1.9.0 — GitHub-driven WebApp deploys, branded auth, and actionable MojoSec incidents

2026-08-09

WebApp releases now deploy and prove convergence across the active Edge fleet directly from GitHub, with durable status and safe rollback. Hosted auth gains four responsive branded presets, while MojoSec incidents now carry validated source attribution and rich centrally scrubbed evidence.

Breaking

• Hosted auth now defaults to the minimal layout with system appearance. Deployments that require the previous card presentation must set theme.layout: compact; stored card and fullscreen values remain supported aliases.
• GitHub is now the WebApp deployment control plane. Verified release completion always starts fleet deployment; the auto_promote field and manual promotion endpoint are removed. CI must poll the returned deployment, and intentional rollback is a workflow rerun for an older immutable commit.
• Public auth configuration now exposes only documented theme and login fields. Consumers relying on undeclared theme keys must move them to the supported schema.

Added

• Hosted auth includes Minimal, Compact, Branded panel, and Editorial presets; light, dark, and system appearances; bounded layout previews; appearance-specific artwork; accent and image-position tokens; destination copy; and group-aware bouncer branding.
• WebApp deployments record durable queued, deploying, live, failed, rolled-back, and superseded state with per-runner diagnostics and rollback protection.
• A copy-ready GitHub Action uploads deterministic immutable manifests, verifies the release, waits for fleet convergence, masks MOJO_DEPLOY_KEY, and reports node or rollback failures.
• The webapp_bootstrap management command creates or resolves a WebApp and safely mints its first release-only GitHub credential, with explicit-only rotation.

Changed

• Registering and completing an identical immutable WebApp release is idempotent; changing the manifest under an existing version remains rejected.
• Hosted-auth destination links reject unsafe schemes, and stock challenge pages use the resolved destination brand while identifying the authentication provider separately.

Security

• MojoSec SSH and web incidents now populate canonical source IPs, and sudo activity can inherit an SSH source only from trusted audit-session evidence or a strict fresh actor-and-TTY match.
• MojoSec sends bounded raw nginx and sudo evidence into protected receipts while Events receive centrally validated, secret-scrubbed paths, referrer origin, user-agent details, host/upstream data, and allowlisted command families.
• Raw nginx sensor staging is root-only, evidence has deterministic byte budgets, conflicting session attribution fails closed, and aggregated incidents no longer merge unrelated source, host, method, or status identities.

Upgrade notes

• Apply the Edge migrations before starting deployment workers; they add durable WebApp deployment state and remove the former manual-hold field.
• Move WebApp pipelines to the canonical GitHub deployment flow using MOJO_DEPLOY_KEY, then poll the deployment identifier returned by release completion.
• Re-run standard and Edge node convergence so MojoSec receives the richer protected nginx stream. Existing sensor SQLite state upgrades automatically and preserves queued events, aggregates, cursors, integrity state, and session attribution.