Merge pull request #189 from kerberos-io/fix/hub-api-cors-origins

fix/hub-api-cors-origins

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.113.0
+version: 0.155.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -1,6 +1,6 @@
 # Kerberos Hub
 
-Kerberos Hub is the single pane of glass for your Agents. It comes with a best of breed open source technology stack, modular and scale first mindset, and allows you to build and maintain an everless growing video surveillance and video analytics landscape.
+Kerberos Hub is the single pane of glass for your Kerberos agents. It comes with a best of breed open source technology stack, modular and scale first mindset, and allows you to build and maintain an everless growing video surveillance and video analytics landscape.
 
 ![Kerberos Hub Interface](assets/images/hub-dashboard.png)
 
@@ -31,10 +31,144 @@ Uninstall the Kerberos Hub chart
 
     helm uninstall hub -n kerberos-hub
 
+### Sprite Resolution
+
+`kerberospipeline.sprite.width` and `height` set the pixel dimensions of each
+sprite tile, not the complete sheet. Preserve a **16:9 aspect ratio**: for
+example, `240x135` (default), `480x270`, or `640x360`.
+
+Deploy the dimension-aware Hub frontend, Hub API, analysis worker, sprite worker,
+notification worker, and export worker before increasing resolution. Release the updated shared Go
+models and update the Hub API/export worker dependency pins before building those
+services. Newly generated sprites carry their own tile dimensions; existing
+sprites without dimensions retain the `240x135` fallback and need no migration.
+Do not change a global fallback to match the new size. Increasing both dimensions
+by two produces four times as many pixels, increasing decoded memory and usually
+storage and bandwidth. Hover previews retain their display size; fullscreen
+scrubbing uses the higher-resolution tiles.
+
+```yaml
+kerberospipeline:
+    sprite:
+        width: "480"
+        height: "270"
+```
+
+### Optional Argo CD pipeline ordering
+
+Each listed pipeline service accepts `deploymentAnnotations` in its existing
+values section. The default is `{}`, so installing or upgrading the chart alone
+does not enable ordering. Commented examples appear beside the service settings
+in `values.yaml`; replace the empty map rather than adding duplicate YAML keys.
+Annotations render on Deployment `metadata`, not on pod templates or Services.
+
+The inline examples use the following order, leaving gaps of ten:
+
+| Wave | `kerberospipeline` keys |
+| --- | --- |
+| 10 | `event` |
+| 20 | `notify` |
+| 30 | `throttler` |
+| 40 | `analysis` |
+| 50 | `thumbnail`, `sprite`, `dominantColor`, `counting` |
+| 60 | `sequence` |
+| 70 | `monitor` |
+
+Enable the annotation in each service's existing environment values section.
+No separate example values file is required. These annotations do not change
+image tags or enable disabled services such as sprite.
+Deploy the compatible analysis bridge before replying workers, and select the
+fixed counting release; waves do not enforce minimum compatible image versions.
+The chart's default image tags are not a compatibility-tested rollout bundle.
+
+Argo CD applies lower waves first and waits for sync/health before proceeding
+within the same Application. Unannotated resources remain at wave zero. A
+single-service image update does not restart earlier services, but an unhealthy
+earlier wave can block it. Separate Applications and external classifier/workflow
+workers require their own coordination. Helm itself does not enforce these waves.
+
+Waves are not a substitute for message compatibility, readiness checks, or
+stopping old RabbitMQ consumers. This example does not add health probes or
+change the Deployment rolling-update strategy.
+
+### Deployment-global workflow identity
+
+`kerberoshub.workflows.definitions` is a map keyed by workflow name. Enabled
+definitions are passed as the same `WORKFLOW_DEFINITIONS` JSON to Hub API and the
+workflow engine. These deployment-global, ops-managed workflows are read-only
+through the API; manage them in Helm values. There are no per-project on/off
+overrides.
+
+Supply an explicit, stable `id` for new definitions:
+
+```yaml
+kerberoshub:
+    workflows:
+        enabled: true
+        definitions:
+            tracking-workflow:
+                id: "ec7e72bc4cedd32018e1f92a"
+                enabled: true
+                stages:
+                    - operation: objecttracking
+```
+
+The worker and its queue must also be configured under
+`kerberoshub.services.objecttracking`. As before, omitted triggers default to a
+single automatic trigger and disabled definitions are not sent to either service.
+
+Identity is separate from mutable names and content versions. Keep an explicit
+ID unchanged when renaming or revising a workflow; changing it creates an
+independent identity, not a new version of the existing workflow. The chart
+does not generate random IDs or introduce a version field.
+
+For compatibility, an omitted `id` remains omitted from the rendered JSON. The
+backend derives the effective ID as the first 24 hexadecimal characters of
+SHA-256 over the **exact map key**, including case and whitespace. Before
+renaming an existing ID-less definition, pin its current derived ID explicitly
+to preserve references and history. For example:
+
+```sh
+printf '%s' 'tracking-workflow' | sha256sum | cut -c1-24
+# ec7e72bc4cedd32018e1f92a
+```
+
+The chart ships an empty definitions map. Its commented `tracking-workflow` and
+`vlm-workflow` examples pin their current name-derived IDs for compatibility.
+
+Explicit IDs must be quoted, non-zero, 24-character hexadecimal strings (Mongo
+ObjectIDs); uppercase is accepted and normalized to lowercase in JSON. Empty,
+null, all-zero, malformed, and non-string IDs fail Helm rendering with the
+definition name and validation requirement. Duplicate effective IDs also fail,
+naming both definitions and the colliding ID, whether explicit/explicit or
+explicit/name-derived. Validation includes disabled definitions and runs even
+when the engine is disabled, so identities remain reserved. Omit the `id` key
+entirely to use the legacy fallback; invalid explicit IDs never fall back.
+
 ### Parameters
 
 Below all configuration options and parameters are listed.
 
+When upgrading to `0.144.0`, move `kerberoshub.audit.enabled` and
+`kerberoshub.audit.intake` to `audit.enabled` and `audit.intake`. Consumer
+workload settings remain under `kerberoshub.audit`.
+
+Auditing is globally disabled by default. Setting `audit.enabled: true` deploys
+the audit consumer and enables every supported producer by default. A producer
+is enabled only when both the global switch and its service switch are true; set
+the service's `audit.enabled` value to `false` only when that service must opt
+out.
+
+```yaml
+audit:
+    enabled: true
+
+kerberospipeline:
+    notify:
+        audit:
+            enabled: false # Optional per-service opt-out.
+```
+
 | Name                                        | Description                                                                                                                | Value |
 | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----- |
 | `license` | The license key you received from support@kerberos.io. If not available request one. | `"L/+DAwEBB2xpY2Vuc2UB/4QAAQIBB1BheWxvYWQBCgABCVNpZ25hdHVyZQEKAAAA/gMk/4QB/gEZ/8sQACxnaXRodWIuY29tL3V1Zy1haS9odWItbGljZW5zZS9tb2RlbHMuTGljZW5zZX8DAQEHTGljZW5zZQH/gAABDAECSWQB/4IAAQNLZXkBDAABB0NvbXBhbnkBDAABB0V4cFRpbWUBBAABBERheXMBBAABB0NhbWVyYXMBBAABBVNpdGVzAQQAAQZWYXVsdHMBBAABCk1lZGlhTGltaXQBBAABCVBlcnBldHVhbAECAAEGQWN0aXZlAQIAAQlJcEFkZHJlc3MBDAAAABj/gQEBAQhPYmplY3RJRAH/ggABBgEYAAAy/4AvAQwAAAAAAAAAAAAAAAACDGZyZWUtbGljZW5zZQH81iZi6gH+AtoBEAEUARQDAQAB/gIAfeXxQb6kaPfAgOWeSAE6qEiQviFD6sciNmNfMel1mEL53FeV0GQe4cYBip9wyJag35az8A1yppxSymZD5V4my2FckyN2zmEW4E2sO/v+8eKepiAGYEzrKtfNCLxdWLmrHd0zjYQ3qk+PNfoPyzCOefeulw3aFsqBlzg9wDkF8cRx6tUW0qNTzki6sFGOuLoxS49cWqsftAvZmt+CRWa8u0VArIAjOpywN0RIZCkEYzp5RYF3LSVyWYEyvVhjE19DDnevzpJyCHRsIHTRcpTQkhboeapOdlEz8cx+PaOvxktN8hBWceTAH+nw96FARG7y6Cpjw3xo+NV1xb0tvRXGaGoK77JnErKLhd/haXji98rGvMakDt18WSbQfTVS84+Fw+/gKGsW3uS3fROAaZw1kZj4PgsEPZDvbVkCVyuS0O87UoYqpxH8S4by8cTF3wDP7FwyIRZbEbYjN2wzHSmlADYOBtdsdb1VGm7wvtB85vML9n7ZSlIpJdqfci06mGks102mDyG2LRMhUEvpUW3D/weErIvj2WiAwf6r0EUj+LO8VmAsYkME9da7FXEN6Vg/5f1u485LOpYki332RaDOhDn2eMG9DVb/HnmQSFagX+XXc/QwfsWiehCgKYGk4jQpyklTqoGu8BAt6Sm8CaoH8ngZ3cHLQT5DcZElV36/N/wA"` |
@@ -51,8 +185,14 @@ Below all configuration options and parameters are listed.
 | `mongodb.authenticationMechanism` | MongoDB authentication mechanism (for example `SCRAM-SHA-256`). | `"SCRAM-SHA-256"` |
 | `mongodb.username` | MongoDB user account, we are using in the hub installation `'root'`. | `"yourusername"` |
 | `mongodb.password` | MongoDB user password, by default `'yourmongodbpassword'` | `"yourpassword"` |
+| `mongodb.appNamePerService` | When `mongodb.uri` is set, override its `appName` per workload with the service name (for example `hub-api`, `hub-pipeline-monitor`), so the MongoDB Atlas query profiler shows which service issued each operation. | `true` |
 | `mongodb.retryWrites` | Enable or disable MongoDB retryable writes. | `"true"` |
 | `mongodb.flavor` | Backend engine flavor: `"mongodb"` (native MongoDB / Atlas) or `"documentdb"` (AWS DocumentDB). The `documentdb` flavor disables features DocumentDB does not support (geospatial queries/indexes, complex `$lookup` pipelines). When set to `documentdb`, also set `mongodb.retryWrites: "false"`. | `"mongodb"` |
+| `mongodb.tls.enabled` | Enable TLS for MongoDB connections. When `mongodb.uri` is set, the chart appends missing `tls=true` and `tlsCAFile` query parameters. | `false` |
+| `mongodb.tls.existingSecret` | Existing Kubernetes Secret containing the MongoDB CA bundle. The Secret is mounted into every workload that consumes `mongodb-config`. | `""` |
+| `mongodb.tls.caFileName` | Key and filename of the CA bundle in `mongodb.tls.existingSecret` (for AWS DocumentDB, typically `global-bundle.pem`). | `""` |
+| `mongodb.tls.mountPath` | Read-only directory where the MongoDB CA Secret is mounted. | `"/etc/mongodb/tls"` |
+| `mongodb.tls.insecureSkipVerify` | Skip MongoDB certificate and hostname verification. This is insecure and intended only for local testing. | `false` |
 | `mqtt.host` | MQTT (Vernemq) hostname. | `"mqtt.yourdomain.com"` |
 | `mqtt.port` | MQTT (Vernemq) port for WSS (secure sockets), by default `'8443'`. | `"8443"` |
 | `mqtt.protocol` | MQTT (Vernemq) protocol, by default `'wss'`. | `"wss"` |
@@ -66,6 +206,12 @@ Below all configuration options and parameters are listed.
 | `rabbitmq.username` | RabbitMQ username, by default `'yourusername'` | `"yourusername"` |
 | `rabbitmq.password` | RabbitMQ password, by default `'yourpassword'` | `"yourpassword"` |
 | `rabbitmq.exchange` | RabbitMQ exchange, by default `''` | `""` |
+| `audit.enabled` | Deploy the Hub audit consumer and act as the master switch for all audit producers. | `false` |
+| `audit.intake.queue` | Shared durable RabbitMQ queue used by audit producers and the audit consumer. | `"hub-audit-events"` |
+| `audit.intake.deadletterQueue` | Shared RabbitMQ queue used for invalid audit events and exhausted persistence retries. | `"hub-audit-dead-letter"` |
+| `audit.intake.maxRetries` | Maximum MongoDB persistence retries before an intake event is dead-lettered. | `10` |
+| `audit.intake.prefetchCount` | Maximum unacknowledged intake events per audit replica. | `20` |
+| `audit.intake.persistTimeout` | Timeout for one MongoDB persistence attempt. | `"10s"` |
 | `kafka.broker` | Kafka brokers, by default `'kafka1.yourdomain.com:9094,kafka2.yourdomain.com:9094'` | `"kafka1.yourdomain.com:9094"` |
 | `kafka.username` | Kafka username, by default `'yourusername'` | `"yourusername"` |
 | `kafka.password` | Kafka password, by default `'yourpassword'` | `"yourpassword"` |
@@ -116,10 +262,17 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.api.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.9.8"` |
 | `kerberoshub.api.replicas` | The number of pods/replicas running for the Kerberos Hub API deployment. | `2` |
+| `kerberoshub.api.audit.enabled` | Enable audit publishing from Hub API when global auditing is enabled. | `true` |
 | `kerberoshub.api.logLevel` | Log verbosity level for `kerberoshub.api`. | `"info"` |
 | `kerberoshub.api.jwtSecret` | A secret that is for generating JWT tokens. | `"this-is-a-secret-please-change-to-random-string"` |
 | `kerberoshub.api.schema` | The protocol to serve the Kerberos Hub API, `'http'` or `'https'`. | `"https"` |
 | `kerberoshub.api.url` | The Kerberos Hub API ingress to access the API. | `"api.yourdomain.com"` |
+| `kerberoshub.api.corsAllowedOrigins` | Additional complete HTTP(S) origins allowed to call the Hub API. Configured frontend origins remain allowed automatically. | `[]` |
+| `kerberoshub.api.disableAgentHeartbeat` | Temporarily stop serving the polled `GET /devices` list (hub-api returns `204` without database reads). Devices still load once through `/session/bootstrap`; online/offline status stops refreshing. | `false` |
+| `kerberoshub.api.mediaProxy.enabled` | Serve media through hub-api (`/media/proxy`) instead of handing out Vault/storage URLs, hiding the storage endpoint from clients. | `false` |
+| `kerberoshub.api.mediaProxy.publicUrl` | Public hub-api base URL used in proxied media URLs. Defaults to `{schema}://{url}`. | `""` |
+| `kerberoshub.api.mediaProxy.key` | Key used to encrypt proxied media URLs (`openssl rand -hex 32`). Defaults to a key derived from `jwtSecret`. | `""` |
+| `kerberoshub.api.mediaProxy.ttl` | Lifetime of proxied media URLs (Go duration, max `168h`). | `"24h"` |
 | `kerberoshub.api.resources.requests.memory` | Memory request for `kerberoshub.api`. | `"100Mi"` |
 | `kerberoshub.api.resources.requests.cpu` | CPU request for `kerberoshub.api`. | `"250m"` |
 | `kerberoshub.api.resources.limits.memory` | Memory limit for `kerberoshub.api`. | `"100Mi"` |
@@ -197,33 +350,64 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.caseFilterAssigneesDefault` | Default assignee filter behavior for cases in the frontend. | `"false"` |
 | `kerberoshub.frontend.features.case.enabled` | Enable or disable the case feature in the frontend. | `"true"` |
 | `kerberoshub.frontend.features.darkModeEnabled` | Enable or disable dark mode in the frontend. | `"true"` |
+| `kerberoshub.frontend.features.splashScreen.enabled` | Enable or disable the pre-bootstrap splash screen and reveal delay. | `"true"` |
 | `kerberoshub.frontend.features.landingPage` | Frontend landing page configuration. | `"/dashboard"` |
 | `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
 | `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
 | `kerberoshub.frontend.features.workflows.enabled` | Enable or disable the workflows feature in the frontend. | `"false"` |
+| `kerberoshub.frontend.features.audit.enabled` | Enable or disable the owner/admin Audit events page and navigation link. | `"true"` |
+| `kerberoshub.frontend.features.organisations.enabled` | Enable or disable the organisation feature family, including projects. When empty, child groups apply independently. | `""` |
+| `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
+| `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
+| `kerberoshub.frontend.features.organisations.settingsEnabled` | Enable or disable the organisation identity link to organisation settings. | `"false"` |
+| `kerberoshub.frontend.features.projects.enabled` | Fallback project group switch used when the organisations umbrella is unset. | `""` |
+| `kerberoshub.frontend.features.projects.switcherEnabled` | Enable or disable the read-only project dropdown. | `"false"` |
+| `kerberoshub.frontend.features.projects.creationEnabled` | Reserved for the project creation UI. | `"false"` |
+| `kerberoshub.frontend.features.projects.settingsEnabled` | Reserved for the project settings UI. | `"false"` |
 | `kerberoshub.frontend.features.map.tileUrlLight` | Tile URL used by the map in light mode. | `"https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png"` |
 | `kerberoshub.frontend.features.map.tileUrlDark` | Tile URL used by the map in dark mode. | `"https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png"` |
 | `kerberoshub.frontend.features.map.attribution` | Attribution text displayed on the map tiles. | `"&copy; <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>"` |
+| `kerberoshub.frontend.features.map.overlayTileUrl` | Optional XYZ overlay URL supporting `{z}`, `{x}`, `{y}`, and `{apiKey}`. Empty disables the overlay. | `""` |
+| `kerberoshub.frontend.features.map.overlayApiKey` | Optional browser-visible API key substituted for `{apiKey}` in the overlay URL. | `""` |
+| `kerberoshub.frontend.features.map.overlayAttribution` | Attribution text displayed when the overlay is enabled. | `""` |
+| `kerberoshub.frontend.features.map.overlayMinZoom` | Minimum zoom level for overlay tiles. | `"0"` |
+| `kerberoshub.frontend.features.map.overlayMaxZoom` | Maximum zoom level for overlay tiles. | `"19"` |
+| `kerberoshub.frontend.features.map.overlayOpacity` | Overlay opacity from `0` to `1`. | `"1"` |
 | `kerberoshub.frontend.features.liveview.defaultStreamMode` | Liveview behavior setting: `defaultStreamMode`. | `"SD"` |
+| `kerberoshub.frontend.features.liveview.liveStreamMode` | Transport backing LIVE mode: `webrtc`, `hls`, or `moq`. | `"webrtc"` |
+| `kerberoshub.frontend.features.liveview.hlsEnabled` | Offer HLS as a selectable LIVE transport. | `"true"` |
+| `kerberoshub.frontend.features.liveview.moqEnabled` | Offer MoQ as a selectable LIVE transport. | `"false"` |
+| `kerberoshub.frontend.features.liveview.remoteRecordingEnabled` | Show the manual REC control and recording-state overlay in live views. | `"true"` |
+| `kerberoshub.frontend.features.liveview.deviceStatusEnabled` | Show connectivity and recent-motion status in live view tile headers. | `"true"` |
+| `kerberoshub.frontend.features.liveview.moqRelayUrl` | WebTransport URL of the MoQ relay. | `"https://relay.uug.ai/anon"` |
+| `kerberoshub.frontend.features.liveview.moqBroadcastPrefix` | Prefix used to build MoQ broadcast names. | `"devices"` |
 | `kerberoshub.frontend.features.liveview.paginationMode` | Liveview behavior setting: `paginationMode` (`scroll`, `numbered` or `maxStreams`). | `"scroll"` |
 | `kerberoshub.frontend.features.liveview.pageSize` | Liveview behavior setting: `pageSize` (max streams shown per page in `numbered` mode). | `"6"` |
 | `kerberoshub.frontend.features.liveview.maxStreams` | Liveview behavior setting: `maxStreams`. | `"-1"` |
+| `kerberoshub.frontend.features.chart.colors` | Ordered colors shared by chart series and marker detection overlays. | `["#84569f", "#3ba7ff", "#ff5c8a", "#4ad991", "#ffb84d", "#ff7043"]` |
 | `kerberoshub.frontend.features.chart.colorChartSelectionFill` | Fill color for chart selection regions. | `"rgba(132, 86, 159, 0.07)"` |
 | `kerberoshub.frontend.features.chart.colorChartSelectionStroke` | Stroke color for chart selection regions. | `"rgba(132, 86, 159, 0.4)"` |
 | `kerberoshub.frontend.features.chart.colorChartGridStroke` | Stroke color for chart grid lines. | `"rgba(0, 106, 255, 0.18)"` |
 | `kerberoshub.frontend.features.devices.hideAgent` | Hide agent controls in the devices section of the frontend. | `"false"` |
+| `kerberoshub.frontend.features.devices.analyticsEnabled` | Enable or disable the Analytics tab on device detail pages. | `"true"` |
+| `kerberoshub.frontend.features.devices.developerToolsEnabled` | Enable or disable owner-only live Agent logs and terminal access on device detail pages. | `"true"` |
+| `kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled` | Enable or disable the fullscreen Sites map on the Dashboard. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.date.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.date`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.sites.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sites`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.groups.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.groups`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.devices.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.devices`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.objectDetection.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.objectDetection`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.star.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.star`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.analysis.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.analysis`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.region.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.region`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.sort.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sort`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.category.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.category`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.markers.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.markers`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled` | Limit marker, category, event, and tag filter options to the selected recordings day. | `"false"` |
+| `kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled` | Order marker filter options from configured categories before other markers. | `"false"` |
+| `kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories` | Ordered exact, case-sensitive marker category names to prioritize. | `[]` |
 | `kerberoshub.frontend.features.media.filter.events.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.events`. | `"true"` |
-| `kerberoshub.frontend.features.liveview.defaultStreamMode` | Default live stream mode: `SD` or `HD`. | `"SD"` |lter.tags`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.tags.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.tags`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.defaultView` | Default view for the media page: `timeline` or `grid`. | `"timeline"` |
 | `kerberoshub.frontend.features.floorplan.enabled` | Enable or disable `kerberoshub.frontend.features.floorplan`. | `"true"` |
 | `kerberoshub.frontend.features.floorplan.colorDeviceActive` | Color customization for `floorplan` in the frontend. | `"hsla(131, 31%, 52%, 1)"` |
@@ -240,6 +424,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing` | Color customization for `floorplan` in the frontend. | `"hsla(204, 100%, 50%, 1)"` |
 | `kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete` | Color customization for `floorplan` in the frontend. | `"hsla(219, 100%, 94%, 1)"` |
 | `kerberoshub.frontend.features.faceRedaction.enabled` | Enable or disable `kerberoshub.frontend.features.faceRedaction`. | `"false"` |
+| `kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled` | Make classifier-generated tracks available in the redaction modal. | `"true"` |
 | `kerberoshub.support.enabled` | Enable or disable in-app support features. | `false` |
 | `kerberoshub.oauth2Proxy.enabled` | Enable or disable `kerberoshub.oauth2Proxy`. | `false` |
 | `kerberoshub.oauth2Proxy.github.clientId` | Client ID used by `kerberoshub.oauth2Proxy.github`. | `"github-client-id"` |
@@ -271,9 +456,24 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.cleanup.globalPassIntervalHours` | Minimum hours between global cleanup passes. | `"0"` |
 | `kerberoshub.cleanup.globalPassDeleteBudget` | Max documents deleted during a global pass. | `"0"` |
 | `kerberoshub.cleanup.defaultTaskRetentionDays` | Default retention (in days) applied to tasks without an explicit `retention_days`. Tasks older than this (anchored on `creation_date`) are deleted with their `case_media` rows. Set to `"0"` or a negative value to keep tasks forever. Must match `kerberoshub.api.defaultTaskRetentionDays`. | `"0"` |
+| `kerberoshub.cleanup.auditEventRetentionDays` | Deployment-wide audit-event retention in days, independent of recording plans, inactive-account cleanup, and the optional global pass. Set to `"0"` or a negative value to keep audit events indefinitely. | `"400"` |
+| `kerberoshub.cleanup.workflowRunRetentionDays` | Deployment-wide workflow run retention in days, anchored on run execution time (`start`). Applied on top of media-linked retention (the stricter cutoff wins) and independent of the optional global pass. Set to `"0"` or a negative value to let runs expire only with their media. | `"0"` |
 | `kerberoshub.cleanup.resources.requests.memory` | Memory request for `kerberoshub.cleanup`. | `"10Mi"` |
 | `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
-| `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
+| `kerberoshub.audit.repository` | Hub audit service container image repository. | `"ghcr.io/uug-ai/hub-audit"` |
+| `kerberoshub.audit.pullPolicy` | Hub audit service image pull policy. | `"IfNotPresent"` |
+| `kerberoshub.audit.tag` | Hub audit service image tag. | `"v1.0.1"` |
+| `kerberoshub.audit.replicas` | Number of audit service replicas. Per-destination MongoDB leases prevent concurrent delivery. | `1` |
+| `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
+| `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
+| `kerberoshub.audit.terminationGracePeriodSeconds` | Pod termination grace period. Keep this longer than `leaseDuration` so an in-flight cycle can finish. | `150` |
+| `kerberoshub.audit.destinations` | Webhook destinations. Each entry supports `id`, `enabled`, `url`, delivery limits, filters, public `headers`, `bearerTokenSecret`, and arbitrary `secretHeaders`. Destination IDs retain independent checkpoints. | `[]` |
+| `kerberoshub.audit.serviceMonitor.enabled` | Create a Prometheus `ServiceMonitor` for audit service metrics. | `true` |
+| `kerberoshub.audit.serviceMonitor.interval` | Audit service metrics scrape interval. | `"15s"` |
+| `kerberoshub.audit.volumes` | Additional pod volumes, for example a private webhook CA bundle. | `[]` |
+| `kerberoshub.audit.volumeMounts` | Additional audit service container volume mounts. | `[]` |
+| `kerberoshub.audit.extraEnv` | Additional audit service environment variables. | `[]` |
+| `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Kerberos Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
 | `kerberoshub.monitordevice.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.0"` |
 | `kerberoshub.monitordevice.replicas` | Number of replicas for `kerberoshub.monitordevice`. | `1` |
@@ -283,15 +483,16 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"uugai/hub-reactivatesubscriptions"` |
 | `kerberoshub.reactivate.pullPolicy` | Image pull policy for `kerberoshub.reactivate`. | `"IfNotPresent"` |
 | `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.2"` |
-| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. | `1` |
+| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. Set to `0` to disable. | `0` |
 | `kerberoshub.reactivate.logLevel` | Log verbosity level for `kerberoshub.reactivate`. | `"info"` |
 | `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
 | `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
 | `kerberoshub.forwarder.enabled` | Enable or disable the Hub forwarder component. | `false` |
+| `kerberoshub.proxy.enabled` | Enable or disable the legacy Hub proxy Deployment and LoadBalancer Service. | `false` |
 | `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
 | `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
 | `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
-| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. | `1` |
+| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy` when enabled. | `0` |
 | `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
 | `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
 | `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
@@ -306,6 +507,7 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.monitor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberospipeline.monitor.tag` | The Docker image tag/version. | `"v1.3.9"` |
 | `kerberospipeline.monitor.replicas` | Number of replicas for `kerberospipeline.monitor`. | `1` |
+| `kerberospipeline.monitor.logLevel` | Monitor log level. Set to `debug` for per-event processing checkpoints. | `"info"` |
 | `kerberospipeline.monitor.resources.requests.memory` | Memory request for `kerberospipeline.monitor`. | `"10Mi"` |
 | `kerberospipeline.monitor.resources.requests.cpu` | CPU request for `kerberospipeline.monitor`. | `"10m"` |
 | `kerberospipeline.sequence.repository` | The [sequencer microservice](https://doc.kerberos.io/hub/pipeline/#sequencer), grouping recordings in chunks/groups. | `"ghcr.io/uug-ai/hub-pipeline-sequence"` |
@@ -325,7 +527,9 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.notify.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.9"` |
 | `kerberospipeline.notify.replicas` | Number of replicas for `kerberospipeline.notify`. | `1` |
+| `kerberospipeline.notify.audit.enabled` | Enable audit publishing from the notification worker when global auditing is enabled. | `true` |
 | `kerberospipeline.notify.logLevel` | Log verbosity level for `kerberospipeline.notify`. | `"info"` |
+| `kerberospipeline.notify.notificationExpiryMinutes` | Maximum recording age in minutes before notification delivery. Set to `"0"` to disable the freshness cutoff. | `"15"` |
 | `kerberospipeline.notify.resources.requests.memory` | Memory request for `kerberospipeline.notify`. | `"10Mi"` |
 | `kerberospipeline.notify.resources.requests.cpu` | CPU request for `kerberospipeline.notify`. | `"10m"` |
 | `kerberospipeline.notifyTest.repository` | The notification service for testing, the different channels. | `"uugai/hub-pipeline-notification-test"` |
@@ -339,6 +543,8 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.analysis.tag` | The Docker image tag/version. | `"v1.7.8"` |
 | `kerberospipeline.analysis.replicas` | Number of replicas for `kerberospipeline.analysis`. | `1` |
 | `kerberospipeline.analysis.logLevel` | Log verbosity level for `kerberospipeline.analysis`. | `"info"` |
+| `kerberospipeline.analysis.dbCache.enabled` | Cache hot-path MongoDB lookups (site vault per device) in memory. Site changes apply after at most one TTL. | `false` |
+| `kerberospipeline.analysis.dbCache.ttl` | Lifetime of a cached lookup, as a Go duration (e.g. `"30s"`, `"5m"`). | `"5m"` |
 | `kerberospipeline.analysis.resources.requests.memory` | Memory request for `kerberospipeline.analysis`. | `"10Mi"` |
 | `kerberospipeline.analysis.resources.requests.cpu` | CPU request for `kerberospipeline.analysis`. | `"10m"` |
 | `kerberospipeline.dominantColor.repository` | The dominant color microservices is computing a top 3 color histogram. | `"ghcr.io/uug-ai/hub-pipeline-dominantcolors"` |
@@ -377,8 +583,8 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.sprite.replicas` | Number of replicas for `kerberospipeline.sprite`. | `5` |
 | `kerberospipeline.sprite.logLevel` | Log verbosity level for `kerberospipeline.sprite`. | `"info"` |
 | `kerberospipeline.sprite.interval` | Configuration value for `kerberospipeline.sprite.interval`. | `"1"` |
-| `kerberospipeline.sprite.width` | Configuration value for `kerberospipeline.sprite.width`. | `"240"` |
-| `kerberospipeline.sprite.height` | Configuration value for `kerberospipeline.sprite.height`. | `"135"` |
+| `kerberospipeline.sprite.width` | Tile width in pixels; preserve width:height = 16:9. | `"240"` |
+| `kerberospipeline.sprite.height` | Tile height in pixels; preserve width:height = 16:9. | `"135"` |
 | `kerberospipeline.sprite.resources.requests.memory` | Memory request for `kerberospipeline.sprite`. | `"512Mi"` |
 | `kerberospipeline.sprite.resources.requests.cpu` | CPU request for `kerberospipeline.sprite`. | `"500m"` |
 | `kerberospipeline.sprite.resources.limits.memory` | Memory limit for `kerberospipeline.sprite`. | `"2Gi"` |
@@ -390,15 +596,6 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.export.logLevel` | Log verbosity level for `kerberospipeline.export`. | `"info"` |
 | `kerberospipeline.export.resources.requests.memory` | Memory request for `kerberospipeline.export`. | `"10Mi"` |
 | `kerberospipeline.export.resources.requests.cpu` | CPU request for `kerberospipeline.export`. | `"10m"` |
-| `kerberospipeline.redaction.repository` | Container image repository for `kerberospipeline.redaction`. | `"ghcr.io/uug-ai/hub-pipeline-redaction"` |
-| `kerberospipeline.redaction.pullPolicy` | Image pull policy for `kerberospipeline.redaction`. | `"IfNotPresent"` |
-| `kerberospipeline.redaction.tag` | Container image tag/version for `kerberospipeline.redaction`. | `"v1.0.0"` |
-| `kerberospipeline.redaction.replicas` | Number of replicas for `kerberospipeline.redaction`. | `2` |
-| `kerberospipeline.redaction.logLevel` | Log verbosity level for `kerberospipeline.redaction`. | `"info"` |
-| `kerberospipeline.redaction.resources.requests.memory` | Memory request for `kerberospipeline.redaction`. | `"512Mi"` |
-| `kerberospipeline.redaction.resources.requests.cpu` | CPU request for `kerberospipeline.redaction`. | `"500m"` |
-| `kerberospipeline.redaction.resources.limits.memory` | Memory limit for `kerberospipeline.redaction`. | `"2Gi"` |
-| `kerberospipeline.redaction.resources.limits.cpu` | CPU limit for `kerberospipeline.redaction`. | `"1000m"` |
 | `email.provider` | The email service provider for sending out messages over email , use `'mailgun'` or `'smtp'`. | `"mailgun"` |
 | `email.from` | The email address that is sending messages in name of, by default `'support@yourdomain.com'`. | `"support@yourdomain.com"` |
 | `email.displayName` | The display name that is sending messages in name of, by default `'yourdomain.com'` | `"yourdomain.com"` |
@@ -423,7 +620,7 @@ Below all configuration options and parameters are listed.
 | `email.templates.highupload` | The template which is send when an account is reaching a specific upload threshold, by default `'threshold'`. | `"highupload"` |
 | `email.templates.device` | The template which is send when a camera goes online or offline, by default `'device'`. | `"device"` |
 | `email.templates.alertTitle` | Email subject title for the `alert` template. | `"[Alert] Kerberos Hub detected something an event"` |
-| `email.templates.deviceTitle` | Email subject title for the `device` template. | `"[Device] An Agent's status has been changed"` |
+| `email.templates.deviceTitle` | Email subject title for the `device` template. | `"[Device] A Kerberos Agent's status has been changed"` |
 | `email.mailgun.apiKey` | The Mailgun API key linked to your Mailgun domain. | `""` |
 | `imagePullSecrets.name` | Docker registry secret name, which is also granted with the license. This allows you to download the Docker images. | `""` |
 | `kerberoshub.forwarder.pullPolicy` | The Docker registry pull policy. | `""` |
@@ -467,6 +664,564 @@ As mentioned during the Post installation step, you'll import some `.nosql` file
 
