docs(planning): mark Phase 0.5 ✅ — 3-bucket CLAUDE.md migration (Step 4)

Phase 0.5 closed at commit fb500cc. The 3-bucket migration extracted
the Decision Log, Rollback Path + Operational Procedures, and Splunk
Quirks sections from the gitignored CLAUDE.md into 3 tracked
public-facing files under docs/.

Stubs that were created in 376f118 (the original PUBLIC_RELEASE_PLAN
commit) are now replaced with the actual migrated content.

Phase 0 picture after this commit:
  ✅ 9   (0.0, 0.1, 0.2.1, 0.3.1, 0.4, 0.5, 0.6, 0.7, 0.8)
  ⚠️ 2   (0.2 split-into-0.2.1, 0.3 split-into-0.3.1)
  ⬜ 3   (0.9 backup-sync, 0.10 secret-scan, 0.11 prior-work-cleanup)

Step 5 (Phase 0.10 secret scan) is the only remaining row from the
user's "1-5 in steps" run.

Author: wildleo91

docs/PUBLIC_RELEASE_PLAN.md

@@ -2,8 +2,8 @@
 
 > Plan owner: Oleh (@RelativisticJet)
 > Created: 2026-05-13
-> Status: **Phase 0 — Foundation cleanup (in flight; 8 ✅, 2 PARTIAL, 4 pending of 14 rows)**
-> Updated: 2026-05-15 (Phase 0.4 / 0.6 / 0.7 / 0.8 closed)
+> Status: **Phase 0 — Foundation cleanup (in flight; 9 ✅, 2 PARTIAL, 3 pending of 14 rows)**
+> Updated: 2026-05-15 (Phase 0.5 closed — 3-bucket migration)
 
