From d08f2135f97e244ec2ec179bc42ce0bb94adc62c Mon Sep 17 00:00:00 2001 From: James Ross Date: Mon, 24 Aug 2026 15:11:57 -0700 Subject: [PATCH] docs: record v6.5.10 publication --- BEARING.md | 18 +-- STATUS.md | 42 ++++--- .../compound-workspace-assets.md | 19 +++- .../witness/release-publication.md | 105 ++++++++++++++++++ .../compound-workspace-assets.md | 7 +- test/unit/docs/release-state.test.js | 48 ++++++-- 6 files changed, 193 insertions(+), 46 deletions(-) create mode 100644 docs/design/0061-compound-workspace-assets/witness/release-publication.md diff --git a/BEARING.md b/BEARING.md index d0539f8..6ffc0d9 100644 --- a/BEARING.md +++ b/BEARING.md @@ -14,7 +14,7 @@ timeline ## Current State -`v6.5.9` shipped on `2026-08-24`, and `v6.5.10` is under release review. +`v6.5.10` shipped on `2026-08-24`. Application asset, bundle, page, cache, expiry, witness, and repository-diagnostics APIs sit above mutable root sets and the low-level CAS pipeline. Direct bundle-reference reads and bounded @@ -100,14 +100,14 @@ What exists now: generation retains their union. A 33-operation witness reduced 200 Git children to 23 and 33 retained generations to one in both SHA-1 and SHA-256 repositories without changing any application handle. -- **Compound workspace assets and exact roots.** The v6.5.10 candidate adds +- **Compound workspace assets and exact roots.** v6.5.10 adds bounded asset waves to the same compound persistence scope and optionally retains a canonical, nonempty, deduplicated selection of handles staged by that exact admission. Prior workspace roots and v6.5.9 retain-all behavior remain intact. A controlled downstream git-warp prototype reduced cold Git commands from 139 to 50 and incremental commands from 149 to 60; those - consumer numbers remain provisional until repeated against the public - registry artifact. + consumer numbers remain provisional until git-warp installs the public + registry artifact and repeats the exact corpus. - **Batched workspace page retention.** v6.5.4 adds `workspace.pages.putBatch()` so one bounded ordered page group is written and retained under one exact workspace generation instead of rewriting a growing @@ -178,15 +178,15 @@ These were the active tensions from the previous bearing. All resolved. ## Next Horizon -With v6.5.9 shipped and the v6.5.10 candidate under release review, active work -is tracked in GitHub Issues and Milestones. Repo docs hold design and evidence -records, not the active queue. The candidate design is: +With v6.5.10 shipped, active work is tracked in GitHub Issues and Milestones. +Repo docs hold design and evidence records, not the active queue. The completed +release design is: - [#127](https://github.com/git-stunts/git-cas/issues/127) - [0061-compound-workspace-assets](./docs/design/0061-compound-workspace-assets/compound-workspace-assets.md) -Its release evidence remains owned by -[#127](https://github.com/git-stunts/git-cas/issues/127) under the +Its completed release evidence is owned by +[#127](https://github.com/git-stunts/git-cas/issues/127) in the [`v6.5.10` milestone](https://github.com/git-stunts/git-cas/milestone/20). The broader horizon remains: diff --git a/STATUS.md b/STATUS.md index 65299af..69c0149 100644 --- a/STATUS.md +++ b/STATUS.md @@ -1,8 +1,8 @@ # STATUS -**Last tagged release:** `v6.5.9` (`2026-08-24`) -**Current release state:** `v6.5.10` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow. -**Latest verification:** exact versioned candidate `2a5be40c` passed 14/14 release-verifier stages with 7,192 observed tests; tag and publication verification remain pending. +**Last tagged release:** `v6.5.10` (`2026-08-24`) +**Current release state:** `v6.5.10` is published to npm and GitHub Releases. +**Latest verification:** reviewed release merge `4316f4ec` passed 14/14 release-verifier stages with 7,192 observed tests; signed tag `v6.5.10` peels to that merge, and release workflow `32782415971` published the matching npm artifact plus final GitHub Release. **Playback truth:** `main` **Runtimes:** Node.js 22.x, Bun, Deno **Current planning method:** [WORKFLOW.md](./WORKFLOW.md) @@ -18,25 +18,25 @@ - The machine-facing `git cas agent` surface exists and now supports OS-keychain passphrase sources for vault-derived key flows, but parity and portability