chore(release): mark 1.5.1 live-release evidence

Sync the place-lock version/SHA pins (container unit, OIDC checklist, README,
docs-site, .env.example, build-info) with the 1.5.1 release commit so the
health -smoke contract test tracks the live artifact.

Author: ocx-test

.env.example

@@ -3,8 +3,8 @@
 #
 # Live place lock (do not change from this checkout):
 #   systemd unit: opencodex-proxy
-#   version:      1.5.0
-#   source SHA:   f5cc348b7f0b7a48a9241cac17714399c2777c0f
+#   version:      1.5.1
+#   source SHA:   c88648fa87001d04beedc8df853bee7700253422
 #   health:       http://<tailscale-ipv4>:10100/healthz
 # The immutable GHCR digest lives only on the live host `.env` as OPENCODEX_IMAGE.
 
@@ -15,10 +15,10 @@
 OPENCODEX_API_TOKEN_FILE=deploy/container/.secrets/api-token
 OPENCODEX_STATE_DIR=./.tmp/opencodex-state
 OPENCODEX_GIT_SHA=
-OPENCODEX_VERSION=1.5.0
+OPENCODEX_VERSION=1.5.1
 
 # --- Production compose.example.yml (digest-pinned; not used by local compose) ---
-# OPENCODEX_IMAGE=ghcr.io/groeponline/opencodex:1.5.0@sha256:<immutable-digest>
+# OPENCODEX_IMAGE=ghcr.io/groeponline/opencodex:1.5.1@sha256:<immutable-digest>
 # OPENCODEX_BIND_IP=          # host Tailscale IPv4; required only for prod compose
 
 # --- Cloudflare Access (live public-host gate; optional locally) ---
@@ -49,5 +49,5 @@ OIDC_REDIRECT_URI=http://127.0.0.1:10100/oauth/callback
 
 # --- Healthz smoke (scripts/healthz-smoke.sh) ---
 # OPENCODEX_HEALTH_URL=http://127.0.0.1:10100/healthz
-# OPENCODEX_SMOKE_EXPECT_SHA=f5cc348b7f0b7a48a9241cac17714399c2777c0f
-# OPENCODEX_SMOKE_EXPECT_VERSION=1.5.0
+# OPENCODEX_SMOKE_EXPECT_SHA=c88648fa87001d04beedc8df853bee7700253422
+# OPENCODEX_SMOKE_EXPECT_VERSION=1.5.1

README.md

@@ -528,7 +528,7 @@ mirrors that path:
 | Dev Container | `.devcontainer/` (Bun 1.4.0)                                       |
 | Health smoke  | `bash scripts/healthz-smoke.sh` → `http://127.0.0.1:10100/healthz` |
 
-Operator notes, the live `1.5.0` / `f5cc348b7` place lock, and Authentik OIDC
+Operator notes, the live `1.5.1` / `c88648fa8` place lock, and Authentik OIDC
 (`chefgroep-ocx-oidc`; issuer APPLY DONE 2026-09-18; consumer JWKS +
 `/oauth/login`) are in
 [`deploy/container/README.md`](./deploy/container/README.md). Cloudflare Access

compose.yml

@@ -15,7 +15,7 @@ services:
       dockerfile: Dockerfile
       args:
         VCS_REF: ${OPENCODEX_GIT_SHA:-dev}
-        VERSION: ${OPENCODEX_VERSION:-1.5.0}
+        VERSION: ${OPENCODEX_VERSION:-1.5.1}
     restart: unless-stopped
     read_only: true
     environment:

deploy/container/README.md

@@ -24,8 +24,8 @@ change. Reported live identity:
 | ---------- | --------------------------------------------------------- |
 | Unit       | `opencodex-proxy.service`                                 |
 | Unit state | Non-serving; a separate npm process owns port `10100`     |
-| Version    | `1.5.0`                                                   |
-| Source SHA | `f5cc348b7f0b7a48a9241cac17714399c2777c0f` (tag `v1.5.0`) |
+| Version    | `1.5.1`                                                   |
+| Source SHA | `c88648fa87001d04beedc8df853bee7700253422` (tag `v1.5.1`) |
 | Health     | `GET /healthz` on the host Tailscale IPv4, port `10100`   |
 