 Within the Kerberos Hub front-end you'll see the option to filter through classifications. This filtered is stored in the `settings` collection. By changing the entries of the `classifications` object, you can add, edit or remove items from the filters.
 
+The default shared classification list lives in
+[`templates/configMaps/catalogs/classifications.yaml`](templates/configMaps/catalogs/classifications.yaml),
+independently of workflow contracts. The chart uses this bundled definition
+unless a deployer provides a ConfigMap override. Each entry contains the stable classifier output
+`key`, the user-facing `label`, and an `icon` key. Hub API exposes this catalog
+to alerts and filters. When the mounted catalog is unavailable, compatible Hub
+API versions fall back to the legacy `settings` document and then the built-in
+classification list. Set `classificationCatalogEnabled: false` to omit the
+ConfigMap and make Hub API use that fallback directly.
+
+Starting with chart **0.155.0**, the inline `classificationCatalog` values key is
+removed. Supplying it fails validation, including `null` and `[]`; it is never
+silently ignored or replaced with bundled defaults.
+
+To customize the catalog, create a ConfigMap in the release namespace containing
+the complete JSON array, then use the per-file replacement interface:
+
+```yaml
+classificationCatalogEnabled: true
+workflowConfiguration:
+  enabled: true
+  includeDefaults: true
+  configMaps:
+    - name: hub-classification-catalog
+      items:
+        - key: classifications.json
+          path: catalogs/classifications.json
+          replace: true
+```
+
+To migrate, copy the existing list exactly (preserving keys, labels and icons)
+into the ConfigMap's JSON data, remove `classificationCatalog` from every values
+overlay and command-line override, and deploy the ConfigMap before the chart
+upgrade. A `null` value is not a migration: remove the key. The bundled list
+remains the default when no override is configured. If an old `[]` intentionally
+selected the API's runtime fallback, use `classificationCatalogEnabled: false`
+and configure workflow packaging without bundled defaults instead.
+
+The existing `classificationCatalogExistingConfigMap: hub-classification-catalog`
+option remains supported, including for deployments without workflow packaging.
+It requires the key `classifications.json`. Do not combine it with a per-file
+catalog replacement. Helm does not create or checksum either kind of external
+catalog. With bundled workflow packaging, the API mount and Start metadata
+reference the same effective ConfigMap. With `includeDefaults: false`, map any
+required catalog explicitly through `configMaps`; the API's catalog selection
+remains independent.
+Disabling `classificationCatalogEnabled` disables the API catalog mount regardless
+of this setting. The external ConfigMap and key must exist before the API pod can
+start. Manage updates and any required rollout/reload through deployment tooling;
+Helm cannot inspect or validate its contents. The catalog schema remains available
+for authoring validation.
+
+### Workflow editor contracts
+
+This chart defines the v1 contract format and opt-in file packaging.
+**Consuming contracts requires compatible Hub API and frontend versions.**
+Enabling packaging only mounts files; it neither enables an editor feature nor
+registers workers or changes execution. Compatible APIs use validated contracts
+to gate custom-editor node availability, together with worker routing.
+
+Deployers describe what a node exposes; Hub code owns what that means:
+
+| Contract controls | Code owns |
+| --- | --- |
+| `presentation`: name, description, approved icon, colour token | Widgets, layout and theme colours |
+| `params`: settings authors enter on a worker stage | Validation, secret masking and storage |
+| `fields`: Start selectors and typed stage outputs, labels, order, choices, bounds | Operator semantics, authorized resource lookups, Start's bindings |
+| Start `controls` and `triggerModes` offered for new authoring | Schedule, condition and trigger execution |
+
+Worker images, queues, resources and credentials stay in `kerberoshub.services`.
+No new loader environment variable is set.
+
+Conditions are not free-form: a new or changed predicate on a connection may
+only test a declared field of Start or of a stage upstream of that connection
+(stage outputs are addressed as `results.<stage>.<path>`), with one of its
+declared operators and a value of its type, within its bounds and, for equality
+on enumerated choices, one of its options. Predicates already stored keep
+running and can be removed, but not edited.
+
+The earlier device-bound workflow configurations were development fixtures, not
+a recommended deployment model. Charts describe capabilities, not selected
+devices, project IDs, concrete workflow edges, or user-authored conditions.
+Device filtering is optional. Saved selections belong in individual workflows.
+
+ConfigMap templates live together under `templates/configMaps/`, with bundled
+catalogs and workflow contracts in their own subdirectories:
+
+```text
+templates/configMaps/
+  configmap-mongodb.yaml
+  configmap-hub-audit.yaml
+  catalogs/
+    classifications.yaml
+  workflow-contracts/
+    start.yaml
+    anpr.yaml
+    forwarder.yaml
+schemas/
+  catalog.schema.json
+  workflow-contract.schema.json
+```
+
+- [Start contract ConfigMap](templates/configMaps/workflow-contracts/start.yaml): current device,
+  site, group and initial-classification presets, schedule/condition controls and
+  both trigger modes.
+- [ANPR contract ConfigMap](templates/configMaps/workflow-contracts/anpr.yaml):
+  presentation plus plate/read-status and OCR metadata from the ANPR worker; no
+  catalog required. It declares no `params`, so any settings come from
+  `kerberoshub.workflows.editorStages`.
+- [Forwarder contract ConfigMap](templates/configMaps/workflow-contracts/forwarder.yaml):
+  presentation and required per-node delivery and RabbitMQ destination settings
+  for custom workflows. Deployment-global workflows keep their deployment
+  bindings. No output fields are declared.
+- [Custom pose example](examples/workflow-contracts/pose.yaml): hypothetical
+  worker, demonstrating presentation, settings (`params`), a file catalog, inline
+  choices and a numeric field.
+  This example does not deploy a worker or claim a universal pose-model format.
+- [Contract schema](schemas/workflow-contract.schema.json): format, source-name
+  documentation and YAML editor completion for standalone contracts via the
+  `$schema` comment.
+- [Catalog schema](schemas/catalog.schema.json): shared JSON lists of
+  `{key, label, icon?}`, compatible with the current classification file format.
+
+The bundled contract and catalog templates define their payloads as named Helm
+templates and emit ConfigMaps when enabled. These are Kubernetes templates, not standalone contract
+files; Helm cannot access files under `templates/` through `.Files.Get`.
+Validate their rendered data against the schemas. The standalone custom examples
+remain plain YAML/JSON files.
+
+Do not associate the contract schema with an entire Helm template or ConfigMap:
+it describes only the contract document inside `data`. The schemas are included
+in the chart package, but are not mounted into pods. Helm validates
+`values.schema.json`, not these payload schemas. Unique field IDs/catalog keys
+and resolvable catalog references also require semantic checks; a JSON Schema
+pass alone does not establish runtime compatibility.
+
+#### Current bundled defaults
+
+Start, ANPR, the forwarder and the shared classification catalog are bundled. The pose files
+under `examples/` are illustrative, not installed presets.
+
+| Start field | Context path | Operators | Choices |
+| --- | --- | --- | --- |
+| `device` | `device.deviceKey` | `eq`, `in` | `project.devices` |
+| `sites` | `device.siteIds.*` | `in` | `project.sites` |
+| `groups` | `device.groupIds.*` | `in` | `project.groups` |
+| `classifications` | `inputs.classify.details.*.classified` | `in` | `../catalogs/classifications.json` |
+
+These are editor condition presets, not worker deployment settings. Only
+classifications are marked optional: initial classification data may be absent.
+The bundled Start contract also declares two condition-only context fields,
+`deviceName` (`device.deviceName`) and `objectClass` (the classification path
+with `eq`/`ne`/`in`/`exists`). Other Start field IDs are not selectors; they must
+use paths under `device.` or `inputs.` and only extend what advanced conditions
+may test.
+
+Site/group arrays can be empty. A contract may omit any of these fields, the
+`weeklySchedule`/`conditions` controls (omitted offers none) or a trigger mode
+(`triggerModes` omitted offers both). Omissions affect new authoring only:
+values already saved in workflows are kept, keep running and can be cleared.
+
+The catalog preserves the API/frontend compatibility defaults: `animal`,
+`pedestrian`, `cyclist`, `motorbike`, `lorry`, `car`, `handbag`, `suitcase` and
+`cell phone`. It is not an exhaustive vocabulary for every detector. Keys are
+literal output/comparison values, not aliases: `motorbike` does not match
+`motorcycle`. Deployments using a different detector vocabulary must supply the
+appropriate complete catalog rather than relabeling keys silently.
+
+##### ANPR: the stage result
+
+The ANPR contract describes `results.anpr` as `models.WorkflowAnprResult`
+defines it: the engine groups hub-anpr's ingest blocks into one detection run
+(`detections`) with one track per vehicle, and one marker per vehicle
+(`markers`). Paths are relative to that result.
+
+| ANPR field | Relative result path | Input |
+| --- | --- | --- |
+| `plate` | `detections.*.tracks.*.meta.plate` | Uppercase letters and digits without separators (`AB123CD`); empty when unread |
+| `unread` | `detections.*.tracks.*.meta.unread` | Boolean |
+| `vehicleClass` | `detections.*.tracks.*.meta.classifiedAs` | Classification label copied from classify (only `ANPR_PLATE_CLASSES`, by default `car`) |
+| `ocrConfidence` | `markers.*.metadata.confidence` | Number; only for read plates; about 0–1 for `fast`, 0.5 for `tesseract`, unclamped for `http` |
+| `ocrEngine` | `markers.*.metadata.engine` | `fast`, `tesseract`, `tesseract+opencv` or `http`; only for read plates |
+| `secondsVisible` | `markers.*.duration` | Whole seconds the vehicle was visible |
+
+The panel offers "Plate contains" and "Plate could not be read", plus a
+collapsed Recognition section (minimum OCR confidence, vehicle class, seconds
+visible). `exists` is not offered: plate, unread and class are present for every
+vehicle, so it would always match.
+
+Important output semantics:
+
+- Wildcards fan out independently. Plate, unread and class are on the same
+  track and can be tied to one vehicle with "Must match the same item"; OCR
+  confidence and engine are on the markers and cannot be tied to a plate.
+- Vehicles removed by the movement and jump gates produce neither a track nor a
+  marker, so the lists can be empty.
+- Track confidence is a constant 0.9 and is deliberately not offered.
+- Node settings (`params`) override the worker's `ANPR_*` environment variables
+  per run: vehicle classes to read (`plateClasses`, a multiselect from the
+  classification catalog), minimum movement, maximum jump, frames to read,
+  agreeing reads required and minimum OCR confidence. Their defaults equal the
+  worker's built-in defaults and are stored on nodes when a workflow is saved,
+  so a deployment that changes those environment variables should change the
+  contract defaults as well. Requires hub-anpr with node settings and an engine
+  that dispatches settings to every stage.
+
+ANPR metadata is bundled whenever default workflow packaging is enabled, even
+if its worker is disabled. It does not deploy the worker. Because a valid
+contract plus worker routing offers a stage, ANPR becomes authorable as soon as
+its worker queue is configured; replace or omit the bundled contract to prevent
+that.
+
+The forwarder contract follows the same rule: the forwarder becomes authorable
+wherever its worker queue is configured. Replace or omit the bundled contract to
+prevent that.
+
+Its nine required custom-workflow settings are `broker`,
+`mode`, `host`, `port` (whole number, 1-65535), `queue`, `vhost`, `tls`,
+`username` and `password`. The contract defaults `broker` to `rabbitmq`, `mode`
+to `delivered` and `tls` to `true`; those values are stored on save. Destination
+and credentials must be supplied before enabling a custom workflow. The password is a secret:
+the API masks it on reads and the engine includes it only in worker dispatches.
+Changing other node settings requires re-entering saved secrets.
+
+Custom workflows never inherit deployment connection settings or credentials.
+They use their own RabbitMQ connection, verified TLS with system trust roots
+when enabled, and their own `<queue>.forwarder-dead-letter` queue. Incomplete
+custom settings fail closed even if a replacement contract makes them optional.
+Shared destinations and custom HTTPS webhooks are not supported in this phase.
+Deployment-global workflows continue using their configured RabbitMQ or HTTPS
+bindings without node overrides. `mode: callback` requires a
+configured callback base URL (`FORWARDER_CALLBACK_BASE_URL` for the
+environment-backed worker); the external service supplies its own Hub token.
+Custom invocations carry the run's inputs and results, not deployment-specific
+field mappings. TLS certificate and queue declaration policies are not node
+settings.
+
+Deploy the engine that stamps the top-level `forwarderDestinationMode`
+(`deployment` or `custom`) before the enforcing worker. Missing or invalid mode
+is rejected; drain old unstamped dispatches before the worker upgrade. Update
+existing custom workflows with complete settings. The mode is engine-owned,
+not contract-defined, and the forwarder queue must accept trusted engine
+publishers only.
+
+This chart source layout does not change the mounted layout:
+
+```text
+/etc/kerberos/configuration/
+  catalogs/
+    classifications.json
+  workflow-contracts/
+    start.yaml
+    anpr.yaml
+    forwarder.yaml
+```
+
+Each contract defines a `stage` type, a `schemaVersion`, a `contractVersion`,
+optional `presentation` and (worker stages only) `params`, and its own `fields`.
+`controls` and `triggerModes` are Start-only. `fields: []` is valid for a node without exposed condition
+fields; omitting the `fields` property is invalid. A field declares `id`, `label`, `path`, scalar `type` and
+supported `operators`; `optional`, numeric bounds and `choices` are optional.
+The `type` describes each wildcard-selected candidate, not the containing array.
+IDs must be unique within a contract. Increment `contractVersion` when changing
+its meaning/output shape; the future runtime must bind workflows to compatible
+versions rather than silently reinterpreting saved conditions.
+
+#### Field paths and connection panels
+
+Every contract path addresses the workflow condition root
+(`models.WorkflowConditionRootSchema`): Start fields use absolute paths, stage
+fields are relative to `results.<stage>`. A compatible API rejects Start paths
+that are not in that schema (for example a typo such as `device.devicename`)
+and lists the valid alternatives; worker-defined `inputs.<operation>` data and
+stage outputs are accepted as declared.
+
+`panel` lays out the inputs on connections leaving a node. Sections place
+declared fields with an editor widget (`multiselect`, `select`, `text`,
+`number`, `toggle`), Start's weekly schedule (`controls: [weeklySchedule]`) or
+the Extra conditions catch-all (`picker: true`), which offers every declared
+field of Start and the stages before the connection. Connections also show the
+panels of earlier steps, collapsed. Contracts without a panel get a default one,
+so existing contracts keep working; on Start a panel replaces the top-level
+`controls` list. See the pose example and the contract schema for the full
+format.
+
+#### Contract-gated custom editor
+
+With a compatible API/frontend, adding or changing a custom-workflow stage node
+requires both of the following:
+
+- Its operation has configured worker routing (normally from
+  `kerberoshub.services.<operation>.queue`).
+- A valid supported contract for that operation is present under
+  `workflow-contracts/`, and any referenced catalogs are valid.
+
+The contract is the allow-list. `kerberoshub.workflows.editorStages` is optional
+metadata: a stage's name, description and params are used only where its
+contract omits `presentation` or `params`.
+
+This is a configuration check, not a live worker-health check. The chart's queue
+catalog does not prove that a worker pod is running; deployers still manage the
+worker's enabled state and deployment.
+
+Start is structural rather than a worker operation and always exists: every
+workflow has exactly one Start node and it needs no worker queue. Without a
+`workflow-contracts/start.yaml`, a compatible API applies a built-in default
+identical to the bundled one; a valid file replaces it entirely. An invalid or
+untrusted Start contract does not remove Start: it falls back to a restricted
+Start without selectors or controls and reports diagnostics in the editor, so a
+mistake never re-exposes fields the deployer meant to hide.
+
+Enable `workflowConfiguration.enabled` and provide stage contracts before using
+contract-gated stages. The chart currently bundles Start, ANPR and the forwarder; other
+editor operations need deployer-supplied contracts. Leaving configuration
+disabled does not stop existing workflows: Start remains authorable with its
+built-in default, but no new stage nodes can be added unless their contracts
+are supplied through another configuration mount.
+
+The contract-gating API currently supports schema and contract version 1. It
+reads configuration on demand, accepting direct YAML/JSON contract files and
+JSON catalogs inside the configured root, including Kubernetes projected-volume
+symlinks. Files are limited to 64 KiB, contracts to 128 fields and 64 params,
+inline choices to 256 values, and catalogs to 1024 entries. Unsupported versions,
+duplicate declarations, unreadable files and invalid references produce
+availability diagnostics, not implicit built-in replacements.
+
+Previously saved nodes whose contracts become unavailable remain visible and
+keep their stored settings. They can be removed or repositioned, but their
+settings and connections cannot be changed while unavailable. Other compatible
+edits to the workflow remain possible. Removing a node also removes its incident
+connections. This authoring rule does not disable existing workflows, change
+manual/automatic execution, or change deployment-global workflow definitions.
+
+The schemas describe data formats, not executable plugins. Contract availability
+does not yet provide a generic output-field editor for every stage.
+
+#### Choice origins
+
+Use exactly one of these, or omit `choices` for typed user input:
+
+```yaml
+choices:
+  source: project.devices
+```
+
+```yaml
+choices:
+  file: ../catalogs/classifications.json
+```
+
+```yaml
+choices:
+  values: [standing, sitting, lying]
+```
+
+The supported system-resource vocabulary for v1 is:
+
+| `choices.source` | User-facing labels | Stored comparison values |
+| --- | --- | --- |
+| `project.devices` | Authorized device names | Stable device keys |
+| `project.sites` | Authorized site names | Stable site IDs |
+| `project.groups` | Authorized group names | Stable group IDs |
+
+These are direct built-in API resolver identifiers, not database paths or
+deployer-selected authorization scopes. Consumers must reuse existing project/resource authorization and
+legacy-owner compatibility; metadata cannot grant access.
+
+File references resolve relative to the mounted contract, within the shared
+configuration root. V1 uses `../catalogs/<name>.json`; no URLs, arbitrary file
+access or recursive catalog references. Catalog keys are stable strings, with
+labels for display; inline lists may contain strings, numbers or booleans matching
+the field type. Catalogs are reusable by filters, alerts and other consumers,
+not owned by workflows. A library may ship a catalog without implementing an API.
+
+#### Bundled and external packaging
+
+`workflowConfiguration.enabled` defaults to `false`. With it enabled and
+`includeDefaults` omitted or `true`, the chart mounts the bundled Start/ANPR contracts and the
+**effective** classification list under `/etc/kerberos/configuration`, using
+the directory layout above. The projected volume reuses the existing
+classification ConfigMap, including `classificationCatalogExistingConfigMap`
+overrides or explicit per-file replacements, rather
+than storing another copy in the workflow ConfigMap.
+
+The default classification ConfigMap name, mount path, `CLASSIFICATION_CATALOG_FILE`
+and API endpoint remain unchanged. Inline `classificationCatalog` values,
+including `[]` and `null`, are rejected from chart 0.155.0 onward. The current API
+still falls back to settings/built-in values for an empty/invalid mounted catalog. The preparatory
+bundle does not reproduce that runtime fallback and must not be treated as a
+resolved API catalog. The Start-specific loader shares the existing classification
+resolver; other consumers must preserve that consistency.
+Bundled packaging requires `classificationCatalogEnabled: true`; an
+external bundle can be packaged independently.
+
+Custom deployers can maintain files in their own repository, create ConfigMaps
+in the release namespace, and use the unchanged chart. `configMaps` adds
+their files alongside the bundled Start/ANPR contracts and effective classification
+catalog. Catalogs can be supplied separately from contracts and mounted into
+other consumers without copying their contents. For example, from this
+chart directory (replace the namespace):
+
+```sh
+kubectl -n YOUR_NAMESPACE create configmap custom-workflow-contracts \
+  --from-file=pose.yaml=examples/workflow-contracts/pose.yaml
+kubectl -n YOUR_NAMESPACE create configmap shared-pose-catalog \
+  --from-file=pose-keypoints.json=examples/catalogs/pose-keypoints.json
+```
+
+Then use [the example values overlay](examples/workflow-configuration-values.yaml).
+Each `configMaps` entry has a `name` and `items` mapping ConfigMap keys to
+files in `workflow-contracts/` and `catalogs/`. A single read-only projected
+volume combines these with the built-in sources, without `subPath`. Paths must
+be unique in the final projection. Unmarked collisions fail rendering instead
+of silently overriding data. ConfigMap size limits apply.
+
+##### Replacing individual bundled files
+
+Keep `includeDefaults: true` and set `replace: true` on a `configMaps` item to
+replace that entire bundled file while retaining all other defaults:
+
+```yaml
+workflowConfiguration:
+  enabled: true
+  includeDefaults: true
+  configMaps:
+    - name: deployment-start-contract
+      items:
+        - key: start.yaml
+          path: workflow-contracts/start.yaml
+          replace: true
+    - name: custom-workflow-contracts
+      items:
+        - key: pose.yaml
+          path: workflow-contracts/pose.yaml
+    - name: shared-pose-catalog
+      items:
+        - key: pose-keypoints.json
+          path: catalogs/pose-keypoints.json
+```
+
+Here the chart still provides the effective classification catalog, but the
+Start contract comes from the deployment. Non-replaced defaults follow the
+pinned chart version; replaced files are maintained by the deployer and are
+not automatically merged with later chart versions.
+
+Replacement targets must already be bundled paths: currently
+`workflow-contracts/start.yaml`, `workflow-contracts/anpr.yaml`,
+`workflow-contracts/forwarder.yaml` and `catalogs/classifications.json`. Unknown
+targets, repeated destinations, and replacements with `includeDefaults: false`
+or the legacy interface fail rendering. For a new custom path, omit `replace`.
+The flag is consumed by Helm and is not emitted into Kubernetes volume items.
+
+ANPR can be replaced independently, without adding any catalog:
+
+```yaml
+workflowConfiguration:
+  enabled: true
+  includeDefaults: true
+  configMaps:
+    - name: deployment-anpr-contract
+      items:
+        - key: anpr.yaml
+          path: workflow-contracts/anpr.yaml
+          replace: true
+```
+
+This suppresses the bundled ANPR ConfigMap and checksum while retaining the
+default Start contract and classification catalog.
+
+A replacement for `catalogs/classifications.json` also supplies the standalone
+classification API. Both mounts use that ConfigMap and key, even when its key
+is not named `classifications.json`. The chart does not generate or checksum the
+replaced ConfigMap. To avoid two competing sources, do not combine this
+replacement with a nonempty `classificationCatalogExistingConfigMap`. That
+existing ConfigMap option remains supported when no per-file catalog replacement
+is configured. The retired inline `classificationCatalog` key is rejected
+regardless of the selected configuration.
+`classificationCatalogEnabled` must remain true when including defaults.
+
+This is whole-file replacement, not field-level YAML merging or catalog-entry
+extension. See [the replacement example](examples/workflow-configuration-overrides-values.yaml)
+for replacing both built-in files while adding a custom contract and catalog.
+
+To manage the complete bundle yourself, set `includeDefaults: false` and supply
+a nonempty `configMaps` list. No Start ConfigMap is generated and no default files
+are projected. The standalone classification API remains independently configured:
+
+```yaml
+workflowConfiguration:
+  enabled: true
+  includeDefaults: false
+  configMaps:
+    - name: hub-start-contract
+      items:
+        - key: start.yaml
+          path: workflow-contracts/start.yaml
+    - name: hub-classification-catalog
+      items:
+        - key: classifications.json
+          path: catalogs/classifications.json
+```
+
+The older `existingConfigMap`, top-level `items`, and `extraConfigMaps` options
+retain their behavior: a nonempty `existingConfigMap` replaces the defaults,
+while `extraConfigMaps` extends either that replacement or the defaults.
+New deployments should use `includeDefaults` and `configMaps`. Do not mix the
+interfaces, even with empty legacy fields. Remove legacy keys from all values
+overlays when migrating. The chart omits both interfaces from its defaults so
+Helm's value merging does not create a mixed configuration.
+
+Migration: replace legacy extras with `configMaps` and keep `includeDefaults: true`
+for additive mode. For legacy replacement mode, set `includeDefaults: false`,
+move `existingConfigMap` and its `items` into the first `configMaps` entry, and
+append any legacy extras. This produces the same mounts without a special base
+ConfigMap. Duplicate destinations remain errors, never order-dependent overrides.
+
+The chart checks item paths and required options but cannot inspect an existing
+ConfigMap at render time. Validate its files against the supplied schemas.
+Bundled changes update the pod checksum. For externally managed ConfigMaps,
+manage rollout/reload in your deployment tooling; the chart cannot checksum
+their contents. Missing referenced ConfigMaps or keys prevent Kubernetes from
+mounting the volume: create them before syncing Hub (for example using an earlier
+Argo CD sync wave). This is distinct from invalid contract/catalog contents,
+which the contract-gating API reports as availability diagnostics without stopping
+Hub. Content diagnostics should be advisory in CI, while rendering/mount
+configuration errors and failing tests remain blocking. Unavailable sections
+must carry explicit errors, never become unrestricted choices or conditions.
+
+Helm validates `values.schema.json`, **not** arbitrary bundled YAML/JSON files.
+The standalone schemas support authoring validation. The contract-gating API
+also rejects duplicate field/catalog keys, unknown sources, missing/invalid
+files, incompatible bounds, unsupported contract versions and unsafe paths.
+Validation failures must be surfaced, not silently replaced with empty choices.
+
+#### Runtime semantics to preserve when wiring consumers
+
+Start paths refer to sanitized initial context, never credentials. Other stage
+paths are relative to that node instance's result. Conditions may use Start and
+all available upstream node outputs, not just the immediately preceding stage;
+future or unrelated parallel results are unavailable. Node instances remain
+distinct. Conditional branches and missing outputs require explicit availability
+handling, even for a field not marked `optional`.
+
+Wildcard positive comparisons match any candidate. Independent wildcard
+conditions can match different objects; use the existing same-element `anyMatch`
+semantics when predicates must match one detection/keypoint.
+
+The existing Start controls retain their behavior: alternatives within a scope
+category are OR; populated device/site/group/classification categories, schedule
+and advanced conditions are AND. `conditionMode` only combines the advanced
+conditions. Empty selections/schedules are unrestricted. Multiple automatic
+Start edges are OR for creating one run; only matched entry branches dispatch.
+Manual runs are created before continuation conditions are evaluated, and their
+automatic trigger settings remain dormant. Schedule uses recording time and an
+IANA timezone, not an invented output field. The advanced editor retains logical
+groups and existence checks; neither scheduling nor logical groups are scalar
+output fields. Contracts do not redefine the saved workflow wire format.
+
 ### Indexing
 
