Release notes
Zequent 3.0.0
Released 1 November 2026.
ZQNT AI, Keycloak sign-in with OpenBao-sealed secrets, custom roles and approval rules, and a checked command path that runs only what an asset has published.
Breaking changes
- The 3.0 API (zqnt-api v3) and the 3.0 SDKs replace the 2.x contracts and SDKs; edge adapters and clients must move to the 3.0.0 SDKs.
- People sign in only through Keycloak; the platform's own password and OIDC sign-in are removed.
- Devices pair only by claim code, and edge credentials can no longer name an organization.
- Schedules and event triggers run as the organization's automation account, within its role.
- Camera lens and zoom run as published commands; the stream lens/zoom endpoints are removed.
- Integration Hub bridge steps are named integration.bridge.<bridge id>, and its credentials are kept only in OpenBao.
Highlights
- ZQNT AI: an assistant that builds and runs Applications, with approvals that preview what will happen, AI nodes within each organization's limit and compliance settings (denied areas, simulator first, retention, emergency stop).
- Sign-in through Keycloak, with Microsoft Entra ID or any OpenID provider per organization; every secret sealed in OpenBao and shown on one Secrets screen.
- Custom roles with a permission matrix and site-limited assignments; approval rules with inherited, overridden and locked values, and approvals by several people or named roles.
- Assets run only the commands they have published; a run is refused before it starts when an asset cannot execute one of its steps. Live video, lens, zoom, recording and manual control use the same checked path.
- Execution history with statistics and step timelines, an audit log with change history and export, and detection history on the operations map.
- Integration Hub: bridges belong to an organization and can be called on demand, OPC UA reacts to value changes, and live telemetry can be streamed out through any sink.
- Simulate an Application on a virtual fleet and read which way it went, from the console or the client SDKs.
Included components
| Component | Version | Previously |
|---|---|---|
| Platform Services | 3.0.0 | — |
| Console | 3.0.0 | — |
| Integration Hub | 3.0.0 | — |
| AI Assistant Service | 3.0.0 | — |
| DJI Adapter | 3.0.0 | — |
| MAVLink Adapter | 3.0.0 | — |
| SAPIENT Adapter | 3.0.0 | — |
| AI Detection Adapter | 3.0.0 | — |
| SDK — Java | 3.0.0 | — |
| SDK — Python | 3.0.0 | — |
| SDK — Go | 3.0.0 | — |
| Zequent API | 3.0.0 | — |
| Simulator | 3.0.0 | — |
Changes
Platform Services 3.0.0
Platform Services 3.0.0 · 1 November 2026
Breaking changes
- Devices pair only by claim code; edge credentials cannot name an organization
- Applications made only of Integration Hub bridges run without an asset
- Schedules and event triggers run as the organization's automation account, within its role
- Camera lens and zoom run as published commands; the stream lens/zoom endpoints are removed
- People sign in only through Keycloak; the platform's own password sign-in is removed
- Passwords and single sign-on live in Keycloak only, secrets are sealed with OpenBao only
- Zequent 3.0 platform — AI agent, approvals only by signed-in users, organization identity hardening
Security
- The media server's stream-auth secret is sent as a header, and WebSocket tickets no longer hold access tokens
- Webhook tokens, stream keys and claim codes are stored only as peppered hashes
- Services refuse to start on development peppers, Keycloak client secret or OpenBao token, also when read from OpenBao
- The AI assistant's tools are proven isolated per organization and role, and model keys never reach the console
- Single sign-on only through Keycloak; the platform's own OIDC sign-in is removed
- Requests without an organization are refused instead of landing in the default organization
- 3.0 service images use the patched native base image (pcre2)
- Refuse to start on default database, Redis and storage passwords
- The AI assistant acts in the Integration Hub without a separate signing key
- A user with a role for some sites sees only those sites' assets
New
- Radar detections published over v3 keep range, bearing, elevation, speed and heading
- Payloads an adapter reports with its capabilities appear on the asset
- 3.0 runs only commands an asset has published
- A run is refused before it starts when an asset can't execute one of its steps
- Live video, lens, zoom and manual control use the checked 3.0 command path
- Recording and photos use the checked 3.0 command path; customer RTMP servers stay untouched
