CID222 0.4.0

0.4.0 is the first minor release of CID222. It supersedes the 0.3 line, whose last published release was 0.3.49. Every 0.3.x appliance upgrades to it directly: the release declares no minimum version to upgrade from, so no intermediate step is required.

What's new

Risk and analysis

• The LLM Risk Analyst reviews a user whose jailbreak and prompt-injection detections fill a sliding window, and records a verdict you can read, question in a chat, and act on from Risk Analysis and AI Analyst.
• My team shows a group leader the members they lead, their reviews and their locks, without giving them the rest of the estate.
• A user lock raised by a review is honoured on every enforcement surface, and cleared through an explicit unlock flow.
• The analyst and its tooling run on the appliance as the risk-analyst and mcp-server containers, started only with --profile llm-analyst, so nothing is sent to a third-party model.

Reference knowledge

• The full MITRE ATLAS release ships as reference tables with a matrix tab, a detail sheet and search, and the analyst cites a technique only after confirming it against the loaded release.
• Six pinned OWASP AI-security documents ship the same way, including OWASP's own crosswalks to ATLAS.

Detection

• RAG hallucination detection runs as the hallucination-guard container, covering English and Turkish.
• Provider API keys are detected as secrets — Anthropic, OpenAI project, GitHub, Slack, Google and CID gateway keys.
• Turkish and Nordic identity field labels are recognised by the regex layer.
• All Detections is one feed over every source — chat, proxy, ICAP, extension, image and document — with a per-row detail drawer, an input-versus-output filter and clean traffic included rather than hidden.
• The DecisionBOM explains why a decision was made and states what the record cannot prove.

Compliance and governance

• Findings answer "and what did you do about it?" against a detection, with a review state and an owner.
• Compliance Reports produce a graded scorecard per subject, and a subject can be a tenant group.
• Regulatory mappings are versioned, and evidence is pinned to the version it was captured under.
• A reporting period can be frozen so it stops following the data, on demand or on a schedule.
• The evidence pack can be verified by an auditor without trusting the appliance that produced it.
• Governance inventories the AI assets in use — shadow discovery, ownership, EU AI Act risk tiers, drift and assignable decommissioning.

Visibility

• AI Usage reports Shadow-AI usage from extension and proxy traffic together, scores the risk each event carries, groups it by application, drills down to one person, and exports as a branded PDF.
• Retention is an explicit, scheduled policy an operator can see and set.
• SIEM export adds OCSF, per-destination scoping, a three-tier severity discipline, export health and agent/tool activity as metadata.
• The ITSM handoff pushes findings into your own ticket system.

Administration

• The auditor role is released as the fifth fixed role, and Access Control becomes its own page where an operator chooses which roles see which pages.
• Licensing enforces the seat cap, shows one capability map with licence history and an expiry digest, and writes LICENSE_EXPIRING, LICENSE_GRACE, LICENSE_EXPIRED and LICENSE_TRIAL_EXPIRED to the event log so a lapse can be alerted on.
• Settings → Certificates manages the appliance's own HTTPS certificate end to end — appliance CA, CSR, upload and outbound site CA — and publishes the root CA at /certs/appliance-root.crt.
• Password delivery can point reset links at your own mail server instead of a hosted one.
• Active Directory integration reports whether the directory is reachable, applies a move at the user's next login, records who created each group membership, and surfaces admin-role drift instead of silently keeping it.
• The in-product help assistant answers with your appliance's live configuration in view, can navigate you to the page it is talking about, and proposes configuration changes rather than making them.

Integration surfaces

• Repository Tracking connects GitHub App, GitLab, Gitea and generic Git remotes for Code Safety scanning, with baseline and incremental scans, server-side paginated findings and a readable structure view. Opt in with REPO_TRACKING_ENABLED.
• The Claude Code plugin gains a deterministic local tool gate, a session audit trail and a repo baseline, and warns the user when inspection is not applying.
• The browser extension generates its managed policy from the appliance's own host name.

The appliance itself

• Host repair lets a signed release fix an installed box's host side — the updater, systemd units, /etc/cid/profile.json and environment keys — without a reinstall, and reports what it did under Settings → System Updates.
• Updates show a duration estimate derived from the size of your database and the migrations actually pending, and report a stall rather than appearing to hang.
• A release verifies against any of several trust anchors, and hands the next signing key over in-band, so the signing key can rotate without stranding boxes.
• A direct registry-pull install is supported for a box that has internet but a slow link to the vendor, and ends up running the same signed images and the same updater as an OVA install.
• This documentation ships with the appliance and works with no internet connection.

