---
title: "1.22.0 — Fail-closed LLM safety and capture-only registration fields"
description: "django-mojo 1.22.0 adds a fail-closed, policy-driven LLM safety boundary with durable incident recovery, and adds capture-only, accessible hosted registration fields. LLM-enabled deployments must configure and activate the safety policy before upgrading."
date: "2026-09-03"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-22-0/"
---

django-mojo 1.22.0 adds a fail-closed, policy-driven LLM safety boundary with durable incident recovery, and adds capture-only, accessible hosted registration fields. LLM-enabled deployments must configure and activate the safety policy before upgrading.

### Breaking

- LLM-enabled deployments must define and activate a complete version-1 safety policy; missing, invalid, or mixed policy blocks provider calls.
- `llm.call()` and `llm.ask()` now raise stable `LLMExecutionError` codes, and explicit models must match their policy route.
- `llm.verify_api_key()` now verifies an exact stored credential; candidate verification moves to the owner-only Assistant setup flow.

### Added

- Hosted registration fields support `capture_only` and accessible `help_text`.
- Provider-neutral LLM limits, ledgers, circuit breakers, and aggregate monitoring.
- Owner controls for policy activation, emergency stops, credential checks, breaker resets, and historical triage.
- Durable, duplicate-safe incident LLM attempts and recovery.

### Changed

- Catch-all incident triage is disabled by default and begins at an owner-stamped activation watermark.
- Model discovery is guarded and limited to 100 models.
- Registration shorthand and public auth-config wire shapes remain compatible.

### Fixed

- Incident triage now runs at 09:00 and 18:00 instead of every minute during those hours.
- Interrupted or duplicated incident LLM work no longer leaves indefinitely active attempts.

### Security

- Emergency stops, policy disagreement, exhausted budgets, and open circuits fail closed without credential failover.
- Exposed records retain safe codes and bounded identifiers—not prompts, responses, credentials, or raw provider errors.
- Candidate credential recovery is a fixed, audited, owner-only probe.

### Upgrade notes

- Apply the new account and incident migrations before enabling LLM traffic.
- Deploy with the static emergency stop enabled, install one consistent policy, activate it as the installation owner, then remove the stop and redeploy.
- Use a distinct provider credential per installation.
- Downstream LLM calls should provide a fixed `feature`.
- `capture_only` is presentation policy, not a security boundary.