docs(planning): mark Phase 0.0 / 0.9 / 0.11 ✅ — Phase 0 COMPLETE

12 ✅, 2 PARTIAL-by-intentional-split, 0 pending of 14 rows.

Row updates in this commit:
- 0.0 ✅ retroactively (commit d8aff63, 2026-04-02): AppInspect dry-run
  was completed long before Phase 0 was formally named; findings at
  docs/APPINSPECT_NOTES.md ("PASS (Standard tag set clean)"). Row had
  an undocumented-but-completed status — caught during the Step-5+
  sweep when QA flagged "2 pending of 14" header drift (actual: 3
  rows unmarked). Marking ✅ resolves the drift accurately.
- 0.9 ✅ (backup-repo commit 53559ed, 2026-05-15): CLAUDE.md backup
  sync to relativisticjet-dev-knowledge-base. Discovered the file
  already existed there from a prior push; this is an update sync,
  not a first sync. Sync mechanism documented (gh api PUT contents
  via stdin'd JSON to avoid bash arg-length on 114KB base64).
- 0.11 ✅ across commits b579d44 (Step 3b in §8) + fb5f8f0 (Tag-cut
  pre-flight §3.5) + investigation-only-closure on the
  wl_expiration_cleanup.py 401 finding (issue already mitigated in
  code, no commit needed).

Phase 0 picture (final):
  ✅  0.0 AppInspect de-risk
  ✅  0.1 validate-and-package green (first ever; 675116a closed it)
  ⚠️  0.2 PARTIAL — work split to 0.2.1
  ✅  0.2.1 integration-tests green (8 consecutive)
  ⚠️  0.3 PARTIAL — work split to 0.3.1
  ✅  0.3.1 e2e-smoke green (3 consecutive)
  ✅  0.4 scheduled workflows verified
  ✅  0.5 3-bucket CLAUDE.md migration
  ✅  0.6 LICENSE Apache 2.0 + NOTICE
  ✅  0.7 copyright Oleh Bezsonov
  ✅  0.8 version 1.0.0-rc1
  ✅  0.9 CLAUDE.md backup sync
  ✅  0.10 git history secret-scan clean
  ✅  0.11 prior-work TODOs closed (a/b/c)

The two ⚠️ PARTIAL rows are intentional documentation choices, not
incomplete work — the underlying scope shipped via 0.2.1 and 0.3.1.

**Phase 0 acceptance criteria from PUBLIC_RELEASE_PLAN.md §3 — met:**
- All 10 existing CI workflows green on a clean push (validate-and-package
  finally green at 7ef42da; integration-tests / e2e-smoke / ci /
  semgrep all green; pip-audit / zap-baseline / a11y-audit verified
  via workflow_dispatch).
- CLAUDE.md slim (Phase 0.5 migration banner + 3 tracked docs in repo).
- 3 new docs/ files (DECISION_LOG / RUNBOOKS / SPLUNK_QUIRKS) exist;
  doc-drift hook validates them.
- Apache 2.0 LICENSE in place with Oleh Bezsonov as copyright holder.
- app.conf:version = 1.0.0-rc1.
- Backup repo CLAUDE.md mirror live at 53559ed.
- Git history confirmed clean (Phase 0.10 secret scan).

Next phase: Phase 1 (AppInspect risk discovery — D2/D7 timeline-flex).

Author: wildleo91

docs/PUBLIC_RELEASE_PLAN.md

@@ -2,8 +2,8 @@
 
 > Plan owner: Oleh (@RelativisticJet)
 > Created: 2026-05-13
-> Status: **Phase 0 — Foundation cleanup (in flight; 10 ✅, 2 PARTIAL, 2 pending of 14 rows)**
-> Updated: 2026-05-15 (Phase 0.10 closed — git history secret-scan clean)
+> Status: **Phase 0 — Foundation cleanup COMPLETE (12 ✅, 2 PARTIAL by intentional split, 0 pending of 14 rows)**
+> Updated: 2026-05-15 (Phase 0.0 / 0.9 / 0.11 closed — Phase 0 acceptance gate met)
 
