Record git-cas v6.5.9 publication evidence

BEARING.md

@@ -14,7 +14,7 @@ timeline
 
 ## Current State
 
-`v6.5.8` shipped on `2026-08-23`, and `v6.5.9` is under release review.
+`v6.5.9` shipped on `2026-08-24`.
 Application asset, bundle, page, cache,
 expiry, witness, and repository-diagnostics APIs sit above mutable root sets
 and the low-level CAS pipeline. Direct bundle-reference reads and bounded
@@ -94,7 +94,7 @@ What exists now:
   Plumbing 3.3.0 sessions pipeline independent blob, tree, metadata, and
   successful checked-ref waves while one-shot and older-capability fallbacks
   remain intact.
-- **Compound workspace-admission candidate.** v6.5.9 adds one bounded
+- **Compound workspace admission.** v6.5.9 adds one bounded
   `workspace.batch()` callback for dependency-ordered page and bundle waves.
   One private persistence scope stages every operation and one exact final
   generation retains their union. A 33-operation witness reduced 200 Git
@@ -170,14 +170,14 @@ These were the active tensions from the previous bearing. All resolved.
 
 ## Next Horizon
 
-With v6.5.8 shipped and the v6.5.9 candidate under release review, active work
-is tracked in GitHub Issues and Milestones. Repo docs hold design and evidence
-records, not the active queue.
+With v6.5.9 shipped, active work is tracked in GitHub Issues and Milestones.
+Repo docs hold design and evidence records, not the active queue.
 
-The candidate design is
+The completed release design is
 [0060-compound-workspace-admission](./docs/design/0060-compound-workspace-admission/compound-workspace-admission.md).
-Its release goalpost is [#123](https://github.com/git-stunts/git-cas/issues/123)
-in the [`v6.5.9` milestone](https://github.com/git-stunts/git-cas/milestone/19).
+Its completed release goalpost is
+[#123](https://github.com/git-stunts/git-cas/issues/123) in the
+[`v6.5.9` milestone](https://github.com/git-stunts/git-cas/milestone/19).
 
 The broader horizon remains:
 

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS
 
-**Last tagged release:** `v6.5.8` (`2026-08-23`)
-**Current release state:** `v6.5.9` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
-**Latest verification:** exact versioned candidate `5512acd4` passed 14/14 release-verifier stages with 7,147 observed tests across Node, Bun, Deno, and all three real-Git integration suites.
+**Last tagged release:** `v6.5.9` (`2026-08-24`)
+**Current release state:** `v6.5.9` is published to npm and GitHub Releases.
+**Latest verification:** reviewed release merge `a16e31a9` passed 14/14 release-verifier stages with 7,147 observed tests; signed tag `v6.5.9` peels to that merge, and release workflow `32766297971` published the matching npm artifact plus final GitHub Release.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,22 +18,22 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
-- **v6.5.9 candidate posture** — implementation PR
-  [#124](https://github.com/git-stunts/git-cas/pull/124) merged normally as
-  `eb8d6176`; release PR [#125](https://github.com/git-stunts/git-cas/pull/125)
-  reviews the versioned candidate. Exact candidate `5512acd4` passed all 14
-  release-verifier stages with 7,147 observed tests. npm, JSR, and runtime
-  metadata identify `6.5.9`, while the signed tag and registry artifact remain
-  deliberately absent pending release review. The SHA-1/SHA-256 compound
-  witness preserves every application-handle digest while reducing a
-  33-operation graph from 200 to 23 Git children and from 33 retained
-  generations to one. The release is additive and requires no application or
-  stored-data migration.
+- **v6.5.9 artifact posture** — implementation PR
+  [#124](https://github.com/git-stunts/git-cas/pull/124) and release PR
+  [#125](https://github.com/git-stunts/git-cas/pull/125) merged normally.
+  Signed tag `v6.5.9` resolves to reviewed release merge `a16e31a9`; npm reports
+  `@git-stunts/git-cas@6.5.9` as `latest` with publish and SLSA provenance, and
+  release workflow `32766297971` published the final GitHub Release. The
+  SHA-1/SHA-256 compound witness preserves every application-handle digest
+  while reducing a 33-operation graph from 200 to 23 Git children and from 33
+  retained generations to one. The release is additive and requires no
+  application or stored-data migration. JSR dry-run validation is healthy, but
+  JSR publication is not part of the release workflow.
 - **v6.5.8 artifact posture** — implementation PR
   [#120](https://github.com/git-stunts/git-cas/pull/120) and release PR
   [#121](https://github.com/git-stunts/git-cas/pull/121) merged normally.
-  Signed tag `v6.5.8` resolves to reviewed release merge `57b40553`; npm reports
-  `@git-stunts/git-cas@6.5.8` as `latest` with publish and SLSA provenance, and
+  Signed tag `v6.5.8` resolves to reviewed release merge `57b40553`; npm retains
+  `@git-stunts/git-cas@6.5.8` with publish and SLSA provenance, and
   release workflow `32690361682` published the final GitHub Release. Bounded
   asset, ordered-bundle, workspace-retention, and Git protocol waves are
   shipped against `@git-stunts/plumbing@3.3.0`. The released-dependency witness
@@ -178,7 +178,7 @@
 
