Capability Catalog
Every capability with an honest maturity label ([GA] / [Beta] / [Preview] / [Planned] — see legend). "Backend" names the owning service; "Surface" is the operator/authority screen or API.
The platform is at mixed [GA]/[Beta] maturity: a first tranche of capabilities meets the GA criteria below; most others are real, functionally complete, and behaviorally tested in CI with at-scale and field validation still pending. A small number are [Preview] (notably the AI/anti-collision engine, gated off by default per ADR-0007).
GA promotion criteria
A capability is promoted [Beta] → [GA] only when all of the following hold (roadmap Phase 13.4) — and the promotion lists its evidence:
- Behavioral tests in CI exercise the capability's core logic (not just assert-strings-in-source contract pins).
- Negative-path coverage: rejection/failure modes are tested, not only the happy path.
- Security posture verified: the surface is covered by default-deny auth and (where tenant data is involved) the RLS verification.
- Honest docs: operator-facing documentation exists and states any residual limits; no known [Preview]-grade gaps hide behind the label.
- External proof where the capability claims interop: a verified run against a reference implementation or live harness.
Promotions are individually justified in the tables below; anything not listed under a GA row's evidence is not being claimed.
Operator experience
| Capability | Maturity | Backend | Notes |
|---|---|---|---|
| Map-first command center (live map, layers, fleet, alerts) | [Beta] | frontend, ws-hub | MapLibre + Martin vector tiles, live WebSocket traffic/telemetry. |
| Mission planning workspace | [Beta] | flight-planning | Operators/pilots/vehicles/payloads/routes selectable; drafts. |
| Route & waypoint planning | [Beta] | flight-planning | Waypoints, volumes, altitude/time windows. |
| Spatial drawing & geometry editing | [Beta] | geo-airspace, frontend | On-map draw toolbar (polygon / rectangle / geodesic circle, click-based vertex editing) on the satellite map, plus the grid-sketch and GeoJSON import/export paths. |
| Task & route library (recurring missions, templates, checklists) | [Beta] | flight-planning | Route templates, task scheduling, execution logs. |
| Operator / pilot / vehicle registry | [Beta] | operator-registry | Full CRUD + lifecycle (approve/suspend/certify). |
| Fleet, dock, payload & firmware model | [Beta] | operator-registry | Vendor-neutral asset model, maintenance, availability. |
| Document vault (upload, virus scan, readiness) | [Beta] | document-management | Real S3 presign + ClamAV scanning + readiness engine. |
Airspace & geospatial
| Capability | Maturity | Backend | Notes |
|---|---|---|---|
| Geozones, NOTAMs, TFRs | [Beta] | geo-airspace | PostGIS-backed CRUD, import/validate. |
| ED-269 geofence lifecycle | [GA] | geo-airspace | State machine, schedules, breach policies, provenance behaviorally tested in CI (test_ed269_geofence_lifecycle_contracts.py); schema gate on import incl. all-invalid rejection; official-schema hook for licence holders. Live PostGIS breach geometry stays harness-covered (noted, not hidden). |
| Airspace ingestion pipeline | [Beta] | geo-airspace | Normalizes imported data into tile-ready PostGIS + update events. |
| Vector tiles (Martin) & tileset registry | [Beta] | geo-airspace, martin | PostGIS/PMTiles tiles served through the gateway. |
| Airspace layer manager (opacity, filters, legends, source health) | [Beta] | frontend | Per-source health and time filtering. |
| CISP/FIMS zone synchronization | [Beta] | flight-planning, geo-airspace | FIMS zone callbacks publish airspace update events. |
Deconfliction, risk & authorization
| Capability | Maturity | Backend | Notes |
|---|---|---|---|
