alkssh/tasks/implementation/w5-publish.md

id, name, status, depends_on, scope, risk, impact, level

id	name	status	depends_on	scope	risk	impact	level
w5-publish	Wave 5 — the publish of alkssh 0.1	in-progress	review-wave-5	narrow	medium	project	implementation

Description

The publish — the plan's closing act (docs/plans/implementation.md §Wave 5: "then the publish of alkssh 0.1 — the gate review that closes the plan"; the alkgit pattern: the gate stays a pure review, the publish is its own task executing only over a green verdict). The checklist:

• Manifest sanity — version 0.1.0 (already the manifest value — verify, no bump needed), rust-version 1.89, edition 2024, the license files present, the dependency pins as ADR-002 records them (russh 0.65 / aws-lc-rs, alkcall 0.10, alkvault 0.1, the per-feature siblings), the package-policy exclude list, the feature graph exactly ADR-003's.
• The full verification set — cargo test per build + --all-features, clippy ×2 -D warnings, fmt, cargo doc --no-deps, the fuzz corpus gate, the matrix runner — all green at the publish commit.
• The dry-run — cargo publish --dry-run --allow-dirty clean at the publish commit (the packaged file list spot-checked once more).
• The tag — the crate-qualified alkssh-v0.1.0 (the alkgit convention: crate-qualified tags, a bare v0.1.0 would be ambiguous across the family's multi-crate repos).
• The publish — cargo publish; the published version verified resolvable on crates.io after (a fresh cargo add/cargo search or the index check). If the publish credential is unavailable, the task stops and books it — never a silent skip; everything before the credential step still lands (tag + records).
• The plan's closure recorded — docs/plans/implementation.md updated (the wave-5 row + the closure note: the plan closed at the publish commit; the freeze inventory's surfaces are one-way from here — the mapping contracts, the honest-advertisement posture, the decline-matrix behavior, the fingerprint format, the russh pin's wire posture; further wire-relevant change is a new ADR + a semver event).

Acceptance Criteria

• Manifest sanity verified + recorded (no version bump needed — 0.1.0 is the manifest value)
• The full verification set green at the publish commit
• The dry-run clean at the publish commit
• The alkssh-v0.1.0 tag on the publish commit
• cargo publish executed; the published 0.1.0 verified resolvable on crates.io (or the credential absence booked — never a silent skip)
• The plan's closure recorded in docs/plans/implementation.md

References

• docs/plans/implementation.md §Wave 5 (the publish bullet), §Scope authority (v0.1.0 publishes the crate)
• docs/architecture/decisions/002-russh-pin.md (the pin the manifest records), docs/architecture/decisions/001-alkssh-alpn-pin.md (the ledger entry the publish makes load-bearing)
• /workspace/@alkdev/alkgit tasks (the core/w5-publish shape this mirrors: manifest sanity, verification, dry-run, the crate-qualified tag, cargo publish)

Notes

Filled by the implementation agent (2026-10-30), executing over the green review-wave-5 verdict at 9383e95.

• No findings in the checklist itself — unlike the alkgit publish (which had to land missing LICENSE files), the wave-5 release readiness already landed every artifact; this task only verified.
• Manifest sanity verified (no bump — 0.1.0 is the manifest value): version 0.1.0, edition 2024, rust-version 1.89, license = "MIT OR Apache-2.0" with LICENSE-MIT + LICENSE-APACHE present, the pins exactly as ADR-002 records them (russh 0.65 default-features = false + aws-lc-rs; alkcall 0.10; alkvault 0.1; the optional siblings alktty 0.8.1 / alkgit 0.1.0 / alktunnels 0.4.1), the package-policy exclude list in place, the feature graph exactly ADR-003's flat shape (default = [], no implies).
• The full verification set green at the gate commit (the tree was clean — gate commit == publish base): scripts/matrix.sh all six builds' cargo test + clippy ×2 (--all-targets -D warnings, with and without --all-features) + cargo fmt --check + cargo doc --no-deps (doctests included — the two no_run usage doctests compile-checked per build); the fuzz corpus gate cargo test --manifest-path fuzz/shared/Cargo.toml 11/11.
• The dry-run clean: cargo publish --dry-run --allow-dirty — 76 files packaged, the packaged tree compiled (verification compile passed), upload aborted by dry run as expected; cargo package --list spot-checked against the package policy — exactly src/ (20), tests/ (+ common/ + vectors/), the architecture docs (docs/architecture/), README.md, CHANGELOG.md, both licenses, the manifests, and scripts/matrix.sh; none of the excluded surface appears (AGENTS.md, .opencode/, docs/plans|reviews|research/, docs/sdd_process.md, tasks/, fuzz/).
• The publish credential is present in this environment — the publish executes live, no operator handover, no silent skip.
• The closure records ride the publish commit: the plan file's status → closed, the wave-5 row → published, and the §Plan closure note (the freeze inventory one-way; the still-booked upstream asks) land in the tagged commit.

Summary

To be filled on completion