The review pipeline

The portal separates concerns that other platforms blur together. Four independent state machines govern your app:

• App lifecycle — the stable identity of your app (draft, approved, deprecated, retired).
• Security review — a decision about one immutable snapshot of your configuration and permission schema.
• Distribution intent — private, invite-only, or marketplace.
• Marketplace listing review — a decision about your public listing content, independent of security approval.

Everything is a versioned snapshot

Permission schemas are monotonically versioned and immutable once submitted. A security review evaluates a frozen snapshot, so:

• You can keep editing while a review is in flight — edits become new draft versions and never mutate what the reviewer sees.
• An approved app stays approved while its next version is under review. Iteration is never punished with downtime.
• Approval is of a specific version; deploying a broader schema version to production requires that version to pass review first.

Independence, concretely

• Production approval ≠ marketplace publication. Approved apps can be distributed privately or by invitation without ever being listed.
• Unpublishing a listing ≠ revoking access. Taking your marketplace listing down does not suspend clinics already running your app.
• The EMR is the authority. The portal orchestrates registration and review, but effective grants, clinic consent, suspension, and revocation live in Ava EMR. The portal shows you the last EMR-confirmed state of your registrations (and its own delivery progress) as distinct fields.

What reviewers look at

The security review sees your app metadata, URIs, and permission schema with rationales — the same rationale text clinicians see at consent. The marketplace review sees your listing content. Writing honest, specific rationales and keeping scopes minimal is the fastest path through both.