Add workflow condition contracts and shared catalog packaging (#180 )

* Add workflow condition contracts and shared catalog packaging Define versioned contract and catalog schemas, Start and custom-stage examples, and opt-in bundled/external ConfigMap packaging. Extract classification defaults without changing the rendered default manifests or existing overrides. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Bump Hub chart to 0.149.0 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Omit optional classification catalog override by default Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Support explicit IDs for deployment-defined workflows (#179 )
2026-10-19 17:38:27 +00:00 · 2026-10-05 16:40:48 +02:00 · 2026-09-29 16:15:02 +02:00 · 2026-09-28 17:17:44 +02:00 · 2026-09-28 14:48:23 +00:00 · 2026-09-28 13:44:15 +00:00
39 changed files with 1709 additions and 38 deletions
@@ -1,15 +1,17 @@
-name: Workflows queue consistency
+name: Workflows queue and identity consistency

 # Fails the build if the analysis producer, the workflows engine and the stage
 # workers would render onto different WORKFLOWS_QUEUE names — the silent
 # producer/consumer queue-name drift that leaves runs piling up with no
-# consumer. Pure `helm template` render check, no cluster required.
+# consumer. Also validates stable workflow identities and API/engine definition
+# consistency. Pure `helm template` render checks, no cluster required.
 on:
  workflow_dispatch:
  pull_request:
    paths:
      - 'charts/hub/**'
      - 'scripts/check-workflows-queue-consistency.sh'
+      - 'scripts/check-workflow-configuration.sh'
      - '.github/workflows/workflows-queue-consistency.yaml'

 permissions:
@@ -27,5 +29,8 @@ jobs:
        with:
          version: v3.16.2

-      - name: Check WORKFLOWS_QUEUE consistency
+      - name: Check workflow queue and identity consistency
        run: ./scripts/check-workflows-queue-consistency.sh charts/hub
+
+      - name: Check workflow configuration and classification catalog
+        run: bash scripts/check-workflow-configuration.sh charts/hub
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.134.0
+version: 0.149.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -31,10 +31,150 @@ Uninstall the Kerberos Hub chart

    helm uninstall hub -n kerberos-hub

+### Sprite Resolution
+
+`kerberospipeline.sprite.width` and `height` set the pixel dimensions of each
+sprite tile, not the complete sheet. Preserve a **16:9 aspect ratio**: for
+example, `240x135` (default), `480x270`, or `640x360`.
+
+Deploy the dimension-aware Hub frontend, Hub API, analysis worker, sprite worker,
+notification worker, and export worker before increasing resolution. Release the updated shared Go
+models and update the Hub API/export worker dependency pins before building those
+services. Newly generated sprites carry their own tile dimensions; existing
+sprites without dimensions retain the `240x135` fallback and need no migration.
+Do not change a global fallback to match the new size. Increasing both dimensions
+by two produces four times as many pixels, increasing decoded memory and usually
+storage and bandwidth. Hover previews retain their display size; fullscreen
+scrubbing uses the higher-resolution tiles.
+
+```yaml
+kerberospipeline:
+    sprite:
+        width: "480"
+        height: "270"
+```
+
+### Optional Argo CD pipeline ordering
+
+Each listed pipeline service accepts `deploymentAnnotations` in its existing
+values section. The default is `{}`, so installing or upgrading the chart alone
+does not enable ordering. Commented examples appear beside the service settings
+in `values.yaml`; replace the empty map rather than adding duplicate YAML keys.
+Annotations render on Deployment `metadata`, not on pod templates or Services.
+
+The inline examples use the following order, leaving gaps of ten:
+
+| Wave | `kerberospipeline` keys |
+| --- | --- |
+| 10 | `event` |
+| 20 | `notify` |
+| 30 | `throttler` |
+| 40 | `analysis` |
+| 50 | `thumbnail`, `sprite`, `dominantColor`, `counting` |
+| 60 | `sequence` |
+| 70 | `monitor` |
+
+Enable the annotation in each service's existing environment values section.
+No separate example values file is required. These annotations do not change
+image tags or enable disabled services such as sprite.
+Deploy the compatible analysis bridge before replying workers, and select the
+fixed counting release; waves do not enforce minimum compatible image versions.
+The chart's default image tags are not a compatibility-tested rollout bundle.
+
+Argo CD applies lower waves first and waits for sync/health before proceeding
+within the same Application. Unannotated resources remain at wave zero. A
+single-service image update does not restart earlier services, but an unhealthy
+earlier wave can block it. Separate Applications and external classifier/workflow
+workers require their own coordination. Helm itself does not enforce these waves.
+
+Waves are not a substitute for message compatibility, readiness checks, or
+stopping old RabbitMQ consumers. This example does not add health probes or
+change the Deployment rolling-update strategy.
+
+### Deployment-global workflow identity
+
+`kerberoshub.workflows.definitions` is a map keyed by workflow name. Enabled
+definitions are passed as the same `WORKFLOW_DEFINITIONS` JSON to Hub API and the
+workflow engine. These deployment-global, ops-managed workflows are read-only
+through the API; manage them in Helm values. There are no per-project on/off
+overrides.
+
+Supply an explicit, stable `id` for new definitions:
+
+```yaml
+kerberoshub:
+    workflows:
+        enabled: true
+        definitions:
+            tracking-workflow:
+                id: "ec7e72bc4cedd32018e1f92a"
+                enabled: true
+                stages:
+                    - operation: objecttracking
+```
+
+The worker and its queue must also be configured under
+`kerberoshub.services.objecttracking`. As before, omitted triggers default to a
+single automatic trigger and disabled definitions are not sent to either service.
+
+Identity is separate from mutable names and content versions. Keep an explicit
+ID unchanged when renaming or revising a workflow; changing it creates an
+independent identity, not a new version of the existing workflow. The chart
+does not generate random IDs or introduce a version field.
+
+For compatibility, an omitted `id` remains omitted from the rendered JSON. The
+backend derives the effective ID as the first 24 hexadecimal characters of
+SHA-256 over the **exact map key**, including case and whitespace. Before
+renaming an existing ID-less definition, pin its current derived ID explicitly
+to preserve references and history. For example:
+
+```sh
+printf '%s' 'tracking-workflow' | sha256sum | cut -c1-24
+# ec7e72bc4cedd32018e1f92a
+```
+
+The chart ships an empty definitions map. Its commented `tracking-workflow` and
+`vlm-workflow` examples pin their current name-derived IDs for compatibility.
+
+Explicit IDs must be quoted, non-zero, 24-character hexadecimal strings (Mongo
+ObjectIDs); uppercase is accepted and normalized to lowercase in JSON. Empty,
+null, all-zero, malformed, and non-string IDs fail Helm rendering with the
+definition name and validation requirement. Duplicate effective IDs also fail,
+naming both definitions and the colliding ID, whether explicit/explicit or
+explicit/name-derived. Validation includes disabled definitions and runs even
+when the engine is disabled, so identities remain reserved. Omit the `id` key
+entirely to use the legacy fallback; invalid explicit IDs never fall back.
+
+Run the render-only queue and identity checks (Helm and Python 3 required):
+
+```sh
+./scripts/check-workflows-queue-consistency.sh charts/hub
+```
+
 ### Parameters

 Below all configuration options and parameters are listed.

