IRIS-NG-v1.1.1: retarget from the never-tagged v1.1.0, document the advisories
v1.1.0 was staged on main but never tagged, so every reference to it as the
release a change shipped in was wrong. Retargeted across AI-Features,
Dependency-Policy, IOC-Correlation, Changelog and Kubernetes.
Changelog gains the two UI dependency advisories cleared in v1.1.1
(brace-expansion, socket.io-parser) and links the release.
Kubernetes: chart 0.5.1, appVersion IRIS-NG-v1.1.1, pull commands updated.
Correlation scoring rewrite, AI troubleshooting, dependency policy
Changelog: adds IRIS-NG-v1.0.2, and IRIS-NG-v1.1.0 marked pending release.
Records that IRIS-NG-v1.0.3 was never released — the version was staged on
main but no tag, release or images were produced, so nothing shipped under
that number and its changes land in v1.1.0.
IOC Correlation: the scoring sections described algorithms that no longer
match the code, and the how-it-works step repeated a misconception the
control's own label encouraged — that "Min shared IOCs" counts cases an
indicator appears in. It counts indicators a case PAIR must share. Rewritten
to state that plainly, with the consequence spelled out: an indicator's fate
is decided by its neighbours, not by itself, so two indicators each present
in exactly two cases can be treated differently.
Decay and confidence rewritten to match what ships in v1.1.0 — tags scale
the half-life rather than the score, age comes from the most recent sighting,
TLP no longer participates, and confidence weighs rarity and credibility
rather than counting indicators. Flags that figures will read lower than
earlier releases, which is a real change analysts will notice.
AI Features: per-surface timeout table replacing the stale 60-90s note, plus
a Troubleshooting section covering the three failures that are hard to tell
apart — an unrecognised model identifier, a model declining security content,
and a timeout — since before v1.1.0 all three displayed the same JSON parse
error.
New Dependency Policy page: why PostgreSQL, jQuery, Node, marshmallow and the
report generator stack are held back, and how to verify a dependency change.
A green build is not evidence a Python upgrade worked; the pkg_resources case
is the reference example, where the image builds cleanly and the application
dies at startup.
Document manual override of AI summary and cluster narrative
AI Features: new "Manual override" section covering the shared mechanics
- the three case_ai_artifact columns, display_content/is_edited, the
serializer's content vs ai_content split, the HTTP 409 regeneration guard
and why it lives in the endpoint rather than the browser, provenance and
revert, a per-surface comparison table, and a four-step recipe for
extending it to another cached AI surface without a migration.
IOC Correlation: "Correcting a narrative by hand" under the cluster
narrative section, plus a note in the STIX section that edits are
exported - a corrected title becomes campaign.name and corrected prose
becomes campaign.description, with the caveat that the v2 prompt's
entity-name prohibition constrains model output, not text an analyst
types. Corrected the CaseAiArtifact field-name note to mention
display_content.
Development Guide: new gotcha for response_api_error() - its second
positional is `data`, not a status code, and it always emits 400, so
several existing calls that pass 503 are really 400s carrying data:503.
Documents building the body via response() when another status is needed.
API Reference, endpoint tables and Home updated with the four new routes
and the discard_edit parameter.
Docs sync: fix Getting Started cert step, strip private Claude integration, add 3 pages
- Getting Started: add required generate_dev_certs.sh step + iris_helper.sh --init
one-shot; correct false "cert generated at container start" claim (certs are
host-generated and bind-mounted read-only); add nginx cert-perms troubleshooting.
- Remove Claude proxy sidecar + per-case Claude memory (not in the public repo):
AI-Features (sidecar/memory sections, backend row, timeout row), Architecture
(claudeProxy/ tree line), Getting Started (service row, port 7440, pointer).
Kept SYNTHESIZER_FAST_MODEL_MAP model routing (real public code).
- New pages: Analyst Time Tracking, Analyst Skills and Teams, Case Export / Import.
- Home: nav rows + at-a-glance links for the three new pages.
[ADD] wiki: STIX export + cluster narrative v2 + marshmallow empty-string gotcha + timeline dedup section
- IOC-Correlation.md: add STIX 2.1 export section (GET /clusters/<id>/stix), AI
narrative enrichment in STIX bundles, CaseAiArtifact field name gotcha
(art.content not art.artifact_content; generated_at not created_at), cluster
narrative prompt v2 entity-name prohibition; add STIX endpoint to the table
- AI-Features.md: update AI cluster narrative entry with prompt v2 constraint and
STIX safety note
- Development-Guide.md: add marshmallow Integer empty-string gotcha (convert "" to
null before JSON.stringify for nullable numeric fields in settings forms)
- Dual-Timeline.md: add Deduplication section (exact + near-dup, endpoints, FK
cleanup load-bearing rule, no-migration deploy)
[ADD] wiki: Evidence-Inventory page + reasoning model, Vite 8, retention policy updates
New page: Evidence-Inventory.md — drive lifecycle, status donut chart, data retention
policy, barcode lookup, auto-link in evidence modal, wipe/rotate workflow, API endpoint
table, 6-touch pattern for new drive fields.
Updated pages:
- AI-Features.md: reasoning model support section (Gemma-4 channel format, DeepSeek/Qwen
<think> tags, _last_json_object fallback, max_tokens guidance for reasoning models)
- Development-Guide.md: Vite 8/rolldown 1.1.4 gotcha (import-free JS → ui/public/,
vite-plugin-static-copy >=3.3.0 for Vite 8)
- Changelog.md: iris-next.5 entry (status donut chart + data retention policy)
- Home.md: Evidence Inventory page link in table, Dashboard + Settings bullet updates
Add initial wiki (11 pages)