1.11.11 — Enrolled MojoSec nodes can deploy again, and deploy stderr is privileged

2026-08-17

django-mojo 1.11.11 unblocks every enrolled MojoSec fleet: 1.11.9 and 1.11.10 could not complete a deploy at all, because the packaged post-deploy program declared a MojoSec control-state file in its own trusted-change journal — a path that journal rejects by design — aborting before MojoSec's observe-and-report convergence could run. It also moves the deploy stderr tail added in 1.11.10 up to the security permission tier, where it belongs.

Fixed

• An enrolled MojoSec node could not complete any deploy on 1.11.9 or 1.11.10: the packaged post-deploy program declared a MojoSec control-state file in its own trusted-change journal, which the journal rejects by design, aborting the deploy before MojoSec's observe-and-report convergence could run.

Changed

• A caller-declared trusted-change path under /etc/mojosec, /var/lib/mojosec or /run/mojosec is now ignored with a warning instead of failing the deploy. Those trees are still never journaled, and producer-derived paths still fail closed.

Security

• The deploy stderr tail in node evidence was readable one permission tier too low, by a role that cannot deploy. Per-line redaction is not airtight — an unlabelled secret, a -p secret flag, or URL credentials inside a traceback line survive it. It now requires view_platform_security, manage_platform or admin.
• No REST graph can serve raw node evidence, including unmapped graph names that previously fell through to whole-model serialization.

Upgrade notes

• Enrolled nodes on 1.11.9 or 1.11.10 take this release on the first attempt: the installed script body installs the new wheel, refreshes the trusted-change validator from it before convergence, and the refreshed validator ignores the old body's declaration. No manual intervention and no ordering requirement.
• Callers reading the deploy stderr tail need one of the three permissions above; at bare view_platform the key is absent. It was always optional — a node with no captured stderr never carried it.