git-stunts · flyingrobots · Jul 30, 2026 · Jul 30, 2026 · Jul 30, 2026
diff --git a/BEARING.md b/BEARING.md
@@ -14,17 +14,17 @@ timeline
 
 ## Current State
 
-`v6.5.5` shipped on `2026-07-26`. Application asset, bundle, page, cache,
+`v6.5.6` shipped on `2026-07-30`. Application asset, bundle, page, cache,
 expiry, witness, and repository-diagnostics APIs sit above mutable root sets
 and the low-level CAS pipeline. Direct bundle-reference reads and bounded
 immutable metadata/page reuse, bounded Git object sessions, page batches, and
 deterministic resource closure are published. Internal commits are independent
-of ambient Git identity. The v6.5.6 release candidate updates the coherent
-Bijou family to 7.2.0, moves the interactive cockpit onto Bijou's hosted
-framed-app boundary, and classifies failed checked ref mutations from structured
-post-failure posture instead of Git diagnostics. npm plus GitHub Releases are
-the active publication surfaces. JSR validation is healthy, but JSR publication
-remains outside the release workflow.
+of ambient Git identity. The coherent Bijou family is at 7.2.0, the interactive
+cockpit runs on Bijou's hosted framed-app boundary, and failed checked ref
+mutations are classified from structured post-failure posture instead of Git
+diagnostics. npm plus GitHub Releases are the active publication surfaces. JSR
+validation is healthy, but JSR publication remains outside the release
+workflow.
 
 What exists now:
 
@@ -88,11 +88,11 @@ What exists now:
 - **Self-contained internal commit identity.** v6.5.5 supplies a
   stable git-cas author and committer for root-set, publication, and vault
   commits without mutating repository or global Git configuration.
-- **Bijou 7 framed-cockpit candidate.** The active v6.5.6 cycle updates the
-  complete Bijou family and makes the frame the sole owner of terminal
-  lifecycle, outer chrome, help, command/search palettes, settings,
-  notifications, performance telemetry, and quit confirmation.
-- **Deterministic checked-ref conflict candidate.** Failed checked updates,
+- **Bijou 7 framed cockpit.** v6.5.6 updates the complete Bijou family and
+  makes the frame the sole owner of terminal lifecycle, outer chrome, help,
+  command/search palettes, settings, notifications, performance telemetry, and
+  quit confirmation.
+- **Deterministic checked-ref conflicts.** Failed checked updates,
   atomic anchors, and checked deletes inspect direct, symbolic, or absent
   post-failure ref posture. Only disproved compare-and-swap preconditions become
   the existing conflict result; unrelated operational failures remain original.
@@ -151,19 +151,14 @@ These were the active tensions from the previous bearing. All resolved.
 
 ## Next Horizon
 
-With v6.5.5 shipped and the v6.5.6 candidate under release review, active work
-is tracked in GitHub Issues and Milestones. Repo docs hold design and evidence
-records, not the active queue.
+With v6.5.6 shipped, active work is tracked in GitHub Issues and Milestones.
+Repo docs hold design and evidence records, not the active queue.
 
-The candidate designs are
+The latest landed designs are
 [0056-bijou-7-framed-cockpit](./docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md)
 and
 [0057-deterministic-ref-conflict-posture](./docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md).
-Their tracker issues are
-[#105](https://github.com/git-stunts/git-cas/issues/105) and
-[#106](https://github.com/git-stunts/git-cas/issues/106), plus
-[#111](https://github.com/git-stunts/git-cas/issues/111), in the
-[`v6.5.6` milestone](https://github.com/git-stunts/git-cas/milestone/16).
+Their release evidence is retained under their witness directories.
 