- Automatic asset selection only picks assets that can run every step
- Dry run of asset selection can take an Application; production refuses the local stream hook secret; native images once per merge
- Every console endpoint is checked by permission, with site-scoped roles
- Integration Hub bridges are capabilities of their organization and run without a hub asset
- Custom roles everywhere, guard rails, SSO group mapping and audited role changes
- Execution history can be filtered by time and a run's events can be read
- ZQNT AI in the platform: subagents, following runs, own model keys, approval rules, platform areas and AI nodes that run for the right person
- Every change and every approval is in the audit log, under the person who made it
- The console can show what any user of the organization may do
- Live event stream per organization, detection history, and events without a time no longer get lost
- List the live video streams of an organization, as the media server sees them
- Applications can be simulated with mock data before they run for real
- The executions list can show only simulated or only live runs
- OpenBao and Keycloak in the local stack and the customer compose
- Signing keys and stored secrets can be kept in OpenBao, with key rotation
- Organization admins see every secret of their organization in one place
- Core services accept Keycloak sign-ins and keep Keycloak organizations and users in step, switched off by default
- With OpenBao, core services read their infrastructure secrets from it and exports are signed by OpenBao Transit
- People sign in to the console through Keycloak when it is switched on
- With Keycloak sign-in, organizations sign in through their own Microsoft Entra ID or OpenID provider
- The assistant sees how risky every command is, and its tool calls are limited and measured
- Every create, reveal, rotate, revoke and delete of a secret is in the audit log
- The AI assistant can run the organization's Skills, find sites and assets by name, and follow agent profiles
- Approval rules per risk level for operators, the AI agent and automation, set as system default, per organization and per site
- AI nodes record model, prompt version, input and answer in the run and the audit log, and keep going when the AI assistant restarts mid-answer
- Failed device commands are retried and COMPENSATION steps undo completed work when a run fails or is cancelled
- Organizations keep the AI assistant away from whole domains, require a simulation before an assistant-built Application runs on a real asset, and stop it with a kill switch
- Customer applications simulate an Application and read its trace through the public SimulationService
- The Keycloak sign-in pages carry the Zequent look
- Failed media files carry their reason over the API, and integrations only see their organization's telemetry
- Prometheus and Grafana with the platform's alerts and dashboard in the local and customer compose stacks
- Runs queue for a busy asset and resume, every run records who started it, and detection triggers can be bound to a site
- ZQNT AI conversations keep their attachments, and free local models no longer count against the AI budget
- The maximum flight altitude (default 120 m) is set per organization, site or asset
- Every system admin can sign in to Grafana; Keycloak accounts carry the user's platform roles
- Attach a theatre to the AI assistant
- Attach files to AI assistant chats, scanned for viruses before anything reads them
Improved
- Application statistics for the last 30 days load fast at fleet volume
- Mission-autonomy no longer reads every cached run to check which drones are busy
- The detection history answers in milliseconds for organizations with few detections
- Core services stop walking the whole Redis keyspace every few seconds
- The detection history stays fast once its query plan is cached
Fixed
- Report dock supply voltage in volts on v3, millivolts on v2
- A flight command the device refuses no longer sends the aircraft home
- Commands on an asset work again for every signed-in user, not only system admins
- Live views, caches and relays keep working when Redis restarts, and new service replicas get traffic
- Admin-console, mission-autonomy and live-data build as native images again
- With several admin-console replicas, Keycloak sync and secret resealing run once and new Keycloak sign-ins work on every replica
- Admin-console and mission-autonomy start when a key or token is configured as an empty value (e.g. secrets in OpenBao)
- Media files whose move into the library failed are retried, and marked failed with the reason
