From 36c70d332f51ae06f230005a9d9d8fea8ad9994c Mon Sep 17 00:00:00 2001 From: James Ross Date: Fri, 17 Jul 2026 21:32:55 -0700 Subject: [PATCH 1/2] docs: record git-cas v6.4.0 publication --- STATUS.md | 21 +++--- .../scoped-staging-workspaces.md | 2 +- .../witness/release-publication.md | 73 +++++++++++++++++++ test/unit/docs/release-state.test.js | 8 +- 4 files changed, 91 insertions(+), 13 deletions(-) create mode 100644 docs/design/0049-scoped-staging-workspaces/witness/release-publication.md diff --git a/STATUS.md b/STATUS.md index 474da92..d7d82b4 100644 --- a/STATUS.md +++ b/STATUS.md @@ -1,8 +1,8 @@ # STATUS -**Last tagged release:** `v6.3.0` (`2026-07-17`) -**Current release state:** `v6.4.0` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow. -**Latest verification:** the `v6.4.0` release verifier passed 14/14 steps with 6,538 observed tests across Node.js, Bun, and Deno; npm and JSR dry-runs passed. +**Last tagged release:** `v6.4.0` (`2026-07-18`) +**Current release state:** `v6.4.0` is published to npm and GitHub Releases from signed tag `v6.4.0` at reviewed merge `d47af74a`. +**Latest verification:** Release run `29627828620` passed validation, unit and Node/Bun/Deno real-Git integration, OIDC trusted npm publication, and final GitHub Release creation; npm reports `6.4.0` as `latest` with SLSA provenance. **Playback truth:** `main` **Runtimes:** Node.js 22.x, Bun, Deno **Current planning method:** [WORKFLOW.md](./WORKFLOW.md) @@ -18,11 +18,12 @@ - The machine-facing `git cas agent` surface exists and now supports OS-keychain passphrase sources for vault-derived key flows, but parity and portability are still partial. -- **v6.4.0 candidate posture** — scoped staging workspaces are merged through - reviewed commit `1ac2fc8`, and structured RootSet lock retries are corrected - by `8185dfb9`; npm, JSR, and runtime version metadata now identify `6.4.0`, - while the tag and registry artifacts remain deliberately absent until - release-candidate review completes. +- **v6.4.0 artifact posture** — signed tag `v6.4.0` resolves to reviewed merge + `d47af74`; npm reports `@git-stunts/git-cas@6.4.0` as `latest` with SLSA + provenance, and the final GitHub Release is published. Scoped staging + workspaces and the corrected structured RootSet lock retry are shipped. JSR + dry-run validation is healthy, but JSR publication is not part of the release + workflow. - **v6.3.0 artifact posture** — signed tag `v6.3.0` resolves to reviewed merge `33f4171`; npm reports `@git-stunts/git-cas@6.3.0` as `latest` with SLSA provenance, and the final GitHub Release is published. JSR dry-run validation @@ -104,9 +105,9 @@ - GitHub Issues are canonical. If this section and GitHub disagree, GitHub wins and this section should be corrected. - Current release goalpost: - [#75 Scoped staging workspaces for multi-object promotion](https://github.com/git-stunts/git-cas/issues/75) + [#38 Bounded Residency](https://github.com/git-stunts/git-cas/issues/38) under the - [`v6.4.0` milestone](https://github.com/git-stunts/git-cas/milestone/4). + [`v6.4.1` milestone](https://github.com/git-stunts/git-cas/milestone/8). - The latest landed design record is [0049-scoped-staging-workspaces](./docs/design/0049-scoped-staging-workspaces/scoped-staging-workspaces.md). diff --git a/docs/design/0049-scoped-staging-workspaces/scoped-staging-workspaces.md b/docs/design/0049-scoped-staging-workspaces/scoped-staging-workspaces.md index aeb323c..adeee93 100644 --- a/docs/design/0049-scoped-staging-workspaces/scoped-staging-workspaces.md +++ b/docs/design/0049-scoped-staging-workspaces/scoped-staging-workspaces.md @@ -528,7 +528,7 @@ The work is done when: - [x] Issue and PR are linked correctly. - [x] Implementation PR CI, Code Rabbit, self-review, and independent Code Lawyer review are clean. -- [ ] v6.4.0 is published before git-warp consumes the API. +- [x] v6.4.0 is published before git-warp consumes the API. ## Validation Plan diff --git a/docs/design/0049-scoped-staging-workspaces/witness/release-publication.md b/docs/design/0049-scoped-staging-workspaces/witness/release-publication.md new file mode 100644 index 0000000..a2ef860 --- /dev/null +++ b/docs/design/0049-scoped-staging-workspaces/witness/release-publication.md @@ -0,0 +1,73 @@ +# PERF-0049 v6.4.0 Publication Witness + +Date: 2026-07-18 + +Issues: #75, #77 + +## Immutable Release Identity + +- Release