 Following indexes should be executed on the MongoDB database (Kerberos) to improve future performance. Within Kerberos Hub several queries are executed, following indexes will improve the loading times. If not applied you might experience application timeouts or reduced performance when storing lots of data.
@@ -487,6 +1242,7 @@ Following indexes should be executed on the MongoDB database (Kerberos) to impro
 #### Analysis collection
 
     db.getCollection("analysis").createIndex({start:1})
+    db.getCollection("analysis").createIndex({organisationId:1, projectId:1, key:1}, {name:"analysis_org_project_key"})
     db.getCollection("analysis").createIndex({userid:1, key:1})
     db.getCollection("analysis").createIndex({userid:1, start:1})
 

charts/hub/custom-layout/i18n-custom/custom-i18n-claim.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: custom-i18n-claim
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: azurefile-premium
+  resources:
+    requests:
+      storage: 25Mi

charts/hub/custom-layout/i18n-custom/en.json

@@ -0,0 +1,9 @@
+{
+  "nav": {
+    "cases": "Investigations",
+    "dashboard": "Home"
+  },
+  "login": {
+    "signInTo": "Sign in to {{domain}} \u2014 Acme Security"
+  }
+}

charts/hub/custom-layout/i18n/en.json

@@ -44,7 +44,8 @@
       "incomplete": "Enter all 4 characters to continue.",
       "unlock": "Unlock encrypted data",
       "switchAccount": "or switch account",
-      "ariaCharacter": "Passphrase character"
+      "ariaCharacter": "Passphrase character",
+      "rememberCode": "Remember code for 24 hours on this device"
     },
     "darkMode": {
       "switchToLight": "Switch to light mode",
@@ -124,6 +125,7 @@
     "recording": "Recording",
     "dayOverview": "Day overview",
     "analytics": "Analytics",
+    "markers": "Markers",
     "watchlist": "Watchlist",
     "cases": "Cases",
     "alerts": "Alerts",
@@ -134,7 +136,257 @@
     "allOf": "All {{name}}s",
     "accounts": "Accounts",
     "roles": "Roles",
+    "audit": "Audit events",
     "settings": "Settings",
+    "context": {
+      "label": "Workspace",
+      "title": "Switch workspace",
+      "open": "Choose organisation and project",
+      "resize": "Resize organisation column"
+    },
+    "projects": {
+      "label": "Project",
+      "open": "Show projects",
+      "search": "Search projects",
+      "noResults": "No matching projects",
+      "fallback": "Project 1",
+      "empty": "No projects",
+      "unavailable": "Projects unavailable",
+      "loading": "Loading projects..."
+    },
+    "organisations": {
+      "label": "Organisation",
+      "search": "Search organisations",
+      "noResults": "No matching organisations",
+      "current": "Current organisation",
+      "none": "No organisation",
+      "select": "Select organisation",
+      "unavailable": "Organisation unavailable",
+      "loading": "Loading organisations...",
+      "empty": "No organisations yet",
+      "create": "Create organisation",
+      "name": "Organisation name",
+      "modal": {
+        "title": "Create organisation",
+        "subtitle": "Add the essentials now. Company and contact details can be completed later.",
+        "create": "Create organisation",
+        "tabs": {
+          "general": "General",
+          "company": "Company",
+          "contact": "Contact & location"
+        },
+        "fields": {
+          "name": "Organisation name *",
+          "description": "Description",
+          "domain": "Email domain",
+          "legalName": "Legal name",
+          "tradingName": "Trading name",
+          "industry": "Industry",
+          "website": "Website",
+          "email": "Contact email",
+          "phone": "Contact phone",
+          "street": "Street address",
+          "street2": "Address line 2",
+          "city": "City",
+          "region": "State / region",
+          "postalCode": "Postal code",
+          "country": "Country"
+        },
+        "placeholders": {
+          "name": "For example, Acme Security",
+          "description": "What this organisation is used for",
+          "domain": "example.com",
+          "website": "https://example.com",
+          "email": "contact@example.com"
+        },
+        "errors": {
+          "form": "Please complete all the missing fields.",
+          "nameRequired": "Enter an organisation name.",
+          "nameLength": "Use at least 2 characters.",
+          "email": "Enter a valid email address."
+        }
+      },
+      "settings": {
+        "title": "Organisation settings",
+        "open": "Open organisation settings",
+        "loading": "Loading organisation...",
+        "loadFailed": "The organisation could not be loaded.",
+        "save": "Save changes",
+        "saving": "Saving...",
+        "tabs": {
+          "general": "General",
+          "company": "Company",
+          "address": "Billing address",
+          "contacts": "Contacts",
+          "regional": "Regional",
+          "users": "Users",
+          "subscription": "Subscription"
+        },
+        "cards": {
+          "userTitle": "{{count}} user",
+          "usersTitle": "{{count}} users",
+          "usersSubtitle": "People with access to this organisation",
+          "usersFooter": "Organisation users",
+          "viewUsers": "View users"
+        },
+        "subscription": {
+          "currentPlan": "Current plan",
+          "noPlan": "No active plan",
+          "description": "Manage the plan, billing method, limits, and integrations for this organisation.",
+          "manage": "Manage subscription",
+          "status": {
+            "no-plan": "No subscription is currently active.",
+            "active": "The subscription is active.",
+            "cancelled": "The subscription has been cancelled.",
+            "reached-limit": "The subscription limit has been reached."
+          }
+        },
+        "users": {
+          "title": "Organisation users",
+          "descriptionSingle": "{{count}} person currently has access to this organisation.",
+          "description": "{{count}} people currently have access to this organisation.",
+          "manage": "Manage users",
+          "inactive": "Inactive",
+          "empty": "No users found",
+          "emptyDescription": "Add users to give them access to this organisation."
+        },
+        "contacts": {
+          "primary": "Primary contact",
+          "financial": "Financial contact",
+          "technical": "Technical contact"
+        },
+        "fields": {
+          "name": "Organisation name *",
+          "description": "Description",
+          "domain": "Email domain",
+          "legalName": "Legal name",
+          "tradingName": "Trading name",
+          "registrationNumber": "Registration number",
+          "vatNumber": "VAT number",
+          "industry": "Industry",
+          "website": "Website",
+          "email": "Contact email",
+          "phone": "Contact phone",
+          "street": "Street address",
+          "street2": "Address line 2",
+          "city": "City",
+          "region": "State / region",
+          "postalCode": "Postal code",
+          "country": "Country",
+          "timezone": "Timezone",
+          "locale": "Locale",
+          "currency": "Currency",
+          "contactName": "Name",
+          "contactEmail": "Email",
+          "contactPhone": "Phone"
+        },
+        "placeholders": {
+          "domain": "example.com",
+          "website": "https://example.com",
+          "email": "contact@example.com",
+          "timezone": "Europe/Brussels",
+          "locale": "en-US",
+          "currency": "EUR"
+        },
+        "errors": {
+          "form": "Please correct the highlighted fields.",
+          "nameRequired": "Enter an organisation name.",
+          "nameLength": "Use at least 2 characters.",
+          "email": "Enter a valid email address."
+        }
+      }
+    },
+    "projects": {
+      "label": "Project",
+      "current": "Current project",
+      "none": "No project",
+      "select": "Select project",
+      "unavailable": "Project unavailable",
+      "loading": "Loading projects...",
+      "empty": "No projects yet",
+      "search": "Search projects",
+      "create": "Create project",
+      "name": "Project name",
+      "settings": {
+        "title": "Project settings",
+        "details": "Project details",
+        "tabs": {
+          "general": "General",
+          "credentials": "Credentials"
+        },
+        "encryption": "Encryption keys",
+        "publicKey": "RSA public key",
+        "privateKey": "RSA private key",
+        "legacyPublicKey": "Agent public key",
+        "legacyPrivateKey": "Agent private key",
+        "encryptionKey": "Encryption key",
+        "secretKeys": "Secret keys",
+        "generate": "Generate credentials",
+        "regenerate": "Regenerate credentials",
+        "generating": "Generating keys...",
+        "generateHint": "Generate keys for this project.",
+        "oneTimeHint": "Copy these keys now. They will not be shown again.",
+        "copyPublicKey": "Copy RSA public key",
+        "copyPrivateKey": "Copy RSA private key",
+        "copyLegacyPublicKey": "Copy Agent public key",
+        "copyLegacyPrivateKey": "Copy Agent private key",
+        "copyEncryptionKey": "Copy encryption key",
+        "pincode": {
+          "generateTitle": "Generate project credentials?",
+          "generateMessage": "Generate new keys for this project.",
+          "label": "PIN code (optional)",
+          "hint": "Enter exactly 4 digits to encrypt the stored encryption key. The PIN is never saved.",
+          "error": "Enter exactly 4 digits or leave the PIN empty.",
+          "statusLabel": "PIN protection",
+          "enabled": "Enabled",
+          "disabled": "Disabled"
+        },
+        "import": {
+          "open": "Bring your own keys",
+          "title": "Bring your own keys",
+          "description": "Import an RSA-4096 public key generated outside the platform and provide your encryption key.",
+          "replacementWarning": "This replaces the current credentials. Cameras using them may disconnect.",
+          "formatHint": "The public key may be OpenSSL PEM or single-line Base64 DER. The encryption key must contain exactly 32 hexadecimal characters.",
+          "encryptionKeyError": "Enter exactly 32 hexadecimal characters.",
+          "cancel": "Cancel",
+          "confirm": "Import credentials",
+          "importing": "Importing..."
+        },
+        "regenerateWarning": {
+          "title": "Regenerate project credentials?",
+          "message": "This immediately replaces the current public, private and encryption keys. This action cannot be undone.",
+          "cameraImpact": "Cameras using the current credentials may disconnect and must be configured with the new credentials.",
+          "cancel": "Cancel",
+          "confirm": "Regenerate credentials"
+        }
+      },
+      "modal": {
+        "title": "Create project",
+        "subtitle": "A project keeps its devices, sites and recordings separate from the rest of the organisation.",
+        "create": "Create project",
+        "fields": {
+          "name": "Project name *",
+          "slug": "Handle *",
+          "description": "Description"
+        },
+        "placeholders": {
+          "name": "For example, Warehouse North",
+          "slug": "warehouse-north",
+          "description": "What this project is used for"
+        },
+        "hints": {
+          "slug": "Lowercase letters, numbers and single hyphens. Used to reference the project later."
+        },
+        "errors": {
+          "form": "Please complete all the missing fields.",
+          "nameRequired": "Enter a project name.",
+          "nameLength": "Use at least 2 characters.",
+          "slugRequired": "Enter a handle.",
+          "slugFormat": "Use lowercase letters, numbers and single hyphens only.",
+          "slugLength": "Use at most 63 characters."
+        }
+      }
+    },
     "plansIntegrations": "Plans & integrations",
     "dataUploaded": "Data uploaded",
     "dailyLimit": "{{percent}}% – {{usage}}/{{max}} GB daily limit",
@@ -208,6 +460,57 @@
     "Vault": "Vault"
   },
   "pages": {
+    "audit": {
+      "title": "Audit events",
+      "refresh": "Refresh",
+      "loadError": "Audit events could not be loaded. Try again.",
+      "metadata": "Metadata",
+      "noMetadata": "No metadata was recorded for this event.",
+      "changes": "Changes",
+      "filters": {
+        "actor": "Actor",
+        "actorPlaceholder": "Name or ID",
+        "action": "Action",
+        "target": "Target",
+        "targetPlaceholder": "Name or ID",
+        "operation": "Operation",
+        "permission": "Permission",
+        "category": "Category",
+        "outcome": "Outcome",
+        "search": "Search all fields",
+        "searchPlaceholder": "Actor, action, target, device...",
+        "from": "From",
+        "to": "To",
+        "any": "Any",
+        "clear": "Clear filters"
+      },
+      "table": {
+        "timestamp": "Timestamp",
+        "actor": "Actor",
+        "action": "Action",
+        "target": "Target",
+        "outcome": "Outcome",
+        "details": "Event details",
+        "showDetails": "Show metadata",
+        "hideDetails": "Hide metadata"
+      },
+      "authorization": "Authorization",
+      "request": "Request",
+      "policy": "Policy",
+      "granted": "Granted",
+      "denied": "Denied",
+      "noResults": {
+        "title": "No audit events found",
+        "description": "Events will appear here as activity is recorded."
+      },
+      "pagination": {
+        "showing": "Showing {{start}}–{{end}} of {{total}}",
+        "rows": "Rows",
+        "previous": "Previous",
+        "next": "Next",
+        "page": "Page {{page}}"
+      }
+    },
     "floorplans": {
       "noneUploaded": "No floor plans uploaded yet",
       "uploadFirstHint": "Upload your first floor plan to visualize your devices on this site",
@@ -260,6 +563,13 @@
       "completeAllFields": "Please complete all the missing fields",
       "nameExists": "This name already exists",
       "badgeColor": "Badge color (HEX)",
+      "fineTuneLocation": "Fine-tune map position",
+      "fineTuneInstructions": "Move the map so the pin marks the exact site location.",
+      "latitude": "Latitude",
+      "longitude": "Longitude",
+      "invalidCoordinates": "Enter valid coordinates.",
+      "selectAddressBeforeFineTune": "Select an address before fine-tuning its map position.",
+      "resetLocation": "Reset position",
       "vaultSaveToUse": "Save changes to use this Vault",
       "vaultCheckCredentials": "Check credentials and try again"
     },
@@ -304,6 +614,85 @@
     "analytics": {
       "manageAlerts": "Manage alerts",
       "subscribePrompt": "Subscribe to a plan to generate notifications",
+      "markers": {
+        "title": "Markers",
+        "overview": "Overview",
+        "searchPlaceholder": "Search marker names, e.g. a license plate",
+        "clearFilters": "Clear filters",
+        "loading": "Loading markers",
+        "loadError": "Markers could not be loaded. Please try again.",
+        "invalidDateRange": "The start date must be before the end date.",
+        "openDetails": "Open marker details",
+        "openMarkerDetails": "Open details for marker {{name}}",
+        "openMedia": "Open recording",
+        "noMedia": "No linked recording",
+        "mediaErrorTitle": "Recording unavailable",
+        "mediaErrorMessage": "The recording linked to this marker could not be opened.",
+        "detail": {
+          "title": "Marker details",
+          "recording": "Marker recording",
+          "loadingRecording": "Loading linked recording...",
+          "videoUnavailable": "The linked recording has no playable video.",
+          "markerPosition": "Marker starts {{offset}} into this recording",
+          "openFullRecording": "Open full recording",
+          "overview": "Overview",
+          "start": "Start",
+          "end": "End",
+          "description": "Description",
+          "classification": "Classification",
+          "metadata": "Metadata",
+          "source": "Source",
+          "engine": "Engine",
+          "modelVersion": "Model version",
+          "boundingBox": "Bounding box",
+          "rawMetadata": "Raw metadata",
+          "comments": "Comments",
+          "identifiers": "Identifiers",
+          "markerId": "Marker ID",
+          "deviceId": "Device ID",
+          "siteId": "Site ID",
+          "groupId": "Group ID",
+          "organisationId": "Organisation ID",
+          "mediaKey": "Media key",
+          "audit": "Audit information"
+        },
+        "filters": {
+          "categories": "Categories",
+          "from": "From",
+          "to": "To",
+          "sort": "Sort markers"
+        },
+        "sort": {
+          "latest": "Latest first",
+          "oldest": "Oldest first",
+          "nameAsc": "Name A-Z",
+          "nameDesc": "Name Z-A"
+        },
+        "table": {
+          "timestamp": "Timestamp",
+          "marker": "Marker",
+          "categories": "Categories",
+          "device": "Device",
+          "duration": "Duration",
+          "source": "Source",
+          "signals": "Events & tags",
+          "events": "Events",
+          "tags": "Tags",
+          "confidence": "Confidence",
+          "media": "Recording"
+        },
+        "noResults": {
+          "title": "No markers found",
+          "description": "Adjust the filters or search for another marker name."
+        },
+        "pagination": {
+          "showing": "Showing {{start}}-{{end}}",
+          "rows": "Rows",
+          "previous": "Previous",
+          "next": "Next",
+          "page": "Page {{page}}"
+        }
+      },
       "noAlerts": {
         "description": "Create an alert or enable existing ones to start receiving analytics.",
         "button": "Alerts"
@@ -340,6 +729,19 @@
       "placeholderDescription": "To create your first case go to the media section, and select a media item. Create a new case and assign it to the relevant person.",
       "goToMedia": "Go to Media",
       "myCases": "My cases",
+      "loadError": "Something went wrong while loading the case. Please try again.",
+      "autoplayNextOn": "Autoplay next: On",
+      "autoplayNextOff": "Autoplay next: Off",
+      "mediaProcessing": "Processing",
+      "mediaFailed": "Failed",
+      "a11y": {
+        "toggleCase": "Toggle case details",
+        "statusOpen": "Case status: open",
+        "statusApproved": "Case status: approved",
+        "statusRejected": "Case status: rejected",
+        "loadingCases": "Loading cases",
+        "caseThumbnail": "Case thumbnail"
+      },
       "actions": {
         "reopenCase": "Reopen case",
         "approveCase": "Approve case",
@@ -351,11 +753,23 @@
         "generateExport": "Generate export",
         "regenerateExport": "Generate export",
         "exportInProgress": "Generating export…",
+        "exportStuck": "Export stuck — Retry",
+        "exportStuckTitle": "Export hasn't reported progress for over 2 minutes. Click to force a retry.",
+        "exportRetryConfirmTitle": "Force retry export?",
+        "exportRetryConfirmText": "This export hasn't reported progress for more than two minutes. Forcing a retry will discard the current run and start a new one.",
+        "exportRetryConfirmButton": "Force retry",
+        "exportRetryCancelButton": "Cancel",
+        "exportStatusGenerating": "Generating export…",
+        "exportStatusUnresponsive": "Export not responding",
+        "exportStatusFailed": "Export failed",
+        "exportStatusStale": "Export out of date",
+        "exportStatusReady": "Export ready",
         "shareCase": "Share case",
         "deleteCase": "Delete case",
         "download": "Download",
         "delete": "Delete",
-        "openDetail": "Open detail"
+        "openDetail": "Open detail",
+        "runWorkflow": "Run workflow"
       },
       "exportSelection": {
         "title": "Export selection",
@@ -367,6 +781,16 @@
         "emptyAttachments": "This case has no attachments yet.",
         "attachmentsHeading": "Attachments"
       },
+      "runWorkflow": {
+        "title": "Run workflow",
+        "subtitle": "Launch a workflow over selected media on this case.",
+        "workflowLabel": "Workflow",
+        "loading": "Loading workflows…",
+        "noWorkflows": "No workflows are available to run on cases.",
+        "attachmentsSelected": "attachments selected",
+        "attachmentBadge": "Attachment",
+        "submit": "Run workflow"
+      },
       "filter": {
         "assignees": "Assignees",
         "labels": "Labels",
@@ -541,6 +965,8 @@
       "filter": {
         "date": "Date",
         "region": "Region",
+        "regionExcluded": "Not in results",
+        "regionExcludedHint": "No region drawn on this camera, so it is left out of the results. Draw a region to include it again.",
         "categories": "Categories",
         "markers": "Markers",
         "events": "Events",
@@ -548,7 +974,15 @@
         "newest": "Newest",
         "oldest": "Oldest",
         "showAllRecordings": "Show all recordings",
-        "showStarredRecordings": "Show starred recordings only"
+        "showStarredRecordings": "Show starred recordings only",
+        "synchronisedPlayer": "Synchronised player",
+        "synchronisedPlayerHint": "Play all recordings of the selected region, one player per camera",
+        "synchronisedPlayerRequirement": "Select a time region of maximum 60 minutes on the timeline to enable the synchronised player",
+        "synchronisedPlayerPlay": "Play",
+        "synchronisedPlayerPause": "Pause",
+        "synchronisedPlayerNoFootage": "No recording at this moment",
+        "synchronisedPlayerEmpty": "No playable recordings found in the selected time region.",
+        "timelinePreviewPlayVideo": "Play video"
       },
       "emptyState": {
         "selectDayAndDevice": "Select day and device",
@@ -564,8 +998,12 @@
       "timeline": {
         "title": "Timeline",
         "clearSelectedTime": "Clear selected time",
+        "selectionStart": "Start of the selected time range",
+        "selectionEnd": "End of the selected time range",
         "fetching": "Fetching timeline rows for selected devices.",
-        "noRecordings": "No recordings are available for the selected date and devices."
+        "noRecordings": "No recordings are available for the selected date and devices.",
+        "resizeHint": "Drag to resize the timeline",
+        "rowHeight": "Drag to change the height of the recording bars"
       },
       "chart": {
         "title": "Chart",
@@ -586,8 +1024,13 @@
         "copyVideoUrl": "Copy Video URL",
         "verifyVideo": "Verify video",
         "shareRecording": "Share Recording",
+        "runWorkflow": "Run workflow",
+        "runWorkflowSubtitle": "Choose a workflow to run on this recording.",
+        "noMediaWorkflows": "No workflows are available for recordings.",
         "newCase": "New case",
         "addToCase": "Add to case",
+        "assignToCase": "Assign to case",
+        "caseActions": "Case actions",
         "share": "Share",
         "save": "Save",
         "loading": "Loading...",
@@ -1603,7 +2046,8 @@
           "k10": "or use the upload button below",
           "k11": "Delete attachment",
           "k12": "Are you sure you want to delete this attachment? This action cannot be undone.",
-          "k13": "Yes, delete"
+          "k13": "Yes, delete",
+          "k14": "Redact"
         }
       },
       "media": {
@@ -1663,7 +2107,7 @@
             "blocks": {
               "face_redaction": {
                 "face_redaction": {
-                  "k1": "Edit video",
+                  "k1": "Redact video",
                   "k2": "Edit video tools",
                   "k3": "This editing tool is coming soon.",
                   "k4": "No detections available",
@@ -1676,7 +2120,10 @@
                   "k11": "Forward 1 second",
                   "k12": "Frames per second for redaction",
                   "k13": "Frames per second",
-                  "k14": "fps"
+                  "k14": "fps",
+                  "k15": "Detection run",
+                  "k16": "Select a detection run",
+                  "k17": "No detections"
                 }
               },
               "motionmap": {
@@ -1902,13 +2349,15 @@
           "k62": "Expiry date",
           "k63": "Open update access token",
           "k64": "No access tokens found",
-          "k65": "date, time",
+          "k65": "time",
           "k66": "ip",
-          "k67": "browser",
-          "k68": "os",
+          "k67": "device",
+          "k68": "status",
           "k69": "No login history found.",
           "k70": "My account",
-          "k71": "Manage your profile, billing methods and invoices"
+          "k71": "Manage your profile, billing methods and invoices",
+          "k72": "Success",
+          "k73": "Failed"
         }
       },
       "roles": {
@@ -2806,7 +3255,22 @@
             "k14": "Device Idle",
             "k15": "The agent is online, but the device stream seems to be offline",
             "k16": "No permissions",
-            "k17": "You aren't allowed to view this livestream."
+            "k17": "You aren't allowed to view this livestream.",
+            "k18": "Record",
+            "k19": "Recording",
+            "k20": "REC",
+            "k21": "Stop recording",
+            "k22": "Camera is set to continuous recording",
+            "k23": "Show motion detection",
+            "k24": "Hide motion detection",
+            "k25": "Recent recordings",
+            "k26": "No recordings available",
+            "k27": "Back 5 seconds",
+            "k28": "Play",
+            "k29": "Pause",
+            "k30": "Forward 5 seconds",
+            "k31": "Previous time window",
+            "k32": "Next time window"
           }
         },
         "tags": {
@@ -2866,6 +3330,13 @@
             "k3": "End time"
           }
         },
+        "time_spinner": {
+          "time_spinner": {
+            "hours": "Hours",
+            "minutes": "Minutes",
+            "seconds": "Seconds"
+          }
+        },
         "video_js": {
           "video_js": {
             "k1": "To view this video please enable JavaScript, and consider upgrading to a web browser that",

charts/hub/custom-layout/templates/device.html

@@ -225,7 +225,7 @@
                                         margin-bottom: 0;
                                         padding-bottom: 0;
                                         padding-left: 0;
-                                        padding-right: 0;">One of your Agents changed</h2>
+                                        padding-right: 0;">One of your Kerberos Agents changed</h2>
                         <h2 style=" font-family: Inter;
                                         font-size: 20px;
                                         font-style: normal;
@@ -265,7 +265,7 @@
                                         letter-spacing: 0em;
                                         text-align: left;
                                         color: #262424;
-                                        width: 480px">The status your Agent changed</h3>
+                                        width: 480px">The status your Kerberos Agent changed</h3>
                         <p style=" font-family: Inter;
                                         font-size: 14px;
                                         font-style: normal;
@@ -275,8 +275,8 @@
                                         letter-spacing: 0em;
                                         text-align: left;
                                         color: #6D6666;
-                                        margin-top: 12px;">Agents go offline due to a variety of reasons. The machine, node, micro controller on which your Agent runs, gets corrupted or disconnected from the internet.
-The camera itself is broken, damaged or in the worst case tampered. Have a look into your Kerberos Hub account for the latest recordings and/or verify the connection and status of your Agent.</p>
+                                        margin-top: 12px;">Kerberos Agents go offline due to a variety of reasons. The machine, node, micro controller on which your Kerberos Agent runs, gets corrupted or disconnected from the internet.
+The camera itself is broken, damaged or in the worst case tampered. Have a look into your Kerberos Hub account for the latest recordings and/or verify the connection and status of your Kerberos Agent.</p>
 
