1.11.9 — MojoSec becomes an observer on the deploy path — convergence can never abort a deploy

2026-08-14

django-mojo 1.11.9 makes deploy-time MojoSec convergence observe-and-report by design: a convergence surprise restores prior state, records exactly what was skipped, and lets the deploy finish — it can never again fail a fleet deploy. It also completes audit-state adoption: seed rules are classified by their effective directives, so stock distro nodes adopt cleanly.

Changed

• Deploy-time MojoSec convergence never aborts a deploy, at any criticality. On any convergence failure it restores the exact prior state (sensor unit, config, nginx fragments, audit and broker files), leaves the sensor running as it was, records the skipped convergence to a root-owned marker file for the operator, and the deploy completes. Previously a required-criticality fleet failed the whole deploy — and its rollback — over harmless machine-state differences; three consecutive production outages came from exactly this. Turning the sensor off keeps strict semantics: that is an explicit operator action, not a routine deploy.

Fixed

• Audit seed classification is by effective directives, not bytes: comments, blank lines, and whitespace no longer disqualify a rules file. The distro ships its seed semantics wrapped in comments, so the previous byte-exact match admitted only freshly skeleton-provisioned nodes. A file whose directives only delete or suppress is seed; any substantive rule still refuses adoption, protecting real local audit policy.

Upgrade notes

• Together with 1.11.7 and 1.11.8 this closes out the 1.11.6 fleet-deploy blockers. Fleets need no node-side action. If MojoSec convergence ever degrades during a deploy, the deploy still lands; check /etc/mojosec/deploy-degraded.json on the node for what was skipped and why — a later successful converge clears it.