[hsd-bot]

Closes #119

Summary

• Replaces CONTRIBUTING's "Releasing" section with the maintainer's 2.0.0 release script, which has now been used for a real release. It's kept nearly word for word and generalized to X.Y.Z. It has 11 steps, each listing the commands to run and what to check before moving on.
• States up front that the maintainer cuts releases, and that agents and ordinary PRs don't bump the version, rebuild the built files, tag, or publish.
• Covers the 2.0.0 lessons: bump the version before building (the build writes it into the header, and VersionSpec checks it), and publish with npm two-factor authentication via npm login, not a saved token.

Decisions

• Changes from the 2.0.0 script: 2.0.0 becomes X.Y.Z. Lines that only applied to 2.0.0 are dropped or generalized: the main-rename note, the expected previous version, the specific breaking change to look for, and the list of issues to close. The two lessons from the issue are added as notes in steps 3 and 8, and the existing note on what prepublishOnly checks is kept.
• Reworded one sentence in "Build outputs" that implied rebuilding in a release PR.
• Docs only, so I didn't start the dev container or run the tests.

🤖 Generated with Claude Code

[hsd-bot]

hsd review round 1

Approved. This is a docs-only change to CONTRIBUTING.md, and it covers everything issue #119 asks for:

• "Releasing" is now a 10-step maintainer checklist that follows the 2.0.0 source material in order.
• The opening paragraph says the maintainer cuts releases and that agents and ordinary PRs don't bump the version, rebuild, tag or publish.
• Both lessons from 2.0.0 are in: step 3 says to bump the version before building (because of the header stamp and VersionSpec), and step 8 covers npm 2FA through npm login with "Authorization and writes" instead of a saved token.
• Rewording the "Build outputs" sentence is justified. Its old wording implied a release PR, which is the problem the issue describes.

I checked the doc's claims against the repo. npm run release runs build and then test:built against both built files. prepublishOnly runs git diff --exit-code on the built files and then test:built. VersionSpec is registered in spec/jasmine.json. The built header has the form // js-imagediff X.Y.Z. The README has a Changelog section.

Nits (not blocking):

• Step 6 uses git commit -am, which also picks up the package-lock.json version bump that npm version makes. That's what we want, so this is fine as written. It could be named explicitly if you prefer.

I didn't use the dev container. The change is prose only, and nothing in it is built or tested.

[hsd-bot]

hsd: ready for human review after 1 review round(s). Agent sessions are still live in tmux -L hsd-js-imagediff attach -t issue-119-docs-record-the-maintainer-release.

[hsd-bot]

hsd: Replaced the Releasing section with the maintainer's 2.0.0 release script, kept nearly verbatim and generalized to X.Y.Z. The change is amended into the single commit.

[hsd-bot]

hsd review round 2

Approved. This round replaces "Releasing" with the maintainer's 2.0.0 release script, generalized to X.Y.Z and amended into the single commit. Round 1 had nothing blocking, and this version still does everything issue #119 asks:

• The opening paragraph says the maintainer cuts releases by hand from main, signed, and that agents and ordinary PRs don't bump the version, rebuild, tag or publish.
• Each step is a runnable block with what to check before moving on, so it reads top to bottom.
• Both lessons from 2.0.0 are in: step 3 says to bump the version before building (because of the header stamp and VersionSpec), and step 8 covers npm 2FA through npm login with "Authorization and writes" instead of a saved token.
• The round 1 nit is resolved: step 3 names package-lock.json explicitly, and so does the git status check in step 6.

I checked the new specifics against the repo:

• .nvmrc exists (24).
• In step 5, the expected npm pack contents match the files field in package.json plus the files npm always includes (package.json, README.md and LICENSE).
• I ran the step 5 awk notes extraction against ### 2.0.0 in the README. It gives exactly the 2.0.0 changelog body and stops at ### 1.0.8.
• In step 7, .github/workflows/test.yml runs on push, so pushing to main triggers CI, and gh run list --commit is a valid flag.
• Step 9 pushes the tag before gh release create --verify-tag, which needs the tag to be on the remote.

Nits (not blocking):

• Step 7's protected-main path says to "confirm that vX.Y.Z points at your commit". At that point the tag is still local only, so this is a check that the merge commit has your signed commit as a parent. It's correct, but it could be worded that way.
• Step 11, closing the resolved issues, goes slightly beyond the issue's source list. It comes from the maintainer's own script, so I'd keep it.

I didn't use the dev container. The change is prose only, and the one command I ran (awk on the README) isn't project tooling.

[hsd-bot]

hsd: ready for human review after 1 review round(s). Agent sessions are still live in tmux -L hsd-js-imagediff attach -t issue-119-docs-record-the-maintainer-release.