docs: record git-cas v6.3.0 publication

[flyingrobots]

Summary

• advance STATUS.md from the v6.3.0 candidate phase to independently verified publication
• record immutable signed-tag, workflow, npm registry, provenance, and GitHub Release evidence
• complete the publication gate while preserving the explicit downstream git-warp handoff gate

Evidence

• release PR: release: prepare git-cas v6.3.0 #73
• reviewed merge: 33f4171f6b69d75110de834f9a75d64e2d14e1a3
• signed tag object: ef65b74e9a8bd94413d30039a4b37f9b28287c3c
• release workflow: 29566015478, green
• npm: @git-stunts/git-cas@6.3.0, latest, trusted publication
• SLSA provenance resolves the package to the reviewed merge and v6.3.0 tag
• GitHub Release: final, not draft or prerelease
• focused release/docs suite: 30/30
• normal pre-push gate: lint plus 215 files / 1,928 tests passed / 2 skipped
• Graft: documentation-only diff, no structural changes

Refs #69.

Issue #69 intentionally remains open until git-warp consumes the published registry artifact through its normal package manager and records executable handoff evidence.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 36 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6cbac680-f3c9-49ae-917e-a94cb3c940c6

📥 Commits

Reviewing files that changed from the base of the PR and between 33f4171 and fd1afa6.

📒 Files selected for processing (3)

• STATUS.md
• docs/design/0048-scoped-cache-acquisitions/witness/release-publication.md
• docs/design/0048-scoped-cache-acquisitions/witness/verification.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

Self-Code Review

Reviewed origin/main...fd1afa61adf4e867f673a036254e5fa260f20a51 after the mandatory clean-worktree gate and a fresh git fetch origin --prune.

@codex please independently confirm this review.

Severity	Count	Result
Critical / P0	0	No findings
High / P1	0	No findings
Medium / P2	0	No findings
Low / P3	0	No findings
Markdown / nits	0	No findings

Review evidence

• Intent and scope match: three documentation-only files record the completed v6.3.0 publication while explicitly preserving the downstream git-warp handoff gate.
• Graft classified all three files as documentation, found no structural changes, and reported no exported API impact.
• git diff --check origin/main...HEAD: pass.
• pnpm run lint: pass.
• Focused publication/docs suite: 4 files, 27 tests, all pass.
• PR CI: lint, unit, and Node/Bun/Deno real-Git integration all pass.
• Signed annotated tag, remote tag object, peeled target, release PR merge, workflow jobs, final GitHub Release, npm metadata, tarball metadata, and both npm/SLSA attestation predicates were independently reverified.
• Issue v6.3.0: Bounded scoped cache acquisitions #69 remains open, matching the documented downstream adoption gate.
• No unresolved review threads exist. CodeRabbit did not review because of its explicit rate limit; it raised no code finding.

Residual risk

The npm registry and GitHub API observations are point-in-time external evidence. The witness mitigates that with immutable Git object IDs, the signed tag, package digests, and SLSA provenance. git-warp adoption is intentionally not claimed by this PR.