release(v1.0.6): bounded-range trial ">=8.1.0 <10.0.0" + range-parse confirmed

v1.0.5's ">=9.0.0" was rejected by SLIM with:

    manifest.platformRequirements.splunk: Version requirement includes
    no supported version of Splunk Enterprise: >=9.0.0

MAJOR ANALYTICAL FINDING: SLIM echoed back the literal range string
(">=9.0.0") in the error wording, NOT "Expected String value". This
empirically confirms SLIM PARSES semver ranges as a valid type. The
Phase 1.7 "type rejection" conclusion across v1.0.2-v1.0.4 docs was
WRONG. Cleanup commit needed regardless of v1.0.6 outcome.

Cloud Classic supported-list shape (inferred from F13-F17):
  - 9.3 NOT on list (F13, v1.0.1)
  - 10.0 NOT on list (F15, v1.0.3)
  - 9.4 NOT on list (F16, v1.0.4)
  - All of [9.0.0, infinity) NOT on list (F17, v1.0.5)

The supported set is NOT a contiguous low-floor range. Splunkbase AI
explainer's NEW recommendation extends the floor DOWN to 8.1.0:

  Recommended example: ">=8.1.0 <9.2.0".
  If you cannot determine the exact upper bound immediately, you can
  temporarily broaden while keeping a sensible cap, e.g.,
  ">=8.1.0 <10.0.0".

User picked ">=8.1.0 <10.0.0" (bounded range, AI's "temporary
broaden" form). Rationale: AI's 8.1.0 floor is a meaningful clue that
Cloud Classic's list may include 8.x versions; a broader range that
covers 8.1.0 -> 9.x maximizes the chance of intersecting Cloud
Classic's list.

What changed:
- app.manifest: Enterprise from ">=9.0.0" to ">=8.1.0 <10.0.0"
  (bounded range, space-conjunction syntax per AI's literal example);
  info.id.version 1.0.5 -> 1.0.6; releaseDate 2026-06-05.
- default/app.conf: build = 676; [launcher].version = [id].version
  = 1.0.6.
- appserver/static/whitelist_manager.js:14: urlArgs: "_b=676"
  (auto-applied).
- docs/SPLUNK_10_COMPATIBILITY.md: Runtime Verification section
  extended with v1.0.5 finding + Cloud Classic supported-list shape
  inference + cumulative format history updated.
- docs/APPINSPECT_FINDINGS.md §7.9: 2026-06-05 hosted-API run F17
  with the major analytical finding + v1.0.6 trial details +
  revision-log entry.
- docs/DECISION_LOG.md 2026-06-05 row: documents the bounded-range
  trial + empirically confirms ranges parse (the v1.0.5 row's "Two
  outcomes possible" analysis was answered: ranges parse, content
  didn't match). One new maintenance lesson: bounded-range
  space-conjunction syntax may differ from Phase 1.7's comma form.
- CLAUDE.md "Splunk Version Pinning Audit" log: new row with the
  range-parse empirical confirmation + two new maintenance lessons.

Three outcomes possible:

1. SLIM accepts ">=8.1.0 <10.0.0" -> first ACCEPTED semver-range
   entry in cumulative history; future releases pin to this range
   format permanently and stop the version-retirement treadmill.
   Cleanup commit fixes v1.0.2-v1.0.4 docs' "ranges are type-
   rejected" claims.
2. SLIM rejects with "no supported version: >=8.1.0 <10.0.0" ->
   Cloud Classic's list excludes both 8.x and 9.x; next move is
   Splunkbase publisher support ticket (now the documented escalation
   path).
3. SLIM rejects with "Expected String value" -> unexpected; would
   indicate space-conjunction is type-rejected. Low probability.

Honesty note: 6th release attempt in 6 days. The iterate-and-test
discovery method has produced 6 failed data points (F13, F14, F15,
F16, F17, plus v1.0.0 pre-release). If v1.0.6 ALSO fails, the
iteration cost (1 week, 6 releases) now exceeds the publisher support
ticket cost; that's the documented next move.

