Signed catalogs and release sources

A signed catalog identifies immutable plugin release bytes and their compatibility. Installation verifies trusted metadata and artifacts before staging or activation.

How it works

Publishing a descriptor is separate from publishing an installable package. An operator reviews requested permissions, setup requirements and trust before installation. Revoked, expired, or mismatched artifacts do not gain authority from discovery.

Complete contract

Read the Skulk™ 2.0 development guide for the complete parameters, constraints, examples and operational behavior.