From registration to steward — how you join, verify your identity, publish your first blueprint, and grow.
Create an account on metafactory with email and password.
Enable MFA immediately — this is a hard gate. TOTP (authenticator app) at minimum, hardware key (WebAuthn/FIDO2) preferred. SMS is not accepted (SIM swap risk).
Link your GitHub account — this establishes your public identity and lets verifiers check your contribution history.
At this point you’re ○ NEW: you can browse the atlas, install blueprints, and explore — but you can’t publish yet.
A ◆ Trusted or ★ Steward member verifies your identity: they check your GitHub profile has meaningful activity (not newly created), and that your real name is verifiable (LinkedIn, personal site, conference talks, open-source presence).
If you’re not personally known to any existing member, two independent verifications are required (dual-control).
You’re assigned a sponsor — a ◆ Trusted or ★ Steward member who agrees to review your first submissions.
Your namespace is reserved (@your-name/) and you sign the publisher agreement.
A ★ Steward promotes you to ◐ IDENTIFIED — you can now submit blueprints.
Target: 48 hours from application to ◐ IDENTIFIED for clear-cut cases.
Run arc bundle ./my-blueprint — arc creates a signed tarball (Sigstore keyless, tied to your OIDC login) and submits it.
The clean room runs four automated checks: attribute gate, deterministic analysis, content scan, quarantine sandbox.
Your sponsor reviews the automated report and your code: do the capabilities make sense? Is the README clear?
If they request changes, fix and resubmit. If they approve, metafactory signs and publishes.
Your blueprint appears in the atlas — consumers can arc install @your-name/blueprint.
| FROM | TO | CRITERIA | PROCESS |
|---|---|---|---|
| ◐ IDENTIFIED | ● PROVEN | 3+ published blueprints, sustained contributions, sponsor endorsement | Sponsor nominates, 7-day objection window, steward approves |
| ● PROVEN | ◆ TRUSTED | 5+ maintained blueprints, security awareness, community consensus | 14-day public comment period, steward endorsement required |
| ◆ TRUSTED | ★ STEWARD | Governance judgment, community trust, long-term commitment | Steward nomination, community vote, 30-day consideration |
Each promotion expands what you can do: ● PROVEN can peer-review others’ updates. ◆ TRUSTED can sponsor new contributors and approve new blueprints. ★ Steward can promote tiers, make governance decisions, and coordinate incident response.
Demotion is possible for policy violations or security incidents — trust is earned and maintained, not permanent.
Not everyone who contributes needs to publish code. The Community Reviewer role recognizes people who contribute through review.
Security professionals, domain experts, experienced developers from adjacent ecosystems (MCP, Homebrew, Debian) — anyone who can evaluate whether a blueprint does what it claims.
Vouched for by a ◆ Trusted or ★ Steward member, same identity verification as onboarding. No publication rights needed.
Community Reviewers can provide review attestations visible to sponsors and consumers, flag security concerns, and participate in review discussions.