 This document is the canonical plan for taking `wl_manager` from
 private-internal to public open-source on GitHub, then to a listed
@@ -63,7 +63,7 @@ CLAUDE.md split. Purely internal; no external dependencies.
 
 | # | Task | Acceptance | Est. |
 |---|------|------------|------|
-| 0.0 | **De-risk Phase 1 FIRST** — install `splunk-appinspect` locally (`pip install splunk-appinspect`), run against the current `.spl` with both `cloud` and `splunk-platform-standalone` profiles, record findings. Decides whether Phase 1 is "trivial" or "multi-week refactor" BEFORE committing the rest of Phase 0. If findings are catastrophic, escalate to user before continuing. | Findings summary written; Phase 1 effort-class estimated | 30-60 min |
+| 0.0 ✅ 2026-04-02 (commit `d8aff63`; findings at `docs/APPINSPECT_NOTES.md`) | **De-risk Phase 1 FIRST** — install `splunk-appinspect` locally (`pip install splunk-appinspect`), run against the current `.spl` with both `cloud` and `splunk-platform-standalone` profiles, record findings. Decides whether Phase 1 is "trivial" or "multi-week refactor" BEFORE committing the rest of Phase 0. If findings are catastrophic, escalate to user before continuing. **Outcome:** AppInspect dry-run completed 2026-04-02 (commit `d8aff63` "feat(08-01): audit codebase for AppInspect compliance and add validation targets"); findings persisted to `docs/APPINSPECT_NOTES.md`. Status documented there as "PASS (Standard tag set clean)". This row had an undocumented-but-completed status — caught during the Step-5+ Phase 0 sweep and marked ✅ retroactively. | Findings summary written; Phase 1 effort-class estimated | 30-60 min |
 | 0.1 ✅ 2026-05-15 (commits `7d4765a` + `675116a` — see correction note) | Fix `validate-and-package.yml`. **Commit `7d4765a` (2026-05-14)** bumped `actions/upload-artifact` v3→v4 and `actions/checkout` v3→v4 — necessary for forward-compat with the 2026 GitHub Actions deprecation, audited all 10 workflows in `.github/workflows/` confirming none of the other 9 still on v3. **But this fix was cosmetic** and did NOT unblock the workflow: the FIRST step in the YAML, "Set up Bash environment", had been running `apt-get install bash` without sudo since 2026-03-22 (commit `219355e`, when the workflow file was originally added), which fails on `ubuntu-latest` runners — so the workflow never reached the action-version-pinned steps. `gh run list --workflow=validate-and-package.yml` showed 0 success runs in 30+ historical attempts. **Commit `675116a` (2026-05-15)** removes the broken step entirely (bash is pre-installed on the runner image; the apt-get step was unnecessary as well as broken) and adds an inline comment documenting the 2-month-long failure pattern. The original ✅ marker on this row was therefore incorrect; corrected as part of the Step-5+ Phase 0.1 redo. | Workflow green on next push | 15 min |
 | 0.2 ⚠️ 2026-05-14 (PARTIAL — see note) | Fix `ci.yml` + `integration-tests.yml` pytest/Python mismatch (pytest 9.x requires Python ≥3.10; CI uses 3.9). **PARTIAL FIX:** bumped Python 3.9 → 3.11 in 4 places (ci.yml × 2, integration-tests.yml, release.yml) in commit `1fe4f92`; fixed 2 unmasked mock bugs in `tests/unit/test_limits.py` in commit `c5c08d1`. **Result on c5c08d1:** `ci.yml` GREEN (4/4 jobs); `integration-tests.yml` STILL FAILING — 23 fails + 220 errors. The integration-tests failures are NOT the Python mismatch alone; the round-7 install failure was masking a large body of pre-existing infrastructure debt: Splunk container 10-s curl-timeout under chaos load, KV-state pollution between tests, rate-limit state leaking across the suite, and one Python-version issue (pytest 9 dropped `pytest.skip(msg=dict)`). These need their own phase — see new Phase 0.2.1. | Both workflows green. Decision documented: cap pytest at ≤8.4.x OR upgrade workflow Python to 3.10+ | 30 min (Phase 0.2 estimate accurate for the mismatch fix itself; 0.2.1 scope much larger) |