 The broader horizon remains:
 

diff --git a/STATUS.md b/STATUS.md
@@ -1,8 +1,8 @@
 # STATUS
 
-**Last tagged release:** `v6.5.5` (`2026-07-26`)
-**Current release state:** `v6.5.6` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
-**Latest verification:** the versioned `v6.5.6` candidate at implementation merge `4327effd` passed 14/14 release-verifier steps with 6,898 observed tests across Node, Bun, Deno, and all three real-Git integration suites.
+**Last tagged release:** `v6.5.6` (`2026-07-30`)
+**Current release state:** `v6.5.6` is published to npm and GitHub Releases; JSR remains validation-only.
+**Latest verification:** reviewed merge `257e8821` passed 14/14 release-verifier steps with 6,898 observed tests before tagging; release workflow `30526282895` then passed tag validation, lint, unit, Node/Bun/Deno real-Git integration, npm OIDC publication, and final GitHub Release creation.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,13 +18,12 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
-- **v6.5.6 candidate posture** — PR
-  [#109](https://github.com/git-stunts/git-cas/pull/109) merged the Bijou 7.2
-  framed cockpit as `e802269a`; PR
-  [#112](https://github.com/git-stunts/git-cas/pull/112) merged deterministic
-  checked-ref conflict classification as `4327effd`. npm, JSR, and runtime
-  metadata identify `6.5.6`; tag and registry artifacts remain deliberately
-  absent pending release review.
+- **v6.5.6 artifact posture** — signed tag `v6.5.6` resolves to reviewed release
+  merge `257e8821`; npm reports `@git-stunts/git-cas@6.5.6` as `latest` with
+  publish and SLSA provenance, and release workflow `30526282895` published the
+  final GitHub Release. The Bijou 7.2 hosted cockpit and deterministic
+  checked-ref conflict classification are shipped. JSR dry-run validation is
+  healthy, but JSR publication is not part of the release workflow.
 - **v6.5.5 artifact posture** — signed tag `v6.5.5` resolves to reviewed merge
   `9ea91a73`; npm reports `@git-stunts/git-cas@6.5.5` as the retained published
   predecessor with SLSA provenance, and release workflow `30211630524`

diff --git a/docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md b/docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md
@@ -360,7 +360,8 @@ fallback theme lookup, and payload review.
 ## Tracker Disposition
 
 GitHub issues #105 and #106 closed after implementation PR #109 merged. The
-patch-release evidence remains with the v6.5.6 candidate witness.
+patch-release evidence is retained by the v6.5.6 candidate and publication
+witnesses under design 0057.
 
 ## Done Does Not Mean
 
@@ -376,4 +377,5 @@ PR #109 merged the framed cockpit as
 Node/Bun/Deno validation passed. Hosting one coherent cockpit page kept Bijou
 responsible for the application shell without splitting the shared vault and
 storage model across independently owned page states. The v6.5.6 release
-candidate then passed the repository's complete 14-step verifier.
+candidate then passed the repository's complete 14-step verifier, and signed
+tag `v6.5.6` published the reviewed release through workflow `30526282895`.
diff --git a/...n/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md b/...n/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md
@@ -291,7 +291,7 @@ operation's precondition, and otherwise rethrow the original error.
 - [x] Focused unit and real-Git integration tests pass.
 - [x] Full lint, unit, integration, and release verification pass.
 - [x] PR review and CI are green.
-- [ ] `v6.5.6` is tagged, published to npm, and represented by a GitHub Release.
+- [x] `v6.5.6` is tagged, published to npm, and represented by a GitHub Release.
 
