SUMMIT.OS

Every event in Summit.OS follows the same path: raw signal in, fused world model out, AI scoring, mission creation, operator action. Here's what happens at each stage.

This is what it looks like in practice. An anomaly is detected. What happens next.

Summit.OS ships with auth off by default so you can run it locally without setting up an identity provider. Flip the flags and every endpoint is locked down.

# Step 1 — User navigates to console
# Console redirects to OIDC provider (Keycloak / Auth0 / etc)
→ GET /auth/callback?code=[authorization_code]

# Step 2 — Gateway validates JWT
→ POST /auth/token  200 OK  { roles: ["OPERATOR"], mfa_required: true }

# Step 3 — MFA challenge (if enrolled)
→ POST /auth/mfa/webauthn/authenticate/begin
# Browser prompts: "Touch your security key"
→ POST /auth/mfa/webauthn/authenticate/complete  200 OK

# Step 4 — Full session issued
✓ Session JWT issued  →  valid 8h  →  RBAC enforced on every request
✓ Audit log entry created: AUTH_LOGIN // user@domain.com // ip: x.x.x.x

Every technical control required for SOC2 compliance is built in — Argon2id, AES-256-GCM field encryption, append-only audit logs, TLS, RBAC, geoblock. Off by default for local dev; flip the env flags and it's a hardened production deployment. Summit.OS is built to pass a SOC2 audit — not a shortcut around one.

Summit.OS doesn't care what your hardware is. Drone, robot, CCTV camera, weather station, Modbus PLC, AIS transponder — if it produces data, it can talk to Summit.OS. Built-in adapters handle the most common sources. For everything else, the SDK is 10 lines of Python.

from summit_sdk import BaseAdapter, AdapterManifest, EntityBuilder, Protocol, Capability

class MySensorAdapter(BaseAdapter):

    MANIFEST = AdapterManifest(
        name="my-temperature-sensor",
        version="1.0.0",
        protocol=Protocol.MQTT,
        capabilities=[Capability.READ, Capability.STREAM],
        entity_types=["ASSET"],
    )

    async def run(self):
        while not self.stopped:
            reading = await self.read_sensor()   # your hardware call

            entity = (EntityBuilder(self.device_id, "ASSET")
                .position(reading.lat, reading.lon, reading.alt)
                .metadata("temperature", reading.celsius)
                .metadata("unit", "sensor-station")
                .build())

            self.publish(entity)           # → Summit.OS world model
            await self.sleep(10)           # poll every 10s

# Run it
$ python my_sensor_adapter.py
✓ Adapter registered → entity streaming → visible on map

The adapter publishes entities over MQTT. Summit.OS picks them up, runs them through fusion, scores them, and displays them on the map — all automatically. The only thing you write is the hardware read logic. See packages/adapters/examples/ for complete templates for drones, cameras, PLCs, and weather stations.

A mission is an assigned task with a type, a target entity, an asset, and a lifecycle. It can be created by the operator, by the AI, or directly via the API. Every mission goes through the same state machine regardless of how it was created.

# Create a SURVEY mission via API
$ curl -X POST http://localhost:8000/v1/missions \
    -H "Authorization: Bearer <token>" \
    -H "Content-Type: application/json" \
    -d '{
      "mission_type":  "SURVEY",
      "entity_id":    "entity-abc123",
      "asset_id":     "drone-01",
      "priority":     "HIGH",
      "notes":        "Smoke detected northeast sector"
    }'

201 Created
{
  "mission_id":  "msn-7f3a...",
  "status":      "PENDING_APPROVAL",  // HIGH = requires operator confirm
  "assigned_to": "drone-01",
  "created_at":  "2026-03-29T14:22:11Z"
}

AGPL v3. No lock-in. Summit.OS is a foundation — like Linux for autonomous ops. The platform is open, the ecosystem is yours to shape. Commercial license available for proprietary deployments.