Marketplace (registry.feral.sh)

​

What’s in the marketplace

​

Install flow

feral install <item_id>

1. GET https://registry.feral.sh/api/v1/item/<id> returns the manifest, signed-tarball URL, SHA-256, Ed25519 signature, and the publisher’s public key.
2. The client recomputes SHA-256 locally and verifies the detached signature against the publisher’s public key.
3. On success, the tarball extracts to the right ~/.feral/<kind>/<id>/ directory and pings the running Brain’s hot-reload endpoint (/api/skills/reload, /api/channels/reload, /api/providers/reload, …).
4. The new capability is live before your next turn.

​

Publish flow

# First time only: register your publisher identity
feral publisher login      # browser OAuth with GitHub
feral publisher register   # uploads your Ed25519 public key

# Every release
feral publish --kind <kind> <path/to/your/bundle/>

​

Trust model

• Every bundle is Ed25519-signed with the publisher’s private key. The signature is stored alongside the blob so clients can re-verify on every install.
• Publishers verify with GitHub OAuth. Your registry handle is your GitHub login. Your public key is registered once and reused for all future publishes.
• verified badge is earned by being in the FEATURED_PUBLISHERS allowlist maintained by the FERAL team. Everything else is community.
• flag endpoint lets anyone report a malicious package. Flags surface in moderation; repeat offenders lose publisher status.

​

Self-hosting the registry

cd feral-registry
fly launch --no-deploy --copy-config --name my-feral-registry
fly volumes create feral_registry_data --size 10
fly secrets set \
  JWT_SECRET="$(openssl rand -hex 32)" \
  GITHUB_CLIENT_ID="..." \
  GITHUB_CLIENT_SECRET="..." \
  FEATURED_PUBLISHERS="my-org"
fly deploy