release(v1.0.8): whitespace fix ">=8.1.0,<10.0.0" (no space) + sensitivity isolated

v1.0.7's ">=8.1.0, <10.0.0" (comma + space per the v1.0.6 AI
explainer's literal example) was rejected by SLIM with the SAME
syntax-class error as v1.0.6's space-only form:

    manifest.platformRequirements.splunk.Enterprise: Illegal version
    specification: >=8.1.0, <10.0.0

The Splunkbase AI explainer for this failure explicitly corrects
its prior recommendation:

    SLIM's version parser expects a valid specifier set without
    whitespace around commas. The space after the comma causes the
    version spec to be considered invalid.

3-position contrast now fully isolates whitespace-sensitivity:

  - ">=A <B" (v1.0.6, space-only)        -> syntax error
  - ">=A, <B" (v1.0.7, comma + space)    -> syntax error
  - ">=A,<B" (Phase 1.7, comma + nospace) -> content error (parses!)

The Phase 1.7 form's content-class error proves comma-with-no-space
parses correctly. The whitespace AROUND the comma is what breaks
SLIM's parser.

What changed:
- app.manifest: Enterprise from ">=8.1.0, <10.0.0" (comma+space) to
  ">=8.1.0,<10.0.0" (comma+no-space, AI's corrected form +
  Phase 1.7's known-parsable syntax); info.id.version 1.0.7 -> 1.0.8;
  releaseDate 2026-06-06.
- default/app.conf: build = 678; [launcher].version = [id].version
  = 1.0.8.
- appserver/static/whitelist_manager.js:14: urlArgs: "_b=678"
  (auto-applied by scripts/hooks/urlargs-sync.js).
- docs/SPLUNK_10_COMPATIBILITY.md: Runtime Verification section
  extended with v1.0.7 finding + whitespace-sensitivity discovery +
  3-position contrast table + cumulative format history updated.
- docs/APPINSPECT_FINDINGS.md §7.11: 2026-06-06 hosted-API run F19
  with the whitespace-sensitivity finding + revision-log entry.
- docs/DECISION_LOG.md 2026-06-06 row: documents the
  whitespace-sensitivity discovery + corrects the 2026-06-05 evening
  row's "comma form with space" recommendation. One new maintenance
  lesson: SLIM version parser is whitespace-sensitive around commas.
- CLAUDE.md "Splunk Version Pinning Audit" log: new row with
  whitespace-sensitivity lesson + the pattern that AI explainer
  recommendations evolve across 4 successive failure reports.

Three outcomes possible:

1. SLIM accepts ">=8.1.0,<10.0.0" -> first ACCEPTED semver-range
   entry in cumulative history; pin to comma-no-space bounded ranges
   permanently. Cleanup commit fixes all prior format claims.
2. SLIM rejects with "no supported version" -> Cloud Classic's list
   excludes [8.1.0, 10.0.0). Next move = Splunkbase publisher support
   ticket (documented escalation path).
3. SLIM rejects with another unprecedented wording -> new error class
   to catalogue; careful analysis before next iteration.

Honesty note: 8th release attempt in 6 days. The iterate-and-test
discovery method has produced 8 distinct empirical data points
(F13-F19 + v1.0.0 pre-release). The Splunkbase AI explainer's
recommendations have evolved across 4 successive failure reports
(open-floor semver in v1.0.4, space-only in v1.0.5, comma+space in
v1.0.6, comma+no-space in v1.0.7). The cumulative SLIM format
history table in docs/SPLUNK_10_COMPATIBILITY.md is the canonical
single-source-of-truth.

Verification:
- bash scripts/validate.sh -> ALL CHECKS PASSED (2 warnings)
- bash scripts/preflight-tag.sh v1.0.8 -> OK (all 4 sources at 1.0.8)
- bash scripts/pre-commit-doc-drift.sh -> OK (49 docs vs build 678)
- Local AppInspect re-run skipped (Docker not running). The next
  Splunkbase upload of wl_manager-1.0.8.spl is the empirical test.

