release(v1.0.7): comma-conjunction "8.1.0, <10.0.0" + NEW syntax error class catalogued

v1.0.6's space-conjunction ">=8.1.0 <10.0.0" was rejected by SLIM
with a fundamentally NEW error class:

    manifest.platformRequirements.splunk.Enterprise: Illegal version
    specification: >=8.1.0 <10.0.0

The wording "Illegal version specification" is structurally distinct
from the prior "no supported version" content-class wording. SLIM
could not PARSE the space form. The Splunkbase AI explainer for this
failure explicitly recommends the comma form.

Retroactive Phase 1.7 disambiguation: Phase 1.7's ">=9.0,<10.0"
(comma) was rejected with the "no supported version" content wording,
NOT "Illegal version specification". This empirically proves the
comma syntax PARSES correctly; Phase 1.7's rejection was content-based
all along.

Cloud Classic supported-list shape narrows further: combining
Phase 1.7's content rejection of [9.0.0, 10.0.0) and v1.0.5's content
rejection of [9.0.0, infinity), the supported list is entirely BELOW
9.0.0 - i.e., 8.x only. This matches the AI's 8.1.0 floor hint.

Three error classes for check_that_app_passes_slim_validation_for_cloud
now empirically catalogued:
  - type: "Expected String value" (v1.0.2 list form)
  - syntax: "Illegal version specification" (v1.0.6 space form, NEW)
  - content: "no supported version of Splunk Enterprise" (F13/F15/F16/F17)

What changed:
- app.manifest: Enterprise from ">=8.1.0 <10.0.0" (space) to
  ">=8.1.0, <10.0.0" (comma, AI's literal recommendation);
  info.id.version 1.0.6 -> 1.0.7; releaseDate 2026-06-05.
- default/app.conf: build = 677; [launcher].version = [id].version
  = 1.0.7.
- appserver/static/whitelist_manager.js:14: urlArgs: "_b=677"
  (auto-applied by scripts/hooks/urlargs-sync.js).
- docs/SPLUNK_10_COMPATIBILITY.md: Runtime Verification section
  extended with v1.0.6 finding (NEW syntax class) + Phase 1.7
  retroactive disambiguation + cumulative format history + three
  known error classes catalogued.
- docs/APPINSPECT_FINDINGS.md §7.10: 2026-06-05 evening run F18 +
  v1.0.7 trial details + three-error-class table.
- docs/DECISION_LOG.md 2026-06-05 row 2 (evening): documents the
  comma-syntax correction + Phase 1.7 retroactive disambiguation +
  narrowed Cloud Classic shape inference (8.x only). Two new
  maintenance lessons: SLIM uses COMMA conjunction (not space);
  three distinct error wordings for the same SLIM check.
- CLAUDE.md "Splunk Version Pinning Audit" log: new row correcting
  the 2026-06-05 morning row's wrong "space-conjunction" maintenance
  rule. Five consecutive corrections in 4 days demonstrate empirical
  discovery is the right method for a poorly-documented external
  system.

Three outcomes possible:

1. SLIM accepts ">=8.1.0, <10.0.0" -> first ACCEPTED semver-range
   entry in cumulative history; pin to comma-form bounded ranges
   permanently. Cleanup commit fixes all prior format claims.
2. SLIM rejects with "no supported version" -> Cloud Classic's list
   is narrower than [8.1.0, 10.0.0); next move is Splunkbase
   publisher support ticket (documented escalation path).
3. SLIM rejects with another unprecedented wording -> new error class
   to catalogue; careful analysis before next iteration.

Honesty note: 7th release attempt in 5 days. The iterate-and-test
discovery method has produced 7 distinct empirical data points
(F13-F18 + v1.0.0 pre-release). The cumulative SLIM format history
table in docs/SPLUNK_10_COMPATIBILITY.md is now the canonical
single-source-of-truth for what SLIM accepts/rejects; future
maintainers should read it before re-attempting any prior-rejected
format.

Verification:
- bash scripts/validate.sh -> ALL CHECKS PASSED (2 warnings)
- bash scripts/preflight-tag.sh v1.0.7 -> OK (all 4 sources at 1.0.7)
- bash scripts/pre-commit-doc-drift.sh -> OK (49 docs vs build 677)
- Local AppInspect re-run skipped (Docker not running). The next
  Splunkbase upload of wl_manager-1.0.7.spl is the empirical test.

