Publish flow

Publishing adds a versioned row to the public catalog. Browsing and install metadata are anonymous; writes require Auth0.

Steps

1. Build the module and package every manifest-declared runtime path in a ZIP.
2. Validate: POST /v1/extensions/validate (no auth).
3. Sign in on glixo.dev (Auth0 PKCE).
4. Select one tested ZIP for every manifest artifact RID, then sign and publish from the dashboard.

The dashboard computes every SHA-256 and uploads those exact bytes. It creates a non-exportable Ed25519 key in the browser, persists the CryptoKey in IndexedDB, registers only the public key, and signs the canonical release payload. Direct API clients must register their own key through POST /v1/me/keys and use canonicalization version 1. The separate git catalog pipeline is for maintainers publishing reviewed catalog products in bulk.

Versioning rules

• Each id@version is immutable on stable/beta channels.
• Use dev or canary channels for iterative testing.
• Bump version and artifact hash for every release.

Source repository (Agxos apps)

Public marketplace listings for Agxos apps require a public git URL in the manifest so anyone can inspect and fork the code.

"sourceRepository": {
  "url": "https://github.com/you/my-agxos-app",
  "directory": "."
}

• Public — clone and browse without login (no private repos, no gist-only drops).
• HTTPS — standard host URLs; SSH-only repos are not accepted for listing.
• Matches the artifact — the tagged commit or default branch should contain the published version and artifact inputs.
• License — include SPDX license in the manifest; source must match what you ship.

Why: marketplace apps are installable binaries. A public repo is the trust and fork surface — users verify what runs, contributors open PRs, and App Creator can fork from your repo instead of an opaque zip.

Enforcement: policy is active for new Agxos listings; API validation will reject publishes without sourceRepository in a follow-up release. Local-only catalog sources and private workspace apps do not need this field.

Community modules can point at a subdirectory in the shared GitHub repository:

"sourceRepository": {
  "url": "https://github.com/tmedanovic/glixo-community-modules",
  "directory": "examples/agxos/apps/incident-notes"
}

Field reference: Manifests → sourceRepository. Iterating on a fork: Extend an existing app.

Dashboard publish

glixo.dev → Publish accepts the manifest and matching ZIPs on the same screen. Select one tested package for every RID in artifacts[]; the portal hashes and signs the complete platform-specific artifact set.

API validate example

curl -X POST https://api.glixo.dev/v1/extensions/validate \
  -H "content-type: application/json" \
  --data-binary @glixo.module.json