 						<a style="text-decoration: none;color: none;" href="{{link}}">
                             <p style="font-family: Inter;

charts/hub/custom-layout/templates/disable.html

@@ -286,7 +286,7 @@ Tomorrow your account will be reset, and recordings will be uploaded again to yo
                                         letter-spacing: 0em;
                                         text-align: left;
                                         color: #6D6666;
-                                        margin-top: 12px;">If you are hitting your daily limits a lot, you might consider upgrading your Kerberos Hub subscription, or fine-tune your Agents so they record less recordings.</p>
+                                        margin-top: 12px;">If you are hitting your daily limits a lot, you might consider upgrading your Kerberos Hub subscription, or fine-tune your Kerberos Agents so they record less recordings.</p>
 
 						<a style="text-decoration: none;color: none;" href="{{link}}">
                             <p style="font-family: Inter;

charts/hub/custom-layout/templates/highupload.html

@@ -225,7 +225,7 @@
                                         margin-bottom: 0;
                                         padding-bottom: 0;
                                         padding-left: 0;
-                                        padding-right: 0;">High upload detected by one or more Agents</h2>
+                                        padding-right: 0;">High upload detected by one or more Kerberos Agents</h2>
                     </td>
                     <td class="corner-td" align="right"></td>
                 </tr>

charts/hub/custom-layout/templates/share_case.html

@@ -0,0 +1,418 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta
+            name="viewport"
+            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
+    />
+    <meta name="description" content="Kerberos.io Mailing">
+    <style type="text/css">
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 400;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 500;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 600;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter var';
+            font-weight: 100 900;
+            font-display: swap;
+            font-style: normal;
+            font-named-instance: 'Regular';
+            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
+        }
+
+        body{
+            background: #E5E5E5;
+            margin-top:0;
+            margin-bottom: 0;
+            margin-right: 0;
+            margin-left: 0;
+            padding-top: 0;
+            padding-left: 0;
+            padding-right: 0;
+            padding-bottom: 0;
+            font-family: 'Inter';
+        }
+        a, a:hover, a:active {
+            color: #262424;
+            text-decoration: none;
+        }
+
+        .corner-td{
+            width: 60px;
+        }
+
+        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
+        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
+        .ExternalClass {width: 100%;}
+        @media screen and (max-width:500px){
+            .tab-td{
+                padding-left: 10px!important;
+            }
+            .tab-td a h4{
+                font-size: 14px!important;
+            }
+            .corner-td{
+                width: 20px!important;
+            }
+            .company-name-td h3{
+                font-size: 16px!important;
+            }
+            table.header-table{
+                padding-top: 8px!important;
+                padding-right: 0px!important;
+                padding-bottom: 24px!important;
+                padding-left: 0px!important;
+            }
+            .colored-card-td  h4{
+                font-size: 14px!important;
+            }
+            .colored-card-td  h2{
+                font-size: 20px!important;
+            }
+            .colored-card-td  a p{
+                font-size: 12px!important;
+                width: 143px!important;
+            }
+            .colored-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td h3{
+                font-size: 18px!important;
+            }
+            .colorless-card-td p{
+                font-size: 14px!important;
+            }
+            .colorless-card-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 24px!important;
+                margin-bottom: 24px!important;
+            }
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:600px) {
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:650px) {
+            .footer-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 0px!important;
+                margin-bottom: 36px!important;
+            }
+        }
+    </style>
+</head>
+<body height="100%" width="100%">
+<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td height="36" align="left" class="company-name-td">
+                        <h3  width="36" height="36" style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;">Kerberos.io</h3>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
+                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab1_title}}</h4>
+                        </a>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
+                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab2_title}}</h4>
+                        </a>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
+                        <h2 style=" font-family: Inter;
+                                        font-size: 24px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 12px;
+                                        margin-bottom: 0;
+                                        padding-bottom: 0;
+                                        padding-left: 0;
+                                        padding-right: 0;">A case has been shared with you</h2>
+                        <h4 style="font-family: Inter;
+                                        font-size: 16px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#b09fb9;">{{user}} shared a case with you</h4>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
+                        <h3 style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;
+                                        width: 280px">Open the shared case</h3>
+                        <p style=" font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #6D6666;
+                                        margin-top: 12px;">{{user}} has shared a case with you. Click the button below to open it. You'll be asked to request a one-time verification code from the share page itself.<br/><br/>This link will expire in {{expiry}}.</p>
+
+
+						<a style="text-decoration: none;color: none;" href="{{url}}">
+                            <p style="font-family: Inter;
+                                                font-size: 14px;
+                                                font-style: normal;
+                                                line-height: 24px;
+                                                mso-line-height-rule:exactly;
+                                                letter-spacing: 0em;
+                                                text-align: left;
+                                                color:#FFFFFF;
+                                                background-color: #84559F;
+                                                padding-top: 6px;
+                                                padding-bottom: 6px;
+                                                padding-right: 16px;
+                                                padding-left: 16px;
+                                                width: 130px;
+                                                border-radius: 4px;
+												text-align: center;
+                                                cursor: pointer;">Open case -></p>
+                        </a>
+					</td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">Get in touch</h4>
+                                    <a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 16px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">support@kerberos.io</p>
+                                    </a>
+                                    <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                    line-height: 16px;
+                                    mso-line-height-rule:exactly;
+                                    letter-spacing: 0em;
+                                    text-align: left;
+                                    color: #A69D9D;">9000 Ghent, BE</p>
+
+                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 24px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">https://kerberos.io</p>
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">About Kerberos</h4>
+                                    <p style=" font-family: Inter;
+                                                        font-size: 14px;
+                                                        font-style: normal;
+                                                        font-weight: 400;
+                                                        line-height: 24px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
+                                                        
+                                    
+                                    <p style="margin-top: 12px;">
+                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
+                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
+                                        </a>
+                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
+                                        </a>
+                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
+                                        </a>
+                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
+                                        </a>
+                                    </p>                
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                    <tr style="height: 50px">
+                        <td></td>
+                    </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+</body>
+</html>

charts/hub/custom-layout/templates/share_case.txt

@@ -0,0 +1,21 @@
+Kerberos.io
+------------
+
+A case has been shared with you
+{{user}} shared a case with you
+
+Open the shared case
+{{user}} has shared a case with you. Open the link below to access it — you'll be asked to request a one-time verification code from the share page.
+{{url}}
+
+This link will expire in {{expiry}}.
+
+Get in touch
+------------
+support@kerberos.io
+9000 Ghent, BE
+https://kerberos.io
+
+About Kerberos
+------------
+Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/custom-layout/templates/share_case_otp.html

@@ -0,0 +1,425 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta
+            name="viewport"
+            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
+    />
+    <meta name="description" content="Kerberos.io Mailing">
+    <style type="text/css">
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 400;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 500;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 600;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter var';
+            font-weight: 100 900;
+            font-display: swap;
+            font-style: normal;
+            font-named-instance: 'Regular';
+            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
+        }
+
+        body{
+            background: #E5E5E5;
+            margin-top:0;
+            margin-bottom: 0;
+            margin-right: 0;
+            margin-left: 0;
+            padding-top: 0;
+            padding-left: 0;
+            padding-right: 0;
+            padding-bottom: 0;
+            font-family: 'Inter';
+        }
+        a, a:hover, a:active {
+            color: #262424;
+            text-decoration: none;
+        }
+
+        .corner-td{
+            width: 60px;
+        }
+
+        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
+        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
+        .ExternalClass {width: 100%;}
+        @media screen and (max-width:500px){
+            .tab-td{
+                padding-left: 10px!important;
+            }
+            .tab-td a h4{
+                font-size: 14px!important;
+            }
+            .corner-td{
+                width: 20px!important;
+            }
+            .company-name-td h3{
+                font-size: 16px!important;
+            }
+            table.header-table{
+                padding-top: 8px!important;
+                padding-right: 0px!important;
+                padding-bottom: 24px!important;
+                padding-left: 0px!important;
+            }
+            .colored-card-td  h4{
+                font-size: 14px!important;
+            }
+            .colored-card-td  h2{
+                font-size: 20px!important;
+            }
+            .colored-card-td  a p{
+                font-size: 12px!important;
+                width: 143px!important;
+            }
+            .colored-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td h3{
+                font-size: 18px!important;
+            }
+            .colorless-card-td p{
+                font-size: 14px!important;
+            }
+            .colorless-card-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 24px!important;
+                margin-bottom: 24px!important;
+            }
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:600px) {
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:650px) {
+            .footer-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 0px!important;
+                margin-bottom: 36px!important;
+            }
+        }
+    </style>
+</head>
+<body height="100%" width="100%">
+<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td height="36" align="left" class="company-name-td">
+                        <h3  width="36" height="36" style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;">Kerberos.io</h3>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
+                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab1_title}}</h4>
+                        </a>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
+                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab2_title}}</h4>
+                        </a>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
+                        <h2 style=" font-family: Inter;
+                                        font-size: 24px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 12px;
+                                        margin-bottom: 0;
+                                        padding-bottom: 0;
+                                        padding-left: 0;
+                                        padding-right: 0;">Verify your access</h2>
+                        <h4 style="font-family: Inter;
+                                        font-size: 16px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#b09fb9;">Use the code below to open the shared case</h4>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
+                        <h3 style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;
+                                        width: 280px">Your verification code</h3>
+                        <p style=" font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #6D6666;
+                                        margin-top: 12px;">Enter the code below on the share page to access the case.</p>
+
+                        <p style="font-family: 'Courier New', Courier, monospace;
+                                        font-size: 32px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 40px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 8px;
+                                        text-align: center;
+                                        color:#262424;
+                                        background-color: #F2F0F4;
+                                        padding-top: 16px;
+                                        padding-bottom: 16px;
+                                        padding-right: 16px;
+                                        padding-left: 16px;
+                                        margin-top: 16px;
+                                        margin-bottom: 16px;
+                                        border-radius: 4px;">{{code}}</p>
+
+                        <p style=" font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #6D6666;">This code expires in {{expiry}}. If you didn't request this, you can safely ignore this email.</p>
+					</td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">Get in touch</h4>
+                                    <a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 16px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">support@kerberos.io</p>
+                                    </a>
+                                    <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                    line-height: 16px;
+                                    mso-line-height-rule:exactly;
+                                    letter-spacing: 0em;
+                                    text-align: left;
+                                    color: #A69D9D;">9000 Ghent, BE</p>
+
+                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 24px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">https://kerberos.io</p>
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">About Kerberos</h4>
+                                    <p style=" font-family: Inter;
+                                                        font-size: 14px;
+                                                        font-style: normal;
+                                                        font-weight: 400;
+                                                        line-height: 24px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
+                                                        
+                                    
+                                    <p style="margin-top: 12px;">
+                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
+                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
+                                        </a>
+                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
+                                        </a>
+                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
+                                        </a>
+                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
+                                        </a>
+                                    </p>                
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                    <tr style="height: 50px">
+                        <td></td>
+                    </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+</body>
+</html>

charts/hub/custom-layout/templates/share_case_otp.txt

@@ -0,0 +1,21 @@
+Kerberos.io
+------------
+
+Verify your access
+Use the code below to open the shared case
+
+Your verification code
+{{code}}
+
+Enter this code on the share page to access the case. This code expires in {{expiry}}.
+If you didn't request this, you can safely ignore this email.
+
+Get in touch
+------------
+support@kerberos.io
+9000 Ghent, BE
+https://kerberos.io
+
+About Kerberos
+------------
+Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/examples/catalogs/pose-keypoints.json

@@ -0,0 +1,5 @@
+[
+  {"key": "nose", "label": "Nose"},
+  {"key": "left_shoulder", "label": "Left shoulder"},
+  {"key": "right_shoulder", "label": "Right shoulder"}
+]

charts/hub/examples/workflow-configuration-overrides-values.yaml

@@ -0,0 +1,25 @@
+# Create these ConfigMaps in the release namespace before deploying the chart.
+# Keys contain complete contracts/catalogs; they are not merged with chart data.
+# Remove the retired classificationCatalog key from every values overlay.
+# Do not also set classificationCatalogExistingConfigMap.
+classificationCatalogEnabled: true
+workflowConfiguration:
+  enabled: true
+  includeDefaults: true
+  configMaps:
+    - name: deployment-workflow-overrides
+      items:
+        - key: start.yaml
+          path: workflow-contracts/start.yaml
+          replace: true
+        - key: deployment-classifications.json
+          path: catalogs/classifications.json
+          replace: true
+    - name: custom-workflow-contracts
+      items:
+        - key: pose.yaml
+          path: workflow-contracts/pose.yaml
+    - name: shared-pose-catalog
+      items:
+        - key: pose-keypoints.json
+          path: catalogs/pose-keypoints.json

charts/hub/examples/workflow-configuration-values.yaml

@@ -0,0 +1,13 @@
+# Packaging only; does not activate contract loading or deploy a pose worker.
+workflowConfiguration:
+  enabled: true
+  includeDefaults: true
+  configMaps:
+    - name: custom-workflow-contracts
+      items:
+        - key: pose.yaml
+          path: workflow-contracts/pose.yaml
+    - name: shared-pose-catalog
+      items:
+        - key: pose-keypoints.json
+          path: catalogs/pose-keypoints.json

charts/hub/examples/workflow-contracts/pose.yaml

@@ -0,0 +1,53 @@
+# yaml-language-server: $schema=../../schemas/workflow-contract.schema.json
+# Hypothetical custom worker output; not an installed stage or universal pose schema.
+schemaVersion: 1
+stage: pose
+contractVersion: 1
+presentation:
+  name: Detect poses
+  description: Estimate body keypoints and posture for people in the recording.
+  icon: person
+  color: teal
+# Settings authors enter per node; the worker receives them as node data.
+params:
+  - name: minConfidence
+    label: Minimum keypoint confidence
+    type: number
+    default: 0.5
+  - name: model
+    label: Model
+    type: select
+    options: [fast, accurate]
+    optionLabels: {fast: Fast, accurate: Accurate}
+    default: fast
+fields:
+  - id: keypoint
+    label: Keypoint
+    path: people.*.keypoints.*.name
+    type: string
+    operators: [in]
+    choices:
+      file: ../catalogs/pose-keypoints.json
+  - id: posture
+    label: Posture
+    path: people.*.posture
+    type: string
+    operators: [in]
+    choices:
+      values: [standing, sitting, lying]
+  - id: confidence
+    label: Keypoint confidence
+    path: people.*.keypoints.*.confidence
+    type: number
+    operators: [gt, gte, lt, lte]
+    minimum: 0
+    maximum: 1
+# Connections leaving this stage: one section with fixed inputs, then the
+# Extra conditions catch-all (appended collapsed when not placed explicitly).
+panel:
+  sections:
+    - id: posture
+      label: Posture
+      fields:
+        - {field: posture, widget: multiselect}
+        - {field: confidence, widget: number, operator: gte, label: Minimum confidence}

charts/hub/schemas/catalog.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Hub shared choice catalog v1",
+  "description": "Compatible with the existing classification JSON format. Keys must be unique; no references to other catalogs.",
+  "type": "array",
+  "minItems": 1,
+  "items": {
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["key", "label"],
+    "properties": {
+      "key": {"type": "string", "minLength": 1},
+      "label": {"type": "string", "minLength": 1},
+      "icon": {"type": "string", "minLength": 1}
+    }
+  }
+}

charts/hub/schemas/workflow-contract.schema.json

@@ -0,0 +1,321 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Hub workflow editor contract v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "stage", "contractVersion", "fields"],
+  "properties": {
+    "schemaVersion": {"const": 1},
+    "stage": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]*$",
+      "description": "Stage type, not a node instance. start describes initial context."
+    },
+    "contractVersion": {"const": 1},
+    "presentation": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "How the editor shows this node. Icons and colours come from approved sets.",
+      "properties": {
+        "name": {"type": "string", "minLength": 1, "maxLength": 80},
+        "description": {"type": "string", "minLength": 1, "maxLength": 500},
+        "icon": {"enum": ["play", "camera", "person", "eye-crossed", "car", "clock", "mlModel", "share"]},
+        "color": {
+          "enum": ["blue", "teal", "rose", "amber", "indigo", "violet", "green", "grey"],
+          "description": "Theme colour token."
+        }
+      }
+    },
+    "params": {
+      "type": "array",
+      "maxItems": 64,
+      "description": "Worker-stage settings authors enter, stored per node. An explicit list (even empty) replaces kerberoshub.workflows.editorStages params. Not supported on start.",
+      "items": {"$ref": "#/definitions/param"}
+    },
+    "fields": {
+      "type": "array",
+      "description": "Typed values conditions may test. Start: the selectors device, sites, groups and classifications plus condition-only fields whose path exists in the condition root schema (models.WorkflowConditionRootSchema), e.g. device.deviceName or inputs.classify.details.*.isStatic; other inputs.<operation> paths are worker-defined. Stage: outputs relative to results.<stage>. New conditions may only use declared fields. An empty array is valid.",
+      "items": {"$ref": "#/definitions/field"},
+      "maxItems": 128
+    },
+    "controls": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "label"],
+        "properties": {
+          "id": {"enum": ["weeklySchedule", "conditions"]},
+          "label": {"type": "string", "minLength": 1}
+        }
+      },
+      "description": "Start only. Controls offered for new authoring; omitted offers none. conditions applies to edges leaving Start.",
+      "maxItems": 16
+    },
+    "triggerModes": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {"enum": ["automatic", "manual"]},
+      "description": "Start only. Trigger modes offered for new authoring; omitted offers both."
+    },
+    "panel": {"$ref": "#/definitions/panel"}
+  },
+  "definitions": {
+    "choices": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "source": {
+          "type": "string",
+          "description": "Built-in authorized project-resource resolver; not a database path.",
+          "oneOf": [
+            {
+              "const": "project.devices",
+              "description": "Device keys as values, device names as labels."
+            },
+            {"const": "project.sites", "description": "Site IDs as values, site names as labels."},
+            {
+              "const": "project.groups",
+              "description": "Group IDs as values, group names as labels."
+            }
+          ]
+        },
+        "file": {
+          "type": "string",
+          "pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$",
+          "description": "Direct shared catalog file relative to the contract; no URLs or nested references."
+        },
+        "values": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"type": ["string", "number", "boolean"]}
+        }
+      },
+      "oneOf": [{"required": ["source"]}, {"required": ["file"]}, {"required": ["values"]}]
+    },
+    "field": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "label", "path", "type", "operators"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[A-Za-z][A-Za-z0-9_-]*$",
+          "description": "Stable identifier, unique within this contract."
+        },
+        "label": {"type": "string", "minLength": 1},
+        "path": {
+          "type": "string",
+          "pattern": "^[A-Za-z_][A-Za-z0-9_-]*(\\.(\\*|[A-Za-z_][A-Za-z0-9_-]*))*$",
+          "description": "Safe Start-context path, or relative path inside this node instance's output. Wildcards select scalar candidates."
+        },
+        "type": {"enum": ["string", "integer", "number", "boolean"]},
+        "operators": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches", "gt", "gte", "lt", "lte"]}
+        },
+        "optional": {
+          "type": "boolean",
+          "default": false,
+          "description": "Field may be absent even when the node completes; branch availability is determined separately."
+        },
+        "minimum": {"type": "number"},
+        "maximum": {"type": "number"},
+        "choices": {"$ref": "#/definitions/choices"}
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"type": {"const": "string"}}},
+          "then": {
+            "properties": {
+              "operators": {"items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches"]}},
+              "choices": {"properties": {"values": {"items": {"type": "string"}}}}
+            },
+            "not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "boolean"}}},
+          "then": {
+            "properties": {
+              "operators": {"items": {"enum": ["eq", "ne", "in", "exists"]}},
+              "choices": {"properties": {"values": {"items": {"type": "boolean"}}}}
+            },
+            "not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
+          }
+        },
+        {
+          "if": {"properties": {"type": {"enum": ["integer", "number"]}}},
+          "then": {
+            "properties": {
+              "operators": {"items": {"enum": ["eq", "ne", "in", "exists", "gt", "gte", "lt", "lte"]}},
+              "choices": {"properties": {"values": {"items": {"type": "number"}}}}
+            }
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "integer"}}},
+          "then": {"properties": {"choices": {"properties": {"values": {"items": {"type": "integer"}}}}}}
+        },
+        {
+          "if": {"properties": {"type": {"enum": ["integer", "number", "boolean"]}}},
+          "then": {
+            "properties": {"choices": {"not": {"anyOf": [{"required": ["file"]}, {"required": ["source"]}]}}}
+          }
+        }
+      ]
+    },
+    "param": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "type"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[A-Za-z][A-Za-z0-9_]*$",
+          "maxLength": 64,
+          "description": "Key in node data; unique within the contract."
+        },
+        "label": {"type": "string", "minLength": 1, "maxLength": 160},
+        "description": {"type": "string", "minLength": 1, "maxLength": 500},
+        "group": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 80,
+          "description": "Editor section; params sharing a group appear together."
+        },
+        "placeholder": {"type": "string", "minLength": 1, "maxLength": 160},
+        "type": {"enum": ["string", "number", "boolean", "select", "multiselect", "secret"]},
+        "required": {"type": "boolean"},
+        "default": {
+          "description": "Value the editor pre-fills and the API stores when a node leaves the setting unset; never for secrets. Typically the worker's own default."
+        },
+        "options": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": {"type": "string", "minLength": 1, "maxLength": 160}
+        },
+        "optionLabels": {
+          "type": "object",
+          "additionalProperties": {"type": "string", "minLength": 1, "maxLength": 160}
+        },
+        "minimum": {"type": "number", "description": "Inclusive lower bound for a number setting."},
+        "maximum": {"type": "number", "description": "Inclusive upper bound for a number setting."},
+        "choices": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["file"],
+          "properties": {
+            "file": {"type": "string", "pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$"}
+          },
+          "description": "Options for a select or multiselect setting from a shared catalog file (keys become options, labels become optionLabels). Use instead of options."
+        }
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"type": {"enum": ["select", "multiselect"]}}},
+          "then": {"oneOf": [{"required": ["options"]}, {"required": ["choices"]}]},
+          "else": {
+            "not": {
+              "anyOf": [{"required": ["options"]}, {"required": ["optionLabels"]}, {"required": ["choices"]}]
+            }
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "secret"}}},
+          "then": {"not": {"required": ["default"]}}
+        },
+        {
+          "if": {"properties": {"type": {"enum": ["string", "select"]}}},
+          "then": {"properties": {"default": {"type": "string"}}}
+        },
+        {
+          "if": {"properties": {"type": {"const": "multiselect"}}},
+          "then": {
+            "properties": {"default": {"type": "array", "items": {"type": "string"}, "uniqueItems": true}}
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "number"}}},
+          "then": {"properties": {"default": {"type": "number"}}},
+          "else": {"not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}}
+        },
+        {
+          "if": {"properties": {"type": {"const": "boolean"}}},
+          "then": {"properties": {"default": {"type": "boolean"}}}
+        }
+      ]
+    },
+    "panel": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sections"],
+      "description": "Layout of connections leaving this node. Without it, a default panel is used. A section with picker: true positions the Extra conditions catch-all; without one it is appended collapsed. On start, a panel replaces the top-level controls list.",
+      "properties": {
+        "sections": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 16,
+          "items": {"$ref": "#/definitions/panelSection"}
+        }
+      }
+    },
+    "panelSection": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "label"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_-]*$", "maxLength": 80},
+        "label": {"type": "string", "minLength": 1, "maxLength": 160},
+        "collapsed": {"type": "boolean"},
+        "picker": {
+          "type": "boolean",
+          "description": "This section is the Extra conditions catch-all over every declared field of Start and upstream stages; it holds no fields or controls."
+        },
+        "controls": {
+          "type": "array",
+          "items": {"const": "weeklySchedule"},
+          "maxItems": 1,
+          "description": "Start only."
+        },
+        "fields": {"type": "array", "maxItems": 32, "items": {"$ref": "#/definitions/panelField"}}
+      },
+      "if": {"properties": {"picker": {"const": true}}, "required": ["picker"]},
+      "then": {"not": {"anyOf": [{"required": ["fields"]}, {"required": ["controls"]}]}}
+    },
+    "panelField": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["field", "widget"],
+      "properties": {
+        "field": {
+          "type": "string",
+          "description": "ID of a field declared in this contract; each field is placed at most once."
+        },
+        "label": {"type": "string", "minLength": 1, "maxLength": 160},
+        "widget": {
+          "enum": ["multiselect", "select", "text", "number", "toggle"],
+          "description": "multiselect: string with choices (in); select: choices (eq, ne); text: string (eq, contains, matches, ne, in); number: integer or number (gte, gt, lte, lt, eq, ne); toggle: boolean (eq, ne)."
+        },
+        "operator": {
+          "enum": ["eq", "ne", "in", "contains", "matches", "gt", "gte", "lt", "lte"],
+          "description": "Fixed operator; must be declared by the field and supported by the widget. Defaults to the first widget operator the field declares."
+        }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": {"properties": {"stage": {"const": "start"}}, "required": ["stage"]},
+      "then": {"not": {"required": ["params"]}},
+      "else": {"not": {"anyOf": [{"required": ["controls"]}, {"required": ["triggerModes"]}]}}
+    },
+    {"if": {"required": ["panel"]}, "then": {"not": {"required": ["controls"]}}}
+  ]
+}

