1.24.21 — Correct AL2023 failed-exec boundaries

2026-09-09

MojoSec now recognizes AL2023’s trusted PROCTITLE boundary when proving that a failed firewall exec did not create a competing process generation. Missing, incomplete, or conflicting Audit outcomes still remain central.

Fixed

• MojoSec now accepts AL2023’s trusted same-event PROCTITLE record as the terminal boundary for a kernel-confirmed failed firewall execve, preventing legitimate cron-owned reconciliations from being misclassified.