chore(audit+demo): build 640 - audit consistency + demo state cleanup

AUDIT TRAIL CONSISTENCY:
- Unify timestamp_human -> timestamp across all 5 panels (was
  inconsistent in FIM Alerts + Out-of-Band Recovery panels). The
  visible column header is the SPL field name; audit_tz.js
  reformats every cell client-side from the hidden epoch_ts
  column anyway, so the choice was purely cosmetic.
- Rename "Out-of-Band Recovery Actions" -> "Recovery Scripts &
  Maintenance Windows" (jargon -> self-explanatory: scripts run
  for recovery + FIM deploy windows). Update audit_tz.js header
  comment to reflect.

DEMO STATE CLEANUP (visible in README screenshots):
- Backup wl_audit index (1.9MB tarball, 12,945 events) + state
  JSONs to backups/2026-05-06/ (gitignored).
- splunk clean eventdata -index wl_audit (after stop).
- Truncate _recovery_log.jsonl (122 dev/test entries).
- Delete _approval_queue.json (259 entries with fuzz-input names),
  _daily_limits.json, _notifications.json, _trash_config.json.
  Each justified inline (no production purge endpoint; trash
  purge is rate-limited to 1/hour by design).
- Remove 19 test rules via remove_rule + 7 orphan CSVs +
  176 orphan version snapshots from lookups/_versions/.
- Clean production CSVs: DR45 had FS_ATTACK_USER row, DR55 had
  auth_method=TEST, DR20 had test_val rows + placeholder Xs.
  Replaced with realistic-looking data via save_csv as superadmin1.
- Re-bootstrap CSV expected-hash registry (20 CSVs, 0 changed).

DEMO SEEDING (production-path only):
- scripts/seed-demo-state.py exercises the production REST endpoints
  exactly as a real user would. Produces 18 production rules, 1
  pending + 1 approved + 1 rejected approval queue entries, ~11
  audit events with realistic variety. Final notification badge:
  resets to 0 after cleanup (legitimate baseline).

CHECKPOINT:
- tests/fixtures/demo-state/README.md documents the restore steps
  for future screenshot rounds.

SCREENSHOTS (3 of 4 refreshed):
- 03-audit-trail.png: new timestamp column header + new panel name
- 04-control-panel.png: clean queue + sparse activity counters
- 02-inline-editing.png: user-provided manual capture (kept as-is)
- 01-main-dashboard.png: automated capture produced byte-identical
  output to prior round despite await_text confirming DR130 data
  rendered (suspected browser-tool caching). Recommend manual
  recapture before public ship.

BUILD: 639 -> 640
- app.conf [install] build
- whitelist_manager.js urlArgs _b=640

Author: wildleo91

CHANGELOG.md

@@ -64,6 +64,148 @@ Detailed per-round entries below.
 