 ## Validation Plan
 
@@ -344,4 +344,7 @@ Re-reading structured state after a failed checked mutation proved narrower
 than both diagnostic parsing and exit-code classification: only a contradicted
 precondition becomes concurrency, while repository and process failures retain
 their original identity. The v6.5.6 release candidate then passed the complete
-14-step verifier.
+14-step verifier. Release PR #113 merged as
+`257e8821ddb971bb922d618b7944da07a987e6c4`; signed tag `v6.5.6` peels to that
+reviewed merge, and workflow `30526282895` published npm plus the final GitHub
+Release.
diff --git a/docs/design/0057-deterministic-ref-conflict-posture/witness/release-publication.md b/docs/design/0057-deterministic-ref-conflict-posture/witness/release-publication.md
@@ -0,0 +1,59 @@
+# TRUST-0057 v6.5.6 Publication Witness
+
+Date: 2026-07-30
+
+Issue: #111
+
+## Immutable Release Identity
+
+- Implementation PRs:
+  [#109](https://github.com/git-stunts/git-cas/pull/109) and
+  [#112](https://github.com/git-stunts/git-cas/pull/112)
+- Release PR: [#113](https://github.com/git-stunts/git-cas/pull/113)
+- Reviewed merge commit: `257e8821ddb971bb922d618b7944da07a987e6c4`
+- Signed annotated tag: `v6.5.6`
+- Tag object: `248f3c740348e019cc0a4fb0ce8d5457dba824e2`
+- Peeled tag target: `257e8821ddb971bb922d618b7944da07a987e6c4`
+- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135`
+- GitHub Release:
+  [v6.5.6](https://github.com/git-stunts/git-cas/releases/tag/v6.5.6)
+  (final, not a draft or prerelease; published `2026-07-30T08:26:15Z`)
+
+Local `git tag -v v6.5.6` reported a good signature. GitHub independently
+reports the annotated tag signature as verified and the tag peels to the
+reviewed release merge exactly.
+
+## Release Workflow
+
+[Release run 30526282895](https://github.com/git-stunts/git-cas/actions/runs/30526282895)
+completed successfully against `v6.5.6`:
+
+| Job | Result | Evidence |
+| --- | --- | --- |
+| Validate | pass | Tag version matched `package.json` |
+| Test | pass | Lint, unit, Node/Bun/Deno real-Git integration |
+| Publish npm | pass | OIDC trusted publication completed |
+| GitHub Release | pass | Final release created after npm publication |
+
+Before tagging, reviewed merge `257e8821` passed all 14 verifier steps with
+6,898 observed tests, public type compatibility, examples, build stamping, and
+npm and JSR dry-runs.
+
+## npm Registry Evidence
+
+Independent registry queries after the workflow completed reported:
+
+| Field | Value |
+| --- | --- |
+| Package | `@git-stunts/git-cas@6.5.6` |
+| Published | `2026-07-30T08:25:59.406Z` |
+| Dist-tag | `latest` -> `6.5.6` |
+| Integrity | `sha512-pv2RSJsTpcGxiNTfxpYhripL3ievxQEgUICj5iOiIU6HV8nTs71/N1nPWr45wMNJpEJmoxzuMZw/JjAwwYJgTQ==` |
+| Shasum | `08dfdf7a217dcd06a465d38dc8692ae4b220083d` |
+| File count | `257` |
+| Unpacked size | `2,218,118` bytes |
+| Tarball | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.6.tgz` |
+
+The registry exposes the package-version
+[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.6)
+with npm publish and `https://slsa.dev/provenance/v1` predicates.
diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js
@@ -6,6 +6,8 @@ const repoRoot = process.cwd();
 const v653PublishedMarker = '**v6.5.3 artifact posture**';
 const v656CandidatePath =
   'docs/design/0057-deterministic-ref-conflict-posture/witness/release-candidate.md';
+const v656PublicationPath =
+  'docs/design/0057-deterministic-ref-conflict-posture/witness/release-publication.md';
 const v655CandidatePath = 'docs/design/0055-internal-commit-identity/witness/release-candidate.md';
 const v655PublicationPath =
   'docs/design/0055-internal-commit-identity/witness/release-publication.md';
@@ -39,8 +41,6 @@ function v6Heading(changelog) {
 
 function expectNoV656PublicationEvidence(...documents) {
   const forbiddenMarkers = [
-    '**Last tagged release:** `v6.5.6`',
-    '**Current release state:** `v6.5.6` is published',
     '- Signed annotated tag: `v6.5.6`',
     'https://github.com/git-stunts/git-cas/releases/tag/v6.5.6',
     '## npm Registry Evidence',
@@ -228,7 +228,6 @@ function expectV655CandidateEvidence(candidate) {
 }
 
 function expectV655PublishedEvidence(status, publication) {
-  expect(status).toContain('**Last tagged release:** `v6.5.5` (`2026-07-26`)');
   expect(status).toContain('**v6.5.5 artifact posture**');
   expect(status).toContain('9ea91a73');
   expect(status).toContain('30211630524');
@@ -249,9 +248,7 @@ function expectV655PublishedEvidence(status, publication) {
   expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.5');
 }
 
