tests. npm, JSR, and runtime - metadata identify `6.5.9`, while the signed tag and registry artifact remain - deliberately absent pending release review. The SHA-1/SHA-256 compound - witness preserves every application-handle digest while reducing a - 33-operation graph from 200 to 23 Git children and from 33 retained - generations to one. The release is additive and requires no application or - stored-data migration. +- **v6.5.9 artifact posture** — implementation PR + [#124](https://github.com/git-stunts/git-cas/pull/124) and release PR + [#125](https://github.com/git-stunts/git-cas/pull/125) merged normally. + Signed tag `v6.5.9` resolves to reviewed release merge `a16e31a9`; npm reports + `@git-stunts/git-cas@6.5.9` as `latest` with publish and SLSA provenance, and + release workflow `32766297971` published the final GitHub Release. The + SHA-1/SHA-256 compound witness preserves every application-handle digest + while reducing a 33-operation graph from 200 to 23 Git children and from 33 + retained generations to one. The release is additive and requires no + application or stored-data migration. JSR dry-run validation is healthy, but + JSR publication is not part of the release workflow. - **v6.5.8 artifact posture** — implementation PR [#120](https://github.com/git-stunts/git-cas/pull/120) and release PR [#121](https://github.com/git-stunts/git-cas/pull/121) merged normally. - Signed tag `v6.5.8` resolves to reviewed release merge `57b40553`; npm reports - `@git-stunts/git-cas@6.5.8` as `latest` with publish and SLSA provenance, and + Signed tag `v6.5.8` resolves to reviewed release merge `57b40553`; npm retains + `@git-stunts/git-cas@6.5.8` with publish and SLSA provenance, and release workflow `32690361682` published the final GitHub Release. Bounded asset, ordered-bundle, workspace-retention, and Git protocol waves are shipped against `@git-stunts/plumbing@3.3.0`. The released-dependency witness @@ -178,7 +178,7 @@ - GitHub Issues are canonical. If this section and GitHub disagree, GitHub wins and this section should be corrected. -- Current release goalpost: +- Latest completed release goalpost: [#123 v6.5.9: Compound staging-workspace admission](https://github.com/git-stunts/git-cas/issues/123) under the [`v6.5.9` milestone](https://github.com/git-stunts/git-cas/milestone/19). diff --git a/docs/design/0060-compound-workspace-admission/compound-workspace-admission.md b/docs/design/0060-compound-workspace-admission/compound-workspace-admission.md index 528ba80c..c78f5601 100644 --- a/docs/design/0060-compound-workspace-admission/compound-workspace-admission.md +++ b/docs/design/0060-compound-workspace-admission/compound-workspace-admission.md @@ -541,7 +541,8 @@ Required artifacts: - readable verification summary with residual process floor; - real-Git prune test output; - exact-head hosted CI URLs; -- v6.5.9 candidate and publication identity evidence; +- [v6.5.9 release-candidate witness](./witness/release-candidate.md); +- [v6.5.9 publication witness](./witness/release-publication.md); - downstream git-warp exact-head benchmark and migrated-v18 read gate. ## Risks @@ -578,10 +579,10 @@ same evidence and separate scope. ## Tracker Disposition -| Issue | Role | Expected disposition | -| ----------------------------------------------------------------- | ------------------- | -------------------------------- | -| [git-cas#123](https://github.com/git-stunts/git-cas/issues/123) | primary goalpost | close after publication evidence | -| [git-warp#851](https://github.com/git-stunts/git-warp/issues/851) | downstream consumer | update after released adoption | +| Issue | Role | Expected disposition | +| ----------------------------------------------------------------- | ------------------- | ------------------------------ | +| [git-cas#123](https://github.com/git-stunts/git-cas/issues/123) | primary goalpost | close through publication PR | +| [git-warp#851](https://github.com/git-stunts/git-warp/issues/851) | downstream consumer | update after released adoption | ## Done Does Not Mean @@ -603,9 +604,17 @@ in both SHA-1 and SHA-256 repositories. Median wall time fell by 80.5% with identical handle digests. Implementation PR #124 merged normally as `eb8d617620fa8f401fb887f5b1bbc341d4746b0a`; exact reviewed head `29ba6e88c787a5e54c95a554e9166fd21aae31c0` passed 14/14 release-verifier -stages with 7,141 observed tests. The remaining work is v6.5.9 release review, -publication, and released downstream adoption. +stages with 7,141 observed tests. Release PR #125 merged normally as +`a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`; that exact merge passed all 14 +release-verifier stages with 7,147 observed tests before signed tag `v6.5.9` +triggered successful release workflow +[`32766297971`](https://github.com/git-stunts/git-cas/actions/runs/32766297971). +The registry, provenance, signature, GitHub Release, and clean-room install +evidence is recorded in the +[publication witness](./witness/release-publication.md). The remaining work is +released downstream git-warp adoption and measurement. PR: - [#124](https://github.com/git-stunts/git-cas/pull/124) +- [#125](https://github.com/git-stunts/git-cas/pull/125) diff --git a/docs/design/0060-compound-workspace-admission/witness/release-publication.md b/docs/design/0060-compound-workspace-admission/witness/release-publication.md new file mode 100644 index 00000000..cf6339a4 --- /dev/null +++ b/docs/design/0060-compound-workspace-admission/witness/release-publication.md @@ -0,0 +1,100 @@ +# PERF-0060 v6.5.9 Publication Witness + +Date: 2026-08-24 + +Issue: #123 + +## Immutable Release Identity + +- Implementation PR: + [#124](https://github.com/git-stunts/git-cas/pull/124) +- Release PR: [#125](https://github.com/git-stunts/git-cas/pull/125) +- Reviewed merge commit: `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275` +- Signed annotated tag: `v6.5.9` +- Tag object: `df65d8af46c5e4758ab3108272ebc849df58c29e` +- Peeled tag target: `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275` +- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135` +- GitHub Release: + [v6.5.9](https://github.com/git-stunts/git-cas/releases/tag/v6.5.9) + (final, not a draft or prerelease; published `2026-08-24T19:12:37Z`) + +Local `git tag -v v6.5.9` reported a good signature. GitHub independently +reports the annotated tag signature as valid and verified, and both local +peeling and the GitHub tag object resolve to the reviewed release merge +exactly. + +## Release Workflow + +[Release run 32766297971](https://github.com/git-stunts/git-cas/actions/runs/32766297971) +completed successfully against tag `v6.5.9` and exact commit +`a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`: + +| Job | Result | Evidence | +| -------------- | ------ | -------------------------------------------------- | +| Validate | pass | Tag version matched `package.json` | +| Test | pass | Lint, unit, and Node/Bun/Deno real-Git integration | +| Publish npm | pass | OIDC trusted publication completed | +| GitHub Release | pass | Final release created after npm publication | + +Before tagging, the exact reviewed merge passed all 14 release-verifier stages +with 7,147 observed tests, public type compatibility, examples, build stamping, +and npm and JSR dry-runs. + +## npm Registry Evidence + +Independent registry queries after the workflow completed reported: + +| Field | Value | +| ------------- | ------------------------------------------------------------------------------------------------- | +| Package | `@git-stunts/git-cas@6.5.9` | +| Published | `2026-08-24T19:12:26.166Z` | +| Dist-tag | `latest` -> `6.5.9` | +| Git head | `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275` | +| Integrity | `sha512-shlQB+EgLmzWsWTxRwLUN8rovI1wKv0N2yx43fiAxdOLTqMOOQOxSB8AMLfUmxnVd0zS+/0HIEwXF5ixl046XQ==` | +| Shasum | `a4fcff9ffd6c50292284903606726d6067636d56` | +| File count | `269` | +| Unpacked size | `2,318,806` bytes | +| Tarball | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.9.tgz` | + +The registry exposes the package-version +[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.9) +with npm publish and `https://slsa.dev/provenance/v1` predicates. The decoded +SLSA statement resolves `refs/tags/v6.5.9` to exact Git commit +`a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275` and workflow run `32766297971`. + +## Clean-Room Consumer Smoke + +A fresh temporary