Verification:
- bash scripts/validate.sh -> ALL CHECKS PASSED (2 warnings)
- bash scripts/preflight-tag.sh v1.0.6 -> OK (all 4 sources at 1.0.6)
- bash scripts/pre-commit-doc-drift.sh -> OK (49 docs vs build 676)
- Local AppInspect re-run skipped (Docker not running). The next
  Splunkbase upload of wl_manager-1.0.6.spl is the empirical test.

Author: RelativisticJet

CHANGELOG.md

@@ -4,6 +4,83 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [1.0.6] - 2026-06-05
+
+**Bounded-range trial after v1.0.5 confirmed SLIM parses semver ranges
+as type.** No app-code changes — manifest + version-bump only.
+
+### Empirical confirmation from v1.0.5
+
+v1.0.5 declared `">=9.0.0"`. SLIM rejected it with:
+
+> manifest.platformRequirements.splunk: Version requirement includes
+> no supported version of Splunk Enterprise: **>=9.0.0**
+
+The error echoed back the **literal range string** (`>=9.0.0`), NOT
+"Expected String value". This is significant: it confirms **SLIM
+parses semver ranges as a valid TYPE**. The Phase 1.7 conclusion
+(captured in v1.0.2 / v1.0.3 / v1.0.4 docs) that "semver ranges are
+type-rejected" was wrong. Semver ranges ARE accepted; the failure
+mode is content (no version in the range matches Cloud Classic's
+supported list).
+
+### What v1.0.6 is testing
+
+Splunkbase AI's recommendation in the v1.0.5 failure report extended
+the floor DOWN to 8.1.0:
+
+> Recommended example: `">=8.1.0 <9.2.0"`. If you cannot determine the
+> exact upper bound immediately, you can temporarily broaden while
+> keeping a sensible cap, e.g., `">=8.1.0 <10.0.0"`.
+
+User picked `">=8.1.0 <10.0.0"` (bounded range, broader than the AI's
+narrower example, excludes 10.x). Rationale: the AI suggesting 8.1.0
+as the floor is a meaningful clue — Cloud Classic's supported list
+may include 8.x versions that we hadn't considered. A broader range
+that covers 8.1.0 → 9.x maximizes the chance of intersecting Cloud
+Classic's list.
+
+Cumulative search-space progression:
+- `[9.4, ∞)` (v1.0.4 `"9.4"`) — single version, didn't match list
+- `[9.0.0, ∞)` (v1.0.5 `">=9.0.0"`) — broader, still didn't match
+- `[8.1.0, 10.0.0)` (v1.0.6 — this release) — extends to 8.x
+
+If 8.x is on Cloud Classic's list, this matches. If only 9.x retired
+minors are on the list (e.g., 9.2 or 9.1), this matches. If 10.x is
+on the list, this still doesn't match (intentional exclusion).
+
+### What changed since v1.0.5
+
+| File | Change |
+|---|---|
+| `app.manifest` | `Enterprise` from `">=9.0.0"` to `">=8.1.0 <10.0.0"`; `info.id.version` 1.0.5 → 1.0.6; `releaseDate` 2026-06-05 |
+| `default/app.conf` | `[install].build` 675 → 676; `[launcher].version` + `[id].version` 1.0.5 → 1.0.6 |
+| `appserver/static/whitelist_manager.js` | `urlArgs: "_b=676"` (auto-synced) |
+| `docs/SPLUNK_10_COMPATIBILITY.md` | Runtime Verification: 2026-06-05 update confirming SLIM parses ranges + cumulative format history with v1.0.5 result |
+| `docs/APPINSPECT_FINDINGS.md` §7.9 | 2026-06-05 hosted-API run F17 + v1.0.6 trial details |
+| `docs/DECISION_LOG.md` 2026-06-05 row | Documents the bounded-range trial + the v1.0.5 empirical confirmation that ranges parse |
+| `CLAUDE.md` | Audit-log row with the confirmation-of-range-parsing |
+| `CHANGELOG.md` | This entry |
+
+### Two outcomes possible
+
+1. **SLIM accepts `">=8.1.0 <10.0.0"`** → Cloud Vetting clears. The
+   format history's first ACCEPTED semver-range entry. Future
+   releases can pin to this range and stop the version-retirement
+   treadmill entirely.
+2. **SLIM rejects with "no supported version: >=8.1.0 <10.0.0"** →
+   Cloud Classic's list is even narrower (possibly only 10.x, or a
+   specific older version). Next move is the Splunkbase publisher
+   support ticket the v1.0.5 docs already flagged as the escalation
+   path.
+
+### What did not change
+
+- All app code, dashboards, RBAC.
+- Sigstore signing chain.
+
+---
+
 ## [1.0.5] - 2026-06-04
 
