diff --git a/STATUS.md b/STATUS.md index a9127ed..18d9bde 100644 --- a/STATUS.md +++ b/STATUS.md @@ -1,8 +1,8 @@ # STATUS -**Last tagged release:** `v6.5.1` (`2026-07-18`) -**Current release state:** `v6.5.2` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow. -**Latest verification:** the versioned `v6.5.2` candidate passed 14/14 release-verifier steps with 6,817 observed tests across Node, Bun, Deno, and all three real-Git integration suites; tag and publication verification remain pending. +**Last tagged release:** `v6.5.2` (`2026-07-19`) +**Current release state:** `v6.5.2` is published to npm with provenance and to GitHub Releases. +**Latest verification:** merge `c2d41f60` passed 14/14 release-verifier steps with 6,817 observed tests; release workflow `29690794540` then passed validation, tests, trusted npm publication, and final GitHub Release creation from signed tag `v6.5.2`. **Playback truth:** `main` **Runtimes:** Node.js 22.x, Bun, Deno **Current planning method:** [WORKFLOW.md](./WORKFLOW.md) @@ -18,14 +18,14 @@ - The machine-facing `git cas agent` surface exists and now supports OS-keychain passphrase sources for vault-derived key flows, but parity and portability are still partial. -- **v6.5.2 candidate posture** - persistent bounded Git object sessions, - scoped page-write batches, and deterministic local resource closure are - merged through reviewed commit `4ce37adc` under - [#90](https://github.com/git-stunts/git-cas/issues/90). npm, JSR, and runtime - version metadata identify `6.5.2`; tag and registry artifacts remain - deliberately absent until release-candidate review completes. +- **v6.5.2 artifact posture** — signed tag `v6.5.2` resolves to reviewed merge + `c2d41f60`; npm reports `@git-stunts/git-cas@6.5.2` as `latest` with SLSA + provenance, and release workflow `29690794540` published the final GitHub + Release. Persistent bounded Git object sessions, scoped page-write batches, + and deterministic local resource closure are shipped. JSR dry-run validation + is healthy, but JSR publication is not part of the release workflow. - **v6.5.1 artifact posture** — signed tag `v6.5.1` resolves to reviewed merge - `49b7d5cb`; npm reports `@git-stunts/git-cas@6.5.1` as `latest` with SLSA + `49b7d5cb`; npm retains `@git-stunts/git-cas@6.5.1` with SLSA provenance, and release workflow `29666480492` published the final GitHub Release. Bounded immutable page payload reuse is shipped. JSR dry-run validation is healthy, but JSR publication is not part of the release @@ -123,10 +123,6 @@ - GitHub Issues are canonical. If this section and GitHub disagree, GitHub wins and this section should be corrected. - Current release goalpost: - [#90 v6.5.2: Reuse bounded Git object sessions](https://github.com/git-stunts/git-cas/issues/90) - under the - [`v6.5.2` milestone](https://github.com/git-stunts/git-cas/milestone/12). -- Next planned goalposts remain [#39 v6.6.0: Operator TUI](https://github.com/git-stunts/git-cas/issues/39) and [#40 v6.6.0: Agent automation follow-through](https://github.com/git-stunts/git-cas/issues/40) diff --git a/docs/design/0052-persistent-git-object-sessions/witness/release-publication.md b/docs/design/0052-persistent-git-object-sessions/witness/release-publication.md new file mode 100644 index 0000000..6bfcedd --- /dev/null +++ b/docs/design/0052-persistent-git-object-sessions/witness/release-publication.md @@ -0,0 +1,79 @@ +# PERF-0052 v6.5.2 Publication Witness + +Date: 2026-07-19 + +Issue: #90 + +## Immutable Release Identity + +- Feature PR: [#91](https://github.com/git-stunts/git-cas/pull/91) +- Release PR: [#92](https://github.com/git-stunts/git-cas/pull/92) +- Reviewed merge commit: `c2d41f608bc9a5e8c19a12ce1024c4c756fd752a` +- Signed annotated tag: `v6.5.2` +- Tag object: `5becfb292460bfa22e6e4dad6cec3c3243e6e88f` +- Peeled tag target: `c2d41f608bc9a5e8c19a12ce1024c4c756fd752a` +- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135` +- GitHub Release: + [v6.5.2](https://github.com/git-stunts/git-cas/releases/tag/v6.5.2) + (final, not a draft or prerelease; published `2026-07-19T14:30:20Z`) + +Local `git tag -v v6.5.2` reported a good signature. The remote tag object and +peeled target match the local tag and reviewed merge commit exactly. + +## Release Workflow + +[Release run 29690794540](https://github.com/git-stunts/git-cas/actions/runs/29690794540) +completed successfully against `v6.5.2`: + +| Job | Result | Evidence | +| -------------- | ------ | ---------------------------------------------- | +| Validate | pass | Tag version matched `package.json` | +| Test | pass | Lint, unit, Node/Bun/Deno real-Git integration | +| Publish npm | pass | OIDC trusted publication completed | +| GitHub Release | pass | Final release created after npm publication | + +Before tagging, `pnpm run release:verify` passed all 14 steps against the exact +reviewed merge `c2d41f608bc9a5e8c19a12ce1024c4c756fd752a`, observing 6,817 +tests and completing public type compatibility, npm package inspection, and the +JSR publication dry-run. The tag push also passed the local pre-push lint and +2,080-test Node unit gate. + +## npm Registry Evidence + +Independent registry queries after the workflow completed reported: + +| Field | Value | +| ------------- | ------------------------------------------------------------------------------------------------- | +| Package | `@git-stunts/git-cas@6.5.2` | +| Published | `2026-07-19T14:30:09.505Z` | +| Dist-tag | `latest` -> `6.5.2` | +| Integrity | `sha512-2fZXK52SuaSnO7xxlcAEh6qxnptNIoN2jl0eq5ZYZCisFdtGRGW6I080gC3J40/r35dI32UTtRRY+R3cCd2X1g==` | +| Shasum | `b2eca5eb490716e3a8156a63e151d0db040ce16c` | +| File count | `253` | +| Unpacked size | `2,200,510` bytes | +| Tarball | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.2.tgz` | + +The registry exposes the package-version +[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.2) +with npm publish and `https://slsa.dev/provenance/v1` predicates. The SLSA +statement resolves the build to Git commit +`c2d41f608bc9a5e8c19a12ce1024c4c756fd752a` from tag `v6.5.2` and release +workflow run `29690794540`, attempt 1. + +## Downstream Gate + +The registry artifact now satisfies the dependency gate for git-warp. The +git-cas v6.5.2 goalpost can close on this publication evidence, while +[git-stunts/git-warp#738](https://github.com/git-stunts/git-warp/issues/738) +and +[git-stunts/git-warp#758](https://github.com/git-stunts/git-warp/issues/758) +remain open until git-warp consumes published version `6.5.2` and records +executable compatibility, process-tree CPU and wall-clock improvement, Git +command reduction, and larger-than-memory bounded-RSS evidence. A local path +override is not acceptable proof of the released contract. + +Publication does not prove that git-warp selects the persistent-session path or +that its end-to-end materialization no longer rebuilds avoidable structure. +Those obligations remain downstream. JSR publication was not claimed or +attempted; its dry-run is healthy, but npm and GitHub Releases are the v6.5.2 +publication surfaces. diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js index c47a3aa..5a55e06 100644 --- a/test/unit/docs/release-state.test.js +++ b/test/unit/docs/release-state.test.js @@ -1,9 +1,9 @@ import { describe, expect, it } from 'vitest'; -import { existsSync, readFileSync } from 'node:fs'; +import { readFileSync } from 'node:fs'; import path from 'node:path'; const repoRoot = process.cwd(); -const v652CandidateMarker = '**Current release state:** `v6.5.2` release candidate'; +const v652PublishedMarker = '**Current release state:** `v6.5.2` is published'; const v652CandidatePath = 'docs/design/0052-persistent-git-object-sessions/witness/release-candidate.md'; const v652PublicationPath = @@ -71,12 +71,7 @@ function expectNoV652PublicationEvidence(...documents) { } } -function expectV652CandidateEvidence(status, candidate) { - expect(status).toContain('**Last