 - GitHub Issues are canonical. If this section and GitHub disagree, GitHub
   wins and this section should be corrected.
-- Current release goalpost:
+- Latest completed release goalpost:
   [#123 v6.5.9: Compound staging-workspace admission](https://github.com/git-stunts/git-cas/issues/123)
   under the
   [`v6.5.9` milestone](https://github.com/git-stunts/git-cas/milestone/19).

docs/design/0060-compound-workspace-admission/compound-workspace-admission.md

@@ -541,7 +541,8 @@ Required artifacts:
 - readable verification summary with residual process floor;
 - real-Git prune test output;
 - exact-head hosted CI URLs;
-- v6.5.9 candidate and publication identity evidence;
+- [v6.5.9 release-candidate witness](./witness/release-candidate.md);
+- [v6.5.9 publication witness](./witness/release-publication.md);
 - downstream git-warp exact-head benchmark and migrated-v18 read gate.
 
 ## Risks
@@ -578,10 +579,10 @@ same evidence and separate scope.
 
 ## Tracker Disposition
 
-| Issue                                                             | Role                | Expected disposition             |
-| ----------------------------------------------------------------- | ------------------- | -------------------------------- |
-| [git-cas#123](https://github.com/git-stunts/git-cas/issues/123)   | primary goalpost    | close after publication evidence |
-| [git-warp#851](https://github.com/git-stunts/git-warp/issues/851) | downstream consumer | update after released adoption   |
+| Issue                                                             | Role                | Expected disposition           |
+| ----------------------------------------------------------------- | ------------------- | ------------------------------ |
+| [git-cas#123](https://github.com/git-stunts/git-cas/issues/123)   | primary goalpost    | close through publication PR   |
+| [git-warp#851](https://github.com/git-stunts/git-warp/issues/851) | downstream consumer | update after released adoption |
 
 ## Done Does Not Mean
 
@@ -603,9 +604,17 @@ in both SHA-1 and SHA-256 repositories. Median wall time fell by 80.5% with
 identical handle digests. Implementation PR #124 merged normally as
 `eb8d617620fa8f401fb887f5b1bbc341d4746b0a`; exact reviewed head
 `29ba6e88c787a5e54c95a554e9166fd21aae31c0` passed 14/14 release-verifier
-stages with 7,141 observed tests. The remaining work is v6.5.9 release review,
-publication, and released downstream adoption.
+stages with 7,141 observed tests. Release PR #125 merged normally as
+`a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`; that exact merge passed all 14
+release-verifier stages with 7,147 observed tests before signed tag `v6.5.9`
+triggered successful release workflow
+[`32766297971`](https://github.com/git-stunts/git-cas/actions/runs/32766297971).
+The registry, provenance, signature, GitHub Release, and clean-room install
+evidence is recorded in the
+[publication witness](./witness/release-publication.md). The remaining work is
+released downstream git-warp adoption and measurement.
 
