The challenge application, Canonically Yours, generates read-only compatibility reports from signed package manifests.
Each registered user receives a private namespace. The server is expected to approve manifests only when the requested package belongs to that namespace.
I found an interpretation conflict between the manifest approval and publication stages. A JSON manifest containing two top-level package members is authorized using the first member but published using the second member.