 The live bc-scan-2 service runs the published npm package from
@@ -107,7 +107,7 @@ the existing `providers` map instead.
 1. Authentik issuer public apply is done (2026-09-18). The consumer is wired,
    but Cloudflare Access remains the live public-host gate until the cutover
    checklist is executed. Client secret is not in git.
-2. This change documents the `1.5.0` / `f5cc348b7` live release and does not
+2. This change documents the `1.5.1` / `c88648fa8` live release and does not
    move it. Do not deploy this PR to bc-scan-2.
 3. The former Azure `deploy.yml` route is retired fail-closed; do not treat a
    merge here as a live cutover.

deploy/container/opencodex-proxy.service

@@ -2,7 +2,7 @@
 Description=OpenCodex proxy (Docker Compose)
 Documentation=https://github.com/GroepOnline/opencodex
 # Live place lock (docs only — this unit does not embed a version or digest):
-#   version 1.5.0 / source SHA f5cc348b7f0b7a48a9241cac17714399c2777c0f
+#   version 1.5.1 / source SHA c88648fa87001d04beedc8df853bee7700253422
 #   image pin is OPENCODEX_IMAGE in EnvironmentFile (immutable digest)
 #   health: GET :10100/healthz on the host Tailscale IPv4
 # Do not retarget the pin from a docs or local/dev change.

deploy/oidc/CUTOVER-CHECKLIST.md

@@ -36,13 +36,13 @@ hostname. It is not a second identity provider.
 - [x] Host `.env` names set (values not recorded): `OIDC_ISSUER`, `OIDC_CLIENT_ID`,
       `OIDC_CLIENT_SECRET_FILE`, `OIDC_REDIRECT_URI`, `OIDC_ALLOWED_HOSTS`, plus
       `CF_ACCESS_TEAM_DOMAIN`, `CF_ACCESS_AUD`, `CF_ACCESS_ALLOWED_HOSTS`.
-- [x] Actual running artifact is npm package **1.5.0** from
-      `/home/joep/.opencodex/releases/f5cc348b7f0b7a48a9241cac17714399c2777c0f`
+- [x] Actual running artifact is npm package **1.5.1** from
+      `/home/joep/.opencodex/releases/c88648fa87001d04beedc8df853bee7700253422`
       (`start-service.sh` → `src/cli/index.ts start --port 10100`). The unit-file
-      comment and runtime health identity cite tag `v1.5.0` / source SHA
-      `f5cc348b7f0b7a48a9241cac17714399c2777c0f`.
+      comment and runtime health identity cite tag `v1.5.1` / source SHA
+      `c88648fa87001d04beedc8df853bee7700253422`.
 - [x] `GET http://100.65.83.86:10100/healthz` returns `status=ok`,
-      `service=opencodex`, `version=1.5.0`, and source SHA `f5cc348b7…`.
+      `service=opencodex`, `version=1.5.1`, and source SHA `c88648fa8…`.
       Bind is the Tailscale IPv4, not 127.0.0.1. Public
       `https://ocx.chefgroep.online/` is still a Cloudflare Access 302.
 - [ ] systemd `opencodex-proxy.service` is **not** healthy: `ActiveState=activating`,
@@ -56,7 +56,7 @@ hostname. It is not a second identity provider.
 - [x] Issuer `https://auth.chefgroep.online/application/o/ocx/` discovery and JWKS return 200 (APPLY DONE 2026-09-18; not DNS HOLD).
 - [x] Client id is `chefgroep-ocx-oidc`. Client secret exists only in `OIDC_CLIENT_SECRET_FILE` on the host (never git, never ChefFactory catalog).
 - [x] Redirect URIs required by `deploy/oidc/authentik-ocx-client.placeholder.json` are present. Extra unused URIs remain; leave them.
-- [x] Live package version is `1.5.0`. Running tree SHA is `f5cc348b7`. This checklist does not retarget the pin.
+- [x] Live package version is `1.5.1`. Running tree SHA is `c88648fa8`. This checklist does not retarget the pin.
 - [x] `GET http://100.65.83.86:10100/healthz` still returns `status=ok`, `service=opencodex`.
 
