Manifest rules
The five rules about connector.json — the key, the SDK constraint, the listing links, the resource kinds, and that the registered manifest is what the file on disk says.
These rules hold the registered manifest to what the file and the SDK demand. The loader has already refused a file that is structurally wrong; these catch what a valid file can still get wrong.
manifest.key_matches
Checks that the manifest's key equals the key the registry holds the connector under.
Fails with the manifest says "example", the registry says "sample".
Why the key is reused everywhere (tables, config, views, routes, limiters), so a connector registered under one name and declaring another would be reachable under neither.
Fix the key in connector.json; the registry always uses the file's key, so a mismatch means the manifest object was built or altered in code.
manifest.sdk_constraint
Checks that Sdk::satisfies($manifest->sdk) holds for the SDK the application runs (Sdk::VERSION).
Fails with SDK 1.0.0 does not satisfy "^2.0".
Why the registry refuses an incompatible package at boot; the kit repeats the check so a report says it in words.
Fix the sdk constraint. ^1.0 is right for a package built against any 1.x; name a minor (^1.2) only when you use something that minor introduced. The syntax is on Identity.
manifest.listing_links
Checks every link in listing.links (documentation, support, privacy, terms, homepage) and listing.changelog_url, when present, against ^(https://[^\s/]+|mailto:[^\s@]+@[^\s]+).
Fails with links must be https URLs or mailto addresses: support "http://acme.test/help", terms "telegram.org/tos".
Why the marketplace renders them as-is on a public page, and the legal pages link privacy for members.
Fix absolute https:// URLs, or mailto: addresses for support.
manifest.resource_kinds
Checks that every entry of resource_kinds is a ResourceKindDefinition with a non-empty label, portalLabel and icon.
Fails with resource kinds: room has no portalLabel, hall has no icon.
Why the label is what creators pick from, the portal label is what members read, and the icon is drawn beside both; an empty one renders a blank.
Fix fill the three strings for every kind. The loader already refuses a kind outside ^[a-z][a-z0-9_-]*$, a duplicate and a grant_mode outside the four.
manifest.file_is_the_source
Runs when a package path is passed. Checks that connector.json exists at the package root, loads, and matches the registered manifest on key, name, version, sdk, the number of capabilities and the number of install and settings fields.
Fails with /path/connector.json does not exist; the manifest must be declared in the file, or the registered manifest must come from the file: version is "1.1.0" in the file and "1.0.0" in the registry, the declared fields differ between the file and the registry.
Why the file is the single source of truth: the marketplace, GET /connectors, the apps and the kit all read it, so a manifest assembled in PHP or edited after registration would show one thing and do another.
Fix declare everything in the file and let the SDK's service provider register it. A connector that binds its own SettingsSchema declares no fields in the file, so the field counts still agree (zero and the registry's copy of zero); one that declares fields binds no schema.
The loader runs first
A file with a missing required key, a wrong type, an unknown key or a value outside its enumeration never reaches the kit: the SDK's service provider throws InvalidManifest at boot with every problem and its dotted path. The rules here are for what a loadable file can still get wrong.
How is this guide?
Conformance Kit
The suite every connector passes before review — what "passes the kit" means, how it runs, how a rule fails, the report it returns, and the twenty-three rules grouped by what they check.
Ports and forms
The three rules about what is bound and what the forms declare — the seven required ports, the install form, the settings form.