From 6293ac8b8d444cdf15da0e183961f6b0b39ba2c7 Mon Sep 17 00:00:00 2001 From: James Ross Date: Sat, 18 Jul 2026 11:19:40 -0700 Subject: [PATCH] docs(release): record v6.5.0 publication --- STATUS.md | 27 ++++--- .../witness/release-publication.md | 78 +++++++++++++++++++ test/unit/docs/release-state.test.js | 34 ++++++-- 3 files changed, 122 insertions(+), 17 deletions(-) create mode 100644 docs/design/0050-lazy-bundle-reference-reads/witness/release-publication.md diff --git a/STATUS.md b/STATUS.md index 277c0e2..4ebf896 100644 --- a/STATUS.md +++ b/STATUS.md @@ -1,8 +1,8 @@ # STATUS -**Last tagged release:** `v6.4.0` (`2026-07-18`) -**Current release state:** `v6.5.0` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow. -**Latest verification:** the final v6.5.0 candidate passed 14/14 release-verifier steps with 6,625 observed tests across Node.js, Bun, and Deno; that verifier run's npm dry-run contained 249 files totaling 769,785 packed bytes and 2,149,364 unpacked bytes. +**Last tagged release:** `v6.5.0` (`2026-07-18`) +**Current release state:** `v6.5.0` is published to npm with provenance and to GitHub Releases. +**Latest verification:** the exact reviewed merge `f464b929` passed 14/14 release-verifier steps with 6,625 observed tests across Node.js, Bun, and Deno; release workflow `29655337483` then passed validation, tests, trusted npm publication, and final GitHub Release creation. **Playback truth:** `main` **Runtimes:** Node.js 22.x, Bun, Deno **Current planning method:** [WORKFLOW.md](./WORKFLOW.md) @@ -18,19 +18,20 @@ - The machine-facing `git cas agent` surface exists and now supports OS-keychain passphrase sources for vault-derived key flows, but parity and portability are still partial. -- **v6.5.0 candidate posture** — bounded direct bundle references, immutable - metadata reuse, and the RootSet/cache concurrency repairs are merged through - reviewed commit `d5f770fb`; npm, JSR, and runtime version metadata identify - `6.5.0`, while the tag and registry artifacts remain deliberately absent - until release-candidate review completes. +- **v6.5.0 artifact posture** — signed tag `v6.5.0` resolves to reviewed merge + `f464b929`; npm reports `@git-stunts/git-cas@6.5.0` as `latest` with SLSA + provenance, and the final GitHub Release is published. Bounded direct bundle + references, immutable metadata reuse, and the RootSet/cache concurrency + repairs are shipped. JSR dry-run validation is healthy, but JSR publication + is not part of the release workflow. - **v6.4.0 artifact posture** — signed tag `v6.4.0` resolves to reviewed merge - `d47af74a`; npm reports `@git-stunts/git-cas@6.4.0` as `latest` with SLSA + `d47af74a`; npm retains `@git-stunts/git-cas@6.4.0` with SLSA provenance, and the final GitHub Release is published. Scoped staging workspaces and the corrected structured RootSet lock retry are shipped. JSR dry-run validation is healthy, but JSR publication is not part of the release workflow. - **v6.3.0 artifact posture** — signed tag `v6.3.0` resolves to reviewed merge - `33f4171`; npm reports `@git-stunts/git-cas@6.3.0` as `latest` with SLSA + `33f4171`; npm retains `@git-stunts/git-cas@6.3.0` with SLSA provenance, and the final GitHub Release is published. JSR dry-run validation is healthy, but JSR publication is not part of the release workflow. - **v6.0.0 encryption scheme simplification** — `whole-v1`/`whole-v2` collapsed @@ -110,9 +111,11 @@ - GitHub Issues are canonical. If this section and GitHub disagree, GitHub wins and this section should be corrected. - Current release goalpost: - [#81 Bounded lazy bundle references and immutable metadata reads](https://github.com/git-stunts/git-cas/issues/81) + [#39 v6.6.0: Operator TUI](https://github.com/git-stunts/git-cas/issues/39) + and + [#40 v6.6.0: Agent automation follow-through](https://github.com/git-stunts/git-cas/issues/40) under