docs: record git-cas v6.5.2 publication

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS
 
-**Last tagged release:** `v6.5.1` (`2026-07-18`)
-**Current release state:** `v6.5.2` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
-**Latest verification:** the versioned `v6.5.2` candidate passed 14/14 release-verifier steps with 6,817 observed tests across Node, Bun, Deno, and all three real-Git integration suites; tag and publication verification remain pending.
+**Last tagged release:** `v6.5.2` (`2026-07-19`)
+**Current release state:** `v6.5.2` is published to npm with provenance and to GitHub Releases.
+**Latest verification:** merge `c2d41f60` passed 14/14 release-verifier steps with 6,817 observed tests; release workflow `29690794540` then passed validation, tests, trusted npm publication, and final GitHub Release creation from signed tag `v6.5.2`.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,14 +18,14 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
-- **v6.5.2 candidate posture** - persistent bounded Git object sessions,
-  scoped page-write batches, and deterministic local resource closure are
-  merged through reviewed commit `4ce37adc` under
-  [#90](https://github.com/git-stunts/git-cas/issues/90). npm, JSR, and runtime
-  version metadata identify `6.5.2`; tag and registry artifacts remain
-  deliberately absent until release-candidate review completes.
+- **v6.5.2 artifact posture** — signed tag `v6.5.2` resolves to reviewed merge
+  `c2d41f60`; npm reports `@git-stunts/git-cas@6.5.2` as `latest` with SLSA
+  provenance, and release workflow `29690794540` published the final GitHub
+  Release. Persistent bounded Git object sessions, scoped page-write batches,
+  and deterministic local resource closure are shipped. JSR dry-run validation
+  is healthy, but JSR publication is not part of the release workflow.
 - **v6.5.1 artifact posture** — signed tag `v6.5.1` resolves to reviewed merge
-  `49b7d5cb`; npm reports `@git-stunts/git-cas@6.5.1` as `latest` with SLSA
+  `49b7d5cb`; npm retains `@git-stunts/git-cas@6.5.1` with SLSA
   provenance, and release workflow `29666480492` published the final GitHub
   Release. Bounded immutable page payload reuse is shipped. JSR dry-run
   validation is healthy, but JSR publication is not part of the release
@@ -123,10 +123,6 @@
 - GitHub Issues are canonical. If this section and GitHub disagree, GitHub
   wins and this section should be corrected.
 - Current release goalpost:
-  [#90 v6.5.2: Reuse bounded Git object sessions](https://github.com/git-stunts/git-cas/issues/90)
-  under the
-  [`v6.5.2` milestone](https://github.com/git-stunts/git-cas/milestone/12).
-- Next planned goalposts remain
   [#39 v6.6.0: Operator TUI](https://github.com/git-stunts/git-cas/issues/39)
   and
   [#40 v6.6.0: Agent automation follow-through](https://github.com/git-stunts/git-cas/issues/40)