Author: RelativisticJet

CHANGELOG.md

@@ -4,6 +4,102 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [1.0.7] - 2026-06-05
+
+**Syntax fix — comma conjunction instead of space.** No app-code or
+behavior changes — manifest + version-bump only.
+
+### Major analytical finding from v1.0.6
+
+v1.0.6 declared `">=8.1.0 <10.0.0"` (space-separated). SLIM rejected
+with a **new error class**:
+
+> manifest.platformRequirements.splunk.Enterprise: **Illegal version
+> specification**: >=8.1.0 <10.0.0
+
+The wording "Illegal version specification" is fundamentally different
+from the prior "no supported version" wording. This is a **syntax
+error**, not a content error.
+
+**This retroactively disambiguates Phase 1.7's `">=9.0,<10.0"`
+rejection.** That earlier failure used "no supported version" wording
+(content class), which means **comma-conjunction syntax parses
+correctly** — Phase 1.7's rejection was content-based all along (no
+version in `[9.0.0, 10.0.0)` matched Cloud Classic's supported list
+at that time).
+
+### Cloud Classic supported-list narrows further
+
+Combining all empirical evidence:
+
+- Phase 1.7's `">=9.0,<10.0"` (comma) → content-rejected → **no
+  version in `[9.0.0, 10.0.0)` was on the supported list**
+- v1.0.5's `">=9.0.0"` (open floor) → content-rejected → **no
+  version in `[9.0.0, ∞)` is on the supported list**
+
+Therefore: **Cloud Classic's supported list is entirely BELOW 9.0.0**
+— i.e., 8.x only. This matches Splunkbase AI's 8.1.0 floor hint.
+
+### What v1.0.7 is testing
+
+The same range as v1.0.6 (`">=8.1.0"` through `<10.0.0"`) but using
+the **comma conjunction** the AI explicitly recommended:
+
+> "The Packaging Toolkit requires multiple constraints to be
+> comma-separated (`">=8.1.0, <10.0.0"`). The space-only separation
+> is parsed as an illegal version specification."
+
+If the range `[8.1.0, 10.0.0)` contains any version on Cloud
+Classic's supported list (and the 8.1.0 floor strongly implies it
+does), SLIM should now accept.
+
+### What changed since v1.0.6
+
+| File | Change |
+|---|---|
+| `app.manifest` | `Enterprise` from `">=8.1.0 <10.0.0"` (space) to `">=8.1.0, <10.0.0"` (comma, AI's literal recommended form); `info.id.version` 1.0.6 → 1.0.7; `releaseDate` 2026-06-05 |
+| `default/app.conf` | `[install].build` 676 → 677; `[launcher].version` + `[id].version` 1.0.6 → 1.0.7 |
+| `appserver/static/whitelist_manager.js` | `urlArgs: "_b=677"` (auto-synced) |
+| `docs/SPLUNK_10_COMPATIBILITY.md` | Runtime Verification: 2026-06-05 evening section — syntax-vs-content disambiguation; Phase 1.7 re-interpretation; cumulative format history updated with v1.0.6 syntax-class error |
+| `docs/APPINSPECT_FINDINGS.md` §7.10 | 2026-06-05 evening F18 (syntax-class error) |
+| `docs/DECISION_LOG.md` 2026-06-05 row 2 | Documents the comma-syntax fix + the Phase 1.7 retroactive disambiguation + the narrowed Cloud Classic shape inference (8.x only) |
+| `CLAUDE.md` | Audit-log row with syntax-discovery + Phase 1.7 re-read |
+| `CHANGELOG.md` | This entry |
+
+### Updated cumulative SLIM format history
+
+| Format | Error class | Result | Release |
+|---|---|---|---|
+| `">=9.0.0"` | content | REJECTED | v1.0.0 pre-release; v1.0.5 |
+| `">=9.0,<10.0"` | **content** (re-classified 2026-06-05 eve) | REJECTED | v1.0.0-rc Phase 1.7 |
+| `"9.3"` | (no error then) | ACCEPTED-then-RETIRED | v1.0.0, v1.0.1 |
+| `["9.4", "10.0"]` | type | REJECTED | v1.0.2 |
+| `"10.0"` | content | REJECTED | v1.0.3 |
+| `"9.4"` | content | REJECTED | v1.0.4 |
+| `">=9.0.0"` | content | REJECTED | v1.0.5 |
+| `">=8.1.0 <10.0.0"` (space) | **syntax** (NEW class) | REJECTED | v1.0.6 |
+| `">=8.1.0, <10.0.0"` (comma) | empirical test | (this release) | v1.0.7 |
+
+### Three outcomes possible
+
+1. **SLIM accepts** — first accepted semver-range entry; future
+   releases pin to comma-form bounded ranges and stop the
+   version-retirement treadmill. Cleanup commit corrects all prior
+   docs.
+2. **SLIM rejects with "no supported version: >=8.1.0, <10.0.0"** →
+   Cloud Classic's list is even narrower than `[8.1.0, 10.0.0)`;
+   possibly only specific 8.x patches. Next move = Splunkbase
+   publisher support ticket (the documented escalation path).
+3. **SLIM rejects with another syntax class** — unexpected; would
+   indicate further AI guidance is needed.
+
+### What did not change
+
+- All app code, dashboards, RBAC.
+- Sigstore signing chain.
+
+---
+
 ## [1.0.6] - 2026-06-05
 
