Marketplace Navin

First-party skills catalogue hosted on the Navin license site (navin.live or your staging host). Complements ClawHub (external public registry) with Navin-signed packages, install ledger, and revenue share.

Runtime requirement: the WebUI calls {licenseServerUrl}/api/marketplace/skills. Until that route is deployed on the server in Account settings and 2026-08-02-marketplace.sql is applied, the Skills → Marketplace panel shows a calm “unavailable / use ClawHub” state (it must not show a raw network error).

Tables (Supabase)

Migration: site/supabase/2026-08-02-marketplace.sql

Table	Role
`marketplace_skills`	Catalogue entry (`slug`, `latest_version`, `signature`, `featured`)
`marketplace_skill_versions`	Versioned `package_url` / `content_hash` + `signature` + changelog
`marketplace_installs`	Per-user or per-org install rows
`marketplace_revenue_share`	Period ledger (`gross` / author / platform micro-USD)

Featured rows require a non-empty signature (SQL check + API verify).

Signing

Env: MARKETPLACE_SIGNING_SECRET (min 32 chars, server-only).

Canonical HMAC-SHA256 payload (base64url digest):

navin-marketplace-v1
{slug}
{version}
{content_hash}
{package_url}

Helpers:

TypeScript: site/src/lib/marketplace.ts (signSkillPackage, verifySkillSignature)
Python: navin/marketplace_signing.py (same algorithm for local/tests)

verifySkillSignature rejects unsigned packages (empty / missing signature).

Skill vetter

Before featuring a skill:

Audit the package with the bundled skill-vetter skill (navin/skills/skill-vetter).
Sign only after an Allow (or Allow with constraints) verdict.
Set featured = true only when the signature verifies.

Site APIs

Method	Path	Notes
GET	`/api/marketplace/skills`	Featured public list (signature-filtered)
GET	`/api/marketplace/skills/[slug]`	Detail; 404 if missing or invalid signature
POST	`/api/marketplace/skills/[slug]/install`	Records install when `user_id`/`org_id` present; returns signed package metadata

CORS is open so the local WebUI can call the catalogue.

WebUI

Settings → Skills includes a Marketplace panel:

Lists featured skills from the configurable site base URL (account.server_url or https://navin.live).
Install calls the site install API, then prefers the local skills_api / createSkill path when inline markdown is returned; otherwise surfaces signed package metadata / URL.
ClawHub stays linked as an external option.

Tests

python3 -m unittest tests.test_marketplace_signing

Covers valid HMAC round-trip, empty signature reject, tamper / wrong-secret / slug-swap reject, and featured eligibility.