Publish @ae-framework/core 0.1.x with npm provenance

[ootakazuhiko]

Background

Parent: #3626

packages/core is prepared as @ae-framework/core@0.1.0, but the package is not live on npm. Current observed state:

• npm view @ae-framework/core version --json returned E404 during Complete #3598 Phase 4 publication and align the issue record with delivered evidence #3626 work.
• Local npm credentials / org ownership were not available to Codex CLI.
• packages/core/package.json already contains package metadata, public publish config, files, and exports.
• packages/core/PUBLISHING.md documents the pre-publish checklist and compatibility boundary.

This issue tracks the actual npm publication path and the evidence required before QUICKSTART wording can claim the package is live.

Tasks

• Repository owner confirms the @ae-framework npm org/scope is controlled by the project, or chooses a different package scope.
• Configure npm trusted publishing or an equivalent release workflow path with provenance support. Workflow/preflight/bootstrap/trusted-publisher path was added by ci(release): add core package publish preflight #3636; release-owner npm configuration remains pending.
• Add or update the release workflow so publication is performed from a release tag/commit, not a local machine. Completed by ci(release): add core package publish preflight #3636.
• Run package checks before publish:
  • pnpm --filter @ae-framework/core run build
  • pnpm --filter @ae-framework/core run test
  • pnpm --filter @ae-framework/core run check:no-src-imports
  • (cd packages/core && npm pack --dry-run --json)
• Publish @ae-framework/core@0.1.x with provenance.
• Verify npm view @ae-framework/core version succeeds.
• Add a non-workspace install/import smoke test for the published package.
• Add the release note required by QUICKSTART-15MIN and update the QUICKSTART publication-boundary wording in the same PR.
• Comment on Complete #3598 Phase 4 publication and align the issue record with delivered evidence #3626 with registry URL, release URL, and CI evidence.

Acceptance criteria

• npm view @ae-framework/core version returns the published 0.1.x version.
• Non-workspace npm i @ae-framework/core && node -e "import('@ae-framework/core')" smoke evidence is available in CI or a documented release run.
• Release notes and QUICKSTART wording are consistent with the actual published state.
• Package provenance evidence is linked from the issue or release.

Human decision required

Codex CLI cannot complete this without release-owner confirmation of npm scope ownership and a configured trusted-publishing/credential path.

Progress update: publish workflow/preflight ready

• Add trusted npm publish workflow preflight for @ae-framework/core #3635 was completed by ci(release): add core package publish preflight #3636.
• Merge commit: 04662a97343b10f5b62eef5ba8bab0d9f8ddf8d1.
• Added .github/workflows/publish-core-package.yml with explicit preflight, bootstrap-token, and trusted-publisher modes.
• The first npm publish remains a release-owner task because OIDC trusted publishing cannot bootstrap a package before it exists in npm settings; use the protected npm-publish-bootstrap Environment and NPM_BOOTSTRAP_TOKEN for the initial publish, then configure npm trusted publishing for subsequent publishes.
• Remaining tasks: confirm/control the @ae-framework npm scope, configure the protected npm environments/secrets/trusted publisher, run the release workflow from core-v<version>, verify npm registry state, run non-workspace install/import smoke, publish release notes, update QUICKSTART, and comment on Complete #3598 Phase 4 publication and align the issue record with delivered evidence #3626.

[ootakazuhiko]

Created #3635 as the Codex-progressable workflow/preflight slice. #3631 remains blocked for the actual npm org/trusted-publishing confirmation and publication evidence.

[ootakazuhiko]

#3635 is complete via #3636.

Evidence:

• Merge commit: 04662a97343b10f5b62eef5ba8bab0d9f8ddf8d1
• Workflow added: .github/workflows/publish-core-package.yml
• Modes: preflight, bootstrap-token, trusted-publisher
• Review handling: Codex review identified the initial OIDC publish limitation; the workflow/runbook now include a protected bootstrap-token path before switching to npm trusted publishing.
• Final PR CI: required checks gate, policy-gate, and verify-lite passed; full rollup had no non-success/non-skipped entries.

I updated this issue body to mark the release-workflow task complete. This issue remains blocked/open for release-owner actions: npm scope confirmation, protected npm environment/token/trusted-publisher setup, actual publish, registry verification, non-workspace smoke, release note, QUICKSTART update, and #3626 evidence comment.

[ootakazuhiko]

Ran the newly merged no-publish preflight workflow on main.

Evidence:

• Workflow run: https://github.com/itdojp/ae-framework/actions/runs/28758749542
• Result: success
• Completed job: core-package-preflight
• Skipped jobs as expected for publish_mode=preflight: core-package-bootstrap-publish, core-package-trusted-publish
• Downloaded artifact: core-pack-dry-run-0.1.0
• Artifact validation summary: package @ae-framework/core@0.1.0, 21 packed files, includes dist/, schema/, LICENSE, and NOTICE, and excludes src/.

npm view @ae-framework/core version --json still returns E404, so the package is not published. Remaining release-owner actions are unchanged: confirm/control the @ae-framework npm scope, configure npm-publish-bootstrap + NPM_BOOTSTRAP_TOKEN for initial publish, publish from core-v0.1.0, remove/disable the bootstrap token, configure npm trusted publishing for subsequent releases, verify registry/provenance, run non-workspace smoke, add release notes, and update QUICKSTART.