docs: align #3845 contributor guide with maintainer policy

Follow-up edits on #3845 to match the settled maintainer decisions:
- CODE_OF_CONDUCT.md: set the enforcement/reporting contact to
  safi@graphify.com (was an unspecified 'email the maintainer if known').
- README team-graph section: add the machine-local never-commit list
  (.graphify_root, .graphify_python, .graphify_analysis.json, the AST
  cache, needs_update) and the re-extract-to-update note. manifest.json
  stays committable since #3781 made its keys portable.
- Add RELEASING.md (maintainer-facing): version bump + changelog +
  uv.lock, test on 3.10/3.13, push v8, gh release create -> PyPI via
  trusted publishing (no twine/token), verify with uvx --refresh.
- CONTRIBUTING Further Reading: drop the paid Gumroad link, point at
  RELEASING.md instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CODE_OF_CONDUCT.md

@@ -36,7 +36,7 @@ This Code of Conduct applies within all community spaces, including the GitHub r
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project maintainers by directly messaging a Community Leader on the [Graphify Discord server](https://discord.gg/XDnKVpzdXB) or by emailing the maintainer directly if known.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project maintainers at safi@graphify.com, or by directly messaging a Community Leader on the [Graphify Discord server](https://discord.gg/XDnKVpzdXB).
 
 All complaints will be reviewed and investigated promptly and fairly. All community leaders are obligated to respect the privacy and security of the reporter of any incident.
 

CONTRIBUTING.md

@@ -148,4 +148,4 @@ Focus on the problem first, proposed behavior, alternatives, and compatibility c
 - [ARCHITECTURE.md](ARCHITECTURE.md)
 - [SECURITY.md](SECURITY.md)
 - [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
-- [The Memory Layer](https://safishamsi.gumroad.com/l/qetvlo)
+- [RELEASING.md](RELEASING.md) (maintainers)

README.md

@@ -460,6 +460,8 @@ git add -f graphify-out/GRAPH_REPORT.md
 
 > `manifest.json` is now portable — keys are stored as relative paths and re-anchored on load, so committing it is safe and avoids a full rebuild on first checkout.
 
+The remaining `graphify-out/` files stay machine-local and should **not** be force-added: `.graphify_root` and `.graphify_python` (absolute paths to this machine's scan root and interpreter), `.graphify_analysis.json`, the AST cache under `graphify-out/cache/`, and the `needs_update` flag. A teammate who pulls the shared `graph.json` can query it immediately; running `graphify update` re-anchors the committed `manifest.json` and rebuilds only what changed on their machine.
+
 ### Recommended workflow
 
 Set this up once per clone. From then on, three of your normal git commands keep the graph current by themselves, and one keeps it in sync with your team:

RELEASING.md

@@ -0,0 +1,49 @@
+# Releasing graphify
+
+Maintainer-facing release process. Contributors do not need this; see
+[CONTRIBUTING.md](CONTRIBUTING.md) for how to propose changes.
+
+graphify publishes to PyPI (package name `graphifyy`) automatically through
+GitHub trusted publishing. There is no manual `twine` upload and no API token to
+manage.
+
+## Steps
+
+1. **Bump the version.** Edit `version` in `pyproject.toml`.
+2. **Update the changelog.** Add a dated section for the new version at the top of
+   `CHANGELOG.md`, crediting each landed PR and its author.
+3. **Refresh the lock.** Run `uv lock` so `uv.lock` records the new version (and
+   any dependency changes).
+4. **Test on both supported interpreters.** Run the full suite on Python 3.10 and
+   3.13:
+   ```bash
+   uv run pytest
+   # and against a 3.13 environment, e.g.
+   uv run --python 3.13 pytest
+   ```
+5. **Commit and push `v8`.** Commit the version, changelog, and lock together,
+   then `git push origin v8`.
+6. **Cut the GitHub release.** Tag the release off `v8`:
+   ```bash
+   gh release create vX.Y.Z --repo Graphify-Labs/graphify --target v8 \
+     --title "vX.Y.Z" --notes-file <notes>
+   ```
+   Publishing the release fires `publish.yml` on the `release-published` event,
+   which builds the wheel/sdist and uploads to PyPI via trusted publishing. Do
+   **not** run `twine` or pass a token.
+7. **Verify the install** once PyPI has the new version (the JSON API updates
+   before the install index; use `--refresh`):
+   ```bash
+   uvx --refresh --from graphifyy==X.Y.Z graphify --version
+   ```
+
+## Version numbering
+
+Keep public versions contiguous. If a number was bumped locally but never
+published to PyPI, reuse that number for the next release rather than leaving a
+gap.
+
+## Supported versions
+
+Security fixes target only the latest released `0.9.x`. See
+[SECURITY.md](SECURITY.md).