docs: record git-cas v6.4.0 publication

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS
 
-**Last tagged release:** `v6.3.0` (`2026-07-17`)
-**Current release state:** `v6.4.0` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
-**Latest verification:** the `v6.4.0` release verifier passed 14/14 steps with 6,538 observed tests across Node.js, Bun, and Deno; npm and JSR dry-runs passed.
+**Last tagged release:** `v6.4.0` (`2026-07-18`)
+**Current release state:** `v6.4.0` is published to npm and GitHub Releases from signed tag `v6.4.0` at reviewed merge `d47af74a`.
+**Latest verification:** Release run `29627828620` passed validation, unit and Node/Bun/Deno real-Git integration, OIDC trusted npm publication, and final GitHub Release creation; npm reports `6.4.0` as `latest` with SLSA provenance.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,11 +18,12 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
-- **v6.4.0 candidate posture** — scoped staging workspaces are merged through
-  reviewed commit `1ac2fc8`, and structured RootSet lock retries are corrected
-  by `8185dfb9`; npm, JSR, and runtime version metadata now identify `6.4.0`,
-  while the tag and registry artifacts remain deliberately absent until
-  release-candidate review completes.
+- **v6.4.0 artifact posture** — signed tag `v6.4.0` resolves to reviewed merge
+  `d47af74`; npm reports `@git-stunts/git-cas@6.4.0` as `latest` with SLSA
+  provenance, and the final GitHub Release is published. Scoped staging
+  workspaces and the corrected structured RootSet lock retry are shipped. JSR
+  dry-run validation is healthy, but JSR publication is not part of the release
+  workflow.
 - **v6.3.0 artifact posture** — signed tag `v6.3.0` resolves to reviewed merge
   `33f4171`; npm reports `@git-stunts/git-cas@6.3.0` as `latest` with SLSA
   provenance, and the final GitHub Release is published. JSR dry-run validation
@@ -104,9 +105,9 @@
 - GitHub Issues are canonical. If this section and GitHub disagree, GitHub
   wins and this section should be corrected.
 - Current release goalpost:
-  [#75 Scoped staging workspaces for multi-object promotion](https://github.com/git-stunts/git-cas/issues/75)
+  [#38 Bounded Residency](https://github.com/git-stunts/git-cas/issues/38)
   under the
-  [`v6.4.0` milestone](https://github.com/git-stunts/git-cas/milestone/4).
+  [`v6.4.1` milestone](https://github.com/git-stunts/git-cas/milestone/8).
 - The latest landed design record is
   [0049-scoped-staging-workspaces](./docs/design/0049-scoped-staging-workspaces/scoped-staging-workspaces.md).
 

docs/design/0049-scoped-staging-workspaces/scoped-staging-workspaces.md

@@ -528,7 +528,7 @@ The work is done when:
 - [x] Issue and PR are linked correctly.
 - [x] Implementation PR CI, Code Rabbit, self-review, and independent Code
   Lawyer review are clean.
-- [ ] v6.4.0 is published before git-warp consumes the API.
+- [x] v6.4.0 is published before git-warp consumes the API.
 
 ## Validation Plan
 

docs/design/0049-scoped-staging-workspaces/witness/release-publication.md

@@ -0,0 +1,74 @@
+# PERF-0049 v6.4.0 Publication Witness
+
+Date: 2026-07-18
+
+Issues: #75, #77
+
+## Immutable Release Identity
+
+- Release PR: [#78](https://github.com/git-stunts/git-cas/pull/78)
+- Reviewed merge commit: `d47af74a288ef362dba684536cff11c063cfdcc3`
+- Signed annotated tag: `v6.4.0`
+- Tag object: `3545b8aa81e395e832f112214b301dbe53d9576f`
+- Peeled tag target: `d47af74a288ef362dba684536cff11c063cfdcc3`
+- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135`
+- GitHub Release:
+  [v6.4.0](https://github.com/git-stunts/git-cas/releases/tag/v6.4.0)
+  (final, not a draft or prerelease; published `2026-07-18T02:58:40Z`)
+
+Local `git tag -v v6.4.0` reported a good signature. The remote tag object and
+peeled target match the local tag and reviewed merge commit exactly.
+
+## Release Workflow
+
+[Release run 29627828620](https://github.com/git-stunts/git-cas/actions/runs/29627828620)
+completed successfully against `v6.4.0`:
+
+| Job | Result | Evidence |
+| --- | --- | --- |
+| Validate | pass | Tag version matched `package.json` |
+| Test | pass | Lint, unit, Node/Bun/Deno real-Git integration |
+| Publish npm | pass | OIDC trusted publication completed |
+| GitHub Release | pass | Final release created after npm publication |
+
+Before tagging, `pnpm run release:verify` passed all 14 steps against version
+`6.4.0`, observing 6,538 tests and completing public type compatibility, npm
+package inspection, and the JSR publication dry-run. The tag push also passed
+the local pre-push lint and 1,993-test Node unit gate.
+
+## npm Registry Evidence
+
+Independent registry queries after the workflow completed reported:
+
+| Field | Value |
+| --- | --- |
+| Package | `@git-stunts/git-cas@6.4.0` |
+| Published | `2026-07-18T02:58:25.447Z` |
+| Dist-tag | `latest` -> `6.4.0` |
+| Integrity | `sha512-xLtNBCpXolGGusV8efsr/cRlhjrRrFFKZQVwgx/gNtonPVzDor6AyidtILM88ss6M6bJLapGUgOaoimr/y3gZA==` |
+| Shasum | `5feda2da0e05bbded738602dd47c8bc1d58a3921` |
+| Unpacked size | `2,129,716` bytes |
+| Tarball | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.4.0.tgz` |
+
+The registry exposes the package-version
+[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.4.0)
+with npm publish and `https://slsa.dev/provenance/v1` predicates. The SLSA
+statement resolves the build to Git commit
+`d47af74a288ef362dba684536cff11c063cfdcc3` from tag `v6.4.0` and release
+workflow run `29627828620`.
+
+## Downstream Gate
+
+The registry artifact now satisfies the dependency gate for git-warp. The
+git-cas release goalpost can close on this publication evidence, while
+[git-stunts/git-warp#738](https://github.com/git-stunts/git-warp/issues/738)
+remains open until git-warp consumes published version `6.4.0` through its
+normal package manager and records executable compatibility and performance
+evidence. A local path override is not acceptable proof of the released
+contract.
+
+Publication does not prove git-warp's unchanged ten-second integration hook or
+the direct-workspace performance advantage over its CacheSet workaround. Those
+remain downstream gates. JSR publication was not claimed or attempted; its
+dry-run is healthy, but npm and GitHub Releases are the v6.4.0 publication
+surfaces.

