docs(planning): Phase 0.3.1 run 1 of 2 green (workflow 25922070685)

`tests/e2e/setup_test_env.sh` now seeds `allow_analyst_create_rules`,
`allow_analyst_create_csv`, `require_reason_rule_creation`, and
`require_reason_csv_creation` via the production `set_daily_limits`
action as superadmin1 (commit 6ec9bec). Workflow run 25922070685 came
back fully green:

  ✓ Smoke 1 — trash path-traversal regression
  ✓ Smoke 2 — rate-limit burst
  ✓ Smoke 3 — control-panel long-content rendering

That's run 1 of the "green on 2 consecutive pushes" acceptance
criterion. This commit (the planning check-off) intentionally pushes
to trigger run 2 — the second clean run is the flakiness check, not
filler.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: wildleo91

docs/PUBLIC_RELEASE_PLAN.md

@@ -68,7 +68,7 @@ CLAUDE.md split. Purely internal; no external dependencies.
 | 0.2 ⚠️ 2026-05-14 (PARTIAL — see note) | Fix `ci.yml` + `integration-tests.yml` pytest/Python mismatch (pytest 9.x requires Python ≥3.10; CI uses 3.9). **PARTIAL FIX:** bumped Python 3.9 → 3.11 in 4 places (ci.yml × 2, integration-tests.yml, release.yml) in commit `1fe4f92`; fixed 2 unmasked mock bugs in `tests/unit/test_limits.py` in commit `c5c08d1`. **Result on c5c08d1:** `ci.yml` GREEN (4/4 jobs); `integration-tests.yml` STILL FAILING — 23 fails + 220 errors. The integration-tests failures are NOT the Python mismatch alone; the round-7 install failure was masking a large body of pre-existing infrastructure debt: Splunk container 10-s curl-timeout under chaos load, KV-state pollution between tests, rate-limit state leaking across the suite, and one Python-version issue (pytest 9 dropped `pytest.skip(msg=dict)`). These need their own phase — see new Phase 0.2.1. | Both workflows green. Decision documented: cap pytest at ≤8.4.x OR upgrade workflow Python to 3.10+ | 30 min (Phase 0.2 estimate accurate for the mismatch fix itself; 0.2.1 scope much larger) |
 | 0.2.1 | Fix `integration-tests.yml` red — separate from 0.2's Python bump. Triage: (a) `pytest.skip(msg=dict)` → `pytest.skip(reason=str)` migrations (pytest 9 API), (b) chaos-test docker curl timeout 10s → ≥30s for GitHub-Actions runners, (c) container_state fixture KV/sentinel cleanup race (Ring 2 Day 7 work), (d) rate-limit state pollution between RBAC-matrix tests. Acceptance: ≤2 flake-resilient retries, 0 hard failures. | `integration-tests.yml` green on 2 consecutive pushes | 4-8 hr |
 | 0.3 ⚠️ 2026-05-15 (PARTIAL — see note) | Fix `e2e-smoke.yml` Playwright `undefined` env var failure (Windows binary path appears on Linux runner). **PARTIAL FIX:** commit `e47ad78` replaces the hard-coded `process.env.LOCALAPPDATA + "/ms-playwright/chromium-1208/chrome-win64/chrome.exe"` constant in `tests/e2e/lib_helpers.cjs` and `tests/e2e/test_task8_modularization.mjs` with a platform-aware `resolveChromiumExecutable()` (honors `PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH` → Windows-with-`LOCALAPPDATA` path → `undefined` so playwright-core auto-resolves). Also pins `e2e-smoke.yml` / `e2e-full.yml` / `a11y-audit.yml` to `npx playwright@1.59.1 install ...` so the installed chromium revision matches `playwright-core@1.59.1`. **Result on e47ad78:** workflow run `25920807221` — Smoke 1 ✅ + Smoke 2 ✅ (chromium launch verified working on Linux runner), Smoke 3 ❌ failing at a *different* point: `LC01`/`LC02` rejected by the admin-settings gate ("Creating detection rules is not permitted. An admin must enable it in the Control Panel"), then `bPage.waitForSelector("table.wl-table tbody tr")` at line 155 times out because pending table is empty. This is test-seed pollution analogous to Phase 0.2.1's KV/rate-limit pollution — `setup_test_env.sh` provisions the wladmin1 user/role but doesn't seed `allow_admin_create_rule = true` / `allow_admin_create_csv = true` in Admin Settings. Belongs in a follow-up — see new Phase 0.3.1. | Workflow green | 1-2 hr (env-var fix accurate; test-seed work much larger) |
-| 0.3.1 | Fix `e2e-smoke.yml` Smoke 3 (`test_control_panel_long_content.cjs`) red — separate from 0.3's chromium-launch fix. Triage: (a) `setup_test_env.sh` needs to seed Admin Settings KV with `allow_admin_create_rule = true` + `allow_admin_create_csv = true` for the CI wladmin1 role, OR test must bypass the gate by setting these via REST API in a pre-test step, (b) LC05+ visual checks assume pending-table population; if the test seeds entries via REST it should also clean them up to avoid cross-run pollution. Acceptance: `e2e-smoke.yml` green on 2 consecutive pushes. | `e2e-smoke.yml` green on 2 consecutive pushes | 2-4 hr |
+| 0.3.1 ⏳ 2026-05-15 (run 1 of 2 ✅) | Fix `e2e-smoke.yml` Smoke 3 (`test_control_panel_long_content.cjs`) red — separate from 0.3's chromium-launch fix. Triage in the original row was "admin settings KV" but the actual gate was the analyst-side toggles (`allow_analyst_create_rules` / `allow_analyst_create_csv`) plus `require_reason_*_creation` to route to the approval queue and return the `request_id` the test expects. **FIX:** commit `6ec9bec` adds a "Seeding limit config" step to `tests/e2e/setup_test_env.sh` that POSTs `set_daily_limits` as `superadmin1` after user provisioning, enabling the four toggles. Admin paths bypass these gates entirely (`wl_handler.py:2747` / `:2811` — admins execute directly), so the change is safe for admin-running tests. **Result on `6ec9bec`:** workflow run `25922070685` — Smoke 1 ✅ + Smoke 2 ✅ + **Smoke 3 ✅**. Acceptance is "green on 2 consecutive pushes" — this is run 1 of 2; the planning check-off commit is run 2. | `e2e-smoke.yml` green on 2 consecutive pushes | 2-4 hr (actual: ~45 min once the gate path was traced) |
 | 0.4 | Verify `a11y-audit` / `zap-baseline` / `pip-audit` workflows fire on schedule | At least one successful recent run of each | 10 min |
 | 0.5 | CLAUDE.md 3-bucket migration: extract Decision Log → `docs/DECISION_LOG.md`, Operational Procedures + Disaster Recovery + Rollback → `docs/RUNBOOKS.md`, Splunk Quirks → `docs/SPLUNK_QUIRKS.md` | 3 files exist, cross-references in CLAUDE.md updated, doc-drift hook passes | 2-3 hr |
 | 0.6 | LICENSE: MIT → Apache 2.0 + add NOTICE file | LICENSE replaced; NOTICE added per Apache 2.0 conventions | 30 min |