Prepare Marketplace playbook and five Sheets add-on candidates

[karlwaldman]

Summary

• add the Marketplace/OAuth launch playbook, public YouTube acquisition plan, and five distinct Sheets portfolio source candidates
• reconcile all release records with the verified public original listing (Apps Script v11/runtime 1.2.2) and the 1.3.1 candidate gate
• keep the five portfolio listings unsubmitted and sequence them one at a time
• harden every candidate against cross-spreadsheet legacy-key reuse and use the canonical X-API-Client attribution header
• add unique product logic, Marketplace assets, reviewer guides, submission checklists, and source-level workbook build tests

Red-green proof

• RED: main merge produced five release-truth conflicts; resolved to current public evidence
• RED: portfolio request test expected canonical X-API-Client and received no value; GREEN after runtime/generator/live-smoke update
• RED: an unscoped prototype key authorized sheet A and sheet B; GREEN after failing closed and documenting reconfiguration
• RED: YouTube UTM/timeline regressions failed; GREEN with per-video CTA identifiers plus Day 30 interim/Day 90 final checkpoints
• RED: remote clone proved the July immutable candidates differ from the hardened source; those versions are now explicitly superseded and every current package says new immutable version required

Verification

• npm ci
• npm audit --audit-level=moderate -> 0 vulnerabilities
• npm run validate -> 98/98; package, assets, portfolio, claims, and secret scan green
• npm run portfolio:verify:links -> 10/10 HTTP 200
• npx clasp --version -> 3.3.0
• git diff --check
• hosted validation is required on exact head c234fe8

Release state

The original Marketplace listing remains public on immutable version 11/runtime 1.2.2. This PR does not change that configuration.

The five July portfolio immutable versions are historical only because they contain the retired unscoped credential fallback and old attribution header. None of the five products has been submitted to Google Workspace Marketplace. After merge, cut a new immutable version from exact main, repeat the non-customer live smoke, remotely verify byte equality, and only then start the Crack Spread Lab draft.

Tracking

• relates to [Release] Google v13 pin and clean-install certification #20
• follows up Produce a public OilPriceAPI Google Sheets tutorial for YouTube discovery #24 and Complete staged Google Console drafts for five Sheets add-ons #25

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR updates Marketplace and OAuth release records for runtime 1.2.2 and immutable Apps Script version 11, adds launch and YouTube promotion playbooks, revises portfolio release sequencing, and synchronizes public-claims tests with the updated submission state.

Changes

Marketplace release and promotion

Layer / File(s)	Summary
Immutable release and Marketplace state DEPLOYMENT_GUIDE.md, MARKETPLACE_LISTING.md, OAUTH_VERIFICATION.md, README.md	Updates runtime/version records, OAuth and Marketplace statuses, submission sequencing, and publication guidance.
Marketplace launch playbook GOOGLE_MARKETPLACE_PLAYBOOK.md, DEPLOYMENT_GUIDE.md	Documents deployment scopes, credential contexts, reviewer fixtures, video requirements, verification steps, automation boundaries, and evidence packets.
Public YouTube promotion contract YOUTUBE_PROMOTION.md, PORTFOLIO.md, README.md	Defines public-video production, branding, search packaging, tracked links, analytics constraints, and a 30-day launch test.
Portfolio rollout and claims validation PORTFOLIO.md, test/public-claims.test.js	Updates portfolio release ordering and validates the new runtime, OAuth status, Marketplace state, and YouTube link.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• [Release] Google v13 pin and clean-install certification #20 — Tracks the same OAuth/Marketplace submission state, release evidence, reviewer guidance, and receipt preservation.

Possibly related PRs

• OilpriceAPI/google-sheets-addin#14 — Updates the same Marketplace submission and OAuth-scope documentation surfaces.
• OilpriceAPI/google-sheets-addin#16 — Modifies the related Marketplace/OAuth release documentation and public-claims expectations.
• OilpriceAPI/google-sheets-addin#21 — Updates the same release-state documents and consistency tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main Marketplace playbook work and the preparation of five Sheets add-on candidates.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/google-marketplace-playbook

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@YOUTUBE_PROMOTION.md`:
- Around line 125-129: Update both YouTube promotion URL examples so their
utm_content values include the specific video identifier alongside the CTA
suffix: use the <video-id>_overview_demo pattern for the “Start here” link and
<video-id>_signup_cta for the account signup link, preserving the existing other
UTM parameters.
- Around line 184-205: Clarify the evaluation timeline in the “30-day launch
test” section by explicitly defining Day 30 as an interim review and Day 90 as
the final success decision, while preserving the existing 90-day thresholds and
follow-up actions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 16a293e8-5f04-4820-a8f3-9f2f05311f5b

📥 Commits

Reviewing files that changed from the base of the PR and between 3747fef and e5f2290.

📒 Files selected for processing (8)

• DEPLOYMENT_GUIDE.md
• GOOGLE_MARKETPLACE_PLAYBOOK.md
• MARKETPLACE_LISTING.md
• OAUTH_VERIFICATION.md
• PORTFOLIO.md
• README.md
• YOUTUBE_PROMOTION.md
• test/public-claims.test.js