1.18.0 — Typed KISS deployments and reliable delegated ACME

2026-08-23

django-mojo replaces the policy-heavy deployment path with a small typed transaction that checks Django, nginx, and real service health, while preserving migrations, mixed node roles, and mechanical rollback. Delegated ACME issuance also stops deadlocking behind incompatible hub and client timeouts, and the default test run becomes a fast core safety baseline.

Breaking

• Fleet nodes still running the predecessor deployment body must install django-mojo 1.18.0 and recycle their job engine once before the first webhook-driven deployment; an already-running old shell cannot switch itself to the new transaction.
• Projects that vendored full deployment scripts must replace or update those copies. Locator-based API shims need no project source change.

Added

• Deployment nodes now have explicit api, code, or project-defined lifecycle types. API nodes retain migrations and framework configuration, code nodes install without API side effects, and custom nodes use one three-verb project profile.

Changed

• Deployment acceptance is now limited to required lifecycle commands, candidate Django loading, nginx -t, service restart, and an exact HTTP 200 probe. MojoSec, RPM/FIM, TLS-lineage, certificate, role, ownership, and trusted-change policy no longer veto administrator-authorized releases.
• The complete deployment and rollback run in a bounded transient systemd unit, allowing specialized nodes to restart their own worker safely while retaining previous Git, dependency, framework, configuration, and service recovery.
• A bare bin/run_tests --agent now runs the curated core preset. Use --tier framework for the previous framework-wide gate and --all only for the complete opt-in surface.

Fixed

• Delegated ACME hub publish and withdrawal return after Route53 accepts the exact change instead of blocking behind a 300-second propagation budget and a 30-second client timeout. Downstreams require a strict majority of discovered authoritative nameservers before validation, while reconciliation failures are retried and surfaced without stacking sweep jobs.

Upgrade notes

• Bootstrap legacy deployment nodes before moving the fleet framework pin, then test one API canary through the normal webhook. Specialized nodes must stage their profile before setting EDGE_DEPLOY_NODE_TYPE and joining the platform-deploy channel.
• In mixed-version ACME federation, upgrade hubs before downstream clients; old clients work with the new hub, while a new client cannot repair an old hub that still blocks its response.