the - [`v6.5.0` milestone](https://github.com/git-stunts/git-cas/milestone/5). + [`v6.6.0` milestone](https://github.com/git-stunts/git-cas/milestone/9). - The latest landed design record is [0050-lazy-bundle-reference-reads](./docs/design/0050-lazy-bundle-reference-reads/lazy-bundle-reference-reads.md). diff --git a/docs/design/0050-lazy-bundle-reference-reads/witness/release-publication.md b/docs/design/0050-lazy-bundle-reference-reads/witness/release-publication.md new file mode 100644 index 0000000..e49c1e7 --- /dev/null +++ b/docs/design/0050-lazy-bundle-reference-reads/witness/release-publication.md @@ -0,0 +1,78 @@ +# PERF-0050 v6.5.0 Publication Witness + +Date: 2026-07-18 + +Issue: #81 + +## Immutable Release Identity + +- Feature PR: [#82](https://github.com/git-stunts/git-cas/pull/82) +- Release PR: [#83](https://github.com/git-stunts/git-cas/pull/83) +- Reviewed merge commit: `f464b9292a07dbc98cda24aad6712e9d9a3bcefa` +- Signed annotated tag: `v6.5.0` +- Tag object: `fa955936f1e3feb4fe07e8456b983d5a535801a8` +- Peeled tag target: `f464b9292a07dbc98cda24aad6712e9d9a3bcefa` +- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135` +- GitHub Release: + [v6.5.0](https://github.com/git-stunts/git-cas/releases/tag/v6.5.0) + (final, not a draft or prerelease; published `2026-07-18T18:15:06Z`) + +Local `git tag -v v6.5.0` reported a good signature. The remote tag object and +peeled target match the local tag and reviewed merge commit exactly. + +## Release Workflow + +[Release run 29655337483](https://github.com/git-stunts/git-cas/actions/runs/29655337483) +completed successfully against `v6.5.0`: + +| Job | Result | Evidence | +| -------------- | ------ | ---------------------------------------------- | +| Validate | pass | Tag version matched `package.json` | +| Test | pass | Lint, unit, Node/Bun/Deno real-Git integration | +| Publish npm | pass | OIDC trusted publication completed | +| GitHub Release | pass | Final release created after npm publication | + +Before tagging, `pnpm run release:verify` passed all 14 steps against the exact +reviewed merge commit, observing 6,625 tests and completing public type +compatibility, npm package inspection, and the JSR publication dry-run. Its npm +dry-run contained 249 files totaling 769,786 packed bytes and 2,149,364 unpacked +bytes. The tag push also passed the local pre-push lint and 2,020-test Node unit +gate. + +## npm Registry Evidence + +Independent registry queries after the workflow completed reported: + +| Field | Value | +| ------------- | ------------------------------------------------------------------------------------------------- | +| Package | `@git-stunts/git-cas@6.5.0` | +| Published | `2026-07-18T18:14:51.865Z` | +| Dist-tag | `latest` -> `6.5.0` | +| Integrity | `sha512-KfKperNdXu3xWw07tpo1yYpLTynhwAP60PhYiZ5MRsSydPdNspQzJmi6Pv0Jz+6WULD883/NJCR0V1IUhBwOBw==` | +| Shasum | `4d05349bb8373bab57e12be65621bdc08325f278` | +| File count | `249` | +| Unpacked size | `2,149,363` bytes | +| Tarball | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.0.tgz` | + +The registry exposes the package-version +[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.0) +with npm publish and `https://slsa.dev/provenance/v1` predicates. The SLSA +statement resolves the build to Git commit +`f464b9292a07dbc98cda24aad6712e9d9a3bcefa` from tag `v6.5.0` and release +workflow run `29655337483`. + +## Downstream Gate + +The registry artifact now satisfies the dependency gate for git-warp. The +git-cas v6.5.0 goalpost can close on this publication evidence, while +[git-stunts/git-warp#738](https://github.com/git-stunts/git-warp/issues/738) +remains open until git-warp consumes published version `6.5.0` through its +normal package manager and records executable compatibility and performance +evidence. A local