Extension SDK

Rule providers

Editor-only extension assemblies can expose rule providers through the public Release Core contracts. Use stable reverse-domain rule IDs and deterministic ordering; never derive identity from display text or file-system enumeration order.

Rule contract

• respect cancellation during bounded work;
• report only evidence observed in the current project;
• keep finding order deterministic;
• use project-relative affected-object and attachment paths;
• avoid credentials, absolute paths, and unbounded file reads;
• return no finding when policy is satisfied;
• report unavailable, unsupported, invalid, or not-applicable capability state instead of inventing a pass.

Findings and attachments

Stable finding IDs bind the rule and affected object. Findings should explain observation, policy, affected object, and remediation. Evidence attachments use project-relative paths, explicit media types, and SHA-256 when content exists; attaching metadata does not automatically authorize sharing source material.

Capability declaration

Report Supported only when the evidence source ran, NotApplicable when selected policy does not apply, Unavailable when a required dependency is absent, and Invalid when a source exists but cannot be trusted. Capability state is separate from severity.

Extension SDK sample

The package sample demonstrates a bounded informational rule that stays inactive until its project-owned marker exists. The sample does not change project settings, register an automatic fix, authorize a release, or send evidence outside the project.