[Former-Stranger]

What does this change?

• Renames the project to panos-decrypt-bypass: package, CLI command, images, compose service, cookie and docs. PDB_VERSION replaces SDB_VERSION. Existing data directories keep working; docs/installation.md has upgrade steps for 0.1.0 installs.
• Adds MANAGEMENT=local for firewalls that aren't managed by SCM or Panorama. A second Terraform module (terraform/local, PaloAltoNetworks/panos 2.0.14) creates the same URL category, address objects, tag, EDLs, profile and ordered no-decrypt rules in a vsys. Deploys finish with a partial commit over the XML API, limited to FIREWALL_USERNAME's changes. MANAGEMENT=scm stays the default.
• The SCM module moves to terraform/scm. Both modules share an identical lists.tf, and a test checks the two copies match.
• Data directories record which module files they hold, so stale files are cleaned up. Running one mode against the other mode's Terraform state is refused.
• One-click bypasses on a local firewall still auto-apply only when the plan just grows the URL list or adds the URL rule. Anything else goes to review, which shows changes per rule.
• FIREWALL_CA_FILE reaches Terraform as a CA bundle through SSL_CERT_FILE.
• New panos-decrypt-bypass terraform <args> passthrough for destroy, import and state commands, plus a commit alias for push.
• Decryption exclusions stay SCM-only, with a warning in local mode. On a local firewall they're part of the SSL decryption settings that also hold the forward-trust certificates.
• The image mirrors both providers. CI tests both modules and checks that both initialise with no network.

How was it tested?

• uv run python -m unittest discover tests: 70 tests, 25 of them new (workspace, local deployer, auto-approve rules, commit against a fake firewall)
• terraform test: 5 mocked-provider runs per module
• Tried it in demo mode (both modes) and against a real firewall: PAN-OS 11.2 with an XML-API-only role (Log, Configuration, Operational Requests, Commit). Covered: plan, CLI deploy, one-click bypass (auto-applied), a deploy that stopped for review and was then confirmed, rule order, a clean re-plan, wrong-admin detection, destroy and commit. Nothing was left behind.
• Image built and both modules initialised offline from the bundled mirror.

Checklist

• Docs and CHANGELOG.md (0.2.0) updated where users would notice
• No real hostnames, IPs, tenant IDs, keys or logs in code, tests or this PR

🤖 Generated with Claude Code