Record git-cas v6.5.10 publication evidence

BEARING.md

@@ -14,7 +14,7 @@ timeline
 
 ## Current State
 
-`v6.5.9` shipped on `2026-08-24`, and `v6.5.10` is under release review.
+`v6.5.10` shipped on `2026-08-24`.
 Application asset, bundle, page, cache,
 expiry, witness, and repository-diagnostics APIs sit above mutable root sets
 and the low-level CAS pipeline. Direct bundle-reference reads and bounded
@@ -100,14 +100,14 @@ What exists now:
   generation retains their union. A 33-operation witness reduced 200 Git
   children to 23 and 33 retained generations to one in both SHA-1 and SHA-256
   repositories without changing any application handle.
-- **Compound workspace assets and exact roots.** The v6.5.10 candidate adds
+- **Compound workspace assets and exact roots.** v6.5.10 adds
   bounded asset waves to the same compound persistence scope and optionally
   retains a canonical, nonempty, deduplicated selection of handles staged by
   that exact admission. Prior workspace roots and v6.5.9 retain-all behavior
   remain intact. A controlled downstream git-warp prototype reduced cold Git
   commands from 139 to 50 and incremental commands from 149 to 60; those
-  consumer numbers remain provisional until repeated against the public
-  registry artifact.
+  consumer numbers remain provisional until git-warp installs the public
+  registry artifact and repeats the exact corpus.
 - **Batched workspace page retention.** v6.5.4 adds
   `workspace.pages.putBatch()` so one bounded ordered page group is written and
   retained under one exact workspace generation instead of rewriting a growing
@@ -178,15 +178,15 @@ These were the active tensions from the previous bearing. All resolved.
 
 ## Next Horizon
 
-With v6.5.9 shipped and the v6.5.10 candidate under release review, active work
-is tracked in GitHub Issues and Milestones. Repo docs hold design and evidence
-records, not the active queue. The candidate design is:
+With v6.5.10 shipped, active work is tracked in GitHub Issues and Milestones.
+Repo docs hold design and evidence records, not the active queue. The completed
+release design is:
 
 - [#127](https://github.com/git-stunts/git-cas/issues/127)
 - [0061-compound-workspace-assets](./docs/design/0061-compound-workspace-assets/compound-workspace-assets.md)
 
-Its release evidence remains owned by
-[#127](https://github.com/git-stunts/git-cas/issues/127) under the
+Its completed release evidence is owned by
+[#127](https://github.com/git-stunts/git-cas/issues/127) in the
 [`v6.5.10` milestone](https://github.com/git-stunts/git-cas/milestone/20).
 
 The broader horizon remains:

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS
 
-**Last tagged release:** `v6.5.9` (`2026-08-24`)
-**Current release state:** `v6.5.10` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
-**Latest verification:** exact versioned candidate `2a5be40c` passed 14/14 release-verifier stages with 7,192 observed tests; tag and publication verification remain pending.
+**Last tagged release:** `v6.5.10` (`2026-08-24`)
+**Current release state:** `v6.5.10` is published to npm and GitHub Releases.
+**Latest verification:** reviewed release merge `4316f4ec` passed 14/14 release-verifier stages with 7,192 observed tests; signed tag `v6.5.10` peels to that merge, and release workflow `32782415971` published the matching npm artifact plus final GitHub Release.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,25 +18,25 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
-- **v6.5.10 candidate posture** — implementation PR
-  [#128](https://github.com/git-stunts/git-cas/pull/128) merged normally as
-  `57cd3002`; its exact reviewed head is `67147506`, and exact implementation
-  checkpoint `e663754b` passed all 14 release-verifier stages with 7,186
-  observed tests. Exact versioned candidate `2a5be40c` passed the same 14-stage
-  method with 7,192 observed tests. npm, JSR, and runtime metadata identify
-  `6.5.10`, while the signed tag and registry artifact remain deliberately
-  absent pending release review [#129](https://github.com/git-stunts/git-cas/pull/129).
-  The additive contract admits bounded asset waves into the compound scope and
-  can retain exact selected terminal roots without changing stored formats,
-  handles, refs, or readers. The controlled git-warp prototype cut cold Git
-  commands from 139 to 50 and incremental commands from 149 to 60; those
-  downstream numbers remain provisional until repeated against the public
-  registry artifact. No application or stored-data migration is required.
+- **v6.5.10 artifact posture** — implementation PR
+  [#128](https://github.com/git-stunts/git-cas/pull/128) and release PR
+  [#129](https://github.com/git-stunts/git-cas/pull/129) merged normally.
+  Signed tag `v6.5.10` resolves to reviewed release merge `4316f4ec`; npm
+  reports `@git-stunts/git-cas@6.5.10` as `latest` with publish and SLSA
+  provenance, and release workflow `32782415971` published the final GitHub
+  Release. The additive contract admits bounded asset waves into the compound
+  scope and can retain exact selected terminal roots without changing stored
+  formats, handles, refs, or readers. The controlled git-warp prototype cut
+  cold Git commands from 139 to 50 and incremental commands from 149 to 60;
+  those downstream numbers remain provisional until repeated against this
+  public artifact. No application or stored-data migration is required. JSR
+  dry-run validation is healthy, but JSR publication is not part of the release
+  workflow.
 - **v6.5.9 artifact posture** — implementation PR
   [#124](https://github.com/git-stunts/git-cas/pull/124) and release PR
   [#125](https://github.com/git-stunts/git-cas/pull/125) merged normally.
-  Signed tag `v6.5.9` resolves to reviewed release merge `a16e31a9`; npm reports
-  `@git-stunts/git-cas@6.5.9` as `latest` with publish and SLSA provenance, and
+  Signed tag `v6.5.9` resolves to reviewed release merge `a16e31a9`; npm retains
+  `@git-stunts/git-cas@6.5.9` with publish and SLSA provenance, and
   release workflow `32766297971` published the final GitHub Release. The
   SHA-1/SHA-256 compound witness preserves every application-handle digest
   while reducing a 33-operation graph from 200 to 23 Git children and from 33
@@ -193,10 +193,6 @@
 - GitHub Issues are canonical. If this section and GitHub disagree, GitHub
   wins and this section should be corrected.
 - Latest completed release goalpost:
-  [#123 v6.5.9: Compound staging-workspace admission](https://github.com/git-stunts/git-cas/issues/123)
-  under the
-  [`v6.5.9` milestone](https://github.com/git-stunts/git-cas/milestone/19).
-- Active release goalpost:
   [#127 v6.5.10: Compound workspace assets and exact roots](https://github.com/git-stunts/git-cas/issues/127)
   under the
   [`v6.5.10` milestone](https://github.com/git-stunts/git-cas/milestone/20).

