Agate 1.1.0
Sign in with the district’s Active Directory, set up a new district from one spreadsheet, see each stack member’s software, and trust each server controller’s certificate. A new install starts ready for a district other than the first.
Release notesReleased October 4, 2026All releases
New
- Directory sign-in: people sign in with their Active Directory username and password, checked over LDAPS or StartTLS, never plain LDAP. Directory groups map to tiers, and someone in no mapped group cannot sign in. Passwords are never stored or logged. Directory sign-in
- Directory sign-in can ask for a 6-digit authenticator code after the password, set up by scanning a QR code at the first sign-in, with ten recovery codes. An Administrator EX can reset a person’s authenticator.
- Sign in with Microsoft stays available as a second button when it is configured, and the local recovery account always works, including when the directory is not answering Cenovel.
- Settings › Import your estate records a new district’s sites, closets and switch management addresses from one spreadsheet. A check lists every line as will be created, already recorded or refused, with the reason, and writes nothing; the import then writes everything in one step, or nothing. Import your estate
- A stack whose members run different software says so, and shows each member’s own version. Cenovel reads member versions from Juniper, Cisco and Extreme stacks.
- Server controllers (Redfish) are checked against a trusted certificate before Cenovel sends them a credential: the controller’s own pinned certificate, or a certificate authority you supply. Turning the check off for one server needs an Administrator EX and a reason, and is recorded.
- A new install starts a 30-day evaluation the first time it runs: the full product with up to 25 sites, and no license needed. After 30 days it keeps working without a license with up to 5 sites, and never becomes read-only. Importing a license ends the evaluation at once. Licensing
- A trial license: a signed license file for a set number of days and sites, usually 30 days and 25 sites, imported in Settings › License like any other. When it ends, the console keeps working with up to 5 sites and is never read-only; the district’s own license replaces it at once. A trial license
- A plan for security incidents and breaches: who leads, how to contain an incident, what evidence to keep, and the 72-hour notice. Incident and breach response
Improved
- A brand-new install starts with a status for each product state and a neutral asset tag scheme, so its first closet and first found switch can be recorded at once. Both can be renamed in Settings. Status states
- A new install starts with no departments; the district adds its own. The set-up checklist on Today walks a new district from its first site to its first switch reading.
- Microsoft sign-in checks each ID token against the tenant’s published keys, with a nonce on every sign-in. The tenant can be given as its directory ID or a verified domain name.
- Site collector releases are signed with a key that stays offline, in three steps: built unsigned, signed offline, then checked against the code that ships. Security & data
- Each release now carries a software bill of materials, and every release is checked for known dependency advisories and committed secrets before it ships.
- The sign-in page loads only when someone is signed out, so the console opens faster for everyone signed in.
- Times are shown to the minute, never the second, in one date style across the console.
- A calmer console: type on one six-step scale, closets five to a row, site pages with one row of tabs, content on cards, and toolbars on one line at 1280 pixels.
- The switch page shows the selected port under the port diagram, and a project’s page opens with one clear header.
- The appliance is built as one virtual machine with four disks, and the OVA is checked by its published SHA-256.
Fixed
- A console that held a license and no longer has one it can verify now says the license is missing, instead of saying it expired and asking for a renewal.
- A found device’s reported time is shown in the display time zone, not in UTC.
- A site with no closets says so, instead of saying no closet matches the filters.
- The Add person drawer no longer shows “new” under its title.
Upgrade notes
- Upgrading adds storage for each stack member’s software version, for directory sign-in identities, and for each server controller’s certificate trust. Nothing already recorded changes.
- Directory sign-in is off until an Administrator EX sets it up. Its service account password is a file in the deployment’s secrets folder, named ldaps_service_password.
- An Agate 1.0.1 image still starts on the upgraded database until someone signs in through the directory. After that, roll back by restoring the backup taken before the upgrade.
- A server controller whose certificate Cenovel already recorded keeps working. One with no recorded certificate is sent no credential until someone checks its fingerprint on the controller and accepts it.
- An install upgraded from an earlier release has no evaluation; it keeps its 90 days to import a license.
Known issues
- The site collector that reads member versions from Cisco and Extreme stacks reaches a district once its new release is signed. Until then, collectors keep running the signed release they have.
- Directory sign-in reads groups from Active Directory; departments still come from Settings › People and departments.
- Releases before Agate 1.1 do not recognize a trial license. Upgrade first, then import it.