Marketplace

The AI Control Architecture marketplace is a neutral index of add-ons that plug into the same core. It belongs to the ecosystem, not to any one vendor. Anyone can publish, every add-on is signed and integrity-checked, and each enterprise decides how much to trust. Neo Control lists its own products here on exactly the same rails as everyone else.

Browse the registry → The live, signed catalogue of add-ons lives at marketplace.aicontrolarchitecture.org. This page explains how it works.

What you can build

ACA is a small core plus six extension slots. An add-on is a directory with a manifest and an entry module, and it reads and writes only ACA objects (use case, control, evidence, assessment, finding, tier).

collector

Reads a system, emits ACA evidence. Connectors live here.

framework

Crosswalks controls to an external standard or regulation.

control-pack

Adds namespaced controls or a domain pack. Core ACA-* stays immutable.

test

An assurance or adversarial check, emits test-result evidence.

renderer

Turns an assessment into a report or export.

enforcer

Acts at runtime on a decision. Paid enforcement plugs into this public interface.

Two tracks

	Open track	Curated track
Who publishes	Anyone, permissionless	Reviewed submissions only
Certification	`ACA-Compatible`	`ACA-Verified` / `ACA-Certified`
Vetting	Automated	Automated, security, and behavioural (plus assurance for Certified)
Runtime	Always sandboxed, permission-prompted	Sandboxed; may be pre-trusted per enterprise policy
Paid add-ons	Not the place for them	Yes, this is where commercial add-ons live
Best for	The long tail, velocity, experimentation	Enterprise-safe adoption and monetisation

An enterprise can set a policy of curated-only. An individual builder can live entirely in the open track.

Every listing is verifiable

Transparency is the point. The decision an enterprise makes is "can I trust this," and each listing answers it up front:

Certification badge (Compatible / Verified / Certified) and support tier
Publisher identity (verified for paid and curated add-ons)
Declared permissions (network, reads, writes, data scopes), shown before install
Licence, version, and security-update status

Under the hood, every package carries a deterministic content hash and is signed (Ed25519). Consumers verify the signature and re-check integrity on install, so a package changed since publish is rejected. A compromised or malicious add-on can be revoked centrally, and installed instances are disabled on the next check. The same registry serves a self-hosted core and a hosted one.

The starter catalogue

The reference add-ons are open and cover one per slot. Copy any of them as the starting point for your own.

example-collector reads a system, emits evidence

example-framework crosswalk to NIST / ISO / OWASP / SR 11-7 / NYDFS

example-control-pack a namespaced control

example-test an assurance / adversarial check

example-renderer assessment to a Markdown report

example-enforcer shadow-mode reference for runtime

Publish your add-on

Scaffold from the reference core, then publish through the signed registry:

npx @aca/core new collector yourorg/your-connector

aca-registry keygen --out mykey
aca-registry publish ./your-connector --track open --key mykey.key.pem --publisher yourorg

The registry (aca-registry) List your add-on / become a Steward

Neutral by design

The marketplace is deployment-neutral: the same registry serves a self-hosted core and a hosted one, and no vendor owns the shelf. Neo Control is the founding steward and the first participant. Its own products, such as AI Supply Chain, Vendor Risk, Shadow AI, and the Action Fabric, list here as curated add-ons on the same rails as anyone else's, and compete on how well they work, not on owning the marketplace.

This is v0.1 and evolving. The curated review board is Neo-stewarded today and moves to external assessors as ACA matures, with published, versioned criteria and an appeals path. See the ecosystem RFC for the full extension contracts and governance.