| 4D strategic deconfliction | [Beta] | flight-planning | Real spatial-temporal conflict engine (intents, geofences, airspace, traffic); geometry behaviorally tested in CI; round-trip verified vs the InterUSS reference DSS. |
| DSS interoperability (operational intents, peer sync) | [GA] | flight-planning | Full F3548 lifecycle verified against the InterUSS reference DSS (create/query/update-OVN/stale-OVN-rejected/delete + subscriptions, 2026-06-10) and the official uss_qualifier DSS suites pass (make uss-qualifier). Live peer-USS negotiation remains out-of-repo (needs a partner USS — claim table). |
| SORA 2.5 risk assessment (GRC/ARC/SAIL/OSO/TMPR) | [GA] | sora-engine | Genuine JARUS SORA 2.5 lookup tables; full SAIL Table 4 behaviorally pinned in CI incl. invalid-input rejection (test_sora_sail_matrix_contracts.py); compliance harness covers the live surface. |
| Authorization workflow & package builder | [Beta] | authorization-broker | Authority-ready dossier (SORA, route, vehicle, pilot, risk, evidence). |
| Authority operations workbench | [Beta] | authorization-broker, frontend | Review/approve/deny, conditional approval, emergency restriction. |
| Jurisdiction & rule engine | [Beta] | authorization-broker | Jurisdictions, applicability rules, rule versions. |
| Multi-authority / cross-border workflows | [Beta] | authorization-broker | Delegated routing, escalation, decision history. |
| AI assistance (anti-collision, trajectory conflict, risk scoring) | [Preview] · gated off by default | ai-engine | Heuristic/early; not safety-grade. Gateway routes disabled by default — see note below. |
Live operations & surveillance
| Capability | Maturity | Backend | Notes |
|---|---|---|---|
| Live operations center | [Beta] | flights-ops, frontend | Active flights, conformance, conflicts, traffic, weather, incidents. |
| Flight lifecycle & telemetry fusion | [Beta] | flights-ops | Activate/land/emergency, telemetry ingest. |
| Telemetry / conformance monitoring | [Beta] | flights-ops | Route deviation, altitude/time breach, lost-link, geofence breach. |
| Detect-and-avoid (DAA) & incident response | [Beta] | flights-ops, frontend | DAA alerts, severity, acknowledge, abort, playbooks. |
| ADS-B / Remote ID / surveillance ingestion | [Beta] | traffic-ingest | Real ADS-B + ASTM RID SP/DP + surveillance; ISA store; circuit breaker. |
| Edge device identity & management | [Beta] | device-identity | Provision/lifecycle, token issue/rotate/revoke, EMQX auth/ACL hooks, audit (ADR-0005). |
| Edge ingestion gateway (HTTPS + MQTT) | [Beta] | ingestion-gateway, emqx | Device-authorized HTTPS + EMQX MQTT → per-domain Pulsar topics; regional-ready (ADR-0005). |
| Traffic / RID quality awareness | [Beta] | traffic-ingest, frontend | Confidence, stale detection, dedupe, source health. |
| Real-time fan-out (rooms, presence, replay) | [Beta] | ws-hub | Redis pub/sub + Pulsar bridge; tenant rooms. |
| Video mission wall (live grid, recording) | [Beta] | video-relay, frontend | LiveKit streaming; evidence recording to object store. |
| Edge gateway telemetry (field/cellular) | [Beta] | edge/gateway, flights-ops | MAVLink → store-and-forward → device-authed ingest; survives link loss. |
| Cellular-resilient video ingest | [Beta] | mediamtx, video-relay | SRT ingest (loss/jitter tolerant) → existing LiveKit bridge; optional edge record-and-forward. |
Platform, governance & support
| Capability | Maturity | Backend | Notes |
|---|---|---|---|
| Identity & access (users, roles, permissions, tenants, JWT/JWKS) | [GA] | auth-iam | Service-level test suite; demo seeding gated to dev/test (negative-tested); SSO federation with fail-closed OIDC verification (CI-tested rules); refresh/rotation paths exercised. |
| RBAC enforcement | [GA] | user-permissions, auth-iam | Default-deny auth on all services; negative-RBAC tests in CI (viewer→403); service-level OPA middleware with opa test in CI (3-stage rollout, enforce per deployment). |
