docs: record git-cas v6.5.3 publication

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS
 
-**Last tagged release:** `v6.5.2` (`2026-07-19`)
-**Current release state:** `v6.5.3` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
-**Latest verification:** the versioned `v6.5.3` candidate passed 14/14 release-verifier steps with 6,829 observed tests across Node, Bun, Deno, and all three real-Git integration suites; tag and publication verification remain pending.
+**Last tagged release:** `v6.5.3` (`2026-07-19`)
+**Current release state:** `v6.5.3` is published to npm with provenance and to GitHub Releases.
+**Latest verification:** merge `00df6077` passed 14/14 release-verifier steps with 6,829 observed tests; release workflow `29696131557` then passed validation, tests, trusted npm publication, and final GitHub Release creation from signed tag `v6.5.3`.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,13 +18,13 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
-- **v6.5.3 candidate posture** — coherent Git object sessions merged through
-  reviewed commit `7bdcbf1f` under
-  [#94](https://github.com/git-stunts/git-cas/issues/94). npm, JSR, and runtime
-  version metadata identify `6.5.3`; tag and registry artifacts remain
-  deliberately absent until release-candidate review completes.
+- **v6.5.3 artifact posture** — signed tag `v6.5.3` resolves to reviewed merge
+  `00df6077`; npm reports `@git-stunts/git-cas@6.5.3` as `latest` with SLSA
+  provenance, and release workflow `29696131557` published the final GitHub
+  Release. Coherent Git object sessions are shipped. JSR dry-run validation is
+  healthy, but JSR publication is not part of the release workflow.
 - **v6.5.2 artifact posture** — signed tag `v6.5.2` resolves to reviewed merge
-  `c2d41f60`; npm reports `@git-stunts/git-cas@6.5.2` as `latest` with SLSA
+  `c2d41f60`; npm retains `@git-stunts/git-cas@6.5.2` with SLSA
   provenance, and release workflow `29690794540` published the final GitHub
   Release. Persistent bounded Git object sessions, scoped page-write batches,
   and deterministic local resource closure are shipped. JSR dry-run validation
@@ -36,7 +36,7 @@
   validation is healthy, but JSR publication is not part of the release
   workflow.
 - **v6.5.0 artifact posture** — signed tag `v6.5.0` resolves to reviewed merge
-  `f464b929`; npm reports `@git-stunts/git-cas@6.5.0` as `latest` with SLSA
+  `f464b929`; npm retains `@git-stunts/git-cas@6.5.0` with SLSA
   provenance, and the final GitHub Release is published. Bounded direct bundle
   references, immutable metadata reuse, and the RootSet/cache concurrency
   repairs are shipped. JSR dry-run validation is healthy, but JSR publication