+When upgrading to `0.144.0`, move `kerberoshub.audit.enabled` and
+`kerberoshub.audit.intake` to `audit.enabled` and `audit.intake`. Consumer
+workload settings remain under `kerberoshub.audit`.
+
+Auditing is globally disabled by default. Setting `audit.enabled: true` deploys
+the audit consumer and enables every supported producer by default. A producer
+is enabled only when both the global switch and its service switch are true; set
+the service's `audit.enabled` value to `false` only when that service must opt
+out.
+
+```yaml
+audit:
+    enabled: true
+
+kerberospipeline:
+    notify:
+        audit:
+            enabled: false # Optional per-service opt-out.
+```
+
 | Name                                        | Description                                                                                                                | Value |
 | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----- |
 | `license` | The license key you received from support@kerberos.io. If not available request one. | `"L/+DAwEBB2xpY2Vuc2UB/4QAAQIBB1BheWxvYWQBCgABCVNpZ25hdHVyZQEKAAAA/gMk/4QB/gEZ/8sQACxnaXRodWIuY29tL3V1Zy1haS9odWItbGljZW5zZS9tb2RlbHMuTGljZW5zZX8DAQEHTGljZW5zZQH/gAABDAECSWQB/4IAAQNLZXkBDAABB0NvbXBhbnkBDAABB0V4cFRpbWUBBAABBERheXMBBAABB0NhbWVyYXMBBAABBVNpdGVzAQQAAQZWYXVsdHMBBAABCk1lZGlhTGltaXQBBAABCVBlcnBldHVhbAECAAEGQWN0aXZlAQIAAQlJcEFkZHJlc3MBDAAAABj/gQEBAQhPYmplY3RJRAH/ggABBgEYAAAy/4AvAQwAAAAAAAAAAAAAAAACDGZyZWUtbGljZW5zZQH81iZi6gH+AtoBEAEUARQDAQAB/gIAfeXxQb6kaPfAgOWeSAE6qEiQviFD6sciNmNfMel1mEL53FeV0GQe4cYBip9wyJag35az8A1yppxSymZD5V4my2FckyN2zmEW4E2sO/v+8eKepiAGYEzrKtfNCLxdWLmrHd0zjYQ3qk+PNfoPyzCOefeulw3aFsqBlzg9wDkF8cRx6tUW0qNTzki6sFGOuLoxS49cWqsftAvZmt+CRWa8u0VArIAjOpywN0RIZCkEYzp5RYF3LSVyWYEyvVhjE19DDnevzpJyCHRsIHTRcpTQkhboeapOdlEz8cx+PaOvxktN8hBWceTAH+nw96FARG7y6Cpjw3xo+NV1xb0tvRXGaGoK77JnErKLhd/haXji98rGvMakDt18WSbQfTVS84+Fw+/gKGsW3uS3fROAaZw1kZj4PgsEPZDvbVkCVyuS0O87UoYqpxH8S4by8cTF3wDP7FwyIRZbEbYjN2wzHSmlADYOBtdsdb1VGm7wvtB85vML9n7ZSlIpJdqfci06mGks102mDyG2LRMhUEvpUW3D/weErIvj2WiAwf6r0EUj+LO8VmAsYkME9da7FXEN6Vg/5f1u485LOpYki332RaDOhDn2eMG9DVb/HnmQSFagX+XXc/QwfsWiehCgKYGk4jQpyklTqoGu8BAt6Sm8CaoH8ngZ3cHLQT5DcZElV36/N/wA"` |
@@ -71,6 +211,12 @@ Below all configuration options and parameters are listed.
 | `rabbitmq.username` | RabbitMQ username, by default `'yourusername'` | `"yourusername"` |
 | `rabbitmq.password` | RabbitMQ password, by default `'yourpassword'` | `"yourpassword"` |
 | `rabbitmq.exchange` | RabbitMQ exchange, by default `''` | `""` |
+| `audit.enabled` | Deploy the Hub audit consumer and act as the master switch for all audit producers. | `false` |
+| `audit.intake.queue` | Shared durable RabbitMQ queue used by audit producers and the audit consumer. | `"hub-audit-events"` |
+| `audit.intake.deadletterQueue` | Shared RabbitMQ queue used for invalid audit events and exhausted persistence retries. | `"hub-audit-dead-letter"` |
+| `audit.intake.maxRetries` | Maximum MongoDB persistence retries before an intake event is dead-lettered. | `10` |
+| `audit.intake.prefetchCount` | Maximum unacknowledged intake events per audit replica. | `20` |
+| `audit.intake.persistTimeout` | Timeout for one MongoDB persistence attempt. | `"10s"` |
 | `kafka.broker` | Kafka brokers, by default `'kafka1.yourdomain.com:9094,kafka2.yourdomain.com:9094'` | `"kafka1.yourdomain.com:9094"` |
 | `kafka.username` | Kafka username, by default `'yourusername'` | `"yourusername"` |
 | `kafka.password` | Kafka password, by default `'yourpassword'` | `"yourpassword"` |
@@ -121,6 +267,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.api.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.9.8"` |
 | `kerberoshub.api.replicas` | The number of pods/replicas running for the Kerberos Hub API deployment. | `2` |
+| `kerberoshub.api.audit.enabled` | Enable audit publishing from Hub API when global auditing is enabled. | `true` |
 | `kerberoshub.api.logLevel` | Log verbosity level for `kerberoshub.api`. | `"info"` |
 | `kerberoshub.api.jwtSecret` | A secret that is for generating JWT tokens. | `"this-is-a-secret-please-change-to-random-string"` |
 | `kerberoshub.api.schema` | The protocol to serve the Kerberos Hub API, `'http'` or `'https'`. | `"https"` |
@@ -207,6 +354,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
 | `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
 | `kerberoshub.frontend.features.workflows.enabled` | Enable or disable the workflows feature in the frontend. | `"false"` |
+| `kerberoshub.frontend.features.audit.enabled` | Enable or disable the owner/admin Audit events page and navigation link. | `"true"` |
 | `kerberoshub.frontend.features.organisations.enabled` | Enable or disable the organisation feature family, including projects. When empty, child groups apply independently. | `""` |
 | `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
 | `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
@@ -228,16 +376,21 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.liveview.liveStreamMode` | Transport backing LIVE mode: `webrtc`, `hls`, or `moq`. | `"webrtc"` |
 | `kerberoshub.frontend.features.liveview.hlsEnabled` | Offer HLS as a selectable LIVE transport. | `"true"` |
 | `kerberoshub.frontend.features.liveview.moqEnabled` | Offer MoQ as a selectable LIVE transport. | `"false"` |
-| `kerberoshub.frontend.features.liveview.remoteRecordingEnabled` | Show the manual REC control in live views. | `"true"` |
+| `kerberoshub.frontend.features.liveview.remoteRecordingEnabled` | Show the manual REC control and recording-state overlay in live views. | `"true"` |
+| `kerberoshub.frontend.features.liveview.deviceStatusEnabled` | Show connectivity and recent-motion status in live view tile headers. | `"true"` |
 | `kerberoshub.frontend.features.liveview.moqRelayUrl` | WebTransport URL of the MoQ relay. | `"https://relay.uug.ai/anon"` |
 | `kerberoshub.frontend.features.liveview.moqBroadcastPrefix` | Prefix used to build MoQ broadcast names. | `"devices"` |
 | `kerberoshub.frontend.features.liveview.paginationMode` | Liveview behavior setting: `paginationMode` (`scroll`, `numbered` or `maxStreams`). | `"scroll"` |
 | `kerberoshub.frontend.features.liveview.pageSize` | Liveview behavior setting: `pageSize` (max streams shown per page in `numbered` mode). | `"6"` |
 | `kerberoshub.frontend.features.liveview.maxStreams` | Liveview behavior setting: `maxStreams`. | `"-1"` |
+| `kerberoshub.frontend.features.chart.colors` | Ordered colors shared by chart series and marker detection overlays. | `["#84569f", "#3ba7ff", "#ff5c8a", "#4ad991", "#ffb84d", "#ff7043"]` |
 | `kerberoshub.frontend.features.chart.colorChartSelectionFill` | Fill color for chart selection regions. | `"rgba(132, 86, 159, 0.07)"` |
 | `kerberoshub.frontend.features.chart.colorChartSelectionStroke` | Stroke color for chart selection regions. | `"rgba(132, 86, 159, 0.4)"` |
 | `kerberoshub.frontend.features.chart.colorChartGridStroke` | Stroke color for chart grid lines. | `"rgba(0, 106, 255, 0.18)"` |
 | `kerberoshub.frontend.features.devices.hideAgent` | Hide agent controls in the devices section of the frontend. | `"false"` |
+| `kerberoshub.frontend.features.devices.analyticsEnabled` | Enable or disable the Analytics tab on device detail pages. | `"true"` |
+| `kerberoshub.frontend.features.devices.developerToolsEnabled` | Enable or disable owner-only live Agent logs and terminal access on device detail pages. | `"true"` |
+| `kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled` | Enable or disable the fullscreen Sites map on the Dashboard. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.date.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.date`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.sites.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sites`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.groups.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.groups`. | `"true"` |
@@ -248,8 +401,11 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.media.filter.sort.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sort`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.category.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.category`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.markers.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.markers`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled` | Limit marker, category, event, and tag filter options to the selected recordings day. | `"false"` |
+| `kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled` | Order marker filter options from configured categories before other markers. | `"false"` |
+| `kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories` | Ordered exact, case-sensitive marker category names to prioritize. | `[]` |
 | `kerberoshub.frontend.features.media.filter.events.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.events`. | `"true"` |
-| `kerberoshub.frontend.features.liveview.defaultStreamMode` | Default live stream mode: `SD` or `HD`. | `"SD"` |lter.tags`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.tags.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.tags`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.defaultView` | Default view for the media page: `timeline` or `grid`. | `"timeline"` |
 | `kerberoshub.frontend.features.floorplan.enabled` | Enable or disable `kerberoshub.frontend.features.floorplan`. | `"true"` |
 | `kerberoshub.frontend.features.floorplan.colorDeviceActive` | Color customization for `floorplan` in the frontend. | `"hsla(131, 31%, 52%, 1)"` |
@@ -298,8 +454,22 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.cleanup.globalPassIntervalHours` | Minimum hours between global cleanup passes. | `"0"` |
 | `kerberoshub.cleanup.globalPassDeleteBudget` | Max documents deleted during a global pass. | `"0"` |
 | `kerberoshub.cleanup.defaultTaskRetentionDays` | Default retention (in days) applied to tasks without an explicit `retention_days`. Tasks older than this (anchored on `creation_date`) are deleted with their `case_media` rows. Set to `"0"` or a negative value to keep tasks forever. Must match `kerberoshub.api.defaultTaskRetentionDays`. | `"0"` |
+| `kerberoshub.cleanup.auditEventRetentionDays` | Deployment-wide audit-event retention in days, independent of recording plans, inactive-account cleanup, and the optional global pass. Set to `"0"` or a negative value to keep audit events indefinitely. | `"400"` |
 | `kerberoshub.cleanup.resources.requests.memory` | Memory request for `kerberoshub.cleanup`. | `"10Mi"` |
 | `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
+| `kerberoshub.audit.repository` | Hub audit service container image repository. | `"ghcr.io/uug-ai/hub-audit"` |
+| `kerberoshub.audit.pullPolicy` | Hub audit service image pull policy. | `"IfNotPresent"` |
+| `kerberoshub.audit.tag` | Hub audit service image tag. | `"v1.0.1"` |
+| `kerberoshub.audit.replicas` | Number of audit service replicas. Per-destination MongoDB leases prevent concurrent delivery. | `1` |
+| `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
+| `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
+| `kerberoshub.audit.terminationGracePeriodSeconds` | Pod termination grace period. Keep this longer than `leaseDuration` so an in-flight cycle can finish. | `150` |
+| `kerberoshub.audit.destinations` | Webhook destinations. Each entry supports `id`, `enabled`, `url`, delivery limits, filters, public `headers`, `bearerTokenSecret`, and arbitrary `secretHeaders`. Destination IDs retain independent checkpoints. | `[]` |
+| `kerberoshub.audit.serviceMonitor.enabled` | Create a Prometheus `ServiceMonitor` for audit service metrics. | `true` |
+| `kerberoshub.audit.serviceMonitor.interval` | Audit service metrics scrape interval. | `"15s"` |
+| `kerberoshub.audit.volumes` | Additional pod volumes, for example a private webhook CA bundle. | `[]` |
+| `kerberoshub.audit.volumeMounts` | Additional audit service container volume mounts. | `[]` |
+| `kerberoshub.audit.extraEnv` | Additional audit service environment variables. | `[]` |
 | `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Kerberos Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
 | `kerberoshub.monitordevice.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.0"` |
@@ -315,10 +485,11 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
 | `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
 | `kerberoshub.forwarder.enabled` | Enable or disable the Hub forwarder component. | `false` |
+| `kerberoshub.proxy.enabled` | Enable or disable the legacy Hub proxy Deployment and LoadBalancer Service. | `false` |
 | `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
 | `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
 | `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
-| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. Set to `0` to disable. | `0` |
+| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy` when enabled. | `0` |
 | `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
 | `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
 | `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
@@ -353,7 +524,9 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.notify.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.9"` |
 | `kerberospipeline.notify.replicas` | Number of replicas for `kerberospipeline.notify`. | `1` |
+| `kerberospipeline.notify.audit.enabled` | Enable audit publishing from the notification worker when global auditing is enabled. | `true` |
 | `kerberospipeline.notify.logLevel` | Log verbosity level for `kerberospipeline.notify`. | `"info"` |
+| `kerberospipeline.notify.notificationExpiryMinutes` | Maximum recording age in minutes before notification delivery. Set to `"0"` to disable the freshness cutoff. | `"15"` |
 | `kerberospipeline.notify.resources.requests.memory` | Memory request for `kerberospipeline.notify`. | `"10Mi"` |
 | `kerberospipeline.notify.resources.requests.cpu` | CPU request for `kerberospipeline.notify`. | `"10m"` |
 | `kerberospipeline.notifyTest.repository` | The notification service for testing, the different channels. | `"uugai/hub-pipeline-notification-test"` |
@@ -405,8 +578,8 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.sprite.replicas` | Number of replicas for `kerberospipeline.sprite`. | `5` |
 | `kerberospipeline.sprite.logLevel` | Log verbosity level for `kerberospipeline.sprite`. | `"info"` |
 | `kerberospipeline.sprite.interval` | Configuration value for `kerberospipeline.sprite.interval`. | `"1"` |
-| `kerberospipeline.sprite.width` | Configuration value for `kerberospipeline.sprite.width`. | `"240"` |
-| `kerberospipeline.sprite.height` | Configuration value for `kerberospipeline.sprite.height`. | `"135"` |
+| `kerberospipeline.sprite.width` | Tile width in pixels; preserve width:height = 16:9. | `"240"` |
+| `kerberospipeline.sprite.height` | Tile height in pixels; preserve width:height = 16:9. | `"135"` |
 | `kerberospipeline.sprite.resources.requests.memory` | Memory request for `kerberospipeline.sprite`. | `"512Mi"` |
 | `kerberospipeline.sprite.resources.requests.cpu` | CPU request for `kerberospipeline.sprite`. | `"500m"` |
 | `kerberospipeline.sprite.resources.limits.memory` | Memory limit for `kerberospipeline.sprite`. | `"2Gi"` |
@@ -486,6 +659,178 @@ As mentioned during the Post installation step, you'll import some `.nosql` file

 Within the Kerberos Hub front-end you'll see the option to filter through classifications. This filtered is stored in the `settings` collection. By changing the entries of the `classifications` object, you can add, edit or remove items from the filters.

+The default shared classification list lives in
+[`configuration/catalogs/classifications.json`](configuration/catalogs/classifications.json),
+independently of workflow contracts. Set `classificationCatalog` to a list to
+replace those defaults; unset or `null` uses the bundled file. Each entry contains the stable classifier output
+`key`, the user-facing `label`, and an `icon` key. Hub API exposes this catalog
+to alerts and filters. When the mounted catalog is unavailable, compatible Hub
+API versions fall back to the legacy `settings` document and then the built-in
+classification list. Set `classificationCatalogEnabled: false` to omit the
+ConfigMap and make Hub API use that fallback directly.
+
+```yaml
+classificationCatalogEnabled: true
+classificationCatalog:
+  - key: forklift
+    label: Forklift
+    icon: vehicle
+```
+
+### Workflow condition contracts (preparatory)
+
+This chart defines the initial v1 metadata format and opt-in file packaging.
+**Hub API and the frontend do not yet consume these contracts.** Enabling the
+packaging only mounts files; it neither enables an editor feature nor registers
+workers or changes execution. No new loader environment variable is set.
+
+The earlier device-bound workflow configurations were development fixtures, not
+a recommended deployment model. Charts describe capabilities, not selected
+devices, project IDs, concrete workflow edges, or user-authored conditions.
+Device filtering is optional. Saved selections belong in individual workflows.
+
+The configuration is split into independent shared catalogs and their consumers:
+
+```text
+configuration/
+  catalogs/
+    classifications.json
+  workflow-contracts/
+    start.yaml
+schemas/
+  catalog.schema.json
+  workflow-contract.schema.json
+```
+
+- [Start contract](configuration/workflow-contracts/start.yaml): current device,
+  site, group and initial-classification presets, plus schedule/condition controls.
+- [Custom pose example](examples/workflow-contracts/pose.yaml): hypothetical
+  worker output, demonstrating a file catalog, inline choices and a numeric field.
+  This example does not deploy a worker or claim a universal pose-model format.
+- [Contract schema](schemas/workflow-contract.schema.json): format, source-name
+  documentation and YAML editor completion via the `$schema` comment.
+- [Catalog schema](schemas/catalog.schema.json): shared JSON lists of
+  `{key, label, icon?}`, compatible with the current classification file format.
+
+Each contract defines a `stage` type, a `schemaVersion`, a `contractVersion` and
+its own `fields`. A field declares `id`, `label`, `path`, scalar `type` and
+supported `operators`; `optional`, numeric bounds and `choices` are optional.
+The `type` describes each wildcard-selected candidate, not the containing array.
+IDs must be unique within a contract. Increment `contractVersion` when changing
+its meaning/output shape; the future runtime must bind workflows to compatible
+versions rather than silently reinterpreting saved conditions.
+
+#### Choice origins
+
+Use exactly one of these, or omit `choices` for typed user input:
+
+```yaml
+choices:
+  source: project.devices
+```
+
+```yaml
+choices:
+  file: ../catalogs/classifications.json
+```
+
+```yaml
+choices:
+  values: [standing, sitting, lying]
+```
+
+The supported system-resource vocabulary for v1 is:
+
+| `choices.source` | User-facing labels | Stored comparison values |
+| --- | --- | --- |
+| `project.devices` | Authorized device names | Stable device keys |
+| `project.sites` | Authorized site names | Stable site IDs |
+| `project.groups` | Authorized group names | Stable group IDs |
+
+These are direct built-in API resolver identifiers, not database paths or
+deployer-selected authorization scopes. They still require implementation in the
+future loader. Resolvers must reuse existing project/resource authorization and
+legacy-owner compatibility; metadata cannot grant access.
+
+File references resolve relative to the mounted contract, within the shared
+configuration root. V1 uses `../catalogs/<name>.json`; no URLs, arbitrary file
+access or recursive catalog references. Catalog keys are stable strings, with
+labels for display; inline lists may contain strings, numbers or booleans matching
+the field type. Catalogs are reusable by filters, alerts and other consumers,
+not owned by workflows. A library may ship a catalog without implementing an API.
+
+#### Bundled and external packaging
+
+`workflowConfiguration.enabled` defaults to `false`. With it enabled and
+`existingConfigMap` empty, the chart mounts the bundled Start contract and the
+**effective** classification list under `/etc/kerberos/configuration`, using
+the directory layout above. The projected volume reuses the existing
+classification ConfigMap, including `classificationCatalog` overrides, rather
+than storing another copy in the workflow ConfigMap.
+
+The existing classification ConfigMap, mount path, `CLASSIFICATION_CATALOG_FILE`
+and API endpoint remain unchanged. `classificationCatalog: []` remains an
+explicit empty list, not a request for chart defaults; the current API falls
+back to settings/built-in values for an empty/invalid catalog. The preparatory
+bundle does not reproduce that runtime fallback and must not be treated as a
+resolved API catalog. The future loader must share the existing classification
+loader. Bundled packaging requires `classificationCatalogEnabled: true`; an
+external bundle can be packaged independently.
+
+Custom deployers can maintain files in their own repository, create a ConfigMap
+in the release namespace, and use the unchanged chart. For example, from this
+chart directory (replace the namespace):
+
+```sh
+kubectl -n YOUR_NAMESPACE create configmap custom-workflow-configuration \
+  --from-file=pose.yaml=examples/workflow-contracts/pose.yaml \
+  --from-file=pose-keypoints.json=examples/catalogs/pose-keypoints.json
+```
+
+Then use [the example values overlay](examples/workflow-configuration-values.yaml).
+`existingConfigMap` replaces the entire bundled configuration, not individual
+files. Include Start and its referenced catalog too if the custom bundle needs
+them. `items` explicitly maps ConfigMap keys to files in `workflow-contracts/`
+and `catalogs/`; files are mounted read-only, without `subPath`. ConfigMap size
+limits apply. Mount the same shared catalog ConfigMap into other consumers as
+needed; do not maintain divergent copies of its contents.
+
+The chart checks item paths and required options but cannot inspect an existing
+ConfigMap at render time. Validate its files against the supplied schemas.
+Bundled changes update the pod checksum. For externally managed ConfigMaps,
+manage rollout/reload in your deployment tooling; the chart cannot checksum
+their contents.
+
+Helm validates `values.schema.json`, **not** arbitrary bundled YAML/JSON files.
+The standalone schemas support authoring validation. The future loader must
+also reject duplicate field/catalog keys, unknown sources, missing/invalid
+files, incompatible bounds, unsupported contract versions and unsafe paths.
+Validation failures must be surfaced, not silently replaced with empty choices.
+
+#### Runtime semantics to preserve when wiring consumers
+
+Start paths refer to sanitized initial context, never credentials. Other stage
+paths are relative to that node instance's result. Conditions may use Start and
+all available upstream node outputs, not just the immediately preceding stage;
+future or unrelated parallel results are unavailable. Node instances remain
+distinct. Conditional branches and missing outputs require explicit availability
+handling, even for a field not marked `optional`.
+
+Wildcard positive comparisons match any candidate. Independent wildcard
+conditions can match different objects; use the existing same-element `anyMatch`
+semantics when predicates must match one detection/keypoint.
+
+The existing Start controls retain their behavior: alternatives within a scope
+category are OR; populated device/site/group/classification categories, schedule
+and advanced conditions are AND. `conditionMode` only combines the advanced
+conditions. Empty selections/schedules are unrestricted. Multiple automatic
+Start edges are OR for creating one run; only matched entry branches dispatch.
+Manual runs are created before continuation conditions are evaluated, and their
+automatic trigger settings remain dormant. Schedule uses recording time and an
+IANA timezone, not an invented output field. The advanced editor retains logical
+groups and existence checks; neither scheduling nor logical groups are scalar
+output fields. Contracts do not redefine the saved workflow wire format.
+
 ### Indexing

