Test, publish, update

#Developer mode

DeepBot -> Apps -> switch Developer mode on (top right). Then:

From a folder: the app's folder on the computer DeepBot runs on (or a folder with several apps). Pages and cards reload as you save; the checks run on every change and show under the app.
From a .zip: app.json at the top of the zip, or in one folder inside it.
From GitHub: owner/repo, owner/repo@v1.2, or .../tree/branch/folder; a token for a private repository. Update pulls the newest commit.

Apps from developer mode are labelled "Not reviewed", load only while developer mode is on, and win over a catalogue app with the same id (unlink to go back to the catalogue's).

#A test pass before publishing

A new conversation: ask for the app's job in the words a person would use. The Bot picks the skill, writes the files, calls the card, the card reports done.
Ask it in another way, and in another language. Ask for something close but different: the app should not take over.
Every button on every card and page. ask buttons produce a sensible next turn.
Failure paths: missing file, bad JSON, no network, a refused permission. The card shows a clear message and calls deepbot.fail; the Bot recovers.
Dark mode (DeepBot Settings), a narrow window, a big window, full screen.
A fresh install: delete the app's workspace folder and its storage (unlink and link again), start from nothing.
Scripts on Windows and macOS/Linux if you can, with a missing dependency.

#Publishing

Push the app to a public GitHub repository: one app at the root, or apps in folders.
Set version in app.json, commit, and tag: git tag v1.0.0 && git push --tags.
On the DeepBot site: Developers -> Sign in with GitHub (you need push access to the repository) -> Submit a version: the repository, the tag, and the folder if the app is not at the root.
The catalogue fetches exactly the commit the tag points at, runs the checks (errors stop it here, with the reasons), builds the package DeepBot installs (without listing/, .git, .github), signs it, and puts it in review. Your dashboard shows the status and the review notes.
Approved: the app is in the catalogue and in every DeepBot's Discover. Moving the tag later changes nothing: DeepBot installs only the reviewed package (it checks the signature and hash).

#Updates

Raise version (1.0.0 -> 1.0.1 for fixes, 1.1.0 for features, 2.0.0 when old files no longer work), add a ### 1.1.0 entry to the changelog, tag, submit. Every version is reviewed; changes to permissions and new scripts get the closest look. Approved updates are offered to everyone who has the app.

Keep old data working: an update must read the files the previous version wrote (normalise old shapes, or migrate them when the app opens).

#Review: what we look at

the checks (manifest, files, names, size, executables);
permissions against what the app does and what the listing says;
every script and every network call;
that the skill does what the listing says, and nothing else;
quality: it works, it fails clearly, it looks at home in light and dark.

Rejected for: hidden data collection or sending data where the listing does not say, obfuscated code, executables, crypto mining, downloading and running code, copies of other apps, names that imitate others, card names DeepBot uses.