docs/design/0061-compound-workspace-assets/compound-workspace-assets.md

@@ -433,7 +433,7 @@ The work is done when:
       without migration.
 - [x] Public docs, architecture, changelog, issue, PR, CI, and local validation
       are complete.
-- [ ] v6.5.10 is publicly installable before downstream results are claimed as
+- [x] v6.5.10 is publicly installable before downstream results are claimed as
       release behavior.
 
 ## Validation Plan
@@ -507,7 +507,20 @@ boundedness hole before review: selector input count is now capped by the exact
 staged-artifact count, preventing duplicate input scanning from exceeding the
 admission's own evidence ledger.
 
+Release PR #129 merged normally as
+`4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`. That exact merge passed all 14
+release-verifier stages with 7,192 observed tests before signed tag `v6.5.10`
+triggered successful release workflow
+[`32782415971`](https://github.com/git-stunts/git-cas/actions/runs/32782415971).
+The registry, provenance, signature, GitHub Release, and clean-room compound
+asset smoke are recorded in the
+[publication witness](./witness/release-publication.md).
+
 The controlled git-warp prototype reduced cold Git commands from 139 to 50 and
 incremental commands from 149 to 60 with equal semantic fingerprints and replay
-counts. That result remains provisional until it is repeated against the
-public v6.5.10 registry artifact.
+counts. The public dependency now exists; that downstream result remains
+provisional until git-warp installs it and repeats the corpus.
+
+Release PR:
+
+- [#129 - Release v6.5.10 compound workspace assets and exact roots](https://github.com/git-stunts/git-cas/pull/129)

