Changelog

Release notes for the appliance and its interface, written from the user’s point of view. R-numbers are interface and appliance build labels; features behind a feature flag are marked as such.

R14 — Orange controls

• No blue left in the interface. The accent orange now both operates and designates: buttons, controls, links and focus states use it, instead of borrowing the design system’s blue for anything that is clickable. Rule D-6 of the product design system was replaced rather than bent, and the docs site follows the same rule — including its focus ring.
• Hover and active states are darker and lighter grades of the same orange, with near-black text on filled controls, so a control keeps its contrast without a second hue.
• Severity and score remain coloured type. No bars, no badges, no glows.

R13 — UniFi live, speaking names, telemetry

• The UniFi Network connector is live. The read-only source against a UniFi OS controller runs on the real scheduler: it detects UniFi OS and classic controllers, pages through clients while de-duplicating by MAC address, and writes identity anchors with source = connector:unifi-network. Its certificate is pinned by fingerprint, and there is still no option to disable verification.
• ndr connectors validate, test <id> --live and collect <id> --once --live prove reachability, authentication, authorisation and the response shape from the command line before the service ever polls — and --live is separate from the frozen-recording path, which remains the unit of testing. Every declared instance gets a connector:<id> health line in the system view.
• Speaking device names. A device is no longer named after its address. An hourly job resolves the name to show from six sources in a fixed priority — operator, controller, DHCP, mDNS, reverse DNS, address — and the interface says which source it came from. The name is an overlay: nothing that already reads a device name had to change, and an operator rename wins over every automated judgement. On by default; NDR_NAMING_ENABLED=false switches it off.
• The telemetry client. Every installation now registers itself and sends one small daily heartbeat: version, operating system, plan and bucketed counts, with a field whitelist and a pattern guard that abort the send rather than trim it. The System page shows the exact payload, ndr telemetry show prints it without sending, and NDR_TELEMETRY=off switches the whole thing off on the free plan. See instance registration and telemetry.
• Secrets for connectors have two accepted shapes and nothing else: mode 0640 owned by root with the service group, or mode 0600 owned by the service user. Everything else is refused at validation with the file name and the fix.

R12 — English only

• The entire interface is English. The translation layer introduced in R11 was removed; every visible string now sits directly in the component that renders it. There is no language switch.
• Dates, times and numbers use a 24-hour clock with the day before the month, and byte units remain binary (MiB, KiB) because that is how the backend counts.
• Route names, query parameters and API error codes were deliberately not renamed. They appear in shared links, in the identity-provider callback and in redirects; renaming them is a migration, not a translation.

R11 — One design system

• The interface adopted the Kumo design system — the open-source design system of the Cloudflare dashboard — as dark Nyxtrace tokens. Colours, spacing and text sizes now come from one place, which is why a repaint is a change to one file rather than a renovation of every component.
• The shell, cards, tables, controls and the login page were rebuilt on it.
• Text base size is 14px, the density of a dashboard rather than a document.
• The accent orange is reserved for the brand and for exactly one product state — live — while controls use the design system’s own operating colour. Superseded in R14, which gave the controls the orange as well.
• Severity and score stay coloured type, never bars, badges or glows.

R10 — Device identity and connectors

Both behind feature flags, off by default, so an existing installation keeps its behaviour until an operator switches them on.

• Device identity, phase one. A device is an identity cluster of weighted anchors rather than a MAC or an IP address. An hourly job reads DHCP events and mDNS names, clusters them, and writes proven host names and MAC addresses back onto the inventory. A merge keeps the earlier first-seen timestamp, so a rotating device does not restart its learning phase. Merges are recorded immutably and are individually reversible; a reversal blocks that anchor combination for that pair only.
• Addresses now resolve at a point in time, so a reassigned address no longer inherits another device’s history.
• The device detail shows the anchors and the merge history, with a marker for a randomised address and for an anchor class that can only confirm an identity.
• The connector framework. One shape for every integration: sources, sinks and responders, with configuration validation, secret references, health, rate limits, backoff and a test connection owned by the framework rather than by each connector.
• A shared conformance suite every connector must pass, and frozen, anonymised recordings so no connector test needs a live foreign system and continuous integration needs no network.
• The first connector: a read-only UniFi Network source with a pinned certificate fingerprint and no option to disable verification.
• ndr connectors list | validate | test, none of which opens a network connection.

R9 — Live interface fixes

• The incident strip keeps its height and shows a proper empty state when there are no incidents, instead of collapsing the layout.
• The tenant badge is hidden in single-tenant mode.
• Sidebar and network-status overlaps fixed.

R8 — The situation view

• A full-surface situation view with the globe, floating navigation, and an incident rail sorted by score.
• The incident dialog is URL-stable: an incident is a link you can send to someone, and the browser’s back button behaves.
• A separate 2D network dialog, with edge and action side sheets.
• Single-tenant mode, which hides the tenant control entirely rather than showing a selector with one entry.

R5–R7 — The appliance

The first complete appliance: the data path, the storage schema, the detection models, the incident workflow and the first interface.

• A native Go core owning normalisation, flow correlation, detection, the incident workflow and every database write. The earlier prototype implementation was removed entirely.
• ClickHouse for telemetry and evidence; a local state store for inventory, workflow, checkpoints and budgets.
• Transport is transport. The collector reads, buffers and forwards; it assigns no tenant and normalises no fields. Identity comes from the source token.
• Correlation across overlapping sensors that never sums counters — one preferred observation supplies the numbers, every other observation stays as evidence.
• The detection model set: rarity, beaconing, robust hourly baselines, scan detection, peer-group isolation, and one composite model.
• A 14-day learning phase during which model results are recorded and deliberately suppressed.
• The optional analyst, off by default, with a required explicit budget and explicit token rates — no guessed prices.
• Response proposals with a required rollback plan. No execution.
• The native appliance installer with checksummed artifacts, six separate mode-0600 secret environments, a repeatable apply, and a fail-closed partial state.
• A local health check, Grafana health dashboards on a restricted read-only database account, and an alert rule that ships paused.
• Optional local GeoIP city and network attribution, with independent readers so one database remains usable without the other.

Earlier

Everything before R5 was design and prototype work, and is not described as a release.