Description
Marketplace SDK Plugin Distribution makes a code-bearing Dots SDK plugin a first-class Marketplace listing type. A developer packages the plugin with the supported manifest, publishes it through the normal seller workflow, and receives the stricter tier-C treatment appropriate for executable behavior. Every SDK plugin submission enters the human review queue; it is never auto-published solely because a seller is verified or the optional review model reports no issue.
After publication and purchase, the Dots install consumer retrieves the entitlement-gated plugin envelope and registers it through the production plugin loader under code-execution controls. Publish-time validation and install-time capability acceptance are kept in parity: the Marketplace must not accept a slot that the downstream loader cannot register. The supported set covers declarative distributable slots plus the explicitly installable tenant-scoped behavior slot while refusing operator-scoped and not-yet-installable code surfaces.
Selling Points
- Gives external developers a commerce and discovery channel for executable Dots extensions.
- Applies mandatory human review to every code-bearing submission.
- Preserves publish-to-install capability parity instead of accepting unusable plugins.
- Uses normal purchase and entitlement controls before code delivery.
- Registers installed code through the platform’s code-execution boundary rather than raw file placement.
User Story
A developer builds a plugin that contributes a supported Dots behavior, packages it with the canonical manifest, and creates an SDK plugin listing. Submission is classified tier C and appears in the operator review queue. Once approved and purchased, a buyer installs it from the in-app Marketplace. The gateway serves the authorized version, and the local orchestrator registers the plugin with a grant derived from the same manifest the publish gate validated.
Extension Surface
The capability is pluggable by definition: it is the Marketplace distribution path for executable SDK extensions. The accepted manifest vocabulary starts in packages/marketplace-client/src/schemas/manifest.ts, while apps/marketplace/src/services/listing-publish-service.ts admits the sdk_plugin type and the review pipeline assigns its risk. Pluggability is deliberately bounded to loader-supported slots and derived grants; listing code cannot claim operator authority or unsupported extension points.
Capabilities & Limits
SDK plugin distribution can validate and version a plugin manifest, store its payload, require human review, sell and entitlement-gate it, deliver the exact version envelope, and support in-app registration. Review reports preserve deterministic and optional model evidence around the executable submission.
It cannot auto-publish tier-C code, install unsupported slots, or use the standalone file installer. Operator-scoped slots and tenant code slots without an install loader remain rejected. A purchased plugin still runs under the platform’s code-execution and grant boundaries rather than receiving ambient authority.
Implementation Map
packages/marketplace-client/src/schemas/manifest.tsapps/marketplace/src/services/listing-publish-service.tsapps/marketplace/src/services/submission-scan.tsapps/marketplace/src/services/admin-review-service.tsapps/marketplace/src/routes/install-gateway.ts