Fixed

• Scanned PDFs are now OCR'd. The document parser called an OCR contract that does not exist, so text in a scanned PDF was never extracted and never inspected.
• OCR models are genuinely baked into the image. The pre-download build argument was being dropped, producing an image that worked on a networked host and failed air-gapped; a build check now refuses an image without the detection and recognition models.
• Turkish filter patterns that matched in the tester now match in chat. They never did before.
• Tenant and group filter overrides now apply on every path that can honestly carry them.
• A built-in rule can no longer void an operator's rule, and a second rule can no longer silently disable the first.
• PDF uploads on the inspection path are analysed as documents instead of being sent to OCR.
• Image-analysis detections appear in All Detections, and its paging returns the right rows.
• The Risk Analysis CSV export produced nothing when selected.
• Tenant Management filters were accepted by the UI and silently discarded.
• Compliance PDF export covers the whole filtered set rather than the visible page, and stops printing EUR 0 for regulations that carry no fine.
• The appliance reports the version it is actually running on the update page.
• Setup adopts the box's existing installation identity instead of rotating it, which invalidated any licence already bound to it.
• A disabled Code Safety integration can no longer stop the gateway, and an optional module's missing table can no longer take out boot, device enrolment and extension policy.
• The hallucination check degrades quietly when its container is absent: one throttled GUARDRAILS_DEGRADED event per window, and responses recorded as not evaluated, instead of errors.
• Sessions no longer list gateway API calls as conversations.
• Seventeen tables the release chain never created are created on appliances, along with the password-delivery table and the provider-key secret patterns that installed boxes were missing.

Changed

• DB_SYNCHRONIZE defaults to false. Migrations own the schema on every deployment. See Upgrade impact.
• PASSWORD_RESET_URL_BASE has no default. Reset links now resolve as: the dashboard's password-delivery setting, then the environment variable, then the address the request arrived on, then the hosted host as a last resort.
• risk-guardian on port 8006 is gone. RAG-hallucination detection is hallucination-guard on 8022, and deep risk review moved to the LLM Risk Analyst.
• Chunked and resumable uploads are refused on all three inspection paths rather than passed through uninspected (CID_RESUMABLE_UPLOAD_POLICY defaults to block).
• The inspection policy's source controls enforce. allowed_source_ips gates the ICAP listener and mtls_subject_dn gates /inspect/v1; both were stored and displayed but read by nothing before this release.
• A reject verdict is at least a mask wherever the inspected payload travels onward, so a refusal never releases the original content.
• Startup refuses a known placeholder JWT_SECRET instead of warning about it.
• The token cost report is restricted to administrators.
• Query results are scoped to the caller's department across the credentials, governance, integrations, inspection and gateway-key APIs. A scoped user sees fewer rows than in 0.3.x, by design.
• The auditor never receives a raw detected value — it reads the record, not the content.
• The seeder no longer reverts operator configuration on every boot, and the demo accounts are opt-in behind SEED_SAMPLE_ACCOUNTS and never overwrite a real account.
• A directory account's password cannot be reset from the dashboard, a directory outage answers 503 rather than a 500 that reads as a bad password, and leaving an Active Directory group no longer disables the account.

Deprecated

• DB_SYNCHRONIZE=true still works and is not supported going forward. Auto-sync drops every index and trigger the migrations create, because no entity declares them.
• New .sql files in the top-level migrations/ directory are inert. The existing files ship as one baseline migration; add a TypeORM migration instead.

Upgrade impact

Known issues

• The prompt-injection filter's configured action does not apply. The attack model reports the label injection, while the shipped filter registers the entity type prompt_injection, so the lookup misses and the detection falls back to the jailbreak filter — which rejects. A prompt injection is therefore blocked, not flagged as the shipped configuration reads. Set the action you want on the jailbreak filter until this is corrected.
• The setup wizard cannot be re-run. Once setup completes the bootstrap routes refuse further calls; every setting the wizard collected is changed from its own settings page instead.
• There is no scheduled-backup feature and no restore workflow. The updater's own pre-update dumps under /var/lib/cid/backups are an update safety net on the appliance's own disk, not disaster recovery. See Backup and restore.
• There is no decommissioning workflow, no remote wipe, and no way to hand a licence back from the appliance. Retiring an appliance is a manual procedure — see Decommission an appliance.
• The Endpoint Agent fleet console is hidden on licensed builds. The feature is pilot-grade on Linux and has never run on real Windows hardware, so the page renders only on a lab build (CID_ENABLE_LAB).
• The capability model decides nothing. All sixty capabilities are computed and compared on every request, and access is still granted by the five fixed roles and the page matrix.
• A group API key borrows the identity of its earliest-added member, so removing that user transfers the key's identity rather than revoking the key.
• The ICAP listener cannot authenticate its peer. No gateway product CID222 integrates with offers a credential or custom-header field, so admission is by source address alone, and an admitted peer is believed down to the user it claims.
• A gateway running as a virtual machine on the same host as CID222 cannot be identified by source address. The source network's own NAT rewrites it to the container bridge. A gateway on a physical LAN keeps its address and the allowlist works.
• Chunked and resumable uploads are refused, not reassembled. Buffering by upload id, inspecting at finalize and re-fragmenting is unimplemented, so a user sending a large file gets a refusal rather than a redaction.

Related

• Upgrade to 0.4.0 — the procedure, for appliances and for Compose installations.
• Update the appliance — the online and offline update paths in full.
• Backup and restore — what to take before you start.