PR: [#78](https://github.com/git-stunts/git-cas/pull/78) +- Reviewed merge commit: `d47af74a288ef362dba684536cff11c063cfdcc3` +- Signed annotated tag: `v6.4.0` +- Tag object: `3545b8aa81e395e832f112214b301dbe53d9576f` +- Peeled tag target: `d47af74a288ef362dba684536cff11c063cfdcc3` +- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135` +- GitHub Release: + [v6.4.0](https://github.com/git-stunts/git-cas/releases/tag/v6.4.0) + (final, not a draft or prerelease; published `2026-07-18T02:58:40Z`) + +Local `git tag -v v6.4.0` reported a good signature. The remote tag object and +peeled target match the local tag and reviewed merge commit exactly. + +## Release Workflow + +[Release run 29627828620](https://github.com/git-stunts/git-cas/actions/runs/29627828620) +completed successfully against `v6.4.0`: + +| Job | Result | Evidence | +| --- | --- | --- | +| Validate | pass | Tag version matched `package.json` | +| Test | pass | Lint, unit, Node/Bun/Deno real-Git integration | +| Publish npm | pass | OIDC trusted publication completed | +| GitHub Release | pass | Final release created after npm publication | + +Before tagging, `pnpm run release:verify` passed all 14 steps against version +`6.4.0`, observing 6,538 tests and completing public type compatibility, npm +package inspection, and the JSR publication dry-run. The tag push also passed +the local pre-push lint and 1,993-test Node unit gate. + +## npm Registry Evidence + +Independent registry queries after the workflow completed reported: + +| Field | Value | +| --- | --- | +| Package | `@git-stunts/git-cas@6.4.0` | +| Published | `2026-07-18T02:58:25.447Z` | +| Dist-tag | `latest` -> `6.4.0` | +| Integrity | `sha512-xLtNBCpXolGGusV8efsr/cRlhjrRrFFKZQVwgx/gNtonPVzDor6AyidtILM88ss6M6bJLapGUgOaoimr/y3gZA==` | +| Shasum | `5feda2da0e05bbded738602dd47c8bc1d58a3921` | +| Unpacked size | `2,129,716` bytes | +| Tarball | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.4.0.tgz` | + +The registry exposes the package-version +[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.4.0) +with npm publish and `https://slsa.dev/provenance/v1` predicates. The SLSA +statement resolves the build to Git commit +`d47af74a288ef362dba684536cff11c063cfdcc3` from tag `v6.4.0` and release +workflow run `29627828620`. + +## Downstream Gate + +The registry artifact now satisfies the dependency gate for git-warp. The +git-cas release goalpost can close on this publication evidence, while +git-stunts/git-warp#738 remains open until git-warp consumes published version +`6.4.0` through its normal package manager and records executable compatibility +and performance evidence. A local path override is not acceptable proof of the +released contract. + +Publication does not prove git-warp's unchanged ten-second integration hook or +the direct-workspace performance advantage over its CacheSet workaround. Those +remain downstream gates. JSR publication was not claimed or attempted; its +dry-run is healthy, but npm and GitHub Releases are the v6.4.0 publication +surfaces. diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js index d7674e5..f64d2a8 100644 --- a/test/unit/docs/release-state.test.js +++ b/test/unit/docs/release-state.test.js @@ -47,6 +47,7 @@ function expectV640CandidateState(status, candidate, publication) { expect(status).toContain('**Last tagged release:** `v6.3.0` (`2026-07-17`)'); expect(status).toContain(v640CandidateMarker); expect(status).toContain('remain pending the reviewed tag workflow'); + expect(status).toContain('#75 Scoped staging workspaces for multi-object promotion'); expect(candidate).toContain('# PERF-0049 v6.4.0 Release Candidate Witness'); expect(candidate).toContain('1ac2fc85be857ca769c459b89c29bf4483b3f304'); expect(candidate).toContain('8185dfb9819909d9fbe0f0394de6ae31fc0a94a3'); @@ -61,6 +62,8 @@ function expectV640CandidateState(status, candidate, publication) { function expectV640PublishedState(status, publication) { expect(status).toMatch(/\*\*Last tagged release:\*\* `v6\.4\.0` \(`\d{4}-\d{2}-\d{2}`\)/); expect(status).toContain(v640PublishedMarker); + expect(status).toContain('#38 Bounded Residency'); + expect(status).toContain('[`v6.4.1` milestone]'); expect(publication).toContain('# PERF-0049 v6.4.0 Publication Witness'); expect(publication).toContain('- Signed annotated tag: `v6.4.0`'); expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.4.0'); @@ -85,7 +88,9 @@ function expectV640Lifecycle(status, candidate, publication) { function expectFutureV640PublicationState() { const status = [ '**Last tagged release:** `v6.4.0` (`2026-07-17`)', - `${v640PublishedMarker} to npm with provenance and to GitHub Releases.