Build the missing action.

Start with the real SDK

Packs use .NET 10 and reference PowerTrove.Abstractions. The public source includes the action contracts and illustrative manifest files. General third-party runtime loading is outside the first alpha.

The new public repository is being prepared. These instructions refer to its main branch and become usable after the first source release.

git clone https://github.com/fgrzesiak/powertrove.git
cd powertrove

A small, explicit contract

• Implement actions and a pack factory against the SDK; keep stable, namespaced IDs.
• Describe input kinds, selection constraints, preview behavior, parameters and required capabilities.
• Keep file engines behind ports. Do not couple a pack to the desktop UI.
• Worker protocol v1 accepts file selections. Validate host version, Windows architecture and dependencies.
• Use a v2 manifest with the payload inventory and SHA-256 hashes. Treat permissions as declarations; current workers do not provide an untrusted-code permission sandbox.

Prepare for curated review

Prepare a pinned source commit, package ID and version, license and dependency information, supported platforms, requested capabilities, test results and a changelog. Keep examples and screenshots free of personal information.

The publisher portal prepares immutable candidates and can send artifacts into a separately configured private quarantine. Submitted bytes will never be served as trusted artifacts. Review, isolated build checks and a protected approval process must precede signing.

Publishing is a separate trust boundary

The web backend will not hold the production plugin signing key. A protected publisher will independently verify approved source, build provenance and immutable hashes before signing exact output bytes.

The existing release builder executes pack factories while extracting metadata. It must not execute untrusted code in the presence of signing credentials. Building and metadata extraction must remain isolated from the final signing process.

A future verified publisher badge will describe checked identity, not a promise that a plugin is harmless.