git-stunts · flyingrobots · Jul 18, 2026 · Jul 18, 2026
diff --git a/STATUS.md b/STATUS.md
@@ -1,8 +1,8 @@
 # STATUS
 
-**Last tagged release:** `v6.4.0` (`2026-07-18`)
-**Current release state:** `v6.5.0` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
-**Latest verification:** the final v6.5.0 candidate passed 14/14 release-verifier steps with 6,625 observed tests across Node.js, Bun, and Deno; that verifier run's npm dry-run contained 249 files totaling 769,785 packed bytes and 2,149,364 unpacked bytes.
+**Last tagged release:** `v6.5.0` (`2026-07-18`)
+**Current release state:** `v6.5.0` is published to npm with provenance and to GitHub Releases.
+**Latest verification:** the exact reviewed merge `f464b929` passed 14/14 release-verifier steps with 6,625 observed tests across Node.js, Bun, and Deno; release workflow `29655337483` then passed validation, tests, trusted npm publication, and final GitHub Release creation.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,19 +18,20 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
-- **v6.5.0 candidate posture** — bounded direct bundle references, immutable
-  metadata reuse, and the RootSet/cache concurrency repairs are merged through
-  reviewed commit `d5f770fb`; npm, JSR, and runtime version metadata identify
-  `6.5.0`, while the tag and registry artifacts remain deliberately absent
-  until release-candidate review completes.
+- **v6.5.0 artifact posture** — signed tag `v6.5.0` resolves to reviewed merge
+  `f464b929`; npm reports `@git-stunts/git-cas@6.5.0` as `latest` with SLSA
+  provenance, and the final GitHub Release is published. Bounded direct bundle
+  references, immutable metadata reuse, and the RootSet/cache concurrency
+  repairs are shipped. JSR dry-run validation is healthy, but JSR publication
+  is not part of the release workflow.
 - **v6.4.0 artifact posture** — signed tag `v6.4.0` resolves to reviewed merge
-  `d47af74a`; npm reports `@git-stunts/git-cas@6.4.0` as `latest` with SLSA
+  `d47af74a`; npm retains `@git-stunts/git-cas@6.4.0` with SLSA
   provenance, and the final GitHub Release is published. Scoped staging
   workspaces and the corrected structured RootSet lock retry are shipped. JSR
   dry-run validation is healthy, but JSR publication is not part of the release
   workflow.
 - **v6.3.0 artifact posture** — signed tag `v6.3.0` resolves to reviewed merge
-  `33f4171`; npm reports `@git-stunts/git-cas@6.3.0` as `latest` with SLSA
+  `33f4171`; npm retains `@git-stunts/git-cas@6.3.0` with SLSA
   provenance, and the final GitHub Release is published. JSR dry-run validation
   is healthy, but JSR publication is not part of the release workflow.
 - **v6.0.0 encryption scheme simplification** — `whole-v1`/`whole-v2` collapsed
@@ -110,9 +111,11 @@
 - GitHub Issues are canonical. If this section and GitHub disagree, GitHub
   wins and this section should be corrected.
 - Current release goalpost:
-  [#81 Bounded lazy bundle references and immutable metadata reads](https://github.com/git-stunts/git-cas/issues/81)
+  [#39 v6.6.0: Operator TUI](https://github.com/git-stunts/git-cas/issues/39)
+  and
+  [#40 v6.6.0: Agent automation follow-through](https://github.com/git-stunts/git-cas/issues/40)
   under the
-  [`v6.5.0` milestone](https://github.com/git-stunts/git-cas/milestone/5).
+  [`v6.6.0` milestone](https://github.com/git-stunts/git-cas/milestone/9).
 - The latest landed design record is
   [0050-lazy-bundle-reference-reads](./docs/design/0050-lazy-bundle-reference-reads/lazy-bundle-reference-reads.md).