 PR:
 
 - [#124](https://github.com/git-stunts/git-cas/pull/124)
+- [#125](https://github.com/git-stunts/git-cas/pull/125)

docs/design/0060-compound-workspace-admission/witness/release-publication.md

@@ -0,0 +1,100 @@
+# PERF-0060 v6.5.9 Publication Witness
+
+Date: 2026-08-24
+
+Issue: #123
+
+## Immutable Release Identity
+
+- Implementation PR:
+  [#124](https://github.com/git-stunts/git-cas/pull/124)
+- Release PR: [#125](https://github.com/git-stunts/git-cas/pull/125)
+- Reviewed merge commit: `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`
+- Signed annotated tag: `v6.5.9`
+- Tag object: `df65d8af46c5e4758ab3108272ebc849df58c29e`
+- Peeled tag target: `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`
+- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135`
+- GitHub Release:
+  [v6.5.9](https://github.com/git-stunts/git-cas/releases/tag/v6.5.9)
+  (final, not a draft or prerelease; published `2026-08-24T19:12:37Z`)
+
+Local `git tag -v v6.5.9` reported a good signature. GitHub independently
+reports the annotated tag signature as valid and verified, and both local
+peeling and the GitHub tag object resolve to the reviewed release merge
+exactly.
+
+## Release Workflow
+
+[Release run 32766297971](https://github.com/git-stunts/git-cas/actions/runs/32766297971)
+completed successfully against tag `v6.5.9` and exact commit
+`a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`:
+
+| Job            | Result | Evidence                                           |
+| -------------- | ------ | -------------------------------------------------- |
+| Validate       | pass   | Tag version matched `package.json`                 |
+| Test           | pass   | Lint, unit, and Node/Bun/Deno real-Git integration |
+| Publish npm    | pass   | OIDC trusted publication completed                 |
+| GitHub Release | pass   | Final release created after npm publication        |
+
+Before tagging, the exact reviewed merge passed all 14 release-verifier stages
+with 7,147 observed tests, public type compatibility, examples, build stamping,
+and npm and JSR dry-runs.
+
+## npm Registry Evidence
+
+Independent registry queries after the workflow completed reported:
+
+| Field         | Value                                                                                             |
+| ------------- | ------------------------------------------------------------------------------------------------- |
+| Package       | `@git-stunts/git-cas@6.5.9`                                                                       |
+| Published     | `2026-08-24T19:12:26.166Z`                                                                        |
+| Dist-tag      | `latest` -> `6.5.9`                                                                               |
+| Git head      | `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`                                                        |
+| Integrity     | `sha512-shlQB+EgLmzWsWTxRwLUN8rovI1wKv0N2yx43fiAxdOLTqMOOQOxSB8AMLfUmxnVd0zS+/0HIEwXF5ixl046XQ==` |
+| Shasum        | `a4fcff9ffd6c50292284903606726d6067636d56`                                                        |
+| File count    | `269`                                                                                             |
+| Unpacked size | `2,318,806` bytes                                                                                 |
+| Tarball       | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.9.tgz`                              |
+
+The registry exposes the package-version
+[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.9)
+with npm publish and `https://slsa.dev/provenance/v1` predicates. The decoded
+SLSA statement resolves `refs/tags/v6.5.9` to exact Git commit
+`a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275` and workflow run `32766297971`.
+
+## Clean-Room Consumer Smoke
+
+A fresh temporary directory with no source-worktree dependency installed the
+exact registry package with:
+
+```bash
+npm install --ignore-scripts @git-stunts/git-cas@6.5.9
+```
+
+The installed artifact then reported:
+
+- package version `6.5.9`;
+- CLI version `6.5.9+a16e31a9`;
+- embedded build SHA `a16e31a`;
+- successful ESM root import with 45 public exports;
+- successful `@git-stunts/git-cas/service` subpath import;
+- public `StagingWorkspace.prototype.batch` with a 1,024-operation bound; and
+- `npm audit signatures` verified registry signatures for all 20 installed
+  packages and attestations for 11, with no invalid or missing results.
+
+This proves that the package consumers receive from npm carries the reviewed
+release identity, verifies through the registry trust surfaces, and exposes the
+compound admission capability through the public package boundary.
+
+## Compatibility And Downstream Boundary
+
+This release requires no application or stored-data migration. It changes no
+application handle, stored object bytes, descriptor schema, ref namespace, or
+existing workspace/read contract. Existing repositories remain readable in
+place.
+
+This witness closes the git-cas publication gate. It does not claim that
+git-warp or Think have consumed the release or that their end-to-end latency is
+fixed. The next required sequence remains git-warp consuming v6.5.9 and
+publishing its exact reference, migrated-v18, process-census, and CPU evidence,
+then Think consuming the released git-warp dependency.