docs/design/0053-git-object-session-coherence/witness/release-publication.md

@@ -0,0 +1,79 @@
+# PERF-0053 v6.5.3 Publication Witness
+
+Date: 2026-07-19
+
+Issue: #94
+
+## Immutable Release Identity
+
+- Feature PR: [#95](https://github.com/git-stunts/git-cas/pull/95)
+- Release PR: [#96](https://github.com/git-stunts/git-cas/pull/96)
+- Reviewed merge commit: `00df6077f1f9c111b9d0d9b636b7d746df0d2aad`
+- Signed annotated tag: `v6.5.3`
+- Tag object: `efd1a1e0f9d71cf971a74d254d2661a52b366a81`
+- Peeled tag target: `00df6077f1f9c111b9d0d9b636b7d746df0d2aad`
+- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135`
+- GitHub Release:
+  [v6.5.3](https://github.com/git-stunts/git-cas/releases/tag/v6.5.3)
+  (final, not a draft or prerelease; published `2026-07-19T17:10:48Z`)
+
+Local `git tag -v v6.5.3` reported a good signature. The remote tag object and
+peeled target match the local tag and reviewed merge commit exactly.
+
+## Release Workflow
+
+[Release run 29696131557](https://github.com/git-stunts/git-cas/actions/runs/29696131557)
+completed successfully against `v6.5.3`:
+
+| Job            | Result | Evidence                                       |
+| -------------- | ------ | ---------------------------------------------- |
+| Validate       | pass   | Tag version matched `package.json`             |
+| Test           | pass   | Lint, unit, Node/Bun/Deno real-Git integration |
+| Publish npm    | pass   | OIDC trusted publication completed             |
+| GitHub Release | pass   | Final release created after npm publication    |
+
+Before tagging, `pnpm run release:verify` passed all 14 steps against the exact
+reviewed merge `00df6077f1f9c111b9d0d9b636b7d746df0d2aad`, observing 6,829
+tests and completing public type compatibility, npm package inspection, and the
+JSR publication dry-run. The tag push also passed the local pre-push lint and
+2,082-test Node unit gate.
+
+## npm Registry Evidence
+
+Independent registry queries after the workflow completed reported:
+
+| Field         | Value                                                                                             |
+| ------------- | ------------------------------------------------------------------------------------------------- |
+| Package       | `@git-stunts/git-cas@6.5.3`                                                                       |
+| Published     | `2026-07-19T17:10:34.025Z`                                                                        |
+| Dist-tag      | `latest` -> `6.5.3`                                                                               |
+| Integrity     | `sha512-to7bk0BCcp0He5rSwViI7ZD0gb5CL0fFrIPbKpuIwXpuc9MBW0y5AzqvZFGicEncN4iwccEaIZm87paOfpEDrg==` |
+| Shasum        | `4010d528abfde6b49739dfa2a4dd0bf41fea4981`                                                        |
+| File count    | `254`                                                                                             |
+| Unpacked size | `2,203,509` bytes                                                                                 |
+| Tarball       | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.3.tgz`                              |
+
+The registry exposes the package-version
+[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.3)
+with npm publish and `https://slsa.dev/provenance/v1` predicates. The SLSA
+statement resolves the build to Git commit
+`00df6077f1f9c111b9d0d9b636b7d746df0d2aad` from tag `v6.5.3` and release
+workflow run `29696131557`, attempt 1.
+
+## Downstream Gate
+
+The registry artifact now satisfies the dependency gate for git-warp. The
+git-cas v6.5.3 publication posture is complete, while
+[git-stunts/git-warp#738](https://github.com/git-stunts/git-warp/issues/738)
+and
+[git-stunts/git-warp#758](https://github.com/git-stunts/git-warp/issues/758)
+remain open until git-warp consumes published version `6.5.3` and records
+executable compatibility, process-tree CPU and wall-clock improvement, Git
+command reduction, and larger-than-memory bounded-RSS evidence. A local path
+override is not acceptable proof of the released contract.
+
+Publication does not prove that git-warp selects the coherent-session path or
+that its end-to-end materialization no longer rebuilds avoidable structure.
+Those obligations remain downstream. JSR publication was not claimed or
+attempted; its dry-run is healthy, but npm and GitHub Releases are the v6.5.3
+publication surfaces.

test/unit/docs/release-state.test.js

@@ -1,9 +1,9 @@
 import { describe, expect, it } from 'vitest';
-import { existsSync, readFileSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import path from 'node:path';
 
 const repoRoot = process.cwd();
-const v653CandidateMarker = '**Current release state:** `v6.5.3` release candidate';
+const v653PublishedMarker = '**Current release state:** `v6.5.3` is published';
 const v653CandidatePath =
   'docs/design/0053-git-object-session-coherence/witness/release-candidate.md';
 const v653PublicationPath =
@@ -98,21 +98,39 @@ function expectNoV653PublicationEvidence(...documents) {
   }
 }
 
