Release Notes r3.5.0

r3.5.0 is a breaking release for operators. It moves the System.Communication Construction Kit model to a new major version (3.x → 4.x), renames the concept Pool to Deployment Site across the whole stack, and introduces adapter pools with shared adapter leasing (switched off by default).

The data migration is automatic but one-way. Read the Upgrade Guide r3.5.0 before you upgrade any installation — in particular the backup and rollback sections.

Highlights

• Deployment Sites replace Pools. The old name described a location, not a pool; it is now System.Communication/DeploymentSite, the Kubernetes custom resource DeploymentSite, the REST route /v1/deploymentsite, and matching octo-cli verbs and MCP tools. See Deployment Sites.
• Adapter pools and shared adapter leasing. A tenant can run a pool of generic adapter processes and lease them to other tenants for individual pipeline executions — with a per-pool queue, round-robin fairness between tenants, interactive work before batch work, and isolation of the borrowing tenant's identity and database credentials. The feature is off by default on every tenant.
• Automatic data migration from every published System.Communication 3.x version (3.35.0 and later) to 4.x, protected by a new engine guard: an upgrade that would cross a major version without a migration now fails loudly instead of silently skipping the data migration.
• TLS validation is enforced in the SDK for all connections from adapters to the platform services, including the SignalR hub connection that used to accept any certificate.
• New major versions of all dependent blueprints and CK models — see Versions. The previous lines stay in the catalogs for installations that still run r3.4.x.

Breaking changes

Area	Before (r3.4.x)	From r3.5.0
CK model	System.Communication 3.x, System.Ai 3.x	System.Communication 4.6.0, System.Ai 4.3.0; tenants on System.Communication 3.35.0–3.41.0 are migrated, 3.42.0 is refused
CK type	System.Communication/Pool	System.Communication/DeploymentSite
Association role	Manages / ManagedBy	Hosts / HostedBy
Kubernetes CRD	communicationpools.octo-mesh.meshmakers.io, kind CommunicationPool, v1alpha1, field poolRtId	deploymentsites.octo-mesh.meshmakers.io, kind DeploymentSite, v1, field deploymentSiteRtId
Operator Helm values	operator.autoManagePools, operator.poolNamespace, operator.defaultPoolName	operator.autoManageDeploymentSites, operator.deploymentSiteNamespace, operator.defaultDeploymentSiteName
REST API (Communication Controller)	{tenantId}/v1/pool/..., query parameter poolRtId	{tenantId}/v1/deploymentsite/..., query parameter deploymentSiteRtId
octo-cli	GetPools, DeployPool, UndeployPool (-id = poolRtId)	GetDeploymentSites, DeployDeploymentSite, UndeployDeploymentSite (-id = deploymentSiteRtId)
MCP tools	get_pools, undeploy_pool	get_deployment_sites, undeploy_deployment_site
Metrics	octo.workload.kind="pool"	octo.workload.kind="deployment_site" for sites, "adapter_pool" for adapter pools (no alias)
Adapter SDK	AdapterOptions.TenantId, key OCTO_ADAPTER__TENANTID	AdapterOptions.DedicatedTenantId, key OCTO_ADAPTER__DEDICATEDTENANTID (the old key still works in this release and logs a deprecation warning)
Adapter SDK, TLS	the hub connection accepted every server certificate; IgnoreCertificateValidation had no effect	certificates are validated on all four HTTP stacks; IgnoreCertificateValidation works but is refused when ASPNETCORE_ENVIRONMENT/DOTNET_ENVIRONMENT is Production
Blueprints	System.Communication-[x,4.0)	blueprints that depend on System.Communication need a 4.x range and a new major version (see Versions)
Blueprint dependencies	the first catalog with a matching version won; installing a blueprint could downgrade an installed dependency	the highest matching version across all catalogs wins; an installed newer dependency is kept, or the installation fails instead of downgrading
Pipeline trigger type	cron executions on dedicated adapters reported Event	cron executions report Scheduled everywhere

Versions

Model or blueprint	r3.5.0
System.Communication	4.6.0
System.Ai	4.3.0 (credentials as SECRET attributes)
Loxone	5.1.0 (Miniserver password as SECRET attribute); 5.0.0 without SECRET
MeshmakersAccounting / .Tesla / .Host	2.2.0 / 2.1.0 / 2.0.0
EnergyCommunity.Base / .Billing / .Simulation / .App / .EdaIntegration	2.11.1 / 2.8.1 / 2.8.2 / 2.1.0 / 2.11.0
OneTimeTicket.Release / .MainLatest	2.0.0
FdaSeen.Base	2.0.0
ZenonDynprop.MainLatest	2.0.0
Samples.PipelineBasics / .Photovoltaics / .Simulator.EnergyCommunity	2.0.0 / 2.0.1 / 2.0.0
Office.ExcelImport	2.0.0
SmartMeterInsights.Base	2.0.0
FamilyOs.Release / .MainLatest	2.0.0

The 1.x lines (and the other pre-4.x lines) stay in the catalogs in parallel. They are for installations that still run r3.4.x; on r3.5.0 update to the versions above (see Blueprints and CK models in the upgrade guide).