 ---
 
+## Unreleased — 2026-05-06 (build 640, audit consistency + demo-state cleanup)
+
+### Audit Trail consistency
+
+Two issues surfaced when reviewing the Audit Trail dashboard for the
+first public-release screenshots:
+
+1. **`timestamp_human` vs `timestamp` field-name drift.** The "File
+   Integrity Monitor Alerts" and (formerly) "Out-of-Band Recovery
+   Actions" panels rendered their first column with the SPL field
+   name `timestamp_human`, while the other three panels (Data
+   Changes / Activity Log / Privileged Admin Actions) used
+   `timestamp`. The visible column header is the field name, so
+   users saw two different labels for the same kind of column.
+   `audit_tz.js` overwrites every cell client-side based on the
+   hidden `epoch_ts` column anyway, so the SPL field-name choice was
+   purely cosmetic. Unified to `timestamp` across all 5 panels.
+
+2. **"Out-of-Band Recovery Actions" panel title.** Jargon for a new
+   user. Renamed to **"Recovery Scripts & Maintenance Windows"** —
+   self-explanatory: the entries are operator-driven recovery
+   scripts (emergency unlock, cooldown reset, schema migrations)
+   plus FIM deploy windows. `audit_tz.js` header comment updated to
+   reflect the new title.
+
+### Demo-state cleanup (visible in README screenshots)
+
+The build-639 README screenshots leaked accumulated dev/test state:
+Control Panel showed 14 pending requests with names like
+`DR_TRASH_TEST` plus 245 historical entries (many from hardening-
+round fuzz inputs); detection-rule dropdowns listed 19 obvious test
+rules (`DR_STRESS_2000x100`, `DR999_stress_test`, `AL13_Test_Rule`,
+`DR_RACE_<unix-ms>`, etc.); CSVs themselves contained fuzz-test rows
+(`FS_ATTACK_USER`, `auth_method=TEST`, `test_val`); `wl_audit` index
+held 12,945 events from every E2E run since builds 552-629.
+
+Cleaned exhaustively:
+
+- Backed up `wl_audit` index (1.9MB tarball, 12,945 events) +
+  state JSONs to `backups/2026-05-06/`. Backup dir gitignored.
+- `splunk clean eventdata -index wl_audit` after stopping splunkd.
+- Truncated `_recovery_log.jsonl` (122 entries from cooldown
+  migrations + deploy-window cycling).
+- Deleted 4 state files: `_approval_queue.json` (queue),
+  `_daily_limits.json`, `_notifications.json`, `_trash_config.json`.
+  Each `# JUSTIFIED:` marker explains why direct removal was used
+  (no production purge endpoint; trash purge has 1-hour cooldown
+  per superadmin by design that blocks bulk cleanup).
+- Removed 19 test detection rules + their CSVs via the production
+  `remove_rule` action with `removal_type=permanent`.
+- Removed 7 orphan test CSVs (`DR778_*`, `DR998_column_stress.csv`,
+  `DR_APPROVAL_TEST_1.csv`, `DR_LONG_NOTIFICATION_TEST_2.csv`,
+  `DR777_new_rule.csv`) that lingered in `lookups/` after their
+  rule-registry entries were already gone.
+- Removed 176 orphan version snapshots in `lookups/_versions/`
+  (`AL_super_*`, `STRESS_*`, `DR_TEST_*`, `DR_RACE_*` etc.) for
+  CSVs that no longer exist.
+- Re-bootstrapped `bootstrap_csv_hashes` against the cleaned
+  registry (20 CSVs hashed, 0 changed, 0 missing).
+- Cleared KV `wl_cooldowns`.
+- Cleaned the production CSVs themselves (DR45 had
+  `FS_ATTACK_USER`, DR55 had `auth_method=TEST`, DR20 had three
+  `test_val,test_val,test_val` rows + a placeholder-X hostname).
+  Replaced with realistic-looking data.
+
+### Demo seeding (production-path only)
+
+To give the screenshots non-empty content without re-introducing
+the test pollution, ran `scripts/seed-demo-state.py` which hits the
+production REST endpoints exactly as a real analyst / admin would:
+
+- analyst1 added `r.thomas` (sales team RDP gateway) to DR45
+  whitelist (`row_added` event).
+- analyst1 increased `svc_patch` brute-force threshold on DR55
+  (`row_edited` event).
+- analyst1 submitted 3 approval requests: remove_csv on DR610,
+  column_removal of `ticket_id` on DR130, remove_rule on DR640.
+- wladmin1 approved the DR610 removal (executed → `csv_removed`
+  event + FIM `csv_external_deletion` because the watcher
+  observed the file vanish; expected behavior, FIM doesn't
+  distinguish handler-driven deletes from external ones).
+- wladmin1 rejected the DR640 rule removal with reason "Hold for
+  GRC sign-off - see ticket SEC-2412".
+- The DR130 column removal stays pending so the queue shows a
+  "live" entry.
+
+Final state: 18 production rules, 3 queue entries (1 pending +
+1 approved + 1 rejected), ~11 audit events with realistic variety
+(`row_added`, `row_edited`, `request_submitted` ×3,
+`request_approved`, `request_rejected`, `csv_removed`,
+`whitelist_view`, `fim_csv_external_deletion`,
+`fim_baseline_initialized`, `fim_watch_started`).
+
+### Demo-state checkpoint
+
+Added `tests/fixtures/demo-state/README.md` documenting the
+restore steps so future screenshot rounds skip the
+"figure out what to clean" step. The actual snapshot files are
+NOT committed — they get regenerated by re-running the seed
+script against a freshly-cleaned environment.
+
+### Screenshots refreshed (3 of 4)
+
+- `docs/screenshots/03-audit-trail.png` — Audit Trail with the
+  new `timestamp` column header + "Recovery Scripts &
+  Maintenance Windows" panel title + clean event variety
+- `docs/screenshots/04-control-panel.png` — Control Panel with
+  realistic 1-pending / 1-approved / 1-rejected approval queue,
+  clean activity counters, no notification accumulation
+- `docs/screenshots/02-inline-editing.png` — left as the
+  user-provided manual capture (excellent inline-editing demo
+  on DR130; the small notification-badge "20" dates from before
+  this cleanup but is content-correct for the screenshot's purpose)
+- `docs/screenshots/01-main-dashboard.png` — automated capture
+  produced byte-identical output to the prior round despite
+  await_text confirming DR130 rendered with seeded data
+  (suspected browser-tool caching layer with the headless
+  Chrome). **Recommend manual recapture before public ship**:
+  open WM, select DR130_privilege_escalation +
+  DR130_priv_escalation.csv, capture full-page at native
+  resolution.
+
+### Build
+
+- `app.conf [install] build` 639 → 640
+- `whitelist_manager.js` urlArgs `_b=639` → `_b=640`
+
+### Migration / rollback
+
+- Audit panel reverts: re-introduce `timestamp_human` evals +
+  field-name in two `<table>` blocks of `default/data/ui/views/audit.xml`
+  and revert the panel title; re-introduce `(timestamp_human)`
+  annotations in `appserver/static/audit_tz.js` header comment.
+- State restore: extract `backups/2026-05-06/wl_audit_backup_*.tar.gz`
+  to `/opt/splunk/var/lib/splunk/wl_audit/` after stopping splunkd;
+  extract `wl_state_backup_*.tar.gz` to
+  `/opt/splunk/etc/apps/wl_manager/lookups/_versions/`. Test rules
+  are NOT auto-restored — the rule registry edit is the source of
+  truth and was deliberately pruned.
+
+---
+
 ## Unreleased — 2026-05-06 (build 639, pre-release polish round)
 
