Design the public API surface — the contract that consumers will depend on. This is load-bearing work because once published, changing the public surface breaks every consumer. Decisions here set the semver policy and dictate how painful every future release will be.

Decompose the intent into verifiable units. Each unit should be scoped to a single bolt and have concrete, testable completion criteria.

Understand the problem this library solves, who consumes it, and what the competitive landscape looks like in this ecosystem. Libraries live or die by adoption — establish who will use it, why they'd pick it over alternatives, and what consumer experience the library needs to deliver.

Implement the library to match the API surface exactly. Write code AND the tests that prove the contract holds. Public behavior is load-bearing — if the implementation doesn't match the documented surface, consumers will break when they upgrade.

Plan how to implement the library against the API surface defined in inception. Sequence the work so public-facing primitives are built first (they're the hardest to change later) and internal implementation follows.

Review the implementation against the API surface and the completion criteria. The reviewer catches contract drift — places where the code "works" but doesn't match what was promised in inception.

Evaluate the library against the threat model and determine whether findings are resolved, mitigated, or accepted with documented justification.

Model threats specific to this library: supply chain risks, misuse by consumers, injection surfaces, and the downstream impact of vulnerabilities in library code. Library threat modeling differs from app threat modeling because the library is a *source* of risk for downstream applications, not a direct victim.

Update the library's public documentation to reflect the release: API reference, migration guides for breaking changes, and consumer guidance surfaced from the security review.

Publish the library to its target registry with a correct semver version, a complete changelog, and operational release metadata (tags, signed artifacts, provenance). Publishing is one-shot — once a version is out, it's out. Get it right before hitting publish.