Apps, manifests and registries

An app is defined by its manifest, cloudoak.app.json: its id (reverse-DNS, such as com.example.notes), name and version, where the node may send users back after sign-in, the scopes it asks users to approve, and the tables, collections, vector indexes and buckets it stores, each with its permissions. The manifest schema describes the file.

You sign it with your publisher key, on your own machine, with the cloudoak CLI. Nobody else holds that key: not the registry, and not the developer portal.

You publish it to a registry. A registry is a catalogue of signed app definitions. It never holds a user, a credential or any app data. The central Cloudoak registry is the default source every node reads; a node’s owner can name others, or none and install from files. Publishing to the central registry opens at its public launch. The registry protocol is the full contract.

A node’s owner enables the app. The node copies the catalogue, checks every signature against the registry’s root key (compiled into every node), and installs only what verifies.

A new version is checked against the one before it. Additive changes apply on their own. A rename or a removal is a listed migration step from a fixed set, with no SQL, and the node’s owner approves it.

The developer portal, https://developer.cloudoak.io, is where you link your publisher key, see your apps and their review, and build a manifest without writing the file by hand.