1.15.16 — Safer WebApp reruns and regional S3 uploads

2026-08-21

WebApp workflow reruns now create distinct immutable releases, S3 uploads use the selected AWS region without overriding compatible-storage endpoints, and Admin rate-limit inspection is fair and bounded across standalone Redis and Redis Cluster.

Changed

• Generated WebApp workflows now give every GitHub Actions attempt its own immutable release identity while retaining the source commit as the readable prefix.
• Codex project tooling now generates the file-backed request, scope, and build workflows plus synchronized post-build review agents.

Fixed

• S3 presigned uploads use the selected AWS region by default while preserving custom endpoints configured explicitly, through environment variables, or through shared AWS profiles.
• Admin Assistant rate-limit inspection fairly samples fixed and sliding windows across Redis primaries, bounds result and scan work, and reports when the view is truncated.
• Workflow reruns can rebuild the same commit without colliding with an earlier immutable WebApp manifest; intentional rollback remains the human-only Admin action that selects an existing verified release.

Upgrade notes

• Existing WebApp repositories should change a bare ${{ github.sha }} release version to ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}. Newly generated workflows already use this form.