directory with no source-worktree dependency installed the +exact registry package with: + +```bash +npm install --ignore-scripts @git-stunts/git-cas@6.5.9 +``` + +The installed artifact then reported: + +- package version `6.5.9`; +- CLI version `6.5.9+a16e31a9`; +- embedded build SHA `a16e31a`; +- successful ESM root import with 45 public exports; +- successful `@git-stunts/git-cas/service` subpath import; +- public `StagingWorkspace.prototype.batch` with a 1,024-operation bound; and +- `npm audit signatures` verified registry signatures for all 20 installed + packages and attestations for 11, with no invalid or missing results. + +This proves that the package consumers receive from npm carries the reviewed +release identity, verifies through the registry trust surfaces, and exposes the +compound admission capability through the public package boundary. + +## Compatibility And Downstream Boundary + +This release requires no application or stored-data migration. It changes no +application handle, stored object bytes, descriptor schema, ref namespace, or +existing workspace/read contract. Existing repositories remain readable in +place. + +This witness closes the git-cas publication gate. It does not claim that +git-warp or Think have consumed the release or that their end-to-end latency is +fixed. The next required sequence remains git-warp consuming v6.5.9 and +publishing its exact reference, migrated-v18, process-census, and CPU evidence, +then Think consuming the released git-warp dependency. diff --git a/docs/method/retro/0060-compound-workspace-admission/compound-workspace-admission.md b/docs/method/retro/0060-compound-workspace-admission/compound-workspace-admission.md index 34b3c6c2..88b6bfbb 100644 --- a/docs/method/retro/0060-compound-workspace-admission/compound-workspace-admission.md +++ b/docs/method/retro/0060-compound-workspace-admission/compound-workspace-admission.md @@ -24,11 +24,15 @@ `eb8d617620fa8f401fb887f5b1bbc341d4746b0a`; exact reviewed head `29ba6e88c787a5e54c95a554e9166fd21aae31c0` passed 14/14 release-verifier stages with 7,141 observed tests. +- Release PR #125 merged normally as + `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`; signed tag `v6.5.9`, trusted npm + publication with SLSA provenance, and the final GitHub Release all resolve to + that reviewed merge. +- The publication witness records the exact tag object, release workflow, + registry integrity, signature audit, and clean-room consumer smoke. ## What Did Not Yet Ship -- v6.5.9 is not tagged or published until the release candidate, reviewed - merge, signed-tag workflow, registry artifact, and clean consumer checks pass. - git-warp has not yet consumed the registry artifact or rerun its exact reference, migrated-v18, process-census, and CPU gates. - Think remains unchanged until the ordered Plumbing -> git-cas -> git-warp diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js index a594f24b..130ac828 100644 --- a/test/unit/docs/release-state.test.js +++ b/test/unit/docs/release-state.test.js @@ -6,6 +6,8 @@ const repoRoot = process.cwd(); const v653PublishedMarker = '**v6.5.3 artifact posture**'; const v659CandidatePath = 'docs/design/0060-compound-workspace-admission/witness/release-candidate.md'; +const v659PublicationPath = + 'docs/design/0060-compound-workspace-admission/witness/release-publication.md'; const v658CandidatePath = 'docs/design/0059-bounded-write-waves/witness/release-candidate.md'; const v658PublicationPath = 'docs/design/0059-bounded-write-waves/witness/release-publication.md'; const v657CandidatePath = @@ -389,7 +391,6 @@ function expectV658CandidateEvidence(candidate, releaseNotes) { } function expectV658PublishedEvidence(status, publication) { - expect(status).toContain('**Last tagged release:** `v6.5.8` (`2026-08-23`)'); expect(status).toContain('**v6.5.8 artifact posture**'); expect(status).toContain('57b40553'); expect(status).toContain('32690361682'); @@ -414,9 +415,7 @@ function expectV658PublishedEvidence(status, publication) { expect(publication).toContain('CLI version `6.5.8+57b4055`'); } -function expectV659CandidateEvidence(status, candidate, releaseNotes) { - expect(status).toContain('**Current release state:** `v6.5.9` release