charts/hub/templates/_configuration.tpl

@@ -0,0 +1,120 @@
+{{- define "hub.workflowConfiguration.bundledPaths" -}}
+{{- list "workflow-contracts/start.yaml" "workflow-contracts/anpr.yaml" "workflow-contracts/forwarder.yaml" "catalogs/classifications.json" | toYaml -}}
+{{- end -}}
+
+{{- define "hub.workflowConfiguration.anpr.configMapName" -}}
+{{- printf "%s-workflow-contract-anpr" (.Release.Name | trunc 40 | trimSuffix "-") -}}
+{{- end -}}
+
+{{- define "hub.workflowConfiguration.forwarder.configMapName" -}}
+{{- printf "%s-workflow-contract-forwarder" (.Release.Name | trunc 40 | trimSuffix "-") -}}
+{{- end -}}
+
+{{- define "hub.classificationCatalog.configMapName" -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- $replacement := index $config.replacements "catalogs/classifications.json" | default dict -}}
+{{- if $replacement -}}
+{{- $replacement.name -}}
+{{- else -}}
+{{- default "classification-catalog" .Values.classificationCatalogExistingConfigMap -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Normalize both interfaces without changing the caller's values. */}}
+{{- define "hub.workflowConfiguration.settings" -}}
+{{- if hasKey .Values "classificationCatalog" -}}
+{{- fail "classificationCatalog is no longer supported; remove the values key and place the complete catalog in a ConfigMap, then use workflowConfiguration.configMaps with path: catalogs/classifications.json and replace: true" -}}
+{{- end -}}
+{{- $config := .Values.workflowConfiguration | default dict -}}
+{{- $unified := or (hasKey $config "includeDefaults") (hasKey $config "configMaps") -}}
+{{- $legacy := or (hasKey $config "existingConfigMap") (hasKey $config "items") (hasKey $config "extraConfigMaps") -}}
+{{- if and $unified $legacy -}}
+{{- fail "workflowConfiguration cannot mix includeDefaults/configMaps with existingConfigMap/items/extraConfigMaps" -}}
+{{- end -}}
+{{- $includeDefaults := true -}}
+{{- $sources := $config.extraConfigMaps | default list -}}
+{{- if $unified -}}
+{{- $sources = $config.configMaps | default list -}}
+{{- if hasKey $config "includeDefaults" -}}
+{{- $includeDefaults = $config.includeDefaults -}}
+{{- end -}}
+{{- else -}}
+{{- if $config.existingConfigMap -}}
+{{- if and $config.enabled (not $config.items) -}}
+{{- fail "workflowConfiguration.items is required with existingConfigMap" -}}
+{{- end -}}
+{{- $includeDefaults = false -}}
+{{- $sources = prepend $sources (dict "name" $config.existingConfigMap "items" ($config.items | default list)) -}}
+{{- else if and $config.enabled $config.items -}}
+{{- fail "workflowConfiguration.items requires existingConfigMap" -}}
+{{- end -}}
+{{- end -}}
+{{- $enabled := $config.enabled | default false -}}
+{{- $replacements := dict -}}
+{{- $normalizedSources := list -}}
+{{- $bundledPaths := include "hub.workflowConfiguration.bundledPaths" . | fromYamlArray -}}
+{{- range $sources -}}
+{{- $name := .name -}}
+{{- $items := list -}}
+{{- range .items -}}
+{{- if and $enabled .replace -}}
+{{- if or (not $unified) (not $includeDefaults) -}}
+{{- fail "workflowConfiguration item replace: true requires configMaps with includeDefaults: true" -}}
+{{- end -}}
+{{- if not (has .path $bundledPaths) -}}
+{{- fail (printf "workflowConfiguration item replace: true targets unknown bundled path %q" .path) -}}
+{{- end -}}
+{{- if hasKey $replacements .path -}}
+{{- fail (printf "duplicate workflowConfiguration replacement path %q" .path) -}}
+{{- end -}}
+{{- $_ := set $replacements .path (dict "name" $name "key" .key) -}}
+{{- end -}}
+{{- $items = append $items (omit . "replace") -}}
+{{- end -}}
+{{- $normalizedSources = append $normalizedSources (dict "name" $name "items" $items) -}}
+{{- end -}}
+{{- if hasKey $replacements "catalogs/classifications.json" -}}
+{{- if .Values.classificationCatalogExistingConfigMap -}}
+{{- fail "a classifications.json replacement cannot be combined with classificationCatalogExistingConfigMap; choose one override mechanism" -}}
+{{- end -}}
+{{- end -}}
+{{- dict "enabled" $enabled "includeDefaults" $includeDefaults "configMaps" $normalizedSources "replacements" $replacements | toYaml -}}
+{{- end -}}
+
+{{- define "hub.workflowConfiguration.validate" -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- if $config.enabled -}}
+{{- $paths := dict -}}
+{{- if $config.includeDefaults -}}
+{{- if not .Values.classificationCatalogEnabled -}}
+{{- fail "bundled workflowConfiguration requires classificationCatalogEnabled; disable includeDefaults and supply configMaps for a custom bundle" -}}
+{{- end -}}
+{{- range $path := (include "hub.workflowConfiguration.bundledPaths" . | fromYamlArray) -}}
+{{- if not (hasKey $config.replacements $path) -}}
+{{- $_ := set $paths $path true -}}
+{{- end -}}
+{{- end -}}
+{{- else -}}
+{{- if not $config.configMaps -}}
+{{- fail "workflowConfiguration.configMaps must be nonempty when enabled without defaults" -}}
+{{- end -}}
+{{- end -}}
+{{- range $config.configMaps -}}
+{{- if not .items -}}
+{{- fail (printf "workflowConfiguration ConfigMap %q requires nonempty items" .name) -}}
+{{- end -}}
+{{- range .items -}}
+{{- if not (regexMatch "^[A-Za-z0-9._-]+$" .key) -}}
+{{- fail "workflowConfiguration.items keys must be valid ConfigMap keys" -}}
+{{- end -}}
+{{- if or (not (regexMatch "^(workflow-contracts|catalogs)/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.(yaml|json)$" .path)) (ne (clean .path) .path) -}}
+{{- fail "workflowConfiguration.items paths must be normalized relative files under workflow-contracts/ or catalogs/" -}}
+{{- end -}}
+{{- if hasKey $paths .path -}}
+{{- fail (printf "duplicate workflowConfiguration.items path %q" .path) -}}
+{{- end -}}
+{{- $_ := set $paths .path true -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

charts/hub/templates/_helpers.tpl

@@ -0,0 +1,84 @@
+{{/* Build the path to the configured MongoDB CA bundle. */}}
+{{- define "hub.mongodb.tlsCAFile" -}}
+{{- if and .Values.mongodb.tls.enabled .Values.mongodb.tls.existingSecret .Values.mongodb.tls.caFileName -}}
+{{- printf "%s/%s" .Values.mongodb.tls.mountPath .Values.mongodb.tls.caFileName | clean -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Add TLS options to a configured MongoDB URI unless they are already present. */}}
+{{- define "hub.mongodb.uri" -}}
+{{- $uri := .Values.mongodb.uri | default "" -}}
+{{- if and .Values.mongodb.tls.enabled $uri -}}
+  {{- if not (regexMatch "(?i)(^|[?&])tls=" $uri) -}}
+    {{- $separator := "?" -}}
+    {{- if contains "?" $uri -}}
+      {{- $separator = "&" -}}
+    {{- end -}}
+    {{- if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%stls=true" $uri $separator -}}
+  {{- end -}}
+  {{- $caFile := include "hub.mongodb.tlsCAFile" . -}}
+  {{- if and $caFile (not (regexMatch "(?i)(^|[?&])tlsCAFile=" $uri)) -}}
+    {{- $separator := "&" -}}
+    {{- if not (contains "?" $uri) -}}
+      {{- $separator = "?" -}}
+    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%stlsCAFile=%s" $uri $separator $caFile -}}
+  {{- end -}}
+{{- end -}}
+{{- $uri -}}
+{{- end -}}
+
+{{/*
+MongoDB URI with appName set to one workload, so the Atlas query profiler and
+currentOp attribute each operation to the service that issued it. Renders
+nothing when no URI is configured or mongodb.appNamePerService is false.
+Usage: include "hub.mongodb.appUri" (dict "root" $ "app" "hub-api")
+*/}}
+{{- define "hub.mongodb.appUri" -}}
+{{- $uri := include "hub.mongodb.uri" .root -}}
+{{- if and $uri .root.Values.mongodb.appNamePerService -}}
+  {{- if regexMatch "(?i)[?&]appName=" $uri -}}
+    {{- $uri = regexReplaceAll "(?i)([?&])appName=[^&]*" $uri (printf "${1}appName=%s" .app) -}}
+  {{- else -}}
+    {{- $separator := "&" -}}
+    {{- if not (contains "?" $uri) -}}
+      {{- $separator = "?" -}}
+    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%sappName=%s" $uri $separator .app -}}
+  {{- end -}}
+  {{- $uri -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Container env entry that overrides MONGODB_URI from mongodb-config with the
+workload's own appName. An explicit env entry takes precedence over envFrom.
+Usage: {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nindent 12 }}
+*/}}
+{{- define "hub.mongodb.appUriEnv" -}}
+{{- with include "hub.mongodb.appUri" . -}}
+- name: MONGODB_URI
+  value: {{ . | quote }}
+{{- end -}}
+{{- end -}}
+
+{{/* Render the shared MongoDB CA Secret volume. */}}
+{{- define "hub.mongodb.tlsVolume" -}}
+- name: mongodb-tls
+  secret:
+    secretName: {{ .Values.mongodb.tls.existingSecret }}
+{{- end -}}
+
+{{/* Render the shared MongoDB CA volume mount. */}}
+{{- define "hub.mongodb.tlsVolumeMount" -}}
+- name: mongodb-tls
+  mountPath: {{ .Values.mongodb.tls.mountPath }}
+  readOnly: true
+{{- end -}}

charts/hub/templates/configMaps/catalogs/classifications.yaml

@@ -0,0 +1,24 @@
+{{- define "hub.classificationCatalog.defaults" -}}
+[
+  {"key": "animal", "label": "Animal", "icon": "animal"},
+  {"key": "pedestrian", "label": "Pedestrian", "icon": "pedestrian"},
+  {"key": "cyclist", "label": "Cyclist", "icon": "cyclist"},
+  {"key": "motorbike", "label": "Motorbike", "icon": "motorbike"},
+  {"key": "lorry", "label": "Lorry", "icon": "lorry"},
+  {"key": "car", "label": "Car", "icon": "car"},
+  {"key": "handbag", "label": "Handbag", "icon": "handbag"},
+  {"key": "suitcase", "label": "Suitcase", "icon": "suitcase"},
+  {"key": "cell phone", "label": "Cell phone", "icon": "cell phone"}
+]
+{{- end -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not (hasKey $config.replacements "catalogs/classifications.json")) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: classification-catalog
+  namespace: {{ .Release.Namespace }}
+data:
+  classifications.json: |-
+    {{- include "hub.classificationCatalog.defaults" . | mustFromJson | toPrettyJson | nindent 4 }}
+{{- end -}}

charts/hub/templates/configMaps/configmap-hub-audit.yaml

@@ -0,0 +1,51 @@
+{{- if .Values.audit.enabled -}}
+{{- $destinations := list -}}
+{{- $destinationIDs := dict -}}
+{{- range $index, $destination := .Values.kerberoshub.audit.destinations -}}
+  {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
+  {{- if not (regexMatch "^[a-z][a-z0-9-]{0,62}$" $id) -}}
+    {{- fail (printf "audit destination id %q must match ^[a-z][a-z0-9-]{0,62}$" $id) -}}
+  {{- end -}}
+  {{- if hasKey $destinationIDs $id -}}
+    {{- fail (printf "duplicate audit destination id %q" $id) -}}
+  {{- end -}}
+  {{- $_ := set $destinationIDs $id true -}}
+  {{- $url := required (printf "url is required for audit destination %s" $id) $destination.url -}}
+  {{- $entry := dict
+      "id" $id
+      "type" (default "webhook" $destination.type)
+      "enabled" $destination.enabled
+      "url" $url
+      "timeoutSeconds" (default 10 $destination.timeoutSeconds)
+      "batchSize" (default 100 $destination.batchSize)
+      "maxAttempts" (default 10 $destination.maxAttempts)
+      "startAt" (default "latest" $destination.startAt)
+      "headers" (default dict $destination.headers)
+      "filters" (default dict $destination.filters) -}}
+  {{- $secretRoot := printf "/var/run/secrets/audit-destinations/%s" $id -}}
+  {{- $bearer := default dict $destination.bearerTokenSecret -}}
+  {{- if gt (len $bearer) 0 -}}
+    {{- $secretName := required (printf "bearerTokenSecret.name is required for destination %s" $id) $bearer.name -}}
+    {{- $secretKey := default "token" $bearer.key -}}
+    {{- $_ := set $entry "bearerTokenFile" (printf "%s/bearer-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName $secretKey) | trunc 12)) -}}
+  {{- end -}}
+  {{- $headerFiles := dict -}}
+  {{- range $headerName, $secret := (default dict $destination.secretHeaders) -}}
+    {{- $secretName := required (printf "secretName is required for destination %s header %s" $id $headerName) $secret.secretName -}}
+    {{- $secretKey := required (printf "secretKey is required for destination %s header %s" $id $headerName) $secret.secretKey -}}
+    {{- $_ := set $headerFiles $headerName (printf "%s/header-%s" $secretRoot (sha256sum (printf "%s:%s:%s" $headerName $secretName $secretKey) | trunc 12)) -}}
+  {{- end -}}
+  {{- if gt (len $headerFiles) 0 -}}
+    {{- $_ := set $entry "headerFiles" $headerFiles -}}
+  {{- end -}}
+  {{- $destinations = append $destinations $entry -}}
+{{- end -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+data:
+  destinations.json: |
+    {{ dict "version" 1 "destinations" $destinations | toPrettyJson | nindent 4 }}
+{{- end }}

charts/hub/templates/configMaps/configmap-mongodb.yaml

@@ -4,7 +4,7 @@ metadata:
   name: mongodb-config
   namespace: {{ .Release.Namespace }}
 data:
-  MONGODB_URI: "{{ .Values.mongodb.uri }}"
+  MONGODB_URI: {{ include "hub.mongodb.uri" . | quote }}
   MONGODB_HOST: "{{ .Values.mongodb.host }}"
   MONGODB_AUTHENTICATION_MECHANISM: "{{ .Values.mongodb.authenticationMechanism }}"
   MONGODB_DATABASE_CREDENTIALS: "{{ .Values.mongodb.adminDatabase }}"
@@ -12,4 +12,7 @@ data:
   MONGODB_PASSWORD: "{{ .Values.mongodb.password }}"
   MONGODB_RETRY_WRITES: "{{ .Values.mongodb.retryWrites }}"
   MONGODB_FLAVOR: "{{ .Values.mongodb.flavor | default "mongodb" }}"
+  MONGODB_TLS: "{{ .Values.mongodb.tls.enabled }}"
+  MONGODB_TLS_CA_FILE: {{ include "hub.mongodb.tlsCAFile" . | quote }}
+  MONGODB_TLS_INSECURE_SKIP_VERIFY: "{{ .Values.mongodb.tls.insecureSkipVerify }}"
   MONGODB_DATABASE_CLOUD: "Kerberos"

charts/hub/templates/configMaps/workflow-contracts/anpr.yaml

@@ -0,0 +1,135 @@
+{{/* Validate the rendered anpr.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
+{{- define "hub.workflowConfiguration.anpr" -}}
+schemaVersion: 1
+stage: anpr
+contractVersion: 1
+presentation:
+  name: Number plate recognition
+  description: Read the number plates of vehicles in the recording.
+  icon: car
+  color: amber
+
+# Node settings hub-anpr reads per run (see its README, "Node settings"). Each
+# overrides the matching ANPR_* environment variable; the defaults below equal
+# the worker's built-in defaults. A deployment that changes those variables
+# should change these defaults too, because new nodes store them on save.
+params:
+  - name: plateClasses
+    label: Read plates for
+    description: Vehicle classes whose plates are read (ANPR_PLATE_CLASSES).
+    type: multiselect
+    choices: {file: ../catalogs/classifications.json}
+    default: [car]
+    group: Which vehicles
+  - name: minMovement
+    label: Minimum movement
+    description: Skip vehicles that barely moved; 0 reads every vehicle (ANPR_READ_MOVEMENT_MIN).
+    type: number
+    minimum: 0
+    default: 0
+    group: Which vehicles
+  - name: maxJump
+    label: Maximum jump between frames
+    description: Drop unstable tracks; 0 disables the check (ANPR_READ_MAX_JUMP).
+    type: number
+    minimum: 0
+    default: 0
+    group: Which vehicles
+  - name: readFrames
+    label: Frames to read per vehicle
+    description: Frames OCR'd per vehicle; 0 disables OCR (ANPR_READ_FRAMES).
+    type: number
+    minimum: 0
+    maximum: 10
+    default: 1
+    group: Recognition
+  - name: readQuorum
+    label: Agreeing reads required
+    description: Reads that must agree before a plate is accepted; 0 accepts any read (ANPR_READ_QUORUM).
+    type: number
+    minimum: 0
+    maximum: 10
+    default: 0
+    group: Recognition
+  - name: minConfidence
+    label: Minimum OCR confidence
+    description: Ignore reads below this confidence (ANPR_READ_CONF_MIN).
+    type: number
+    minimum: 0
+    maximum: 1
+    default: 0
+    group: Recognition
+
+# Paths are relative to results.anpr (models.WorkflowAnprResult): one track and
+# one marker per vehicle. Plate, unread and class can be tied to the same
+# vehicle with "Must match the same item"; OCR confidence and engine live on
+# the markers and cannot be tied to a plate.
+fields:
+  - id: plate
+    label: Number plate
+    path: detections.*.tracks.*.meta.plate
+    type: string
+    operators: [eq, in, contains, matches]   # stored uppercase, letters and digits only, e.g. AB123CD
+    optional: true
+  - id: unread
+    label: Plate could not be read
+    path: detections.*.tracks.*.meta.unread
+    type: boolean
+    operators: [eq]
+    optional: true
+  - id: vehicleClass
+    label: Vehicle class (from classification)
+    path: detections.*.tracks.*.meta.classifiedAs
+    type: string
+    operators: [eq, in]
+    optional: true
+    choices: {file: ../catalogs/classifications.json}
+  - id: ocrConfidence
+    label: OCR confidence
+    path: markers.*.metadata.confidence
+    type: number
+    operators: [gte, gt, lte, lt]   # read plates only; about 0-1 for fast, 0.5 for tesseract
+    minimum: 0
+    optional: true
+  - id: ocrEngine
+    label: OCR engine
+    path: markers.*.metadata.engine
+    type: string
+    operators: [eq, in]   # read plates only
+    optional: true
+    choices: {values: [fast, tesseract, tesseract+opencv, http]}
+  - id: secondsVisible
+    label: Seconds visible
+    path: markers.*.duration
+    type: integer
+    operators: [gte, lte]
+    minimum: 0
+    optional: true
+
+# Connections leaving this stage; Extra conditions are appended collapsed.
+panel:
+  sections:
+    - id: plate
+      label: Plate
+      fields:
+        - {field: plate, widget: text, operator: contains, label: Plate contains (e.g. AB123)}
+        - {field: unread, widget: toggle, label: Plate could not be read}
+    - id: recognition
+      label: Recognition
+      collapsed: true
+      fields:
+        - {field: ocrConfidence, widget: number, operator: gte, label: Minimum OCR confidence}
+        - {field: vehicleClass, widget: multiselect}
+        - {field: secondsVisible, widget: number, operator: gte, label: Visible for at least (seconds)}
+{{ end -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/anpr.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hub.workflowConfiguration.anpr.configMapName" . }}
+  namespace: {{ .Release.Namespace }}
+data:
+  anpr.yaml: |-
+    {{- include "hub.workflowConfiguration.anpr" . | nindent 4 }}
+{{- end }}

charts/hub/templates/configMaps/workflow-contracts/forwarder.yaml

@@ -0,0 +1,95 @@
+{{/* Validate the rendered forwarder.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
+{{- define "hub.workflowConfiguration.forwarder" -}}
+schemaVersion: 1
+stage: forwarder
+contractVersion: 1
+presentation:
+  name: Forward to my system
+  description: Send the run's data to your own RabbitMQ destination.
+  icon: share
+  color: green
+
+# Custom workflows supply their own connection; deployment credentials are never
+# inherited. These non-secret defaults are stored on save, not read from the worker.
+params:
+  - name: broker
+    label: Provider
+    description: Custom workflows use their own RabbitMQ destination. Shared deployment integrations are reserved for global workflows.
+    type: select
+    required: true
+    options: [rabbitmq]
+    optionLabels: {rabbitmq: RabbitMQ}
+    default: rabbitmq
+    group: Delivery
+  - name: mode
+    label: Completion mode
+    description: Complete after delivery, or wait for the external result. Callback requires a deployment-configured Hub callback URL.
+    type: select
+    required: true
+    options: [delivered, callback]
+    optionLabels: {delivered: Complete after delivery, callback: Wait for result}
+    default: delivered
+    group: Delivery
+  - name: host
+    label: Host
+    description: Your RabbitMQ destination host. Required before enabling the workflow.
+    type: string
+    required: true
+    placeholder: rabbitmq.example.com
+    group: RabbitMQ destination
+  - name: port
+    label: Port
+    description: Your RabbitMQ destination port, a whole number (usually 5671 with TLS or 5672 without TLS).
+    type: number
+    required: true
+    minimum: 1
+    maximum: 65535
+    group: RabbitMQ destination
+  - name: queue
+    label: Queue
+    description: Your destination queue. Its dead-letter queue is this name followed by .forwarder-dead-letter.
+    type: string
+    required: true
+    group: RabbitMQ destination
+  - name: vhost
+    label: Virtual host
+    description: Your RabbitMQ virtual host. Use / for the broker's default virtual host.
+    type: string
+    required: true
+    placeholder: /
+    group: RabbitMQ destination
+  - name: tls
+    label: Use TLS
+    description: Encrypt the connection and verify the broker certificate using system trust roots. Deployment TLS overrides are never inherited.
+    type: boolean
+    required: true
+    default: true
+    group: RabbitMQ destination
+  - name: username
+    label: Username
+    description: Your RabbitMQ destination username. Deployment credentials are never used.
+    type: string
+    required: true
+    group: RabbitMQ credentials
+  - name: password
+    label: Password
+    description: Your RabbitMQ destination password. Required before enabling the workflow; masked after saving.
+    type: secret
+    required: true
+    group: RabbitMQ credentials
+
+# It contributes no output fields: connections after it can still use Start and
+# earlier stages in Extra conditions.
+fields: []
+{{ end -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/forwarder.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hub.workflowConfiguration.forwarder.configMapName" . }}
+  namespace: {{ .Release.Namespace }}
+data:
+  forwarder.yaml: |-
+    {{- include "hub.workflowConfiguration.forwarder" . | nindent 4 }}
+{{- end }}

charts/hub/templates/configMaps/workflow-contracts/start.yaml

@@ -0,0 +1,75 @@
+{{/* Validate the rendered start.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
+{{- define "hub.workflowConfiguration.start" -}}
+schemaVersion: 1
+stage: start
+contractVersion: 1
+
+# Paths refer to the safe initial context, not the full event or credentials.
+fields:
+  - id: device
+    label: Device
+    path: device.deviceKey
+    type: string
+    operators: [eq, in]
+    choices:
+      source: project.devices
+  - id: sites
+    label: Sites
+    path: device.siteIds.*
+    type: string
+    operators: [in]
+    choices:
+      source: project.sites
+  - id: groups
+    label: Groups
+    path: device.groupIds.*
+    type: string
+    operators: [in]
+    choices:
+      source: project.groups
+  - id: classifications
+    label: Initial classifications
+    path: inputs.classify.details.*.classified
+    type: string
+    operators: [in]
+    optional: true
+    choices:
+      file: ../catalogs/classifications.json
+  # Condition-only context fields (not selectors): advanced conditions on
+  # Start connections may test only declared fields, under device. or inputs.
+  - id: deviceName
+    label: Camera name
+    path: device.deviceName
+    type: string
+    operators: [eq, in, contains, matches]
+  - id: objectClass
+    label: Detected object
+    path: inputs.classify.details.*.classified
+    type: string
+    operators: [eq, ne, in, exists]
+    optional: true
+    choices:
+      file: ../catalogs/classifications.json
+
+# Controls offered for new authoring; an omitted control is not offered.
+controls:
+  - id: weeklySchedule
+    label: Weekly schedule
+  - id: conditions
+    label: Advanced conditions
+
+# Trigger modes offered for new authoring; omitted offers both.
+triggerModes: [automatic, manual]
+{{ end -}}
+{{- include "hub.workflowConfiguration.validate" . -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/start.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
+  namespace: {{ .Release.Namespace }}
+data:
+  start.yaml: |-
+    {{- include "hub.workflowConfiguration.start" . | nindent 4 }}
+{{- end }}

charts/hub/templates/kerberos-hub/hub-api.yaml

@@ -1,4 +1,6 @@
 {{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+{{- $workflowConfiguration := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- $catalogReplacement := index $workflowConfiguration.replacements "catalogs/classifications.json" | default dict -}}
 {{- if .Values.kerberoshub.api.serviceEnabled }}
 apiVersion: v1
 kind: Service
@@ -119,7 +121,19 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
+        {{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not $catalogReplacement) }}
+        checksum/classification-catalog: {{ include (print $.Template.BasePath "/configMaps/catalogs/classifications.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml")) }}
+        checksum/workflow-configuration: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/start.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/anpr.yaml")) }}
+        checksum/workflow-contract-anpr: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/anpr.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/forwarder.yaml")) }}
+        checksum/workflow-contract-forwarder: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/forwarder.yaml") . | sha256sum }}
+        {{- end }}
       labels:
         app: hub-api
     spec:
@@ -131,8 +145,61 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
-      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- $classificationCatalogEnabled := .Values.classificationCatalogEnabled }}
+      {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- if $workflowConfiguration.enabled }}
+        - name: workflow-configuration
+          projected:
+            sources:
+              {{- if $workflowConfiguration.includeDefaults }}
+              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml") }}
+              - configMap:
+                  name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
+                  items:
+                    - key: start.yaml
+                      path: workflow-contracts/start.yaml
+              {{- end }}
+              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/anpr.yaml") }}
+              - configMap:
+                  name: {{ include "hub.workflowConfiguration.anpr.configMapName" . }}
+                  items:
+                    - key: anpr.yaml
+                      path: workflow-contracts/anpr.yaml
+              {{- end }}
+              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/forwarder.yaml") }}
+              - configMap:
+                  name: {{ include "hub.workflowConfiguration.forwarder.configMapName" . }}
+                  items:
+                    - key: forwarder.yaml
+                      path: workflow-contracts/forwarder.yaml
+              {{- end }}
+              {{- if not $catalogReplacement }}
+              - configMap:
+                  name: {{ include "hub.classificationCatalog.configMapName" . }}
+                  items:
+                    - key: classifications.json
+                      path: catalogs/classifications.json
+              {{- end }}
+              {{- end }}
+              {{- range $workflowConfiguration.configMaps }}
+              - configMap:
+                  name: {{ .name | quote }}
+                  items:
+                    {{- toYaml .items | nindent 20 }}
+              {{- end }}
+      {{- end }}
+      {{- if $classificationCatalogEnabled }}
+        - name: classification-catalog
+          configMap:
+            name: {{ include "hub.classificationCatalog.configMapName" . }}
+            {{- if or .Values.classificationCatalogExistingConfigMap $catalogReplacement }}
+            items:
+              - key: {{ default "classifications.json" $catalogReplacement.key | quote }}
+                path: classifications.json
+            {{- end }}
+      {{- end }}
       {{- with .Values.kerberoshub.api.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
@@ -141,6 +208,9 @@ spec:
           secret:
             secretName: {{ $serverTLS.secretName }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
       {{- end }}
       {{- with .Values.kerberoshub.api.topologySpreadConstraints }}
       topologySpreadConstraints:
@@ -157,8 +227,18 @@ spec:
           ports:
             - containerPort: 80
               name: http
-          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) }}
+          {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- if $workflowConfiguration.enabled }}
+            - name: workflow-configuration
+              mountPath: /etc/kerberos/configuration
+              readOnly: true
+          {{- end }}
+          {{- if $classificationCatalogEnabled }}
+            - name: classification-catalog
+              mountPath: /etc/kerberos/classifications
+              readOnly: true
+          {{- end }}
           {{- with .Values.kerberoshub.api.volumeMounts}}
             {{- toYaml . | nindent 12 }}
           {{- end }}
@@ -167,12 +247,20 @@ spec:
               mountPath: {{ $serverTLS.mountPath }}
               readOnly: true
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
           {{- end }}
           # Mongodb - loaded from ConfigMap
           envFrom:
             - configMapRef:
                 name: mongodb-config
           env:
+            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nindent 12 }}
+            {{- if $classificationCatalogEnabled }}
+            - name: CLASSIFICATION_CATALOG_FILE
+              value: /etc/kerberos/classifications/classifications.json
+            {{- end }}
             - name: ENVIRONMENT
               value: "{{ .Values.environment }}"
             - name: READ_ONLY
@@ -187,6 +275,26 @@ spec:
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
             - name: PUBLIC_URL
               value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
+            - name: REFRESH_COOKIE_SECURE
+              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
+            {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
+            {{- with .Values.kerberoshub.frontend.legacyUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- range .Values.kerberoshub.frontend.domains }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
+            {{- end }}
+            {{- range .Values.kerberoshub.api.corsAllowedOrigins }}
+            {{- $corsOrigins = append $corsOrigins . }}
+            {{- end }}
+            - name: CORS_ALLOWED_ORIGINS
+              value: {{ join "," $corsOrigins | quote }}
             {{ if .Values.isPrivate }}
             - name: KERBEROS_PRIVATE_CLOUD
               value: "true"
@@ -233,6 +341,27 @@ spec:
             - name: KERBEROS_JWT_SECRET
               value: "{{ .Values.kerberoshub.api.jwtSecret }}"
 