 **Bounded-range trial after v1.0.5 confirmed SLIM parses semver ranges

app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null,
       "name": "wl_manager",
-      "version": "1.0.6"
+      "version": "1.0.7"
     },
     "author": [
       {
@@ -36,7 +36,7 @@
   "incompatibleApps": null,
   "platformRequirements": {
     "splunk": {
-      "Enterprise": ">=8.1.0 <10.0.0"
+      "Enterprise": ">=8.1.0, <10.0.0"
     }
   },
   "supportedDeployments": [

appserver/static/whitelist_manager.js

@@ -11,7 +11,7 @@
 // disk cache. Splunk serves /static/@<server-hash>/... with Cache-Control:
 // public, max-age=31536000; without urlArgs, bumped build numbers don't force
 // a re-fetch and clients run stale JS until they hard-refresh.
-require.config({ urlArgs: "_b=676" });
+require.config({ urlArgs: "_b=677" });
 require([
     "jquery",
     "underscore",

default/app.conf

@@ -5,20 +5,20 @@
 
 [install]
 is_configured = false
-build = 676
+build = 677
 
 [launcher]
 author       = Oleh Bezsonov
 description  = Manage detection-rule CSV whitelists with inline editing, approval workflows, version control, and diff-based audit trail
-version      = 1.0.6
+version      = 1.0.7
 
 [ui]
 is_visible = true
 label      = Whitelist Manager
 
 [id]
 name              = wl_manager
-version           = 1.0.6
+version           = 1.0.7
 
 # AppInspect 4.2.0 has both `check_for_valid_package_id` (looks at the
 # new [id] stanza) and `check_for_updates_disabled` (looks at the

docs/APPINSPECT_FINDINGS.md

@@ -902,6 +902,94 @@ list.
 
