Distribution review
Private source is not public distribution.
Select a runtime to inspect its current source, artifact, verification, and rollback state. No public bundle is offered until its byte count, SHA-256, provenance, and signature state are recorded.
Runtime compiler
The same package, distributed honestly.
Each plan is derived from the package manifest. Every path remains review-only until a public artifact exists, then remains promotion-blocked until the adapter is exercised in the chosen host and its positive and refusal fixtures pass.
Choose a host-specific path
Codex: native
Codex adapter source exists in the private release repository. No public archive or marketplace source is distributed yet; this path is review-only.
- Public artifact
- not distributed
- Self-service path
- review only
- Host verified
- no
- Remote published
- no
- Promotion ready
- no
Distribution review
- Review the declared Codex marketplace and Agent Skill contract on the public package page.
- Wait for a public archive URL, byte count, SHA-256 digest, and signature state; do not treat the private repository as a self-service source.
- After publication, pin the verified artifact, validate the plugin, and run the positive and refusal fixtures before promotion.
Verification gate
- Manifest version and source match the reviewed package
- No secret, private memory, or customer data is bundled
- Positive fixture produces every required evidence-draft field
- Refusal fixture stops external publish and credential actions
- Human operator records the promotion or rollback decision
Rollback
- Disable or uninstall the adapter in the target runtime.
- Restore the prior pinned package version if one existed.
- Retain the failed evidence draft and exception note; remove any temporary source packet.
The canonical preview archive is still being built and verified. No download is offered until the digest and byte count are generated from this repository state.