docs/method/retro/0060-compound-workspace-admission/compound-workspace-admission.md

@@ -24,11 +24,15 @@
   `eb8d617620fa8f401fb887f5b1bbc341d4746b0a`; exact reviewed head
   `29ba6e88c787a5e54c95a554e9166fd21aae31c0` passed 14/14 release-verifier
   stages with 7,141 observed tests.
+- Release PR #125 merged normally as
+  `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`; signed tag `v6.5.9`, trusted npm
+  publication with SLSA provenance, and the final GitHub Release all resolve to
+  that reviewed merge.
+- The publication witness records the exact tag object, release workflow,
+  registry integrity, signature audit, and clean-room consumer smoke.
 
 ## What Did Not Yet Ship
 
-- v6.5.9 is not tagged or published until the release candidate, reviewed
-  merge, signed-tag workflow, registry artifact, and clean consumer checks pass.
 - git-warp has not yet consumed the registry artifact or rerun its exact
   reference, migrated-v18, process-census, and CPU gates.
 - Think remains unchanged until the ordered Plumbing -> git-cas -> git-warp

test/unit/docs/release-state.test.js

@@ -6,6 +6,8 @@ const repoRoot = process.cwd();
 const v653PublishedMarker = '**v6.5.3 artifact posture**';
 const v659CandidatePath =
   'docs/design/0060-compound-workspace-admission/witness/release-candidate.md';
+const v659PublicationPath =
+  'docs/design/0060-compound-workspace-admission/witness/release-publication.md';
 const v658CandidatePath = 'docs/design/0059-bounded-write-waves/witness/release-candidate.md';
 const v658PublicationPath = 'docs/design/0059-bounded-write-waves/witness/release-publication.md';
 const v657CandidatePath =
@@ -389,7 +391,6 @@ function expectV658CandidateEvidence(candidate, releaseNotes) {
 }
 
 function expectV658PublishedEvidence(status, publication) {
-  expect(status).toContain('**Last tagged release:** `v6.5.8` (`2026-08-23`)');
   expect(status).toContain('**v6.5.8 artifact posture**');
   expect(status).toContain('57b40553');
   expect(status).toContain('32690361682');
@@ -414,9 +415,7 @@ function expectV658PublishedEvidence(status, publication) {
   expect(publication).toContain('CLI version `6.5.8+57b4055`');
 }
 