+            # Temporarily stop serving the polled GET /devices list (204, no DB reads).
+            - name: DISABLE_AGENT_HEARTBEAT
+              value: {{ .Values.kerberoshub.api.disableAgentHeartbeat | default false | quote }}
+
+            # Media proxy: hide Vault/storage endpoints behind hub-api URLs.
+            {{- $mediaProxy := .Values.kerberoshub.api.mediaProxy | default dict }}
+            - name: MEDIA_PROXY_ENABLED
+              value: {{ $mediaProxy.enabled | default false | quote }}
+            {{- if $mediaProxy.publicUrl }}
+            - name: MEDIA_PROXY_PUBLIC_URL
+              value: {{ $mediaProxy.publicUrl | quote }}
+            {{- end }}
+            {{- if $mediaProxy.key }}
+            - name: MEDIA_PROXY_KEY
+              value: {{ $mediaProxy.key | quote }}
+            {{- end }}
+            {{- if $mediaProxy.ttl }}
+            - name: MEDIA_PROXY_TTL
+              value: {{ $mediaProxy.ttl | quote }}
+            {{- end }}
+
             # SSO (OIDC) setup
             - name: SSO_DOMAINS
               value:  "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
@@ -259,6 +388,22 @@ spec:
             - name: QUEUE_NAME
               value: "{{ .Values.queueName }}"
 
+            # Deployment-global workflow definitions (WORKFLOW_DEFINITIONS): the
+            # SAME set the workflows engine consumes, assembled from the enabled
+            # definitions under kerberoshub.workflows.definitions (see
+            # kerberos-pipeline/_workflows-helpers.tpl). hub-api reads these
+            # read-only to surface config workflows alongside the user workflows
+            # it stores in the database; the config workflows are never persisted.
+            - name: WORKFLOW_DEFINITIONS
+              value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
+            # Deployment service routing catalog used by API-owned embedded
+            # workflows (for example the one-stage case redaction modal flow).
+            - name: WORKFLOW_STAGE_QUEUES
+              value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
+            # Stages tenants may place in the workflow editor (see workflows.editorStages).
+            - name: WORKFLOW_EDITOR_STAGES
+              value: {{ .Values.kerberoshub.workflows.editorStages | default list | toJson | quote }}
+
             # Stripe for billing
             - name: STRIPE_KEY
               value: "{{ .Values.kerberoshub.api.stripe.privateKey }}"
@@ -319,6 +464,14 @@ spec:
               value: "{{ .Values.rabbitmq.username }}"
             - name: RABBITMQ_PASSWORD
               value: "{{ .Values.rabbitmq.password }}"
+            - name: AUDIT_ENABLED
+              value: {{ and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled | quote }}
+            {{- if and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled }}
+            - name: AUDIT_QUEUE
+              value: {{ .Values.audit.intake.queue | quote }}
+            - name: AUDIT_DEADLETTER_QUEUE
+              value: {{ .Values.audit.intake.deadletterQueue | quote }}
+            {{- end }}
 
             # Slack notifications (this will send events/logs to a specific channel).
             - name: SLACK_ENABLED
@@ -353,6 +506,14 @@ spec:
               value: "{{ .Values.email.templates.share }}"
             - name: SHARE_TITLE
               value: "{{ .Values.email.templates.shareTitle }}"
+            - name: CASE_SHARE_TEMPLATE
+              value: "{{ .Values.email.templates.caseShare }}"
+            - name: CASE_SHARE_TITLE
+              value: "{{ .Values.email.templates.caseShareTitle }}"
+            - name: CASE_SHARE_OTP_TEMPLATE
+              value: "{{ .Values.email.templates.caseShareOtp }}"
+            - name: CASE_SHARE_OTP_TITLE
+              value: "{{ .Values.email.templates.caseShareOtpTitle }}"
             - name: ASSIGN_TASK_TEMPLATE
               value: "{{ .Values.email.templates.assignTask }}"
             - name: ASSIGN_TASK_TITLE
@@ -399,15 +560,16 @@ spec:
             - name: VAULT_SPRITE_SECRET_KEY
               value: "{{ .Values.kerberosvault.sprite.secretKey }}"
             - name: VAULT_SPRITE_INTERVAL
-              value: "{{ .Values.kerberosvault.sprite.interval }}"
+              value: "{{ .Values.kerberospipeline.sprite.interval }}"
             - name: VAULT_SPRITE_WIDTH
-              value: "{{ .Values.kerberosvault.sprite.width }}"
+              value: "{{ .Values.kerberospipeline.sprite.width }}"
             - name: VAULT_SPRITE_HEIGHT
-              value: "{{ .Values.kerberosvault.sprite.height }}"
+              value: "{{ .Values.kerberospipeline.sprite.height }}"
             {{- if .Values.kerberoshub.extraEnv }}
             {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
             {{- end }}
 
+            {{- if .Values.opentelemetry.enabled }}
             # Open Telemetry tracing
             - name: OTEL_EXPORTED_OTLP_ENABLED
               value: "{{ .Values.opentelemetry.enabled }}"
@@ -415,4 +577,5 @@ spec:
               value: "{{ .Values.opentelemetry.routingEnabled }}"
             - name: OTEL_EXPORTER_OTLP_ENDPOINT
               value: "{{ .Values.opentelemetry.collector.endpoint }}"
+            {{- end }}
 {{- end }}

charts/hub/templates/kerberos-hub/hub-audit-servicemonitor.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.audit.enabled .Values.kerberoshub.audit.serviceMonitor.enabled -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: hub-audit-servicemonitor
+  namespace: {{ .Release.Namespace }}
+  labels:
+    service: hub-audit
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      service: hub-audit
+  endpoints:
+    - port: metrics
+      interval: {{ .Values.kerberoshub.audit.serviceMonitor.interval }}
+      path: /metrics
+{{- end }}

charts/hub/templates/kerberos-hub/hub-audit.yaml

@@ -0,0 +1,167 @@
+{{- if .Values.audit.enabled -}}
+{{- if ne (upper .Values.queueProvider) "RABBITMQ" -}}
+{{- fail "kerberoshub.audit currently requires queueProvider=RABBITMQ" -}}
+{{- end -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.kerberoshub.audit.replicas }}
+  selector:
+    matchLabels:
+      app: hub-audit
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      annotations:
+        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
+      labels:
+        app: hub-audit
+    spec:
+      terminationGracePeriodSeconds: {{ .Values.kerberoshub.audit.terminationGracePeriodSeconds }}
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      volumes:
+        - name: destinations
+          configMap:
+            name: hub-audit
+          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+      {{- $bearer := default dict $destination.bearerTokenSecret }}
+      {{- $secretHeaders := default dict $destination.secretHeaders }}
+      {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
+        - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
+          projected:
+            sources:
+            {{- if gt (len $bearer) 0 }}
+              - secret:
+                  name: {{ required (printf "bearerTokenSecret.name is required for destination %s" $destination.id) $bearer.name | quote }}
+                  items:
+                    - key: {{ default "token" $bearer.key | quote }}
+                      path: bearer-{{ sha256sum (printf "%s:%s" $bearer.name (default "token" $bearer.key)) | trunc 12 }}
+            {{- end }}
+            {{- range $headerName, $secret := $secretHeaders }}
+              - secret:
+                  name: {{ required (printf "secretName is required for destination %s header %s" $destination.id $headerName) $secret.secretName | quote }}
+                  items:
+                    - key: {{ required (printf "secretKey is required for destination %s header %s" $destination.id $headerName) $secret.secretKey | quote }}
+                      path: header-{{ sha256sum (printf "%s:%s:%s" $headerName $secret.secretName $secret.secretKey) | trunc 12 }}
+            {{- end }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.audit.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberoshub.audit.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: hub-audit
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.audit.repository }}:{{ .Values.kerberoshub.audit.tag }}"
+          imagePullPolicy: {{ .Values.kerberoshub.audit.pullPolicy }}
+          {{- with .Values.kerberoshub.audit.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: metrics
+              containerPort: 2112
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+          volumeMounts:
+            - name: destinations
+              mountPath: /etc/hub-audit
+              readOnly: true
+          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+          {{- $bearer := default dict $destination.bearerTokenSecret }}
+          {{- $secretHeaders := default dict $destination.secretHeaders }}
+          {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
+            - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
+              mountPath: /var/run/secrets/audit-destinations/{{ $destination.id }}
+              readOnly: true
+          {{- end }}
+          {{- end }}
+          {{- with .Values.kerberoshub.audit.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
+          env:
+            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-audit") | nindent 12 }}
+            - name: RABBITMQ_HOST
+              value: {{ .Values.rabbitmq.host | quote }}
+            - name: RABBITMQ_EXCHANGE
+              value: {{ .Values.rabbitmq.exchange | quote }}
+            - name: RABBITMQ_USERNAME
+              value: {{ .Values.rabbitmq.username | quote }}
+            - name: RABBITMQ_PASSWORD
+              value: {{ .Values.rabbitmq.password | quote }}
+            - name: AUDIT_QUEUE
+              value: {{ .Values.audit.intake.queue | quote }}
+            - name: AUDIT_DEADLETTER_QUEUE
+              value: {{ .Values.audit.intake.deadletterQueue | quote }}
+            - name: AUDIT_MAX_RETRIES
+              value: {{ .Values.audit.intake.maxRetries | quote }}
+            - name: AUDIT_PREFETCH_COUNT
+              value: {{ .Values.audit.intake.prefetchCount | quote }}
+            - name: AUDIT_PERSIST_TIMEOUT
+              value: {{ .Values.audit.intake.persistTimeout | quote }}
+            - name: DISPATCH_INTERVAL
+              value: {{ .Values.kerberoshub.audit.dispatchInterval | quote }}
+            - name: LEASE_DURATION
+              value: {{ .Values.kerberoshub.audit.leaseDuration | quote }}
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          {{- with .Values.kerberoshub.audit.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.kerberoshub.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: hub-audit
+    service: hub-audit
+spec:
+  ports:
+    - name: metrics
+      port: 2112
+      targetPort: metrics
+      protocol: TCP
+  selector:
+    app: hub-audit
+{{- end }}

charts/hub/templates/kerberos-hub/hub-cleanup.yaml

@@ -18,7 +18,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-cleanup
     spec:
@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.cleanup.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.cleanup.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.cleanup.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberoshub.cleanup.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,16 +51,22 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- with .Values.kerberoshub.cleanup.volumeMounts }}
+          {{- if or .Values.kerberoshub.cleanup.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- with .Values.kerberoshub.cleanup.volumeMounts }}
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
           envFrom:
             - configMapRef:
                 name: mongodb-config
           ports:
             - containerPort: 8080
           env:
+            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-cleanup") | nindent 12 }}
             - name: MODE
               value: "{{ .Values.kerberoshub.cleanup.mode }}"
             - name: LOG_LEVEL
@@ -97,6 +109,10 @@ spec:
               value: "{{ .Values.kerberoshub.cleanup.globalPassDeleteBudget }}"
             - name: DEFAULT_TASK_RETENTION_DAYS
               value: "{{ .Values.kerberoshub.cleanup.defaultTaskRetentionDays }}"
+            - name: AUDIT_EVENT_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.cleanup.auditEventRetentionDays }}"
+            - name: WORKFLOW_RUN_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.cleanup.workflowRunRetentionDays | default "0" }}"
           {{- if .Values.kerberoshub.extraEnv }}
           {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
           {{- end }}

charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml

@@ -193,6 +193,10 @@ spec:
         - name: GOOGLEMAPS_KEY
           value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
 
+        # features > chart
+        - name: CHART_COLORS
+          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
+
         # Zendesk for support
         - name: ZENDESK_URL
           value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"
@@ -229,8 +233,34 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
         - name: FEATURE_WORKFLOWS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_AUDIT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
+        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
+        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
+        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
+        - name: FEATURE_ORGANISATIONS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
+        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
+        - name: FEATURE_ORGANISATION_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
+        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
+        - name: FEATURE_PROJECTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
+        - name: FEATURE_PROJECT_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
+        - name: FEATURE_PROJECT_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
+        - name: FEATURE_PROJECT_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
         - name: FEATURE_DARK_MODE
           value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
+        - name: FEATURE_SPLASH_SCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
         - name: FEATURE_LANDING_PAGE
           value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
 
@@ -241,6 +271,20 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.i18n.defaultLanguage }}"
 
         # features > liveview
+        - name: FEATURE_LIVE_STREAM_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
+        - name: FEATURE_HLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
+        - name: FEATURE_MOQ_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
+        - name: FEATURE_REMOTE_RECORDING_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
+        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
+        - name: MOQ_RELAY_URL
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
+        - name: MOQ_BROADCAST_PREFIX
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
         - name: FEATURE_LIVEVIEW_PAGINATION_MODE
           value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
         - name: FEATURE_LIVEVIEW_PAGE_SIZE
@@ -255,6 +299,26 @@ spec:
         # features > floorplan
         - name: FEATURE_FLOORPLAN_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"      
+        # features > map
+        - name: MAP_TILE_URL_LIGHT
+          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
+        - name: MAP_TILE_URL_DARK
+          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
+        - name: MAP_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
+        - name: MAP_OVERLAY_TILE_URL
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
+        - name: MAP_OVERLAY_API_KEY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
+        - name: MAP_OVERLAY_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
+        - name: MAP_OVERLAY_MIN_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
+        - name: MAP_OVERLAY_MAX_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
+        - name: MAP_OVERLAY_OPACITY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
+
         - name: COLOR_TRACK_BOX
           value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
         - name: COLOR_TRACK_BOX_HOVER
@@ -288,7 +352,9 @@ spec:
 
         # features > face redaction 
         - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}" 
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
+        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
         
         # features > media
         - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
@@ -303,14 +369,22 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
         - name: FEATURE_MEDIA_FILTER_STAR_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_ANALYSIS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.analysis.enabled }}"
         - name: FEATURE_MEDIA_FILTER_REGION_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
         - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_CATEGORY_ENABLED
+        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
         - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
+          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
         - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
         - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -312,8 +312,34 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
         - name: FEATURE_WORKFLOWS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_AUDIT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
+        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
+        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
+        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
+        - name: FEATURE_ORGANISATIONS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
+        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
+        - name: FEATURE_ORGANISATION_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
+        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
+        - name: FEATURE_PROJECTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
+        - name: FEATURE_PROJECT_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
+        - name: FEATURE_PROJECT_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
+        - name: FEATURE_PROJECT_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
         - name: FEATURE_DARK_MODE
           value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
+        - name: FEATURE_SPLASH_SCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
         - name: FEATURE_LANDING_PAGE
           value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
 
@@ -326,6 +352,20 @@ spec:
         # features > liveview
         - name: FEATURE_DEFAULT_STREAM_MODE
           value: "{{ .Values.kerberoshub.frontend.features.liveview.defaultStreamMode }}"
+        - name: FEATURE_LIVE_STREAM_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
+        - name: FEATURE_HLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
+        - name: FEATURE_MOQ_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
+        - name: FEATURE_REMOTE_RECORDING_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
+        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
+        - name: MOQ_RELAY_URL
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
+        - name: MOQ_BROADCAST_PREFIX
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
         - name: FEATURE_LIVEVIEW_PAGINATION_MODE
           value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
         - name: FEATURE_LIVEVIEW_PAGE_SIZE
@@ -348,6 +388,18 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
         - name: MAP_ATTRIBUTION
           value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
+        - name: MAP_OVERLAY_TILE_URL
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
+        - name: MAP_OVERLAY_API_KEY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
+        - name: MAP_OVERLAY_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
+        - name: MAP_OVERLAY_MIN_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
+        - name: MAP_OVERLAY_MAX_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
+        - name: MAP_OVERLAY_OPACITY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
 
         - name: COLOR_TRACK_BOX
           value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
@@ -377,6 +429,8 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
 
         # features > chart
+        - name: CHART_COLORS
+          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
         - name: COLOR_CHART_SELECTION_FILL
           value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionFill }}"
         - name: COLOR_CHART_SELECTION_STROKE
@@ -390,7 +444,9 @@ spec:
 
         # features > face redaction 
         - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}" 
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
+        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
         
         # features > media
         - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
@@ -405,14 +461,22 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
         - name: FEATURE_MEDIA_FILTER_STAR_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_ANALYSIS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.analysis.enabled }}"
         - name: FEATURE_MEDIA_FILTER_REGION_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
         - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_CATEGORY_ENABLED
+        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
         - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
+          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
         - name: FEATURE_MEDIA_FILTER_DEFAULT_VIEW
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.defaultView }}"
         - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED

charts/hub/templates/kerberos-hub/hub-monitor-device.yaml

@@ -18,7 +18,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-monitor-device
     spec:
@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.monitordevice.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.monitordevice.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.monitordevice.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberoshub.monitordevice.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,14 +51,20 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
+          {{- if or .Values.kerberoshub.monitordevice.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
           envFrom:
             - configMapRef:
                 name: mongodb-config
           env:
+            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-monitor-device") | nindent 12 }}
             - name: LOG_LEVEL
               value: "{{ .Values.kerberoshub.monitordevice.logLevel }}"
             - name: READ_ONLY

charts/hub/templates/kerberos-hub/hub-reactivate-subscription.yaml

@@ -18,7 +18,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-reactivate-subscription
     spec:
@@ -26,10 +26,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.reactivate.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.reactivate.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.reactivate.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberoshub.reactivate.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -38,14 +44,20 @@ spec:
         - name: hub-reactivate-subscription
           image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.reactivate.pullPolicy }}
-          {{- with .Values.kerberoshub.reactivate.volumeMounts }}
+          {{- if or .Values.kerberoshub.reactivate.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- with .Values.kerberoshub.reactivate.volumeMounts }}
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
           envFrom:
             - configMapRef:
                 name: mongodb-config
           env:
+            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-reactivatesubscriptions") | nindent 12 }}
             - name: LOG_LEVEL
               value: "{{ .Values.kerberoshub.reactivate.logLevel }}"
             - name: READ_ONLY

charts/hub/templates/kerberos-pipeline/_workflows-helpers.tpl

@@ -0,0 +1,96 @@
+{{/*
+Reserve every effective identity, including disabled definitions, so enabling a
+workflow later cannot silently alias another workflow's runs or references.
+*/}}
+{{- define "kerberoshub.workflows.validateDefinitions" -}}
+{{- $identities := dict -}}
+{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
+{{- $id := sha256sum $name | trunc 24 -}}
+{{- if hasKey $wf "id" -}}
+{{- $invalid := printf "kerberoshub.workflows.definitions[%q].id must be a non-zero 24-character hexadecimal string (Mongo ObjectID); omit id for name-derived compatibility" $name -}}
+{{- if not (kindIs "string" $wf.id) -}}
+{{- fail $invalid -}}
+{{- end -}}
+{{- if or (not (regexMatch "^[0-9a-fA-F]{24}$" $wf.id)) (eq $wf.id "000000000000000000000000") -}}
+{{- fail $invalid -}}
+{{- end -}}
+{{- $id = lower $wf.id -}}
+{{- end -}}
+{{- if hasKey $identities $id -}}
+{{- fail (printf "kerberoshub.workflows.definitions: duplicate effective workflow id %q for %q and %q (including disabled definitions)" $id (index $identities $id) $name) -}}
+{{- end -}}
+{{- $_ := set $identities $id $name -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
+JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
+This is the engine's boot-loaded configuration source and deployment stage
+catalog: several distinct config workflows can run over one recording — each
+opens its own run and dispatches only its own stages. Organisation-scoped
+database workflows are discovered separately at runtime.
+
+Each enabled definition contributes one workflow object:
+  id        optional explicit stable identity, normalized to lowercase. Omitted
+            for legacy definitions; their effective id is SHA256(name)[:24].
+  name      the map key (mutable display name when an explicit id is supplied).
+  enabled   always true here (a disabled definition is skipped entirely).
+  source    "config" — provenance marking a Helm-defined, deployment-global,
+            ops-managed workflow (read-only in the API, no owning organisation).
+  triggers  how a run OPENS. Defaults to a single bare automatic trigger
+            (opens for every recording); narrow with device/schedule triggers.
+            Per-stage `needs` (below) decide which stages then FIRE.
+  stages    the executable stage set, each contributing the same routing
+            descriptor the stageRegistry emits:
+              operation  the stage's operation (unique within the workflow).
+              dispatch   "always" (default) | "conditional".
+              queue      from the matching services.<operation>.queue
+                         (authoritative; omitted when unset so the engine
+                         derives "kcloud-<operation>-queue.fifo").
+              needs      conditional stages only: upstream dependencies, each
+                         {operation?, condition?}, carried through verbatim.
+              needsMode  conditional stages: "any" (default) | "all".
+*/}}
+{{- define "kerberoshub.workflows.workflowDefinitions" -}}
+{{- include "kerberoshub.workflows.validateDefinitions" . -}}
+{{- $defs := list -}}
+{{- $services := .Values.kerberoshub.services | default dict -}}
+{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
+{{- if $wf.enabled -}}
+{{- $stages := list -}}
+{{- range $stage := $wf.stages -}}
+{{- $op := $stage.operation -}}
+{{- $entry := dict "operation" $op "dispatch" (default "always" $stage.dispatch) -}}
+{{- $service := index $services $op -}}
+{{- if $service }}{{- with $service.queue }}{{- $_ := set $entry "queue" . -}}{{- end }}{{- end }}
+{{- with $stage.needs }}{{- $_ := set $entry "needs" . -}}{{- end }}
+{{- with $stage.needsMode }}{{- $_ := set $entry "needsMode" . -}}{{- end }}
+{{- $stages = append $stages $entry -}}
+{{- end -}}
+{{- $def := dict "name" $name "enabled" true "source" "config" "triggers" (default (list (dict "type" "automatic")) $wf.triggers) "stages" $stages -}}
+{{- if hasKey $wf "id" }}{{- $_ := set $def "id" (lower $wf.id) -}}{{- end }}
+{{- $defs = append $defs $def -}}
+{{- end -}}
+{{- end -}}
+{{- $defs | toJson -}}
+{{- end -}}
+
+{{/*
+Expose the deployment's operation→queue catalog to API producers that seed
+embedded WorkflowRuns. Unlike WORKFLOW_DEFINITIONS this includes services that
+are enabled for internal flows but are absent from user-visible workflow
+definitions. The workflows engine remains authoritative for dispatch; producers
+use this only to embed the same queue on a synthetic stage.
+*/}}
+{{- define "kerberoshub.workflows.stageQueues" -}}
+{{- $queues := dict -}}
+{{- range $operation, $service := (.Values.kerberoshub.services | default dict) -}}
+{{- if ne $operation "workflows" -}}
+{{- with $service.queue -}}
+{{- $_ := set $queues $operation . -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- $queues | toJson -}}
+{{- end -}}

charts/hub/templates/kerberos-pipeline/hub-stage.yaml

@@ -0,0 +1,161 @@
+{{- /*
+  Generic workflow-stage worker.
+
+  Renders a Deployment + Service for every enabled worker under
+  kerberoshub.services.<name> other than the `workflows` engine itself. A custom
+  stage joins the pipeline by values alone — declare its worker here and route to
+  it from a kerberoshub.workflows.definitions stage of the same operation; no
+  per-stage template is needed.
+
+  Every stage worker receives the same connection contract; the only value that
+  varies by stage is the consume-queue variable name, <NAME>_QUEUE (a worker
+  named "loitering" gets LOITERING_QUEUE, "my-stage" gets MY_STAGE_QUEUE). To run
+  a worker outside the chart instead, leave services.<name>.enabled unset (or
+  false) and point its workflow stage at the queue you publish.
+
+  All stages receive the Vault read credentials (KERBEROS_STORAGE_URI /
+  ACCESS_KEY / SECRET). A stage that also writes an artefact back to Vault (e.g.
+  redaction) declares its destination provider with the named field
+  services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
+  read-only stage omits it and gets no provider env.
+
+  Worker-specific settings go in services.<name>.env (plain values) and
+  services.<name>.secretEnv (references to keys in an existing Secret).
+*/ -}}
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
+{{- $root := . -}}
+{{- $services := .Values.kerberoshub.services | default dict -}}
+{{- range $name, $svc := $services -}}
+{{- if and (ne $name "workflows") $svc $svc.enabled -}}
+{{- $queueEnv := printf "%s_QUEUE" ($name | upper | replace "-" "_") -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-{{ $name }}
+  namespace: {{ $root.Release.Namespace }}
+spec:
+  replicas: {{ $svc.replicas | default 1 }}
+  selector:
+    matchLabels:
+      app: hub-{{ $name }}
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: hub-{{ $name }}
+    spec:
+      {{- if $root.Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" $root.Release.Name $root.Chart.Name | trunc 63 | trimSuffix "-") $root.Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with $root.Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $svc.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $svc.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: hub-{{ $name }}
+        image: "{{ $root.Values.global.imageRegistry }}{{ $svc.repository }}:{{ $svc.tag }}"
+        imagePullPolicy: {{ $svc.pullPolicy | default "IfNotPresent" }}
+        {{- with $svc.resources }}
+        resources:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- with $svc.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        env:
+        - name: LOG_LEVEL
+          value: "{{ $svc.logLevel | default "info" }}"
+        - name: QUEUE_SYSTEM
+          value: "{{ $root.Values.queueProvider }}"
+
+        # The queue this stage worker consumes dispatched "{{ $name }}" stages
+        # from ({{ $queueEnv }}) and the workflows engine queue it routes its
+        # result back to (WORKFLOWS_QUEUE, so the run records the resolution and
+        # any stage that needs "{{ $name }}" can fire).
+        - name: {{ $queueEnv }}
+          value: "{{ $svc.queue }}"
+        - name: WORKFLOWS_QUEUE
+          value: "{{ $root.Values.kerberoshub.services.workflows.queue }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ $root.Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ $root.Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ $root.Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ $root.Values.rabbitmq.password }}"
+
+        # Kerberos Vault — global storage credentials this stage uses to fetch
+        # the media it operates on.
+        - name: KERBEROS_STORAGE_URI
+          value: "{{ $root.Values.kerberosvault.uri }}"
+        - name: KERBEROS_STORAGE_ACCESS_KEY
+          value: "{{ $root.Values.kerberosvault.accesskey }}"
+        - name: KERBEROS_STORAGE_SECRET
+          value: "{{ $root.Values.kerberosvault.secretkey }}"
+        {{- with $svc.storageProvider }}
+        # Destination Vault provider (KERBEROS_STORAGE_PROVIDER) — only stages
+        # that write an artefact back (e.g. redaction) set services.<name>.
+        # storageProvider; read-only stages omit it and get no provider env.
+        - name: KERBEROS_STORAGE_PROVIDER
+          value: {{ . | quote }}
+        {{- end }}
+
+        # Per-stage tuning knobs. Any key/value under services.<name>.env is
+        # rendered verbatim as container env, so a worker can be tuned from
+        # values without a per-stage template. These override the image's own
+        # ENV defaults; the fixed contract env above is not overridable here.
+        {{- range $key, $value := $svc.env }}
+        - name: {{ $key }}
+          value: {{ $value | quote }}
+        {{- end }}        {{- with $svc.secretEnv }}
+
+        # Per-stage secret env. Each key under services.<name>.secretEnv maps a
+        # container env var to a key in an existing Kubernetes Secret
+        # ({name, key}), so credentials such as a model API key stay out of
+        # values. The Secret must exist in the release namespace.
+        {{- range $key, $ref := . }}
+        - name: {{ $key }}
+          valueFrom:
+            secretKeyRef:
+              name: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.name is required" $name $key) $ref.name | quote }}
+              key: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.key is required" $name $key) $ref.key | quote }}
+        {{- end }}
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-{{ $name }}
+  namespace: {{ $root.Release.Namespace }}
+  labels:
+    app: hub-{{ $name }}
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: hub-{{ $name }}
+{{ end -}}
+{{- end }}
+{{- end }}