New

Adapter pools and shared adapter leasing

• New CK types System.Communication/AdapterPool (a pool of adapter processes owned by a lending tenant) and System.Communication/LentAdapterPool (the mirror a borrowing tenant sees). An adapter can use the new lifecycle mode Leased to run its pipelines on a pool member instead of its own process.
• Per-pool queue with round-robin between tenants and interactive-before-batch ordering inside a tenant's turn. Cron triggers of leased adapters go through the queue and coalesce.
• Kill switch per tenant: octo-cli -c SetCommunicationLifecycle -le false (REST PUT {tenantId}/v1/communication/lifecycle, field leasingEnabled). Switching it off holds the queue; it neither drains nor cancels it.
• New octo-cli commands GetAdapterPoolQueue and CancelQueuedExecution; new MCP tools get_adapter_pool_queue and cancel_queued_execution.
• New REST endpoints under {tenantId}/v1/adapterpool (queue, members, lease, mirrors, lending) and {tenantId}/v1/deploymentsite/workloads/adapter-pool/scale.
• Pool members never receive cluster-wide secrets or database administrator credentials; they receive a per-lease, tenant-scoped credential. The IronOCR licence key is the only cluster secret a pool member gets.
• A pool member that resumes after a lost connection or a Communication Controller restart reports its running lease, so the result of a lease is no longer lost when the controller restarts.
• New metrics under octo.lease.* (queue depth and wait, grants, refusals, interruptions, scale-up) and octo.pool.* (member state).

Platform

• Pipeline executions started by a cron schedule report the trigger type Scheduled (also on dedicated adapters); Event is reserved for real bus events.
• ToPipelineDataEvent@1 wakes a scaled-to-zero target workload before it publishes to it.
• Adapters fail at startup when a configured datastore host name does not resolve, instead of failing on the first execution.
• Blueprint dependency ranges resolve to the highest matching version across all readable catalogs, and installing a blueprint never downgrades an installed dependency (it keeps a newer version that satisfies all ranges, or fails).
• The GitHub blueprint catalogs have an IsEnabled option like the CK catalogs; a disabled catalog is skipped by listing, search, dependency resolution, installation and refresh. Default true.
• Staged authorization of the Communication Controller's adapter and operator hubs: Helm values services.communication.hubAuthorization.adapterMode / operatorMode, default LogOnly (log and count in octo.communication.hub.authorization.decisions, refuse nothing). Enforce is a separate, later step per cluster.
• Key ring values for SECRET attribute values in the core and operator charts, with an opt-in render guard (secretEncryptionRequired). Inactive until configured.

Fixes

• Updating rows of a runtime query through GraphQL (runtimeQuery.update) wrote association changes in the reversed direction, and replaced to-many navigations, for roles whose opposite side has the multiplicity ZeroOrOne.
• Installing a blueprint could re-apply the seed data of an older version of a dependency and record that older version as installed.

Refinery Studio

• Pools are called Deployment Sites everywhere in the Studio (integration overview, detail and configuration pages, command palette, attention cards). The site configuration uses the delivered entity form "Deployment site".
• The old route communication/pools has no redirect; update bookmarks to the Deployment Sites page.
• Pages for adapter pools and leasing are not yet part of the new Studio; they follow in a later Studio release. Until then, leasing is operated with octo-cli, the MCP tools or the REST API.

Known limitations

• Run the Communication Controller with one replica. Lease state lives in the controller process; persistent leases for several replicas are planned (AB#5878).
• Leasing is off by default on every tenant; enable it in a separate change after the upgrade.
• Refinery Studio has no pages for adapter pools and leasing yet.
• Tenants on System.Communication 3.42.0 are refused by the migration and stay on 3.x until a later release adds that entry point.
• The operator does not recreate the Deployment Site resources by itself after the upgrade; redeploy every site per tenant (see the upgrade guide).
• The Communication Controller removes a second HelmRepository association of an adapter when it re-applies the System.Communication seed on its first start; record and restore such associations (see the upgrade guide).
• Adapter pools reject ReceivesClusterSecrets and ingress configuration. A pool that runs ExecuteCSharp@1 needs a memory limit of at least 1 Gi.
• Leased pipelines cannot reveal SECRET attribute values (RevealSecret@1); a pool member holds no tenant key ring.
• Stream data (CrateDB) is not available to leased executions.
• Changes to a pool's name, sharing mode or allow-list reach borrowing tenants only after POST {tenantId}/v1/adapterpool/mirrors/publish.
• The deprecated adapter configuration key OCTO_ADAPTER__TENANTID is removed in the next release. Adapter charts must render OCTO_ADAPTER__DEDICATEDTENANTID by then.

Upgrading

See the Upgrade Guide r3.5.0.