Re-run deploy with the new cleanup + recreate

./setup.sh deploy ./setup.sh health

If you changed the WASM too:

./setup.sh refresh-wasm ./setup.sh restart-envoy

./setup.sh validate # quick sanity check of envoy.yaml + wasm + certs ./setup.sh rebuild-envoy # rebuild only Envoy ./setup.sh rebuild-rl # rebuild only RL service ./setup.sh rotate-certs # regen certs and restart Envoy ./setup.sh ci # run waf-test + aux + e2e captcha ./setup.sh rl-train 500 # train RL for 500 episodes (if script exists) ./setup.sh restart-all # restart everything quickly ./setup.sh logs envoy # live logs for Envoy (or captcha / rl-agent /threat-intelligence) ./setup.sh envoy-stats # quick text stats from admin ./setup.sh envoy-dump # save full config dump to logs ./setup.sh support-bundle # collect ps/logs/stats for troubleshooting

Enable similarity-boost in TI (lets nearest BLOCKs nudge borderline scores up a bit)

turn on the env flags in compose (we already added the hook)

./setup.sh ti-sim-boost

sanity

./setup.sh qdrant-test

Tune & maintain the collection

HNSW + payload indexes (runs inside TI container)

./setup.sh qdrant-tune

prune old points (e.g., keep last 14 days)

./setup.sh qdrant-retention 14

on-demand snapshot

./setup.sh qdrant-snapshot

Query tricks you can use right now

look for only BLOCK neighbors, and high-score ones

curl -sS -H 'Content-Type: application/json'
-d '{"request":{"path":"/login?id=1 OR 1=1","user_agent":"sqlmap"}, "limit":5, "decision":"BLOCK", "score_min":0.8}'
http://localhost:5001/similar | jq .

STEPS=5000
BENIGN=1200 SQLI=400 XSS=400 TRAVERSAL=400
NOSQLI=250 RCE=250 SSRF=250 OPENREDIR=180 DESERIAL=150 LOG4SHELL=150 METHOD_FUZZ=120
GRAY=600
MIN_ACC=0.95 MAX_BENIGN_FP=0.06 MIN_BLOCK_RECALL=0.98
./train.sh