 Following indexes should be executed on the MongoDB database (Kerberos) to improve future performance. Within Kerberos Hub several queries are executed, following indexes will improve the loading times. If not applied you might experience application timeouts or reduced performance when storing lots of data.
@@ -0,0 +1,11 @@
+[
+  {"key": "animal", "label": "Animal", "icon": "animal"},
+  {"key": "pedestrian", "label": "Pedestrian", "icon": "pedestrian"},
+  {"key": "cyclist", "label": "Cyclist", "icon": "cyclist"},
+  {"key": "motorbike", "label": "Motorbike", "icon": "motorbike"},
+  {"key": "lorry", "label": "Lorry", "icon": "lorry"},
+  {"key": "car", "label": "Car", "icon": "car"},
+  {"key": "handbag", "label": "Handbag", "icon": "handbag"},
+  {"key": "suitcase", "label": "Suitcase", "icon": "suitcase"},
+  {"key": "cell phone", "label": "Cell phone", "icon": "cell phone"}
+]
@@ -0,0 +1,44 @@
+# yaml-language-server: $schema=../../schemas/workflow-contract.schema.json
+# Metadata only; no current API loader consumes this contract.
+schemaVersion: 1
+stage: start
+contractVersion: 1
+
+# Paths refer to the safe initial context, not the full event or credentials.
+fields:
+  - id: device
+    label: Device
+    path: device.deviceKey
+    type: string
+    operators: [eq, in]
+    choices:
+      source: project.devices
+  - id: sites
+    label: Sites
+    path: device.siteIds.*
+    type: string
+    operators: [in]
+    choices:
+      source: project.sites
+  - id: groups
+    label: Groups
+    path: device.groupIds.*
+    type: string
+    operators: [in]
+    choices:
+      source: project.groups
+  - id: classifications
+    label: Initial classifications
+    path: inputs.classify.details.*.classified
+    type: string
+    operators: [in]
+    optional: true
+    choices:
+      file: ../catalogs/classifications.json
+
+# Existing structured controls, not fields produced by Start.
+controls:
+  - id: weeklySchedule
+    label: Weekly schedule
+  - id: conditions
+    label: Advanced conditions
@@ -0,0 +1,5 @@
+[
+  {"key": "nose", "label": "Nose"},
+  {"key": "left_shoulder", "label": "Left shoulder"},
+  {"key": "right_shoulder", "label": "Right shoulder"}
+]
@@ -0,0 +1,9 @@
+# Packaging only; does not activate contract loading or deploy a pose worker.
+workflowConfiguration:
+  enabled: true
+  existingConfigMap: custom-workflow-configuration
+  items:
+    - key: pose.yaml
+      path: workflow-contracts/pose.yaml
+    - key: pose-keypoints.json
+      path: catalogs/pose-keypoints.json
@@ -0,0 +1,27 @@
+# yaml-language-server: $schema=../../schemas/workflow-contract.schema.json
+# Hypothetical custom worker output; not an installed stage or universal pose schema.
+schemaVersion: 1
+stage: pose
+contractVersion: 1
+fields:
+  - id: keypoint
+    label: Keypoint
+    path: people.*.keypoints.*.name
+    type: string
+    operators: [in]
+    choices:
+      file: ../catalogs/pose-keypoints.json
+  - id: posture
+    label: Posture
+    path: people.*.posture
+    type: string
+    operators: [in]
+    choices:
+      values: [standing, sitting, lying]
+  - id: confidence
+    label: Keypoint confidence
+    path: people.*.keypoints.*.confidence
+    type: number
+    operators: [gt, gte, lt, lte]
+    minimum: 0
+    maximum: 1
@@ -0,0 +1,17 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Hub shared choice catalog v1",
+  "description": "Compatible with the existing classification JSON format. Keys must be unique; no references to other catalogs.",
+  "type": "array",
+  "minItems": 1,
+  "items": {
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["key", "label"],
+    "properties": {
+      "key": {"type": "string", "minLength": 1},
+      "label": {"type": "string", "minLength": 1},
+      "icon": {"type": "string", "minLength": 1}
+    }
+  }
+}
@@ -0,0 +1,142 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Hub workflow condition contract v1 (preparatory)",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "stage", "contractVersion", "fields"],
+  "properties": {
+    "schemaVersion": {"const": 1},
+    "stage": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]*$",
+      "description": "Stage type, not a node instance. start describes initial context."
+    },
+    "contractVersion": {"type": "integer", "minimum": 1},
+    "fields": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"$ref": "#/definitions/field"}
+    },
+    "controls": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "label"],
+        "properties": {
+          "id": {"enum": ["weeklySchedule", "conditions"]},
+          "label": {"type": "string", "minLength": 1}
+        }
+      }
+    }
+  },
+  "definitions": {
+    "choices": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "source": {
+          "type": "string",
+          "description": "Built-in authorized project-resource resolver; not a database path.",
+          "oneOf": [
+            {"const": "project.devices", "description": "Device keys as values, device names as labels."},
+            {"const": "project.sites", "description": "Site IDs as values, site names as labels."},
+            {"const": "project.groups", "description": "Group IDs as values, group names as labels."}
+          ]
+        },
+        "file": {
+          "type": "string",
+          "pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$",
+          "description": "Direct shared catalog file relative to the contract; no URLs or nested references."
+        },
+        "values": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"type": ["string", "number", "boolean"]}
+        }
+      },
+      "oneOf": [
+        {"required": ["source"]},
+        {"required": ["file"]},
+        {"required": ["values"]}
+      ]
+    },
+    "field": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "label", "path", "type", "operators"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[A-Za-z][A-Za-z0-9_-]*$",
+          "description": "Stable identifier, unique within this contract."
+        },
+        "label": {"type": "string", "minLength": 1},
+        "path": {
+          "type": "string",
+          "pattern": "^[A-Za-z_][A-Za-z0-9_-]*(\\.(\\*|[A-Za-z_][A-Za-z0-9_-]*))*$",
+          "description": "Safe Start-context path, or relative path inside this node instance's output. Wildcards select scalar candidates."
+        },
+        "type": {"enum": ["string", "integer", "number", "boolean"]},
+        "operators": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches", "gt", "gte", "lt", "lte"]}
+        },
+        "optional": {
+          "type": "boolean",
+          "default": false,
+          "description": "Field may be absent even when the node completes; branch availability is determined separately."
+        },
+        "minimum": {"type": "number"},
+        "maximum": {"type": "number"},
+        "choices": {"$ref": "#/definitions/choices"}
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"type": {"const": "string"}}},
+          "then": {
+            "properties": {
+              "operators": {"items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches"]}},
+              "choices": {"properties": {"values": {"items": {"type": "string"}}}}
+            },
+            "not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "boolean"}}},
+          "then": {
+            "properties": {
+              "operators": {"items": {"enum": ["eq", "ne", "in", "exists"]}},
+              "choices": {"properties": {"values": {"items": {"type": "boolean"}}}}
+            },
+            "not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
+          }
+        },
+        {
+          "if": {"properties": {"type": {"enum": ["integer", "number"]}}},
+          "then": {
+            "properties": {
+              "operators": {"items": {"enum": ["eq", "ne", "in", "exists", "gt", "gte", "lt", "lte"]}},
+              "choices": {"properties": {"values": {"items": {"type": "number"}}}}
+            }
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "integer"}}},
+          "then": {"properties": {"choices": {"properties": {"values": {"items": {"type": "integer"}}}}}}
+        },
+        {
+          "if": {"properties": {"type": {"enum": ["integer", "number", "boolean"]}}},
+          "then": {
+            "properties": {
+              "choices": {"not": {"anyOf": [{"required": ["file"]}, {"required": ["source"]}]}}
+            }
+          }
+        }
+      ]
+    }
+  }
+}
@@ -0,0 +1,41 @@
+{{/* Keep the legacy endpoint and the preparatory bundle on the same chart data. */}}
+{{- define "hub.classificationCatalog" -}}
+{{- if kindIs "invalid" .Values.classificationCatalog -}}
+{{- .Files.Get "configuration/catalogs/classifications.json" | mustFromJson | toPrettyJson -}}
+{{- else if kindIs "slice" .Values.classificationCatalog -}}
+{{- .Values.classificationCatalog | toPrettyJson -}}
+{{- else -}}
+{{- fail "classificationCatalog must be null (bundled defaults) or a list" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "hub.workflowConfiguration.validate" -}}
+{{- $config := .Values.workflowConfiguration | default dict -}}
+{{- if $config.enabled -}}
+{{- if $config.existingConfigMap -}}
+{{- if not $config.items -}}
+{{- fail "workflowConfiguration.items is required with existingConfigMap" -}}
+{{- end -}}
+{{- $paths := dict -}}
+{{- range $config.items -}}
+{{- if not (regexMatch "^[A-Za-z0-9._-]+$" .key) -}}
+{{- fail "workflowConfiguration.items keys must be valid ConfigMap keys" -}}
+{{- end -}}
+{{- if or (not (regexMatch "^(workflow-contracts|catalogs)/[A-Za-z0-9._/-]+$" .path)) (ne (clean .path) .path) -}}
+{{- fail "workflowConfiguration.items paths must be normalized relative files under workflow-contracts/ or catalogs/" -}}
+{{- end -}}
+{{- if hasKey $paths .path -}}
+{{- fail (printf "duplicate workflowConfiguration.items path %q" .path) -}}
+{{- end -}}
+{{- $_ := set $paths .path true -}}
+{{- end -}}
+{{- else -}}
+{{- if $config.items -}}
+{{- fail "workflowConfiguration.items requires existingConfigMap" -}}
+{{- end -}}
+{{- if not .Values.classificationCatalogEnabled -}}
+{{- fail "bundled workflowConfiguration requires classificationCatalogEnabled; use an existingConfigMap for a custom bundle" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
@@ -0,0 +1,10 @@
+{{- if .Values.classificationCatalogEnabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: classification-catalog
+  namespace: {{ .Release.Namespace }}
+data:
+  classifications.json: |-
+    {{- include "hub.classificationCatalog" . | nindent 4 }}
+{{- end }}
@@ -0,0 +1,51 @@
+{{- if .Values.audit.enabled -}}
+{{- $destinations := list -}}
+{{- $destinationIDs := dict -}}
+{{- range $index, $destination := .Values.kerberoshub.audit.destinations -}}
+  {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
+  {{- if not (regexMatch "^[a-z][a-z0-9-]{0,62}$" $id) -}}
+    {{- fail (printf "audit destination id %q must match ^[a-z][a-z0-9-]{0,62}$" $id) -}}
+  {{- end -}}
+  {{- if hasKey $destinationIDs $id -}}
+    {{- fail (printf "duplicate audit destination id %q" $id) -}}
+  {{- end -}}
+  {{- $_ := set $destinationIDs $id true -}}
+  {{- $url := required (printf "url is required for audit destination %s" $id) $destination.url -}}
+  {{- $entry := dict
+      "id" $id
+      "type" (default "webhook" $destination.type)
+      "enabled" $destination.enabled
+      "url" $url
+      "timeoutSeconds" (default 10 $destination.timeoutSeconds)
+      "batchSize" (default 100 $destination.batchSize)
+      "maxAttempts" (default 10 $destination.maxAttempts)
+      "startAt" (default "latest" $destination.startAt)
+      "headers" (default dict $destination.headers)
+      "filters" (default dict $destination.filters) -}}
+  {{- $secretRoot := printf "/var/run/secrets/audit-destinations/%s" $id -}}
+  {{- $bearer := default dict $destination.bearerTokenSecret -}}
+  {{- if gt (len $bearer) 0 -}}
+    {{- $secretName := required (printf "bearerTokenSecret.name is required for destination %s" $id) $bearer.name -}}
+    {{- $secretKey := default "token" $bearer.key -}}
+    {{- $_ := set $entry "bearerTokenFile" (printf "%s/bearer-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName $secretKey) | trunc 12)) -}}
+  {{- end -}}
+  {{- $headerFiles := dict -}}
+  {{- range $headerName, $secret := (default dict $destination.secretHeaders) -}}
+    {{- $secretName := required (printf "secretName is required for destination %s header %s" $id $headerName) $secret.secretName -}}
+    {{- $secretKey := required (printf "secretKey is required for destination %s header %s" $id $headerName) $secret.secretKey -}}
+    {{- $_ := set $headerFiles $headerName (printf "%s/header-%s" $secretRoot (sha256sum (printf "%s:%s:%s" $headerName $secretName $secretKey) | trunc 12)) -}}
+  {{- end -}}
+  {{- if gt (len $headerFiles) 0 -}}
+    {{- $_ := set $entry "headerFiles" $headerFiles -}}
+  {{- end -}}
+  {{- $destinations = append $destinations $entry -}}
+{{- end -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+data:
+  destinations.json: |
+    {{ dict "version" 1 "destinations" $destinations | toPrettyJson | nindent 4 }}
+{{- end }}
@@ -0,0 +1,12 @@
+{{- include "hub.workflowConfiguration.validate" . -}}
+{{- $config := .Values.workflowConfiguration | default dict -}}
+{{- if and $config.enabled (not $config.existingConfigMap) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
+  namespace: {{ .Release.Namespace }}
+data:
+  start.yaml: |-
+    {{- .Files.Get "configuration/workflow-contracts/start.yaml" | nindent 4 }}
+{{- end }}
@@ -1,4 +1,5 @@
 {{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+{{- $workflowConfiguration := .Values.workflowConfiguration | default dict -}}
 {{- if .Values.kerberoshub.api.serviceEnabled }}
 apiVersion: v1
 kind: Service
@@ -120,6 +121,12 @@ spec:
    metadata:
      annotations:
        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        {{- if .Values.classificationCatalogEnabled }}
+        checksum/classification-catalog: {{ include (print $.Template.BasePath "/configmap-classification-catalog.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if and $workflowConfiguration.enabled (not $workflowConfiguration.existingConfigMap) }}
+        checksum/workflow-configuration: {{ include (print $.Template.BasePath "/configmap-workflow-configuration.yaml") . | sha256sum }}
+        {{- end }}
      labels:
        app: hub-api
    spec:
@@ -132,8 +139,36 @@ spec:
      {{- end }}
      {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      {{- $classificationCatalogEnabled := .Values.classificationCatalogEnabled }}
+      {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- if $workflowConfiguration.enabled }}
+        - name: workflow-configuration
+          {{- if $workflowConfiguration.existingConfigMap }}
+          configMap:
+            name: {{ $workflowConfiguration.existingConfigMap | quote }}
+            items:
+              {{- toYaml $workflowConfiguration.items | nindent 14 }}
+          {{- else }}
+          projected:
+            sources:
+              - configMap:
+                  name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
+                  items:
+                    - key: start.yaml
+                      path: workflow-contracts/start.yaml
+              - configMap:
+                  name: classification-catalog
+                  items:
+                    - key: classifications.json
+                      path: catalogs/classifications.json
+          {{- end }}
+      {{- end }}
+      {{- if $classificationCatalogEnabled }}
+        - name: classification-catalog
+          configMap:
+            name: classification-catalog
+      {{- end }}
      {{- with .Values.kerberoshub.api.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
@@ -161,8 +196,18 @@ spec:
          ports:
            - containerPort: 80
              name: http
-          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
          volumeMounts:
+          {{- if $workflowConfiguration.enabled }}
+            - name: workflow-configuration
+              mountPath: /etc/kerberos/configuration
+              readOnly: true
+          {{- end }}
+          {{- if $classificationCatalogEnabled }}
+            - name: classification-catalog
+              mountPath: /etc/kerberos/classifications
+              readOnly: true
+          {{- end }}
          {{- with .Values.kerberoshub.api.volumeMounts}}
            {{- toYaml . | nindent 12 }}
          {{- end }}
@@ -180,6 +225,10 @@ spec:
            - configMapRef:
                name: mongodb-config
          env:
+            {{- if $classificationCatalogEnabled }}
+            - name: CLASSIFICATION_CATALOG_FILE
+              value: /etc/kerberos/classifications/classifications.json
+            {{- end }}
            - name: ENVIRONMENT
              value: "{{ .Values.environment }}"
            - name: READ_ONLY
@@ -295,6 +344,9 @@ spec:
            # workflows (for example the one-stage case redaction modal flow).
            - name: WORKFLOW_STAGE_QUEUES
              value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
+            # Stages tenants may place in the workflow editor (see workflows.editorStages).
+            - name: WORKFLOW_EDITOR_STAGES
+              value: {{ .Values.kerberoshub.workflows.editorStages | default list | toJson | quote }}