 **Semver-range trial after `"9.4"` was also rejected.** No app-code or

app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null,
       "name": "wl_manager",
-      "version": "1.0.5"
+      "version": "1.0.6"
     },
     "author": [
       {
@@ -14,7 +14,7 @@
         "company": null
       }
     ],
-    "releaseDate": "2026-06-04",
+    "releaseDate": "2026-06-05",
     "description": "Manage detection-rule CSV whitelists with diff-based audit trail. Provides a web-based interface for viewing, editing, adding, and removing whitelist entries with full change tracking, expiration management, and role-based access control.",
     "classification": {
       "intendedAudience": "Security Operations",
@@ -36,7 +36,7 @@
   "incompatibleApps": null,
   "platformRequirements": {
     "splunk": {
-      "Enterprise": ">=9.0.0"
+      "Enterprise": ">=8.1.0 <10.0.0"
     }
   },
   "supportedDeployments": [

appserver/static/whitelist_manager.js

@@ -11,7 +11,7 @@
 // disk cache. Splunk serves /static/@<server-hash>/... with Cache-Control:
 // public, max-age=31536000; without urlArgs, bumped build numbers don't force
 // a re-fetch and clients run stale JS until they hard-refresh.
-require.config({ urlArgs: "_b=675" });
+require.config({ urlArgs: "_b=676" });
 require([
     "jquery",
     "underscore",

default/app.conf

@@ -5,20 +5,20 @@
 
 [install]
 is_configured = false
-build = 675
+build = 676
 
 [launcher]
 author       = Oleh Bezsonov
 description  = Manage detection-rule CSV whitelists with inline editing, approval workflows, version control, and diff-based audit trail
-version      = 1.0.5
+version      = 1.0.6
 
 [ui]
 is_visible = true
 label      = Whitelist Manager
 
 [id]
 name              = wl_manager
-version           = 1.0.5
+version           = 1.0.6
 
 # AppInspect 4.2.0 has both `check_for_valid_package_id` (looks at the
 # new [id] stanza) and `check_for_updates_disabled` (looks at the

docs/APPINSPECT_FINDINGS.md

@@ -827,6 +827,81 @@ Runtime Verification for details):
 
