1. Start from official history
The API constructs only the fixed official Registry history route from a namespace/name. It does not accept an arbitrary fetch URL or treat the submitted name as a network destination.
2. Prioritize material declarations
Package identity and remote-origin changes rank above title or description edits. Severity orders review effort; it does not label a release malicious.
3. Keep secret values out
The report compares required declarations and fingerprints argument shape. Values declared as secrets never appear in the response, share link or H/M metrics.
4. Preserve reproducible evidence
An unsigned SHA-256 receipt binds the selected versions, normalized fingerprints and change ledger. It can detect changed exported JSON but is not a signature or issuer authentication.
5. Separate metadata from runtime
The gate does not fetch artifacts, execute packages, reverify ownership or observe runtime conduct. It is a release review gate, not a security certification.
Frequently asked questions
H/M Blindspot · hogarmas.net
Does Release Gate install or run the server?
No. It reads only public metadata from official Registry version history.
Does no observable change mean an update is safe?
No. It means only that covered normalized fields match; artifacts and runtime behavior remain outside scope.
Does H/M store the queried name or versions?
Not in product metrics. Only fixed aggregate funnel event IDs are recorded.