 ### UI hygiene: standardize section headers, empty states, and error card
@@ -115,12 +257,12 @@ maintenance polish.
   been left over from before the previously-shipped build-637
   dark-only decision.
 - **README screenshots refreshed (3 of 4)**:
-  - `docs/screenshots/01-main-dashboard.png` — captured at build 639
-    showing dark theme + DR20 rule loaded
+  - `docs/screenshots/01-main-dashboard.png` — originally captured
+    at build 639 (2026-05-06) showing dark theme + DR20 rule loaded
   - `docs/screenshots/03-audit-trail.png` — full audit dashboard
-    fullpage capture at build 639
+    fullpage capture at build 639 (2026-05-06)
   - `docs/screenshots/04-control-panel.png` — full Control Panel
-    Approval Queue tab fullpage at build 639
+    Approval Queue tab fullpage at build 639 (2026-05-06)
   - `docs/screenshots/02-inline-editing.png` — **NOT refreshed**.
     Captures cell-edit state which needs interactive click + cell
     selection that's hard to script reliably in headless mode.

appserver/static/audit_tz.js

@@ -1,14 +1,17 @@
 /**
  * Audit Trail — Timezone Display Toggle (Phase A + B: all 5 panels)
  *
- * Reformats the first column (timestamp / timestamp_human) of every
- * audit-dashboard table on the fly based on the tz_display dropdown.
+ * Reformats the first `timestamp` column of every audit-dashboard
+ * table on the fly based on the tz_display dropdown. All five panels
+ * use the same `timestamp` field name (unified in build 640); the
+ * underlying SPL coalesces wl_fim's pre-formatted `timestamp_human`
+ * with strftime(_time) for first-paint where applicable.
  * Panels covered (all in TABLE_IDS below):
- *   - audit_table_changes    — Data Changes (timestamp)
- *   - audit_table_activity   — Activity Log (timestamp)
- *   - audit_table_admin      — Privileged Admin Actions (timestamp)
- *   - audit_table_fim        — File Integrity Monitor Alerts (timestamp_human)
- *   - audit_table_recovery   — Out-of-Band Recovery Actions (timestamp_human)
+ *   - audit_table_changes    — Data Changes
+ *   - audit_table_activity   — Activity Log
+ *   - audit_table_admin      — Privileged Admin Actions
+ *   - audit_table_fim        — File Integrity Monitor Alerts
+ *   - audit_table_recovery   — Recovery Scripts & Maintenance Windows
  * No server-side work — the heavy lifting is done against a hidden
  * epoch_ts column the SPL search puts at the end of each result set.
  *

appserver/static/whitelist_manager.js

@@ -11,7 +11,7 @@
 // disk cache. Splunk serves /static/@<server-hash>/... with Cache-Control:
 // public, max-age=31536000; without urlArgs, bumped build numbers don't force
 // a re-fetch and clients run stale JS until they hard-refresh.
-require.config({ urlArgs: "_b=639" });
+require.config({ urlArgs: "_b=640" });
 require([
     "jquery",
     "underscore",