 | 0.2.1 ✅ 2026-05-14 (first green at `26933aa`; `53876d4` final QA-clean) | Fix `integration-tests.yml` red — separate from 0.2's Python bump. Triage: (a) `pytest.skip(msg=dict)` → `pytest.skip(reason=str)` migrations (pytest 9 API), (b) chaos-test docker curl timeout 10s → ≥30s for GitHub-Actions runners, (c) container_state fixture KV/sentinel cleanup race (Ring 2 Day 7 work), (d) rate-limit state pollution between RBAC-matrix tests. **FIX:** commit `b7e3429` replaced bind-mount-busting `rm -rf $LOOKUPS_DIR` with `find $LOOKUPS_DIR -mindepth 1 -delete` in `tests/integration/conftest.py :: _restore_container_state` — eliminated all 220 teardown errors. Commit `ccb37fc` closed the remaining 4 categories of failures (audit-POST 401 swallow, baseline-set skip, RBAC permission-string variants, chaos timing tolerance). Commit `26933aa` (QA #11 HIGH) replaced timeout bump with state-poll in `test_chaos_fim_dual_store.py :: test_kv_missing_silent_rebuild_from_fs`. Commit `53876d4` (QA #12 MEDIUM) dropped redundant `import time as _time` style nit. **Result:** 7 consecutive `integration-tests.yml` green runs from `26933aa` through current HEAD `035a390` (last red: `ccb37fc`). Acceptance: 358 passed, 8 skipped, 0 errors, 0 failed. | `integration-tests.yml` green on 2 consecutive pushes | 4-8 hr |
@@ -74,9 +74,9 @@ CLAUDE.md split. Purely internal; no external dependencies.
 | 0.6 ✅ 2026-05-15 (commit `e55e9ab`) | LICENSE: MIT → Apache 2.0 + add NOTICE file. Canonical Apache 2.0 boilerplate from apache.org with "How to apply" appendix carrying `Copyright 2026 Oleh Bezsonov`. NOTICE file carries copyright attribution + Splunk trademark disclaimer (early-landing Phase 2.1 item) + third-party content statement (jQuery/Bootstrap consumed via Splunk runtime, not redistributed). | LICENSE replaced; NOTICE added per Apache 2.0 conventions | 30 min |
 | 0.7 ✅ 2026-05-15 (commit `da5cbc0`) | Copyright holder change from "Security Engineering" to Oleh Bezsonov. Touched `default/app.conf` `[launcher].author` and `docs/Whitelist_Manager_Documentation.md` byline. Deliberately NOT touched: `docs/PUBLIC_RELEASE_PLAN.md` (self-referential historical text) and `docs/Splunk_Admin_Installation_Guide.md` (references a customer-side SOC role named "Security Engineering team", different semantic from this project's authorship). | Single Edit in LICENSE + NOTICE | 5 min |
 | 0.8 ✅ 2026-05-15 (commit `a01aa79`) | `app.conf:version` bump 2.0.0 → 1.0.0-rc1. Both `[launcher].version` and `[id].version` updated (must match per AppInspect 4.2.0). Doc byline in `Whitelist_Manager_Documentation.md` also bumped to match. `[install].build` unchanged — build counters are deploy-cycle monotonic across version bumps. | Version reflects pre-public RC | 5 min |
-| 0.9 | CLAUDE.md backup sync: first push of slim CLAUDE.md to `relativisticjet-dev-knowledge-base/projects/wl_manager/CLAUDE.md` | First sync committed in the backup repo. Sync mechanism documented (manual / cron / git hook — user's preference) | 30 min |
+| 0.9 ✅ 2026-05-15 (backup-repo commit `53559ed`) | CLAUDE.md backup sync: pushed wl_manager-side CLAUDE.md (with the new Phase 0.5 migration banner at the top pointing readers to `docs/DECISION_LOG.md` / `docs/RUNBOOKS.md` / `docs/SPLUNK_QUIRKS.md`) to `relativisticjet-dev-knowledge-base/projects/wl_manager/CLAUDE.md`. **NOT a first sync** — discovered the backup file already existed at SHA `dc9fe369` from a prior unrelated push, so this is an update sync. **Sync mechanism documented:** `gh api -X PUT contents/...` with the payload constructed via stdin'd JSON (avoids the bash argument-length limit on the ~114KB base64-encoded body). Manual cadence — pushed when wl_manager CLAUDE.md has substantive changes worth preserving, not on every edit. | First sync committed in the backup repo. Sync mechanism documented (manual / cron / git hook — user's preference) | 30 min |
