Marketplace Readiness
Marketplace Status And Roadmap
Marketplace Readiness is future/prep documentation. It explains the review posture and package expectations MyronCMS should eventually need, but it does not make marketplace browse, install, signing, sandboxing, or dependency resolution available today.
Extension v1 is a local SDK. Developers place extension files under app/extensions/{vendor}/, and an operator registers and grants scopes through the Extensions admin surfaces.
Current Status
| Surface | Current posture |
|---|---|
| Local extension package | Stable current under app/extensions/{vendor}/. |
| Extension registration and grants | Stable current through /extensions/register and /extensions. |
| Marketplace browse UI | Future planned; the current admin control is disabled. |
| Marketplace install | Future planned; no runtime installer exists. |
| Package signing | Prohibited current; no signing contract exists. |
| Sandbox isolation | Prohibited current; no sandbox contract exists. |
| Dependency resolution | Prohibited current; extensions cannot rely on package dependency resolution. |
Human Path
A future contributor should treat this section as readiness guidance:
- Build against the current local extension SDK first.
- Keep the package inside the vendor namespace.
- Document scopes, actions, migrations, admin routes, MIC resolvers, and mail transports honestly.
- Classify any marketplace-specific behavior as future planned unless a later runtime contract implements it.
- Route any proposal for marketplace install or trust automation through a new MCD cycle.
AI Path
An AI coding agent can read this roadmap and author local extension files in the repository. It can also help prepare a future package proposal document.
An installed MCP client cannot browse a marketplace, install an extension, sign a package, sandbox code, resolve dependencies, or grant extension trust. That is the current parity gap. If an AI client needs marketplace runtime access, the correct answer is a future platform evaluation, not an invented tool route.
Scopes
This roadmap requires no runtime scope to read.
Current extension runtime work still uses the existing scope gates:
- operator extension grants from the admin UI,
- action
requiredScope, - caller scopes for API and MCP access.
No marketplace scope model exists yet.
Artifacts
Current artifacts:
app/extensions/{vendor}/app/extensions/{vendor}/manifest.jsonapp/extensions/{vendor}/bootstrap.php/extensions/register/extensions
Future marketplace artifacts are not implemented. Any future package index, package envelope, review record, signing record, or install ledger needs a later contract.
Safety Boundary
Do not use marketplace wording to bypass the local SDK boundary. The current platform does not support marketplace install mechanics. A future marketplace should be built only after the package shape, review criteria, compatibility declaration, and security posture are contracted as runtime behavior.
Verification
Current verification is documentary:
- The page states marketplace browse and install are future planned.
- The page does not include runnable install instructions.
- The page points contributors back to local extension authoring.
- The page does not claim signing, sandboxing, dependency resolution, public publication flow, or core rail injection.
Runtime source verification:
/extensions/registerpresents local extension registration.- The marketplace browse button is disabled.
Failure Modes
| Failure | Likely cause | Safe response |
|---|---|---|
| A contributor expects a marketplace install button to work | Future/planned status was missed. | Use local extension installation and operator registration. |
| An AI client asks for a marketplace install tool | Installed MCP parity does not exist. | Mark the request as a parity gap and route through Evaluate. |
| Docs describe package signing as available | Future security posture was overstated. | Change wording to prohibited-current or future-planned. |
| A package proposal depends on dependency resolution | Current extension v1 does not resolve dependencies. | Remove the dependency assumption or start a new platform contract. |