 ## Authorize canary (no live cutover)

docs-site/src/content/docs/guides/access-vs-authentik.md

@@ -47,7 +47,7 @@ OPENCODEX_OIDC_CANARY_URL=http://127.0.0.1:10100 bash scripts/oidc-authorize-can
 
 The operator checklist for dual-run and Cloudflare Access cutover is
 [`deploy/oidc/CUTOVER-CHECKLIST.md`](https://github.com/GroepOnline/opencodex/blob/main/deploy/oidc/CUTOVER-CHECKLIST.md).
-Merging the consumer does not move the live `1.5.0` place lock and is not a
+Merging the consumer does not move the live `1.5.1` place lock and is not a
 cutover.
 
 ## See also

src/build-info.json

@@ -1,6 +1,6 @@
 {
-  "git_sha": "f5cc348b7f0b7a48a9241cac17714399c2777c0f",
+  "git_sha": "c88648fa87001d04beedc8df853bee7700253422",
   "built_at": "2026-09-24T09:30:48.055Z",
   "release": "v1.5.0",
-  "gui_version": "1.5.0"
+  "gui_version": "1.5.1"
 }

tests/local-dev-contract.test.ts

@@ -95,7 +95,7 @@ describe("local/dev complete path", () => {
     expect(compose).not.toContain("OIDC_CLIENT_SECRET_FILE:?");
   });
 
-  test("systemd unit keeps the compose place lock and documents 1.5.0 / f5cc348b7", async () => {
+  test("systemd unit keeps the compose place lock and documents 1.5.1 / c88648fa8", async () => {
     const unit = await readRepo("deploy/container/opencodex-proxy.service");
     expect(unit).toContain(
       "ExecStart=/usr/bin/docker compose up -d --remove-orphans",
@@ -106,8 +106,8 @@ describe("local/dev complete path", () => {
     expect(unit).toContain(
       "After=docker.service network-online.target tailscaled.service",
     );
-    expect(unit).toContain("1.5.0");
-    expect(unit).toContain("f5cc348b7f0b7a48a9241cac17714399c2777c0f");
+    expect(unit).toContain("1.5.1");
+    expect(unit).toContain("c88648fa87001d04beedc8df853bee7700253422");
     expect(unit).toContain("GET :10100/healthz");
   });
 
@@ -125,7 +125,7 @@ describe("local/dev complete path", () => {
       "OIDC_REDIRECT_URI=http://127.0.0.1:10100/oauth/callback",
     );
     expect(envExample).toContain("https://ocx.chefgroep.online/oauth/callback");
-    expect(envExample).toContain("f5cc348b7f0b7a48a9241cac17714399c2777c0f");
+    expect(envExample).toContain("c88648fa87001d04beedc8df853bee7700253422");
     expect(envExample).not.toMatch(/OIDC_CLIENT_SECRET=/);
     expect(envExample).not.toMatch(/\bsk-[A-Za-z0-9_-]{20,}\b/);
     expect(envExample).not.toMatch(/\bghp_[A-Za-z0-9_]{20,}\b/);
@@ -230,7 +230,7 @@ describe("local/dev complete path", () => {
     expect(checklist).toContain("GET /oauth/login");
     expect(checklist).toContain("Do not apply Cloudflare DNS");
     expect(checklist).toContain("ChefFactory");
-    expect(checklist).toContain("1.5.0");
+    expect(checklist).toContain("1.5.1");
     expect(checklist).toContain(":10100");
   });
 });
@@ -243,11 +243,11 @@ describe("healthz-smoke against a live proxy", () => {
     try {
       const ok = await runHealthzSmoke({
         OPENCODEX_HEALTH_URL: `http://127.0.0.1:${server.port}/healthz`,
-        OPENCODEX_SMOKE_EXPECT_VERSION: "1.5.0",
+        OPENCODEX_SMOKE_EXPECT_VERSION: "1.5.1",
       });
       expect(ok.exitCode).toBe(0);
       expect(ok.stdout).toContain('"service": "opencodex"');
-      expect(ok.stdout).toContain('"version": "1.5.0"');
+      expect(ok.stdout).toContain('"version": "1.5.1"');
     } finally {
       await server.stop(true);
     }