- Secrets in OpenBao stay readable when a connection to OpenBao drops
- System admins can manage roles, SSO group mappings, agent profiles and the AI assistant of any organization
- The audit log answers 400 instead of 500 when a system admin names no organization
- Installation-wide settings are found again when listed by scope (AI assistant kill switch showed as missing)
- The command palette no longer empties itself every few minutes
- A flight waiting for no-fly-zone approval no longer hovers forever when nobody answers
- The console no longer signs people out or shows errors right after the platform restarts
- Core services start on Kubernetes when they read their secrets from OpenBao
- Users of an organization created from a license can sign in right away
- Background jobs and seeders run once when core services run with several replicas
- Mission-autonomy rebuilds its list of running executions without flooding Redis
- A deleted or moved technical config setting stops applying at once
- A run that never started frees its drone after 15 minutes instead of 6 hours
- Webhook triggers start their run even when the call carries an Authorization header
- Telemetry is no longer lost when a batch reaches the platform twice
- The audit log shows how many tokens an AI step used
- The AI assistant can create triggers and no-fly zones again
- AI assistant answers are stored again when a chat is renamed or changed while it answers
- The AI assistant gets a clear answer instead of a silent dead trigger when it wires an integration trigger to a connector
- AI assistant answers are stored again when a new chat gets its title while it answers
Console 3.0.0
Console 3.0.0 · 1 November 2026
Breaking changes
- The console signs people in only through Keycloak
- Zequent 3.0
Security
- License keys are no longer stored in the browser
- Single sign-on only through Keycloak; the platform's own OIDC sign-in is removed
- 3.0 console gets Next.js 16.4.2 and the patched dependencies
New
- The console follows 3.0 permissions and shows each asset's own commands
- Execution history with time ranges, Application run statistics and a step timeline
- Audit log with change history, approvals and export
- ZQNT AI, the assistant's own page with approvals that preview what will happen, live run cards and maps, and organization settings
- Custom roles with a permission matrix, site-limited role assignments and "what can this user do?
- Detection history in Operate, filterable by asset, object type, time range, confidence and no-fly zone
- Detections, device alerts and event-trigger firings appear live in the alert stack and on the operations map
- The Live Monitor shows which assets are streaming video right now
- All secrets of an organization on one Secrets screen
- People sign in to the console through Keycloak when it is switched on
- With Keycloak sign-in, organization admins connect Microsoft Entra ID or any OpenID provider
- The audit log can be filtered to secrets and to reads
- Skills can be offered to the AI assistant with guidance, and agent profiles are managed in the console
- Approval rules editor with inherited, overridden and locked values, and the approval each command needs
- AI assistant compliance settings: denied areas, simulator first, retention, emergency stop and conversation export
- Undo steps (compensation) and retries in the graph editor and execution view
- The media library shows files that could not be filed, with the reason
- Manage → Secrets is the one place for credentials; the separate Credentials page is gone
- Forward live telemetry of your assets to any Integration Hub sink, set up from the console
- See queued runs and who started a run, gate detection triggers on a site, and try bridges before using them
- Lens, zoom and parameter limits come from what the asset publishes
- ZQNT AI shows attachments, quieter answers and a clear card for messages that are too long
- ZQNT AI shows as coming soon until it is switched on
- Attach a theatre to the AI assistant chat
- Attach files and photos in the AI assistant
- Integration Hub credentials are managed on the Secrets page
- OPC UA connectors can push value changes as they happen
- Build AI steps in Skills and Applications and inspect them in a run
Fixed
- System admins choose the organization on the Roles, Agent Profiles and AI Assistant pages
- Dropdowns follow the dark theme (no more white lists with white text)
- System admins choose the organization on the Audit log page
- System admins choose the organization for licenses, single sign-on, triggers, simulators and no-fly zones