charts/hub/templates/kerberos-pipeline/hub-workflows.yaml

@@ -0,0 +1,136 @@
+{{- include "kerberoshub.workflows.validateDefinitions" . -}}
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-workflows
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.kerberoshub.services.workflows.replicas }}
+  selector:
+    matchLabels:
+      app: hub-workflows
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
+      labels:
+        app: hub-workflows
+    spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.services.workflows.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberoshub.services.workflows.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: hub-workflows
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.services.workflows.repository }}:{{ .Values.kerberoshub.services.workflows.tag }}"
+        imagePullPolicy: {{ .Values.kerberoshub.services.workflows.pullPolicy }}
+        {{- with .Values.kerberoshub.services.workflows.resources }}
+        resources:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if or .Values.kerberoshub.services.workflows.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
+        env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-workflows") | nindent 8 }}
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberoshub.services.workflows.logLevel }}"
+        - name: QUEUE_SYSTEM
+          value: "{{ .Values.queueProvider }}"
+
+        # Queue this service consumes from (WORKFLOWS_QUEUE) and the set of
+        # named workflows it runs (WORKFLOW_DEFINITIONS): each with its own
+        # trigger and executable stages, assembled from the enabled definitions
+        # under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
+        # Definitions are the engine's boot-loaded config source and deployment
+        # stage catalog. Organisation-scoped database workflows are read per
+        # recording; an in-cluster engine refuses to start only when both the
+        # config definitions and the stage-queue catalog below are empty.
+        - name: WORKFLOWS_QUEUE
+          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
+        - name: WORKFLOW_DEFINITIONS
+          value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
+        # Operation→queue catalog so DB workflows reach workers no config workflow references.
+        - name: WORKFLOW_STAGE_QUEUES
+          value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+
+        # Kerberos Vault — global storage credentials a dispatched stage worker
+        # uses to fetch the media. Per-recording vault overrides (site/account)
+        # are resolved at dispatch time from the database.
+        - name: KERBEROS_STORAGE_URI
+          value: "{{ .Values.kerberosvault.uri }}"
+        - name: KERBEROS_STORAGE_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.accesskey }}"
+        - name: KERBEROS_STORAGE_SECRET
+          value: "{{ .Values.kerberosvault.secretkey }}"
+
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-workflows
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: hub-workflows
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: hub-workflows
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-analysis.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-analysis
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.analysis.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.analysis.replicas }}
   selector:
@@ -18,7 +22,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-analysis
     spec:
@@ -29,10 +33,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.analysis.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.analysis.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.analysis.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.analysis.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,14 +55,20 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.analysis.volumeMounts }}
+        {{- if or .Values.kerberospipeline.analysis.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.analysis.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-analysis") | nindent 8 }}
         - name: LOG_LEVEL
           value: "{{ .Values.kerberospipeline.analysis.logLevel }}"
         - name: CLOUD_PROVIDER
@@ -81,6 +97,18 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+
+        # When true, analysis tees the classify result to the hub-workflows
+        # service in parallel with the throttler/notification tail (which still
+        # runs unchanged). Kept in sync with whether the workflows service runs.
+        - name: WORKFLOWS_ENABLED
+          value: "{{ .Values.kerberoshub.workflows.enabled }}"
+
+        # Queue analysis publishes opened workflow runs to (WORKFLOWS_QUEUE),
+        # taken from the workflows service's queue so analysis and the engine
+        # always agree on the queue name (no drift).
+        - name: WORKFLOWS_QUEUE
+          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
           
         # Kerberos Vault
         - name: KERBEROS_STORAGE_URI
@@ -93,7 +121,14 @@ spec:
         # Sprites
         - name: SPRITE_ENABLED
           value: "{{ .Values.kerberospipeline.sprite.enabled }}"
+
+        # In-memory cache for hot-path MongoDB lookups
+        - name: DB_CACHE_ENABLED
+          value: {{ .Values.kerberospipeline.analysis.dbCache.enabled | default false | quote }}
+        - name: DB_CACHE_TTL
+          value: {{ .Values.kerberospipeline.analysis.dbCache.ttl | default "5m" | quote }}
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -101,6 +136,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-counting.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-counting
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.counting.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.counting.replicas }}
   selector:
@@ -77,6 +81,7 @@ spec:
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -84,6 +89,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-dominantcolor.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-dominantcolor
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.dominantColor.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.dominantColor.replicas }}
   selector:
@@ -77,6 +81,7 @@ spec:
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -84,6 +89,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-event.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-event
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.event.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.event.replicas }}
   selector:
@@ -18,7 +22,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-event
     spec:
@@ -29,10 +33,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.event.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.event.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.event.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.event.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,16 +55,22 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.event.volumeMounts }}
+        {{- if or .Values.kerberospipeline.event.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.event.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         ports:
           - containerPort: 8080
         envFrom:
         - configMapRef:
             name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-event") | nindent 8 }}
         - name: LOG_LEVEL
           value: "{{ .Values.kerberospipeline.event.logLevel }}"
         - name: READ_ONLY
@@ -86,6 +102,7 @@ spec:
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -93,6 +110,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-export.yaml

@@ -18,7 +18,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-export
     spec:
@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.export.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.export.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.export.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.export.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,14 +51,20 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.export.volumeMounts }}
+        {{- if or .Values.kerberospipeline.export.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.export.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-export") | nindent 8 }}
         - name: LOG_LEVEL
           value: "{{ .Values.kerberospipeline.export.logLevel }}"
         {{- if .Values.kerberospipeline.export.playerAssetsPath }}
@@ -122,6 +134,7 @@ spec:
         - name: VAULT_THUMBNAIL_SECRET_KEY
           value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -129,6 +142,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-monitor.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-monitor
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.monitor.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.monitor.replicas }}
   selector:
@@ -18,7 +22,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-monitor
     spec:
@@ -29,10 +33,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.monitor.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.monitor.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.monitor.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.monitor.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,14 +55,24 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.monitor.volumeMounts }}
+        {{- if or .Values.kerberospipeline.monitor.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.monitor.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-monitor") | nindent 8 }}
+        # Application
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.monitor.logLevel }}"
+
         # Queue      
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
@@ -103,6 +123,7 @@ spec:
         - name: SMTP_PASSWORD
           value: "{{ .Values.email.smtp.password }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -110,6 +131,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-notify-test.yaml

@@ -18,7 +18,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-notify-test
     spec:
@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.notifyTest.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.notifyTest.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.notifyTest.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.notifyTest.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,14 +51,20 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
+        {{- if or .Values.kerberospipeline.notifyTest.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-notification-test") | nindent 8 }}
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
@@ -110,6 +122,7 @@ spec:
         - name: SMTP_PASSWORD
           value: "{{ .Values.email.smtp.password }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -117,6 +130,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-notify.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-notify
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.notify.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.notify.replicas }}
   selector:
@@ -18,7 +22,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-notify
     spec:
@@ -29,10 +33,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.notify.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.notify.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.notify.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.notify.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,16 +55,24 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.notify.volumeMounts}}
+        {{- if or .Values.kerberospipeline.notify.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.notify.volumeMounts}}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-notification") | nindent 8 }}
         - name: LOG_LEVEL
           value: "{{ .Values.kerberospipeline.notify.logLevel }}"
+        - name: NOTIFICATION_EXPIRY_MINUTES
+          value: "{{ .Values.kerberospipeline.notify.notificationExpiryMinutes }}"
         # Queue
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
@@ -80,6 +98,14 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+        - name: AUDIT_ENABLED
+          value: {{ and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled | quote }}
+        {{- if and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled }}
+        - name: AUDIT_QUEUE
+          value: {{ .Values.audit.intake.queue | quote }}
+        - name: AUDIT_DEADLETTER_QUEUE
+          value: {{ .Values.audit.intake.deadletterQueue | quote }}
+        {{- end }}
 
         # Kerberos Vault
         - name: STORAGE_URI
@@ -142,6 +168,7 @@ spec:
         - name: VAULT_SPRITE_SECRET_KEY
           value: "{{ .Values.kerberosvault.sprite.secretKey }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -149,6 +176,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-redaction.yaml

@@ -1,114 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pipe-redaction
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberospipeline.redaction.replicas }}
-  selector:
-    matchLabels:
-      app: pipe-redaction
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      labels:
-        app: pipe-redaction
-    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.redaction.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.redaction.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: pipe-redaction
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.redaction.repository }}:{{ .Values.kerberospipeline.redaction.tag }}"
-        imagePullPolicy: {{ .Values.kerberospipeline.redaction.pullPolicy }}
-        {{- with .Values.kerberospipeline.redaction.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.redaction.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.redaction.logLevel }}"
-        - name: CLOUD_PROVIDER
-          value: "{{ .Values.cloudProvider }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ .Values.queueProvider }}"
-
-        # Kafka settings
-        - name: KAFKA_BROKER
-          value: "{{ .Values.kafka.broker }}"
-        - name: KAFKA_USERNAME
-          value: "{{ .Values.kafka.username }}"
-        - name: KAFKA_PASSWORD
-          value: "{{ .Values.kafka.password }}"
-        - name: KAFKA_MECHANISM
-          value: "{{ .Values.kafka.mechanism }}"
-        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
-        # Kerberos Vault (used to download the source media and upload the redacted artifact).
-        - name: KERBEROS_STORAGE_URI
-          value: "{{ .Values.kerberosvault.uri }}"
-        - name: KERBEROS_STORAGE_PROVIDER
-          value: "{{ .Values.kerberosvault.provider }}"
-        - name: KERBEROS_STORAGE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.accesskey }}"
-        - name: KERBEROS_STORAGE_SECRET
-          value: "{{ .Values.kerberosvault.secretkey }}"
-
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-redaction
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-redaction
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-redaction
-{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-sequence.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-sequence
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.sequence.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.sequence.replicas }}
   selector:
@@ -18,7 +22,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-sequence
     spec:
@@ -29,10 +33,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.sequence.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.sequence.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.sequence.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.sequence.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,14 +55,20 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.sequence.volumeMounts }}
+        {{- if or .Values.kerberospipeline.sequence.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.sequence.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-sequence") | nindent 8 }}
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
@@ -80,6 +96,7 @@ spec:
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -87,6 +104,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-sprite.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-sprite
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.sprite.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.sprite.replicas }}
   selector:
@@ -100,6 +104,7 @@ spec:
         - name: VAULT_SPRITE_HEIGHT
           value: "{{ .Values.kerberospipeline.sprite.height }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -107,6 +112,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-throttler.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-throttler
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.throttler.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.throttler.replicas }}
   selector:
@@ -18,7 +22,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-throttler
     spec:
@@ -29,10 +33,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.throttler.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.throttler.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.throttler.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.throttler.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,14 +55,20 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.throttler.volumeMounts }}
+        {{- if or .Values.kerberospipeline.throttler.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.throttler.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-throttler") | nindent 8 }}
         - name: LOG_LEVEL
           value: "{{ .Values.kerberospipeline.throttler.logLevel }}"
         - name: CLOUD_PROVIDER
@@ -82,6 +98,7 @@ spec:
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -89,6 +106,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-thumbnail.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-thumbnail
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.thumbnail.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.thumbnail.replicas }}
   selector:
@@ -103,6 +107,7 @@ spec:
         - name: VAULT_THUMBNAIL_SECRET_KEY
           value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
         
+        {{- if .Values.opentelemetry.enabled }}
         # Open Telemetry tracing
         - name: OTEL_EXPORTED_OTLP_ENABLED
           value: "{{ .Values.opentelemetry.enabled }}"
@@ -110,6 +115,7 @@ spec:
           value: "{{ .Values.opentelemetry.routingEnabled }}"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
 
 ---
 apiVersion: v1

charts/hub/templates/kerberos-vault/vault-forwarder.yaml

@@ -19,7 +19,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: vault-forwarder
     spec:
@@ -27,10 +27,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.forwarder.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.forwarder.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -43,14 +49,20 @@ spec:
             requests:
               memory: 10Mi
               cpu: 10m
-          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
+          {{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
           envFrom:
           - configMapRef:
               name: mongodb-config
           env:
+          {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "vault-forwarder") | nindent 10 }}
           - name: ITERATION_SPEED
             value: "5"
           - name: BUFFER_TIME

charts/hub/templates/kerberos-vault/vault-proxy.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.mode "all" -}}
+{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:

charts/hub/values.schema.json

@@ -0,0 +1,101 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "classificationCatalogExistingConfigMap": {
+      "type": "string",
+      "maxLength": 253,
+      "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+    },
+    "classificationCatalog": {
+      "not": {},
+      "description": "Removed in 0.155.0. Store the complete catalog in a ConfigMap and use workflowConfiguration.configMaps with replace: true at catalogs/classifications.json."
+    },
+    "kerberoshub": {
+      "type": "object",
+      "properties": {
+        "api": {
+          "type": "object",
+          "properties": {
+            "corsAllowedOrigins": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "pattern": "^https?://[^/?#]+$"
+              }
+            }
+          }
+        }
+      }
+    },
+    "workflowConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["enabled"],
+      "not": {
+        "allOf": [
+          {"anyOf": [{"required": ["includeDefaults"]}, {"required": ["configMaps"]}]},
+          {"anyOf": [{"required": ["existingConfigMap"]}, {"required": ["items"]}, {"required": ["extraConfigMaps"]}]}
+        ]
+      },
+      "properties": {
+        "enabled": {"type": "boolean"},
+        "includeDefaults": {
+          "type": "boolean",
+          "description": "Include bundled files not explicitly replaced by configMaps items; true when omitted."
+        },
+        "configMaps": {
+          "type": "array",
+          "items": {"$ref": "#/definitions/configMapSource"},
+          "description": "Add files or explicitly replace a bundled file using replace: true on an item."
+        },
+        "extraConfigMaps": {
+          "type": "array",
+          "description": "Legacy additive sources; use configMaps for new deployments.",
+          "items": {"$ref": "#/definitions/configMapSource"}
+        },
+        "existingConfigMap": {
+          "type": "string",
+          "maxLength": 253,
+          "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+        },
+        "items": {
+          "type": "array",
+          "items": {"$ref": "#/definitions/configMapItem"}
+        }
+      }
+    }
+  },
+  "definitions": {
+    "configMapSource": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "items"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "maxLength": 253,
+          "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+        },
+        "items": {
+          "type": "array",
+          "minItems": 1,
+          "items": {"$ref": "#/definitions/configMapItem"}
+        }
+      }
+    },
+    "configMapItem": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["key", "path"],
+      "properties": {
+        "key": {"type": "string", "pattern": "^[A-Za-z0-9._-]+$"},
+        "path": {"type": "string", "pattern": "^(workflow-contracts|catalogs)/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.(yaml|json)$"},
+        "replace": {
+          "type": "boolean",
+          "description": "Replace this whole bundled file, not individual fields/entries. Requires configMaps and includeDefaults: true; the path must identify a bundled file."
+        }
+      }
+    }
+  }
+}

charts/hub/values.yaml

@@ -46,6 +46,10 @@ mongodb:
   # MongoDB URI (for example for a SaaS service like MongoDB Atlas)
   # If uri is set, the below properties are not used (host, adminDatabase, username, password)
   #uri: "mongodb+srv://xx:xx@kerberos-hub.xxx.mongodb.net/?retryWrites=true&w=majority&appName=xxx"
+  # When uri is set, give each workload its own appName (hub-api,
+  # hub-pipeline-monitor, ...) instead of the one in uri, so the Atlas query
+  # profiler and currentOp show which service issued an operation.
+  appNamePerService: true
 
