docs(planning): close Phase 1.4 — Splunk Dev secrets registered

User completed the Phase 1.4 manual step documented in
`docs/RUNBOOKS.md` "AppInspect API — Credential Setup". Both
GitHub Actions secrets are now registered on the upstream repo:

- `SPLUNK_DEV_USERNAME` — 2026-05-17T17:42:17Z
- `SPLUNK_DEV_PASSWORD` — 2026-05-17T17:42:48Z

Verified via `gh secret list --repo RelativisticJet/wl_manager`
immediately after the user reported "both secrets are present".

Changes:

1. `docs/PUBLIC_RELEASE_PLAN.md` Phase 1.4 row: ⚠️ PARTIAL → ✅
   with timestamp + reference to the DECISION_LOG.md followups
   ack landing in this same commit. Acceptance-criteria column
   left as-is (it was already accurate); the row body now
   describes the actual closure state instead of "awaiting".

2. `docs/PUBLIC_RELEASE_PLAN.md` header status line: Phase 1.4
   moved from ⚠️ PARTIAL to closed; "Next" advanced from
   "complete 1.4 secrets step" to "Phase 1.5 — `appinspect-api-action`
   workflow wiring against the registered secrets".

3. `docs/DECISION_LOG.md` Followups & acknowledgements
   subsection: new "2026-05-17 | D18 followup (Phase 1.4
   closure)" row matching the existing "2026-05-16 | D15 followup"
   row's convention. Records the secret-name + registration
   timestamps (no values; values are not retrievable post-set
   anyway). Notes that end-to-end auth validation is deferred
   to Phase 1.5's first workflow run, which is by design —
   `splunk/appinspect-api-action` does the splunk.com JWT
   exchange internally, so a wrong secret surfaces as a clean
   401 there, not in a separate hand-run round-trip from the
   local shell.

No code, conf, or test changes. Pure docs closure.

Doc-drift hook passes on all 29 docs.

Author: RelativisticJet

docs/DECISION_LOG.md

@@ -46,3 +46,4 @@ Out-of-band closures and acknowledgements that reference decisions in the main t
 | Date | Reference | Body |
 |------|-----------|------|
 | 2026-05-16 | D15 followup (Phase 1.1.1 closure) | Splunk Developer account credentials stored in maintainer's personal password manager. TOTP 2FA enabled on the account; recovery codes stored separately from the password. Linked Gmail (`communicate.oleh@gmail.com`) has its own 2FA + recovery. Storage method intentionally not documented further in this public log. |
+| 2026-05-17 | D18 followup (Phase 1.4 closure) | Splunk Developer credentials registered as GitHub Actions secrets on `RelativisticJet/wl_manager`: `SPLUNK_DEV_USERNAME` (registered 2026-05-17T17:42:17Z) and `SPLUNK_DEV_PASSWORD` (registered 2026-05-17T17:42:48Z). Verified via `gh secret list --repo RelativisticJet/wl_manager` immediately after registration. Phase 1.4 ⚠️ PARTIAL → ✅ flipped at the same time. End-to-end auth validation deferred to Phase 1.5's first workflow run (`splunk/appinspect-api-action` does the splunk.com JWT exchange internally; a wrong secret surfaces as a clean 401 there). Secret values are NOT in the repo; only the registration acknowledgement. |

