ADR-0120: Marketplace of signed packs

• Status: accepted
• Date: 2026-10-30
• French version: ../ADR-0120-marketplace.md

Context

Kit section 12.

Decision

Publication is refused when a gate fails or is missing: schema, signature (pack digest and each SKILL.md), SPDX 2.3 SBOM, Trivy scan, tests, evaluations, licence, permissions, FR and EN docs, secrets.

Consequences

HR and Finance reference packs.

Evidence

• services/control-plane/src/eai/domains/marketplace/gates.py
• sql/postgres/V130__marketplace.sql
• packs/hr
• packs/finance
• services/control-plane/tests/test_marketplace.py