            # Stripe for billing
            - name: STRIPE_KEY
@@ -356,6 +408,14 @@ spec:
              value: "{{ .Values.rabbitmq.username }}"
            - name: RABBITMQ_PASSWORD
              value: "{{ .Values.rabbitmq.password }}"
+            - name: AUDIT_ENABLED
+              value: {{ and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled | quote }}
+            {{- if and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled }}
+            - name: AUDIT_QUEUE
+              value: {{ .Values.audit.intake.queue | quote }}
+            - name: AUDIT_DEADLETTER_QUEUE
+              value: {{ .Values.audit.intake.deadletterQueue | quote }}
+            {{- end }}

            # Slack notifications (this will send events/logs to a specific channel).
            - name: SLACK_ENABLED
@@ -444,11 +504,11 @@ spec:
            - name: VAULT_SPRITE_SECRET_KEY
              value: "{{ .Values.kerberosvault.sprite.secretKey }}"
            - name: VAULT_SPRITE_INTERVAL
-              value: "{{ .Values.kerberosvault.sprite.interval }}"
+              value: "{{ .Values.kerberospipeline.sprite.interval }}"
            - name: VAULT_SPRITE_WIDTH
-              value: "{{ .Values.kerberosvault.sprite.width }}"
+              value: "{{ .Values.kerberospipeline.sprite.width }}"
            - name: VAULT_SPRITE_HEIGHT
-              value: "{{ .Values.kerberosvault.sprite.height }}"
+              value: "{{ .Values.kerberospipeline.sprite.height }}"
            {{- if .Values.kerberoshub.extraEnv }}
            {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
            {{- end }}
@@ -0,0 +1,18 @@
+{{- if and .Values.audit.enabled .Values.kerberoshub.audit.serviceMonitor.enabled -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: hub-audit-servicemonitor
+  namespace: {{ .Release.Namespace }}
+  labels:
+    service: hub-audit
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      service: hub-audit
+  endpoints:
+    - port: metrics
+      interval: {{ .Values.kerberoshub.audit.serviceMonitor.interval }}
+      path: /metrics
+{{- end }}
@@ -0,0 +1,166 @@
+{{- if .Values.audit.enabled -}}
+{{- if ne (upper .Values.queueProvider) "RABBITMQ" -}}
+{{- fail "kerberoshub.audit currently requires queueProvider=RABBITMQ" -}}
+{{- end -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.kerberoshub.audit.replicas }}
+  selector:
+    matchLabels:
+      app: hub-audit
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      annotations:
+        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+      labels:
+        app: hub-audit
+    spec:
+      terminationGracePeriodSeconds: {{ .Values.kerberoshub.audit.terminationGracePeriodSeconds }}
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      volumes:
+        - name: destinations
+          configMap:
+            name: hub-audit
+          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+      {{- $bearer := default dict $destination.bearerTokenSecret }}
+      {{- $secretHeaders := default dict $destination.secretHeaders }}
+      {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
+        - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
+          projected:
+            sources:
+            {{- if gt (len $bearer) 0 }}
+              - secret:
+                  name: {{ required (printf "bearerTokenSecret.name is required for destination %s" $destination.id) $bearer.name | quote }}
+                  items:
+                    - key: {{ default "token" $bearer.key | quote }}
+                      path: bearer-{{ sha256sum (printf "%s:%s" $bearer.name (default "token" $bearer.key)) | trunc 12 }}
+            {{- end }}
+            {{- range $headerName, $secret := $secretHeaders }}
+              - secret:
+                  name: {{ required (printf "secretName is required for destination %s header %s" $destination.id $headerName) $secret.secretName | quote }}
+                  items:
+                    - key: {{ required (printf "secretKey is required for destination %s header %s" $destination.id $headerName) $secret.secretKey | quote }}
+                      path: header-{{ sha256sum (printf "%s:%s:%s" $headerName $secret.secretName $secret.secretKey) | trunc 12 }}
+            {{- end }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.audit.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberoshub.audit.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: hub-audit
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.audit.repository }}:{{ .Values.kerberoshub.audit.tag }}"
+          imagePullPolicy: {{ .Values.kerberoshub.audit.pullPolicy }}
+          {{- with .Values.kerberoshub.audit.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: metrics
+              containerPort: 2112
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+          volumeMounts:
+            - name: destinations
+              mountPath: /etc/hub-audit
+              readOnly: true
+          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+          {{- $bearer := default dict $destination.bearerTokenSecret }}
+          {{- $secretHeaders := default dict $destination.secretHeaders }}
+          {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
+            - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
+              mountPath: /var/run/secrets/audit-destinations/{{ $destination.id }}
+              readOnly: true
+          {{- end }}
+          {{- end }}
+          {{- with .Values.kerberoshub.audit.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
+          env:
+            - name: RABBITMQ_HOST
+              value: {{ .Values.rabbitmq.host | quote }}
+            - name: RABBITMQ_EXCHANGE
+              value: {{ .Values.rabbitmq.exchange | quote }}
+            - name: RABBITMQ_USERNAME
+              value: {{ .Values.rabbitmq.username | quote }}
+            - name: RABBITMQ_PASSWORD
+              value: {{ .Values.rabbitmq.password | quote }}
+            - name: AUDIT_QUEUE
+              value: {{ .Values.audit.intake.queue | quote }}
+            - name: AUDIT_DEADLETTER_QUEUE
+              value: {{ .Values.audit.intake.deadletterQueue | quote }}
+            - name: AUDIT_MAX_RETRIES
+              value: {{ .Values.audit.intake.maxRetries | quote }}
+            - name: AUDIT_PREFETCH_COUNT
+              value: {{ .Values.audit.intake.prefetchCount | quote }}
+            - name: AUDIT_PERSIST_TIMEOUT
+              value: {{ .Values.audit.intake.persistTimeout | quote }}
+            - name: DISPATCH_INTERVAL
+              value: {{ .Values.kerberoshub.audit.dispatchInterval | quote }}
+            - name: LEASE_DURATION
+              value: {{ .Values.kerberoshub.audit.leaseDuration | quote }}
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          {{- with .Values.kerberoshub.audit.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.kerberoshub.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: hub-audit
+    service: hub-audit
+spec:
+  ports:
+    - name: metrics
+      port: 2112
+      targetPort: metrics
+      protocol: TCP
+  selector:
+    app: hub-audit
+{{- end }}
@@ -108,6 +108,8 @@ spec:
              value: "{{ .Values.kerberoshub.cleanup.globalPassDeleteBudget }}"
            - name: DEFAULT_TASK_RETENTION_DAYS
              value: "{{ .Values.kerberoshub.cleanup.defaultTaskRetentionDays }}"
+            - name: AUDIT_EVENT_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.cleanup.auditEventRetentionDays }}"
          {{- if .Values.kerberoshub.extraEnv }}
          {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
          {{- end }}
@@ -193,6 +193,10 @@ spec:
        - name: GOOGLEMAPS_KEY
          value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"

+        # features > chart
+        - name: CHART_COLORS
+          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
+
        # Zendesk for support
        - name: ZENDESK_URL
          value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"
@@ -229,6 +233,14 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
        - name: FEATURE_WORKFLOWS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_AUDIT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
+        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
+        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
+        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
        - name: FEATURE_ORGANISATIONS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
@@ -267,6 +279,8 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
        - name: FEATURE_REMOTE_RECORDING_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
+        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
        - name: MOQ_RELAY_URL
          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
        - name: MOQ_BROADCAST_PREFIX
@@ -363,6 +377,12 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
+          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
        - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
        - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
@@ -312,6 +312,14 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
        - name: FEATURE_WORKFLOWS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_AUDIT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
+        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
+        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
+        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
        - name: FEATURE_ORGANISATIONS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
@@ -352,6 +360,8 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
        - name: FEATURE_REMOTE_RECORDING_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
+        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
        - name: MOQ_RELAY_URL
          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
        - name: MOQ_BROADCAST_PREFIX
@@ -419,6 +429,8 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"

        # features > chart
+        - name: CHART_COLORS
+          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
        - name: COLOR_CHART_SELECTION_FILL
          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionFill }}"
        - name: COLOR_CHART_SELECTION_STROKE
@@ -457,6 +469,12 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
+          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
        - name: FEATURE_MEDIA_FILTER_DEFAULT_VIEW
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.defaultView }}"
        - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
@@ -1,3 +1,28 @@
+{{/*
+Reserve every effective identity, including disabled definitions, so enabling a
+workflow later cannot silently alias another workflow's runs or references.
+*/}}
+{{- define "kerberoshub.workflows.validateDefinitions" -}}
+{{- $identities := dict -}}
+{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
+{{- $id := sha256sum $name | trunc 24 -}}
+{{- if hasKey $wf "id" -}}
+{{- $invalid := printf "kerberoshub.workflows.definitions[%q].id must be a non-zero 24-character hexadecimal string (Mongo ObjectID); omit id for name-derived compatibility" $name -}}
+{{- if not (kindIs "string" $wf.id) -}}
+{{- fail $invalid -}}
+{{- end -}}
+{{- if or (not (regexMatch "^[0-9a-fA-F]{24}$" $wf.id)) (eq $wf.id "000000000000000000000000") -}}
+{{- fail $invalid -}}
+{{- end -}}
+{{- $id = lower $wf.id -}}
+{{- end -}}
+{{- if hasKey $identities $id -}}
+{{- fail (printf "kerberoshub.workflows.definitions: duplicate effective workflow id %q for %q and %q (including disabled definitions)" $id (index $identities $id) $name) -}}
+{{- end -}}
+{{- $_ := set $identities $id $name -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
 JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
@@ -7,9 +32,9 @@ opens its own run and dispatches only its own stages. Organisation-scoped
 database workflows are discovered separately at runtime.

