1.11.6 — Privileged provenance and durable WebApp onboarding

2026-08-13

django-mojo 1.11.6 makes MojoSec privileged activity attributable and fail-open, routing expected firewall automation through a verified broker while preserving rich operator evidence, and adds replay-safe Admin onboarding that can create a new WebApp organization in place.

Added

• Admin WebApp onboarding can create a new organization and application in one durable, replay-safe flow, with recovery for interrupted or ambiguous drafts.
• MojoSec records bounded process and session provenance for privileged activity and uses a root-owned semantic firewall broker for expected job automation.

Changed

• Scoped WebApp administrators can resume onboarding with current group authority, while globally gated Domains navigation stays hidden without global access.
• The site wordmark gives greater visual emphasis to MOJO.

Security

• Sudo incidents now expose the exact bounded command, executable, working directory, actor, TTY, source IP, and validated ancestry available to security administrators.
• Expected firewall automation becomes local-only only when Audit health, CROND/PAM origin, job context, broker receipts, and every privileged child execution agree; missing, conflicting, stale, or delayed proof is delivered as an ordinary rich event.
• MojoSec preserves pending evidence across restarts and collectors, flushes held alerts before shutdown or downgrade, and keeps deployment rollback compatible with the previous sensor generation.

Upgrade notes

• On supported Amazon Linux 2023 nodes, MojoSec replaces only the recognized task,never Audit seed, installs an audit-health helper and firewall broker, and waits for a proven post-cutover job-engine lineage before suppressing automation. Unknown Audit policy is refused rather than overwritten.
• Legacy direct firewall sudo grants remain temporarily available for framework rollback and are reported as transitional drift; they are not eligible for suppression.