Release checklist

Use this checklist for each preview or stable release. Keep code acceptance, release-delta verification, and publication authorization as separate records.

Local review candidate

• Set the intended Semantic Versioning identifier.
• Keep private: true while publication remains unauthorized.
• Confirm README installation and status text match that version.
• Update CHANGELOG.md, compatibility status, and provenance.
• Confirm that absent public repository metadata is described as pending.
• Commit the candidate and create one local annotated tag.

Verification

• Clone the frozen tag into a new directory.
• Confirm that the checkout is clean and does not contain dist.
• Run npm ci.
• Run npm run check.
• Run npm run test:matrix.
• Run npm audit --omit=dev.
• Run npm run pack:dry-run.
• Build one tarball and record its SHA-256 hash.
• Install that exact tarball in clean ESM and CommonJS consumers.
• Confirm the tarball contains no credentials, .env files, temporary canary paths, or unrelated artifacts.

Review

• Compare the release commit with the last accepted runtime commit.
• Reuse the accepted code decision when the delta contains only documentation, version metadata, repository metadata, and release workflow changes.
• Run a new independent review when source code, runtime dependencies, build behavior, tests, or the public API changes.
• For a release-only delta, repeat the tarball hash, content inspection, and clean ESM/CommonJS installs.
• Keep first-party verification separate from the inherited code acceptance record.

Publication candidate

• Obtain separate authorization for the public repository, push, npm publication, and release announcement.
• Add the approved public repository metadata.
• Remove private: true in a focused manifest change.
• Review that manifest change and repeat the tarball, hash, install, and package-content checks.
• Publish from the reviewed commit through trusted publishing with provenance when available.
• Create the Git tag and GitHub Release for the same commit.
• Compare the registry tarball integrity with the reviewed artifact.
• Verify installation from the public registry on supported Node versions.

Downstream validation

• Replace local tarball paths with the published version or a fixed public commit.
• Open one small draft migration PR.
• Include only the downstream's dependency, import, mock, error mapping, and required contract documentation changes.
• Record maintainer feedback before opening more migration PRs.