1.22.0 — Fail-closed LLM safety and capture-only registration fields

2026-09-03

django-mojo 1.22.0 adds a fail-closed, policy-driven LLM safety boundary with durable incident recovery, and adds capture-only, accessible hosted registration fields. LLM-enabled deployments must configure and activate the safety policy before upgrading.

Breaking

• LLM-enabled deployments must define and activate a complete version-1 safety policy; missing, invalid, or mixed policy blocks provider calls.
• llm.call() and llm.ask() now raise stable LLMExecutionError codes, and explicit models must match their policy route.
• llm.verify_api_key() now verifies an exact stored credential; candidate verification moves to the owner-only Assistant setup flow.

Added

• Hosted registration fields support capture_only and accessible help_text.
• Provider-neutral LLM limits, ledgers, circuit breakers, and aggregate monitoring.
• Owner controls for policy activation, emergency stops, credential checks, breaker resets, and historical triage.
• Durable, duplicate-safe incident LLM attempts and recovery.

Changed

• Catch-all incident triage is disabled by default and begins at an owner-stamped activation watermark.
• Model discovery is guarded and limited to 100 models.
• Registration shorthand and public auth-config wire shapes remain compatible.

Fixed

• Incident triage now runs at 09:00 and 18:00 instead of every minute during those hours.
• Interrupted or duplicated incident LLM work no longer leaves indefinitely active attempts.

Security

• Emergency stops, policy disagreement, exhausted budgets, and open circuits fail closed without credential failover.
• Exposed records retain safe codes and bounded identifiers—not prompts, responses, credentials, or raw provider errors.
• Candidate credential recovery is a fixed, audited, owner-only probe.

Upgrade notes

• Apply the new account and incident migrations before enabling LLM traffic.
• Deploy with the static emergency stop enabled, install one consistent policy, activate it as the installation owner, then remove the stop and redeploy.
• Use a distinct provider credential per installation.
• Downstream LLM calls should provide a fixed feature.
• capture_only is presentation policy, not a security boundary.