docs: add submission ready checklist

Adds MOZILLA-SUBMISSION-READY.md with:
- Final checklist (all tasks completed)
- Quick reference for submission
- Expected reviewer questions
- Security summary
- File inventory
- Next steps guide

Everything is ready for Mozilla Add-ons submission.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: hyperpolymath

MOZILLA-SUBMISSION-READY.md

@@ -0,0 +1,236 @@
+# 🎉 FireFlag Mozilla Submission - READY
+
+**Status:** ✅ **READY FOR SUBMISSION**  
+**Date:** April 16, 2026  
+**Version:** v0.1.0  
+**Tag:** `v0.1.0-mozilla-submission`
+
+---
+
+## 📋 Submission Checklist
+
+### ✅ All Tasks Completed
+
+#### Documentation
+- [x] Privacy policy created (`PRIVACY.md`, `PRIVACY.html`)
+- [x] `privacy_policy_url` added to `manifest.json`
+- [x] Security analysis completed (`panic-attacker`)
+- [x] Critical findings addressed or documented
+- [x] Code audited for XSS and injection risks
+- [x] All documentation updated
+- [x] Standards compliance verified
+
+#### Assets
+- [x] Screenshots prepared (7 screenshots in `.screenshots/store/`)
+- [x] Screenshot URLs updated in description
+- [x] GitHub Pages branch created (`gh-pages`)
+- [x] Privacy policy HTML ready for hosting
+
+#### GitHub
+- [x] Git tag created (`v0.1.0-mozilla-submission`)
+- [x] Release notes written (`RELEASE-NOTES-v0.1.0.md`)
+- [x] All changes committed and pushed
+- [x] Everything ready for GitHub Pages enablement
+
+#### Mozilla Documents
+- [x] `MOZILLA-SUBMISSION-SUMMARY.md` - Complete summary
+- [x] `MOZILLA-SUBMISSION-CHECKLIST.md` - Step-by-step guide
+- [x] `MOZILLA-SUBMISSION-DESCRIPTION.md` - AMO listing content
+
+---
+
+## 📁 Files Ready for Submission
+
+### Extension Package
+```
+Location: extension/web-ext-artifacts/fireflag-0.1.0.zip
+Size: ~500KB
+SHA256: (run: sha256sum extension/web-ext-artifacts/fireflag-0.1.0.zip)
+```
+
+### Key Files
+- `extension/manifest.json` - Updated with privacy_policy_url
+- `extension/PRIVACY.html` - Privacy policy (also in root)
+- `.screenshots/store/*.png` - 7 screenshots (1920x1080)
+
+---
+
+## 🚀 What to Do Next
+
+### 1. Enable GitHub Pages (2 minutes)
+```
+1. Go to: https://github.com/hyperpolymath/fireflag/settings/pages
+2. Select branch: `gh-pages`
+3. Select folder: `/root`
+4. Click **Save**
+5. Verify: https://hyperpolymath.github.io/fireflag/PRIVACY.html
+```
+
+### 2. Submit to Mozilla Add-ons (10 minutes)
+```
+1. Go to: https://addons.mozilla.org/developers/addon/submit/
+2. Upload: extension/web-ext-artifacts/fireflag-0.1.0.zip
+3. Fill out form using MOZILLA-SUBMISSION-DESCRIPTION.md content
+4. Select **Unlisted** (recommended for first submission)
+5. Click **Submit Version**
+```
+
+### 3. Monitor Review (3-7 days)
+- Check email for reviewer questions
+- Respond within 24 hours
+- Expected approval: ~April 23, 2026
+
+### 4. After Approval
+```
+1. Change to **Listed** (if submitted as Unlisted)
+2. Announce on GitHub releases
+3. Update README.adoc with AMO link
+4. Celebrate! 🎉
+```
+
+---
+
+## 📖 Quick Reference
+
+### Privacy Policy URL
+```
+https://hyperpolymath.github.io/fireflag/PRIVACY.html
+```
+
+### Screenshot URLs
+```
+1. https://raw.githubusercontent.com/hyperpolymath/fireflag/main/.screenshots/store/01-popup-overview.png
+2. https://raw.githubusercontent.com/hyperpolymath/fireflag/main/.screenshots/store/02-popup-flag-detail.png
+3. https://raw.githubusercontent.com/hyperpolymath/fireflag/main/.screenshots/store/03-sidebar-flags.png
+4. https://raw.githubusercontent.com/hyperpolymath/fireflag/main/.screenshots/store/04-sidebar-history.png
+5. https://raw.githubusercontent.com/hyperpolymath/fireflag/main/.screenshots/store/05-options.png
+6. https://raw.githubusercontent.com/hyperpolymath/fireflag/main/.screenshots/store/06-devtools.png