 Each enabled definition contributes one workflow object:
-  name      the map key (the workflow's human-readable name; also its identity —
-            the engine derives a stable id from it when the definition carries
-            no explicit id).
+  id        optional explicit stable identity, normalized to lowercase. Omitted
+            for legacy definitions; their effective id is SHA256(name)[:24].
+  name      the map key (mutable display name when an explicit id is supplied).
  enabled   always true here (a disabled definition is skipped entirely).
  source    "config" — provenance marking a Helm-defined, deployment-global,
            ops-managed workflow (read-only in the API, no owning organisation).
@@ -28,6 +53,7 @@ Each enabled definition contributes one workflow object:
              needsMode  conditional stages: "any" (default) | "all".
 */}}
 {{- define "kerberoshub.workflows.workflowDefinitions" -}}
+{{- include "kerberoshub.workflows.validateDefinitions" . -}}
 {{- $defs := list -}}
 {{- $services := .Values.kerberoshub.services | default dict -}}
 {{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
@@ -43,6 +69,7 @@ Each enabled definition contributes one workflow object:
 {{- $stages = append $stages $entry -}}
 {{- end -}}
 {{- $def := dict "name" $name "enabled" true "source" "config" "triggers" (default (list (dict "type" "automatic")) $wf.triggers) "stages" $stages -}}
+{{- if hasKey $wf "id" }}{{- $_ := set $def "id" (lower $wf.id) -}}{{- end }}
 {{- $defs = append $defs $def -}}
 {{- end -}}
 {{- end -}}
@@ -59,9 +86,11 @@ use this only to embed the same queue on a synthetic stage.
 {{- define "kerberoshub.workflows.stageQueues" -}}
 {{- $queues := dict -}}
 {{- range $operation, $service := (.Values.kerberoshub.services | default dict) -}}
+{{- if ne $operation "workflows" -}}
 {{- with $service.queue -}}
 {{- $_ := set $queues $operation . -}}
 {{- end -}}
 {{- end -}}
+{{- end -}}
 {{- $queues | toJson -}}
 {{- end -}}
@@ -18,6 +18,9 @@
  redaction) declares its destination provider with the named field
  services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
  read-only stage omits it and gets no provider env.
+
+  Worker-specific settings go in services.<name>.env (plain values) and
+  services.<name>.secretEnv (references to keys in an existing Secret).
 */ -}}
 {{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
 {{- $root := . -}}
@@ -122,6 +125,19 @@ spec:
        {{- range $key, $value := $svc.env }}
        - name: {{ $key }}
          value: {{ $value | quote }}
+        {{- end }}        {{- with $svc.secretEnv }}
+
+        # Per-stage secret env. Each key under services.<name>.secretEnv maps a
+        # container env var to a key in an existing Kubernetes Secret
+        # ({name, key}), so credentials such as a model API key stay out of
+        # values. The Secret must exist in the release namespace.
+        {{- range $key, $ref := . }}
+        - name: {{ $key }}
+          valueFrom:
+            secretKeyRef:
+              name: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.name is required" $name $key) $ref.name | quote }}
+              key: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.key is required" $name $key) $ref.key | quote }}
+        {{- end }}
        {{- end }}
 ---
 apiVersion: v1
@@ -1,3 +1,4 @@
+{{- include "kerberoshub.workflows.validateDefinitions" . -}}
 {{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -75,12 +76,15 @@ spec:
        # under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
        # Definitions are the engine's boot-loaded config source and deployment
        # stage catalog. Organisation-scoped database workflows are read per
-        # recording; an in-cluster engine still requires at least one config
-        # definition so an empty catalog cannot silently drop traffic.
+        # recording; an in-cluster engine refuses to start only when both the
+        # config definitions and the stage-queue catalog below are empty.
        - name: WORKFLOWS_QUEUE
          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
        - name: WORKFLOW_DEFINITIONS
          value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
+        # Operation→queue catalog so DB workflows reach workers no config workflow references.
+        - name: WORKFLOW_STAGE_QUEUES
+          value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}

        # RabbitMQ settings
        - name: RABBITMQ_HOST
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
  name: pipe-analysis
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.analysis.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  replicas: {{ .Values.kerberospipeline.analysis.replicas }}
  selector:
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
  name: pipe-counting
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.counting.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  replicas: {{ .Values.kerberospipeline.counting.replicas }}
  selector:
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
  name: pipe-dominantcolor
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.dominantColor.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  replicas: {{ .Values.kerberospipeline.dominantColor.replicas }}
  selector:
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
  name: pipe-event
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.event.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  replicas: {{ .Values.kerberospipeline.event.replicas }}
  selector:
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
  name: pipe-monitor
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.monitor.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  replicas: {{ .Values.kerberospipeline.monitor.replicas }}
  selector:
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
  name: pipe-notify
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.notify.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  replicas: {{ .Values.kerberospipeline.notify.replicas }}
  selector:
@@ -66,6 +70,8 @@ spec:
        env:
        - name: LOG_LEVEL
          value: "{{ .Values.kerberospipeline.notify.logLevel }}"
+        - name: NOTIFICATION_EXPIRY_MINUTES
+          value: "{{ .Values.kerberospipeline.notify.notificationExpiryMinutes }}"
        # Queue
        - name: QUEUE_SYSTEM
          value: "{{ .Values.queueProvider }}"
@@ -91,6 +97,14 @@ spec:
          value: "{{ .Values.rabbitmq.username }}"
        - name: RABBITMQ_PASSWORD
          value: "{{ .Values.rabbitmq.password }}"
+        - name: AUDIT_ENABLED
+          value: {{ and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled | quote }}
+        {{- if and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled }}
+        - name: AUDIT_QUEUE
+          value: {{ .Values.audit.intake.queue | quote }}
+        - name: AUDIT_DEADLETTER_QUEUE
+          value: {{ .Values.audit.intake.deadletterQueue | quote }}
+        {{- end }}

