1.24.20 — Reliable short-lived firewall proof

2026-09-09

MojoSec now handles short-lived AL2023 firewall processes without misclassifying legitimate cron-owned work. Exact receipt, command, parent, and pinned JobEngine checks remain required.

Fixed

• MojoSec no longer treats a kernel-confirmed failed firewall execve as a competing process generation.
• Short-lived firewall processes missing start-tick enrichment can match their exact Audit PID within a bounded two-second receipt window; incomplete or conflicting evidence still remains central.