Add Marketplace Listing contract tests and eligibility boundaries - PR_26152_084-marketplace-listing-contract-tests

Author: ToolboxAid

docs/dev/reports/marketplace_listing_contract_tests_validation.md

@@ -0,0 +1,64 @@
+# Marketplace Listing Contract Tests Validation
+
+PR: `PR_26152_084-marketplace-listing-contract-tests`
+
+## Scope
+
+- Added Marketplace Listing contract definition under `src/shared/contracts`.
+- Added Marketplace Listing fixture scenarios.
+- Added Marketplace Listing targeted contract test suite.
+- Added Marketplace Listing contract specification document.
+- No database, authentication, UI, HTML, CSS, payment, moderation, or runtime implementation changes.
+
+## Commands
+
+| Command | Result |
+| --- | --- |
+| `node --check src/shared/contracts/marketplaceListingContract.js` | PASS |
+| `node --check tests/shared/MarketplaceListingContract.test.mjs` | PASS |
+| `node tests/shared/MarketplaceListingContract.test.mjs` | PASS |
+| `node tests/shared/PublishContract.test.mjs` | PASS |
+| `node tests/shared/ReleaseContract.test.mjs` | PASS |
+| `node tests/shared/ProjectContract.test.mjs` | PASS |
+| `node tests/shared/IdentityPermissionsContract.test.mjs` | PASS |
+| `git diff --name-only -- '*.css' '*.html'` | PASS - no CSS or HTML changes |
+| `git diff --check` | PASS |
+
+## Contract Coverage
+
+Validated Marketplace Listing rules:
+
+- Listing requires owner.
+- Listing requires project.
+- Listing requires source Release.
+- Listing requires source Publish record.
+- Source Publish release linkage must match source Release.
+- Visibility must be one of `private`, `unlisted`, `public`, or `marketplace`.
+- Lifecycle status must be one of `draft`, `listed`, `unlisted`, or `retired`.
+- Listed and retired listings require `listedAt`.
+- Listed listings are immutable unless policy allows edits.
+- Retired listings remain historically referenceable.
+- Marketplace Listing access cannot bypass project ownership, visibility, or permissions.
+
+Validated forbidden leakage:
+
+- Runtime state rejected.
+- Auth state rejected.
+- Payment state rejected.
+- Moderation decision state rejected.
+- Tool state payload leakage rejected.
+
+## Samples Decision
+
+SKIP. This PR only changes shared contract definitions, contract fixtures, contract tests, docs/specs, and reports. Samples are not in scope.
+
+## Playwright
+
+Playwright impacted: No. This PR has no UI, runtime, tool behavior, rendering, or page changes.
+
+## Manual Validation
+
+1. Review `docs/dev/specs/MARKETPLACE_LISTING_CONTRACT.md`.
+2. Review `src/shared/contracts/marketplaceListingContract.js`.
+3. Confirm Marketplace Listing remains metadata-only and does not include runtime, auth, payment, or moderation decision state.
+4. Confirm `docs/dev/reports/codex_review.diff` and `docs/dev/reports/codex_changed_files.txt` exist for review.

docs/dev/specs/MARKETPLACE_LISTING_CONTRACT.md

@@ -0,0 +1,77 @@
+# Marketplace Listing Contract
+
+## Purpose
+
+The Marketplace Listing contract defines the portable listing metadata that connects a published or retired Release and Publish record to marketplace discovery.
+
+Marketplace Listing is not runtime state, authentication state, payment state, or moderation decision state.
+
+## Ownership
+
+- Every Marketplace Listing requires `ownerId`.
+- Every Marketplace Listing requires `projectId`.
+- Marketplace Listing cannot bypass the ownership, visibility, and permission contracts already defined for platform objects.
+- Project remains the persisted ownership container.
+
+## Required Linkage
+
+Marketplace Listing requires:
+
+- `sourceRelease` with `releaseId`, `version`, and optional published/retired status.
+- `sourcePublish` with `publishId`, `releaseId`, and optional published/retired status.
+- `sourcePublish.releaseId` must match `sourceRelease.releaseId`.
+
+## Fields
+
+- `listingId`
+- `ownerId`
+- `projectId`
+- `sourceRelease`
+- `sourcePublish`
+- `visibility`
+- `status`
+- `listedAt`
+- `listingTitle`
+- `listingSummary`
+
+## Visibility
+
+Allowed Marketplace Listing visibility states:
+
+- `private`
+- `unlisted`
+- `public`
+- `marketplace`
+
+Marketplace and public listings are visible to public viewers. Private listings require owner or granted project access.
+
+## Lifecycle Status
+
+Allowed Marketplace Listing lifecycle states:
+
+- `draft`
+- `listed`
+- `unlisted`
+- `retired`
+
+Listed and retired listings require `listedAt`. Listed and retired listings are immutable unless an explicit policy allows edits.
+
+## Forbidden State
+
+Marketplace Listing records must not contain:
+
+- runtime state
+- auth state
+- payment state
+- moderation decision state
+- tool state payloads
+
+Moderation and payment systems may link to Marketplace Listing later, but their decisions and transaction state do not live in the Marketplace Listing contract.
+
+## Non-Goals
+
+- No database implementation.
+- No authentication implementation.
+- No payment implementation.
+- No moderation implementation.
+- No UI or runtime behavior changes.