Skip to main content
The SDK distribution matrix is the product proof that BudsCollab is safely composable across more than one packaging shape. A widget, full app, agent plugin package, Eve sandbox export, and registry handoff all start from SDK_PRIMITIVE_LAYER_CATALOG, then declare UI, Theme, surface, capability, safety, and distribution primitives before they can move forward. The checked source is distribution-matrix.json. It maps each route to the same primitive layers and names the evidence files that prove the route exists:
RouteProducerRequired evidenceInstall posture
Personal widgetDeveloper-owned repobudscollab.package.json, budscollab-app-review.jsonHost-rendered, review required
Full appDeveloper-owned repobudscollab-showcase.json, SHOWCASE.md, budscollab-app-review.jsonPackage review required
Agent plugin packageCodex or Claude plugin wrapperbudscollab-plugin-package.json, SKILL.md, .mcp.jsonAgent helper, review gated
Eve sandbox exportEve AI sandboxsandbox-sdk-policy.json, sandbox-sdk-handoff.json, sandbox-artifact-receipt.json, sandbox-sdk-instructions.md, budscollab-registry-publisher-verification.json, budscollab-registry-review-evidence.json, budscollab-registry-signing-request.json, budscollab-registry-install-policy.jsonValidated export, not live install
Registry handoff@budscollab/cli registry commandsbudscollab-registry-acceptance-request.json, budscollab-registry-publisher-verification.json, budscollab-registry-review-evidence.json, budscollab-registry-signing-request.json, budscollab-registry-install-policy.json, hosted-registry-api-contract.jsonReview gated until signed
This matrix is deliberately stricter than a marketing diagram. Each route must include the same six primitive layers:
  • ui
  • theme
  • surface
  • capability
  • safety
  • distribution
That means plugin packages are not a separate app system. They are an agent distribution envelope around the same SDK artifact. Eve sandbox output is not a direct install path either; it must return a validated exported artifact with the same SDK policy, sandbox-sdk-handoff.json envelope, sandbox-artifact-receipt.json local receipt, and review evidence. The production artifact store, artifact hash, review storage, signing, and host install policy are required before install. Registry handoff is also not a marketplace install claim until publisher verification, review storage, artifact hash, artifact signing, and host install policy are implemented. Use this page when deciding whether a new route belongs in the public SDK. If it cannot name its primitive layers, required artifacts, validation command, and install posture, it is not ready to be presented as safely composable.