Trust model
Signing, verification, isolation and what a household sees before installing.
- You publish. The bundle goes to Novon's registry through an API key tied to your developer account.
- Novon signs. The cloud verifies the upload and signs
(domain, version, sha256)with an ed25519 key. - The hub verifies. A hub downloads a bundle only when a household installs it, re-hashes it, and checks the signature against the public keys in its own configuration. A bundle that does not verify never runs.
- The sandbox contains it. Each entry runs in its own isolate with only the API it was granted
(
http,kv,timers), no filesystem, no raw sockets, no loopback, and fixed resource limits. - Novon can revoke. Administrators can block a version or a domain; blocked bundles are removed from every hub in the environment.
What the household sees in the picker: your name, brand and description, the iotClass, the
permissions you request, and which config fields are exposed. Ask for the minimum.
The wire contract (manifest schema, release manifest, signature format) lives in the platform's
communityIntegration.schemas.ts and is summarised on the SDK API reference.