chore(release): record the plan closure for the alkssh 0.1.0 publish (w5-publish)

- plan file status → closed; wave-5 row → published; §Plan closure
  added (the freeze inventory one-way, the still-booked upstream asks)
- w5-publish task: the checklist record (manifest sanity, the full
  verification set, dry-run, package list) + status, over the green
  review-wave-5 verdict

docs/plans/implementation.md

@@ -1,8 +1,8 @@
 ---
-status: draft
-last_updated: 2026-10-30 (wave 5 decomposed after the wave-4 gate
-  closed green — nothing to absorb beyond the wave's own plan; waves
-  1–4 decomposed + implemented + gated 2026-10-28/29)
+status: closed
+last_updated: 2026-10-30 (the plan closed at the publish of alkssh
+  0.1.0 — tag `alkssh-v0.1.0`; waves 1–5 decomposed + implemented +
+  gated 2026-10-28/30)
 ---
 
 # alkssh — Implementation plan
@@ -48,7 +48,7 @@ mappings ∥ client direction) → validation & release.
 | [2](#wave-2--the-server-stack) | `SshAdapter::handle` mount + `Config` construction; the auth bridge; parse-only dispatch + fail-closed decline core; spawn-and-return plumbing; bounded resources; loopback harness | wave 1 | decomposed |
 | [3](#wave-3--server-mappings) | session → alktty (translation bridge + exit derivation); git → alkgit (exec grammar + dispatch); tunnel → alktunnels route 1; sftp placeholder declines | wave 2 | decomposed |
 | [4](#wave-4--client-direction) | Dial surface; op rows (exec/pty, direct-tcpip, git exec); the `-R` leg (listen + acceptor registry); lifecycle primitives | wave 1 | decomposed |
-| [5](#wave-5--validation--release) | Decline-matrix contract suite; real-tool e2e; fuzzing; docs; **the publish** | waves 3 + 4 | decomposed |
+| [5](#wave-5--validation--release) | Decline-matrix contract suite; real-tool e2e; fuzzing; docs; **the publish** | waves 3 + 4 | published |
 
 ## Wave 1 — Foundations
 
@@ -526,6 +526,33 @@ Interpretations recorded (flagged for the wave-5 gate):
 - **No version bump** — the manifest already carries 0.1.0; the
   publish task verifies rather than bumps.
 
+## Plan closure (2026-10-30)
+
+The plan closed at the publish of **`alkssh 0.1.0`** — the publish
+commit, tagged **`alkssh-v0.1.0`** (the crate-qualified alkgit tag
+convention) and pushed to `origin/main`. Scope authority discharged:
+the complete two-direction door shipped (server stack + all mappings,
+client stack + op rows, key sources, host-key policy seam, the
+decline matrix contract-tested per build per `scripts/matrix.sh` —
+see AGENTS.md's verification list), the assembly stays out (seams
+only — identity/ACL/fabric policy is downstream composition), no
+binary, single crate. All five review gates closed green (waves 1–4
+2026-10-28/29; the wave-5 release gate 2026-10-30).
+
+**The freeze inventory is one-way from the publish** (recorded in
+`w5-release-readiness.md` §The freeze inventory, verified accurate
+against the landed code at the wave-5 gate): the mapping contracts,
+the honest-advertisement posture, the decline-matrix behavior, the
+fingerprint string format, the russh 0.65 pin's wire posture.
+Further wire-relevant change is a new ADR + a semver event.
+
+Still booked with their owners (nothing absorbed through the
+release): the wave-3 gate's item-5 upstream asks (the
+alktunnels/alkcall non-detaching post-construction identity seam;
+mapping.md's correlation-miss event-vocabulary nuance) and the
+`ssh-key` PPK parse-echo ask recorded in `w5-fuzz-harness.md`
+(the tracker filing is owner-territory).
+
 ## References
 
 - `docs/architecture/` — overview, mapping, client, auth,

tasks/implementation/w5-publish.md

@@ -1,7 +1,7 @@
 ---
 id: w5-publish
 name: Wave 5 — the publish of alkssh 0.1
-status: pending
+status: in-progress
 depends_on: [review-wave-5]
 scope: narrow
 risk: medium
@@ -71,7 +71,45 @@ The checklist:
 
 ## Notes
 
-> To be filled by implementation agent
+Filled by the implementation agent (2026-10-30), executing over the
+green `review-wave-5` verdict at `9383e95`.
+
+- **No findings in the checklist itself** — unlike the alkgit
+  publish (which had to land missing LICENSE files), the wave-5
+  release readiness already landed every artifact; this task only
+  verified.
+- **Manifest sanity verified** (no bump — 0.1.0 is the manifest
+  value): version 0.1.0, edition 2024, `rust-version` 1.89,
+  `license = "MIT OR Apache-2.0"` with `LICENSE-MIT` +
+  `LICENSE-APACHE` present, the pins exactly as ADR-002 records them
+  (russh 0.65 `default-features = false` + `aws-lc-rs`; alkcall
+  0.10; alkvault 0.1; the optional siblings alktty 0.8.1 / alkgit
+  0.1.0 / alktunnels 0.4.1), the package-policy `exclude` list in
+  place, the feature graph exactly ADR-003's flat shape
+  (`default = []`, no implies).
+- **The full verification set green at the gate commit** (the tree
+  was clean — gate commit == publish base): `scripts/matrix.sh` all
+  six builds' `cargo test` + clippy ×2 (`--all-targets -D warnings`,
+  with and without `--all-features`) + `cargo fmt --check` +
+  `cargo doc --no-deps` (doctests included — the two `no_run`
+  usage doctests compile-checked per build); the fuzz corpus gate
+  `cargo test --manifest-path fuzz/shared/Cargo.toml` 11/11.
+- **The dry-run clean**: `cargo publish --dry-run --allow-dirty` —
+  76 files packaged, the packaged tree compiled (verification
+  compile passed), upload aborted by dry run as expected;
+  `cargo package --list` spot-checked against the package policy —
+  exactly `src/` (20), `tests/` (+ `common/` + `vectors/`), the
+  architecture docs (`docs/architecture/`), `README.md`,
+  `CHANGELOG.md`, both licenses, the manifests, and
+  `scripts/matrix.sh`; none of the excluded surface appears
+  (`AGENTS.md`, `.opencode/`, `docs/plans|reviews|research/`,
+  `docs/sdd_process.md`, `tasks/`, `fuzz/`).
+- **The publish credential is present in this environment** — the
+  publish executes live, no operator handover, no silent skip.
+- **The closure records ride the publish commit**: the plan file's
+  status → `closed`, the wave-5 row → `published`, and the §Plan
+  closure note (the freeze inventory one-way; the still-booked
+  upstream asks) land in the tagged commit.
 
 ## Summary