docs: record git-cas v6.5.1 publication

[flyingrobots]

Summary

• record the immutable signed-tag, release-workflow, npm, and GitHub Release evidence for v6.5.1
• move STATUS.md from release-candidate posture to published-artifact truth
• preserve the unpublished candidate witness as historical evidence
• enforce exact publication identity, integrity, provenance, and prior-release evidence in tests

Provenance

This closes the documentation loop for #85 after implementation PR #87 and release PR #88. It does not change the already-published artifact.

Verified release

• signed tag object: ed905f8f8cde55ffae08f607dc02f545f9e0565b
• reviewed merge: 49b7d5cb9d589d73fa17d393e48d40bd6f139e57
• release workflow: https://github.com/git-stunts/git-cas/actions/runs/29666480492
• npm latest: 6.5.1
• npm integrity: sha512-rRPDuuMUsy1KpysIDlQ0oclUxnECAN+b7TNGOBZdE+c7inqaj3Mv4dHuZ2Bb4I/jKwQ+e13wSSG+IaWfkrmOXw==
• npm attestation: SLSA provenance resolves to the reviewed merge, signed tag, and release run
• GitHub Release: final, non-draft, non-prerelease

Validation

• focused release/planning contracts: 32/32
• Markdown-link contract: 1/1
• lint: passed
• pre-push unit suite: 2,036 passed, 2 skipped
• git diff --check: clean

Downstream boundary

This witness explicitly leaves git-warp adoption/performance to git-warp#738 and git-warp#758, and path-local retained-page derivation to git-cas#86.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ba3cfccb-fa2a-4e21-b617-f6b22374a3bc

📥 Commits

Reviewing files that changed from the base of the PR and between 49b7d5c and 5a2a547.

📒 Files selected for processing (3)

• STATUS.md
• docs/design/0051-bounded-page-payload-reuse/witness/release-publication.md
• test/unit/docs/release-state.test.js

---

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

@codex Please confirm this self-review verdict and flag any remaining issue before merge.

Self-Code Review / Code Lawyer

Reviewed origin/main...HEAD after proving a clean worktree and fetching current refs. This PR changes only publication truth, its durable witness, and the test that enforces that evidence.

Findings

Severity	Count	Status
Critical	0	Clear
High	0	Clear
Medium	0	Clear
Low	0	Clear

Evidence reviewed

• Signed tag object ed905f8f8cde55ffae08f607dc02f545f9e0565b peels to reviewed merge 49b7d5cb9d589d73fa17d393e48d40bd6f139e57.
• git tag -v v6.5.1 reports a good signature from key 01A63D8E9DBEEDE32918AF9C39560E0406CA9135.
• Release run 29666480492 completed validation, full tests, OIDC trusted npm publication, and final GitHub Release creation.
• npm independently reports 6.5.1 as latest, integrity sha512-rRPDuuMUsy1KpysIDlQ0oclUxnECAN+b7TNGOBZdE+c7inqaj3Mv4dHuZ2Bb4I/jKwQ+e13wSSG+IaWfkrmOXw==, shasum 3811131c703a0ccea5f4fdbb906778a6bdd06eb0, 250 files, and 2,158,035 unpacked bytes.
• The npm attestation endpoint exposes both publish and SLSA provenance predicates and resolves to the reviewed commit, v6.5.1 tag, and workflow run.
• GitHub Release v6.5.1 is final, non-draft, and non-prerelease.
• Focused release/planning tests: 32/32; Markdown links: 1/1; pre-push unit suite: 2,036 passed, 2 skipped; lint passed.
• git diff --check origin/main...HEAD: clean.
• Graft classifies the diff as two documentation files and one test file, with zero structural changes and zero breaking changes.

Boundary review

The witness does not claim JSR publication, git-warp performance, or path-local retained-page derivation. Those obligations remain explicitly assigned to git-warp#738, git-warp#758, and git-cas#86.

No unresolved local finding remains. CI and CodeRabbit are still mandatory before merge.