// Quality
How the catalog checks a module.
Official, Community, Third-party say who made a module. Official: made by the Open Mercato team. Community: made by Open Mercato team members and certified partners. Third-party: made by other authors.
Works on latest means the catalog added the module to a new Open Mercato 0.9.0 app by the nightly run and every check passed. Not working on latest means the last test failed. The data and the README badge call the first one Verified; a module that only passed the listing checks is Listed.
OM Quality is a review by two people of the core team, for one published version, valid 12 months. No module has it yet. Be the first: request a review.
A test is a compatibility signal, not a security review. Just looking for a module? Browse modules.
Full rules for maintainers The levels, every rule with its code, the measured signals, the OM Quality checklist and what a level does not mean.
- Listed
The descriptor, the package, its kind and its license pass the checks. Read from the published code.
- Verified · 0.9
Installed in a fresh Open Mercato 0.9.0 app by the nightly run, per version, granted and lost automatically.
- OM Qualityper tarball · 12 months
A core team reviewer and a second approver checked one published tarball against the checklist. Valid 12 months.
// Listed · machine · all rules required
Listed
| Rule | Check |
|---|---|
LST-1 | The descriptor is valid: schema, path, category and texts. |
LST-2 | The package exists, has a stable version (official: a preview is enough) and is not deprecated. |
LST-3 | The tarball confirms the kind: a module has the src/modules and dist/modules pair. |
LST-4 | The license is detected or shown as unknown. Always passes, always visible. |
LST-5 | No known malware and no open critical advisory. |
LST-6 | The name is not a typo of an existing one. Checked in the pull request. |
An entry on hold or delisted is not listed and has no level.
// Verified · machine · per version · on the latest line
Verified
| Rule | Check |
|---|---|
VER-1 | A verified receipt on the latest line, at most 14 days old, with a green baseline, for the newest installable stable version. |
VER-2 | Fits statically on the latest line: ok or drift. |
VER-3 | Supply chain: ok. |
VER-4 | Hygiene: no lint rule of weight error. |
VER-5 | Source integrity: the tarball repository is the listed repository, and a package that names no repository does not pass; GitHub-only entries are tested on a pinned tag. |
Lost when latest is confirmed broken (two red nights in a row with a green baseline), when the receipt is older than 14 days, or when VER-3 to VER-5 break. A failed test app or a run that did not finish never takes it away. A new release in the Yarn age gate does not take it away either: the recommended version keeps it. Provenance is not required. Built-in and enterprise modules have no level.
Installed in a fresh Open Mercato 0.9.0 app: scaffold, install, add, generate, typecheck, initialize, build, start, smoke. A module's own code runs during the test. Verified is a compatibility signal, not a security review.
// Signals · measured per version · each with a date and evidence
What is measured for each version
| Signal | States | Rule |
|---|---|---|
SIG-RCPReceipt, per line |
| A fresh app of the line adds the module and runs nine steps, scaffold to smoke. Status comes from the GitHub Actions API, not from files the module could write. |
SIG-FITFits statically, per line |
| Every import resolves against the published packages of the line. Drift is reported only against latest. |
SIG-ANAAnatomy | full, partial, hidden, none | Facts read from src/ of the published tarball. Partial: fewer than three kinds of contract, or no src. Hidden: enterprise. |
SIG-SUPSupply chain | ok, warn, fail | No undeclared install scripts or binding.gyp, no git, http or file dependencies, no high or critical advisory older than 30 days, no lost provenance. |
SIG-HYGHygiene | ok, warn, fail | Lint of the anatomy, each finding with an anchor in the Open Mercato docs and a file and line. Fail on any error. |
SIG-MNTMaintenance | current, behind, stale, archived, deprecated | Current: a release within 180 days or verified on latest. Stale: more than 365 days and not verified on latest. |
SIG-DECDeclared vs observed | match, mismatch | Built for (peers) against Verified on (receipts), declared hosts and environment against the anatomy. |
Anatomy is read statically from src/ in the published tarball. Code was not executed. It describes what the code declares, not whether it is safe.
// OM Quality · people only · per published tarball
OM Quality
No module holds OM Quality yet. Be the first: request a review.
Preconditions: the version is Verified, the entry is Claimed, provenance is verified or a GitHub tag equals the version, and the license is explicit (UNLICENSED only with a review agreement).
| Item | Check, pass or fail with a file and a line |
|---|---|
OMQ-01 | Tenant isolation: queries are scoped by tenant_id and organization_id. |
OMQ-02 | Every route and page declares requireFeatures; public routes are justified. |
OMQ-03 | defaultRoleFeatures in setup.ts are proportionate. |
OMQ-04 | Migrations are additive, tables use the module prefix, no DDL on core tables. |
OMQ-05 | Event IDs follow module.entity.action. |
OMQ-06 | Observed hosts equal declared hosts; no eval, new Function or child_process. |
OMQ-07 | Secrets go through the Open Mercato credentials mechanism; environment variables are documented. |
OMQ-08 | Dependencies have no install scripts and no known vulnerabilities; the release ships a CycloneDX SBOM. |
OMQ-09 | The repository has tests and green CI. |
OMQ-10 | UI uses @open-mercato/ui; i18n follows the convention. |
OMQ-11 | README covers install and configuration; the package ships AGENTS.md. |
OMQ-12 | Peer dependencies are ranges, or a pin is justified. |
How a review runs
- The author asks for a review with the issue form.
- An isolated agent pre-pass reads the tarball statically and drafts a report with files and lines. It cannot grant anything.
- A reviewer from the core team checks every item.
- A second person approves.
- A pull request adds the review file; a maintainer merges it.
Validity
12 months, for one dist.integrity. A new version does not inherit the review. Revoked automatically when Verified is lost for more than 14 days, or when a high or critical advisory stays unfixed for 14 days.
Revocations
No revocations.
Review time can be paid for. The result cannot.
// Read this before you trust a badge
What the levels do not mean
- Verified does not mean safe. A module's own code runs during the test. It is a compatibility signal, not a security review.
- Listed does not mean tested. It means the descriptor, package, kind and license checks passed.
- Built for is not Verified on. Peer dependencies are a declaration, not a test.
- Built from is not a safety claim. It tells you where a package came from, not that it is safe.
- OM Quality does not carry over. Each new version needs its own review.
- Popularity is not a level. Downloads and stars are shown, not scored, and hidden for official packages.
- No level is for sale. Review time can be paid for. The result cannot.