` + `${v640PublishedMarker} to npm with provenance and to GitHub Releases.`, + '#38 Bounded Residency', + '[`v6.4.1` milestone]' ].join('\n'); const publication = [ '# PERF-0049 v6.4.0 Publication Witness', @@ -109,7 +114,6 @@ describe('release state docs', () => { expectV640Lifecycle(status, candidate, publication); expectFutureV640PublicationState(); expect(status).toContain('Current release goalpost:'); - expect(status).toContain('#75 Scoped staging workspaces for multi-object promotion'); expect(v630Publication).toContain('33f4171f6b69d75110de834f9a75d64e2d14e1a3'); expect(v630Publication).toContain('sha512-Cl/WPjj60LvjXl3BqSb1M3a0tx2xpx6KxGEC1TXKekNzgn5so/t43LG7Qz2XuXle+YmXWoCi8H94cJYvfgI8Yw=='); expect(v630Publication).toContain('https://slsa.dev/provenance/v1'); From 4e513188c16a67ddae794879c2a52afde34daa79 Mon Sep 17 00:00:00 2001 From: James Ross Date: Fri, 17 Jul 2026 21:45:16 -0700 Subject: [PATCH 2/2] test: pin v6.4.0 publication identity --- .../witness/release-publication.md | 9 +++++---- test/unit/docs/release-state.test.js | 18 ++++++++++++++++++ 2 files changed, 23 insertions(+), 4 deletions(-) diff --git a/docs/design/0049-scoped-staging-workspaces/witness/release-publication.md b/docs/design/0049-scoped-staging-workspaces/witness/release-publication.md index a2ef860..a3097da 100644 --- a/docs/design/0049-scoped-staging-workspaces/witness/release-publication.md +++ b/docs/design/0049-scoped-staging-workspaces/witness/release-publication.md @@ -61,10 +61,11 @@ workflow run `29627828620`. The registry artifact now satisfies the dependency gate for git-warp. The git-cas release goalpost can close on this publication evidence, while -git-stunts/git-warp#738 remains open until git-warp consumes published version -`6.4.0` through its normal package manager and records executable compatibility -and performance evidence. A local path override is not acceptable proof of the -released contract. +[git-stunts/git-warp#738](https://github.com/git-stunts/git-warp/issues/738) +remains open until git-warp consumes published version `6.4.0` through its +normal package manager and records executable compatibility and performance +evidence. A local path override is not acceptable proof of the released +contract. Publication does not prove git-warp's unchanged ten-second integration hook or the direct-workspace performance advantage over its CacheSet workaround. Those diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js index f64d2a8..cff5f03 100644 --- a/test/unit/docs/release-state.test.js +++ b/test/unit/docs/release-state.test.js @@ -72,6 +72,21 @@ function expectV640PublishedState(status, publication) { expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.4.0'); } +function expectCurrentV640PublicationEvidence(status, publication) { + expect(status).toContain('**Last tagged release:** `v6.4.0` (`2026-07-18`)'); + expect(status).toContain('d47af74a'); + expect(status).toContain('Release run `29627828620`'); + expect(publication).toContain('d47af74a288ef362dba684536cff11c063cfdcc3'); + expect(publication).toContain('3545b8aa81e395e832f112214b301dbe53d9576f'); + expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135'); + expect(publication).toContain('actions/runs/29627828620'); + expect(publication).toContain( + 'sha512-xLtNBCpXolGGusV8efsr/cRlhjrRrFFKZQVwgx/gNtonPVzDor6AyidtILM88ss6M6bJLapGUgOaoimr/y3gZA==' + ); + expect(publication).toContain('5feda2da0e05bbded738602dd47c8bc1d58a3921'); + expect(publication).toContain('2,129,716'); +} + function expectV640Lifecycle(status, candidate, publication) { const isCandidate = status.includes(v640CandidateMarker); const isPublished = status.includes(v640PublishedMarker); @@ -112,6 +127,9 @@ describe('release state docs', () => { const v630Publication = read(v630PublicationPath); expectV640Lifecycle(status, candidate, publication); + if (publication !== null) { + expectCurrentV640PublicationEvidence(status, publication); + } expectFutureV640PublicationState(); expect(status).toContain('Current release goalpost:'); expect(v630Publication).toContain('33f4171f6b69d75110de834f9a75d64e2d14e1a3');