-function expectV653CandidateEvidence(status, candidate) {
-  expect(status).toContain('**Last tagged release:** `v6.5.2` (`2026-07-19`)');
-  expect(status).toContain(v653CandidateMarker);
-  expect(status).toContain('remain pending the reviewed tag workflow');
-  expect(status).toContain('passed 14/14 release-verifier steps with 6,829 observed tests');
-  expect(status).toContain('7bdcbf1f');
+function expectV653CandidateEvidence(candidate) {
   expect(candidate).toContain('# PERF-0053 v6.5.3 Release Candidate Witness');
   expect(candidate).toContain('Implementation review: #95');
   expect(candidate).toContain('Release review: #96');
   expect(candidate).toContain('7bdcbf1f9eccd16acd324c94d576e1ecd2e11d98');
   expect(candidate).toContain('**PASS (14/14)**');
   expect(candidate).toContain('**6,829**');
   expect(candidate).toMatch(/explicitly\s+unpublished candidate/);
-  expectNoV653PublicationEvidence(status, candidate);
-  expect(existsSync(path.join(repoRoot, v653PublicationPath))).toBe(false);
+  expectNoV653PublicationEvidence(candidate);
+}
+
+function expectV653PublishedEvidence(status, publication) {
+  expect(status).toContain('**Last tagged release:** `v6.5.3` (`2026-07-19`)');
+  expect(status).toContain(v653PublishedMarker);
+  expect(status).toContain('00df6077');
+  expect(status).toContain('29696131557');
+  expect(status).toContain('#39 v6.6.0: Operator TUI');
+  expect(status).toContain('#40 v6.6.0: Agent automation follow-through');
+  expect(publication).toContain('# PERF-0053 v6.5.3 Publication Witness');
+  expect(publication).toContain('00df6077f1f9c111b9d0d9b636b7d746df0d2aad');
+  expect(publication).toContain('efd1a1e0f9d71cf971a74d254d2661a52b366a81');
+  expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135');
+  expect(publication).toContain('- Signed annotated tag: `v6.5.3`');
+  expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.3');
+  expect(publication).toContain('actions/runs/29696131557');
+  expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.3`\s+\|/);
+  expect(publication).toMatch(/\| Dist-tag\s+\| `latest` -> `6\.5\.3`\s+\|/);
+  expect(publication).toContain(
+    'sha512-to7bk0BCcp0He5rSwViI7ZD0gb5CL0fFrIPbKpuIwXpuc9MBW0y5AzqvZFGicEncN4iwccEaIZm87paOfpEDrg=='
+  );
+  expect(publication).toContain('4010d528abfde6b49739dfa2a4dd0bf41fea4981');
+  expect(publication).toContain('2,203,509');
+  expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.3');
 }
 
 function expectV652CandidateEvidence(candidate) {
@@ -127,7 +145,6 @@ function expectV652CandidateEvidence(candidate) {
 }
 
 function expectV652PublishedEvidence(status, publication) {
-  expect(status).toContain('**Last tagged release:** `v6.5.2` (`2026-07-19`)');
   expect(status).toContain('**v6.5.2 artifact posture**');
   expect(status).toContain('c2d41f60');
   expect(status).toContain('29690794540');
@@ -217,9 +234,10 @@ function expectCurrentV640PublicationEvidence(publication) {
 }
 
 describe('release state docs', () => {
-  it('enforces the v6.5.3 candidate while preserving prior evidence', () => {
+  it('enforces v6.5.3 publication while preserving candidate and prior evidence', () => {
     const status = read('STATUS.md');
     const candidate = read(v653CandidatePath);
+    const v653Publication = read(v653PublicationPath);
     const v652Candidate = read(v652CandidatePath);
     const v652Publication = read(v652PublicationPath);
     const v651Candidate = read(v651CandidatePath);
@@ -229,7 +247,8 @@ describe('release state docs', () => {
     const v650Publication = read(v650PublicationPath);
     const v640Publication = read(v640PublicationPath);
 
-    expectV653CandidateEvidence(status, candidate);
+    expectV653CandidateEvidence(candidate);
+    expectV653PublishedEvidence(status, v653Publication);
     expectV652CandidateEvidence(v652Candidate);
     expectV652PublishedEvidence(status, v652Publication);
     expectV651CandidateEvidence(v651Candidate);