default/app.conf

@@ -5,7 +5,7 @@
 
 [install]
 is_configured = false
-build = 639
+build = 640
 
 [launcher]
 author       = Security Engineering

default/data/ui/views/audit.xml

@@ -918,7 +918,7 @@
             | where action!="fim_watch_heartbeat"
             | sort -timestamp
             | eval epoch_ts=_time
-            | eval timestamp_human=if(isnull(timestamp_human), strftime(timestamp, "%d-%m-%Y %H:%M:%S UTC"), timestamp_human)
+            | eval timestamp=coalesce(timestamp_human, strftime(_time, "%d-%m-%Y %H:%M:%S UTC"))
             | eval severity=coalesce(severity, case(
                 action=="fim_baseline_tampered",            "CRITICAL",
                 action=="fim_baseline_hmac_mismatch",       "CRITICAL",
@@ -998,17 +998,19 @@
                 action=="fim_watch_heartbeat", "Watcher heartbeat (still alive)",
                 1==1, coalesce(details, action)
               )
-            | table timestamp_human severity action _path old_hash new_hash summary epoch_ts
+            | table timestamp severity action _path old_hash new_hash summary epoch_ts
             | rename _path AS path
           </query>
           <earliest>$time_token.earliest$</earliest>
           <latest>$time_token.latest$</latest>
         </search>
-        <!-- epoch_ts is LAST (hidden via CSS, read by audit_tz.js). First
-             column uses timestamp_human (not timestamp) because FIM events
-             sometimes ship a pre-formatted string; audit_tz.js reformats
-             the first column based on the raw epoch regardless. -->
-        <fields>["timestamp_human","severity","action","path","old_hash","new_hash","summary","epoch_ts"]</fields>
+        <!-- epoch_ts is LAST (hidden via CSS, read by audit_tz.js). The
+             first column is named `timestamp` to match every other audit
+             panel; the SPL above coalesces the FIM event's pre-formatted
+             `timestamp_human` (when present) with a strftime of `_time`
+             so we get a sensible first-paint string. audit_tz.js then
+             reformats the cell based on epoch_ts within ~500 ms. -->
+        <fields>["timestamp","severity","action","path","old_hash","new_hash","summary","epoch_ts"]</fields>
         <option name="drilldown">none</option>
         <option name="count">10</option>
         <option name="wrap">true</option>
@@ -1021,14 +1023,14 @@
        ============================================================ -->
   <row>
     <panel>
-      <title>Out-of-Band Recovery Actions</title>
+      <title>Recovery Scripts &amp; Maintenance Windows</title>
       <table id="audit_table_recovery">
         <search>
           <query>
             index=wl_audit sourcetype=wl_audit_recovery
             | sort -timestamp
             | eval epoch_ts=_time
-            | eval timestamp_human=if(isnull(timestamp_human), strftime(timestamp, "%d-%m-%Y %H:%M:%S UTC"), timestamp_human)
+            | eval timestamp=coalesce(timestamp_human, strftime(_time, "%d-%m-%Y %H:%M:%S UTC"))
             | eval severity=case(
                 action=="emergency_unlock",       "CRITICAL",
                 action=="reset_cooldowns",        "HIGH",
@@ -1056,14 +1058,17 @@
                 1==1,
                   coalesce(details, "Recovery action: " . action . " — script=" . _script . " by=" . _by)
               )
-            | table timestamp_human severity action _script _by _ctx summary epoch_ts
+            | table timestamp severity action _script _by _ctx summary epoch_ts
             | rename _script AS script, _by AS host_user, _ctx AS context
           </query>
           <earliest>$time_token.earliest$</earliest>
           <latest>$time_token.latest$</latest>
         </search>
-        <!-- epoch_ts is LAST (hidden via CSS, read by audit_tz.js). -->
-        <fields>["timestamp_human","severity","action","script","host_user","context","summary","epoch_ts"]</fields>
+        <!-- epoch_ts is LAST (hidden via CSS, read by audit_tz.js).
+             First column unified to `timestamp` to match other panels;
+             SPL coalesces the recovery script's pre-formatted
+             `timestamp_human` with strftime(_time) for first-paint. -->
+        <fields>["timestamp","severity","action","script","host_user","context","summary","epoch_ts"]</fields>
         <option name="drilldown">none</option>
         <option name="count">5</option>
         <option name="wrap">true</option>