path override is not acceptable proof of the released +contract. + +Publication does not prove git-warp's runtime-scoped acquisition reuse, CPU +budget, or bounded-memory behavior on a logical graph larger than its process +memory cap. Those remain downstream gates. JSR publication was not claimed or +attempted; its dry-run is healthy, but npm and GitHub Releases are the v6.5.0 +publication surfaces. diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js index 6c6b126..259e4e1 100644 --- a/test/unit/docs/release-state.test.js +++ b/test/unit/docs/release-state.test.js @@ -31,14 +31,18 @@ function expectNoV650PublicationEvidence(...documents) { '- Signed annotated tag: `v6.5.0`', 'https://github.com/git-stunts/git-cas/releases/tag/v6.5.0', '## npm Registry Evidence', - '| Package | `@git-stunts/git-cas@6.5.0` |', - '| Dist-tag | `latest` -> `6.5.0` |', + /\| Package\s+\| `@git-stunts\/git-cas@6\.5\.0`\s+\|/, + /\| Dist-tag\s+\| `latest` -> `6\.5\.0`\s+\|/, 'attestations/@git-stunts%2fgit-cas@6.5.0', ]; for (const document of documents) { for (const marker of forbiddenMarkers) { - expect(document).not.toContain(marker); + if (marker instanceof RegExp) { + expect(document).not.toMatch(marker); + } else { + expect(document).not.toContain(marker); + } } } } @@ -62,13 +66,24 @@ function expectV650CandidateState(status, candidate, publication) { function expectV650PublishedState(status, publication) { expect(status).toMatch(/\*\*Last tagged release:\*\* `v6\.5\.0` \(`\d{4}-\d{2}-\d{2}`\)/); expect(status).toContain(v650PublishedMarker); + expect(status).toContain('f464b929'); expect(status).toContain('#39 v6.6.0: Operator TUI'); + expect(status).toContain('#40 v6.6.0: Agent automation follow-through'); expect(status).toContain('[`v6.6.0` milestone]'); expect(publication).toContain('# PERF-0050 v6.5.0 Publication Witness'); + expect(publication).toContain('f464b9292a07dbc98cda24aad6712e9d9a3bcefa'); + expect(publication).toContain('fa955936f1e3feb4fe07e8456b983d5a535801a8'); + expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135'); expect(publication).toContain('- Signed annotated tag: `v6.5.0`'); expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.0'); - expect(publication).toContain('| Package | `@git-stunts/git-cas@6.5.0` |'); - expect(publication).toContain('| Dist-tag | `latest` -> `6.5.0` |'); + expect(publication).toContain('actions/runs/29655337483'); + expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.0`\s+\|/); + expect(publication).toMatch(/\| Dist-tag\s+\| `latest` -> `6\.5\.0`\s+\|/); + expect(publication).toContain( + 'sha512-KfKperNdXu3xWw07tpo1yYpLTynhwAP60PhYiZ5MRsSydPdNspQzJmi6Pv0Jz+6WULD883/NJCR0V1IUhBwOBw==' + ); + expect(publication).toContain('4d05349bb8373bab57e12be65621bdc08325f278'); + expect(publication).toContain('2,149,363'); expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.0'); } @@ -101,15 +116,24 @@ function expectFutureV650PublicationState() { const status = [ '**Last tagged release:** `v6.5.0` (`2026-07-18`)', `${v650PublishedMarker} to npm with provenance and to GitHub Releases.`, + 'f464b929', '#39 v6.6.0: Operator TUI', + '#40 v6.6.0: Agent automation follow-through', '[`v6.6.0` milestone]', ].join('\n'); const publication = [ '# PERF-0050 v6.5.0 Publication Witness', + 'f464b9292a07dbc98cda24aad6712e9d9a3bcefa', + 'fa955936f1e3feb4fe07e8456b983d5a535801a8', + '01A63D8E9DBEEDE32918AF9C39560E0406CA9135', '- Signed annotated tag: `v6.5.0`', 'https://github.com/git-stunts/git-cas/releases/tag/v6.5.0', + 'actions/runs/29655337483', '| Package | `@git-stunts/git-cas@6.5.0` |', '| Dist-tag | `latest` -> `6.5.0` |', + 'sha512-KfKperNdXu3xWw07tpo1yYpLTynhwAP60PhYiZ5MRsSydPdNspQzJmi6Pv0Jz+6WULD883/NJCR0V1IUhBwOBw==', + '4d05349bb8373bab57e12be65621bdc08325f278', + '2,149,363', 'attestations/@git-stunts%2fgit-cas@6.5.0', ].join('\n');