1.24.14 — Canonical firewall broker lineage

2026-09-09

Firewall broker launches now produce one canonical Audit exec generation so MojoSec can prove expected reconciliation work without weakening its fail-open checks.

Fixed

• The root firewall broker now enters safe-path Python directly, preventing a shell trampoline from creating an ambiguous second exec generation that kept routine reconciliation events in the central feed.
• Node audit now includes separately retained live engine anchors in the documented process-node bound instead of misreporting bounded provenance state as unhealthy.