Release git-cas v6.5.6

BEARING.md

@@ -19,11 +19,12 @@ expiry, witness, and repository-diagnostics APIs sit above mutable root sets
 and the low-level CAS pipeline. Direct bundle-reference reads and bounded
 immutable metadata/page reuse, bounded Git object sessions, page batches, and
 deterministic resource closure are published. Internal commits are independent
-of ambient Git identity. The active v6.5.6 cycle updates the coherent Bijou
-family to 7.2.0 and moves the interactive cockpit onto Bijou's hosted framed-app
-boundary. npm plus GitHub Releases are the active publication surfaces. JSR
-validation is healthy, but JSR publication remains outside the release
-workflow.
+of ambient Git identity. The v6.5.6 release candidate updates the coherent
+Bijou family to 7.2.0, moves the interactive cockpit onto Bijou's hosted
+framed-app boundary, and classifies failed checked ref mutations from structured
+post-failure posture instead of Git diagnostics. npm plus GitHub Releases are
+the active publication surfaces. JSR validation is healthy, but JSR publication
+remains outside the release workflow.
 
 What exists now:
 
@@ -91,6 +92,10 @@ What exists now:
   complete Bijou family and makes the frame the sole owner of terminal
   lifecycle, outer chrome, help, command/search palettes, settings,
   notifications, performance telemetry, and quit confirmation.
+- **Deterministic checked-ref conflict candidate.** Failed checked updates,
+  atomic anchors, and checked deletes inspect direct, symbolic, or absent
+  post-failure ref posture. Only disproved compare-and-swap preconditions become
+  the existing conflict result; unrelated operational failures remain original.
 - **Migration script.** `scripts/migrate-encryption.js` upgrades legacy v1/v2
   manifests to the current scheme identifiers.
 
@@ -146,15 +151,18 @@ These were the active tensions from the previous bearing. All resolved.
 
 ## Next Horizon
 
-With v6.5.5 shipped and the v6.5.6 framed-cockpit cycle being prepared, active
-work is tracked in GitHub Issues and Milestones. Repo docs hold design and
-evidence records, not the active queue.
+With v6.5.5 shipped and the v6.5.6 candidate under release review, active work
+is tracked in GitHub Issues and Milestones. Repo docs hold design and evidence
+records, not the active queue.
 
-The active design is
-[0056-bijou-7-framed-cockpit](./docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md).
-Its goalpost and hosted-shell slice are
+The candidate designs are
+[0056-bijou-7-framed-cockpit](./docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md)
+and
+[0057-deterministic-ref-conflict-posture](./docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md).
+Their tracker issues are
 [#105](https://github.com/git-stunts/git-cas/issues/105) and
-[#106](https://github.com/git-stunts/git-cas/issues/106) in the
+[#106](https://github.com/git-stunts/git-cas/issues/106), plus
+[#111](https://github.com/git-stunts/git-cas/issues/111), in the
 [`v6.5.6` milestone](https://github.com/git-stunts/git-cas/milestone/16).
 
 The broader horizon remains:

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.5.6] — 2026-07-30
+
 ### Changed
 
 - **Bijou 7 framed cockpit** - updates the coherent Bijou dependency family to

README.md

@@ -49,7 +49,7 @@ Unlike traditional LFS which moves files to external servers, `git-cas` treats t
 Existing v5 users should read [UPGRADING.md](./UPGRADING.md) and run
 `npm run upgrade` in dry-run mode before restoring old encrypted vault entries.
 For the release overview, see the
-[v6.5.5 Release Notes](./docs/releases/v6.5.5.md).
+[v6.5.6 Release Notes](./docs/releases/v6.5.6.md).
 
 ### 1. CLI Usage
 
@@ -228,6 +228,8 @@ All three runtimes are tested in CI on every push. The hexagonal architecture is
   retained under one exact staging-workspace generation.
 - **[v6.5.5 Release Notes](./docs/releases/v6.5.5.md)**: Self-contained
   identity for git-cas-owned commits in unconfigured bare repositories.
+- **[v6.5.6 Release Notes](./docs/releases/v6.5.6.md)**: Bijou 7 hosted
+  cockpit ownership and deterministic checked-ref conflict classification.
 - **[Upgrading](./UPGRADING.md)**: Migration guide for v5 → v6.
 - **[Changelog](./CHANGELOG.md)**: Version history and migration notes.
 