Author: RelativisticJet

CHANGELOG.md

@@ -4,6 +4,78 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [1.0.8] - 2026-06-06
+
+**Whitespace fix — comma with NO space after.** No app-code changes —
+manifest + version-bump only.
+
+### Why this exists
+
+v1.0.7 declared `">=8.1.0, <10.0.0"` (comma followed by SPACE per
+the v1.0.6 AI explainer's literal example). SLIM rejected with:
+
+> manifest.platformRequirements.splunk.Enterprise: **Illegal version
+> specification**: >=8.1.0, <10.0.0
+
+Same syntax-class error as v1.0.6's space-conjunction failure. The
+v1.0.7 explainer corrects the prior recommendation: SLIM's version
+parser does NOT tolerate whitespace around commas. The correct form
+is `">=8.1.0,<10.0.0"` — comma with no spaces.
+
+### Phase 1.7 confirmed correct syntax (yet again)
+
+Phase 1.7's `">=9.0,<10.0"` (comma, no space) was rejected with the
+**content** error wording ("no supported version"), NOT the syntax
+error wording. The no-space-around-comma form parses correctly.
+
+This means we now have a 3-position contrast that fully isolates the
+whitespace sensitivity:
+
+| Form | Whitespace around comma | Error class |
+|---|---|---|
+| `">=8.1.0 <10.0.0"` (v1.0.6, space, no comma) | n/a | syntax (Illegal) |
+| `">=8.1.0, <10.0.0"` (v1.0.7, space after comma) | yes | syntax (Illegal) |
+| `">=9.0,<10.0"` (Phase 1.7, no space anywhere) | no | content (no supported version) |
+| `">=8.1.0,<10.0.0"` (v1.0.8, no space anywhere) | no | (this release — empirical test) |
+
+### What v1.0.8 is testing
+
+Comma-no-space form. The Cloud Classic supported-list shape inference
+from v1.0.7 still holds: list is entirely BELOW 9.0.0 (Phase 1.7 +
+v1.0.5 both content-rejected `[9.0.0, ...)` regions). If 8.x is on
+the list and the syntax is now correct, this should pass.
+
+### What changed since v1.0.7
+
+| File | Change |
+|---|---|
+| `app.manifest` | `Enterprise` from `">=8.1.0, <10.0.0"` (comma+space) to `">=8.1.0,<10.0.0"` (comma, no space); `info.id.version` 1.0.7 → 1.0.8; `releaseDate` 2026-06-06 |
+| `default/app.conf` | `[install].build` 677 → 678; `[launcher].version` + `[id].version` 1.0.7 → 1.0.8 |
+| `appserver/static/whitelist_manager.js` | `urlArgs: "_b=678"` (auto-synced) |
+| `docs/SPLUNK_10_COMPATIBILITY.md` | Runtime Verification: v1.0.7 failure + whitespace-sensitivity finding + corrected syntax table |
+| `docs/APPINSPECT_FINDINGS.md` §7.11 | 2026-06-06 hosted-API run F19 (whitespace syntax error) + v1.0.8 trial details |
+| `docs/DECISION_LOG.md` 2026-06-06 row | Documents the whitespace-sensitivity discovery + corrects the 2026-06-05 evening row's "comma-with-space" recommendation |
+| `CLAUDE.md` | Audit-log row with whitespace-sensitivity lesson |
+| `CHANGELOG.md` | This entry |
+
+### Three outcomes possible
+
+1. **SLIM accepts** → first ACCEPTED semver-range entry in cumulative
+   history; pin to comma-no-space bounded ranges permanently.
+2. **SLIM rejects with "no supported version: >=8.1.0,<10.0.0"** →
+   Cloud Classic's list excludes `[8.1.0, 10.0.0)`. The 8.x-only
+   inference was wrong, or the list is narrower (specific 8.x patches
+   only). Next move = Splunkbase publisher support ticket.
+3. **SLIM rejects with another wording** → new error class to
+   catalogue.
+
+### What did not change
+
+- All app code, dashboards, RBAC.
+- Sigstore signing chain.
+
+---
+
 ## [1.0.7] - 2026-06-05
 
