1.24.11 — Deployment-complete MojoSec identity proof

2026-09-09

django-mojo 1.24.11 makes ordinary enrolled deployments fully converge MojoSec from the activated framework before firewall work, so newly shipped identity-helper assets actually reach hosts. It also persists a protected Yama ptrace policy without weakening stricter host settings. No migrations or consumer code changes are required.

Fixed

• Ordinary candidate and previous-version activations now fully converge enrolled MojoSec assets before firewall reconciliation, instead of only restarting the existing sensor unit.
• Deployment identity is carried into trusted-change evidence, while observer degradation remains non-blocking to application rollout.

Security

• Observe convergence persists kernel.yama.ptrace_scope >= 1, raises weak live policy immediately, and never lowers an existing value of 2 or 3.
• Managed sysctl content and metadata are replaced atomically, symlinks are refused, and failed convergence restores the prior file and live kernel value.
• Node checks now verify that live and persistent ptrace protection agree exactly.

Upgrade notes

• Enrolled hosts adopt the helper units and managed kernel policy automatically on their next normal deployment.
• Mode-off removes the package-owned persistent setting after retiring the helper, without weakening the current live kernel value.