are still partial. -- **v6.5.10 candidate posture** — implementation PR - [#128](https://github.com/git-stunts/git-cas/pull/128) merged normally as - `57cd3002`; its exact reviewed head is `67147506`, and exact implementation - checkpoint `e663754b` passed all 14 release-verifier stages with 7,186 - observed tests. Exact versioned candidate `2a5be40c` passed the same 14-stage - method with 7,192 observed tests. npm, JSR, and runtime metadata identify - `6.5.10`, while the signed tag and registry artifact remain deliberately - absent pending release review [#129](https://github.com/git-stunts/git-cas/pull/129). - The additive contract admits bounded asset waves into the compound scope and - can retain exact selected terminal roots without changing stored formats, - handles, refs, or readers. The controlled git-warp prototype cut cold Git - commands from 139 to 50 and incremental commands from 149 to 60; those - downstream numbers remain provisional until repeated against the public - registry artifact. No application or stored-data migration is required. +- **v6.5.10 artifact posture** — implementation PR + [#128](https://github.com/git-stunts/git-cas/pull/128) and release PR + [#129](https://github.com/git-stunts/git-cas/pull/129) merged normally. + Signed tag `v6.5.10` resolves to reviewed release merge `4316f4ec`; npm + reports `@git-stunts/git-cas@6.5.10` as `latest` with publish and SLSA + provenance, and release workflow `32782415971` published the final GitHub + Release. The additive contract admits bounded asset waves into the compound + scope and can retain exact selected terminal roots without changing stored + formats, handles, refs, or readers. The controlled git-warp prototype cut + cold Git commands from 139 to 50 and incremental commands from 149 to 60; + those downstream numbers remain provisional until repeated against this + public artifact. No application or stored-data migration is required. JSR + dry-run validation is healthy, but JSR publication is not part of the release + workflow. - **v6.5.9 artifact posture** — implementation PR [#124](https://github.com/git-stunts/git-cas/pull/124) and release PR [#125](https://github.com/git-stunts/git-cas/pull/125) merged normally. - Signed tag `v6.5.9` resolves to reviewed release merge `a16e31a9`; npm reports - `@git-stunts/git-cas@6.5.9` as `latest` with publish and SLSA provenance, and + Signed tag `v6.5.9` resolves to reviewed release merge `a16e31a9`; npm retains + `@git-stunts/git-cas@6.5.9` with publish and SLSA provenance, and release workflow `32766297971` published the final GitHub Release. The SHA-1/SHA-256 compound witness preserves every application-handle digest while reducing a 33-operation graph from 200 to 23 Git children and from 33 @@ -193,10 +193,6 @@ - GitHub Issues are canonical. If this section and GitHub disagree, GitHub wins and this section should be corrected. - Latest completed release goalpost: - [#123 v6.5.9: Compound staging-workspace admission](https://github.com/git-stunts/git-cas/issues/123) - under the - [`v6.5.9` milestone](https://github.com/git-stunts/git-cas/milestone/19). -- Active release goalpost: [#127 v6.5.10: Compound workspace assets and exact roots](https://github.com/git-stunts/git-cas/issues/127) under the [`v6.5.10` milestone](https://github.com/git-stunts/git-cas/milestone/20). diff --git a/docs/design/0061-compound-workspace-assets/compound-workspace-assets.md b/docs/design/0061-compound-workspace-assets/compound-workspace-assets.md index 9b78d2b..3e61850 100644 --- a/docs/design/0061-compound-workspace-assets/compound-workspace-assets.md +++ b/docs/design/0061-compound-workspace-assets/compound-workspace-assets.md @@ -433,7 +433,7 @@ The work is done when: without migration. - [x] Public docs, architecture, changelog, issue, PR, CI, and local validation are complete. -- [ ] v6.5.10 is publicly installable before downstream results are claimed as +- [x] v6.5.10 is publicly installable before downstream results are claimed as release behavior. ## Validation Plan @@ -507,7 +507,20 @@ boundedness hole before review: selector input count is now capped by the exact staged-artifact count, preventing duplicate input scanning from exceeding the admission's own evidence ledger. +Release PR #129 merged normally as +`4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`. That exact merge passed all 14 +release-verifier stages with 7,192 observed tests before signed tag `v6.5.10` +triggered successful release workflow +[`32782415971`](https://github.com/git-stunts/git-cas/actions/runs/32782415971). +The registry, provenance, signature, GitHub Release, and clean-room compound +asset smoke are recorded in the +[publication witness](./witness/release-publication.md). + The controlled git-warp prototype reduced cold Git commands from 139 to 50 and incremental commands from 149 to 60 with equal semantic fingerprints and replay -counts. That result remains provisional until it is repeated against the -public v6.5.10 registry artifact. +counts. The public dependency now exists; that downstream result remains +provisional until git-warp installs it and repeats the corpus. + +Release PR: + +- [#129 - Release v6.5.10 compound workspace assets and exact roots](https://github.com/git-stunts/git-cas/pull/129) diff --git a/docs/design/0061-compound-workspace-assets/witness/release-publication.md b/docs/design/0061-compound-workspace-assets/witness/release-publication.md new file mode 100644 index 0000000..9f6395f --- /dev/null +++ b/docs/design/0061-compound-workspace-assets/witness/release-publication.md @@ -0,0 +1,105 @@ +# PERF-0061 v6.5.10 Publication Witness + +Date: 2026-08-24 + +Issue: #127 + +## Immutable Release Identity + +- Implementation PR: + [#128](https://github.com/git-stunts/git-cas/pull/128) +- Release PR: [#129](https://github.com/git-stunts/git-cas/pull/129) +- Reviewed merge commit: `4316f4ec7eeda531c07627d2ad0d15c1fcade2f8` +- Signed annotated tag: `v6.5.10` +- Tag object: `37e2b32f501b09abd10130cf0046e2a99885f5f3` +- Peeled tag target: `4316f4ec7eeda531c07627d2ad0d15c1fcade2f8` +- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135` +- GitHub Release: + [v6.5.10](https://github.com/git-stunts/git-cas/releases/tag/v6.5.10) + (final, not a draft or prerelease; published `2026-08-24T22:05:09Z`) + +Local `git verify-tag v6.5.10` reported a good signature. GitHub independently +reports the annotated tag signature as valid and verified. Local peeling and +the GitHub tag object both resolve to the reviewed release merge exactly. + +## Release Workflow + +[Release run 32782415971](https://github.com/git-stunts/git-cas/actions/runs/32782415971) +completed successfully against tag `v6.5.10` and exact commit +`4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`: + +| Job | Result | Evidence | +| -------------- | ------ | -------------------------------------------------- | +| Validate | pass | Tag version matched `package.json` | +| Test | pass | Lint, unit, and Node/Bun/Deno real-Git integration | +| Publish npm | pass | OIDC trusted publication completed | +| GitHub Release | pass | Final release created after npm publication | + +Before tagging, the exact reviewed merge passed all 14 release-verifier stages +with 7,192 observed tests, public type compatibility, examples, build stamping, +and npm and JSR dry-runs. The explicit tag push also passed the repository's +pre-push lint and 2,194-test Node unit gate. + +## npm Registry Evidence + +Independent registry queries after the workflow completed reported: + +| Field | Value | +| ------------- | ------------------------------------------------------------------------------------------------- | +| Package | `@git-stunts/git-cas@6.5.10` | +| Published | `2026-08-24T22:04:55.645Z` | +| Dist-tag | `latest` -> `6.5.10` | +| Git head | `4316f4ec7eeda531c07627d2ad0d15c1fcade2f8` | +| Integrity | `sha512-JemWVMtuzqArMyxnIMBBQFMOIQ3CsvhXKfza9aIjNPxQ3MBt7J/Hm2ePr3k7Z+wtM+MO38BTGA7gzCZ/Hpld4w==` | +| Shasum | `3592d2b86ad7e8ab54ae8809d6de977c8eee5ad2` | +| File count | `270` | +| Unpacked size | `2,331,318` bytes | +| Tarball | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.10.tgz` | + +The registry exposes the package-version +[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.10) +with npm publish and `https://slsa.dev/provenance/v1` predicates. The decoded +SLSA statement resolves `refs/tags/v6.5.10` to exact Git commit +`4316f4ec7eeda531c07627d2ad0d15c1fcade2f8` and workflow run `32782415971`. + +## Clean-Room Consumer Smoke + +A fresh temporary bare Git repository with no source-worktree dependency +installed the exact registry package with: + +```bash +npm install --ignore-scripts @git-stunts/git-cas@6.5.10 +``` + +The installed artifact then reported: + +- package version `6.5.10`; +- CLI version `6.5.10+4316f4e`; +- embedded build SHA `4316f4e`; +- successful ESM root import with 45 public exports; +- successful `@git-stunts/git-cas/service` subpath import; +- public `StagingWorkspace.prototype.batch`; +- successful real-Git compound admission using `scope.assets.putBatch()`, an + ordered bundle wave, and the synchronous `retain(value)` selector; +- exact payload readback through the retained terminal bundle; +- exactly one selected terminal root in the retention evidence; and +- `npm audit signatures` verified registry signatures for all 20 installed + packages and attestations for 11, with no invalid or missing results. + +This proves that the package consumers receive from npm carries the reviewed +release identity and exposes compound asset admission plus exact selected-root +retention through the public package boundary. + +## Compatibility And Downstream Boundary + +This release requires no application or stored-data migration. It changes no +stored asset, page, bundle, descriptor, RootSet, handle, namespace, ref layout, +or reader. Existing repositories and workspace refs open in place. Omitting +`retain` preserves v6.5.9 retain-all behavior. + +This witness closes the git-cas publication gate. It does not claim that the +controlled git-warp prototype numbers are released-artifact measurements or +that Think has consumed the release. The next required sequence is git-warp +installing this exact registry artifact, repeating its semantic, migrated-v18, +process-census, CPU, and wall-time gates, publishing its release, and only then +updating Think. diff --git a/docs/method/retro/0061-compound-workspace-assets/compound-workspace-assets.md b/docs/method/retro/0061-compound-workspace-assets/compound-workspace-assets.md index 46ea32a..a9884c8 100644 --- a/docs/method/retro/0061-compound-workspace-assets/compound-workspace-assets.md +++ b/docs/method/retro/0061-compound-workspace-assets/compound-workspace-assets.md @@ -26,10 +26,15 @@ `6714750620aa2310ad0279f957414be65898a66a` contains implementation checkpoint `e663754bf221784f0e5856a41fe071bebfa5befb`, whose complete release method passed 14/14 stages with 7,186 observed tests. +- Release PR #129 merged normally as + `4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`; signed tag `v6.5.10`, trusted npm + publication with SLSA provenance, and the final GitHub Release all resolve to + that reviewed merge. +- The publication witness records the exact tag object, release workflow, + registry integrity, signature audit, and clean-room compound asset smoke. ## What Did Not Yet Ship -- v6.5.10 has not yet been tagged or published to npm and GitHub Releases. - git-warp has not yet installed the registry artifact or repeated its exact reference, migrated-v18, process-census, CPU, and wall-time gates. - Think remains unchanged until the ordered Plumbing -> git-cas -> git-warp diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js index 6779ade..6e9ec7b 100644 --- a/test/unit/docs/release-state.test.js +++ b/test/unit/docs/release-state.test.js @@ -6,6 +6,8 @@ const repoRoot = process.cwd(); const v653PublishedMarker = '**v6.5.3 artifact posture**'; const v6510CandidatePath = 'docs/design/0061-compound-workspace-assets/witness/release-candidate.md'; +const v6510PublicationPath = + 'docs/design/0061-compound-workspace-assets/witness/release-publication.md'; const v659CandidatePath = 'docs/design/0060-compound-workspace-admission/witness/release-candidate.md'; const v659PublicationPath = @@ -455,9 +457,7 @@ function expectV659CandidateEvidence(candidate, releaseNotes) { expectNoV659PublicationEvidence(candidate, releaseNotes); } -function expectV6510CandidateEvidence(status, candidate, releaseNotes) { - expect(status).toContain('**Current release state:** `v6.5.10` release candidate'); - expect(status).toContain('**v6.5.10 candidate posture**'); +function expectV6510CandidateEvidence(candidate, releaseNotes) { expect(candidate).toContain('# PERF-0061 v6.5.10 Release Candidate Witness'); expect(candidate).toContain('Implementation review: #128'); expect(candidate).toContain('Release