| Multi-tenancy | [GA] | all | PostgreSQL row-level security behaviorally proven by verify_tenant_rls.py (cross-tenant reads empty, writes rejected, authority scope sees all tenants read-only) across every tenant service; cutover via make db-setup; ADR-0006. |
| Audit trail & compliance evidence ledger | [Beta] | audit-log, authorization-broker | Event-sourced audit; hash-linked evidence bundle export. |
| Notifications (email/SMS/webhook, templates) | [Beta] | notifications | Multi-channel delivery, deliveries, acknowledgements. |
| Weather (METAR/TAF, forecasts, alerts) | [Beta] | weather | Real parser + NOAA/OpenWeather integration. |
| Platform configuration & service registry | [Beta] | configuration | Feature flags, rate limits, vendor/DJI adapters. |
| Admin operations (tenants, system config, dashboard) | [Beta] | admin-ops | Superuser operations. |
| Vendor adapter framework (DJI, MAVLink, PX4/ArduPilot, docks, RID, weather) | [Beta] | configuration | Adapter boundaries for partner systems. |
| DJI FlightHub 2 integration (bidirectional) | [Beta] | configuration, ingestion-gateway, flight-planning, dji-bridge | Native two-way DJI interop — see the dedicated section below. Credential-scoped org/project/device/task/route/livestream sync; HMAC-signed FlightHub Sync webhook + live telemetry ingest (hosted) and DJI Cloud API MQTT (On-Premises / AIO) via the optional dji-bridge; DJI KMZ/WPML flight-plan import & export; FlightStudio flight-plan → FlightHub 2 mission (wayline + flight-task) push; live dock/aircraft telemetry on the map. |
| Observability (metrics, traces, SLO dashboards) | [Beta] | platform | OTel → Prometheus/Grafana/Jaeger; domain SLO rules. |
| Backups / disaster recovery automation | [Beta] | platform | Scripted backups + retention, CI-verified restore drill, scheduled CronJobs in the chart; WAL/PITR via the CloudNativePG option. See backup & DR. |
| High-availability data plane (clustered Pulsar, HA Postgres/Redis) | [Beta] | platform | In-chart CNPG Postgres cluster (3 instances, PITR) + values.ha.yaml overlay; Redis/Pulsar clustering via external-managed services (documented modes). |
| Policy enforcement via OPA | [Beta] | all services | Service-level OPA middleware with claims-based policies and opa test in CI; 3-stage rollout (disabled → shadow → enforce), disabled by default. |
Important capability note: AI engine
The ai-engine capabilities (anti-collision TCPA/DCPA, 4D trajectory conflict,
schedule optimization, ML risk scoring) are [Preview] and must not be
relied on as safety-of-life functions today. The anti-collision logic is a
documented heuristic placeholder and the risk model is trained on placeholder
data; its endpoints are auth-guarded but the outputs are not safety-grade.
Because of this, the ai-engine gateway routes (/api/v1/anti-collision,
/api/v1/trajectory, /api/v1/risk-assessment, /api/v1/orchestration) are
disabled by default in ops/kong/kong.yml: the
service stays registered but is not exposed to clients, so it cannot be relied on
inadvertently. No frontend surface consumes it (risk uses sora-engine,
deconfliction uses flight-planning). To evaluate it internally, uncomment the
routes block. Strategic safety today is provided by the flight-planning 4D
deconfliction engine and the sora-engine risk methodology. Disposition is
decided in ADR-0007:
keep gated [Preview]; training is data-gated on real field telemetry.
DJI FlightHub 2 integration
DJI is the dominant enterprise-drone and docked-drone vendor, so FlightStudio ships a native, bidirectional FlightHub 2 integration while staying vendor-neutral (the DJI path is one adapter among many; nothing is DJI-locked). It works in both FlightHub 2 topologies and closes the loop from plan to live telemetry to mission execution. All capabilities are [Beta].