 **Syntax fix — comma conjunction instead of space.** No app-code or

app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null,
       "name": "wl_manager",
-      "version": "1.0.7"
+      "version": "1.0.8"
     },
     "author": [
       {
@@ -14,7 +14,7 @@
         "company": null
       }
     ],
-    "releaseDate": "2026-06-05",
+    "releaseDate": "2026-06-06",
     "description": "Manage detection-rule CSV whitelists with diff-based audit trail. Provides a web-based interface for viewing, editing, adding, and removing whitelist entries with full change tracking, expiration management, and role-based access control.",
     "classification": {
       "intendedAudience": "Security Operations",
@@ -36,7 +36,7 @@
   "incompatibleApps": null,
   "platformRequirements": {
     "splunk": {
-      "Enterprise": ">=8.1.0, <10.0.0"
+      "Enterprise": ">=8.1.0,<10.0.0"
     }
   },
   "supportedDeployments": [

appserver/static/whitelist_manager.js

@@ -11,7 +11,7 @@
 // disk cache. Splunk serves /static/@<server-hash>/... with Cache-Control:
 // public, max-age=31536000; without urlArgs, bumped build numbers don't force
 // a re-fetch and clients run stale JS until they hard-refresh.
-require.config({ urlArgs: "_b=677" });
+require.config({ urlArgs: "_b=678" });
 require([
     "jquery",
     "underscore",

default/app.conf

@@ -5,20 +5,20 @@
 
 [install]
 is_configured = false
-build = 677
+build = 678
 
 [launcher]
 author       = Oleh Bezsonov
 description  = Manage detection-rule CSV whitelists with inline editing, approval workflows, version control, and diff-based audit trail
-version      = 1.0.7
+version      = 1.0.8
 
 [ui]
 is_visible = true
 label      = Whitelist Manager
 
 [id]
 name              = wl_manager
-version           = 1.0.7
+version           = 1.0.8
 
 # AppInspect 4.2.0 has both `check_for_valid_package_id` (looks at the
 # new [id] stanza) and `check_for_updates_disabled` (looks at the

docs/APPINSPECT_FINDINGS.md

@@ -990,6 +990,85 @@ i.e., 8.x only. Matches Splunkbase AI's 8.1.0 floor hint.
 
