Choose trust tiers
Compare the T0, T1 and T2 boundaries.
Run the first T1 example
Verify the counter example with a process and a mock host.
Prepare a project with the CLI
Validate the project, produce a browser bundle and package it.
Define the manifest
Declare runtime, compatibility, permission and action fields.
Publish the pack
Prepare the pack, upload it and submit it to Market moderation.
Read the distribution status
See the boundary between local development and public readiness.
Core contract
- T1 is not a sandbox. It provides separate Node process lifecycle/crash isolation but may have the OS access of the user account.
- T2 is default-deny. The host-owned sandboxed Chromium Worker uses only declared ∩ granted capability calls.
- The public SDK provides no raw secret getter.
- A direct network, filesystem or process fallback does not count as T2 compatibility.
- Public executable upload/install stays closed until the production chain is complete.