Tool Maturity Model

Use this guide to prepare your marketplace tool for Verified status, request a review, and understand the checks that keep the badge active.

Overview

Every marketplace tool starts as Unverified and completes automated validation. A Verified tool has also passed a human review, displays a checkmark badge, and is sorted to the top of the marketplace.

Request Verification

After your tool is available in the marketplace:

1. Open My Tools.
2. Find the Unverified tool you own and select Get Verified.
3. Look for the confirmation email. It confirms that your request is queued and states the 1–2 week review SLA.
4. Wait for the approval or rejection email. Reviews are handled in submission order and do not include a back-and-forth stage with the reviewer.

Before requesting verification, publish and test the version you want reviewed. Run pptb-validate and resolve every validation error first. Verification is a separate human review performed after the normal publishing and marketplace submission process.

Reviewer Checklist

All Required items must pass. Optional items are recorded to help improve quality, but they do not determine approval.

Documentation

• Required — README quality: Show the tool UI with a screenshot or GIF, explain what the tool does, and provide installation and run instructions. A new user should be able to get started without asking for missing steps.
• Required — CSP exceptions documented: For every cspExceptions entry, explain why the tool must connect to that external domain. Remove exceptions that the tool does not need. See CSP Configuration.

Code & Security

• Required — No critical or high CVEs: Run npm audit against the dependency tree and resolve every critical or high-severity vulnerability before requesting review.
• Required — No deprecated PPTB APIs or unsupported methods: Do not call removed or unsupported APIs. Deprecated API use is flagged. It is a soft gate rather than an automatic blocker when an active migration is demonstrably in progress.

UI & Experience

• Required — Reacts to the PPTB app theme: Support both light and dark mode without requiring manual configuration, and keep the interface legible in each theme.
• Required — Has an icon: Bundle a valid SVG under dist and reference it with the top-level icon field. HTTP or HTTPS icon URLs are not accepted. See the Package Manifest.
• Optional — Basic colour contrast: Check text and interactive controls in both themes. This is not a strict WCAG audit, but obvious contrast failures are recorded.
• Optional — No console errors on load: Open the browser console during initial tool load and resolve errors. Warnings are acceptable, and console errors are not a hard blocker.

Versioning

• Required — Version 1.0.0 or greater: Publish version 1.0.0 or later to signal that the tool is ready for production use.

Maintenance & Ownership

• Required — Healthy bug response: Reviewers assess open bug reports using the thresholds below. The 10-day and 30-day clocks measure time from issue creation to the first maintainer response, not time to close.

Result	What the reviewer checks
Pass	Fewer than 5 open bugs, with a maintainer response to every bug within 10 days.
Flag	5 or more open bugs, or any bug has gone more than 10 days without a maintainer response. The reviewer uses judgment.
Blocker	Any bug has gone more than 30 days without a maintainer response.

• Required — Active contributor: Name at least one reachable contributor who is accountable for the tool and has been recently active through commits or issue responses.
• Required — Up to date with breaking changes: Show that the tool has been updated for breaking dependency and PPTB API changes.

Usage & Trust Signals

• Required — Meets 2 of 3 usage metrics: The tool must meet any two thresholds in the following table.

Metric	Threshold	What it demonstrates
Monthly active users (MAU)	10 or more	Ongoing use, with a low threshold that does not unduly penalise newer tools.
Total downloads	50 or more	Cumulative adoption; considered with MAU so inactive downloads do not stand alone.
Reviews	At least 1 rated 3 or above	A real user has provided a positive-enough trust signal.

Review Outcome

The review ends with a single approval or rejection decision:

• Approved: PPTB grants the Verified badge, displays the checkmark, and sorts the tool to the top of the marketplace.
• Rejected: The email lists every failed required criterion. You can correct the issues and submit another request immediately; the new request receives a full review.

Optional findings may be included, but they do not cause rejection.

Keeping the Badge

PPTB runs nightly automated governance checks on Verified tools. The following triggers are currently active:

Trigger	Badge impact	What you need to do
Critical or high CVE detected	Removed immediately	Resolve the vulnerable dependency, publish an updated tool, and request full re-verification. PPTB emails you when the badge is removed.
New CSP exception added	Removed immediately	Ensure the new exception is necessary and documented, then request full re-verification. PPTB emails you when the badge is removed.
Bug health threshold breached	2-week grace period	Address the bug-health breach during the grace period. The badge remains in place for two weeks and is removed if the breach is unresolved.
PPTB API breaking change not addressed	2 weeks after release	Update and publish the tool for the breaking change. PPTB announces deprecations two weeks before release, emails again at release, and removes the badge if the tool is still unresolved two weeks after release.

Reinstatement

Every route back to Verified requires the same full review. There is no shortcut or lighter re-verification track, and the tool appears as Unverified while re-verification is in progress.

Next Steps