App manifest

Every app version carries a manifest. The builder proposes it, a person approves it, and the gate enforces it: anything not declared here is denied. The manifest of a published version never changes; wider access is a new version.

You rarely write one by hand. A plan from the Build screen, plan_app_from_prompt or qaldy build --plan contains one, and shows it as sentences. This page is for reading a plan closely, for reviewing what an agent proposes, and for building tools around the API.

An example#

{
  "name": "Low-stock alert",
  "description": "Tells the roastery chat in Telegram when a coffee bean stock drops below 5 kg.",
  "archetype": "radiotower",
  "category": "messaging",
  "permissions": {
    "data": [
      {
        "table": "stock",
        "access": "read"
      },
      {
        "table": "alerts_sent",
        "access": "write"
      }
    ],
    "connectors": [
      {
        "id": "telegram",
        "actions": [
          "sendMessage"
        ],
        "scope": "#roastery"
      }
    ],
    "egress": [],
    "ai": null
  },
  "triggers": [
    {
      "type": "schedule",
      "cron": "0 8 * * 1-5"
    }
  ],
  "sharing": {
    "default": "private"
  },
  "roi": {
    "manualMinutesPerRun": 10
  }
}

The plan shows this manifest to the person who approves it as these sentences:

• Can read stock.
• Can change alerts_sent.
• Can send Telegram messages to #roastery through Telegram.
• Does not use AI models.
• Can't reach anything else on the internet.

Nothing here reaches the internet: egress is empty and ai is null. Each connector action is named, so the app can send a message to that one chat and cannot do anything else through Telegram. The app can read the stock table and write alerts_sent, and no other table.

Every field#

The table is generated from the schema the API, the builder and the gate all parse with, so it cannot drift from what is enforced.

How the permissions are enforced#

A manifest is checked twice: the builder's static checks against the code (declared egress must equal used egress, see Approvals and the Trust Score), and the gate at run time against the actual calls.