diff --git a/STATUS.md b/STATUS.md index 04f0ca3..e5d63f6 100644 --- a/STATUS.md +++ b/STATUS.md @@ -1,8 +1,8 @@ # STATUS -**Last tagged release:** `v6.5.2` (`2026-07-19`) -**Current release state:** `v6.5.3` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow. -**Latest verification:** the versioned `v6.5.3` candidate passed 14/14 release-verifier steps with 6,829 observed tests across Node, Bun, Deno, and all three real-Git integration suites; tag and publication verification remain pending. +**Last tagged release:** `v6.5.3` (`2026-07-19`) +**Current release state:** `v6.5.3` is published to npm with provenance and to GitHub Releases. +**Latest verification:** merge `00df6077` passed 14/14 release-verifier steps with 6,829 observed tests; release workflow `29696131557` then passed validation, tests, trusted npm publication, and final GitHub Release creation from signed tag `v6.5.3`. **Playback truth:** `main` **Runtimes:** Node.js 22.x, Bun, Deno **Current planning method:** [WORKFLOW.md](./WORKFLOW.md) @@ -18,13 +18,13 @@ - The machine-facing `git cas agent` surface exists and now supports OS-keychain passphrase sources for vault-derived key flows, but parity and portability are still partial. -- **v6.5.3 candidate posture** — coherent Git object sessions merged through - reviewed commit `7bdcbf1f` under - [#94](https://github.com/git-stunts/git-cas/issues/94). npm, JSR, and runtime - version metadata identify `6.5.3`; tag and registry artifacts remain - deliberately absent until release-candidate review completes. +- **v6.5.3 artifact posture** — signed tag `v6.5.3` resolves to reviewed merge + `00df6077`; npm reports `@git-stunts/git-cas@6.5.3` as `latest` with SLSA + provenance, and release workflow `29696131557` published the final GitHub + Release. Coherent Git object sessions are shipped. JSR dry-run validation is + healthy, but JSR publication is not part of the release workflow. - **v6.5.2 artifact posture** — signed tag `v6.5.2` resolves to reviewed merge - `c2d41f60`; npm reports `@git-stunts/git-cas@6.5.2` as `latest` with SLSA + `c2d41f60`; npm retains `@git-stunts/git-cas@6.5.2` with SLSA provenance, and release workflow `29690794540` published the final GitHub Release. Persistent bounded Git object sessions, scoped page-write batches, and deterministic local resource closure are shipped. JSR dry-run validation @@ -36,7 +36,7 @@ validation is healthy, but JSR publication is not part of the release workflow. - **v6.5.0 artifact posture** — signed tag `v6.5.0` resolves to reviewed merge - `f464b929`; npm reports `@git-stunts/git-cas@6.5.0` as `latest` with SLSA + `f464b929`; npm retains `@git-stunts/git-cas@6.5.0` with SLSA provenance, and the final GitHub Release is published. Bounded direct bundle references, immutable metadata reuse, and the RootSet/cache concurrency repairs are shipped. JSR dry-run validation is healthy, but JSR publication diff --git a/docs/design/0053-git-object-session-coherence/witness/release-publication.md b/docs/design/0053-git-object-session-coherence/witness/release-publication.md new file mode 100644 index 0000000..7471e2b --- /dev/null +++ b/docs/design/0053-git-object-session-coherence/witness/release-publication.md @@ -0,0 +1,79 @@ +# PERF-0053 v6.5.3 Publication Witness + +Date: 2026-07-19 + +Issue: #94 + +## Immutable Release Identity + +- Feature PR: [#95](https://github.com/git-stunts/git-cas/pull/95) +- Release PR: [#96](https://github.com/git-stunts/git-cas/pull/96) +- Reviewed merge commit: `00df6077f1f9c111b9d0d9b636b7d746df0d2aad` +- Signed annotated tag: `v6.5.3` +- Tag object: `efd1a1e0f9d71cf971a74d254d2661a52b366a81` +- Peeled tag target: `00df6077f1f9c111b9d0d9b636b7d746df0d2aad` +- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135` +- GitHub Release: + [v6.5.3](https://github.com/git-stunts/git-cas/releases/tag/v6.5.3) + (final, not