docs/design/0061-compound-workspace-assets/witness/release-publication.md

@@ -0,0 +1,105 @@
+# PERF-0061 v6.5.10 Publication Witness
+
+Date: 2026-08-24
+
+Issue: #127
+
+## Immutable Release Identity
+
+- Implementation PR:
+  [#128](https://github.com/git-stunts/git-cas/pull/128)
+- Release PR: [#129](https://github.com/git-stunts/git-cas/pull/129)
+- Reviewed merge commit: `4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`
+- Signed annotated tag: `v6.5.10`
+- Tag object: `37e2b32f501b09abd10130cf0046e2a99885f5f3`
+- Peeled tag target: `4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`
+- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135`
+- GitHub Release:
+  [v6.5.10](https://github.com/git-stunts/git-cas/releases/tag/v6.5.10)
+  (final, not a draft or prerelease; published `2026-08-24T22:05:09Z`)
+
+Local `git verify-tag v6.5.10` reported a good signature. GitHub independently
+reports the annotated tag signature as valid and verified. Local peeling and
+the GitHub tag object both resolve to the reviewed release merge exactly.
+
+## Release Workflow
+
+[Release run 32782415971](https://github.com/git-stunts/git-cas/actions/runs/32782415971)
+completed successfully against tag `v6.5.10` and exact commit
+`4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`:
+
+| Job            | Result | Evidence                                           |
+| -------------- | ------ | -------------------------------------------------- |
+| Validate       | pass   | Tag version matched `package.json`                 |
+| Test           | pass   | Lint, unit, and Node/Bun/Deno real-Git integration |
+| Publish npm    | pass   | OIDC trusted publication completed                 |
+| GitHub Release | pass   | Final release created after npm publication        |
+
+Before tagging, the exact reviewed merge passed all 14 release-verifier stages
+with 7,192 observed tests, public type compatibility, examples, build stamping,
+and npm and JSR dry-runs. The explicit tag push also passed the repository's
+pre-push lint and 2,194-test Node unit gate.
+
+## npm Registry Evidence
+
+Independent registry queries after the workflow completed reported:
+
+| Field         | Value                                                                                             |
+| ------------- | ------------------------------------------------------------------------------------------------- |
+| Package       | `@git-stunts/git-cas@6.5.10`                                                                      |
+| Published     | `2026-08-24T22:04:55.645Z`                                                                        |
+| Dist-tag      | `latest` -> `6.5.10`                                                                              |
+| Git head      | `4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`                                                        |
+| Integrity     | `sha512-JemWVMtuzqArMyxnIMBBQFMOIQ3CsvhXKfza9aIjNPxQ3MBt7J/Hm2ePr3k7Z+wtM+MO38BTGA7gzCZ/Hpld4w==` |
+| Shasum        | `3592d2b86ad7e8ab54ae8809d6de977c8eee5ad2`                                                        |
+| File count    | `270`                                                                                             |
+| Unpacked size | `2,331,318` bytes                                                                                 |
+| Tarball       | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.10.tgz`                             |
+
+The registry exposes the package-version
+[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.10)
+with npm publish and `https://slsa.dev/provenance/v1` predicates. The decoded
+SLSA statement resolves `refs/tags/v6.5.10` to exact Git commit
+`4316f4ec7eeda531c07627d2ad0d15c1fcade2f8` and workflow run `32782415971`.
+
+## Clean-Room Consumer Smoke
+
+A fresh temporary bare Git repository with no source-worktree dependency
+installed the exact registry package with:
+
+```bash
+npm install --ignore-scripts @git-stunts/git-cas@6.5.10
+```
+
+The installed artifact then reported:
+
+- package version `6.5.10`;
+- CLI version `6.5.10+4316f4e`;
+- embedded build SHA `4316f4e`;
+- successful ESM root import with 45 public exports;
+- successful `@git-stunts/git-cas/service` subpath import;
+- public `StagingWorkspace.prototype.batch`;
+- successful real-Git compound admission using `scope.assets.putBatch()`, an
+  ordered bundle wave, and the synchronous `retain(value)` selector;
+- exact payload readback through the retained terminal bundle;
+- exactly one selected terminal root in the retention evidence; and
+- `npm audit signatures` verified registry signatures for all 20 installed
+  packages and attestations for 11, with no invalid or missing results.
+
+This proves that the package consumers receive from npm carries the reviewed
+release identity and exposes compound asset admission plus exact selected-root
+retention through the public package boundary.
+
+## Compatibility And Downstream Boundary
+
+This release requires no application or stored-data migration. It changes no
+stored asset, page, bundle, descriptor, RootSet, handle, namespace, ref layout,
+or reader. Existing repositories and workspace refs open in place. Omitting
+`retain` preserves v6.5.9 retain-all behavior.
+
+This witness closes the git-cas publication gate. It does not claim that the
+controlled git-warp prototype numbers are released-artifact measurements or
+that Think has consumed the release. The next required sequence is git-warp
+installing this exact registry artifact, repeating its semantic, migrated-v18,
+process-census, CPU, and wall-time gates, publishing its release, and only then
+updating Think.

docs/method/retro/0061-compound-workspace-assets/compound-workspace-assets.md

@@ -26,10 +26,15 @@
   `6714750620aa2310ad0279f957414be65898a66a` contains implementation checkpoint
   `e663754bf221784f0e5856a41fe071bebfa5befb`, whose complete release method
   passed 14/14 stages with 7,186 observed tests.
+- Release PR #129 merged normally as
+  `4316f4ec7eeda531c07627d2ad0d15c1fcade2f8`; signed tag `v6.5.10`, trusted npm
+  publication with SLSA provenance, and the final GitHub Release all resolve to
+  that reviewed merge.
+- The publication witness records the exact tag object, release workflow,
+  registry integrity, signature audit, and clean-room compound asset smoke.
 
 ## What Did Not Yet Ship
 
-- v6.5.10 has not yet been tagged or published to npm and GitHub Releases.
 - git-warp has not yet installed the registry artifact or repeated its exact
   reference, migrated-v18, process-census, CPU, and wall-time gates.
 - Think remains unchanged until the ordered Plumbing -> git-cas -> git-warp