        # Kerberos Vault
        - name: STORAGE_URI
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
  name: pipe-sequence
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.sequence.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  replicas: {{ .Values.kerberospipeline.sequence.replicas }}
  selector:
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
  name: pipe-sprite
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.sprite.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  replicas: {{ .Values.kerberospipeline.sprite.replicas }}
  selector:
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
  name: pipe-throttler
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.throttler.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  replicas: {{ .Values.kerberospipeline.throttler.replicas }}
  selector:
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
  name: pipe-thumbnail
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.thumbnail.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  replicas: {{ .Values.kerberospipeline.thumbnail.replicas }}
  selector:
@@ -1,4 +1,4 @@
-{{- if eq .Values.mode "all" -}}
+{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -0,0 +1,32 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "classificationCatalog": {"type": ["array", "null"]},
+    "workflowConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["enabled", "existingConfigMap", "items"],
+      "properties": {
+        "enabled": {"type": "boolean"},
+        "existingConfigMap": {
+          "type": "string",
+          "maxLength": 253,
+          "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+        },
+        "items": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["key", "path"],
+            "properties": {
+              "key": {"type": "string", "pattern": "^[A-Za-z0-9._-]+$"},
+              "path": {"type": "string", "pattern": "^(workflow-contracts|catalogs)/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.(yaml|json)$"}
+            }
+          }
+        }
+      }
+    }
+  }
+}
@@ -69,6 +69,25 @@ mongodb:
    caFileName: ""
    mountPath: "/etc/mongodb/tls"
    insecureSkipVerify: false
+
+# Classifications supported by Hub filters, alerts, markers, and other
+# downstream processing. Classifier output keys must match these values.
+# Disable this to use the legacy classification catalog stored in MongoDB.
+classificationCatalogEnabled: true
+# classificationCatalog is optional and omitted by default, which uses
+# configuration/catalogs/classifications.json. Set it to a list to override.
+# Explicit null also uses defaults; [] retains the API fallback behavior.
+
+# Preparatory configuration packaging only: the API does not yet load workflow
+# contracts. Enabling this mounts files but does not activate a new editor/runtime.
+workflowConfiguration:
+  enabled: false
+  # Empty uses the bundled Start contract and effective classification catalog.
+  # Otherwise mount this existing ConfigMap instead; it must be in this namespace.
+  existingConfigMap: ""
+  # Required only with existingConfigMap: map ConfigMap keys to relative files
+  # under /etc/kerberos/configuration (workflow-contracts/... or catalogs/...).
+  items: []
 ###################################################
 # MQTT configuration (bi-directional communication)
 ###################################################
@@ -102,6 +121,16 @@ rabbitmq:
  username: "yourusername"
  password: "yourpassword"
  exchange: ""
+# Shared audit transport. The master switch controls the consumer and all
+# producers; individual services may opt out through their own audit setting.
+audit:
+  enabled: false
+  intake:
+    queue: "hub-audit-events"
+    deadletterQueue: "hub-audit-dead-letter"
+    maxRetries: 10
+    prefetchCount: 20
+    persistTimeout: "10s"
 # If you already have a Kafka cluster you might use this instead of RabbitMQ.
 kafka:
  broker: "kafka1.yourdomain.com:9094" # can be internal dns name or external
@@ -242,6 +271,8 @@ kerberoshub:
    pullPolicy: IfNotPresent
    tag: "v1.9.51"
    replicas: 2
+    audit:
+      enabled: true
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Set to false to skip rendering the hub-api Service (e.g. when an
    # external/shared Service is managed elsewhere).
@@ -477,6 +508,9 @@ kerberoshub:
      # Workflows allow you to define automated processes and actions in the front-end.
      workflows:
        enabled: "false" # Enable or disable workflows feature 'true' or 'false'
+      # Audit events are visible to owner/admin users when enabled.
+      audit:
+        enabled: "true" # Enable or disable the Audit events page and navigation link 'true' or 'false'
      # Organisation controls remain visible as a read-only current organisation when switching is disabled.
      organisations:
        enabled: "" # Enable or disable the organisation feature family, including projects; when empty, child groups apply independently
@@ -505,7 +539,8 @@ kerberoshub:
        liveStreamMode: "webrtc" # Transport backing the LIVE (HD) mode: 'webrtc' (default), 'hls' or 'moq'
        hlsEnabled: "true" # Offer HLS as a selectable LIVE transport 'true' or 'false'. When 'false' the HLS option is removed from the front-end and streams use webrtc
        moqEnabled: "false" # Offer MoQ as a selectable LIVE transport 'true' or 'false'
-        remoteRecordingEnabled: "true" # Show the manual REC control in live views
+        remoteRecordingEnabled: "true" # Show the manual REC control and recording-state overlay in live views
+        deviceStatusEnabled: "true" # Show connectivity and recent-motion status in live view tile headers
        moqRelayUrl: "https://relay.uug.ai/anon" # WebTransport URL of the MoQ relay
        moqBroadcastPrefix: "devices" # Prefix used to build devices/<deviceKey>/live.hang broadcast names
        paginationMode: "scroll" # Pagination mode in live view 'scroll', 'numbered' or 'maxStreams'
@@ -514,6 +549,11 @@ kerberoshub:
      # Device page
      devices:
        hideAgent: "false" # Hide the 'add agent' button in the front-end
+        analyticsEnabled: "true" # Enable or disable the Analytics tab on device detail pages 'true' or 'false'
+        developerToolsEnabled: "true" # Enable or disable device logs and terminal access 'true' or 'false'
+      # Dashboard page
+      dashboard:
+        sitesFullscreenEnabled: "true" # Enable or disable the fullscreen Sites map 'true' or 'false'
      # Media page
      media:
        filter:
@@ -537,6 +577,11 @@ kerberoshub:
            enabled: "true" # Enable or disable category filter in media 'true' or 'false'
          markers:
            enabled: "true" # Enable or disable markers filter in media 'true' or 'false'
+          markerOptionsByDate:
+            enabled: "false" # Limit marker-related filter options to the selected recording day
+          markerCategoryPriority:
+            enabled: "false" # Order marker options from configured categories before other markers
+            categories: [] # Ordered marker category names, for example ["security", "traffic"]
          events:
            enabled: "true" # Enable or disable events filter in media 'true' or 'false'
          tags:
@@ -544,6 +589,13 @@ kerberoshub:
          defaultView: "timeline" # Default view for media page 'timeline' or 'grid'
      # Chart feature
      chart:
+        colors:
+          - "#84569f"
+          - "#3ba7ff"
+          - "#ff5c8a"
+          - "#4ad991"
+          - "#ffb84d"
+          - "#ff7043"
        colorChartSelectionFill: "rgba(132, 86, 159, 0.07)"
        colorChartSelectionStroke: "rgba(132, 86, 159, 0.4)"
        colorChartGridStroke: "rgba(0, 106, 255, 0.18)"
@@ -643,10 +695,59 @@ kerberoshub:
    # Tasks with `legal_hold=true` are never deleted. Must match the value
    # used by `kerberoshub.api.defaultTaskRetentionDays`.
    defaultTaskRetentionDays: "0"
+    # Deployment-wide retention for audit events. This is independent from
+    # recording plans, inactive-account cleanup, and the optional global pass.
+    # Set to "0" or a negative value to retain audit events indefinitely.
+    auditEventRetentionDays: "400"
    resources:
      requests:
        memory: 10Mi
        cpu: 10m
+  # Dispatches canonical audit_events to one or more external webhook sinks.
+  # Credentials are always read from existing Secrets and never stored here.
+  audit:
+    repository: ghcr.io/uug-ai/hub-audit
+    pullPolicy: IfNotPresent
+    tag: "v1.0.1"
+    replicas: 1
+    dispatchInterval: "5s"
+    leaseDuration: "2m"
+    terminationGracePeriodSeconds: 150 # Keep above leaseDuration so an in-flight cycle can finish.
+    topologySpreadConstraints: []
+    volumes: []
+    volumeMounts: []
+    extraEnv: []
+    serviceMonitor:
+      enabled: true
+      interval: 15s
+    destinations: []
+    # - id: primary-siem
+    #   type: webhook
+    #   enabled: true
+    #   url: https://siem.example.com/api/audit
+    #   timeoutSeconds: 10
+    #   batchSize: 100
+    #   maxAttempts: 10
+    #   startAt: latest # latest | beginning, applied only on first creation
+    #   headers:
+    #     X-Source: kerberos-hub
+    #   bearerTokenSecret:
+    #     name: audit-primary-siem
+    #     key: token
+    #   secretHeaders:
+    #     X-Api-Key:
+    #       secretName: audit-primary-siem
+    #       secretKey: api-key
+    #   filters:
+    #     organisationIds: []
+    #     projectIds: []
+    #     actions: []
+    #     categories: []
+    #     outcomes: [] # success | failure
+    # resources:
+    #   requests:
+    #     memory: 32Mi
+    #     cpu: 10m
  # hub-workflows is the standalone, queue-driven workflow engine. It consumes
  # pipeline events and dispatches the stages declared in its workflow
  # definitions, tracking each run in its own `workflow_runs` collection. It shares events
@@ -676,6 +777,13 @@ kerberoshub:
    # more config workflows.
    #
    # Each definition:
+    #   id        optional stable identity: quote a non-zero 24-hex Mongo ObjectID.
+    #             Recommended for new definitions; rendered lowercase. Omit for
+    #             legacy SHA256(exact map key)[:24] identity. Pin that old ID before
+    #             renaming an existing workflow; changing id creates a new identity.
+    #             Invalid IDs and duplicate effective IDs fail Helm rendering,
+    #             including disabled definitions. Name/version are not identity
+    #             when id is explicit. No per-project on/off overrides are provided.
    #   enabled   include this workflow (soft-delete toggle).
    #   source    always rendered as "config" (a Helm-defined, ops-managed,
    #             deployment-global workflow — read-only in the API).
@@ -700,19 +808,41 @@ kerberoshub:
    # kerberoshub.services.<operation> (deploy the objecttracking / loitering
    # workers below).
    definitions: {}
-    #tracking-workflow:
-    #  enabled: true
-    #  triggers:
-    #    - type: automatic
-    #  stages:
-    #    - operation: objecttracking
-    #      dispatch: always
-    #    - operation: loitering
-    #      dispatch: conditional
-    #      # Fire loitering once objecttracking has resolved — a readiness join
-    #      # (no condition ⇒ gate on the upstream's presence, not a value).
-    #      needs:
-    #        - operation: objecttracking
+    # Replace {} above with the indented examples below to enable them. Their IDs
+    # are pinned to the existing name-derived identities; do not regenerate them.
+    #  tracking-workflow:
+    #    id: "ec7e72bc4cedd32018e1f92a"
+    #    enabled: true
+    #    triggers:
+    #      - type: automatic
+    #    stages:
+    #      - operation: objecttracking
+    #        dispatch: always
+    #      - operation: loitering
+    #        dispatch: conditional
+    #        # Fire loitering once objecttracking has resolved — a readiness join
+    #        # (no condition ⇒ gate on the upstream's presence, not a value).
+    #        needs:
+    #          - operation: objecttracking
+    #  vlm-workflow:
+    #    id: "9e3666c56854b2befdb1f645"
+    #    # Describe every recording with the hub-vlm worker (services.vlm below).
+    #    enabled: true
+    #    triggers:
+    #      - type: automatic
+    #    stages:
+    #      - operation: vlm
+    #        dispatch: always
+    # Stages tenants may place on the workflow editor canvas next to the device
+    # node. Each entry needs a deployed worker (services.<operation>.queue);
+    # entries without one are hidden. Empty means the editor offers no stages.
+    editorStages: []
+    #  - operation: vlm
+    #    name: Describe recording
+    #    description: Summarise the recording with a vision language model.
+    #  - operation: forwarder
+    #    name: Forward to my system
+    #    description: Send the result to the external destination configured for the forwarder.
  # Workflow deployments. Every workflows-subsystem Deployment's image/tag/
  # replicas/resources/queue lives here in a single, uniform shape:
  #   - `workflows` is the engine itself (the orchestrator). It is deployed
@@ -723,6 +853,8 @@ kerberoshub:
  #     Deploying a worker (services.<name>.enabled) is independent from routing
  #     to it (a workflows.definitions stage of the same operation) — it runs only
  #     when its own `enabled` is true AND the workflows engine is enabled.
+  #     Worker-specific settings go in `env` (plain key/values) and `secretEnv`
+  #     (ENV_NAME: {name, key} of an existing Secret, for credentials).
  services:
    # hub-workflows — the workflows engine (orchestrator). Consumes the engine
    # queue, evaluates the boot-loaded config workflows (WORKFLOW_DEFINITIONS)
@@ -801,6 +933,43 @@ kerberoshub:
          #    requests:
          #      memory: 10Mi
          #      cpu: 10m
+          # ---------------------------------------------------------------------
+          # EXAMPLE stage worker (commented out) — hub-vlm (operation "vlm").
+          #
+          # Samples frames from the recording, describes them with an Azure OpenAI
+          # vision model and emits timeline markers plus a recording description.
+          # Route to it with a workflows.definitions stage `- operation: vlm`.
+          # See https://github.com/uug-ai/hub-vlm for every VLM_* / AZURE_OPENAI_*
+          # setting. Create the API key Secret first, e.g.
+          #   kubectl create secret generic hub-vlm-azure-openai \
+          #     --from-literal=apiKey=<azure-openai-api-key>
+          #vlm:
+          #  # Deploy the hub-vlm worker.
+          #  enabled: true
+          #  repository: ghcr.io/uug-ai/hub-vlm
+          #  pullPolicy: IfNotPresent
+          #  tag: "v1.0.0"