test/unit/docs/release-state.test.js

@@ -47,6 +47,7 @@ function expectV640CandidateState(status, candidate, publication) {
   expect(status).toContain('**Last tagged release:** `v6.3.0` (`2026-07-17`)');
   expect(status).toContain(v640CandidateMarker);
   expect(status).toContain('remain pending the reviewed tag workflow');
+  expect(status).toContain('#75 Scoped staging workspaces for multi-object promotion');
   expect(candidate).toContain('# PERF-0049 v6.4.0 Release Candidate Witness');
   expect(candidate).toContain('1ac2fc85be857ca769c459b89c29bf4483b3f304');
   expect(candidate).toContain('8185dfb9819909d9fbe0f0394de6ae31fc0a94a3');
@@ -61,6 +62,8 @@ function expectV640CandidateState(status, candidate, publication) {
 function expectV640PublishedState(status, publication) {
   expect(status).toMatch(/\*\*Last tagged release:\*\* `v6\.4\.0` \(`\d{4}-\d{2}-\d{2}`\)/);
   expect(status).toContain(v640PublishedMarker);
+  expect(status).toContain('#38 Bounded Residency');
+  expect(status).toContain('[`v6.4.1` milestone]');
   expect(publication).toContain('# PERF-0049 v6.4.0 Publication Witness');
   expect(publication).toContain('- Signed annotated tag: `v6.4.0`');
   expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.4.0');
@@ -69,6 +72,21 @@ function expectV640PublishedState(status, publication) {
   expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.4.0');
 }
 
+function expectCurrentV640PublicationEvidence(status, publication) {
+  expect(status).toContain('**Last tagged release:** `v6.4.0` (`2026-07-18`)');
+  expect(status).toContain('d47af74a');
+  expect(status).toContain('Release run `29627828620`');
+  expect(publication).toContain('d47af74a288ef362dba684536cff11c063cfdcc3');
+  expect(publication).toContain('3545b8aa81e395e832f112214b301dbe53d9576f');
+  expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135');
+  expect(publication).toContain('actions/runs/29627828620');
+  expect(publication).toContain(
+    'sha512-xLtNBCpXolGGusV8efsr/cRlhjrRrFFKZQVwgx/gNtonPVzDor6AyidtILM88ss6M6bJLapGUgOaoimr/y3gZA=='
+  );
+  expect(publication).toContain('5feda2da0e05bbded738602dd47c8bc1d58a3921');
+  expect(publication).toContain('2,129,716');
+}
+
 function expectV640Lifecycle(status, candidate, publication) {
   const isCandidate = status.includes(v640CandidateMarker);
   const isPublished = status.includes(v640PublishedMarker);
@@ -85,7 +103,9 @@ function expectV640Lifecycle(status, candidate, publication) {
 function expectFutureV640PublicationState() {
   const status = [
     '**Last tagged release:** `v6.4.0` (`2026-07-17`)',
-    `${v640PublishedMarker} to npm with provenance and to GitHub Releases.`
+    `${v640PublishedMarker} to npm with provenance and to GitHub Releases.`,
+    '#38 Bounded Residency',
+    '[`v6.4.1` milestone]'
   ].join('\n');
   const publication = [
     '# PERF-0049 v6.4.0 Publication Witness',
@@ -107,9 +127,11 @@ describe('release state docs', () => {
     const v630Publication = read(v630PublicationPath);
 
     expectV640Lifecycle(status, candidate, publication);
+    if (publication !== null) {
+      expectCurrentV640PublicationEvidence(status, publication);
+    }
     expectFutureV640PublicationState();
     expect(status).toContain('Current release goalpost:');
-    expect(status).toContain('#75 Scoped staging workspaces for multi-object promotion');
     expect(v630Publication).toContain('33f4171f6b69d75110de834f9a75d64e2d14e1a3');
     expect(v630Publication).toContain('sha512-Cl/WPjj60LvjXl3BqSb1M3a0tx2xpx6KxGEC1TXKekNzgn5so/t43LG7Qz2XuXle+YmXWoCi8H94cJYvfgI8Yw==');
     expect(v630Publication).toContain('https://slsa.dev/provenance/v1');