a draft or prerelease; published `2026-07-19T17:10:48Z`) + +Local `git tag -v v6.5.3` reported a good signature. The remote tag object and +peeled target match the local tag and reviewed merge commit exactly. + +## Release Workflow + +[Release run 29696131557](https://github.com/git-stunts/git-cas/actions/runs/29696131557) +completed successfully against `v6.5.3`: + +| Job | Result | Evidence | +| -------------- | ------ | ---------------------------------------------- | +| Validate | pass | Tag version matched `package.json` | +| Test | pass | Lint, unit, Node/Bun/Deno real-Git integration | +| Publish npm | pass | OIDC trusted publication completed | +| GitHub Release | pass | Final release created after npm publication | + +Before tagging, `pnpm run release:verify` passed all 14 steps against the exact +reviewed merge `00df6077f1f9c111b9d0d9b636b7d746df0d2aad`, observing 6,829 +tests and completing public type compatibility, npm package inspection, and the +JSR publication dry-run. The tag push also passed the local pre-push lint and +2,082-test Node unit gate. + +## npm Registry Evidence + +Independent registry queries after the workflow completed reported: + +| Field | Value | +| ------------- | ------------------------------------------------------------------------------------------------- | +| Package | `@git-stunts/git-cas@6.5.3` | +| Published | `2026-07-19T17:10:34.025Z` | +| Dist-tag | `latest` -> `6.5.3` | +| Integrity | `sha512-to7bk0BCcp0He5rSwViI7ZD0gb5CL0fFrIPbKpuIwXpuc9MBW0y5AzqvZFGicEncN4iwccEaIZm87paOfpEDrg==` | +| Shasum | `4010d528abfde6b49739dfa2a4dd0bf41fea4981` | +| File count | `254` | +| Unpacked size | `2,203,509` bytes | +| Tarball | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.3.tgz` | + +The registry exposes the package-version +[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.3) +with npm publish and `https://slsa.dev/provenance/v1` predicates. The SLSA +statement resolves the build to Git commit +`00df6077f1f9c111b9d0d9b636b7d746df0d2aad` from tag `v6.5.3` and release +workflow run `29696131557`, attempt 1. + +## Downstream Gate + +The registry artifact now satisfies the dependency gate for git-warp. The +git-cas v6.5.3 publication posture is complete, while +[git-stunts/git-warp#738](https://github.com/git-stunts/git-warp/issues/738) +and +[git-stunts/git-warp#758](https://github.com/git-stunts/git-warp/issues/758) +remain open until git-warp consumes published version `6.5.3` and records +executable compatibility, process-tree CPU and wall-clock improvement, Git +command reduction, and larger-than-memory bounded-RSS evidence. A local path +override is not acceptable proof of the released contract. + +Publication does not prove that git-warp selects the coherent-session path or +that its end-to-end materialization no longer rebuilds avoidable structure. +Those obligations remain downstream. JSR publication was not claimed or +attempted; its dry-run is healthy, but npm and GitHub Releases are the v6.5.3 +publication surfaces. diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js index baaea66..503aace 100644 --- a/test/unit/docs/release-state.test.js +++ b/test/unit/docs/release-state.test.js @@ -1,9 +1,9 @@ import { describe, expect, it } from 'vitest'; -import { existsSync, readFileSync } from 'node:fs'; +import { readFileSync } from 'node:fs'; import path from 'node:path'; const repoRoot = process.cwd(); -const v653CandidateMarker = '**Current release state:** `v6.5.3` release candidate'; +const v653PublishedMarker = '**Current release state:** `v6.5.3` is published'; const v653CandidatePath = 'docs/design/0053-git-object-session-coherence/witness/release-candidate.md'; const v653PublicationPath = @@ -98,12 +98,7 @@ function expectNoV653PublicationEvidence(...documents) { } } -function