+          #  replicas: 1 # Number of pods for the worker.
+          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+          #  logLevel: "info" # possible values: trace, debug, info, warn, error
+          #  # Queue this worker consumes dispatched messages from (VLM_QUEUE).
+          #  queue: "hub-vlm-queue"
+          #  env:
+          #    AZURE_OPENAI_ENDPOINT: "https://<resource>.openai.azure.com"
+          #    AZURE_OPENAI_DEPLOYMENT: "gpt-5.4-mini" # Name of the model deployment.
+          #    AZURE_OPENAI_REASONING_EFFORT: "low" # none | minimal | low | medium | high
+          #    VLM_MAX_FRAMES: "8" # Frames sampled per recording (max 32).
+          #    VLM_FRAME_WIDTH: "1024" # Maximum frame width in pixels.
+          #    VLM_SET_DESCRIPTION: "true" # Write the summary to the recording description.
+          #  # The API key is read from an existing Secret, never from values.
+          #  secretEnv:
+          #    AZURE_OPENAI_API_KEY:
+          #      name: hub-vlm-azure-openai
+          #      key: apiKey
+          #  resources:
+          #    requests:
+          #      memory: 128Mi
+          #      cpu: 100m
  monitordevice:
    repository: ghcr.io/uug-ai/hub-monitor-device
    pullPolicy: IfNotPresent
@@ -857,10 +1026,11 @@ kerberoshub:
    #    cpu: 10m
  # This proxy is legacy for the old agent, will be migrated in the new Hub API.
  proxy:
+    enabled: false
    repository: uugai/hub-proxy
    pullPolicy: IfNotPresent
    tag: "v1.0.0"
-    replicas: 0 # Number of pods for the service. Set to 0 to disable.
+    replicas: 0 # Number of pods for the service when enabled.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
    #volumes:
@@ -880,6 +1050,10 @@ kerberoshub:
 # The pipeline is a critical component of Kerberos Hub, and should be monitored closely.
 kerberospipeline:
  event:
+    deploymentAnnotations: {}
+    # Example (opt-in Argo CD ordering):
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "10"
    repository: ghcr.io/uug-ai/hub-pipeline-event
    pullPolicy: IfNotPresent
    tag: "v1.3.1"
@@ -899,6 +1073,9 @@ kerberospipeline:
        cpu: 10m
  monitor:
    repository: ghcr.io/uug-ai/hub-pipeline-monitor
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "70"
    pullPolicy: IfNotPresent
    tag: "v1.3.13"
    replicas: 1 # Number of pods for the service.
@@ -917,6 +1094,9 @@ kerberospipeline:
        cpu: 10m
  sequence:
    repository: ghcr.io/uug-ai/hub-pipeline-sequence
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "60"
    pullPolicy: IfNotPresent
    tag: "v1.6.26"
    replicas: 1 # Number of pods for the service.
@@ -934,6 +1114,9 @@ kerberospipeline:
        cpu: 10m
  throttler:
    repository: uugai/hub-pipeline-throttler
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "30"
    pullPolicy: IfNotPresent
    tag: "v1.2.1"
    replicas: 1 # Number of pods for the service.
@@ -952,11 +1135,17 @@ kerberospipeline:
        cpu: 10m
  notify:
    repository: ghcr.io/uug-ai/hub-pipeline-notification
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "20"
    pullPolicy: IfNotPresent
    tag: "v1.3.18"
    replicas: 1 # Number of pods for the service.
+    audit:
+      enabled: true
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    logLevel: "info" # possible values: trace, debug, info, warn, error
+    notificationExpiryMinutes: "15" # Maximum recording age before notification delivery; 0 disables expiry.
    resources:
      requests:
        memory: 10Mi
@@ -989,6 +1178,9 @@ kerberospipeline:
        #      claimName: custom-layout-claim
  analysis:
    repository: ghcr.io/uug-ai/hub-pipeline-analysis
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "40"
    pullPolicy: IfNotPresent
    tag: "v1.8.5"
    replicas: 1 # Number of pods for the service.
@@ -1007,6 +1199,9 @@ kerberospipeline:
        cpu: 10m
  dominantColor:
    repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
    tag: "v2.0.3"
    replicas: 3 # Number of pods for the service.
@@ -1028,6 +1223,9 @@ kerberospipeline:
        cpu: 1000m
  thumbnail:
    repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
    tag: "v1.3.10"
    replicas: 2 # Number of pods for the service.
@@ -1054,6 +1252,9 @@ kerberospipeline:
        cpu: 1000m
  counting:
    repository: uugai/hub-pipeline-counting
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
    tag: "v2.0.0"
    replicas: 1 # Number of pods for the service.
@@ -1072,6 +1273,9 @@ kerberospipeline:
        cpu: 10m
  sprite:
    enabled: false # Enable or disable the sprite generation 'true' or 'false
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
    repository: ghcr.io/uug-ai/hub-pipeline-sprite
    pullPolicy: IfNotPresent
    tag: "v1.1.16"
@@ -1086,8 +1290,10 @@ kerberospipeline:
    #    mountPath: /data
    logLevel: "info" # possible values: trace, debug, info, warn,
    interval: "1" # Number of secondes between each thumbnail in the sprite
-    width: "240" # Should not be changed for the moment (hard coded in UI)
-    height: "135" # Should not be changed for the moment (hard coded in UI)
+    # Tile size in pixels. Preserve width:height = 16:9 (e.g. 240x135, 480x270, 640x360).
+    # Deploy dimension-aware sprite/analysis workers, Hub API and frontend before increasing.
+    width: "240"
+    height: "135"
    resources:
      requests:
        memory: 512Mi
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CHART_DIR="${1:-charts/hub}"
+
+# Supply per-service test overrides without requiring a separate values file.
+WAVE_FLAGS=()
+for setting in event:10 notify:20 throttler:30 analysis:40 thumbnail:50 sprite:50 dominantColor:50 counting:50 sequence:60 monitor:70; do
+  service="${setting%%:*}"
+  wave="${setting#*:}"
+  WAVE_FLAGS+=(--set-string "kerberospipeline.${service}.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=${wave}")
+done
+
+# Only read Deployment metadata, never pod-template or Service annotations.
+extract_waves() {
+  awk '
+    /^---/ { deployment=0; metadata=0; name="" }
+    /^kind: Deployment$/ { deployment=1 }
+    /^metadata:$/ { metadata=1; next }
+    /^[^ #]/ { metadata=0 }
+    deployment && metadata && /^  name:/ { name=$2 }
+    deployment && metadata && /^    argocd.argoproj.io\/sync-wave:/ {
+      value=$2
+      gsub(/"/, "", value)
+      print name, value
+    }
+  ' | sort
+}
+
+assert_waves() {
+  local rendered="$1"
+  local expected="$2"
+  local actual
+  actual="$(printf '%s\n' "$rendered" | extract_waves)"
+  if [[ "$actual" != "$expected" ]]; then
+    printf 'Unexpected Deployment waves:\n%s\nExpected:\n%s\n' "$actual" "$expected" >&2
+    return 1
+  fi
+  local all_count expected_count
+  all_count="$(printf '%s\n' "$rendered" | grep -c 'argocd.argoproj.io/sync-wave:' || true)"
+  expected_count="$(printf '%s\n' "$expected" | awk 'NF { count++ } END { print count+0 }')"
+  if [[ "$all_count" != "$expected_count" ]]; then
+    echo "Sync-wave annotation leaked outside expected Deployment metadata" >&2
+    return 1
+  fi
+}
+
+expected="$(printf '%s\n' \
+  'pipe-event 10' 'pipe-notify 20' 'pipe-throttler 30' 'pipe-analysis 40' \
+  'pipe-thumbnail 50' 'pipe-sprite 50' 'pipe-dominantcolor 50' \
+  'pipe-counting 50' 'pipe-sequence 60' 'pipe-monitor 70' | sort)"
+
+for mode in all pipeline; do
+  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  assert_waves "$default_render" ""
+  if printf '%s\n' "$default_render" | grep -q '^  annotations: null'; then
+    echo "Empty annotations must be omitted" >&2
+    exit 1
+  fi
+  configured_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  assert_waves "$configured_render" "$expected"
+  echo "OK ($mode): defaults opt out; per-service values assign all ten Deployment waves"
+done
+
+disabled_sprite="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=pipeline)"
+assert_waves "$disabled_sprite" "$(printf '%s\n' "$expected" | grep -v '^pipe-sprite ')"
+
+ui_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=ui --set kerberospipeline.sprite.enabled=true)"
+assert_waves "$ui_render" ""
+
+# Exercise zero/negative strings and an unrelated annotation on the same map.
+for wave in 0 -10; do
+  override="$(helm template hub "$CHART_DIR" --set mode=pipeline \
+    --set-string "kerberospipeline.event.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=$wave" \
+    --set-string 'kerberospipeline.event.deploymentAnnotations.example\.com/owner=queue-team')"
+  assert_waves "$override" "pipe-event $wave"
+  printf '%s\n' "$override" | grep -q "^    argocd.argoproj.io/sync-wave: \"$wave\"$"
+  printf '%s\n' "$override" | grep -q '^    example.com/owner: queue-team$'
+done
+
+echo "All pipeline Deployment annotation checks passed."
@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Chart-only checks; no cluster or application loader required.
+set -euo pipefail
+
+CHART_DIR="${1:-charts/hub}"
+
+assert_contains() {
+  if ! grep -Fq -- "$2" <<<"$1"; then
+    printf 'FAIL: expected rendered output to contain %s\n' "$2" >&2
+    exit 1
+  fi
+}
+
+assert_absent() {
+  if grep -Fq -- "$2" <<<"$1"; then
+    printf 'FAIL: unexpected rendered output contains %s\n' "$2" >&2
+    exit 1
+  fi
+}
+
+expect_failure() {
+  local expected="$1"
+  shift
+  local output
+  if output="$(helm template hub "$CHART_DIR" "$@" 2>&1)"; then
+    printf 'FAIL: render unexpectedly succeeded: %s\n' "$*" >&2
+    exit 1
+  fi
+  assert_contains "$output" "$expected"
+}
+
+if grep -q '^classificationCatalog:' "$CHART_DIR/values.yaml"; then
+  echo "FAIL: classificationCatalog should be omitted from default values" >&2
+  exit 1
+fi
+default_out="$(helm template hub "$CHART_DIR")"
+assert_absent "$default_out" "name: workflow-configuration"
+assert_absent "$default_out" "checksum/workflow-configuration"
+assert_contains "$default_out" "value: /etc/kerberos/classifications/classifications.json"
+legacy_out="$(helm template hub "$CHART_DIR" --set workflowConfiguration=null)"
+if [ "$default_out" != "$legacy_out" ]; then
+  echo "FAIL: absent workflowConfiguration changed the default render" >&2
+  exit 1
+fi
+
+null_out="$(helm template hub "$CHART_DIR" --set classificationCatalog=null)"
+if [ "$default_out" != "$null_out" ]; then
+  echo "FAIL: omitted and null classificationCatalog render differently" >&2
+  exit 1
+fi
+
+# A file-backed default must render identically to the previous inline-list form.
+explicit_out="$(helm template hub "$CHART_DIR" \
+  --set-json "classificationCatalog=$(tr -d '\n' <"$CHART_DIR/configuration/catalogs/classifications.json")")"
+if [ "$default_out" != "$explicit_out" ]; then
+  echo "FAIL: bundled defaults and explicit classification list render differently" >&2
+  exit 1
+fi
+
+override_flags=(--set-json 'classificationCatalog=[{"key":"forklift","label":"Forklift","icon":"vehicle"}]')
+override_out="$(helm template hub "$CHART_DIR" "${override_flags[@]}")"
+assert_contains "$override_out" '"key": "forklift"'
+assert_absent "$override_out" '"key": "pedestrian"'
+
+empty_out="$(helm template hub "$CHART_DIR" --set-json 'classificationCatalog=[]')"
+assert_contains "$empty_out" "    []"
+assert_absent "$empty_out" '"key": "pedestrian"'
+disabled_out="$(helm template hub "$CHART_DIR" --set classificationCatalogEnabled=false)"
+assert_absent "$disabled_out" "name: classification-catalog"
+assert_absent "$disabled_out" "CLASSIFICATION_CATALOG_FILE"
+
+bundle_out="$(helm template hub "$CHART_DIR" --set workflowConfiguration.enabled=true)"
+assert_contains "$bundle_out" "checksum/workflow-configuration:"
+assert_contains "$bundle_out" "mountPath: /etc/kerberos/configuration"
+assert_contains "$bundle_out" "path: workflow-contracts/start.yaml"
+assert_contains "$bundle_out" "path: catalogs/classifications.json"
+assert_contains "$bundle_out" "source: project.devices"
+assert_contains "$bundle_out" "file: ../catalogs/classifications.json"
+assert_absent "$bundle_out" "WORKFLOW_CONTRACTS"
+bundle_config="$(helm template hub "$CHART_DIR" --set workflowConfiguration.enabled=true \
+  --show-only templates/configmap-workflow-configuration.yaml)"
+assert_absent "$bundle_config" "classifications.json: |-"
+override_bundle="$(helm template hub "$CHART_DIR" --set workflowConfiguration.enabled=true "${override_flags[@]}")"
+assert_contains "$override_bundle" '"key": "forklift"'
+assert_absent "$override_bundle" '"key": "pedestrian"'
+
+external_flags=(-f "$CHART_DIR/examples/workflow-configuration-values.yaml")
+external_out="$(helm template hub "$CHART_DIR" "${external_flags[@]}" --set classificationCatalogEnabled=false)"
+assert_contains "$external_out" 'name: "custom-workflow-configuration"'
+assert_contains "$external_out" "path: workflow-contracts/pose.yaml"
+assert_contains "$external_out" "path: catalogs/pose-keypoints.json"
+assert_absent "$external_out" "name: hub-workflow-configuration"
+assert_absent "$external_out" "checksum/workflow-configuration"
+
+ui_out="$(helm template hub "$CHART_DIR" --set mode=ui --set workflowConfiguration.enabled=true)"
+assert_contains "$ui_out" "name: hub-workflow-configuration"
+pipeline_out="$(helm template hub "$CHART_DIR" --set mode=pipeline --set workflowConfiguration.enabled=true)"
+assert_absent "$pipeline_out" "name: hub-workflow-configuration"
+assert_absent "$pipeline_out" "name: workflow-configuration"
+
+expect_failure "requires classificationCatalogEnabled" \
+  --set workflowConfiguration.enabled=true --set classificationCatalogEnabled=false
+expect_failure "items is required" \
+  --set workflowConfiguration.enabled=true --set workflowConfiguration.existingConfigMap=custom
+expect_failure "items requires existingConfigMap" "${external_flags[@]}" --set workflowConfiguration.existingConfigMap=
+expect_failure "duplicate workflowConfiguration.items path" "${external_flags[@]}" \
+  --set 'workflowConfiguration.items[1].path=workflow-contracts/pose.yaml'
+expect_failure "workflowConfiguration" "${external_flags[@]}" \
+  --set 'workflowConfiguration.items[0].path=../../secret.yaml'
+expect_failure "workflowConfiguration" "${external_flags[@]}" \
+  --set 'workflowConfiguration.items[0].path=/etc/secret.yaml'
+expect_failure "classificationCatalog" --set classificationCatalog=not-a-list
+
+echo "All workflow configuration and classification catalog checks passed."
@@ -12,6 +12,9 @@
 # producer and consumer silently drift onto different queue names and messages
 # pile up with no consumer. This check fails the build before that can ship.
 #
+# Also checks workflow identity validation and identical WORKFLOW_DEFINITIONS
+# in the API and engine. Requires Helm and Python 3 (standard library only).
+#
 # Usage: scripts/check-workflows-queue-consistency.sh [chart-dir]
 #        (chart-dir defaults to charts/hub, relative to the repo root)