-function expectV656CandidateEvidence(status, candidate) {
-  expect(status).toContain('**Last tagged release:** `v6.5.5` (`2026-07-26`)');
-  expect(status).toContain('**Current release state:** `v6.5.6` release candidate');
+function expectV656CandidateEvidence(candidate) {
   expect(candidate).toContain('# TRUST-0057 v6.5.6 Release Candidate Witness');
   expect(candidate).toContain('Implementation reviews: #109 and #112');
   expect(candidate).toContain('Release review: #113');
@@ -260,7 +257,37 @@ function expectV656CandidateEvidence(status, candidate) {
   expect(candidate).toContain('**PASS: 14/14 gates**');
   expect(candidate).toContain('**6,898**');
   expect(candidate).toMatch(/explicitly\s+unpublished\s+candidate/);
-  expectNoV656PublicationEvidence(status, candidate);
+  expectNoV656PublicationEvidence(candidate);
+}
+
+function expectV656PublishedEvidence(status, publication) {
+  expect(status).toContain('**Last tagged release:** `v6.5.6` (`2026-07-30`)');
+  expect(status).toContain('**Current release state:** `v6.5.6` is published');
+  expect(status).toContain('**v6.5.6 artifact posture**');
+  expect(status).toContain('257e8821');
+  expect(status).toContain('30526282895');
+  expect(publication).toContain('# TRUST-0057 v6.5.6 Publication Witness');
+  expect(publication).toContain(
+    '- Reviewed merge commit: `257e8821ddb971bb922d618b7944da07a987e6c4`'
+  );
+  expect(publication).toContain(
+    '- Tag object: `248f3c740348e019cc0a4fb0ce8d5457dba824e2`'
+  );
+  expect(publication).toContain(
+    '- Peeled tag target: `257e8821ddb971bb922d618b7944da07a987e6c4`'
+  );
+  expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135');
+  expect(publication).toContain('- Signed annotated tag: `v6.5.6`');
+  expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.6');
+  expect(publication).toContain('actions/runs/30526282895');
+  expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.6`\s+\|/);
+  expect(publication).toMatch(/\| Dist-tag\s+\| `latest` -> `6\.5\.6`\s+\|/);
+  expect(publication).toContain(
+    'sha512-pv2RSJsTpcGxiNTfxpYhripL3ievxQEgUICj5iOiIU6HV8nTs71/N1nPWr45wMNJpEJmoxzuMZw/JjAwwYJgTQ=='
+  );
+  expect(publication).toContain('08dfdf7a217dcd06a465d38dc8692ae4b220083d');
+  expect(publication).toContain('2,218,118');
+  expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.6');
 }
 
 function expectV653PublishedEvidence(status, publication) {
@@ -387,9 +414,9 @@ function expectCurrentV640PublicationEvidence(publication) {
 }
 
 describe('release state docs', () => {
-  it('enforces the v6.5.6 candidate while preserving published evidence', () => {
+  it('preserves the v6.5.6 candidate and enforces publication evidence', () => {
     const status = read('STATUS.md');
-    const v656Candidate = read(v656CandidatePath);
+    const [v656Candidate, v656Publication] = [v656CandidatePath, v656PublicationPath].map(read);
     const v655Candidate = read(v655CandidatePath);
     const v655Publication = read(v655PublicationPath);
     const v654Candidate = read(v654CandidatePath);
@@ -408,7 +435,8 @@ describe('release state docs', () => {
     const v650Publication = read(v650PublicationPath);
     const v640Publication = read(v640PublicationPath);
 
-    expectV656CandidateEvidence(status, v656Candidate);
+    expectV656CandidateEvidence(v656Candidate);
+    expectV656PublishedEvidence(status, v656Publication);
     expectV655CandidateEvidence(v655Candidate);
     expectV655PublishedEvidence(status, v655Publication);
     expectV654CandidateEvidence(v654Candidate);