Package registries must be designed for automated actors, not humans.

Package registries must be designed for automated actors, not humans. The RubyGems agent incident shows autonomous clients can probe, publish, and adapt at machine speed, turning simple publish APIs into attack surfaces. Treat registries and internal artifact feeds as programmable endpoints: enforce machine-oriented identity, non-human rate limits, provenance metadata, and a fast kill-switch for suspicious clients. Make those controls part of the registry contract rather than an afterthought.