bRRAIn marketplace

1. Marketplace overview

The bRRAIn marketplace is a certification-gated catalog of apps that customer bRRAIn instances can install in seconds. As a vendor, you publish a listing with one or more endpoints, declare your endpoint posture (TLS, auth scopes, data flows, latency SLA, BC commitments), and submit for certification. After review you set per-listing plans (free / flat / per-seat / usage). Customers license your app per-org per DEC-008; revenue is split 30% MHJ / 70% you.

2. Onboarding

1. Sign up at /vendor-signup.
2. Verify your email by replaying the token from the sign-up response.
3. Wait for MHJ admin to flip your account to admin_approved.
4. Visit /vendor-portal/{your-slug} for your dashboard.
5. Publish your first listing via the portal (or directly via POST /api/vendor/{slug}/listings).

3. Listing schema

Every listing carries:

• id, slug (lowercase ascii letters/digits/hyphens, 2–64 chars), name, vendor_slug, category_slug
• description, support_contact, install_instructions
• pricing (legacy hint for the catalog card; real plans are in the licensing API)
• endpoints — array of {url, purpose, auth_model}; URLs must be HTTPS
• screenshots — array of vector-only .svg URLs (no raster per Vector-First standard)
• versions — semver-shaped {version, manifest_url, changelog, published_at, deprecated}
• signing.publisher_key — base64url-no-pad ed25519 public key (43 chars)

4. Certification

See /certification-criteria for the complete v1.0 rubric. TL;DR:

• TLS minimum 1.2 (1.3 preferred); cert validity buffer 14 days
• Response-time gate: 5s timeout
• Required: incident_notification_url, vulnerability_disclosure URL, latency_sla string
• Submission generates one review record per endpoint with verdict pending → accepted / needs-changes / rejected
• Auto-tooling: POST /api/cert/scan probes TLS + cert validity + reachability + response time (rate-limited 1/hour per (vendor, endpoint))

5. Licensing & revenue

Plans are per-listing. Customers pick a plan when they start a license. Trial periods (trial_days on the plan) flip the license trialing → active on conversion. Cancel keeps access through current_period_end; expire fires when a trial elapses without conversion.

Every charge appends a RevenueEvent split 30% MHJ / 70% vendor. Settlement is monthly (GET /api/admin/revenue?month=YYYY-MM).

6. Version management

• POST /api/vendor/{slug}/listings/{listing_slug}/versions — add a new semver version
• POST /api/vendor/{slug}/listings/{listing_slug}/versions/{version}/deprecate — flag a version deprecated (catalog skips it as LatestVersion)
• Customers update via the install lifecycle — see /installs/{org} for their per-org install state.

7. Marketplace Developer certification (DEC-010)

A free Marketplace Developer course runs on learn.brrain.io/marketplace-developer when the curriculum is authored. It covers schema, signing keys, the certification process, billing webhooks, and revenue reporting. Until then, this docs page is the canonical reference.

8. Support

Open a ticket via POST /api/vendor/{slug}/tickets. Tickets show up in your dashboard at /vendor-portal/{slug}.