Compare two release-metadata snapshots and see exactly what changed, what is missing, and what would block a delivery — before you send it anywhere.
Load one of the two built-in examples, or drop your own two CSVs.
The entire audit engine is embedded in index.html and runs in your browser.
It contains no network code at all — no fetch, no XMLHttpRequest, no
WebSocket, no EventSource, no sendBeacon, no dynamic import(). The build
script refuses to emit a page that contains any of them.
You can save index.html, disconnect from the internet, and open it from your
own disk. That was tested, not assumed: in headless Chrome on a file:// URL,
isSecureContext is true, WebCrypto is available, and the engine produces a
report.
- Validates identifiers and required fields — ISRC shape, EAN-13/UPC-A check digits, missing required columns, duplicate identities, conflicting release information.
- Matches records conservatively — by
record_id, then ISRC, then configured position. When the evidence is ambiguous it refuses to guess and says so, rather than pairing the wrong two rows. - Sorts changes by review priority — and distinguishes a real value change
from a formatting-only one. An ISRC that gained hyphens, or a title that
differs only in Unicode normalisation, is
info, not a red flag. - Says which file a problem came from —
beforeorafter, so two files with the same defect are never indistinguishable. - Produces a deterministic report — the same inputs give byte-identical JSON every time, which is what makes it auditable.
This page embeds the engine built from commit d454b13. The reports it produces
are byte-for-byte identical to the ones the CLI writes for the same inputs at
that commit — same SHA-256, same exit codes. Not "equivalent output": the same
bytes.
Development has continued since. The report format has changed — findings now
carry per-file row evidence (evidence: RowEvidence[]) instead of a single
input and rows pair, and the both role was dropped. This page is therefore
a fixed, self-consistent snapshot, not a preview of the current format. It will
be rebuilt once the newer work has been independently reviewed.
ReleaseDiff has not been released. @notgabriels/releasediff is not on npm,
there is no tagged release, and nothing here is for sale. This page is a
preview of the audit engine, published so the tool can be judged before it
ships.
The example files use invented labels, artists and catalogue numbers, and ISRCs
in the unallocated ZZ prefix. They are not real releases.
ReleaseDiff compares two local metadata snapshots, validates common identifiers and required fields, highlights exact changes by review priority, and produces an auditable report without uploading the files.
ReleaseDiff checks only the data you provide. It does not verify rights, identifier ownership, distributor acceptance, or publication on any external platform.
MIT. The embedded engine bundles csv-parse
and lossless-json, both MIT;
their notices are reproduced in THIRD-PARTY-NOTICES.md
and in the engine's own licence header inside index.html.
github.com/notgabriels-sys/deadwax — the ReleaseDiff source, MIT licensed. Every check, the matching rules and the test suite are readable there.
src/ in this repo holds the page template and the build script that inlines the engine
into a single file.