1.24.7 — Firewall authority independent of MojoSec

2026-09-09

django-mojo 1.24.7 makes firewall reconciliation a separately enrolled host capability instead of a side effect of MojoSec. MojoSec can remain off: only an enrolled, ready application runner advertises firewall authority, and explicit fleet membership prevents an unavailable node from being mistaken for fleet-wide success. There are no database migrations, but participating hosts must be enrolled and custom job-channel configurations must include the firewall channel.

Key changes

• A standalone firewall lifecycle now enrolls, checks, repairs, or revokes the broker without enabling MojoSec. Enrollment survives framework deploys and rollbacks, preserves existing kernel state, and does not change SSH access.
• Runners advertise firewall capability only after proving the effective application identity and the exact least-privilege broker grant. Structural configuration failures stop loudly; transient host contention and timeouts retain bounded retry behavior.
• Reconciliation now uses an explicit expected-host list. Healthy hosts can repair themselves while any unavailable expected host prevents aggregate truth from being finalized as fleet-wide success.
• Startup recovery and aggregate work are coalesced and incarnation-aware, avoiding duplicate retry chains while rejecting stale runner evidence.
• Node diagnostics and deployment documentation now report firewall enrollment and runner-channel readiness independently from MojoSec.

Operator action

Enroll every participating host, configure the same complete FIREWALL_EXPECTED_HOSTS list on each one, and add firewall to any project-specific JOBS_CHANNELS override. The standard API channel set includes it automatically.