 | 0.10 ✅ 2026-05-15 (scan documented in PR review of HEAD) | `git log --all -p` secret scan across all 456 commits / 17 MB of diff history. Scanned 14 high-confidence patterns (PEM private keys, AWS AKIA, AWS secret-access-key assignments, GitHub PAT/OAuth/server/refresh tokens, Slack `xoxX-`, Stripe `sk_live_`/`sk_test_`, 3-segment JWTs, GitLab `glpat-`, npm `npm_`, Splunk HEC-token-UUID) and 5 generic-pattern fallbacks. **High-confidence hits: 0 across all 14 patterns.** Generic-pattern hits: 1 `password="..."` (the `api_call()` helper's default `password="Chang3d!"`, the documented Splunk dev-container admin password) and 3 `token="..."` (Splunk SimpleXML **dashboard-variable** tokens — `general_action_display`, `admin_action_display`, `drilldown_analyst` — Splunk lingo for dashboard state, NOT credentials). No `.env` / `.pem` / `.key` / `.p12` / `.pfx` / `.jks` / `.keystore` files ever committed. **Decision (per Phase 0.10 acceptance footer): ACCEPT — no `git filter-repo` rewrite needed.** `Chang3d!` is a known-dev-credential by design (Splunk Docker container demo password, documented in INSTALLATION + CLAUDE.md, used by 30+ dev/test/docs files); users running the demo container are instructed to change it before any production exposure. | No accidental credentials in history. Or — if found — decision documented (filter-repo vs accept) | 30 min |
-| 0.11 | Close prior-work TODOs that fit Phase 0 scope: `wl_expiration_cleanup.py` 401 investigation, `scripts/package.sh` version-tag drift, Step 3b permanent add to RELEASE_CHECKLIST §8 | Each closed as atomic commit | 2-3 hr |
+| 0.11 ✅ 2026-05-15 (3 sub-items closed across commits — see breakdown) | Close prior-work TODOs that fit Phase 0 scope. **0.11a — `wl_expiration_cleanup.py` 401 investigation:** the issue is **already mitigated in code** at `bin/wl_expiration_cleanup.py:50-67` — file-level comments document the failure mode (splunkd recycles scripted-input session tokens around restarts, producing transient 401), and the mitigation is shipped: `_recovery_log.jsonl` fallback path is auto-indexed via the `wl_audit_recovery` monitor input so failed audit POSTs still land in `index=wl_audit sourcetype=wl_audit_recovery`, PLUS `AUDIT_POST_RETRIES = 2` with 1-second sleep catches the common sub-second race. No code change needed — closure by investigation. **0.11b — `scripts/package.sh` version-tag drift, commit `fb5f8f0`:** added `## 3.5. Version-Tag Consistency (pre-flight before git tag)` section to `docs/RELEASE_CHECKLIST.md` per the 2026-05-13 Sigstore dry-run side-finding. 12-line bash check verifies `app.conf` `[launcher].version` and `[id].version` match the intended tag (with leading `v` stripped) before any `git tag` is cut. **0.11c — Step 3b permanent add to RELEASE_CHECKLIST §8, commit `b579d44`:** inserted `### Step 3b — Foreign-signature identity-pin test (rigor extension)` in §8 between Step 3 (signature-integrity tamper test) and Step 4 (Rekor lookup). Proves that the `--certificate-identity-regexp` pin is a SEPARATE security boundary from signature integrity by attempting to verify a known-good `sigstore/cosign` release asset against this repo's identity regex. §8 Acceptance line updated to "Steps 2+3+3b+4 all produced the expected outcomes". | Each closed as atomic commit | 2-3 hr |
 
 **Phase 0 acceptance**:
 - All 10 existing CI workflows green on a clean push