---
title: "1.24.7 — Firewall authority independent of MojoSec"
description: "django-mojo 1.24.7 makes firewall reconciliation a separately enrolled host capability instead of a side effect of MojoSec. MojoSec can remain off: only an enrolled, ready application runner advertises firewall authority, and explicit fleet membership prevents an unavailable node from being mistaken…"
date: "2026-09-09"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-24-7/"
---

django-mojo 1.24.7 makes firewall reconciliation a separately enrolled host capability instead of a side effect of MojoSec. MojoSec can remain off: only an enrolled, ready application runner advertises firewall authority, and explicit fleet membership prevents an unavailable node from being mistaken for fleet-wide success. There are no database migrations, but participating hosts must be enrolled and custom job-channel configurations must include the firewall channel.

## Key changes

- A standalone firewall lifecycle now enrolls, checks, repairs, or revokes the broker without enabling MojoSec. Enrollment survives framework deploys and rollbacks, preserves existing kernel state, and does not change SSH access.
- Runners advertise firewall capability only after proving the effective application identity and the exact least-privilege broker grant. Structural configuration failures stop loudly; transient host contention and timeouts retain bounded retry behavior.
- Reconciliation now uses an explicit expected-host list. Healthy hosts can repair themselves while any unavailable expected host prevents aggregate truth from being finalized as fleet-wide success.
- Startup recovery and aggregate work are coalesced and incarnation-aware, avoiding duplicate retry chains while rejecting stale runner evidence.
- Node diagnostics and deployment documentation now report firewall enrollment and runner-channel readiness independently from MojoSec.

## Operator action

Enroll every participating host, configure the same complete `FIREWALL_EXPECTED_HOSTS` list on each one, and add `firewall` to any project-specific `JOBS_CHANNELS` override. The standard API channel set includes it automatically.