- Remote Control's confirmation dialogs open above the command bar
- Invite user no longer shows the previous user's temporary password
- A live view that cannot reach its media server shows why instead of connecting forever
- Try again after a failed approval in the AI assistant no longer repeats the whole answer
- Opening a live view no longer restarts the stream for everyone watching
Integration Hub 3.0.0
Integration Hub 3.0.0 · 1 November 2026
Breaking changes
- Bridge steps are named integration.bridge.<bridge id>
- Integration Hub credentials are kept only in OpenBao
- Zequent 3.0
Security
- Golang.org/x/net 0.60.0 (CVE-2026-78669)
- Secret headers of HTTP and WebSocket connectors are stored as credentials
- Connectors can only use credentials of their own organization
- 3.0 Integration Hub gets Go 1.26.10, Next.js 16.4.2 and patched dependencies
- The AI assistant's Integration Hub calls are verified with the platform's service keys
New
- Integration Hub bridges are available to their own organization without a hub asset
- The Integration Hub accepts bridge commands signed with rotated platform keys
- Integration Hub credentials can be kept in OpenBao
- The Integration Hub accepts Keycloak sign-ins
- Every access to an Integration Hub credential appears in the platform audit log
- Stream live telemetry of an organization's assets out through any Integration Hub sink
- Bridges can be called on demand with parameters, tried out before use, and belong to an organization
- OPC UA bridges react to value changes as they happen instead of polling
Fixed
- The Integration Hub publishes an organization's bridges again
- Live telemetry forwards selected device values such as wind.speed, and Kafka sinks keep up with more than one message per second
- Integration Hub bridges stop when stopped, and OPC UA/HTTP bridges without an interval run only on demand
AI Assistant Service 3.0.0
AI Assistant Service 3.0.0 · 1 November 2026
Breaking changes
- Zequent 3.0
Security
- Update certifi (GHSA-6q48-6c7w-9gw2)
- 3.0 AI assistant uses certifi 2026.10.19
New
- The assistant thinks at each provider's own setting, works across the platform, survives restarts and runs AI nodes within the organization's limit
- ZQNT AI works with small local models, very long messages and attachments
- The AI assistant can focus on an attached theatre and its sub-sites
- The AI assistant reads attached files in a sandbox
Fixed
- AI nodes only succeed with an answer that matches their output schema
- Agent-setup and agent-chat sign in through Keycloak
- Long AI assistant conversations keep working after approvals and failed answers
- The AI assistant wires Integration Hub signals to Applications correctly
- The AI assistant builds run-time checks with Integration Hub bridges (e.g. weather before takeoff)
- The AI assistant points to the Secrets page for Integration Hub credentials
DJI Adapter 3.0.0
DJI Adapter 3.0.0 · 1 November 2026
Breaking changes
- DJI docks pair only by claim code (organization-id bind removed)
- DJI adapter serves the v3 edge contract — one ExecuteCommand, served next to v2
Security
- 3.0 DJI adapter uses the pinned patched base image and reports the aircraft's GPS/RTK state
New
- DJI docks report their detected payloads with their capabilities
- Dock camera streams without an aircraft; recording published as a capability
- Full conformance check again; native image once per merge
- The DJI adapter accepts commands signed with rotated platform keys
- The DJI adapter can read its DJI Cloud API, MQTT, object storage and Redis credentials from OpenBao
- The adapter tells the platform how risky each command is
- DJI commands publish their limits, and a lens switch finds the running stream itself
Fixed
- Report dock supply voltage in volts on v3, millivolts on v2
- DJI docks and drones report telemetry and event times in exact UTC
- DJI adapter license check no longer assumes the default organization
- The DJI adapter starts on Kubernetes when it reads its secrets from OpenBao
- DJI drone telemetry reports the active camera lens (currentLens) on 3.0
MAVLink Adapter 3.0.0
MAVLink Adapter 3.0.0 · 1 November 2026
Breaking changes
- The MAVLink adapter runs on Zequent 3.0
New
- MAVLink runs only its registered commands on v3; 2.x calls keep execution ids and convert text values
- The MAVLink adapter accepts commands signed with rotated platform keys
- The adapter tells the platform how risky each command is
Fixed
- Report battery voltage in volts on v3
- MAVLink drones can be controlled and point their gimbal again
SAPIENT Adapter 3.0.0