 

diff --git a/docs/design/0050-lazy-bundle-reference-reads/witness/release-publication.md b/docs/design/0050-lazy-bundle-reference-reads/witness/release-publication.md
@@ -0,0 +1,78 @@
+# PERF-0050 v6.5.0 Publication Witness
+
+Date: 2026-07-18
+
+Issue: #81
+
+## Immutable Release Identity
+
+- Feature PR: [#82](https://github.com/git-stunts/git-cas/pull/82)
+- Release PR: [#83](https://github.com/git-stunts/git-cas/pull/83)
+- Reviewed merge commit: `f464b9292a07dbc98cda24aad6712e9d9a3bcefa`
+- Signed annotated tag: `v6.5.0`
+- Tag object: `fa955936f1e3feb4fe07e8456b983d5a535801a8`
+- Peeled tag target: `f464b9292a07dbc98cda24aad6712e9d9a3bcefa`
+- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135`
+- GitHub Release:
+  [v6.5.0](https://github.com/git-stunts/git-cas/releases/tag/v6.5.0)
+  (final, not a draft or prerelease; published `2026-07-18T18:15:06Z`)
+
+Local `git tag -v v6.5.0` reported a good signature. The remote tag object and
+peeled target match the local tag and reviewed merge commit exactly.
+
+## Release Workflow
+
+[Release run 29655337483](https://github.com/git-stunts/git-cas/actions/runs/29655337483)
+completed successfully against `v6.5.0`:
+
+| Job            | Result | Evidence                                       |
+| -------------- | ------ | ---------------------------------------------- |
+| Validate       | pass   | Tag version matched `package.json`             |
+| Test           | pass   | Lint, unit, Node/Bun/Deno real-Git integration |
+| Publish npm    | pass   | OIDC trusted publication completed             |
+| GitHub Release | pass   | Final release created after npm publication    |
+
+Before tagging, `pnpm run release:verify` passed all 14 steps against the exact
+reviewed merge commit, observing 6,625 tests and completing public type
+compatibility, npm package inspection, and the JSR publication dry-run. Its npm
+dry-run contained 249 files totaling 769,786 packed bytes and 2,149,364 unpacked
+bytes. The tag push also passed the local pre-push lint and 2,020-test Node unit
+gate.
+
+## npm Registry Evidence
+
+Independent registry queries after the workflow completed reported:
+
+| Field         | Value                                                                                             |
+| ------------- | ------------------------------------------------------------------------------------------------- |
+| Package       | `@git-stunts/git-cas@6.5.0`                                                                       |
+| Published     | `2026-07-18T18:14:51.865Z`                                                                        |
+| Dist-tag      | `latest` -> `6.5.0`                                                                               |
+| Integrity     | `sha512-KfKperNdXu3xWw07tpo1yYpLTynhwAP60PhYiZ5MRsSydPdNspQzJmi6Pv0Jz+6WULD883/NJCR0V1IUhBwOBw==` |
+| Shasum        | `4d05349bb8373bab57e12be65621bdc08325f278`                                                        |
+| File count    | `249`                                                                                             |
+| Unpacked size | `2,149,363` bytes                                                                                 |
+| Tarball       | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.0.tgz`                              |
+
+The registry exposes the package-version
+[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.0)
+with npm publish and `https://slsa.dev/provenance/v1` predicates. The SLSA
+statement resolves the build to Git commit
+`f464b9292a07dbc98cda24aad6712e9d9a3bcefa` from tag `v6.5.0` and release
+workflow run `29655337483`.
+
+## Downstream Gate
+
+The registry artifact now satisfies the dependency gate for git-warp. The
+git-cas v6.5.0 goalpost can close on this publication evidence, while
+[git-stunts/git-warp#738](https://github.com/git-stunts/git-warp/issues/738)
+remains open until git-warp consumes published version `6.5.0` through its
+normal package manager and records executable compatibility and performance
+evidence. A local path override is not acceptable proof of the released
+contract.
