Marketplace Readiness
Review Criteria
Future marketplace review should make extension behavior predictable before a package reaches operators. These criteria are preparation guidance only. MyronCMS does not currently run a marketplace review workflow.
Human Path
A future reviewer should evaluate a package in these areas:
- Package identity and namespace.
- Manifest and scope declaration.
- Action metadata and API/MCP exposure.
- Storage and migration isolation.
- Admin route isolation.
- MIC resolver or mail transport descriptors, when present.
- AI-native documentation completeness.
- Security posture and unsupported-surface avoidance.
AI Path
An AI coding agent can review local files against this checklist and report gaps. It can inspect source files, compare metadata, and run local verification commands.
An installed MCP client cannot approve a marketplace submission, grant package trust, or install a reviewed package. Future marketplace review remains a parity gap for installed runtime AI until a later contract defines it.
Criteria
| Area | Required posture |
|---|---|
| Identity | Vendor is snake_case, stable, and matches the normalized package directory. |
| Namespace | API URIs stay under /api/v1/x/{vendor}/; action domains stay under x.{vendor}.. |
| Manifest | Uses current supported fields and declares base extension scopes honestly. |
| Scope grants | Does not assume operator grants; docs explain the extension grant gate and caller scope gate separately. |
| Actions | Metadata includes schemas, required scope, side effects, preconditions, postconditions, and accurate MCP exposure. |
| MCP exposure | exposeToMcp:false has a policy reason; exposeToMcp:true still depends on caller scope. |
| Storage | SQL migrations touch only {vendor}_* tables. |
| Admin routes | Route keys and paths stay isolated under the extension route boundary. |
| MIC resolvers | Descriptors use x.{vendor}.{slug} and safe bank surface settings. |
| Mail transports | Descriptors name setup scopes and do not hard-code secrets. |
| Documentation | Every workflow names a human path, AI path or parity gap, scopes, artifacts, verification, and failure modes. |
| Security | Package does not claim signing, sandboxing, dependency resolution, or install automation unless future runtime support exists. |
AI-Native Documentation Gate
A future marketplace submission should not pass review if its docs imply AI support without naming the route.
Acceptable AI access wording:
- MCP tool with discovery and scope notes.
- MCP resource with URI and MIME type.
- Direct API action hidden from MCP with reason.
- Local-authoring path for repository file work.
- Human-admin-only path for trust-gate workflows.
- Parity gap with blocker, risk, and future contract question.
Scopes
This policy page requires no runtime scope to read.
Review must confirm:
- manifest scopes are limited to base extension scopes,
- action
requiredScopevalues match behavior, - operator grants and caller scopes are documented as separate gates,
- AI clients are not told to self-grant or self-rescope.
Artifacts
Reviewable current artifacts include:
manifest.jsonbootstrap.php- action classes
- migration files
- admin route files
- MIC resolver classes
- mail transport classes
- extension README or docs
Future marketplace review records are not implemented.
Safety Boundary
Do not turn these review criteria into an enforcement claim. They are documentation policy until a later marketplace workflow implements submission, review, approval, installation, and audit records.
Reject or defer any package that depends on prohibited-current extension behavior, including public render hooks, design token group registration, snapshot contribution, core rail injection, core table mutation, signing, sandboxing, or dependency resolution.
Verification
For current local verification:
php app/tests/verify-extension-system-foundation.phpAdditional domain-specific verification depends on the extension type. For docs review, confirm that every page follows the AI-native documentation contract.
Failure Modes
| Failure | Likely cause | Safe response |
|---|---|---|
| Review criteria claim current marketplace approval | Future policy was overstated. | Reword as future/prep. |
| Package docs say "AI can manage this" with no route | AI parity was implied. | Add MCP/API/local-authoring path or mark a parity gap. |
| Extension action lacks schemas or scope | Action metadata is incomplete. | Fix metadata before review. |
| Migration mutates a core table | Storage isolation violation. | Move data into {vendor}_* tables or evaluate a core feature. |
| Package requires a public render hook | Unsupported extension surface. | Defer until a new platform contract exists. |