| Capability | What it does | Where |
|---|---|---|
| Credentialed FlightHub 2 sync | Store FlightHub 2 credentials (cloud region or base URL, organization ID, user token, project UUID, org key, webhook secret — secrets Fernet-encrypted at rest), validate the connection with a live system_status probe, and preview then execute a sync that maps FlightHub organizations / projects / devices / tasks / routes / livestreams onto FlightStudio contracts (built-in default read endpoints, no hand-typed URLs). |
configuration · Admin → Integrations → DJI FlightHub |
| FlightHub Sync ingest (hosted) | HMAC-verified webhook receiver (device online/offline, task/flight lifecycle, media uploaded) + a telemetry endpoint that resolves DJI serial numbers to FlightStudio devices and normalizes DJI OSD onto the platform's device-telemetry topic. | ingestion-gateway |
| DJI Cloud API MQTT ingest (On-Premises / AIO) | Optional dji-bridge worker subscribes to a DJI Cloud API MQTT broker and forwards normalized OSD/state to the same ingest endpoint — the air-gapped/on-prem path converges on identical downstream processing as the hosted path. |
dji-bridge (profile dji-cloud-api) |
| DJI KMZ/WPML flight-plan import & export | Import a DJI Pilot 2 / FlightHub wayline (.kmz/WPML) as a FlightStudio draft flight plan, and export a FlightStudio flight plan back to DJI KMZ — round-tripping waypoints, actions, speed, gimbal pitch, heading, turn mode, and hover time. |
flight-planning |
| Mission push (FlightStudio → FlightHub 2) | Turn an approved FlightStudio flight plan into a FlightHub 2 wayline + flight-task via the real object-store flow (STS token → OSS upload → finish-upload → flight-task → poll status) — so plans authored and deconflicted in FlightStudio execute on a DJI dock/aircraft. | configuration |
| Live dock & aircraft telemetry | Dock/aircraft state (mode, battery, environment, network, position) flows through the realtime hub for on-map DJI dock markers and a dock detail panel. | frontend (map components) |
| Event-driven state sync | FlightHub events update FlightStudio operation status (flights-ops) and device online/last-seen (device-identity) off the dji/events topic. |
flights-ops, device-identity |
Honest limits: the connector's live round-trip is exercised against DJI's FlightHub 2 APIs only with real credentials (CI covers the pure mappers, normalizers, and KMZ round-trip); and enabling the hosted webhook path requires confirming the gateway route prefix in your deployment. The on-map dock markers/panel mount on the live map as of Phase 15 (#233). Operator setup is in the DJI FlightHub 2 integration guide.
Configuration platform, integration framework & AI agent (Phase 16)
| Capability | Status | Notes |
|---|---|---|
| End-user configuration | GA | Persisted, audited platform settings + a full configuration workspace (feature toggles, rate limits, maintenance windows, notification channels, per-tenant config keys with reset-to-default and audit history). |
| Secrets encrypted at rest | GA | Sensitive config_values are Fernet-encrypted (enc:v1:); fail-closed sensitive writes in production; lazy re-encryption of legacy rows. |
| Integration framework & marketplace | GA | Declarative manifests → install → schema-driven config → health monitoring → lifecycle events. DJI FlightHub 2 fully UI-configured; generic webhook; honest PLANNED tiles. See the integration roadmap. |
| Weather provider | GA | Pluggable (Open-Meteo keyless / none for air-gapped); live conditions, forecast, and computed mission suitability. No fabricated data. |
| AI detection & agents | [Beta] · Enterprise | LiveKit-native agent: on-stream YOLOv10 detection → local Ollama/Qwen2-VL incident reasoning + PDF reports → pgvector semantic search. All-local/sovereign; entitlement-gated (ai_detection). |
Honest limits: the AI agent is [Beta] and Enterprise-gated — detection needs a LiveKit server + model weights (CPU inference default, GPU optional); reasoning needs a reachable local Ollama (degrades to detection-only, never fabricating summaries); semantic search needs a pgvector-enabled Postgres (degrades to keyword search, honestly indicated). The default YOLOv10 backend is AGPL-3.0 and is isolated to the AI-agent container; RF-DETR (Apache-2.0) is documented as the permissive alternative. Milestone/Cumulocity/ThingWorx/Insights-Hub are PLANNED tiles, not shipped connectors.