Skip to main content

​
Paths available today

  • T0 data-only profile, action, icon and sound packs use the Market/moderation flow.
  • The CLI and SDK are available self-serve on npm: a project is created with npx @evoxapp/plugin-cli init (Quickstart).
  • T1 plugins can be loaded with explicit trust and run from the Plugins → Developer window.
  • T2 browser Worker sources can be tested with the SDK, the evox-plugin run preview and evox-plugin sandbox-test (a static pre-publication sandbox compatibility check: Node/DOM/direct network scan). The real sandbox boundary is the host-owned Electron Chromium Worker.

​
Public executable plugin gate

Public executable metadata and multipart upload are currently closed:
The gate is reconsidered only when all of the following are verified under production conditions:
  1. Dynamic executable scanning.
  2. Malware and dependency vulnerability intelligence.
  3. Production approval signing and trust-root rotation.
  4. Signed revocation feed/cache freshness and replay protection.
  5. Private quarantine and immutable canonical byte binding.
  6. Desktop Market signed installer/update/rollback wiring.
  7. Real sandbox/resource and deployment checks.
A static scan, a local sandbox smoke or a working T1 example is not public-ready on its own. Do not bypass the 503 gate with a client fallback, a metadata-only upload or a generic worker “passed” result.
T3 EXE/DLL/driver is not self-service and requires a special Wraith security/release review.