-function expectV659CandidateEvidence(status, candidate, releaseNotes) {
-  expect(status).toContain('**Current release state:** `v6.5.9` release candidate');
-  expect(status).toContain('**v6.5.9 candidate posture**');
+function expectV659CandidateEvidence(candidate, releaseNotes) {
   expect(candidate).toContain('# PERF-0060 v6.5.9 Release Candidate Witness');
   expect(candidate).toContain('Implementation review: #124');
   expect(candidate).toContain('Release review: #125');
@@ -428,7 +427,35 @@ function expectV659CandidateEvidence(status, candidate, releaseNotes) {
   expect(candidate).toContain('**7,147**');
   expect(candidate).toMatch(/explicitly\s+unpublished\s+candidate/);
   expect(releaseNotes).toMatch(/requires no application or stored-data migration/);
-  expectNoV659PublicationEvidence(status, candidate, releaseNotes);
+  expectNoV659PublicationEvidence(candidate, releaseNotes);
+}
+
+function expectV659PublishedEvidence(status, publication) {
+  expect(status).toContain('**Last tagged release:** `v6.5.9` (`2026-08-24`)');
+  expect(status).toContain('**Current release state:** `v6.5.9` is published');
+  expect(status).toContain('**v6.5.9 artifact posture**');
+  expect(status).toContain('a16e31a9');
+  expect(status).toContain('32766297971');
+  expect(publication).toContain('# PERF-0060 v6.5.9 Publication Witness');
+  expect(publication).toContain(
+    '- Reviewed merge commit: `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`'
+  );
+  expect(publication).toContain('- Tag object: `df65d8af46c5e4758ab3108272ebc849df58c29e`');
+  expect(publication).toContain('- Peeled tag target: `a16e31a9d4b0dff3b538fe8ad9ad2da31b67b275`');
+  expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135');
+  expect(publication).toContain('- Signed annotated tag: `v6.5.9`');
+  expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.9');
+  expect(publication).toContain('actions/runs/32766297971');
+  expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.9`\s+\|/);
+  expect(publication).toMatch(/\| Dist-tag\s+\| `latest` -> `6\.5\.9`\s+\|/);
+  expect(publication).toContain(
+    'sha512-shlQB+EgLmzWsWTxRwLUN8rovI1wKv0N2yx43fiAxdOLTqMOOQOxSB8AMLfUmxnVd0zS+/0HIEwXF5ixl046XQ=='
+  );
+  expect(publication).toContain('a4fcff9ffd6c50292284903606726d6067636d56');
+  expect(publication).toContain('2,318,806');
+  expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.9');
+  expect(publication).toContain('CLI version `6.5.9+a16e31a9`');
+  expect(publication).toContain('`StagingWorkspace.prototype.batch`');
 }
 
 function expectV656PublishedEvidence(status, publication) {
@@ -602,13 +629,15 @@ function expectV658ReleaseDocs(status) {
 
 function expectV659ReleaseDocs(status) {
   const candidate = read(v659CandidatePath);
+  const publication = read(v659PublicationPath);
   const releaseNotes = read('docs/releases/v6.5.9.md');
 
-  expectV659CandidateEvidence(status, candidate, releaseNotes);
+  expectV659CandidateEvidence(candidate, releaseNotes);
+  expectV659PublishedEvidence(status, publication);
 }
 
 function expectCurrentQueue(status) {
-  expect(status).toContain('Current release goalpost:');
+  expect(status).toContain('Latest completed release goalpost:');
   expect(status).toContain('Current queued release goalposts are');
   expect(status).toContain('#39 v6.6.0: Operator TUI');
   expect(status).toContain('#40 v6.6.0: Agent automation follow-through');
@@ -617,7 +646,7 @@ function expectCurrentQueue(status) {
 }
 
 describe('release state docs', () => {
-  it('enforces the v6.5.9 candidate and prior publication evidence', () => {
+  it('enforces the v6.5.9 candidate history and publication evidence', () => {
     const status = read('STATUS.md');
     const [v656Candidate, v656Publication] = [v656CandidatePath, v656PublicationPath].map(read);
     const v655Candidate = read(v655CandidatePath);
@@ -669,11 +698,10 @@ describe('release state docs', () => {
 
 describe('v6.5.9 candidate publication-marker calibration', () => {
   it('rejects a GitHub Release marker in candidate release notes', () => {
-    const status = read('STATUS.md');
     const candidate = read(v659CandidatePath);
     const releaseNotes = `${read('docs/releases/v6.5.9.md')}\nhttps://github.com/git-stunts/git-cas/releases/tag/v6.5.9\n`;
 
-    expect(() => expectV659CandidateEvidence(status, candidate, releaseNotes)).toThrow();
+    expect(() => expectV659CandidateEvidence(candidate, releaseNotes)).toThrow();
   });
 });