Skip to main content

​
Paths available today

  • T0 data-only profile, action, icon and sound packs use the Market/moderation flow.
  • The CLI and SDK are available self-serve on npm: a project is created with npx @evoxapp/plugin-cli init (Quickstart).
  • T1 plugins can be loaded with explicit trust and run from the Plugins → Developer window.
  • T2 browser Worker sources can be tested with the SDK, the evox-plugin run preview and evox-plugin sandbox-test (a static pre-publication sandbox compatibility check: Node/DOM/direct network scan). The real sandbox boundary is the host-owned Electron Chromium Worker.

​
Public executable plugin gate

Public executable metadata and multipart upload are currently closed:
The gate is reconsidered only when all of the following are verified under production conditions:
  1. Dynamic executable scanning.
  2. Malware and dependency vulnerability intelligence.
  3. Production approval signing and trust-root rotation.
  4. Signed revocation feed/cache freshness and replay protection.
  5. Private quarantine and immutable canonical byte binding.
  6. Desktop Market signed installer/update/rollback wiring.
  7. Real sandbox/resource and deployment checks.
A static scan, a local sandbox smoke or a working T1 example is not public-ready on its own. Do not bypass the 503 gate with a client fallback, a metadata-only upload or a generic worker “passed” result.

​
T1R gate

Uploads of reviewed full-access plugins (T1R) depend on a gate separate from T2’s; opening one does not open the other. Today it is closed:
The pieces that are ready:
  • The CLI turns a trusted-node project into a package fit for review (evox-plugin pack) and checks the declarations with evox-plugin publish-check.
  • The server redoes the static scan and the declaration analysis itself; the malware and dependency check is required.
  • A moderator reviews the source, the declarations and the diff against the previously approved version.
  • The desktop app verifies the signed T1R release, asks for full-access consent and keeps the plugin off until the user turns it on.
  • The web Market shows the plugin with a “Full access” label; the Publish form lists the T1R requirements.
The gate opens after the signing, revocation and intelligence chain is verified in production and a real install and revocation run succeeds on Linux.
T1R is not a sandbox. Even after the gate opens, the plugin runs with the rights of the user’s account; the review does not change that. Details: Trust tiers.
T3 EXE/DLL/driver is not self-service and requires a special Wraith security/release review.