# Review checklist

The store's reviewers walk this list for every submission. Walk it yourself
first. Anything marked **(auto)** is also checked by `cletus-plugin check`.

## Identity and listing

- [ ] `id` starts with your publisher id; `version` is new and matches the tag. **(auto)**
- [ ] Name, description and guide are accurate and plain. No
      claims about Eidonix or other companies, no imitation of their screens.
- [ ] `CHANGELOG.md` describes this version for users.

## Permissions

- [ ] Every declared permission is used, and every use is declared. **(auto, for host calls)**
- [ ] `docs/plan.md` gives a reason for each permission that a user would accept.
- [ ] `files.computer`, `net:*`, `net.configured` and `processes`: the code
      does only what `docs/plan.md` says (folders, hosts, addresses typed by
      the user, named programs).
- [ ] Data leaves the machine only where the description says so.

## Code

- [ ] Builds from source with no network, `CGO_ENABLED=0`, no prebuilt
      binaries, vendored dependencies. **(auto)**
- [ ] No code loaded, generated or evaluated at run time. **(auto, flags for review)**
- [ ] No obfuscation; any `unsafe`, `reflect`, `syscall`, `os/exec`, `net`
      or direct file access is explained and matches the permissions. **(auto flags)**
- [ ] No behaviour that depends on the date, machine, user or test mode.
- [ ] Paths come from the host or the data folder; nothing reads Cletus's
      settings, keys, history, vaults or other plugins' data.
- [ ] Secrets only through `host.secrets`; none in code, files or logs. **(auto scan)**
- [ ] No telemetry. Logs carry no user data.
- [ ] Dependencies: licences allow distribution; no known serious
      vulnerability. **(auto)**
- [ ] Handlers honour cancellation; long jobs have progress and cancel;
      `plugin.busy` is truthful.
- [ ] Files written stay readable across downgrades, or are refused with a
      plain message.

## Behaviour (the recorded run)

Reviewers run the plugin under a recording host that logs every host call,
file opened, connection attempted and program started.

- [ ] Everything in the recording matches the permissions and `docs/plan.md`.
- [ ] Chat tools do one thing each, are marked `mutating` correctly, and
      fail with a reason and a next step.
- [ ] A screen, if any, follows `style-guide.md` in all three themes: tokens only,
      density, no layout shift, Esc, plain errors.

## Tests

- [ ] Go tests cover every tool, service method and `ui.*` method, and pass. **(auto)**
- [ ] Fixtures are synthetic.