FinePrint: Release Integrity Checker

FINEPRINT — PROBLEM & SOLUTION STATEMENT. THE PROBLEM: Every release depends on developers accurately describing what changed. In practice, they often don't — not out of malice, but because commit messages are written quickly, under time pressure, and rarely double-checked against the actual diff. A commit labeled "small tweak" can quietly change a token format. A "patch" release can secretly contain a breaking API change. A dependency bump can jump a major version with no mention in the message at all. This is a documented, measured problem: an industry survey of 300 mobile engineers found teams spend around five hours per release on low-value manual verification, roughly 130 wasted engineering hours per developer annually, with over three-quarters of teams reporting incidents needing hotfixes every three to five releases. Academic research (ARENA, UT Dallas/University of Sannio) found manually writing accurate release notes can take up to eight hours. A real open-source maintainer (XWiki) logged two hours to a full day per release just on this task. Existing tools — GitHub's auto-generated notes, Release Drafter, semantic-release — only summarize what commit messages say; none of them check whether those messages are telling the truth about the actual code change. They trust the label; they never read the diff. THE SOLUTION: FinePrint reads the real diff between two release tags — not the commit messages describing it — and checks whether the message accurately represents what actually happened in the code. It runs three deterministic checks per commit. First, diff-vs-message mismatch: does the commit's message name the areas of the codebase it actually touched? If a commit changes files in an area never mentioned in its message, FinePrint flags it and shows exactly which unclaimed files changed. Second, semver violation: does a patch or minor version bump secretly contain a breaking change? Third, dependency bump: did any dependency jump a major version, regardless of what the message says? Results render as a single-glance "receipt" — a monospace, itemized list styled like a real paper receipt, with a health bar showing routine versus flagged commits at a glance, and tap-to-expand evidence, the actual code diff, for every flagged item, so nothing is asserted without proof. FinePrint is a zero-install web app: paste any public GitHub repo URL and two tags, get a receipt. It runs entirely client-side against GitHub's public API, with no backend, no account, and no secrets. Validated on two real cases: it correctly flagged a deliberately undisclosed change in our own test repository, showing the exact unclaimed diff as evidence, and ran cleanly against a real FasterXML/jackson-databind release with zero false positives, correctly ignoring routine, mechanically-generated commits such as release-plugin bumps and merge commits that would otherwise create noise. The result: a release-readiness check that catches what commit-message-based tools structurally cannot see, in the time it takes to paste a URL.