docs/design/0052-persistent-git-object-sessions/witness/release-publication.md

@@ -0,0 +1,79 @@
+# PERF-0052 v6.5.2 Publication Witness
+
+Date: 2026-07-19
+
+Issue: #90
+
+## Immutable Release Identity
+
+- Feature PR: [#91](https://github.com/git-stunts/git-cas/pull/91)
+- Release PR: [#92](https://github.com/git-stunts/git-cas/pull/92)
+- Reviewed merge commit: `c2d41f608bc9a5e8c19a12ce1024c4c756fd752a`
+- Signed annotated tag: `v6.5.2`
+- Tag object: `5becfb292460bfa22e6e4dad6cec3c3243e6e88f`
+- Peeled tag target: `c2d41f608bc9a5e8c19a12ce1024c4c756fd752a`
+- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135`
+- GitHub Release:
+  [v6.5.2](https://github.com/git-stunts/git-cas/releases/tag/v6.5.2)
+  (final, not a draft or prerelease; published `2026-07-19T14:30:20Z`)
+
+Local `git tag -v v6.5.2` reported a good signature. The remote tag object and
+peeled target match the local tag and reviewed merge commit exactly.
+
+## Release Workflow
+
+[Release run 29690794540](https://github.com/git-stunts/git-cas/actions/runs/29690794540)
+completed successfully against `v6.5.2`:
+
+| Job            | Result | Evidence                                       |
+| -------------- | ------ | ---------------------------------------------- |
+| Validate       | pass   | Tag version matched `package.json`             |
+| Test           | pass   | Lint, unit, Node/Bun/Deno real-Git integration |
+| Publish npm    | pass   | OIDC trusted publication completed             |
+| GitHub Release | pass   | Final release created after npm publication    |
+
+Before tagging, `pnpm run release:verify` passed all 14 steps against the exact
+reviewed merge `c2d41f608bc9a5e8c19a12ce1024c4c756fd752a`, observing 6,817
+tests and completing public type compatibility, npm package inspection, and the
+JSR publication dry-run. The tag push also passed the local pre-push lint and
+2,080-test Node unit gate.
+
+## npm Registry Evidence
+
+Independent registry queries after the workflow completed reported:
+
+| Field         | Value                                                                                             |
+| ------------- | ------------------------------------------------------------------------------------------------- |
+| Package       | `@git-stunts/git-cas@6.5.2`                                                                       |
+| Published     | `2026-07-19T14:30:09.505Z`                                                                        |
+| Dist-tag      | `latest` -> `6.5.2`                                                                               |
+| Integrity     | `sha512-2fZXK52SuaSnO7xxlcAEh6qxnptNIoN2jl0eq5ZYZCisFdtGRGW6I080gC3J40/r35dI32UTtRRY+R3cCd2X1g==` |
+| Shasum        | `b2eca5eb490716e3a8156a63e151d0db040ce16c`                                                        |
+| File count    | `253`                                                                                             |
+| Unpacked size | `2,200,510` bytes                                                                                 |
+| Tarball       | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.2.tgz`                              |
+
+The registry exposes the package-version
+[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.2)
+with npm publish and `https://slsa.dev/provenance/v1` predicates. The SLSA
+statement resolves the build to Git commit
+`c2d41f608bc9a5e8c19a12ce1024c4c756fd752a` from tag `v6.5.2` and release
+workflow run `29690794540`, attempt 1.
+
+## Downstream Gate
+
+The registry artifact now satisfies the dependency gate for git-warp. The
+git-cas v6.5.2 goalpost can close on this publication evidence, while
+[git-stunts/git-warp#738](https://github.com/git-stunts/git-warp/issues/738)
+and
+[git-stunts/git-warp#758](https://github.com/git-stunts/git-warp/issues/758)
+remain open until git-warp consumes published version `6.5.2` and records
+executable compatibility, process-tree CPU and wall-clock improvement, Git
+command reduction, and larger-than-memory bounded-RSS evidence. A local path
+override is not acceptable proof of the released contract.
+
+Publication does not prove that git-warp selects the persistent-session path or
+that its end-to-end materialization no longer rebuilds avoidable structure.
+Those obligations remain downstream. JSR publication was not claimed or
+attempted; its dry-run is healthy, but npm and GitHub Releases are the v6.5.2
+publication surfaces.

test/unit/docs/release-state.test.js

@@ -1,9 +1,9 @@
 import { describe, expect, it } from 'vitest';
-import { existsSync, readFileSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import path from 'node:path';
 
 const repoRoot = process.cwd();
-const v652CandidateMarker = '**Current release state:** `v6.5.2` release candidate';
+const v652PublishedMarker = '**Current release state:** `v6.5.2` is published';
 const v652CandidatePath =
   'docs/design/0052-persistent-git-object-sessions/witness/release-candidate.md';
 const v652PublicationPath =
@@ -71,21 +71,39 @@ function expectNoV652PublicationEvidence(...documents) {
   }
 }
 