tagged release:** `v6.5.1` (`2026-07-18`)'); - expect(status).toContain(v652CandidateMarker); - expect(status).toContain('remain pending the reviewed tag workflow'); - expect(status).toContain('passed 14/14 release-verifier steps with 6,817 observed tests'); - expect(status).toContain('4ce37adc'); +function expectV652CandidateEvidence(candidate) { expect(candidate).toContain('# PERF-0052 v6.5.2 Release Candidate Witness'); expect(candidate).toContain('Implementation review: #91'); expect(candidate).toContain('Release review: #92'); @@ -84,8 +79,31 @@ function expectV652CandidateEvidence(status, candidate) { expect(candidate).toContain('**PASS (14/14)**'); expect(candidate).toContain('**6,817**'); expect(candidate).toMatch(/explicitly\s+unpublished candidate/); - expectNoV652PublicationEvidence(status, candidate); - expect(existsSync(path.join(repoRoot, v652PublicationPath))).toBe(false); + expectNoV652PublicationEvidence(candidate); +} + +function expectV652PublishedEvidence(status, publication) { + expect(status).toContain('**Last tagged release:** `v6.5.2` (`2026-07-19`)'); + expect(status).toContain(v652PublishedMarker); + expect(status).toContain('c2d41f60'); + expect(status).toContain('29690794540'); + expect(status).toContain('#39 v6.6.0: Operator TUI'); + expect(status).toContain('#40 v6.6.0: Agent automation follow-through'); + expect(publication).toContain('# PERF-0052 v6.5.2 Publication Witness'); + expect(publication).toContain('c2d41f608bc9a5e8c19a12ce1024c4c756fd752a'); + expect(publication).toContain('5becfb292460bfa22e6e4dad6cec3c3243e6e88f'); + expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135'); + expect(publication).toContain('- Signed annotated tag: `v6.5.2`'); + expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.2'); + expect(publication).toContain('actions/runs/29690794540'); + expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.2`\s+\|/); + expect(publication).toMatch(/\| Dist-tag\s+\| `latest` -> `6\.5\.2`\s+\|/); + expect(publication).toContain( + 'sha512-2fZXK52SuaSnO7xxlcAEh6qxnptNIoN2jl0eq5ZYZCisFdtGRGW6I080gC3J40/r35dI32UTtRRY+R3cCd2X1g==' + ); + expect(publication).toContain('b2eca5eb490716e3a8156a63e151d0db040ce16c'); + expect(publication).toContain('2,200,510'); + expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.2'); } function expectV651CandidateEvidence(candidate) { @@ -155,23 +173,26 @@ function expectCurrentV640PublicationEvidence(publication) { } describe('release state docs', () => { - it('enforces the v6.5.2 candidate while preserving prior publication evidence', () => { + it('enforces v6.5.2 publication while preserving candidate and prior evidence', () => { const status = read('STATUS.md'); const candidate = read(v652CandidatePath); + const v652Publication = read(v652PublicationPath); const v651Candidate = read(v651CandidatePath); const releaseNotes = read('docs/releases/v6.5.2.md'); const publication = read(v651PublicationPath); const v650Publication = read(v650PublicationPath); const v640Publication = read(v640PublicationPath); - expectV652CandidateEvidence(status, candidate); + expectV652CandidateEvidence(candidate); + expectV652PublishedEvidence(status, v652Publication); expectV651CandidateEvidence(v651Candidate); expectV651PublishedEvidence(status, publication); expect(releaseNotes).toContain('passed all 14 release-verifier steps with 6,817 observed'); expectV650PublishedEvidence(status, v650Publication); expectCurrentV640PublicationEvidence(v640Publication); expect(status).toContain('Current release goalpost:'); - expect(status).toContain('#90 v6.5.2: Reuse bounded Git object sessions'); + expect(status).toContain('#39 v6.6.0: Operator TUI'); + expect(status).toContain('#40 v6.6.0: Agent automation follow-through'); expect(status).toContain('0052-persistent-git-object-sessions'); expect(v640Publication).toContain('https://slsa.dev/provenance/v1'); expect(v640Publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.4.0');