Publish assurance-gate v1 Marketplace listing

[ootakazuhiko]

Background

Parent: #3626

The action release surface was improved and the v1.0.1 immutable tag plus moving v1 tag were created. The GitHub Marketplace listing itself remains a release-owner/UI publication task.

This issue tracks making the Marketplace listing live without over-claiming publication state in documentation.

Tasks

• Repository owner confirms the Marketplace publication route for the root action / assurance-gate action surface.
• Review existing action metadata and listing draft wording for the assurance-control-plane positioning. Verified locally after ci(release): add core package publish preflight #3636: root action.yml and .github/actions/assurance-gate/README.md contain the Marketplace-compatible metadata/draft wording.
• Publish or update the Marketplace listing.
• Verify immutable assurance-gate@v1.0.2 and moving @v1 from a public external consumer with pass/block runtime smoke and required artifacts. Both refs resolve to c00541d75fc1a13720bfd95d6e3b888d0852090e. Evidence: https://github.com/itdojp/ae-framework-impl-test-hub/actions/runs/29185693898 / https://github.com/itdojp/ae-framework-impl-test-hub/actions/runs/29185737973
• Add or update the release note / documentation that states the listing is live.
• Update Complete #3598 Phase 4 publication and align the issue record with delivered evidence #3626 with the Marketplace URL and verification evidence.

Acceptance criteria

• Marketplace listing URL is live and linked from Complete #3598 Phase 4 publication and align the issue record with delivered evidence #3626.
• QUICKSTART and ae init documentation do not claim more than the live listing supports.
• @v1 reference remains the documented default, with SHA pinning documented as the reproducibility option.

Human decision required

Codex CLI cannot publish the Marketplace listing through the GitHub UI. A repository owner must complete or explicitly delegate the publication step.

Progress update: metadata and v1 reference verified

Codex-side verification completed after #3636:

• git ls-remote --tags origin refs/tags/v1 refs/tags/v1.0.1 shows both tags.
• gh api -X GET repos/itdojp/ae-framework/contents/action.yml -f ref=v1 resolves root action metadata.
• gh api -X GET repos/itdojp/ae-framework/contents/.github/actions/assurance-gate/action.yml -f ref=v1 resolves the compatibility subdirectory action metadata.
• .github/actions/assurance-gate/README.md contains the Marketplace listing metadata draft and publication boundary.

Remaining blocked tasks are the release-owner Marketplace publication route, actual Marketplace publish/update, listing-live release note/docs, and #3626 update with the Marketplace URL.

[ootakazuhiko]

Codex-side checks completed for the non-UI parts of this issue.

Evidence:

• git ls-remote --tags origin refs/tags/v1 refs/tags/v1.0.1 shows both tags.
• gh api -X GET repos/itdojp/ae-framework/contents/action.yml -f ref=v1 resolves root action metadata.
• gh api -X GET repos/itdojp/ae-framework/contents/.github/actions/assurance-gate/action.yml -f ref=v1 resolves the compatibility subdirectory action metadata.
• .github/actions/assurance-gate/README.md contains the Marketplace listing metadata draft and publication boundary.

I updated the issue checklist for the metadata-review and @v1 reference-verification tasks. The issue remains blocked/open for release-owner Marketplace UI publication, live listing URL, release note/docs update, and #3626 evidence update.

[ootakazuhiko]

Rechecked Marketplace publication status from the public web surface.

Evidence:

• Marketplace search for ae-framework Assurance Gate did not surface a Marketplace listing for this action.
• Candidate listing URLs currently return 404:
  • https://github.com/marketplace/actions/ae-framework-assurance-gate
  • https://github.com/marketplace/actions/ae-framework

This is consistent with the current blocked state: action metadata and @v1 resolution are prepared, but release-owner/UI Marketplace publication and a live listing URL are still required.

[ootakazuhiko]

Sequencing update: repair the published Action ref before Marketplace publication

Repository review on 2026-07-12 found that the current v1 / v1.0.1 refs predate the pnpm frozen-lockfile runtime fix merged by #3644. Path resolution succeeds, but that alone is not sufficient runtime evidence.

New prerequisite Issues:

• [REL-121] Marketplace live判定にexternal runtime smoke evidenceを必須化する #3650 — require external immutable-tag and moving-v1 pass/block runtime smoke evidence before assuranceGateMarketplace.state=live is valid.
• [REL-130] assurance-gate v1.0.2をreleaseしmoving v1を修正版へ更新する #3651 — prepare and release v1.0.2, smoke the candidate SHA and immutable tag, move v1 to the same commit, then smoke @v1 again.

Updated order for this Issue:

1. Complete [REL-121] Marketplace live判定にexternal runtime smoke evidenceを必須化する #3650.
2. Complete [REL-130] assurance-gate v1.0.2をreleaseしmoving v1を修正版へ更新する #3651 and record the GitHub Release plus external runtime smoke URLs.
3. Publish the Marketplace listing through the release-owner UI path.
4. Add the listing URL and release note evidence.
5. Update docs/operate/publication-evidence.json to live only when the complete contract validates.
6. Update Complete #3598 Phase 4 publication and align the issue record with delivered evidence #3626 and [REL-100] Epic: release readiness を完了し live external validation へ移行する #3637 with the final evidence.

Do not publish the Marketplace listing against the current pre-fix v1 ref, and do not treat action-path resolution as runtime success.