docs/PUBLIC_RELEASE_PLAN.md

@@ -2,8 +2,8 @@
 
 > Plan owner: Oleh (@RelativisticJet)
 > Created: 2026-05-13
-> Status: **Phase 0 — Foundation cleanup COMPLETE for all 15 rows.** Phase 1 in progress — **1.1, 1.2, 1.3 closed 2026-05-17**; **1.4 ⚠️ PARTIAL** (re-scoped per D18 — skip Cloud Sandbox, use existing splunk.com Dev creds with the AppInspect HTTP API; setup procedure landed in RUNBOOKS.md, awaiting user `gh secret set`). Next: complete 1.4 secrets step → Phase 1.5 (`appinspect-api-action` workflow wiring).
-> Updated: 2026-05-17 (Phase 1.4 re-scoped: D18 added to §1 locking the decision; `docs/RUNBOOKS.md` gained "AppInspect API — Credential Setup" section documenting the `gh secret set` workflow. Phase 1.2 + 1.3 landed earlier this date: `.github/workflows/appinspect.yml` enforcing 0-blocker gate on both `splunk-platform-standalone` and `cloud` profiles + `docs/APPINSPECT_FINDINGS.md` baseline + warning triage; fresh AppInspect run reproduced + fixed an `app.manifest:2.0.0` ↔ `app.conf:1.0.0-rc1` drift; `docs/RELEASE_CHECKLIST.md` §3.5 pre-flight extended)
+> Status: **Phase 0 — Foundation cleanup COMPLETE for all 15 rows.** Phase 1 in progress — **1.1, 1.2, 1.3, 1.4 all closed 2026-05-17**. Next: **Phase 1.5** (`appinspect-api-action` workflow wiring against the `SPLUNK_DEV_USERNAME` / `SPLUNK_DEV_PASSWORD` secrets registered in 1.4).
+> Updated: 2026-05-17 (Phase 1.4 closed: both Splunk Dev GitHub Actions secrets registered 17:42 UTC on `RelativisticJet/wl_manager`, verified via `gh secret list`; D18 followup ack added to `docs/DECISION_LOG.md` followups subsection. Earlier this date: Phase 1.4 re-scoped per D18 (skip Cloud Sandbox; use splunk.com Dev creds directly with the AppInspect HTTP API); `docs/RUNBOOKS.md` gained "AppInspect API — Credential Setup" section. Phase 1.2 + 1.3 landed earlier: `.github/workflows/appinspect.yml` enforcing 0-blocker gate on both profiles + `docs/APPINSPECT_FINDINGS.md` baseline + warning triage; fresh AppInspect run reproduced + fixed an `app.manifest:2.0.0` ↔ `app.conf:1.0.0-rc1` drift; `docs/RELEASE_CHECKLIST.md` §3.5 pre-flight extended)
 