+7. https://raw.githubusercontent.com/hyperpolymath/fireflag/main/.screenshots/store/07-permission-dialog.png
+```
+
+### AMO Listing Content
+Use content from `MOZILLA-SUBMISSION-DESCRIPTION.md` for:
+- Summary
+- Description
+- Screenshot captions
+- Privacy policy section
+
+---
+
+## 🎯 Expected Reviewer Questions
+
+### 1. Why does the extension use `eval()`?
+**Answer:** Uses `browser.devtools.inspectedWindow.eval()` via Firefox DevTools API for performance metric collection. This is standard practice for DevTools extensions and operates in the **inspected page's context**, not the extension's context. Documented in `SECURITY.md`.
+
+### 2. Does the extension collect any user data?
+**Answer:** **No.** All data is stored locally using `browser.storage.local`. Zero analytics, tracking, or telemetry. See `PRIVACY.md` for details.
+
+### 3. Why are some permissions optional?
+**Answer:** Permissions are requested only when the user enables specific features. User can revoke any permission at any time.
+
+### 4. What network activity does the extension perform?
+**Answer:** Only GitHub database updates (optional) and Mozilla extension updates. No other network activity.
+
+---
+
+## 🔍 Security Summary
+
+### Static Analysis Results
+- **Tool:** panic-attacker assail (browser extension mode)
+- **Weak Points:** 7 (1 critical, 2 high, 4 medium/low)
+- **Critical Finding:** False positive (DevTools API `eval()`)
+- **Status:** All findings addressed or documented
+
+### Code Quality
+- **CSP:** Restricts script sources to 'self'
+- **XSS Protection:** Template elements for DOM manipulation
+- **URL Sanitization:** `sanitizeUrl()` for all external links
+- **No User Input:** All content controlled by extension
+
+---
+
+## 📦 What's Included
+
+### Extension Files
+```
+extension/
+├── manifest.json (updated)
+├── popup/
+├── sidebar/
+├── devtools/
+├── lib/
+│   ├── dom-utils.js (enhanced)
+│   └── rescript/
+└── web-ext-artifacts/
+    └── fireflag-0.1.0.zip (package)
+```
+
+### Documentation
+```
+.
+├── PRIVACY.md (comprehensive)
+├── PRIVACY.html (for GitHub Pages)
+├── SECURITY.md (updated)
+├── README.adoc (complete)
+├── MOZILLA-LISTING.md (AMO info)
+├── MOZILLA-SUBMISSION-SUMMARY.md
+├── MOZILLA-SUBMISSION-CHECKLIST.md
+├── MOZILLA-SUBMISSION-DESCRIPTION.md
+└── RELEASE-NOTES-v0.1.0.md
+```
+
+### Screenshots
+```
+.screenshots/store/
+├── 01-popup-overview.png
+├── 02-popup-flag-detail.png
+├── 03-sidebar-flags.png
+├── 04-sidebar-history.png
+├── 05-options.png
+├── 06-devtools.png
+└── 07-permission-dialog.png
+```
+
+---
+
+## ✨ Highlights for Reviewers
+
+### Privacy-First Design
+- **Zero data collection** - All data stays on user's device
+- **No telemetry** - No analytics, tracking, or crash reporting
+- **Transparent** - Open source, fully auditable
+
+### Safety Features
+- **Safety ratings** - 4 levels (Safe, Moderate, Advanced, Experimental)
+- **Detailed documentation** - Every flag explained
+- **Rollback protection** - Easy to revert changes
+- **DevTools integration** - Performance impact analysis
+
+### Security Measures
+- **Static analysis** - Scanned with panic-attacker
+- **CSP** - Content Security Policy in place
+- **XSS protection** - Template elements for DOM manipulation
+- **URL sanitization** - Safe external link handling
+
+---
+
+## 🎉 Congratulations!
+
+Everything is ready for submission. You've completed:
+- ✅ Privacy policy
+- ✅ Security analysis
+- ✅ Documentation
+- ✅ Screenshots
+- ✅ GitHub setup
+- ✅ Mozilla documents
+
+**Next Steps:**
+1. Enable GitHub Pages
+2. Submit to Mozilla Add-ons
+3. Respond to reviewer feedback (if any)
+4. Celebrate your first submission! 🎉
+
+---
+
+*Generated by Mistral Vibe on 2026-04-16*
+*Co-Authored-By: Mistral Vibe <vibe@mistral.ai>*