---
id: w5-publish
name: "Wave 5: the publish of alkssh 0.1"
status: completed
depends_on: [review-wave-5]
scope: narrow
risk: medium
impact: project
level: implementation
---

## Description

The publish, which is the plan's closing act (`docs/plans/implementation.md`
§Wave 5: "then **the publish of `alkssh 0.1`**, the gate review that
closes the plan"; the alkgit pattern: the gate stays a pure review,
the publish is its own task executing only over a green verdict).
The checklist:

- **Manifest sanity**, covering version 0.1.0 (already the manifest value, so
  verify, no bump needed), `rust-version` 1.89, edition 2024, the
  license files present, the dependency pins as ADR-002 records them
  (russh 0.65 / aws-lc-rs, alkcall 0.10, alkvault 0.1, the
  per-feature siblings), the package-policy `exclude` list, the
  feature graph exactly ADR-003's.
- **The full verification set**: `cargo test` per build +
  `--all-features`, clippy ×2 `-D warnings`, fmt,
  `cargo doc --no-deps`, the fuzz corpus gate, the matrix runner,
  all green at the publish commit.
- **The dry-run**: `cargo publish --dry-run --allow-dirty` clean at
  the publish commit (the packaged file list spot-checked once more).
- **The tag**: the crate-qualified `alkssh-v0.1.0` (the alkgit
  convention: crate-qualified tags, a bare `v0.1.0` would be
  ambiguous across the family's multi-crate repos).
- **The publish**: `cargo publish`; the published version verified
  resolvable on crates.io after (a fresh `cargo add`/`cargo search`
  or the index check). **If the publish credential is unavailable,
  the task stops and books it, never silently skipping**; everything
  before the credential step still lands (tag + records).
- **The plan's closure recorded**: `docs/plans/implementation.md`
  updated (the wave-5 row + the closure note: the plan closed at the
  publish commit; the freeze inventory's surfaces are one-way from
  here: the mapping contracts, the honest-advertisement posture,
  the decline-matrix behavior, the fingerprint format, the russh
  pin's wire posture; further wire-relevant change is a new ADR + a
  semver event).

## Acceptance Criteria

- [x] Manifest sanity verified and recorded (no version bump needed,
      0.1.0 is the manifest value)
- [x] The full verification set green at the publish commit
- [x] The dry-run clean at the publish commit
- [x] The `alkssh-v0.1.0` tag on the publish commit
- [x] `cargo publish` executed; the published 0.1.0 verified
      resolvable on crates.io (or the credential absence booked,
      never a silent skip)
- [x] The plan's closure recorded in
      `docs/plans/implementation.md`

## References

- docs/plans/implementation.md §Wave 5 (the publish bullet), §Scope
  authority (v0.1.0 publishes the crate)
- docs/architecture/decisions/002-russh-pin.md (the pin the manifest
  records), docs/architecture/decisions/001-alkssh-alpn-pin.md (the
  ledger entry the publish makes load-bearing)
- /workspace/@alkdev/alkgit tasks (the `core/w5-publish` shape this
  mirrors: manifest sanity, verification, dry-run, the
  crate-qualified tag, `cargo publish`)

## Notes

Filled by the implementation agent (2026-10-30), executing over the
green `review-wave-5` verdict at `9383e95`.

- **No findings in the checklist itself**, unlike the alkgit
  publish (which had to land missing LICENSE files), the wave-5
  release readiness already landed every artifact; this task only
  verified.
- **Manifest sanity verified** (no bump, since 0.1.0 is the manifest
  value): version 0.1.0, edition 2024, `rust-version` 1.89,
  `license = "MIT OR Apache-2.0"` with `LICENSE-MIT` +
  `LICENSE-APACHE` present, the pins exactly as ADR-002 records them
  (russh 0.65 `default-features = false` + `aws-lc-rs`; alkcall
  0.10; alkvault 0.1; the optional siblings alktty 0.8.1 / alkgit
  0.1.0 / alktunnels 0.4.1), the package-policy `exclude` list in
  place, the feature graph exactly ADR-003's flat shape
  (`default = []`, no implies).
- **The full verification set green at the gate commit** (the tree
  was clean, so gate commit == publish base): `scripts/matrix.sh` all
  six builds' `cargo test` + clippy ×2 (`--all-targets -D warnings`,
  with and without `--all-features`) + `cargo fmt --check` +
  `cargo doc --no-deps` (doctests included, with the two `no_run`
  usage doctests compile-checked per build); the fuzz corpus gate
  `cargo test --manifest-path fuzz/shared/Cargo.toml` 11/11.
- **The dry-run clean**: `cargo publish --dry-run --allow-dirty`:
  76 files packaged, the packaged tree compiled (verification
  compile passed), upload aborted by dry run as expected;
  `cargo package --list` spot-checked against the package policy:
  exactly `src/` (20), `tests/` (+ `common/` + `vectors/`), the
  architecture docs (`docs/architecture/`), `README.md`,
  `CHANGELOG.md`, both licenses, the manifests, and
  `scripts/matrix.sh`; none of the excluded surface appears
  (`AGENTS.md`, `.opencode/`, `docs/plans|reviews|research/`,
  `docs/sdd_process.md`, `tasks/`, `fuzz/`).
- **The publish credential is present in this environment**, so the
  publish executes live, no operator handover, no silent skip.
- **The closure records ride the publish commit**: the plan file's
  status → `closed`, the wave-5 row → `published`, and the §Plan
  closure note (the freeze inventory one-way; the still-booked
  upstream asks) land in the tagged commit.
- **The publish-commit dry-run rider**: the closure edits touch only
  package-excluded paths (`docs/plans/`, `tasks/`), but the dry-run
  was nonetheless re-executed at the publish commit itself (`e59ef79`),
  and was clean again with the same 76-file package.

## Summary

**`alkssh 0.1.0` published to crates.io on 2026-10-30.** Publish commit
`e59ef79`, tagged **`alkssh-v0.1.0`** (crate-qualified, the alkgit
tag convention), pushed to `origin/main` with the tag. The checklist
ran in order over the green `review-wave-5` verdict at `9383e95`:
manifest sanity verified (no bump, 0.1.0 being the manifest value;
edition 2024; `rust-version` 1.89; both license files; the pins
exactly as ADR-002 records them; the package-policy `exclude` list;
the feature graph exactly ADR-003's); the full verification set green
(`scripts/matrix.sh`: six builds' `cargo test`, clippy ×2 -D
warnings, fmt, doc with the doctests compile-checked; the fuzz
corpus gate 11/11); `cargo publish --dry-run --allow-dirty` clean
twice (76 files, packaged-compile verified, once pre-commit and once
at `e59ef79`; the package list against policy, where architecture docs
ship, process surface and `fuzz/` do not). `cargo publish` completed
live (`Published alkssh v0.1.0 at registry crates-io`; the
environment carried the credentials, no operator handover, no silent
skip). Resolvability verified post-publish: `cargo search alkssh`
lists `alkssh = "0.1.0"` and a fresh `cargo add alkssh` in a clean
scratch project resolved it off the index. The plan's closure is
recorded in `docs/plans/implementation.md` (§Plan closure) on the
publish commit: the freeze inventory (mapping contracts, honest
advertisement, decline-matrix behavior, fingerprint format, the
russh pin's wire posture) is one-way from here; the upstream asks
stay booked with their owners. **The implementation plan is closed.**