SAPIENT Adapter 3.0.0 · 1 November 2026
Breaking changes
- The SAPIENT adapter runs on Zequent 3.0
New
- SAPIENT radar detections go over v3 with range, bearing, elevation, speed and heading
- Pre-2.0 SAPIENT request strings are accepted from 2.x callers only
- The SAPIENT adapter accepts commands signed with rotated platform keys
- The adapter tells the platform how risky each command is
Fixed
- The SAPIENT adapter reconnects within a second after the platform renews its stream
AI Detection Adapter 3.0.0
AI Detection Adapter 3.0.0 · 1 November 2026
Breaking changes
- The AI detection adapter runs on Zequent 3.0
Security
- Update certifi (GHSA-6q48-6c7w-9gw2)
- 3.0 AI adapter uses certifi 2026.10.19
New
- The AI adapter accepts commands signed with rotated platform keys
- The adapter tells the platform how risky each command is
Fixed
- AI detection runs only its registered commands on v3 and keeps the stop message on 2.x
- The AI adapter reconnects within a second after the platform renews its stream
SDK — Java 3.0.0
SDK — Java 3.0.0 · 1 November 2026
Breaking changes
- Java SDK timestamps are exact UTC instants instead of local date-times
- Zequent 3.0
New
- V3 runs only registered capabilities; the 2.x bridge keeps execution ids and converts text values
- The Java client SDK lists an organization's live video streams
- Adapters accept commands signed with rotated platform keys (published key set)
- Simulate an Application and read its trace from the client SDK
Fixed
- Adapters without a registry run only advertised built-in commands on 3.0
- Conformance kit no longer reports an alias of a published command as unadvertised
- A command that names no asset reaches the platform
SDK — Python 3.0.0
SDK — Python 3.0.0 · 1 November 2026
Breaking changes
- Zequent 3.0
New
- Edge SDK ships the Redis caching helpers (edge_sdk.caching)
- V3 runs only registered capabilities; the 2.x bridge keeps execution ids and converts text values
- The Python client SDK lists an organization's live video streams
- Adapters accept commands signed with rotated platform keys (published key set)
- Simulate an Application and read its trace from the client SDK
Fixed
- Edge publishers reconnect within a second after the platform renews their stream
SDK — Go 3.0.0
SDK — Go 3.0.0 · 1 November 2026
Breaking changes
- Zequent 3.0
New
- V3 runs only registered capabilities; the 2.x bridge keeps execution ids and converts text values
- The Go client SDK lists an organization's live video streams
- Go adapters accept commands signed with rotated platform keys
- Simulate an Application and read its trace from the client SDK
Fixed
- The platform preflight no longer fails for every Go adapter
Zequent API 3.0.0
Zequent API 3.0.0 · 1 November 2026
Breaking changes
- Zequent 3.0
New
- List the live video streams of an organization
- Skills can carry guidance for the AI assistant and be offered to it as tools
- A human approval can ask for several approvers, named roles and someone other than the requester
- Simulate an Application on a virtual fleet and read which way it went (SimulationService)
- Media files whose move into the library failed show as failed with the reason, and integrations watch the telemetry of one named organization
- Timestamps from the Java API are exact UTC instants, independent of the server's time zone
Simulator 3.0.0
Simulator 3.0.0 · 1 November 2026
Breaking changes
- Simulated devices are created in the simulator credential's organization
- The simulator runs on Zequent 3.0 (v3 edge and fleet contracts)
Security
- Golang.org/x/net 0.60.0 (CVE-2026-78669)
- Simulated devices are only created in an organization the caller names
- 3.0 simulator builds with patched Go and fails the scan on malicious packages
New
- Simulator runs only its registered commands on v3; 2.x calls keep execution ids and convert text values
- Simulated docks can switch their light
- The simulator accepts commands signed with rotated platform keys
- The simulator accepts Keycloak sign-ins
- The simulator tells the platform how risky each command is
- Simulated radar targets can approach, pass by or intrude on a site with a set speed and heading
- Simulated take-off publishes its default altitude
Fixed
- A simulated command replaced by another no longer stays running forever
- Preflight works on simulated drones
- Simulated aircraft fly up to the 500 m their commands allow; the altitude limit comes from the platform
Zequent 3.0.0 release notes. Compiled on 1 November 2026 from the published releases of each component. Pre-release, preview and internal builds are not included.