 ---
 
+## 7.11 v1.0.7 Splunkbase upload — comma + space form ALSO syntax-rejected (2026-06-06 → v1.0.8 trial)
+
+**Background**: v1.0.7 declared `">=8.1.0, <10.0.0"` (comma + space
+per the v1.0.6 AI explainer's literal example). SLIM rejected with
+the SAME syntax-class error as v1.0.6's space-only form:
+
+> manifest.platformRequirements.splunk.Enterprise: **Illegal version
+> specification**: >=8.1.0, <10.0.0
+
+| # | Class | File | Stanza | Setting / message |
+|---|-------|------|--------|------------------|
+| **F19** | **HARD ERROR (syntax)** | `app.manifest` | `platformRequirements.splunk.Enterprise` | "Illegal version specification: >=8.1.0, <10.0.0" |
+
+**Headline numbers**: 162 success / **1 failure** / 0 future / 0 errors
+/ 5 warnings / 79 N/A / 0 skipped. Byte-identical totals to all
+prior runs.
+
+**F19 — whitespace-sensitivity isolated**: SLIM's version parser
+treats any whitespace around the comma as a syntax error. The v1.0.7
+AI explainer corrects its prior recommendation: "SLIM's version
+parser expects a valid specifier set without whitespace around
+commas."
+
+**Three-position contrast now confirms**: comma works, whitespace
+around comma breaks parsing.
+
+| Form | Around-comma whitespace | Error class |
+|---|---|---|
+| `">=8.1.0 <10.0.0"` (v1.0.6) | (no comma) | syntax (F18) |
+| `">=8.1.0, <10.0.0"` (v1.0.7) | space after | syntax (F19) |
+| `">=9.0,<10.0"` (Phase 1.7) | none | content (no supported version) |
+
+Phase 1.7's content-class error proves comma-with-no-space parses
+correctly. The syntax-class error is whitespace-specific.
+
+**Resolution (v1.0.8, commit pending)**:
+
+- `app.manifest`: `Enterprise` from `">=8.1.0, <10.0.0"` (comma+space)
+  to `">=8.1.0,<10.0.0"` (comma+no-space, AI's corrected form +
+  Phase 1.7's known-parsable syntax).
+- `app.manifest`: `info.id.version` 1.0.7 → 1.0.8; `releaseDate`
+  2026-06-06.
+- `default/app.conf`: `build = 678`; `[launcher].version =
+  [id].version = 1.0.8`.
+- `appserver/static/whitelist_manager.js:14`: `urlArgs: "_b=678"`
+  (auto-applied).
+- `docs/SPLUNK_10_COMPATIBILITY.md` Runtime Verification: 2026-06-06
+  section + whitespace-sensitivity finding + 3-position contrast +
+  cumulative format history updated.
+
+**Disposition**: **F19 testing-in-v1.0.8**.
+
+**Updated cumulative format history** (whitespace-sensitivity row
+inserted):
+
+| Format | Error class | Result | Release |
+|---|---|---|---|
+| `">=9.0.0"` | content | REJECTED | v1.0.0 pre-release; v1.0.5 |
+| `">=9.0,<10.0"` | content | REJECTED | v1.0.0-rc Phase 1.7 |
+| `"9.3"` | (none then) | ACCEPTED-then-RETIRED | v1.0.0, v1.0.1 |
+| `["9.4", "10.0"]` | type | REJECTED | v1.0.2 (F14) |
+| `"10.0"` | content | REJECTED | v1.0.3 (F15) |
+| `"9.4"` | content | REJECTED | v1.0.4 (F16) |
+| `">=9.0.0"` | content | REJECTED | v1.0.5 (F17) |
+| `">=8.1.0 <10.0.0"` (space) | syntax | REJECTED | v1.0.6 (F18) |
+| `">=8.1.0, <10.0.0"` (comma+space) | syntax | REJECTED | v1.0.7 (F19) |
+| `">=8.1.0,<10.0.0"` (comma+no-space) | empirical test | (v1.0.8 trial) | v1.0.8 |
+
+**Three outcomes possible for v1.0.8**:
+
+1. SLIM accepts → first accepted semver-range entry; pin permanently.
+2. SLIM rejects with content wording → Cloud Classic's list is even
+   narrower than `[8.1.0, 10.0.0)`; next move = publisher support
+   ticket (documented escalation).
+3. SLIM rejects with unprecedented wording → new error class; careful
+   analysis required.
+
+---
+
 ## 8. Revision log
 
 - 2026-05-17 — initial Phase 1.3 baseline. App.manifest version drift
@@ -1086,6 +1165,20 @@ i.e., 8.x only. Matches Splunkbase AI's 8.1.0 floor hint.
   conclusion: list form, semver ranges, and open-ended floors are
   all rejected; multi-version support requires a Splunk-side SLIM
   schema change.
+- 2026-06-06 — **v1.0.7 Splunkbase upload → F19 SLIM `Illegal version
+  specification` (whitespace-sensitivity isolated)**. The comma+space
+  form `">=8.1.0, <10.0.0"` was rejected with the SAME syntax-class
+  error as v1.0.6's space-only form, isolating the issue to the
+  whitespace around the comma. The Splunkbase AI explainer corrects
+  its v1.0.6 recommendation: "SLIM's version parser expects a valid
+  specifier set without whitespace around commas. The space after
+  the comma causes the version spec to be considered invalid." The
+  3-position contrast (space-only / comma+space / comma+no-space)
+  now fully isolates whitespace sensitivity; Phase 1.7's
+  `">=9.0,<10.0"` (comma+no-space, content-rejected) is the
+  confirmed-parsable syntax. v1.0.8 tests `">=8.1.0,<10.0.0"`
+  (comma+no-space). §7.11 added with the whitespace-sensitivity
+  finding + 3-position contrast + updated cumulative format history.
 - 2026-06-05 (evening) — **v1.0.6 Splunkbase upload → F18 SLIM
   `Illegal version specification` (NEW error class)**. Space-conjunction
   `">=8.1.0 <10.0.0"` is syntax-rejected; comma form is required.