release: prepare git-cas v6.3.0

[flyingrobots]

Summary

• promote @git-stunts/git-cas, JSR metadata, and the runtime version export to 6.3.0
• publish the scoped cache acquisition changelog, upgrade guidance, and release notes
• record an explicitly unpublished release-candidate witness while preserving immutable v6.2.0 publication evidence
• enforce published history and current candidate truth separately in release-state tests

Why

Scoped cache acquisitions are merged and ready for publication. git-warp needs the registry artifact to hold an exact materialization generation reachable from cache lookup through consumption, without owning Git CAS references or a second cache.

Refs #69.

Release posture

This PR does not claim that a v6.3.0 tag, npm artifact, or GitHub Release exists. After review and merge, a signed annotated tag will trigger the release workflow. Issue #69 remains open until publication evidence and the downstream git-warp registry handoff are attached.

Verification

• pnpm run release:verify: 14/14 steps, 6,325 observed tests
• unit: Node 1,928; Bun 1,927; Deno 1,918
• integration: Node/Bun/Deno 184 each
• public type compatibility: pass
• npm package dry-run: 242 files; 747,220 packed bytes; 2,054,933 unpacked bytes
• JSR publish dry-run: pass
• focused release/docs suite: 30/30
• normal pre-push gate: lint plus 215 files / 1,928 passing tests / 2 skipped
• git diff --check: clean
• Graft working-tree review: no structural API changes

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 53 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2e49d18a-996b-4720-a0b9-b7f668643200

📥 Commits

Reviewing files that changed from the base of the PR and between bc34a07 and bbc66cc.

📒 Files selected for processing (1)

• test/unit/docs/release-state.test.js

📝 Walkthrough

Walkthrough

Changes

v6.3.0 release candidate

Layer / File(s)	Summary
Version and release documentation CHANGELOG.md, jsr.json, package.json, src/package-version.js, docs/releases/v6.3.0.md	Version metadata, changelog content, and release verification counts are updated for v6.3.0.
Acquisition upgrade and status guidance STATUS.md, UPGRADING.md	Scoped cache acquisition, release, diagnostics, and candidate release status are documented.
Release verification witness docs/design/0048-scoped-cache-acquisitions/witness/*	Release provenance, verification results, package receipt data, publication gates, and repository gate status are recorded.
Release-state evidence tests test/unit/docs/release-state.test.js	Tests validate the v6.2.0 published artifact and ensure v6.3.0 remains represented as an unpublished candidate.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• v6.3.0: Bounded scoped cache acquisitions #69 — Documents the scoped cache acquisition work and its v6.3.0 rollout.

Possibly related PRs

• git-stunts/git-cas#68 — Adds related release-state tests for publication and status evidence.

Suggested reviewers: git-stunts

Poem

A rabbit hops through versioned hay,
“Six-three-oh” marks the release day.
Cache bounds hold, docs point the way,
Tests guard what tags may say,
And gates await before we play.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: preparing git-cas 6.3.0 for release.
Description check	✅ Passed	The description is mostly complete, covering summary, issue context, release posture, and verification with concrete results.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

Code Lawyer finding

Severity	File	Finding	Posture
P2	test/unit/docs/release-state.test.js	Candidate assertions required intended markers but did not reject contradictory v6.3.0 tag, npm, provenance, or GitHub Release receipts.	Fix validated locally; separate commit pending.

RED evidence: a temporary contradictory v6.3.0 is published status line caused the focused test to fail exactly at the new guard. The contradictory line was removed; the clean focused test, 30-test release/docs slice, lint, and git diff --check now pass.

[flyingrobots]

Code Lawyer re-review finding

Severity	File	Finding	Posture
P1	test/unit/docs/release-state.test.js	The first negative guard encoded candidate state unconditionally, so legitimate post-publication evidence would require deleting the invariant rather than advancing an explicit lifecycle.	Fix in progress as a separate commit.

The replacement will enforce exactly one phase: candidate state must exclude publication receipts; published state must include a v6.3.0 publication witness with signed tag, npm/provenance, and GitHub Release evidence.

[flyingrobots]

Code Lawyer activity summary

Item	Severity	Resolution commit	Outcome
Reject contradictory candidate/publication evidence	P2	bc34a077	RED mutation failed as intended; clean candidate passed.
Model candidate-to-publication lifecycle explicitly	P1	bbc66ccf	Candidate forbids receipts; published state requires signed tag, npm/provenance, and GitHub Release evidence.

Final independent Code Lawyer verdict: CLEAN on exact head bbc66ccf3cbc18e92c9f80bf5b85213f0e37f5ef.

Final gate:

• lint: pass
• unit: pass
• Node integration: pass
• Bun integration: pass
• Deno integration: pass
• unresolved review threads: 0
• CodeRabbit: rate limited; no actionable findings or review threads
• Graft: no breaking changes and no exported API changes