Cloud Codex 0.15.0

The standalone release. Cloud Codex is one complete product on its own: suite mode, the connection to a sibling product and the issuer-specific behaviour are removed. Sign-in works with any standard OIDC issuer.

Highlights

• Provider-neutral OIDC. Sign-in, sign-out and back-channel logout are tested against a second issuer shape. Setup notes cover common providers. "Hosted mode" is now called OIDC-only mode; no variable names or values changed.
• Safer claims handling. Userinfo refines the ID token instead of replacing it. An email and its verified flag always come from one source. A userinfo subject that differs from the ID token's is refused.
• Cleaner configuration. Variables the server no longer reads are named at boot with a one-line reason.
• JSON 404s. Any unmatched /api path answers a JSON 404.
• Phone layout and presence fixes. On phones, the nav strip no longer runs under the account avatar. The same person in two tabs shows one avatar.

Upgrading from 0.14.0

One migration runs. If you never ran Codex beside another product, nothing else changes.

If you did, read the CHANGELOG's upgrade notes and docs/deployment.md first:

• After upgrading, review Admin, Users. Accounts a sync promoted keep their admin role.
• Open invitations that granted admin are expired.
• Accounts linked to an identity provider now accept a local password and local two-factor. Set AUTH_PROVIDERS=oidc to keep sign-in provider-only.

The full list is in CHANGELOG.md.