Store readiness

Status: not yet published on the Chrome Web Store or Microsoft Edge Add-ons. This page collects what a submission needs and what is still missing. The Edge end-to-end run has not happened.

Single purpose

Guidepost lets a person record, preview and publish guided tours, tips and announcements for a web application, and shows them on the pages of sites the user has granted access to.

Permission justification

Permission	Justification
storage	Settings and per-item progress
unlimitedStorage	The local content library, including uploaded images, is kept in IndexedDB and can exceed the default quota
sidePanel	The authoring studio
scripting	The service worker injects the player, picker and frame agent into granted pages on demand. No remote code
alarms	Declared for a periodic manifest refresh. A 5-minute alarm is created, but nothing handles it yet
identity	Declared for single sign-on in a later step. Nothing uses it in the local MVP
Optional https://*/*, http://localhost/*, http://127.0.0.1/*	Requested one origin at a time from a user gesture. Nothing is granted at install

Be ready to explain alarms and identity

Both are declared and neither does anything today. A reviewer is likely to ask. Either remove them from this release or justify them as above. This is the maintainer's decision.

Data-use answers

Question	Answer
Personally identifiable information	Not collected
Health, financial, authentication, location data	Not collected
Personal communications	Not collected
Web history	Not collected
User activity (clicks, keystrokes)	Not collected. Field values are never captured
Website content	Not collected or transmitted. Content you author is stored locally
Remote code	None. CSP is script-src 'self'; object-src 'self'
Data sold or transferred to third parties	No
Used for unrelated purposes or creditworthiness	No

Declared in the dashboard: collected: none. The privacy policy must be hosted at a public URL and, before a store submission, give the store dashboard a monitored support address (the policy points to the GitHub issue tracker).

Asset checklist

Asset	Size	Status
Extension icon	128 x 128 px (also 16, 32, 48 recommended)	Missing. The manifest declares no icons
Small promo tile	440 x 280 px	Missing
Screenshots	1280 x 800 px, up to five	Not produced. site/scripts/capture-screenshots.mjs can generate them but has not been run
Privacy policy URL	Public URL	Page drafted, host not chosen
Description	Short and long text	Short description exists in _locales

Review risks

• Optional http://localhost/* and http://127.0.0.1/*. Loopback only, so authors can try the extension on a local dev server such as ng serve. Other plain-http sites need the managed build.
• Optional https://*/*. Broad patterns draw extra review. The argument for it: it is optional, nothing is granted at install, the user grants one origin at a time from a visible button, and the store build declares no host_permissions. The player only runs on origins that were granted and have published content.
• Dynamic content script registration. The content script is registered at run time with scripting.registerContentScripts, not declared in the manifest. Explain it in the reviewer notes.
• Unused permissions. See the warning above.
• Fixed manifest key. The manifest carries a key so the extension id stays stable (ndfpefldicajaangbhjlebpkjdimncml). Whether the store upload accepts it, or needs it removed, is unverified. The store assigns its own id.
• Rich text and embeds. Markdown is sanitised with DOMPurify and embedded viewers use a sandboxed iframe.
• Edge. Builds and the manifest was inspected; the test suite has not run on Edge.

Submission steps

All steps are not yet done.

Chrome Web Store

1. Build the store flavour: pnpm build, then pnpm zip.
2. Create or use a developer account and pay the registration fee.
3. Upload the zip, fill the listing, the permission justifications and the data-use form above.
4. Add the privacy policy URL, icon, tile and screenshots.
5. Submit for review.

Microsoft Edge Add-ons

1. Build the Edge target: pnpm build:edge, then zip apps/extension/.output/edge-mv3.
2. Register in Partner Center.
3. Upload and complete the same listing and privacy answers.
4. Run the end-to-end suite against Edge first. This has not been done.
5. Submit for certification.

The release procedure in docs/RUNBOOK.md is a placeholder until a listing and signing key exist.

Gotchas

• Store review times vary. Plan for several days and for a follow-up question on permissions.
• Do not enable the managed flavour for a store upload. It carries host_permissions for a fixed set of origins.