Skip to content

AIFW v1.5.307 - Alberta, Canada

Latest
Latest

Choose a tag to compare

View all tags
@secure-tron secure-tron released this 21 Oct 00:14
Alberta
cedfd74

AIFW 1.5.307

Released: 2026-10-20
Edition: Community and Enterprise
Runtime: ASP.NET Core on .NET 11 RC1 (11.0.100-rc.1 SDK, 11.0.0-rc.1 runtime)

AIFW is the AI governance and agent-trust gateway from Securetron: policy enforcement, prompt and
response inspection, routing, identity validation and audit for generative-AI traffic, without
locking you to a model provider.

Container images

Registry Image Tags
GitHub Container Registry ghcr.io/securetron-gh/aifw 1.5.307, latest
  • linux/amd64, runs as non-root user app, HTTP 80 / HTTPS 443 (Endpoints:WebHttps).
  • Image digest: sha256:08532520feb4feebe7a66973b9690863d9dab2101a8b4c909f840ee73e78cb40
docker run --rm -p 8080:80 \
  -e ConnectionStrings__PostgreSQL="Host=<host>;Port=5432;Database=pki_remote_agent;Username=<user>;Password=<pass>" \
  -e AiFw__JwtSecret="<secret>" \
  -e AiFw__Ledger__Key="<quota-ledger hmac key>" \
  ghcr.io/securetron-gh/aifw:1.5.307

PostgreSQL is required: the container exits during startup when the database is unreachable rather than
serving from a fallback store. Health: GET /api/health · A2A discovery: GET /.well-known/agent-card.json

What's new

Microsoft Decision-1 as a policy classifier

Foundry's System One decision model is now a first-class option instead of an add-on:

  • Model Inventory gains a Microsoft Decision-1 (System One decisions, not chat) protocol. Point the
    backend URL at the resource endpoint and put the deployment name in the model ID; the entry carries its
    own key.
  • Guardrails → Classifier offers decision alongside the chat and embedding backends. Both the risk
    stage and the flag verifier use the selected classifier, so picking once is enough.
  • POST /v1/decision lets agents reach a decision model through the gateway: same authentication,
    same prompt inspection, same masking, same audit row and the same 400 + X-Gateway-Security: Violated refusal shape as every other endpoint.
  • Question mode (semantic_question_mode) controls how the classifier is asked: per_rule asks one
    question per rule, batched sends every rule's question in a single decision request (per-rule scores
    kept, prompt billed once), single asks one combined question.

Measured on the buried-injections corpus (726 cases: 629 attacks, 97 benign; 7 built-in rules):

Classifier Mode Attacks caught Benign blocked p50
deepseek-v4-flash per_rule 629/629 40 2990 ms
gpt-6-luna per_rule 629/629 38 3013 ms
Microsoft Decision-1 per_rule 323/629 2 2011 ms
Microsoft Decision-1 batched 629/629 4 274 ms

The per_rule decision row is a throttling artefact, not a classifier result: one question per rule meant
seven calls per request and 393 429 responses, which the fail-open path counted as passes. Batched mode
recorded none. On AgentDojo v1.2.2 (949 attacks, 97 benign) Decision-1 in batched mode caught 949/949
with 5 benign blocks at 276 ms.

Flag verification that cannot hide

  • The flag-verification score is recorded on blocked rows, and verdicts are attached to the exact request
    that produced them, including asynchronous verification.
  • Blocks are judged by the rule's block threshold rather than its flag threshold, so a confirmation can
    actually act on the verdict.
  • With verification on, a flagged prompt is refused before the answer is generated, not after.
  • Rules accept configurable exemplars, and the built-in rules ship tuned thresholds.
  • Blocked rows now carry the endpoint kind, so Activity says which endpoint refused.

Cursor agent hooks and IDE artifacts

  • POST /hooks/cursor records one audit row per shell invocation, with a capture mode and a configurable
    repeat window for duplicate suppression.
  • The shim answers explicitly when the gateway is unreachable instead of failing silently.
  • IDE artifacts are recorded alongside the hook events.

Skills and tool governance

  • Platform skills are declared once and the A2A agent card is built from that declaration.
  • Custom skills can be defined from the UI; the catalog is gated on the A2A admin role.
  • Tool and skill use is governed per agent, with the compliance rule and schema fixes that go with it.

Configuration backup and restore

Versioned configuration backups, with scheduled backups and a restore path that validates the version.

Behaviour changes to plan for

  • The 30-day allowance is fixed at 10,000,000,000 tokens for every installation. The previous ceiling
    and the AiFw:License:DemoCap deployment override no longer apply; the key still parses but is ignored,
    and /api/health reports capCeiling 10,000,000,000 with capOverrideActive false. An existing
    deployment that relied on the override will drop to 10 billion and reach its grace window.

  • semantic_question_mode defaults to per_rule. On a quota-limited decision deployment, set
    batched; the endpoint needs semantic_decision_endpoint (or a registered decision model) and will
    otherwise fail closed.

Fixes

  • AI-FW schema DDL corrected so an existing database reaches the current shape.
  • Cursor hook audit rows and transaction batches no longer lose entries.
  • Flag-verification persistence and cancellation fixed for the asynchronous path.
  • The guardrails model path controls reappear when flag verification is on.
  • Compliance rule cells no longer render their own markup as text.

Performance

  • The risk dashboard is read from a daily rollup, with risk history indexed, instead of scanning it three
    times per load.

Upgrading from 1.1.264

  1. Review the quota: the allowance is now a fixed 10 billion tokens per rolling 30 days.
  2. If the semantic classifier is a decision model, set semantic_question_mode=batched and confirm the
    decision endpoint or inventory entry is present.
  3. Keep AiFw__JwtSecret and AiFw__Ledger__Key stable across the upgrade. The ledger key signs the quota
    hash chain, so changing it starts a new chain and the existing quorum history is no longer verifiable.

Full Changelog: Goose...Alberta

Assets 2
Loading