 This document is the canonical plan for taking `wl_manager` from
 private-internal to public open-source on GitHub, then to a listed
@@ -141,7 +141,7 @@ timeline slips, scope does not.
 | 1.1 ✅ 2026-05-16 (per Decision D15 in §1; marked retroactively during 2026-05-15 gap review as G3; demoted to ⚠️ PARTIAL on 2026-05-16 per QA-C5 finding; re-promoted to ✅ same-day after Phase 1.1.1 closure landed in `docs/DECISION_LOG.md` "Followups & acknowledgements" section) | Sign up for Splunk Developer account at dev.splunk.com. Account `Oleh Bezsonov` / `communicate.oleh@gmail.com` is active per D15. **Phase 1.1.1 closed 2026-05-16**: credentials stored in maintainer's personal password manager; TOTP 2FA enabled on the account; recovery codes stored separately from the password; linked Gmail has its own 2FA + recovery — see the 2026-05-16 row in `docs/DECISION_LOG.md` followups subsection. Storage method intentionally not documented further in the public log (the ack is the proof; the credential location stays out-of-repo). Reversibility note per D15: account transferable by emailing Splunk Developer Support if an LLC is ever formed. | Account active, credentials stored securely (method documented OUT-OF-REPO; ack lives in DECISION_LOG.md followups subsection) | 15 min |
 | 1.2 ✅ 2026-05-17 | Wire `splunk/appinspect-cli-action` in new `.github/workflows/appinspect.yml` | Workflow runs against built .spl with `splunk-platform-standalone` profile. **Landed**: `.github/workflows/appinspect.yml` runs both `splunk-platform-standalone` AND `cloud` profiles on push/PR/manual; pins Python 3.11 (per Phase 0.0 wheel-availability finding); enforces a hard gate (0 errors / 0 failures / 0 future_failures) via inline Python summary parse; uploads JSON reports as 30-day artifacts; concurrency-coalesces in-flight runs on the same ref. Uses `pip install splunk-appinspect` directly rather than the `splunk/appinspect-cli-action` wrapper to stay byte-for-byte aligned with the local re-run command at `docs/APPINSPECT_FINDINGS.md` §6 and to avoid a third-party-action version pin; swap is trivial if ever preferred. | 30 min |
 | 1.3 ✅ 2026-05-17 | First AppInspect CLI run + triage findings → `docs/APPINSPECT_FINDINGS.md` | All findings logged by severity (error / warning / manual_check); each has a fix-or-defer decision. **Landed**: `docs/APPINSPECT_FINDINGS.md` written. Standalone 160 success / 0 failure / 0 future_failure / 6 warning; Cloud 157 / 0 / 0 / 5. Zero delta vs Phase 0.0 build-660 baseline. The fresh run surfaced an `app.manifest` version drift (Phase 0.8 demoted `app.conf` to `1.0.0-rc1` but missed `app.manifest`, still at `2.0.0`); fixed in same commit + Phase 0.11b §3.5 pre-flight extended with a 5th check (`info.id.version` in `app.manifest`) so the gap can't recur silently. All 6/5 warnings re-triaged in the doc with per-finding justification (4 high-frequency cron searches accepted as security-critical detection latency, not cosmetic). | 2-4 hr |
-| 1.4 ⚠️ PARTIAL 2026-05-17 (re-scoped per D18; setup procedure landed; awaiting user `gh secret set`) | Per D18, use existing splunk.com Developer credentials (D15) with the AppInspect HTTP API; defer Cloud Sandbox unless Phase 1.6 surfaces hands-on triage need. **Landed this turn**: D18 in §1, this row's re-scope, and `docs/RUNBOOKS.md` "AppInspect API — Credential Setup" section documenting (a) anonymous endpoint probe (`appinspect.splunk.com/v1/info` → AppInspect 4.2.0, matches our local pin) and (b) the `gh secret set SPLUNK_DEV_USERNAME` + `SPLUNK_DEV_PASSWORD` commands the user runs against `RelativisticJet/wl_manager`. **Flip to ✅ when**: user has run both `gh secret set` commands and confirmed via `gh secret list --repo RelativisticJet/wl_manager` (both secrets present); first Phase 1.5 workflow run will be the end-to-end auth validation. | API access confirmed via endpoint probe (AppInspect 4.2.0 matches local pin); credentials stored in GitHub Actions secrets (`SPLUNK_DEV_USERNAME`, `SPLUNK_DEV_PASSWORD`) | 30 min |
+| 1.4 ✅ 2026-05-17 (re-scoped per D18; secrets registered; closure ack at `docs/DECISION_LOG.md` followups subsection) | Per D18, use existing splunk.com Developer credentials (D15) with the AppInspect HTTP API; Cloud Sandbox deferred unless Phase 1.6 surfaces hands-on triage need. Both GitHub Actions secrets (`SPLUNK_DEV_USERNAME`, `SPLUNK_DEV_PASSWORD`) registered against `RelativisticJet/wl_manager` 2026-05-17 17:42 UTC and verified via `gh secret list`. End-to-end auth validation deferred to Phase 1.5's first workflow run — `splunk/appinspect-api-action` does the splunk.com JWT exchange internally; if either secret is wrong, that workflow surfaces a clear 401. Procedure documented in `docs/RUNBOOKS.md` "AppInspect API — Credential Setup". | API access confirmed via endpoint probe (AppInspect 4.2.0 matches local pin); credentials stored in GitHub Actions secrets (`SPLUNK_DEV_USERNAME`, `SPLUNK_DEV_PASSWORD`) | 30 min |
 | 1.5 | Wire `splunk/appinspect-api-action` workflow with `cloud` + `self-service` tags | API workflow fires, dynamic checks complete | 30 min |
 | 1.6 | First AppInspect API run — **surface Cloud-cert blockers** | Findings appended to APPINSPECT_FINDINGS.md. **Critical**: assess `wl_fim.py` / `wl_fim_watch.py` / `wl_expiration_cleanup.py` viability for Cloud profile. **If estimated refactor >2 weeks, escalate per D7 before continuing** | 1 day investigation |
 | 1.7 | Fix all AppInspect "error"-severity findings | Each as atomic commit. AppInspect re-runs green | 1 day – several weeks (per 1.6 outcome) |