 ---
 
+## 7.10 v1.0.6 Splunkbase upload — NEW error class: "Illegal version specification" (2026-06-05 evening → v1.0.7 trial)
+
+**Background**: v1.0.6 declared `">=8.1.0 <10.0.0"` (space conjunction
+per the 2026-06-05 morning AI explainer's literal example). SLIM
+rejected with:
+
+> manifest.platformRequirements.splunk.Enterprise: **Illegal version
+> specification**: >=8.1.0 <10.0.0
+
+| # | Class | File | Stanza | Setting / message |
+|---|-------|------|--------|------------------|
+| **F18** | **HARD ERROR (syntax)** | `app.manifest` | `platformRequirements.splunk.Enterprise` | "Illegal version specification: >=8.1.0 <10.0.0" |
+
+**Headline numbers**: 162 success / **1 failure** / 0 future / 0 errors
+/ 5 warnings / 79 N/A / 0 skipped. Byte-identical totals to all prior
+runs.
+
+**F18 — NEW error class discovered**: this is the first occurrence
+of "Illegal version specification" wording in our format history.
+Fundamentally different from the prior "no supported version"
+content-class wording. SLIM could not PARSE the space-conjunction
+form. The space form is type/syntax-rejected; the comma form is
+required.
+
+**Retroactive Phase 1.7 disambiguation**: Phase 1.7's `">=9.0,<10.0"`
+(comma form) was rejected with the "no supported version" content
+wording — NOT "Illegal version specification". This proves the
+comma syntax parses correctly; Phase 1.7's rejection was content-based
+(no version in `[9.0.0, 10.0.0)` matched Cloud Classic's supported
+list at that time). The 2026-06-05 morning Runtime Verification's
+hypothesis is now empirically confirmed.
+
+**Cloud Classic shape narrows further**: combining Phase 1.7's
+content rejection of `[9.0.0, 10.0.0)` and v1.0.5's content rejection
+of `[9.0.0, ∞)`, the supported list is entirely BELOW 9.0.0 —
+i.e., 8.x only. Matches Splunkbase AI's 8.1.0 floor hint.
+
+**Resolution (v1.0.7, commit pending)**:
+
+- `app.manifest`: `Enterprise` from `">=8.1.0 <10.0.0"` (space) to
+  `">=8.1.0, <10.0.0"` (comma, AI's literal recommended form from
+  the v1.0.6 explainer).
+- `app.manifest`: `info.id.version` 1.0.6 → 1.0.7; `releaseDate`
+  2026-06-05.
+- `default/app.conf`: `build = 677`; `[launcher].version =
+  [id].version = 1.0.7`.
+- `appserver/static/whitelist_manager.js:14`: `urlArgs: "_b=677"`
+  (auto-applied).
+- `docs/SPLUNK_10_COMPATIBILITY.md` Runtime Verification: 2026-06-05
+  evening section + cumulative format history updated with v1.0.6
+  finding (NEW syntax error class) + Phase 1.7 retroactive
+  disambiguation.
+
+**Disposition**: **F18 testing-in-v1.0.7**.
+
+**Three known error classes for `check_that_app_passes_slim_validation_for_cloud`**:
+
+| Wording | Class | First seen |
+|---|---|---|
+| "Expected String value, not [...]" | type | v1.0.2 (F14) |
+| "Illegal version specification: <value>" | syntax | v1.0.6 (F18) |
+| "Version requirement includes no supported version of Splunk Enterprise: <value>" | content | v1.0.0-rc Phase 1.7 |
+
+**Updated cumulative format history**:
+
+| Format | Error class | Result | Release |
+|---|---|---|---|
+| `">=9.0.0"` | content | REJECTED | v1.0.0 pre-release; v1.0.5 (F17) |
+| `">=9.0,<10.0"` | content (re-classified) | REJECTED | v1.0.0-rc Phase 1.7 |
+| `"9.3"` | (no error then) | ACCEPTED-then-RETIRED | v1.0.0, v1.0.1 |
+| `["9.4", "10.0"]` | type | REJECTED | v1.0.2 (F14) |
+| `"10.0"` | content | REJECTED | v1.0.3 (F15) |
+| `"9.4"` | content | REJECTED | v1.0.4 (F16) |
+| `">=8.1.0 <10.0.0"` (space) | **syntax** | REJECTED | v1.0.6 (F18) |
+| `">=8.1.0, <10.0.0"` (comma) | empirical test | (v1.0.7 trial) | v1.0.7 |
+
+**Three outcomes possible for v1.0.7**:
+
+1. SLIM accepts → first accepted semver-range entry in history; pin
+   to comma-form bounded ranges permanently.
+2. SLIM rejects with "no supported version" → 8.x-only inference is
+   too generous; Cloud Classic's list is even narrower; next move =
+   publisher support ticket.
+3. SLIM rejects with another unprecedented wording → new error class;
+   careful analysis before next iteration.
+
+---
+
 ## 8. Revision log
 
 - 2026-05-17 — initial Phase 1.3 baseline. App.manifest version drift
@@ -998,6 +1086,19 @@ list.
   conclusion: list form, semver ranges, and open-ended floors are
   all rejected; multi-version support requires a Splunk-side SLIM
   schema change.
+- 2026-06-05 (evening) — **v1.0.6 Splunkbase upload → F18 SLIM
+  `Illegal version specification` (NEW error class)**. Space-conjunction
+  `">=8.1.0 <10.0.0"` is syntax-rejected; comma form is required.
+  Retroactively disambiguates Phase 1.7: that comma form was
+  content-rejected, NOT syntax-rejected, so the comma syntax PARSES
+  correctly. Combining Phase 1.7's content rejection of
+  `[9.0.0, 10.0.0)` with v1.0.5's content rejection of `[9.0.0, ∞)`,
+  Cloud Classic's supported list is entirely BELOW 9.0.0 — 8.x only.
+  This matches the AI's 8.1.0 floor hint. §7.10 added. v1.0.7 tests
+  the comma form `">=8.1.0, <10.0.0"`. Three known error classes now
+  documented for `check_that_app_passes_slim_validation_for_cloud`:
+  type ("Expected String value"), syntax ("Illegal version
+  specification"), content ("no supported version").
 - 2026-06-05 — **v1.0.5 Splunkbase upload → F17 SLIM unsupported-
   version rejection of `">=9.0.0"` semver range** — major analytical
   finding: SLIM echoed back the literal range string, NOT "Expected