expectV653CandidateEvidence(status, candidate) { - expect(status).toContain('**Last tagged release:** `v6.5.2` (`2026-07-19`)'); - expect(status).toContain(v653CandidateMarker); - expect(status).toContain('remain pending the reviewed tag workflow'); - expect(status).toContain('passed 14/14 release-verifier steps with 6,829 observed tests'); - expect(status).toContain('7bdcbf1f'); +function expectV653CandidateEvidence(candidate) { expect(candidate).toContain('# PERF-0053 v6.5.3 Release Candidate Witness'); expect(candidate).toContain('Implementation review: #95'); expect(candidate).toContain('Release review: #96'); @@ -111,8 +106,31 @@ function expectV653CandidateEvidence(status, candidate) { expect(candidate).toContain('**PASS (14/14)**'); expect(candidate).toContain('**6,829**'); expect(candidate).toMatch(/explicitly\s+unpublished candidate/); - expectNoV653PublicationEvidence(status, candidate); - expect(existsSync(path.join(repoRoot, v653PublicationPath))).toBe(false); + expectNoV653PublicationEvidence(candidate); +} + +function expectV653PublishedEvidence(status, publication) { + expect(status).toContain('**Last tagged release:** `v6.5.3` (`2026-07-19`)'); + expect(status).toContain(v653PublishedMarker); + expect(status).toContain('00df6077'); + expect(status).toContain('29696131557'); + expect(status).toContain('#39 v6.6.0: Operator TUI'); + expect(status).toContain('#40 v6.6.0: Agent automation follow-through'); + expect(publication).toContain('# PERF-0053 v6.5.3 Publication Witness'); + expect(publication).toContain('00df6077f1f9c111b9d0d9b636b7d746df0d2aad'); + expect(publication).toContain('efd1a1e0f9d71cf971a74d254d2661a52b366a81'); + expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135'); + expect(publication).toContain('- Signed annotated tag: `v6.5.3`'); + expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.3'); + expect(publication).toContain('actions/runs/29696131557'); + expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.3`\s+\|/); + expect(publication).toMatch(/\| Dist-tag\s+\| `latest` -> `6\.5\.3`\s+\|/); + expect(publication).toContain( + 'sha512-to7bk0BCcp0He5rSwViI7ZD0gb5CL0fFrIPbKpuIwXpuc9MBW0y5AzqvZFGicEncN4iwccEaIZm87paOfpEDrg==' + ); + expect(publication).toContain('4010d528abfde6b49739dfa2a4dd0bf41fea4981'); + expect(publication).toContain('2,203,509'); + expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.3'); } function expectV652CandidateEvidence(candidate) { @@ -127,7 +145,6 @@ function expectV652CandidateEvidence(candidate) { } function expectV652PublishedEvidence(status, publication) { - expect(status).toContain('**Last tagged release:** `v6.5.2` (`2026-07-19`)'); expect(status).toContain('**v6.5.2 artifact posture**'); expect(status).toContain('c2d41f60'); expect(status).toContain('29690794540'); @@ -217,9 +234,10 @@ function expectCurrentV640PublicationEvidence(publication) { } describe('release state docs', () => { - it('enforces the v6.5.3 candidate while preserving prior evidence', () => { + it('enforces v6.5.3 publication while preserving candidate and prior evidence', () => { const status = read('STATUS.md'); const candidate = read(v653CandidatePath); + const v653Publication = read(v653PublicationPath); const v652Candidate = read(v652CandidatePath); const v652Publication = read(v652PublicationPath); const v651Candidate = read(v651CandidatePath); @@ -229,7 +247,8 @@ describe('release state docs', () => { const v650Publication = read(v650PublicationPath); const v640Publication = read(v640PublicationPath); - expectV653CandidateEvidence(status, candidate); + expectV653CandidateEvidence(candidate); + expectV653PublishedEvidence(status, v653Publication); expectV652CandidateEvidence(v652Candidate); expectV652PublishedEvidence(status, v652Publication); expectV651CandidateEvidence(v651Candidate);