ROADMAP.md

@@ -43,7 +43,7 @@ GitHub wins and this file should be corrected.
 | [`v6.5.3`](https://github.com/git-stunts/git-cas/milestone/13) | Coherent Git object sessions across immutable writes        | [#94](https://github.com/git-stunts/git-cas/issues/94)                                                                                                                                                                         |
 | [`v6.5.4`](https://github.com/git-stunts/git-cas/milestone/14) | Batched staging-workspace page retention                    | [#99](https://github.com/git-stunts/git-cas/issues/99)                                                                                                                                                                         |
 | [`v6.5.5`](https://github.com/git-stunts/git-cas/milestone/15) | Identity-independent internal Git commits                   | [#102](https://github.com/git-stunts/git-cas/issues/102)                                                                                                                                                                       |
-| [`v6.5.6`](https://github.com/git-stunts/git-cas/milestone/16) | Bijou 7 framed cockpit                                      | [#105](https://github.com/git-stunts/git-cas/issues/105), [#106](https://github.com/git-stunts/git-cas/issues/106)                                                                                                             |
+| [`v6.5.6`](https://github.com/git-stunts/git-cas/milestone/16) | Bijou 7 framed cockpit and deterministic ref conflicts      | [#105](https://github.com/git-stunts/git-cas/issues/105), [#106](https://github.com/git-stunts/git-cas/issues/106), [#111](https://github.com/git-stunts/git-cas/issues/111)                                                    |
 | [`v6.6.0`](https://github.com/git-stunts/git-cas/milestone/9)  | Operator TUI and agent automation follow-through            | [#39](https://github.com/git-stunts/git-cas/issues/39), [#40](https://github.com/git-stunts/git-cas/issues/40)                                                                                                                 |
 | [`v6.7.0`](https://github.com/git-stunts/git-cas/milestone/10) | Browser and edge read-path exploration                      | [#41](https://github.com/git-stunts/git-cas/issues/41)                                                                                                                                                                         |
 | [`v7.0.0`](https://github.com/git-stunts/git-cas/milestone/6)  | Protocol break only if audit requires it                    | [#42](https://github.com/git-stunts/git-cas/issues/42), only when justified                                                                                                                                                    |
@@ -52,10 +52,10 @@ GitHub wins and this file should be corrected.
 
 The latest landed design record is:
 
-- [0055-internal-commit-identity](./docs/design/0055-internal-commit-identity/internal-commit-identity.md)
+- [0057-deterministic-ref-conflict-posture](./docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md)
 
 Its GitHub goalpost issue,
-[#102](https://github.com/git-stunts/git-cas/issues/102), owns the release
+[#111](https://github.com/git-stunts/git-cas/issues/111), owns the release
 evidence. The design doc is the durable contract; GitHub records completion.
 
 The `v6.2.0` slice record is:

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS
 
-**Last tagged release:** `v6.5.4` (`2026-07-26`)
-**Current release state:** `v6.5.5` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
-**Latest verification:** the versioned `v6.5.5` candidate passed 14/14 release-verifier steps with 6,850 observed tests across Node, Bun, Deno, and all three real-Git integration suites; tag and publication verification remain pending.
+**Last tagged release:** `v6.5.5` (`2026-07-26`)
+**Current release state:** `v6.5.6` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
+**Latest verification:** the versioned `v6.5.6` candidate at implementation merge `4327effd` passed 14/14 release-verifier steps with 6,898 observed tests across Node, Bun, Deno, and all three real-Git integration suites.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,12 +18,19 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
-- **v6.5.5 candidate posture** — internal root-set, publication, and vault
-  commits now supply a git-cas-owned author and committer identity instead of
-  depending on ambient Git user configuration. Implementation PR
-  [#103](https://github.com/git-stunts/git-cas/pull/103) merged as
-  `fa3d5f64`; npm, JSR, and runtime metadata identify `6.5.5`, while tag and
-  registry artifacts remain deliberately absent pending release review.
+- **v6.5.6 candidate posture** — PR
+  [#109](https://github.com/git-stunts/git-cas/pull/109) merged the Bijou 7.2
+  framed cockpit as `e802269a`; PR
+  [#112](https://github.com/git-stunts/git-cas/pull/112) merged deterministic
+  checked-ref conflict classification as `4327effd`. npm, JSR, and runtime
+  metadata identify `6.5.6`; tag and registry artifacts remain deliberately
+  absent pending release review.
+- **v6.5.5 artifact posture** — signed tag `v6.5.5` resolves to reviewed merge
+  `9ea91a73`; npm reports `@git-stunts/git-cas@6.5.5` as the retained published
+  predecessor with SLSA provenance, and release workflow `30211630524`
+  published the final GitHub Release. Identity-independent git-cas-owned
+  commits are shipped. JSR dry-run validation is healthy, but JSR publication
+  is not part of the release workflow.
 - **v6.5.4 artifact posture** — signed tag `v6.5.4` resolves to reviewed merge
   `a2d23f5b`; npm reports `@git-stunts/git-cas@6.5.4` as `latest` with SLSA
   provenance, and release workflow `30205009357` published the final GitHub
@@ -146,7 +153,7 @@
   under the
   [`v6.6.0` milestone](https://github.com/git-stunts/git-cas/milestone/9).
 - The latest landed design record is
-  [0055-internal-commit-identity](./docs/design/0055-internal-commit-identity/internal-commit-identity.md).
+  [0057-deterministic-ref-conflict-posture](./docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md).
 