 This document is the canonical plan for taking `wl_manager` from
 private-internal to public open-source on GitHub, then to a listed
@@ -70,7 +70,7 @@ CLAUDE.md split. Purely internal; no external dependencies.
 | 0.3 ⚠️ 2026-05-15 (PARTIAL — see note) | Fix `e2e-smoke.yml` Playwright `undefined` env var failure (Windows binary path appears on Linux runner). **PARTIAL FIX:** commit `e47ad78` replaces the hard-coded `process.env.LOCALAPPDATA + "/ms-playwright/chromium-1208/chrome-win64/chrome.exe"` constant in `tests/e2e/lib_helpers.cjs` and `tests/e2e/test_task8_modularization.mjs` with a platform-aware `resolveChromiumExecutable()` (honors `PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH` → Windows-with-`LOCALAPPDATA` path → `undefined` so playwright-core auto-resolves). Also pins `e2e-smoke.yml` / `e2e-full.yml` / `a11y-audit.yml` to `npx playwright@1.59.1 install ...` so the installed chromium revision matches `playwright-core@1.59.1`. **Result on e47ad78:** workflow run `25920807221` — Smoke 1 ✅ + Smoke 2 ✅ (chromium launch verified working on Linux runner), Smoke 3 ❌ failing at a *different* point: `LC01`/`LC02` rejected by the admin-settings gate ("Creating detection rules is not permitted. An admin must enable it in the Control Panel"), then `bPage.waitForSelector("table.wl-table tbody tr")` at line 155 times out because pending table is empty. This is test-seed pollution analogous to Phase 0.2.1's KV/rate-limit pollution — `setup_test_env.sh` provisions the wladmin1 user/role but doesn't seed `allow_admin_create_rule = true` / `allow_admin_create_csv = true` in Admin Settings. Belongs in a follow-up — see new Phase 0.3.1. | Workflow green | 1-2 hr (env-var fix accurate; test-seed work much larger) |
 | 0.3.1 ✅ 2026-05-15 (commit `6ec9bec`) | Fix `e2e-smoke.yml` Smoke 3 (`test_control_panel_long_content.cjs`) red — separate from 0.3's chromium-launch fix. Triage in the original row was "admin settings KV" but the actual gate was the analyst-side toggles (`allow_analyst_create_rules` / `allow_analyst_create_csv`) plus `require_reason_*_creation` to route to the approval queue and return the `request_id` the test expects. **FIX:** commit `6ec9bec` adds a "Seeding limit config" step to `tests/e2e/setup_test_env.sh` that POSTs `set_daily_limits` as `superadmin1` after user provisioning, enabling the four toggles. Admin paths bypass these gates entirely (`wl_handler.py:2747` / `:2811` — admins execute directly), so the change is safe for admin-running tests. **Acceptance met:** workflow run `25922070685` (HEAD `6ec9bec`) — Smoke 1 ✅ + Smoke 2 ✅ + Smoke 3 ✅; workflow run `25922310733` (HEAD `adfaf91`, the prior planning-commit push) — Smoke 1 ✅ + Smoke 2 ✅ + Smoke 3 ✅. Two consecutive green pushes, no flakiness observed. | `e2e-smoke.yml` green on 2 consecutive pushes | 2-4 hr (actual: ~45 min once the gate path was traced) |
 | 0.4 ✅ 2026-05-15 (`workflow_dispatch` runs `25926028136` / `25926029561` / `25926030716`) | Verify `a11y-audit` / `zap-baseline` / `pip-audit` workflows fire on schedule. All three workflow files were added AFTER their last scheduled fire date (a11y/zap on 2026-05-11, pip-audit on 2026-04-29) so none had auto-fired; manually triggered via `gh workflow run --ref main`. Results: **zap-baseline** clean scan (success); **pip-audit** clean scan (success); **a11y-audit** correctly detects 3 serious findings on the `audit` dashboard + 0 violations on `whitelist_manager` / `control_panel` (workflow conclusion = failure because findings exist, but the workflow itself is healthy — it's the audit-dashboard a11y regressions that need follow-up, NOT the workflow). **Acceptance interpretation:** "at least one successful recent run of each" = each workflow runs to completion and reports correctly. All 3 do. The a11y findings themselves are tracked as a Phase 2.x follow-up (see "Pending findings" footer below). | At least one successful recent run of each | 10 min |
-| 0.5 | CLAUDE.md 3-bucket migration: extract Decision Log → `docs/DECISION_LOG.md`, Operational Procedures + Disaster Recovery + Rollback → `docs/RUNBOOKS.md`, Splunk Quirks → `docs/SPLUNK_QUIRKS.md` | 3 files exist, cross-references in CLAUDE.md updated, doc-drift hook passes | 2-3 hr |
+| 0.5 ✅ 2026-05-15 (commit `fb500cc`) | CLAUDE.md 3-bucket migration: extract Decision Log → `docs/DECISION_LOG.md`, Operational Procedures + Disaster Recovery + Rollback → `docs/RUNBOOKS.md`, Splunk Quirks → `docs/SPLUNK_QUIRKS.md`. Replaced the 3 pre-reserved stub files from commit `376f118` with the actual migrated content (38 / 376 / 45 lines respectively). Cross-references in CLAUDE.md handled as local-only edits since the file is gitignored per D11 ("CLAUDE.md slimmed to personal overlay, stays gitignored"). Doc-drift hook passes on all 28 scanned docs against build 660. **Actual time: ~30 min** (much less than the 2-3 hr estimate — `sed`-based extraction from the gitignored source was straightforward; the heavy lift was in the original drafting of those sections, which already happened months ago). | 3 files exist, cross-references in CLAUDE.md updated, doc-drift hook passes | 2-3 hr |
 | 0.6 ✅ 2026-05-15 (commit `e55e9ab`) | LICENSE: MIT → Apache 2.0 + add NOTICE file. Canonical Apache 2.0 boilerplate from apache.org with "How to apply" appendix carrying `Copyright 2026 Oleh Bezsonov`. NOTICE file carries copyright attribution + Splunk trademark disclaimer (early-landing Phase 2.1 item) + third-party content statement (jQuery/Bootstrap consumed via Splunk runtime, not redistributed). | LICENSE replaced; NOTICE added per Apache 2.0 conventions | 30 min |
 | 0.7 ✅ 2026-05-15 (commit `da5cbc0`) | Copyright holder change from "Security Engineering" to Oleh Bezsonov. Touched `default/app.conf` `[launcher].author` and `docs/Whitelist_Manager_Documentation.md` byline. Deliberately NOT touched: `docs/PUBLIC_RELEASE_PLAN.md` (self-referential historical text) and `docs/Splunk_Admin_Installation_Guide.md` (references a customer-side SOC role named "Security Engineering team", different semantic from this project's authorship). | Single Edit in LICENSE + NOTICE | 5 min |
 | 0.8 ✅ 2026-05-15 (commit `a01aa79`) | `app.conf:version` bump 2.0.0 → 1.0.0-rc1. Both `[launcher].version` and `[id].version` updated (must match per AppInspect 4.2.0). Doc byline in `Whitelist_Manager_Documentation.md` also bumped to match. `[install].build` unchanged — build counters are deploy-cycle monotonic across version bumps. | Version reflects pre-public RC | 5 min |