Lanvex Store

Three gates, kept separate

1. Company qualification. Who the publisher legally is, who answers for them, and whether they are competent to support what they sell.
2. Framework review. Security and compatibility, the four extension manifests, declared connector permissions, signed dependencies, the domain dossier and the claims made.
3. Signed commercial release. Publisher and Lanvex signatures, licence terms, and an installation the customer's administrator approves.

Passing one gate is not passing another, and a listing shows which have been passed.

Two review tiers

Reviewed is the baseline: automated checks and a lighter manual review that every listed framework passes.

Sovereign Certified is a deeper paid audit, repeated annually, which a publisher chooses to seek. It states what was audited and at which version.

Neither tier is a statement that a framework can do a profession's whole job. That is a separate claim requiring customer evidence.

Neutrality

Admission, review scope, security standards, category access, search policy and certification are publisher-neutral. First-party frameworks face the same process as independent ones, and independent publishers may compete directly in any domain, including the ones Lanvex builds for itself.

Equal process is not equal placement. Placement follows what customers choose.

Lifecycle

Submission, dossier, security review, signatures, signed bundle delivery, authorised import, administrator approval, licence verification, rollback, revocation and vault preservation.

Air-gapped and isolated sites need explicit freshness and revocation rules: installed applications may keep running on previously accepted state even when offline metadata is stale, and new installations are refused instead.