 ## Read Next
 

UPGRADING.md

@@ -2,6 +2,22 @@
 
 v6.0.0 is a major release that simplifies the encryption model, hardens security defaults, and cleans up the architecture. This guide covers every breaking change and what you need to do.
 
+## v6.5.5 To v6.5.6
+
+v6.5.6 changes no public API or stored-data schema and requires no migration.
+Interactive terminals now run the cockpit through Bijou 7.2's hosted
+`FramedApp`; noninteractive output and machine-readable command behavior are
+unchanged.
+
+Checked ref updates, atomic anchors, and checked deletes now classify
+concurrency from structured post-failure ref posture instead of Git's
+human-readable diagnostics. Existing callers keep the same boolean and
+`GIT_REF_CONFLICT` contracts. Operational failures remain unchanged when the
+attempted ref precondition still holds.
+
+See [v6.5.6 Release Notes](./docs/releases/v6.5.6.md) for the framed-cockpit,
+progress, contrast, and deterministic conflict details.
+
 ## v6.5.4 To v6.5.5
 
 v6.5.5 changes no public API and requires no stored-data migration. New

docs/design/0055-internal-commit-identity/witness/release-publication.md

@@ -0,0 +1,56 @@
+# INFRA-0055 v6.5.5 Publication Witness
+
+Date: 2026-07-26
+
+Issue: #102
+
+## Immutable Release Identity
+
+- Implementation PR: [#103](https://github.com/git-stunts/git-cas/pull/103)
+- Release PR: [#104](https://github.com/git-stunts/git-cas/pull/104)
+- Reviewed merge commit: `9ea91a738f2cbadf2a20b5ac7c2c6d54ba9f409e`
+- Signed annotated tag: `v6.5.5`
+- Tag object: `c1dc40fa3b25902be4abf6588da75f309a0153c7`
+- Peeled tag target: `9ea91a738f2cbadf2a20b5ac7c2c6d54ba9f409e`
+- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135`
+- GitHub Release:
+  [v6.5.5](https://github.com/git-stunts/git-cas/releases/tag/v6.5.5)
+  (final, not a draft or prerelease; published `2026-07-26T17:04:28Z`)
+
+Local `git tag -v v6.5.5` reported a good signature. The tag peels to the
+reviewed release merge exactly.
+
+## Release Workflow
+
+[Release run 30211630524](https://github.com/git-stunts/git-cas/actions/runs/30211630524)
+completed successfully against `v6.5.5`:
+
+| Job | Result | Evidence |
+| --- | --- | --- |
+| Validate | pass | Tag version matched `package.json` |
+| Test | pass | Lint, unit, Node/Bun/Deno real-Git integration |
+| Publish npm | pass | OIDC trusted publication completed |
+| GitHub Release | pass | Final release created after npm publication |
+
+Before tagging, the release candidate passed all 14 verifier steps with 6,850
+observed tests, public type compatibility, examples, build stamping, and npm
+and JSR dry-runs.
+
+## npm Registry Evidence
+
+Independent registry queries after the workflow completed reported:
+
+| Field | Value |
+| --- | --- |
+| Package | `@git-stunts/git-cas@6.5.5` |
+| Published | `2026-07-26T17:04:16.205Z` |
+| Dist-tag at publication | `latest` -> `6.5.5` |
+| Integrity | `sha512-x2ohvIq04o5W3eFmn/x6WQ8UuXcqIxcdKuQOhttZJ80ZokuY+97xqqi7cJCDdrmeJMkbcuSW1VvWFzcz6K6TAg==` |
+| Shasum | `92d2be5d262dd8f24273d518d60bb23f81d7d427` |
+| File count | `256` |
+| Unpacked size | `2,213,032` bytes |
+| Tarball | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.5.tgz` |
+
+The registry exposes the package-version
+[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.5)
+with npm publish and `https://slsa.dev/provenance/v1` predicates.

docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md

@@ -7,7 +7,7 @@ release_home: 'v6.5.6'
 issue: 'https://github.com/git-stunts/git-cas/issues/105'
 goalpost_issue: 'https://github.com/git-stunts/git-cas/issues/105'
 tracker_source: 'github'
-status: 'active'
+status: 'landed'
 base_commit: '9ea91a738f2cbadf2a20b5ac7c2c6d54ba9f409e'
 owners:
   - '@git-stunts'
@@ -18,7 +18,7 @@ blocking_issues: []
 supersedes: []
 superseded_by: null
 created: '2026-07-27'
-updated: '2026-07-27'
+updated: '2026-07-30'
 ---
 
 # TUI-0056 - Bijou 7 Framed Cockpit
@@ -318,7 +318,7 @@ outer-shell concern from the page model and renderer.
 - [x] application actions appear in frame help/commands/search;
 - [x] static mode and structured stdout boundaries are unchanged;
 - [x] all declared text/surface pairs pass at 4.5:1 or higher;
-- [ ] full validation and package/release checks pass.
+- [x] full validation and package/release checks pass.
 
 ## Validation Plan
 
@@ -359,8 +359,8 @@ fallback theme lookup, and payload review.
 
 ## Tracker Disposition
 
-GitHub issues #105 and #106 remain open until the implementation, witness,
-merge, and patch release are complete.
+GitHub issues #105 and #106 closed after implementation PR #109 merged. The
+patch-release evidence remains with the v6.5.6 candidate witness.
 
 ## Done Does Not Mean
 
@@ -371,4 +371,9 @@ merge, and patch release are complete.
 
 ## Retrospective
 
-Pending merge and release evidence.
+PR #109 merged the framed cockpit as
+`e802269ab6035eae75c2d61a8e8a898800cffbb8` after focused and hosted
+Node/Bun/Deno validation passed. Hosting one coherent cockpit page kept Bijou
+responsible for the application shell without splitting the shared vault and
+storage model across independently owned page states. The v6.5.6 release
+candidate then passed the repository's complete 14-step verifier.

docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md

@@ -7,7 +7,7 @@ release_home: "v6.5.6"
 issue: "https://github.com/git-stunts/git-cas/issues/111"
 goalpost_issue: "https://github.com/git-stunts/git-cas/issues/105"
 tracker_source: "github"
-status: "active"
+status: "landed"
 base_commit: "e802269ab6035eae75c2d61a8e8a898800cffbb8"
 owners:
   - "@git-stunts"
@@ -18,7 +18,7 @@ blocking_issues: []
 supersedes: []
 superseded_by: null
 created: "2026-07-29"
-updated: "2026-07-29"
+updated: "2026-07-30"
 ---
 
 # TRUST-0057 - Deterministic Ref Conflict Posture
@@ -289,8 +289,8 @@ operation's precondition, and otherwise rethrow the original error.
 - [x] No checked ref classification depends on diagnostic text.
 - [x] The three mutation methods implement the documented posture decision.
 - [x] Focused unit and real-Git integration tests pass.
-- [ ] Full lint, unit, integration, and release verification pass.
-- [ ] PR review and CI are green.
+- [x] Full lint, unit, integration, and release verification pass.
+- [x] PR review and CI are green.
 - [ ] `v6.5.6` is tagged, published to npm, and represented by a GitHub Release.
 
 ## Validation Plan
@@ -337,4 +337,11 @@ Git exit codes.
 
 ## Retrospective
 
-Pending implementation and release.
+PR #112 merged the posture-based classifier as
+`4327effd31c6d8ff00980512d6c59fc5064432d7` after all six GitHub checks
+passed, CodeRabbit approved the exact head, and no review threads existed.
+Re-reading structured state after a failed checked mutation proved narrower
+than both diagnostic parsing and exit-code classification: only a contradicted
+precondition becomes concurrency, while repository and process failures retain
+their original identity. The v6.5.6 release candidate then passed the complete
+14-step verifier.