@@ -94,4 +97,137 @@ probe_out="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}" \
 mapfile -t probe_vals < <(printf '%s\n' "${probe_out}" | extract_workflows_queue)
 assert_all_equal "${PROBE}" "override probe" "${probe_vals[@]}" || exit 1

-echo "All WORKFLOWS_QUEUE consistency checks passed."
+assert_definitions() {
+  local rendered="$1" expected="$2" label="$3"
+  printf '%s\n' "$rendered" | python3 -c '
+import json
+import re
+import sys
+
+expected = json.loads(sys.argv[1])
+label = sys.argv[2]
+actual = {}
+for document in sys.stdin.read().split("\n---"):
+    match = re.search(r"(?m)^[ \t]*- name: WORKFLOW_DEFINITIONS[ \t]*\n[ \t]*value: (\".*\")$", document)
+    if not match:
+        continue
+    name = re.search(r"(?m)^metadata:\n  name: (.+)$", document).group(1)
+    assert name not in actual, f"duplicate WORKFLOW_DEFINITIONS in {name}"
+    actual[name] = json.loads(json.loads(match.group(1)))
+assert set(actual) == {"hub-api", "hub-workflows"}, f"unexpected deployments: {set(actual)}"
+for name, definitions in actual.items():
+    assert definitions == expected, f"{label}: {name}: {definitions!r} != {expected!r}"
+print(f"OK ({label}): API and engine receive identical expected workflow definitions")
+' "$expected" "$label"
+}
+
+assert_render_failure() {
+  local label="$1" expected="$2"; shift 2
+  local output
+  if output="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}" "$@" 2>&1)"; then
+    echo "FAIL (${label}): Helm accepted invalid workflow identities" >&2
+    return 1
+  fi
+  if [[ "$output" != *"$expected"* ]]; then
+    printf 'FAIL (%s): expected diagnostic %s, got:\n%s\n' "$label" "$expected" "$output" >&2
+    return 1
+  fi
+  echo "OK (${label}): Helm rejected invalid workflow identities"
+}
+
+assert_definitions "$default_out" '[]' "empty defaults"
+
+echo "== Checking explicit and legacy workflow definitions =="
+identity_fixture='{
+  " Legacy Workflow ": {
+    "enabled": true,
+    "stages": [
+      {"operation": "queuecheck"},
+      {"operation": "external", "dispatch": "conditional", "needs": [{"operation": "queuecheck"}], "needsMode": "all"}
+    ]
+  },
+  "explicit": {
+    "id": "ABCDEF0123456789ABCDEF01",
+    "enabled": true,
+    "triggers": [{"type": "automatic", "devices": [{"key": "fixture-device"}]}],
+    "stages": []
+  },
+  "disabled": {"id": "abcdef0123456789abcdef02", "enabled": false}
+}'
+expected_definitions='[
+  {
+    "name": " Legacy Workflow ", "enabled": true, "source": "config",
+    "triggers": [{"type": "automatic"}],
+    "stages": [
+      {"operation": "queuecheck", "dispatch": "always", "queue": "queuecheck-fixture-queue"},
+      {"operation": "external", "dispatch": "conditional", "needs": [{"operation": "queuecheck"}], "needsMode": "all"}
+    ]
+  },
+  {
+    "name": "explicit", "id": "abcdef0123456789abcdef01", "enabled": true, "source": "config",
+    "triggers": [{"type": "automatic", "devices": [{"key": "fixture-device"}]}],
+    "stages": []
+  }
+]'
+identity_out="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}" \
+  --set-json "kerberoshub.workflows.definitions=$identity_fixture")"
+assert_definitions "$identity_out" "$expected_definitions" "explicit ID lowercase; legacy omission; disabled filtering; triggers and stages unchanged"
+
+renamed_out="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}" \
+  --set-json "kerberoshub.workflows.definitions=${identity_fixture/\"explicit\"/\"renamed\"}")"
+assert_definitions "$renamed_out" "${expected_definitions/\"explicit\"/\"renamed\"}" "explicit identity survives rename"
+
+legacy_only_out="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}" \
+  --set-json 'kerberoshub.workflows.definitions={"legacy":{"enabled":true}}')"
+assert_definitions "$legacy_only_out" \
+  '[{"name":"legacy","enabled":true,"source":"config","triggers":[{"type":"automatic"}],"stages":[]}]' \
+  "legacy-only values unchanged"
+
+echo "== Checking bundled example identity pins =="
+python3 - "$CHART_DIR/values.yaml" <<'PY'
+import hashlib
+import pathlib
+import re
+import sys
+
+values = pathlib.Path(sys.argv[1]).read_text()
+for name in ("tracking-workflow", "vlm-workflow"):
+    expected = hashlib.sha256(name.encode()).hexdigest()[:24]
+    match = re.search(r"(?m)^    #  " + re.escape(name) + r':\n    #    id: "([^"]+)"$', values)
+    assert match and match.group(1) == expected, f"{name} must preserve its name-derived ID {expected}"
+    print(f"OK ({name}): example pins existing identity {expected}")
+PY
+
+echo "== Rejecting invalid explicit IDs, including disabled definitions =="
+invalid_ids=('""' 'null' '"000000000000000000000000"' '0' '123' 'true' 'false' '[]' '{}'
+  '"abc"' '"zzzzzzzzzzzzzzzzzzzzzzzz"' '"abcdef0123456789abcdef01 "'
+  '"abcdef0123456789abcdef0"' '"abcdef0123456789abcdef012"')
+invalid_diagnostic='kerberoshub.workflows.definitions["invalid"].id must be a non-zero 24-character hexadecimal string'
+for enabled in true false; do
+  for id in "${invalid_ids[@]}"; do
+    assert_render_failure "id=$id, enabled=$enabled" "$invalid_diagnostic" \
+      --set-json "kerberoshub.workflows.definitions={\"invalid\":{\"enabled\":$enabled,\"id\":$id}}"
+  done
+done
+
+# Validation must not depend on either consumer being rendered.
+for mode in all ui pipeline; do
+  assert_render_failure "engine disabled, mode=$mode" "$invalid_diagnostic" \
+    --set "mode=$mode" --set kerberoshub.workflows.enabled=false \
+    --set-json 'kerberoshub.workflows.definitions={"invalid":{"enabled":false,"id":null}}'
+done
+
+echo "== Rejecting duplicate effective IDs =="
+legacy_id="$(python3 -c 'import hashlib; print(hashlib.sha256(b" Legacy Workflow ").hexdigest()[:24])')"
+for first_enabled in true false; do
+  for second_enabled in true false; do
+    assert_render_failure "explicit collision, enabled=$first_enabled/$second_enabled" \
+      'duplicate effective workflow id "abcdef0123456789abcdef01" for "first" and "second"' \
+      --set-json "kerberoshub.workflows.definitions={\"first\":{\"enabled\":$first_enabled,\"id\":\"ABCDEF0123456789ABCDEF01\"},\"second\":{\"enabled\":$second_enabled,\"id\":\"abcdef0123456789abcdef01\"}}"
+    assert_render_failure "explicit/derived collision, enabled=$first_enabled/$second_enabled" \
+      "duplicate effective workflow id \"$legacy_id\" for \" Legacy Workflow \" and \"explicit\"" \
+      --set-json "kerberoshub.workflows.definitions={\" Legacy Workflow \":{\"enabled\":$first_enabled},\"explicit\":{\"enabled\":$second_enabled,\"id\":\"${legacy_id^^}\"}}"
+  done
+done
+
+echo "All workflow queue and identity checks passed."
Author	SHA1	Message	Date
KilianandCopilot	2111c0f9d6	Add workflow condition contracts and shared catalog packaging (#180 ) * Add workflow condition contracts and shared catalog packaging Define versioned contract and catalog schemas, Start and custom-stage examples, and opt-in bundled/external ConfigMap packaging. Extract classification defaults without changing the rendered default manifests or existing overrides. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Bump Hub chart to 0.149.0 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Omit optional classification catalog override by default Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-10-05 16:40:48 +02:00
KilianandCopilot	eef273bf3c	Support explicit IDs for deployment-defined workflows (#179 ) Render and validate optional stable workflow IDs, retain legacy name-derived identities, pin documented examples, and exercise identity consistency across API and engine manifests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-29 16:15:02 +02:00
Cédric Verstraeten	dc6c79df2e	Merge pull request #178 from kerberos-io/feature/extend-workflow-designer feature/extend-workflow-designer	2026-09-28 17:17:44 +02:00
cedricve	a847bcd3d5	Bump chart version to 0.148.0 for release	2026-09-28 14:48:23 +00:00
cedricve	a9f916fe89	Add WORKFLOW_EDITOR_STAGES to hub-api.yaml and values.yaml for workflow editor customization	2026-09-28 13:44:15 +00:00
cedricve	9900824b59	Update comments in hub-workflows.yaml to clarify engine behavior with empty config definitions	2026-09-28 12:17:27 +00:00
Cédric Verstraeten	d2a550b526	Add WORKFLOW_STAGE_QUEUES to hub-workflows.yaml for DB workflow queue catalog	2026-09-28 13:53:45 +02:00
Cédric Verstraeten	277b4e64b6	Merge pull request #177 from kerberos-io/feature/hub-vlm-worker feature/hub-vlm-worker	2026-09-25 16:26:13 +02:00
Cédric VerstraetenandCopilot	6f23fba755	Add hub-vlm stage worker example and secretEnv support - hub-stage: render services.<name>.secretEnv (ENV: {name, key}) as secretKeyRef env so worker credentials stay out of values; nothing is rendered when unset, so existing workers are unchanged. - values: commented hub-vlm (ghcr.io/uug-ai/hub-vlm:v1.0.0) worker and vlm-workflow definition examples. - Bump chart to 0.147.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-25 14:18:56 +00:00
Cédric Verstraeten	1da29a87f4	Merge pull request #171 from kerberos-io/feature/dynamic-sprite-size feature/dynamic-sprite-size	2026-09-21 21:40:22 +02:00
Cédric Verstraeten	f4d62af315	Merge branch 'main' into feature/dynamic-sprite-size	2026-09-21 21:37:55 +02:00
Cédric Verstraeten	5f457002b5	Update Chart.yaml	2026-09-21 21:37:00 +02:00
Cédric Verstraeten	440b475966	Fix vault sprite interval configuration Read the sprite interval from the Kerberos Pipeline values, consistent with the other sprite dimensions.	2026-09-21 20:30:12 +02:00
KilianandCopilot	e20c562fc6	Add optional pipeline Deployment annotations and sync-wave examples (#174 ) * Add optional pipeline Deployment annotations and sync-wave examples Expose empty-by-default annotation maps per pipeline service and an opt-in waves 10-70 example. Include a standalone Helm render check; CI workflow wiring is deferred due credential scope. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Keep sync-wave examples inline with each service Remove the separate overlay and make render checks supply per-service overrides directly. Leave optional defaults and Deployment template support unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-21 17:44:08 +02:00
Kilian	c02f503c4e	Configure notification audit producer (#173 ) * feat(hub): configure notification audit producer * feat(hub): add per-service audit switches * refactor(hub): centralize audit transport settings * docs(hub): clarify audit producer defaults	2026-09-21 16:18:32 +02:00
Kilian	632cf8aa4b	feat(hub): configure explicit API audit enablement (#172 )	2026-09-21 12:08:36 +02:00
Cédric Verstraeten	ad5d3305f2	Fix VAULT_SPRITE env vars and document sprite sizing Hub API was reading VAULT_SPRITE_WIDTH/HEIGHT from kerberosvault.sprite instead of kerberospipeline.sprite; fixed the mismatch. Also removed the outdated 'hard coded in UI' note and added README/values documentation on sprite tile resolution, aspect ratio requirements, and rollout order for dependent services.	2026-09-19 09:41:14 +02:00
Kilian	1538b8cf12	Clarify Live View motion status flag (#170 ) * docs(hub): clarify live view status flag Clarify that the device status flag controls connectivity and recent-motion state. * docs(hub): clarify remote recording UI Clarify the remote-recording value controls the REC action and recording-state overlay.	2026-09-16 15:43:52 +02:00
KilianandCopilot	30378b94bf	feat(hub): make classification catalog optional (#169 ) Allow deployments to disable the rendered classification catalog so Hub API can read the legacy MongoDB settings catalog directly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-16 08:53:20 +02:00
Kilian	f6ac0b771c	feat(hub): configure API audit producer (#168 ) Pass the audit intake queue and dead-letter queue to Hub API when the audit service is enabled, and bump the chart to 0.141.0.	2026-09-15 17:07:51 +02:00
Kilian	065335c0f8	feat(hub): expose live view status flag (#167 ) Map the Live View device status badge setting into normal and demo frontend deployments.	2026-09-15 17:07:45 +02:00
KilianandCopilot	456aba7ee5	feat: configure marker category priority (#166 ) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-15 17:07:41 +02:00
Kilian	a364873372	Merge pull request #165 from kerberos-io/feat/audit-intake Configure durable Hub audit intake	2026-09-15 11:54:09 +02:00
Kilian Boute	3e78109e52	chore(hub): pin audit v1.0.1	2026-09-15 08:48:47 +00:00
Kilian Boute	4a6ea2dc59	chore(hub): bump chart to 0.140.0	2026-09-15 07:46:23 +00:00
Kilian Boute	518ea5732a	Merge remote-tracking branch 'origin/main' into feat/audit-intake	2026-09-15 07:45:32 +00:00
Kilian	a2b10cde36	Merge pull request #164 from kerberos-io/chore/hub-chart-0.139.0 Bump Hub chart to 0.139.0	2026-09-14 16:24:40 +02:00
Kilian Boute	4ed325fdab	feat(hub): configure durable audit intake	2026-09-14 11:51:47 +00:00
Kilian Boute	01f5a7beb3	chore: bump Hub chart to 0.139.0	2026-09-14 11:36:10 +00:00
Kilian	52165fa668	Merge pull request #163 from kerberos-io/feat/device-developer-tools-flag Add device developer tools feature flag	2026-09-14 13:31:12 +02:00
Kilian Boute	93ba2c6045	feat: add device developer tools flag	2026-09-14 09:51:53 +00:00
Kilian	cb7e51e2e3	Merge pull request #162 from kerberos-io/chore/hub-chart-0.138.0 Bump Hub chart to 0.138.0	2026-09-11 16:15:48 +02:00
Kilian Boute	293ae4699c	chore: bump Hub chart to 0.138.0	2026-09-11 14:11:43 +00:00
Kilian	142e7d5c54	Merge pull request #160 from kerberos-io/feat/configurable-chart-colors Add configurable frontend chart colors	2026-09-11 15:50:07 +02:00
Kilian	07fd4c345d	Merge pull request #161 from kerberos-io/feat/device-analytics-flag Add device analytics and dashboard map flags	2026-09-11 15:34:08 +02:00
Kilian Boute	0ed38b82f7	feat: configure dashboard and device flags	2026-09-11 12:46:58 +00:00
Kilian Boute	2c17f5a579	feat: configure frontend chart colors	2026-09-11 11:45:37 +00:00
Kilian	ae3d1d26fb	Merge pull request #159 from kerberos-io/feat/audit-destinations Add configurable audit destinations	2026-09-11 10:53:29 +02:00
Kilian Boute	dae3d663b4	chore(hub): pin audit v1.0.0	2026-09-11 08:31:09 +00:00
Kilian Boute	3d5c0ecd3e	refactor(hub): rename dispatcher to audit service	2026-09-10 08:35:40 +00:00
Kilian Boute	6454e8fa33	feat(hub): add configurable audit destinations	2026-09-09 12:23:36 +00:00
Kilian	fbffe917bb	Merge pull request #158 from kerberos-io/feat/classification-catalog Add a configurable classification catalog	2026-09-09 11:57:59 +02:00
Kilian Boute	5c1d233c45	feat: add configurable classification catalog Render deployer-defined classification keys, labels, and icons into a ConfigMap mounted by Hub API.	2026-09-08 14:27:22 +00:00
Kilian	f9de70fce4	Merge pull request #157 from kerberos-io/feat/configurable-notification-expiry feat: configure notification expiry	2026-09-07 16:20:01 +02:00
Kilian Boute	6c50f1d359	bump chart version	2026-09-07 16:16:52 +02:00
Kilian	9badb35126	Merge pull request #156 from kerberos-io/feat/marker-options-by-date Expose selected-day marker option filtering	2026-09-07 16:00:48 +02:00
Kilian Boute	fb26c6b755	feat(frontend): expose marker option date flag Add a default-off Helm value for selected-day marker option filtering and inject it into primary and demo frontend deployments.	2026-09-07 12:35:47 +00:00
Kilian BouteandCopilot	3719ec0bbe	feat: configure notification expiry Expose the notification freshness cutoff in minutes through the Hub chart. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-07 12:34:51 +00:00
Kilian	c262433aa1	Merge pull request #155 from kerberos-io/feat/audit-event-retention Configure audit event retention	2026-09-04 16:45:31 +02:00
Kilian Boute	f70aedc5d5	feat(hub): expose audit frontend flag	2026-09-04 14:37:46 +00:00
Kilian Boute	2d75d84509	feat(hub): configure audit event retention Expose AUDIT_EVENT_RETENTION_DAYS for hub-cleanup with a 400-day default and document the setting.	2026-09-04 14:22:20 +00:00
Cédric Verstraeten	c5231ca3cf	Merge pull request #154 from kerberos-io/feature/add-feature-flag-proxy-enabled feature/add-feature-flag-proxy-enabled	2026-09-01 16:18:52 +02:00
Cédric Verstraeten	776599cd30	Gate legacy Hub proxy with explicit flag Add `kerberoshub.proxy.enabled` (default `false`) and require it in the vault proxy template so the legacy proxy only deploys when explicitly enabled. Update values and README wording to reflect the new enable/replica behavior, and bump the chart version to `0.134.1`.	2026-09-01 16:12:29 +02:00