Beyond the kit

The kit runs against a registered connector and reads two things on disk. Three more rules hold every connector installed on Subscriby, enforced by the application's architecture tests rather than the kit, and a reviewer reads for what no test can see.

Isolation, both ways

• A connector imports nothing from the application. use App\… and App\… class strings are forbidden in every packages/subscriby-connector-*/src directory. A third-party package must have zero; the first-party connectors carry a shrinking allow-list that must be empty before the SDK's next major. Your connector talks to the core through Subscriby\Connector\Core\* and the SDK's value objects only.
• The core imports nothing from a connector. No Subscriby\Connectors\… namespace appears in the application; the core reaches a connector through the registry, the ports and the slots.

The only thing that crosses in either direction is the SDK.

Translation parity

Every string a connector shows on a core page, in a slot, a field label, a resource-kind label, a portal button, a readiness item, has a translation in each of the ten locales Subscriby ships (English, Spanish, French, German, Italian, Portuguese, Turkish, Hindi, Bengali, Sinhala), in the package's own lang/<locale>.json. The application's language parity tests scan package language directories beside the core's and fail on a key present in one locale and missing in another.

Skeleton parity

A slot contribution's placeholder mirrors the loaded layout: the same boxes, the same heights, so a lazy page does not jump when the contribution arrives. The kit checks that a placeholder exists; review checks that it matches.

What review reads for

Passing the kit and the three rules above is the entry ticket. A reviewer then reads the package for what a test cannot judge, against the checklist on Listing and Review:

• credentials never reach a log, an exception message or a view;
• the platform's terms allow what the connector automates;
• the listing describes what the bound ports actually do, and every declared capability works on the platform rather than throwing UnsupportedByConnector;
• repeated grants and revokes are safe, pacing matches the platform's published limits, and the classifier maps the platform's rate-limit answer to RateLimited with its retry-after;
• the ten locales are real translations, not the English copied ten times.