1.4.0 — Redis index ownership, and file upload hardening

2026-08-07

Closes a case where a test checkout could flush a Redis index another suite was using — including on a remote Redis, where the ownership guard was checking the wrong server entirely. Also hardens the file upload lifecycle and scopes record attachments.

Changed

• Redis allocation now fails closed when Redis is unreachable. Set MOJO_TESTENV_NO_REDIS=1 to opt out of the allocation-time probe. This is the one behaviour change adopters need to know about.
• Allocation no longer imports from mojo.* or reads Django settings, so allocating from a test settings module can no longer pin the process's Redis client to index 0. The ceiling now comes from MOJO_TESTENV_REDIS_LIMIT.

Fixed

• The pre-flush ownership guard checked the wrong server. It resolved host and port from environment variables while the client that actually flushes is built from REDIS_URL and can point anywhere. Against a remote Redis the guard passed locally and the flush emptied another owner's index — then stamped a false claim on an unrelated local index. Ownership calls now accept the live client and use it as-is.
• MOJO_TESTENV_NO_REDIS=1 silently disabled the guard entirely, leaving an unguarded flush.
• A corrupt allocation registry is preserved rather than silently overwriting every checkout's record.
• File relation and avatar semantics.

Security

• File upload lifecycle hardened, with a policy-safe MIME sniff fallback preserved.
• Record attachments are scoped — an attachment cannot be pointed at a record the caller has no claim on.

Added

• Redis ownership stamps (testenv:owner), checked at allocation and before every flush.
• New public API: redis_owner, redis_index_is_free, claim_redis_index, stamp_redis_owner.
• New environment variables: MOJO_TESTENV_REDIS_LIMIT, MOJO_TESTENV_NO_REDIS, MOJO_TESTENV_REDIS_HOST, MOJO_TESTENV_REDIS_PORT.
• Assistant attachment references.
• Test runs report themselves to the work board with no configuration, so a project's green-or-red status is answerable without access to the machine that ran them.