1.15.24 — System Setup describes release-bucket CORS accurately

2026-08-22

System Setup now distinguishes an already-permissive wildcard CORS rule from the missing dedicated portal-origin rule, so its warning tells operators exactly what is absent without claiming uploads are blocked.

What changed

• The release-bucket readiness warning now says when the dedicated portal-origin browser-upload CORS rule is missing.
• Existing wildcard CORS remains a warning because it is broader than the recommended exact-origin rule, but the report no longer falsely claims browser uploads are blocked.
• Remediation remains additive and explicitly preserves existing CORS configuration.

Verification

• Added a regression for a wildcard CORS configuration that already permits uploads.
• test_aws: 329 total, 315 passed, 14 skipped, 0 failed.
• Full release gate: 5,993 total, 5,952 passed, 41 skipped, 0 failed.