1.39.0 — MojoSec defaults, protected health evidence and safer upgrade boundaries

2026-10-20

Installs receipt-backed MojoSec ignore and scanner-block defaults, adds protected health snapshots and diagnostics, and strengthens firewall target and shared-ACME upgrade safety. Existing operator security policies remain preserved.

Breaking

• New firewall blocks refuse non-global, protected, trusted-proxy and actively whitelisted IPv4 targets.
• Stale Fleet configuration publication revisions return HTTP 409.
• Shared ACME remains disabled until a qualified operator cutover; existing participant state requires qualification before mutations resume.

Added

• Protected five-minute health snapshots through REST and Assistant/MCP, with independently expiring source observations and paginated failed/expired job evidence.
• Read-only fleet health, selected-node diagnostics and monitoring coverage with separate platform, AWS and jobs permissions.
• Opt-in tenant-specific list requirements and project-defined realtime/chat subscription checks. Invalid configured subscription handlers fail closed; unset handlers preserve existing behavior.
• Protected shared-validation configuration, approved hub profiles, write-only credentials, named recipient keys and per-node loaded-identity verification.

Changed

• MojoSec installs create-only governed defaults after schema-ready migration and during ingestion. Existing operator categories and edited or disabled defaults remain preserved.
• Receipt-proven routine activity and redirected/refused probes avoid incident noise. Failures and unproven operations remain visible; host incidents bundle by installation and web incidents by source address.
• Packaged Admin updated to portal-mojo 0.2.19.

Fixed

• Diagnostic deadlines cover DNS, connections, TLS and complete transfers. Missing metrics and incomplete source coverage remain explicit.
• Health publication fences stale collectors and retains independent source failures and resource-role obligations.
• Shared-validation contention refuses before mutation and preserves diagnostics until admission succeeds.
• Bounded DNS regression expectations support Python 3.13 mapped-IPv6 formatting.

Security

• MojoSec scanner blocking requires three fresh trusted receipts across three distinct sensitive paths within ten minutes. The one-hour checked block revalidates evidence when its queued job executes.
• Firewall sets exclude unsafe addresses while preserving stored operator intent. Malformed protection settings refuse new blocks while permitting removals.

Upgrade notes

• Apply normal database migrations. DNSMan migration leaves shared validation in owner-only compatibility mode without creating trust or binding legacy owners.
• Shared ACME activation requires a separately authorized cutover with a qualified published artifact, quiesced writers/launch sources and retained root recovery floors. Protected consumer selectors must be pinned before publication.
• Preview legacy visibility replacement with mojosec_rules --repair-visibility. Applying requires its matching revision; historical evidence is retained. Disable defaults to preserve overrides.
• Health snapshots require installation/environment identity and existing cron/job infrastructure. Missing, stale or denied evidence remains unknown; reads perform no remediation.