+
+Publication does not prove git-warp's runtime-scoped acquisition reuse, CPU
+budget, or bounded-memory behavior on a logical graph larger than its process
+memory cap. Those remain downstream gates. JSR publication was not claimed or
+attempted; its dry-run is healthy, but npm and GitHub Releases are the v6.5.0
+publication surfaces.
diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js
@@ -31,14 +31,18 @@ function expectNoV650PublicationEvidence(...documents) {
     '- Signed annotated tag: `v6.5.0`',
     'https://github.com/git-stunts/git-cas/releases/tag/v6.5.0',
     '## npm Registry Evidence',
-    '| Package | `@git-stunts/git-cas@6.5.0` |',
-    '| Dist-tag | `latest` -> `6.5.0` |',
+    /\| Package\s+\| `@git-stunts\/git-cas@6\.5\.0`\s+\|/,
+    /\| Dist-tag\s+\| `latest` -> `6\.5\.0`\s+\|/,
     'attestations/@git-stunts%2fgit-cas@6.5.0',
   ];
 
   for (const document of documents) {
     for (const marker of forbiddenMarkers) {
-      expect(document).not.toContain(marker);
+      if (marker instanceof RegExp) {
+        expect(document).not.toMatch(marker);
+      } else {
+        expect(document).not.toContain(marker);
+      }
     }
   }
 }
@@ -62,13 +66,24 @@ function expectV650CandidateState(status, candidate, publication) {
 function expectV650PublishedState(status, publication) {
   expect(status).toMatch(/\*\*Last tagged release:\*\* `v6\.5\.0` \(`\d{4}-\d{2}-\d{2}`\)/);
   expect(status).toContain(v650PublishedMarker);
+  expect(status).toContain('f464b929');
   expect(status).toContain('#39 v6.6.0: Operator TUI');
+  expect(status).toContain('#40 v6.6.0: Agent automation follow-through');
   expect(status).toContain('[`v6.6.0` milestone]');
   expect(publication).toContain('# PERF-0050 v6.5.0 Publication Witness');
+  expect(publication).toContain('f464b9292a07dbc98cda24aad6712e9d9a3bcefa');
+  expect(publication).toContain('fa955936f1e3feb4fe07e8456b983d5a535801a8');
+  expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135');
   expect(publication).toContain('- Signed annotated tag: `v6.5.0`');
   expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.0');
-  expect(publication).toContain('| Package | `@git-stunts/git-cas@6.5.0` |');
-  expect(publication).toContain('| Dist-tag | `latest` -> `6.5.0` |');
+  expect(publication).toContain('actions/runs/29655337483');
+  expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.0`\s+\|/);
+  expect(publication).toMatch(/\| Dist-tag\s+\| `latest` -> `6\.5\.0`\s+\|/);
+  expect(publication).toContain(
+    'sha512-KfKperNdXu3xWw07tpo1yYpLTynhwAP60PhYiZ5MRsSydPdNspQzJmi6Pv0Jz+6WULD883/NJCR0V1IUhBwOBw=='
+  );
+  expect(publication).toContain('4d05349bb8373bab57e12be65621bdc08325f278');
+  expect(publication).toContain('2,149,363');
   expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.0');
 }
 
@@ -101,15 +116,24 @@ function expectFutureV650PublicationState() {
   const status = [
     '**Last tagged release:** `v6.5.0` (`2026-07-18`)',
     `${v650PublishedMarker} to npm with provenance and to GitHub Releases.`,
+    'f464b929',
     '#39 v6.6.0: Operator TUI',
+    '#40 v6.6.0: Agent automation follow-through',
     '[`v6.6.0` milestone]',
   ].join('\n');
   const publication = [
     '# PERF-0050 v6.5.0 Publication Witness',
+    'f464b9292a07dbc98cda24aad6712e9d9a3bcefa',
+    'fa955936f1e3feb4fe07e8456b983d5a535801a8',
+    '01A63D8E9DBEEDE32918AF9C39560E0406CA9135',
     '- Signed annotated tag: `v6.5.0`',
     'https://github.com/git-stunts/git-cas/releases/tag/v6.5.0',
+    'actions/runs/29655337483',
     '| Package | `@git-stunts/git-cas@6.5.0` |',
     '| Dist-tag | `latest` -> `6.5.0` |',
+    'sha512-KfKperNdXu3xWw07tpo1yYpLTynhwAP60PhYiZ5MRsSydPdNspQzJmi6Pv0Jz+6WULD883/NJCR0V1IUhBwOBw==',
+    '4d05349bb8373bab57e12be65621bdc08325f278',
+    '2,149,363',
     'attestations/@git-stunts%2fgit-cas@6.5.0',
   ].join('\n');