review: #129'); @@ -470,11 +470,38 @@ function expectV6510CandidateEvidence(status, candidate, releaseNotes) { expect(candidate).toContain('**7,192**'); expect(candidate).toMatch(/explicitly\s+unpublished\s+candidate/); expect(releaseNotes).toMatch(/requires no application or stored-data migration/); - expectNoV6510PublicationEvidence(status, candidate, releaseNotes); + expectNoV6510PublicationEvidence(candidate, releaseNotes); +} + +function expectV6510PublishedEvidence(status, publication) { + expect(status).toContain('**Last tagged release:** `v6.5.10` (`2026-08-24`)'); + expect(status).toContain('**v6.5.10 artifact posture**'); + expect(status).toContain('4316f4ec'); + expect(status).toContain('32782415971'); + expect(publication).toContain('# PERF-0061 v6.5.10 Publication Witness'); + expect(publication).toContain( + '- Reviewed merge commit: `4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`' + ); + expect(publication).toContain('- Tag object: `37e2b32f501b09abd10130cf0046e2a99885f5f3`'); + expect(publication).toContain('- Peeled tag target: `4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`'); + expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135'); + expect(publication).toContain('- Signed annotated tag: `v6.5.10`'); + expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.10'); + expect(publication).toContain('actions/runs/32782415971'); + expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.10`\s+\|/); + expect(publication).toMatch(/\| Dist-tag\s+\| `latest` -> `6\.5\.10`\s+\|/); + expect(publication).toContain( + 'sha512-JemWVMtuzqArMyxnIMBBQFMOIQ3CsvhXKfza9aIjNPxQ3MBt7J/Hm2ePr3k7Z+wtM+MO38BTGA7gzCZ/Hpld4w==' + ); + expect(publication).toContain('3592d2b86ad7e8ab54ae8809d6de977c8eee5ad2'); + expect(publication).toContain('2,331,318'); + expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.10'); + expect(publication).toContain('CLI version `6.5.10+4316f4e`'); + expect(publication).toContain('`scope.assets.putBatch()`'); + expect(publication).toContain('exactly one selected terminal root'); } function expectV659PublishedEvidence(status, publication) { - expect(status).toContain('**Last tagged release:** `v6.5.9` (`2026-08-24`)'); expect(status).toContain('**v6.5.9 artifact posture**'); expect(status).toContain('a16e31a9'); expect(status).toContain('32766297971'); @@ -680,9 +707,11 @@ function expectV659ReleaseDocs(status) { function expectV6510ReleaseDocs(status) { const candidate = read(v6510CandidatePath); + const publication = read(v6510PublicationPath); const releaseNotes = read('docs/releases/v6.5.10.md'); - expectV6510CandidateEvidence(status, candidate, releaseNotes); + expectV6510CandidateEvidence(candidate, releaseNotes); + expectV6510PublishedEvidence(status, publication); } function expectRecentReleaseDocs(status) { @@ -697,13 +726,13 @@ function expectCurrentQueue(status) { expect(status).toContain('Current queued release goalposts are'); expect(status).toContain('#39 v6.6.0: Operator TUI'); expect(status).toContain('#40 v6.6.0: Agent automation follow-through'); - expect(status).toContain('#123 v6.5.9: Compound staging-workspace admission'); expect(status).toContain('#127 v6.5.10: Compound workspace assets and exact roots'); expect(status).toContain('0061-compound-workspace-assets'); + expect(status).not.toContain('Active release goalpost:'); } describe('release state docs', () => { - it('enforces the v6.5.10 candidate and prior publication evidence', () => { + it('enforces the v6.5.10 publication and prior release evidence', () => { const status = read('STATUS.md'); const [v656Candidate, v656Publication] = [v656CandidatePath, v656PublicationPath].map(read); const v655Candidate = read(v655CandidatePath); @@ -753,11 +782,10 @@ describe('release state docs', () => { describe('v6.5.10 candidate publication-marker calibration', () => { it('rejects a GitHub Release marker in candidate release notes', () => { - const status = read('STATUS.md'); const candidate = read(v6510CandidatePath); const releaseNotes = `${read('docs/releases/v6.5.10.md')}\nhttps://github.com/git-stunts/git-cas/releases/tag/v6.5.10\n`; - expect(() => expectV6510CandidateEvidence(status, candidate, releaseNotes)).toThrow(); + expect(() => expectV6510CandidateEvidence(candidate, releaseNotes)).toThrow(); }); });