 ---
 
+## 7.9 v1.0.5 Splunkbase upload — `">=9.0.0"` REJECTED but confirms SLIM parses ranges (2026-06-05 → v1.0.6 trial)
+
+**Background**: v1.0.5 declared `">=9.0.0"` as an empirical test of
+whether SLIM type-rejects semver ranges. SLIM rejected with:
+
+> manifest.platformRequirements.splunk: Version requirement includes
+> no supported version of Splunk Enterprise: **>=9.0.0**
+
+| # | Class | File | Stanza | Setting / message |
+|---|-------|------|--------|------------------|
+| **F17** | **HARD ERROR (content)** | `app.manifest` | `platformRequirements.splunk.Enterprise` | "Version requirement includes no supported version of Splunk Enterprise: >=9.0.0" |
+
+**Headline numbers**: 162 success / **1 failure** / 0 future / 0 errors
+/ 5 warnings / 79 N/A / 0 skipped.
+
+**F17 — major analytical finding**: SLIM echoed back the literal range
+string `">=9.0.0"`, NOT "Expected String value". This is the
+definitive disambiguation: SLIM **parses semver ranges as a valid
+type**. The rejection is content-based — no version in `[9.0.0, ∞)`
+matches Cloud Classic's supported list. My v1.0.2 / v1.0.3 / v1.0.4
+docs claiming "ranges are type-rejected" were wrong.
+
+**Cloud Classic supported-list shape (inferred from F13-F17)**:
+
+Versions NOT on the list:
+- 9.3 (F13, v1.0.1)
+- 10.0 (F15, v1.0.3)
+- 9.4 (F16, v1.0.4)
+- All of `[9.0.0, ∞)` (F17, v1.0.5)
+
+The supported set is NOT a contiguous low-floor range. Splunkbase AI
+explainer's new floor hint (`">=8.1.0"`) suggests 8.x may be on the
+list.
+
+**Resolution (v1.0.6, commit pending)**:
+
+- `app.manifest`: `Enterprise` from `">=9.0.0"` to `">=8.1.0 <10.0.0"`
+  (bounded range, space-conjunction syntax per AI explainer's
+  example).
+- `app.manifest`: `info.id.version` 1.0.5 → 1.0.6; `releaseDate`
+  2026-06-05.
+- `default/app.conf`: `build = 676`; `[launcher].version =
+  [id].version = 1.0.6`.
+- `appserver/static/whitelist_manager.js:14`: `urlArgs: "_b=676"`
+  (auto-applied).
+- `docs/SPLUNK_10_COMPATIBILITY.md` Runtime Verification: 2026-06-05
+  section + cumulative format history updated with the v1.0.5 finding.
+
+**Disposition**: **F17 testing-in-v1.0.6**.
+
+**Updated cumulative SLIM format history**:
+
+| Format | Result | Release |
+|---|---|---|
+| `">=9.0.0"` | REJECTED (content) | v1.0.0 pre-release; v1.0.5 |
+| `">=9.0,<10.0"` | REJECTED (likely content + comma syntax) | v1.0.0-rc Phase 1.7 |
+| `"9.3"` | ACCEPTED-then-RETIRED | v1.0.0, v1.0.1 |
+| `["9.4", "10.0"]` | REJECTED (type) | v1.0.2 (F14) |
+| `"10.0"` | REJECTED (content) | v1.0.3 (F15) |
+| `"9.4"` | REJECTED (content) | v1.0.4 (F16) |
+| `">=9.0.0"` | REJECTED (content) — empirically confirmed range PARSES | v1.0.5 (F17) |
+| `">=8.1.0 <10.0.0"` | (v1.0.6 trial) | v1.0.6 |
+
+**Three outcomes possible for v1.0.6**:
+
+1. SLIM accepts → first ACCEPTED semver-range entry. Pin to this
+   format permanently. Cleanup commit needed for v1.0.2-v1.0.4 docs.
+2. SLIM rejects with "no supported version" → Cloud Classic's list
+   excludes both 8.x and 9.x; next move is Splunkbase publisher
+   support ticket.
+3. SLIM rejects with "Expected String value" → unexpected; would
+   indicate space-conjunction is type-rejected. Low probability.
+
+---
+
 ## 8. Revision log
 
 - 2026-05-17 — initial Phase 1.3 baseline. App.manifest version drift
@@ -923,6 +998,21 @@ Runtime Verification for details):
   conclusion: list form, semver ranges, and open-ended floors are
   all rejected; multi-version support requires a Splunk-side SLIM
   schema change.
+- 2026-06-05 — **v1.0.5 Splunkbase upload → F17 SLIM unsupported-
+  version rejection of `">=9.0.0"` semver range** — major analytical
+  finding: SLIM echoed back the literal range string, NOT "Expected
+  String value". This empirically confirms SLIM PARSES semver ranges
+  as a valid type; my v1.0.2-v1.0.4 docs claiming "ranges are type-
+  rejected" were wrong. §7.9 added with the analytical disambiguation
+  + Cloud Classic supported-list shape inference (NOT a contiguous
+  low-floor range; `[9.0.0, ∞)` excluded). Splunkbase AI's new
+  recommendation extends the floor DOWN to 8.1.0, suggesting 8.x may
+  be on the list. v1.0.6 tests bounded range `">=8.1.0 <10.0.0"`
+  (space conjunction per AI explainer's example syntax). New
+  `docs/DECISION_LOG.md` 2026-06-05 row + `docs/SPLUNK_10_COMPATIBILITY.md`
+  Runtime Verification updated; CLAUDE.md audit log row appended.
+  Cleanup commit needed regardless of v1.0.6 outcome to correct the
+  v1.0.2-v1.0.4 docs' "ranges are type-rejected" claim.
 - 2026-06-04 (evening) — **v1.0.4 Splunkbase upload → F16 SLIM
   unsupported-version rejection of `"9.4"`**. Three single-version
   strings now confirmed NOT on Cloud Classic's supported list: 9.3