diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index 2f5bee0db..bc71334af 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -36,7 +36,7 @@ This Code of Conduct applies within all community spaces, including the GitHub r
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project maintainers by directly messaging a Community Leader on the [Graphify Discord server](https://discord.gg/XDnKVpzdXB) or by emailing the maintainer directly if known.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project maintainers at safi@graphify.com, or by directly messaging a Community Leader on the [Graphify Discord server](https://discord.gg/XDnKVpzdXB).
 
 All complaints will be reviewed and investigated promptly and fairly. All community leaders are obligated to respect the privacy and security of the reporter of any incident.
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e4a4fbb56..7f3ba91ca 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -148,4 +148,4 @@ Focus on the problem first, proposed behavior, alternatives, and compatibility c
 - [ARCHITECTURE.md](ARCHITECTURE.md)
 - [SECURITY.md](SECURITY.md)
 - [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
-- [The Memory Layer](https://safishamsi.gumroad.com/l/qetvlo)
+- [RELEASING.md](RELEASING.md) (maintainers)
diff --git a/README.md b/README.md
index 5027e81f1..187f3001f 100644
--- a/README.md
+++ b/README.md
@@ -460,6 +460,8 @@ git add -f graphify-out/GRAPH_REPORT.md
 
 > `manifest.json` is now portable — keys are stored as relative paths and re-anchored on load, so committing it is safe and avoids a full rebuild on first checkout.
 
+The remaining `graphify-out/` files stay machine-local and should **not** be force-added: `.graphify_root` and `.graphify_python` (absolute paths to this machine's scan root and interpreter), `.graphify_analysis.json`, the AST cache under `graphify-out/cache/`, and the `needs_update` flag. A teammate who pulls the shared `graph.json` can query it immediately; running `graphify update` re-anchors the committed `manifest.json` and rebuilds only what changed on their machine.
+
 ### Recommended workflow
 
 Set this up once per clone. From then on, three of your normal git commands keep the graph current by themselves, and one keeps it in sync with your team:
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 000000000..f62859b90
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,49 @@
+# Releasing graphify
+
+Maintainer-facing release process. Contributors do not need this; see
+[CONTRIBUTING.md](CONTRIBUTING.md) for how to propose changes.
+
+graphify publishes to PyPI (package name `graphifyy`) automatically through
+GitHub trusted publishing. There is no manual `twine` upload and no API token to
+manage.
+
+## Steps
+
+1. **Bump the version.** Edit `version` in `pyproject.toml`.
+2. **Update the changelog.** Add a dated section for the new version at the top of
+   `CHANGELOG.md`, crediting each landed PR and its author.
+3. **Refresh the lock.** Run `uv lock` so `uv.lock` records the new version (and
+   any dependency changes).
+4. **Test on both supported interpreters.** Run the full suite on Python 3.10 and
+   3.13:
+   ```bash
+   uv run pytest
+   # and against a 3.13 environment, e.g.
+   uv run --python 3.13 pytest
+   ```
+5. **Commit and push `v8`.** Commit the version, changelog, and lock together,
+   then `git push origin v8`.
+6. **Cut the GitHub release.** Tag the release off `v8`:
+   ```bash
+   gh release create vX.Y.Z --repo Graphify-Labs/graphify --target v8 \
+     --title "vX.Y.Z" --notes-file <notes>
+   ```
+   Publishing the release fires `publish.yml` on the `release-published` event,
+   which builds the wheel/sdist and uploads to PyPI via trusted publishing. Do
+   **not** run `twine` or pass a token.
+7. **Verify the install** once PyPI has the new version (the JSON API updates
+   before the install index; use `--refresh`):
+   ```bash
+   uvx --refresh --from graphifyy==X.Y.Z graphify --version
+   ```
+
+## Version numbering
+
+Keep public versions contiguous. If a number was bumped locally but never
+published to PyPI, reuse that number for the next release rather than leaving a
+gap.
+
+## Supported versions
+
+Security fixes target only the latest released `0.9.x`. See
+[SECURITY.md](SECURITY.md).