Catalog sources and every catalog download_url must be plain HTTPS URLs on the single approved host, checked before any connection is opened and again on the snapshot entry before an install fetch. Catalog fetches use an opener that refuses redirects; LUT downloads request without redirect following and treat any 3xx as an error. Foreign catalogs are deliberately unsupported; local LUT files go straight into the LUT folder. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>