1.12.0 — Permission-gated graphs and safer fleet convergence

2026-08-18

django-mojo 1.12.0 makes named REST graphs explicit and permission-aware, hardens single-node and fleet deployment finalization, strengthens MojoSec health and RPM ownership checks, and prevents GoDaddy’s recursive DNS cache from breaking automated ACME issuance.

Breaking

• Undefined special REST graph names now return 400 instead of silently falling back to default. Clients using custom graph names must request a graph the model defines; undefined common names (default, basic, list, simple, detail, detailed, and full) retain default fallback.
• A model that declares RestMeta.GRAPHS without a default graph now raises instead of serializing every field when a request resolves to no defined graph. Add a default graph before upgrading; a model that declares no GRAPHS at all is unaffected.

Added

• Models can declare per-graph permissions with RestMeta.GRAPH_PERMISSIONS; REST and assistant model tools enforce the permission on the graph actually served.
• Deployment state now carries an atomic versioned identity with bounded, no-follow reads and race detection, giving reconciliation durable evidence across restart boundaries.
• MojoSec exposes a closed Audit health contract and structurally verifies installed-file RPM ownership through one bounded isolated transaction.

Changed

• Single-node deployments finalize after the application restart, while recovery reconciles a surviving deployment identity without replaying a completed release.
• Config-sync restarts enqueue non-blocking systemd transactions, avoiding boot-order deadlocks while leaving start failures visible to normal service health checks.
• Privileged platform deployment evidence is available only through the permission-gated admin graph; default and basic responses remain evidence-free.

Fixed

• GoDaddy-backed ACME DNS-01 issuance waits out GoDaddy’s enforced 600-second TXT TTL after authoritative propagation, so secondary CA validation cannot see the previous cached challenge value.
• MojoSec RPM scans retain the prior authoritative baseline when helper readiness, output bounds, ownership, or the RPM database cookie cannot be proven.

Upgrade notes

• Clients that send application-specific ?graph= values must either define those graphs on the model or switch to a common graph name before upgrading.