candidate'); - expect(status).toContain('**v6.5.9 candidate posture**'); +function expectV659CandidateEvidence(candidate, releaseNotes) { expect(candidate).toContain('# PERF-0060 v6.5.9 Release Candidate Witness'); expect(candidate).toContain('Implementation review: #124'); expect(candidate).toContain('Release review: #125'); @@ -428,7 +427,35 @@ function expectV659CandidateEvidence(status, candidate, releaseNotes) { expect(candidate).toContain('**7,147**'); expect(candidate).toMatch(/explicitly\s+unpublished\s+candidate/); expect(releaseNotes).toMatch(/requires no application or stored-data migration/); - expectNoV659PublicationEvidence(status, candidate, releaseNotes); + expectNoV659PublicationEvidence(candidate, releaseNotes); +} + +function expectV659PublishedEvidence(status, publication) { + expect(status).toContain('**Last tagged release:** `v6.5.9` (`2026-08-24`)'); + expect(status).toContain('**Current release state:** `v6.5.9` is published'); + expect(status).toContain('**v6.5.9 artifact posture**'); + expect(status).toContain('a16e31a9'); + expect(status).toContain('32766297971'); + expect(publication).toContain('# PERF-0060 v6.5.9 Publication Witness'); + expect(publication).toContain( + '- Reviewed merge commit: `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`' + ); + expect(publication).toContain('- Tag object: `df65d8af46c5e4758ab3108272ebc849df58c29e`'); + expect(publication).toContain('- Peeled tag target: `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`'); + expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135'); + expect(publication).toContain('- Signed annotated tag: `v6.5.9`'); + expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.9'); + expect(publication).toContain('actions/runs/32766297971'); + expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.9`\s+\|/); + expect(publication).toMatch(/\| Dist-tag\s+\| `latest` -> `6\.5\.9`\s+\|/); + expect(publication).toContain( + 'sha512-shlQB+EgLmzWsWTxRwLUN8rovI1wKv0N2yx43fiAxdOLTqMOOQOxSB8AMLfUmxnVd0zS+/0HIEwXF5ixl046XQ==' + ); + expect(publication).toContain('a4fcff9ffd6c50292284903606726d6067636d56'); + expect(publication).toContain('2,318,806'); + expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.9'); + expect(publication).toContain('CLI version `6.5.9+a16e31a9`'); + expect(publication).toContain('`StagingWorkspace.prototype.batch`'); } function expectV656PublishedEvidence(status, publication) { @@ -602,13 +629,15 @@ function expectV658ReleaseDocs(status) { function expectV659ReleaseDocs(status) { const candidate = read(v659CandidatePath); + const publication = read(v659PublicationPath); const releaseNotes = read('docs/releases/v6.5.9.md'); - expectV659CandidateEvidence(status, candidate, releaseNotes); + expectV659CandidateEvidence(candidate, releaseNotes); + expectV659PublishedEvidence(status, publication); } function expectCurrentQueue(status) { - expect(status).toContain('Current release goalpost:'); + expect(status).toContain('Latest completed release goalpost:'); expect(status).toContain('Current queued release goalposts are'); expect(status).toContain('#39 v6.6.0: Operator TUI'); expect(status).toContain('#40 v6.6.0: Agent automation follow-through'); @@ -617,7 +646,7 @@ function expectCurrentQueue(status) { } describe('release state docs', () => { - it('enforces the v6.5.9 candidate and prior publication evidence', () => { + it('enforces the v6.5.9 candidate history and publication evidence', () => { const status = read('STATUS.md'); const [v656Candidate, v656Publication] = [v656CandidatePath, v656PublicationPath].map(read); const v655Candidate = read(v655CandidatePath); @@ -669,11 +698,10 @@ describe('release state docs', () => { describe('v6.5.9 candidate publication-marker calibration', () => { it('rejects a GitHub Release marker in candidate release notes', () => { - const status = read('STATUS.md'); const candidate = read(v659CandidatePath); const releaseNotes = `${read('docs/releases/v6.5.9.md')}\nhttps://github.com/git-stunts/git-cas/releases/tag/v6.5.9\n`; - expect(() => expectV659CandidateEvidence(status, candidate, releaseNotes)).toThrow(); + expect(() => expectV659CandidateEvidence(candidate, releaseNotes)).toThrow(); }); });