1.11.8 — Audit convergence adopts never-enrolled nodes — second fleet-deploy blocker cleared

2026-08-14

django-mojo 1.11.8 clears the second and final 1.11.6-era fleet-deploy blocker: the Linux Audit convergence introduced in 1.11.6 now adopts nodes whose audit rules directory is empty, instead of failing every deploy — and every rollback — on long-lived fleets at required criticality.

Fixed

• MojoSec's Linux Audit convergence now classifies an empty audit rules directory with inert active rules as adoptable seed state. Long-lived nodes whose stock rules file was removed by earlier tooling could never match the previous classifier (exact AL2023 seed or already-managed only), so at required criticality every deploy — and the rollback behind it — failed at post_deploy while the node itself stayed healthy. Non-seed rule content is still refused, protecting any real custom audit policy.

Upgrade notes

• Combined with 1.11.7: fleets that have been failing deploys since 1.11.6 published need no node-side action. The first deploy that resolves this version converges MojoSec fully, including turning on the Audit provenance generation the classifier previously refused to install.