> ## Documentation Index
> Fetch the complete documentation index at: https://docs.budscollab.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Distribution matrix

> How widgets, apps, plugins, Eve exports, and registry handoff share the same primitive contract.

The SDK distribution matrix is the product proof that BudsCollab is safely
composable across more than one packaging shape. A widget, full app, agent
plugin package, Eve sandbox export, and registry handoff all start from
`SDK_PRIMITIVE_LAYER_CATALOG`, then declare UI, Theme, surface, capability,
safety, and distribution primitives before they can move forward.

The checked source is `distribution-matrix.json`. It maps each route to the
same primitive layers and names the evidence files that prove the route exists:

| Route                | Producer                            | Required evidence                                                                                                                                                                                                                                                                                           | Install posture                    |
| -------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
| Personal widget      | Developer-owned repo                | `budscollab.package.json`, `budscollab-app-review.json`                                                                                                                                                                                                                                                     | Host-rendered, review required     |
| Full app             | Developer-owned repo                | `budscollab-showcase.json`, `SHOWCASE.md`, `budscollab-app-review.json`                                                                                                                                                                                                                                     | Package review required            |
| Agent plugin package | Codex or Claude plugin wrapper      | `budscollab-plugin-package.json`, `SKILL.md`, `.mcp.json`                                                                                                                                                                                                                                                   | Agent helper, review gated         |
| Eve sandbox export   | Eve AI sandbox                      | `sandbox-sdk-policy.json`, `sandbox-sdk-handoff.json`, `sandbox-artifact-receipt.json`, `sandbox-sdk-instructions.md`, `budscollab-registry-publisher-verification.json`, `budscollab-registry-review-evidence.json`, `budscollab-registry-signing-request.json`, `budscollab-registry-install-policy.json` | Validated export, not live install |
| Registry handoff     | `@budscollab/cli` registry commands | `budscollab-registry-acceptance-request.json`, `budscollab-registry-publisher-verification.json`, `budscollab-registry-review-evidence.json`, `budscollab-registry-signing-request.json`, `budscollab-registry-install-policy.json`, `hosted-registry-api-contract.json`                                    | Review gated until signed          |

This matrix is deliberately stricter than a marketing diagram. Each route must
include the same six primitive layers:

* `ui`
* `theme`
* `surface`
* `capability`
* `safety`
* `distribution`

That means plugin packages are not a separate app system. They are an agent
distribution envelope around the same SDK artifact. Eve sandbox output is not a
direct install path either; it must return a validated exported artifact with
the same SDK policy, `sandbox-sdk-handoff.json` envelope,
`sandbox-artifact-receipt.json` local receipt, and review evidence.
The production artifact store, artifact hash, review storage, signing, and host
install policy are required before install. Registry handoff is also not a
marketplace install claim until publisher verification, review storage,
artifact hash, artifact signing, and host install policy are implemented.

Use this page when deciding whether a new route belongs in the public SDK. If
it cannot name its primitive layers, required artifacts, validation command, and
install posture, it is not ready to be presented as safely composable.