-function expectV652CandidateEvidence(status, candidate) {
-  expect(status).toContain('**Last tagged release:** `v6.5.1` (`2026-07-18`)');
-  expect(status).toContain(v652CandidateMarker);
-  expect(status).toContain('remain pending the reviewed tag workflow');
-  expect(status).toContain('passed 14/14 release-verifier steps with 6,817 observed tests');
-  expect(status).toContain('4ce37adc');
+function expectV652CandidateEvidence(candidate) {
   expect(candidate).toContain('# PERF-0052 v6.5.2 Release Candidate Witness');
   expect(candidate).toContain('Implementation review: #91');
   expect(candidate).toContain('Release review: #92');
   expect(candidate).toContain('4ce37adc57d49d2633507c3fbdc46e98617b26d6');
   expect(candidate).toContain('**PASS (14/14)**');
   expect(candidate).toContain('**6,817**');
   expect(candidate).toMatch(/explicitly\s+unpublished candidate/);
-  expectNoV652PublicationEvidence(status, candidate);
-  expect(existsSync(path.join(repoRoot, v652PublicationPath))).toBe(false);
+  expectNoV652PublicationEvidence(candidate);
+}
+
+function expectV652PublishedEvidence(status, publication) {
+  expect(status).toContain('**Last tagged release:** `v6.5.2` (`2026-07-19`)');
+  expect(status).toContain(v652PublishedMarker);
+  expect(status).toContain('c2d41f60');
+  expect(status).toContain('29690794540');
+  expect(status).toContain('#39 v6.6.0: Operator TUI');
+  expect(status).toContain('#40 v6.6.0: Agent automation follow-through');
+  expect(publication).toContain('# PERF-0052 v6.5.2 Publication Witness');
+  expect(publication).toContain('c2d41f608bc9a5e8c19a12ce1024c4c756fd752a');
+  expect(publication).toContain('5becfb292460bfa22e6e4dad6cec3c3243e6e88f');
+  expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135');
+  expect(publication).toContain('- Signed annotated tag: `v6.5.2`');
+  expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.2');
+  expect(publication).toContain('actions/runs/29690794540');
+  expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.2`\s+\|/);
+  expect(publication).toMatch(/\| Dist-tag\s+\| `latest` -> `6\.5\.2`\s+\|/);
+  expect(publication).toContain(
+    'sha512-2fZXK52SuaSnO7xxlcAEh6qxnptNIoN2jl0eq5ZYZCisFdtGRGW6I080gC3J40/r35dI32UTtRRY+R3cCd2X1g=='
+  );
+  expect(publication).toContain('b2eca5eb490716e3a8156a63e151d0db040ce16c');
+  expect(publication).toContain('2,200,510');
+  expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.2');
 }
 
 function expectV651CandidateEvidence(candidate) {
@@ -155,23 +173,26 @@ function expectCurrentV640PublicationEvidence(publication) {
 }
 
 describe('release state docs', () => {
-  it('enforces the v6.5.2 candidate while preserving prior publication evidence', () => {
+  it('enforces v6.5.2 publication while preserving candidate and prior evidence', () => {
     const status = read('STATUS.md');
     const candidate = read(v652CandidatePath);
+    const v652Publication = read(v652PublicationPath);
     const v651Candidate = read(v651CandidatePath);
     const releaseNotes = read('docs/releases/v6.5.2.md');
     const publication = read(v651PublicationPath);
     const v650Publication = read(v650PublicationPath);
     const v640Publication = read(v640PublicationPath);
 
-    expectV652CandidateEvidence(status, candidate);
+    expectV652CandidateEvidence(candidate);
+    expectV652PublishedEvidence(status, v652Publication);
     expectV651CandidateEvidence(v651Candidate);
     expectV651PublishedEvidence(status, publication);
     expect(releaseNotes).toContain('passed all 14 release-verifier steps with 6,817 observed');
     expectV650PublishedEvidence(status, v650Publication);
     expectCurrentV640PublicationEvidence(v640Publication);
     expect(status).toContain('Current release goalpost:');
-    expect(status).toContain('#90 v6.5.2: Reuse bounded Git object sessions');
+    expect(status).toContain('#39 v6.6.0: Operator TUI');
+    expect(status).toContain('#40 v6.6.0: Agent automation follow-through');
     expect(status).toContain('0052-persistent-git-object-sessions');
     expect(v640Publication).toContain('https://slsa.dev/provenance/v1');
     expect(v640Publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.4.0');