   # Self-hosted mongodb, you could also use the uri property above.
   host: mongodb.mongodb
@@ -60,13 +64,50 @@ mongodb:
   # and indexes, complex $lookup pipelines, etc.). When using DocumentDB you
   # should also set retryWrites: "false".
   flavor: "mongodb"
+  # TLS for MongoDB-compatible backends. When uri is set, missing TLS query
+  # parameters are appended automatically. AWS DocumentDB requires TLS and a
+  # trusted RDS CA bundle, typically stored in an existing Kubernetes Secret.
+  tls:
+    enabled: false
+    existingSecret: ""
+    caFileName: ""
+    mountPath: "/etc/mongodb/tls"
+    insecureSkipVerify: false
+
+# Classifications supported by Hub filters, alerts, markers, and other
+# downstream processing. Classifier output keys must match these values.
+# Disable this to use the legacy classification catalog stored in MongoDB.
+classificationCatalogEnabled: true
+# Optional existing ConfigMap in the release namespace with classifications.json.
+# When set, do not create a catalog ConfigMap; this replaces bundled defaults.
+classificationCatalogExistingConfigMap: ""
+# Defaults live in templates/configMaps/catalogs/classifications.yaml.
+# Inline classificationCatalog values are no longer accepted (including null/[]).
+# Use a ConfigMap item with path: catalogs/classifications.json and replace: true.
+
+# Configuration packaging only: consuming contracts requires a compatible
+# API/frontend. Enabling this mounts files but does not register stage workers.
+workflowConfiguration:
+  enabled: false
+  # Omitted includeDefaults means true; false requires a nonempty configMaps list.
+  # includeDefaults: true
+  # configMaps: []
+  # Each ConfigMap supplies name and items [{key, path, replace?}] in the release namespace.
+  # An item with replace: true replaces one bundled file while retaining other defaults.
+  # Replacement requires includeDefaults: true and a known bundled destination path.
+  # Unmarked collisions and repeated custom destinations are rejected.
+  # Replacing catalogs/classifications.json also supplies the classification API:
+  # do not combine it with classificationCatalogExistingConfigMap.
+  # Legacy existingConfigMap/items/extraConfigMaps remain supported, but cannot
+  # be mixed with includeDefaults/configMaps. Both interfaces are omitted here
+  # so Helm's default merging does not introduce a false mixed configuration.
 ###################################################
 # MQTT configuration (bi-directional communication)
 ###################################################
 # A MQTT broker (vernemq or other like mosquitto) is used to have a bi-directional communication between Agents and Hub.
 # We recommend to use VernemQ (as part of this installation), but a stand-alone mosquitto broker is also possible.
 mqtt:
-  host: "mqtt.yourdomain.com" # this needs to be a public accessible DNS name (it's used to communicate between Agents and Kerberos Hub)
+  host: "mqtt.yourdomain.com" # this needs to be a public accessible DNS name (it's used to communicate between Kerberos Agents and Kerberos Hub)
   port: "8443"
   protocol: "wss"
   username: "yourusername"
@@ -93,6 +134,16 @@ rabbitmq:
   username: "yourusername"
   password: "yourpassword"
   exchange: ""
+# Shared audit transport. The master switch controls the consumer and all
+# producers; individual services may opt out through their own audit setting.
+audit:
+  enabled: false
+  intake:
+    queue: "hub-audit-events"
+    deadletterQueue: "hub-audit-dead-letter"
+    maxRetries: 10
+    prefetchCount: 20
+    persistTimeout: "10s"
 # If you already have a Kafka cluster you might use this instead of RabbitMQ.
 kafka:
   broker: "kafka1.yourdomain.com:9094" # can be internal dns name or external
@@ -121,7 +172,12 @@ opentelemetry:
   enabled: false
   routingEnabled: false
   collector:
-    endpoint: "http://otel-collector:4317"
+    # NOTE: the services use the OTLP *HTTP* exporter, so this must be the
+    # collector's HTTP port (4318) and must include the scheme. Use http://
+    # for a plaintext in-cluster collector (e.g. Jaeger) and https:// only if
+    # the collector terminates TLS. A scheme-less value defaults to TLS and
+    # fails against a plaintext collector ("server gave HTTP response to HTTPS client").
+    endpoint: "http://otel-collector:4318"
 ############################################
 # OpenAI configuration (semantic search)
 #
@@ -226,8 +282,10 @@ kerberoshub:
   api:
     repository: ghcr.io/uug-ai/hub-api
     pullPolicy: IfNotPresent
-    tag: "v1.9.8"
+    tag: "v1.9.51"
     replicas: 2
+    audit:
+      enabled: true
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Set to false to skip rendering the hub-api Service (e.g. when an
     # external/shared Service is managed elsewhere).
@@ -236,6 +294,22 @@ kerberoshub:
     jwtSecret: "this-is-a-secret-please-change-to-random-string" # change to a random value, this is for generating JWT tokens.
     schema: "https"
     url: "api.yourdomain.com"
+    # Additional complete HTTP(S) origins allowed to call the Hub API.
+    # The configured frontend origins remain allowed automatically.
+    corsAllowedOrigins: []
+    # Temporarily stop serving the polled GET /devices list: hub-api answers 204
+    # without querying MongoDB. The frontend still loads devices once through
+    # /session/bootstrap, but device online/offline status stops refreshing.
+    disableAgentHeartbeat: false
+    # Media proxy: when enabled, hub-api wraps every media URL it receives from
+    # Kerberos Vault into an opaque hub-api URL ({schema}://{url}/media/proxy?t=...)
+    # and streams the object itself, so clients never see Vault or the
+    # underlying storage endpoint. Increases hub-api egress/bandwidth.
+    mediaProxy:
+      enabled: false
+      publicUrl: "" # Optional override of the public hub-api base URL; defaults to {schema}://{url}.
+      key: "" # Optional encryption key (openssl rand -hex 32); defaults to a key derived from jwtSecret. Must be identical on all replicas.
+      ttl: "" # Optional lifetime of proxied URLs (Go duration, e.g. "12h"); defaults to 24h, max 168h.
     resources:
       requests:
         memory: 100Mi
@@ -339,7 +413,7 @@ kerberoshub:
   frontend:
     repository: ghcr.io/uug-ai/hub-frontend
     pullPolicy: IfNotPresent
-    tag: "v1.9.11"
+    tag: "v1.13.9"
     replicas: 2
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Set to false to skip rendering the hub-frontend Service (e.g. when an
@@ -372,8 +446,8 @@ kerberoshub:
     #  - hosts:
     #      - "demo.yourdomain.com"
     #    secretName: kerberoshub-demo
-    # You can disable the Agent buttons, this make sense
-    # in a white-label setup, or where you are managing the Agents for your customers.
+    # You can disable the Kerberos agent buttons, this make sense
+    # in a white-label setup, or where you are managing the Kerberos Agents for your customers.
     hideAddAgent: "false"
     # Multi tenancy (domains)
     # By default the Kerberos Hub allows multi-tenancy through the concept
@@ -391,17 +465,32 @@ kerberoshub:
     logo: "custom"
     # Custom layout: override css, favicons and translations (i18n)
     # By providing a style.css file in the custom folder this file will override
-    # any css styling. Favicons are mounted into the favicon folder. Custom
-    # translation files (e.g. en.json, nl.json, ...) can be mounted into the
-    # i18n folder to override the built-in translations shipped in the image.
-    # An example translation file can be found in custom-layout/i18n/en.json.
+    # any css styling. Favicons are mounted into the favicon folder.
+    #
+    # Translations (i18n): for each language the served strings are
+    #   deepMerge(assets/i18n/<lang>.json, assets/i18n-custom/<lang>.json)
+    # — your optional overrides layered on top of the shipped base file. To
+    # customise, mount a volume at assets/i18n-custom holding <lang>.json files
+    # with the keys you want to change. Any key you omit falls back to the shipped
+    # value, so keys added in future releases always render a real string (never a
+    # raw key) and you only maintain your diffs. Put as little or as much here as
+    # you like — even a complete file — but mounting at this overlay layer is
+    # always the safe choice, because missing keys can never leak into the UI.
+    # You only need files for the languages you actually customise. A partial
+    # example lives in custom-layout/i18n-custom/en.json; the matching complete
+    # files (handy to copy keys from) are published as hub-frontend release assets
+    # (en.json / i18n-<tag>.zip) and ship in the image at assets/i18n.
+    #
+    # (Backward compatibility: deployments that instead mount complete files over
+    # assets/i18n keep working, but that layer has no fallback — any key you do
+    # not supply shows as a raw key — so prefer assets/i18n-custom for new setups.)
     #volumeMounts:
     #  - name: custom-layout
     #    mountPath: /usr/share/nginx/html/assets/custom
     #  - name: custom-favicon
     #    mountPath: /usr/share/nginx/html/assets/favicon
     #  - name: custom-i18n
-    #    mountPath: /usr/share/nginx/html/assets/i18n
+    #    mountPath: /usr/share/nginx/html/assets/i18n-custom
     #volumes:
     #  - name: custom-layout
     #    persistentVolumeClaim:
@@ -433,6 +522,8 @@ kerberoshub:
     features:
       # General
       darkModeEnabled: "true" # Enable or disable dark mode toggle 'true' or 'false'
+      splashScreen:
+        enabled: "true" # Enable or disable the pre-bootstrap splash screen 'true' or 'false'
       landingPage: "/dashboard" # Landing page after login '/dashboard', '/liveview', '/media', '/devices', '/sites', '/groups'
       # Internationalization (i18n): controls the runtime language behaviour
       # of the front-end. When `enabled` is "false" the language switcher is
@@ -446,20 +537,52 @@ kerberoshub:
       # Workflows allow you to define automated processes and actions in the front-end.
       workflows:
         enabled: "false" # Enable or disable workflows feature 'true' or 'false'
+      # Audit events are visible to owner/admin users when enabled.
+      audit:
+        enabled: "true" # Enable or disable the Audit events page and navigation link 'true' or 'false'
+      # Organisation controls remain visible as a read-only current organisation when switching is disabled.
+      organisations:
+        enabled: "" # Enable or disable the organisation feature family, including projects; when empty, child groups apply independently
+        switcherEnabled: "false" # Enable or disable organisation switching 'true' or 'false'
+        creationEnabled: "false" # Enable or disable organisation creation; requires switcherEnabled 'true' or 'false'
+        settingsEnabled: "false" # Enable or disable the organisation settings link 'true' or 'false'
+      projects:
+        enabled: "" # Fallback project group switch used only when organisations.enabled is empty
+        switcherEnabled: "false" # Enable or disable the read-only project dropdown 'true' or 'false'
+        creationEnabled: "false" # Reserved for project creation UI 'true' or 'false'
+        settingsEnabled: "false" # Reserved for project settings UI 'true' or 'false'
       # Map tile configuration  
       map:
         tileUrlLight: "https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png" # Map tile URL for light mode
         tileUrlDark: "https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png" # Map tile URL for dark mode
         attribution: "&copy; <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>" # Map attribution
+        overlayTileUrl: "" # Optional XYZ overlay URL; supports {z}, {x}, {y}, and {apiKey}
+        overlayApiKey: "" # Optional browser-visible API key substituted into overlayTileUrl
+        overlayAttribution: "" # Attribution displayed when the overlay is enabled
+        overlayMinZoom: "0" # Minimum overlay zoom level
+        overlayMaxZoom: "19" # Maximum overlay zoom level
+        overlayOpacity: "1" # Overlay opacity from 0 to 1
       # Live view page
       liveview:
         defaultStreamMode: "SD" # Default stream mode 'SD' or 'HD' (will be migrated to 'preview' or 'live')
+        liveStreamMode: "webrtc" # Transport backing the LIVE (HD) mode: 'webrtc' (default), 'hls' or 'moq'
+        hlsEnabled: "true" # Offer HLS as a selectable LIVE transport 'true' or 'false'. When 'false' the HLS option is removed from the front-end and streams use webrtc
+        moqEnabled: "false" # Offer MoQ as a selectable LIVE transport 'true' or 'false'
+        remoteRecordingEnabled: "true" # Show the manual REC control and recording-state overlay in live views
+        deviceStatusEnabled: "true" # Show connectivity and recent-motion status in live view tile headers
+        moqRelayUrl: "https://relay.uug.ai/anon" # WebTransport URL of the MoQ relay
+        moqBroadcastPrefix: "devices" # Prefix used to build devices/<deviceKey>/live.hang broadcast names
         paginationMode: "scroll" # Pagination mode in live view 'scroll', 'numbered' or 'maxStreams'
         pageSize: "6" # Max streams shown per page when paginationMode is 'numbered' (4, 8, 12, 16 or 25)
         maxStreams: "-1" # Maximum number of live streams to show in live view, -1 for unlimited
       # Device page
       devices:
         hideAgent: "false" # Hide the 'add agent' button in the front-end
+        analyticsEnabled: "true" # Enable or disable the Analytics tab on device detail pages 'true' or 'false'
+        developerToolsEnabled: "true" # Enable or disable device logs and terminal access 'true' or 'false'
+      # Dashboard page
+      dashboard:
+        sitesFullscreenEnabled: "true" # Enable or disable the fullscreen Sites map 'true' or 'false'
       # Media page
       media:
         filter:
@@ -475,6 +598,8 @@ kerberoshub:
             enabled: "true" # Enable or disable object detection filter in media 'true' or 'false'
           star:
             enabled: "true" # Enable or disable star filter in media 'true' or 'false'
+          analysis:
+            enabled: "true" # Enable or disable the "with analysis" filter (hides recordings without markers, description or detections) in media 'true' or 'false'
           region:
             enabled: "true" # Enable or disable region filter in media 'true' or 'false'
           sort:
@@ -483,6 +608,11 @@ kerberoshub:
             enabled: "true" # Enable or disable category filter in media 'true' or 'false'
           markers:
             enabled: "true" # Enable or disable markers filter in media 'true' or 'false'
+          markerOptionsByDate:
+            enabled: "false" # Limit marker-related filter options to the selected recording day
+          markerCategoryPriority:
+            enabled: "false" # Order marker options from configured categories before other markers
+            categories: [] # Ordered marker category names, for example ["security", "traffic"]
           events:
             enabled: "true" # Enable or disable events filter in media 'true' or 'false'
           tags:
@@ -490,6 +620,13 @@ kerberoshub:
           defaultView: "timeline" # Default view for media page 'timeline' or 'grid'
       # Chart feature
       chart:
+        colors:
+          - "#84569f"
+          - "#3ba7ff"
+          - "#ff5c8a"
+          - "#4ad991"
+          - "#ffb84d"
+          - "#ff7043"
         colorChartSelectionFill: "rgba(132, 86, 159, 0.07)"
         colorChartSelectionStroke: "rgba(132, 86, 159, 0.4)"
         colorChartGridStroke: "rgba(0, 106, 255, 0.18)"
@@ -517,6 +654,7 @@ kerberoshub:
       # Face redaction feature
       faceRedaction:
         enabled: "false" # Enable or disable face redaction 'true' or 'false'
+        classifierTracksEnabled: "true" # Make classifier-generated tracks available in the redaction modal
     # Optional integrations
     mixpanel: # We can keep track logging in Mixpanel as well
       apikey: "xxx"
@@ -552,7 +690,7 @@ kerberoshub:
   cleanup:
     repository: ghcr.io/uug-ai/hub-cleanup
     pullPolicy: IfNotPresent
-    tag: "v1.4.13"
+    tag: "v1.4.19"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -588,14 +726,290 @@ kerberoshub:
     # Tasks with `legal_hold=true` are never deleted. Must match the value
     # used by `kerberoshub.api.defaultTaskRetentionDays`.
     defaultTaskRetentionDays: "0"
+    # Deployment-wide retention for audit events. This is independent from
+    # recording plans, inactive-account cleanup, and the optional global pass.
+    # Set to "0" or a negative value to retain audit events indefinitely.
+    auditEventRetentionDays: "400"
+    # Deployment-wide cap for workflow runs, anchored on run execution time.
+    # Runs always expire with their media; this only shortens their lifetime.
+    # Set to "0" or a negative value to let runs follow media retention only.
+    workflowRunRetentionDays: "0"
     resources:
       requests:
         memory: 10Mi
         cpu: 10m
+  # Dispatches canonical audit_events to one or more external webhook sinks.
+  # Credentials are always read from existing Secrets and never stored here.
+  audit:
+    repository: ghcr.io/uug-ai/hub-audit
+    pullPolicy: IfNotPresent
+    tag: "v1.0.1"
+    replicas: 1
+    dispatchInterval: "5s"
+    leaseDuration: "2m"
+    terminationGracePeriodSeconds: 150 # Keep above leaseDuration so an in-flight cycle can finish.
+    topologySpreadConstraints: []
+    volumes: []
+    volumeMounts: []
+    extraEnv: []
+    serviceMonitor:
+      enabled: true
+      interval: 15s
+    destinations: []
+    # - id: primary-siem
+    #   type: webhook
+    #   enabled: true
+    #   url: https://siem.example.com/api/audit
+    #   timeoutSeconds: 10
+    #   batchSize: 100
+    #   maxAttempts: 10
+    #   startAt: latest # latest | beginning, applied only on first creation
+    #   headers:
+    #     X-Source: kerberos-hub
+    #   bearerTokenSecret:
+    #     name: audit-primary-siem
+    #     key: token
+    #   secretHeaders:
+    #     X-Api-Key:
+    #       secretName: audit-primary-siem
+    #       secretKey: api-key
+    #   filters:
+    #     organisationIds: []
+    #     projectIds: []
+    #     actions: []
+    #     categories: []
+    #     outcomes: [] # success | failure
+    # resources:
+    #   requests:
+    #     memory: 32Mi
+    #     cpu: 10m
+  # hub-workflows is the standalone, queue-driven workflow engine. It consumes
+  # pipeline events and dispatches the stages declared in its workflow
+  # definitions, tracking each run in its own `workflow_runs` collection. It shares events
+  # (not a document) with the analysis pipeline and is meant to grow into the
+  # primary orchestrator. See https://github.com/uug-ai/hub-workflows.
+  workflows:
+    # Disabled by default. When enabled, the analysis service tees each
+    # classify result to this service (via WORKFLOWS_ENABLED on pipe-analysis)
+    # in parallel with the normal throttler/notification tail, which still runs
+    # unchanged. Flip to true to run the workflows engine.
+    enabled: false
+    # This block is purely behaviour: the master switch above plus the workflow
+    # definitions below. The engine's own deployment (image/tag/replicas/queue/
+    # resources) lives under kerberoshub.services.workflows, in the same uniform
+    # shape as the stage workers it dispatches to.
+    #
+    # -----------------------------------------------------------------------
+    # Global workflow definitions — the named workflows the engine runs.
+    #
+    # `definitions` is the engine's deployment-global configuration source and
+    # stage catalog: several distinct workflows can run over one recording, each
+    # opening its own run and dispatching only its own stages. Database-backed
+    # organisation workflows, when present, are read separately per recording.
+    # This is a MAP keyed by workflow name (names are unique and merge cleanly
+    # across -f / --set overrides). Ships empty; the commented block is a worked
+    # example of an object-tracking + loitering pipeline. Add more keys to run
+    # more config workflows.
+    #
+    # Each definition:
+    #   id        optional stable identity: quote a non-zero 24-hex Mongo ObjectID.
+    #             Recommended for new definitions; rendered lowercase. Omit for
+    #             legacy SHA256(exact map key)[:24] identity. Pin that old ID before
+    #             renaming an existing workflow; changing id creates a new identity.
+    #             Invalid IDs and duplicate effective IDs fail Helm rendering,
+    #             including disabled definitions. Name/version are not identity
+    #             when id is explicit. No per-project on/off overrides are provided.
+    #   enabled   include this workflow (soft-delete toggle).
+    #   source    always rendered as "config" (a Helm-defined, ops-managed,
+    #             deployment-global workflow — read-only in the API).
+    #   triggers  how a run OPENS. Omit for a single bare automatic trigger
+    #             (opens for every recording); the per-stage `needs` then decide
+    #             which stages FIRE. Narrow with device/schedule triggers, e.g.
+    #             `- {type: automatic, devices: [{key: <device-key>}]}`.
+    #   stages    the executable stages, each {operation, dispatch?, needs?,
+    #             needsMode?}. dispatch is "always" (default) or "conditional";
+    #             a conditional stage's `needs` are upstream dependencies, each
+    #             {operation?, condition?} — operation is the readiness GATE (the
+    #             upstream op whose data must be present before the condition is
+    #             read; omit for a check on the run root itself), condition is
+    #             {path, op, value} where path is ABSOLUTE from the run root;
+    #             a `*` segment fans out across array elements. needsMode combines
+    #             multiple needs: "any" (default;
+    #             fire on the first match) or "all" (a join; fire once every need
+    #             has resolved and matched). The queue is taken from the matching
+    #             services.<operation> entry, so dispatch and consume cannot drift.
+    #
+    # Every stage `operation` must have a deployed worker under
+    # kerberoshub.services.<operation> (deploy the objecttracking / loitering
+    # workers below).
+    definitions: {}
+    # Replace {} above with the indented examples below to enable them. Their IDs
+    # are pinned to the existing name-derived identities; do not regenerate them.
+    #  tracking-workflow:
+    #    id: "ec7e72bc4cedd32018e1f92a"
+    #    enabled: true
+    #    triggers:
+    #      - type: automatic
+    #    stages:
+    #      - operation: objecttracking
+    #        dispatch: always
+    #      - operation: loitering
+    #        dispatch: conditional
+    #        # Fire loitering once objecttracking has resolved — a readiness join
+    #        # (no condition ⇒ gate on the upstream's presence, not a value).
+    #        needs:
+    #          - operation: objecttracking
+    #  vlm-workflow:
+    #    id: "9e3666c56854b2befdb1f645"
+    #    # Describe every recording with the hub-vlm worker (services.vlm below).
+    #    enabled: true
+    #    triggers:
+    #      - type: automatic
+    #    stages:
+    #      - operation: vlm
+    #        dispatch: always
+    # Optional editor metadata (name, description, params) per operation. With
+    # workflowConfiguration contracts, a stage is offered when it has a valid
+    # contract and a deployed worker (services.<operation>.queue); contract
+    # presentation and params take precedence over these entries.
+    editorStages: []
+    #  - operation: vlm
+    #    name: Describe recording
+    #    description: Summarise the recording with a vision language model.
+    #  - operation: forwarder
+    #    name: Forward to my system
+    #    description: Send the result to the external destination configured for the forwarder.
+  # Workflow deployments. Every workflows-subsystem Deployment's image/tag/
+  # replicas/resources/queue lives here in a single, uniform shape:
+  #   - `workflows` is the engine itself (the orchestrator). It is deployed
+  #     whenever kerberoshub.workflows.enabled is true and has no `enabled` of
+  #     its own — the master switch already gates the whole subsystem.
+  #   - every other entry is a stage worker the engine dispatches to. A worker
+  #     consumes its own queue and routes its result back to the engine queue.
+  #     Deploying a worker (services.<name>.enabled) is independent from routing
+  #     to it (a workflows.definitions stage of the same operation) — it runs only
+  #     when its own `enabled` is true AND the workflows engine is enabled.
+  #     Worker-specific settings go in `env` (plain key/values) and `secretEnv`
+  #     (ENV_NAME: {name, key} of an existing Secret, for credentials).
+  services:
+    # hub-workflows — the workflows engine (orchestrator). Consumes the engine
+    # queue, evaluates the boot-loaded config workflows (WORKFLOW_DEFINITIONS)
+    # plus organisation-scoped database workflows, and dispatches to the stage
+    # workers below. Deployed when workflows.enabled is true; it has no separate
+    # `enabled` here.
+    workflows:
+      repository: ghcr.io/uug-ai/hub-workflows
+      pullPolicy: IfNotPresent
+      tag: "v1.0.0"
+      replicas: 1 # Number of pods for the service.
+      topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+      # Optional extra volumes / volumeMounts for this deployment (empty = none).
+      #volumes:
+      #  - name: extra
+      #    emptyDir: {}
+      #volumeMounts:
+      #  - name: extra
+      #    mountPath: /data
+      logLevel: "info" # possible values: trace, debug, info, warn, error
+      # Queue this service consumes ingest events and upstream results from
+      # (WORKFLOWS_QUEUE). Must be fed the same messages the analysis service sees.
+      queue: "hub-workflows-queue"
+      resources:
+        requests:
+          memory: 10Mi
+          cpu: 10m
+          # ---------------------------------------------------------------------
+          # EXAMPLE custom stage worker (commented out) — hub-loitering.
+          #
+          # Companion deployment for the workflows.definitions example above (the
+          # loitering stage of tracking-workflow). Uncomment to deploy the demo
+          # worker. It ships as its own repository/module.
+          # See https://github.com/uug-ai/hub-loitering.
+          #loitering:
+          #  # Deploy the hub-loitering worker.
+          #  enabled: true
+          #  repository: ghcr.io/uug-ai/hub-loitering
+          #  pullPolicy: IfNotPresent
+          #  tag: "v1.0.0"
+          #  replicas: 1 # Number of pods for the worker.
+          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+          #  #volumes:
+          #  #  - name: extra
+          #  #    emptyDir: {}
+          #  #volumeMounts:
+          #  #  - name: extra
+          #  #    mountPath: /data
+          #  logLevel: "info" # possible values: trace, debug, info, warn, error
+          #  # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
+          #  # same value is taken into the matching workflows.definitions stage, so the
+          #  # engine dispatches and the worker consumes the same queue with no drift.
+          #  # Convention: "kcloud-<operation>-queue.fifo".
+          #  queue: "kcloud-loitering-queue.fifo"
+          #  resources:
+          #    requests:
+          #      memory: 10Mi
+          #      cpu: 10m
+          # ---------------------------------------------------------------------
+          # EXAMPLE stage worker (commented out) for the workflows.definitions example
+          # above — hub-objecttracking. Uncomment the worker whose operation a
+          # definition references, so the engine dispatches and the worker consumes the
+          # same queue with no drift.
+          #objecttracking:
+          #  # Deploy the object-tracking worker (operation "objecttracking").
+          #  enabled: true
+          #  repository: ghcr.io/uug-ai/hub-objecttracking
+          #  pullPolicy: IfNotPresent
+          #  tag: "v1.0.0"
+          #  replicas: 1 # Number of pods for the worker.
+          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+          #  logLevel: "info" # possible values: trace, debug, info, warn, error
+          #  # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
+          #  queue: "kcloud-objecttracking-queue.fifo"
+          #  resources:
+          #    requests:
+          #      memory: 10Mi
+          #      cpu: 10m
+          # ---------------------------------------------------------------------
+          # EXAMPLE stage worker (commented out) — hub-vlm (operation "vlm").
+          #
+          # Samples frames from the recording, describes them with an Azure OpenAI
+          # vision model and emits timeline markers plus a recording description.
+          # Route to it with a workflows.definitions stage `- operation: vlm`.
+          # See https://github.com/uug-ai/hub-vlm for every VLM_* / AZURE_OPENAI_*
+          # setting. Create the API key Secret first, e.g.
+          #   kubectl create secret generic hub-vlm-azure-openai \
+          #     --from-literal=apiKey=<azure-openai-api-key>
+          #vlm:
+          #  # Deploy the hub-vlm worker.
+          #  enabled: true
+          #  repository: ghcr.io/uug-ai/hub-vlm
+          #  pullPolicy: IfNotPresent
+          #  tag: "v1.0.0"
+          #  replicas: 1 # Number of pods for the worker.
+          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+          #  logLevel: "info" # possible values: trace, debug, info, warn, error
+          #  # Queue this worker consumes dispatched messages from (VLM_QUEUE).
+          #  queue: "hub-vlm-queue"
+          #  env:
+          #    AZURE_OPENAI_ENDPOINT: "https://<resource>.openai.azure.com"
+          #    AZURE_OPENAI_DEPLOYMENT: "gpt-5.4-mini" # Name of the model deployment.
+          #    AZURE_OPENAI_REASONING_EFFORT: "low" # none | minimal | low | medium | high
+          #    VLM_MAX_FRAMES: "8" # Frames sampled per recording (max 32).
+          #    VLM_FRAME_WIDTH: "1024" # Maximum frame width in pixels.
+          #    VLM_SET_DESCRIPTION: "true" # Write the summary to the recording description.
+          #  # The API key is read from an existing Secret, never from values.
+          #  secretEnv:
+          #    AZURE_OPENAI_API_KEY:
+          #      name: hub-vlm-azure-openai
+          #      key: apiKey
+          #  resources:
+          #    requests:
+          #      memory: 128Mi
+          #      cpu: 100m
   monitordevice:
     repository: ghcr.io/uug-ai/hub-monitor-device
     pullPolicy: IfNotPresent
-    tag: "v1.4.0"
+    tag: "v1.4.2"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -615,7 +1029,7 @@ kerberoshub:
     repository: uugai/hub-reactivatesubscriptions
     pullPolicy: IfNotPresent
     tag: "v1.0.2"
-    replicas: 1 # Number of pods for the service.
+    replicas: 0 # Number of pods for the service. Set to 0 to disable.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
     #volumes:
@@ -648,10 +1062,11 @@ kerberoshub:
     #    cpu: 10m
   # This proxy is legacy for the old agent, will be migrated in the new Hub API.
   proxy:
+    enabled: false
     repository: uugai/hub-proxy
     pullPolicy: IfNotPresent
     tag: "v1.0.0"
-    replicas: 1 # Number of pods for the service.
+    replicas: 0 # Number of pods for the service when enabled.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
     #volumes:
@@ -671,9 +1086,13 @@ kerberoshub:
 # The pipeline is a critical component of Kerberos Hub, and should be monitored closely.
 kerberospipeline:
   event:
+    deploymentAnnotations: {}
+    # Example (opt-in Argo CD ordering):
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "10"
     repository: ghcr.io/uug-ai/hub-pipeline-event
     pullPolicy: IfNotPresent
-    tag: "v1.3.0"
+    tag: "v1.3.1"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -690,8 +1109,11 @@ kerberospipeline:
         cpu: 10m
   monitor:
     repository: ghcr.io/uug-ai/hub-pipeline-monitor
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "70"
     pullPolicy: IfNotPresent
-    tag: "v1.3.9"
+    tag: "v1.3.13"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -701,14 +1123,18 @@ kerberospipeline:
     #volumeMounts:
     #  - name: extra
     #    mountPath: /data
+    logLevel: "info" # possible values: debug, info, warn, error
     resources:
       requests:
         memory: 10Mi
         cpu: 10m
   sequence:
     repository: ghcr.io/uug-ai/hub-pipeline-sequence
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "60"
     pullPolicy: IfNotPresent
-    tag: "v1.6.18"
+    tag: "v1.6.26"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -724,8 +1150,11 @@ kerberospipeline:
         cpu: 10m
   throttler:
     repository: uugai/hub-pipeline-throttler
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "30"
     pullPolicy: IfNotPresent
-    tag: "v1.2.0"
+    tag: "v1.2.1"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -742,11 +1171,17 @@ kerberospipeline:
         cpu: 10m
   notify:
     repository: ghcr.io/uug-ai/hub-pipeline-notification
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "20"
     pullPolicy: IfNotPresent
-    tag: "v1.3.9"
+    tag: "v1.3.18"
     replicas: 1 # Number of pods for the service.
+    audit:
+      enabled: true
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     logLevel: "info" # possible values: trace, debug, info, warn, error
+    notificationExpiryMinutes: "15" # Maximum recording age before notification delivery; 0 disables expiry.
     resources:
       requests:
         memory: 10Mi
@@ -762,7 +1197,7 @@ kerberospipeline:
   notifyTest:
     repository: uugai/hub-pipeline-notification-test
     pullPolicy: IfNotPresent
-    tag: "v1.2.1"
+    tag: "v1.2.2"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     resources:
@@ -779,8 +1214,11 @@ kerberospipeline:
         #      claimName: custom-layout-claim
   analysis:
     repository: ghcr.io/uug-ai/hub-pipeline-analysis
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "40"
     pullPolicy: IfNotPresent
-    tag: "v1.7.8"
+    tag: "v1.8.5"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -791,14 +1229,22 @@ kerberospipeline:
     #  - name: extra
     #    mountPath: /data
     logLevel: "info" # possible values: trace, debug, info, warn, error
+    # In-memory cache for hot-path MongoDB lookups (site vault per device).
+    # Site changes apply after at most one TTL; each replica caches separately.
+    dbCache:
+      enabled: false
+      ttl: "5m" # Go duration, e.g. "30s", "5m"
     resources:
       requests:
         memory: 10Mi
         cpu: 10m
   dominantColor:
     repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     pullPolicy: IfNotPresent
-    tag: "v2.0.2"
+    tag: "v2.0.3"
     replicas: 3 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -818,8 +1264,11 @@ kerberospipeline:
         cpu: 1000m
   thumbnail:
     repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     pullPolicy: IfNotPresent
-    tag: "v1.3.4"
+    tag: "v1.3.10"
     replicas: 2 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -844,8 +1293,11 @@ kerberospipeline:
         cpu: 1000m
   counting:
     repository: uugai/hub-pipeline-counting
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     pullPolicy: IfNotPresent
-    tag: "v1.6.3"
+    tag: "v2.0.0"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -862,9 +1314,12 @@ kerberospipeline:
         cpu: 10m
   sprite:
     enabled: false # Enable or disable the sprite generation 'true' or 'false
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     repository: ghcr.io/uug-ai/hub-pipeline-sprite
     pullPolicy: IfNotPresent
-    tag: "v1.1.12"
+    tag: "v1.1.16"
     replicas: 5 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -876,8 +1331,10 @@ kerberospipeline:
     #    mountPath: /data
     logLevel: "info" # possible values: trace, debug, info, warn,
     interval: "1" # Number of secondes between each thumbnail in the sprite
-    width: "240" # Should not be changed for the moment (hard coded in UI)
-    height: "135" # Should not be changed for the moment (hard coded in UI)
+    # Tile size in pixels. Preserve width:height = 16:9 (e.g. 240x135, 480x270, 640x360).
+    # Deploy dimension-aware sprite/analysis workers, Hub API and frontend before increasing.
+    width: "240"
+    height: "135"
     resources:
       requests:
         memory: 512Mi
@@ -888,7 +1345,7 @@ kerberospipeline:
   export:
     repository: ghcr.io/uug-ai/hub-pipeline-export
     pullPolicy: IfNotPresent
-    tag: "v1.2.4"
+    tag: "v1.2.10"
     replicas: 2 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -904,27 +1361,6 @@ kerberospipeline:
       requests:
         memory: 10Mi
         cpu: 10m
-  redaction:
-    repository: ghcr.io/uug-ai/hub-pipeline-redaction
-    pullPolicy: IfNotPresent
-    tag: "v1.0.0"
-    replicas: 2 # Number of pods for the service.
-    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-    # Optional extra volumes / volumeMounts for this deployment (empty = none).
-    #volumes:
-    #  - name: extra
-    #    emptyDir: {}
-    #volumeMounts:
-    #  - name: extra
-    #    mountPath: /data
-    logLevel: "info" # possible values: trace, debug, info, warn, error
-    resources:
-      requests:
-        memory: 512Mi
-        cpu: 500m
-      limits:
-        memory: 2Gi
-        cpu: 1000m
 ###########################################################################
 # Email configuration
 #
@@ -952,11 +1388,15 @@ email:
     forgotTitle: "Password reset Kerberos Hub. You forgot your password"
     share: "share"
     shareTitle: "[Action] You received a recording from Kerberos Hub"
+    caseShare: "share_case"
+    caseShareTitle: "[Action] A case has been shared with you on Kerberos Hub"
+    caseShareOtp: "share_case_otp"
+    caseShareOtpTitle: "Your Kerberos Hub verification code"
     assignTask: "assign_task"
     assignTaskTitle: "[Action] You've been assigned to a task"
     detection: "detection"
-    disabled: "disabled"
+    disabled: "disable"
     highupload: "highupload"
     device: "device"
     alertTitle: "[Alert] Kerberos Hub detected something an event"
-    deviceTitle: "[Device] An Agent's status has been changed"
+    deviceTitle: "[Device] A Kerberos Agent's status has been changed"

scripts/check-pipeline-deployment-annotations.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CHART_DIR="${1:-charts/hub}"
+
+# Supply per-service test overrides without requiring a separate values file.
+WAVE_FLAGS=()
+for setting in event:10 notify:20 throttler:30 analysis:40 thumbnail:50 sprite:50 dominantColor:50 counting:50 sequence:60 monitor:70; do
+  service="${setting%%:*}"
+  wave="${setting#*:}"
+  WAVE_FLAGS+=(--set-string "kerberospipeline.${service}.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=${wave}")
+done
+
+# Only read Deployment metadata, never pod-template or Service annotations.
+extract_waves() {
+  awk '
+    /^---/ { deployment=0; metadata=0; name="" }
+    /^kind: Deployment$/ { deployment=1 }
+    /^metadata:$/ { metadata=1; next }
+    /^[^ #]/ { metadata=0 }
+    deployment && metadata && /^  name:/ { name=$2 }
+    deployment && metadata && /^    argocd.argoproj.io\/sync-wave:/ {
+      value=$2
+      gsub(/"/, "", value)
+      print name, value
+    }
+  ' | sort
+}
+
+assert_waves() {
+  local rendered="$1"
+  local expected="$2"
+  local actual
+  actual="$(printf '%s\n' "$rendered" | extract_waves)"
+  if [[ "$actual" != "$expected" ]]; then
+    printf 'Unexpected Deployment waves:\n%s\nExpected:\n%s\n' "$actual" "$expected" >&2
+    return 1
+  fi
+  local all_count expected_count
+  all_count="$(printf '%s\n' "$rendered" | grep -c 'argocd.argoproj.io/sync-wave:' || true)"
+  expected_count="$(printf '%s\n' "$expected" | awk 'NF { count++ } END { print count+0 }')"
+  if [[ "$all_count" != "$expected_count" ]]; then
+    echo "Sync-wave annotation leaked outside expected Deployment metadata" >&2
+    return 1
+  fi
+}
+
+expected="$(printf '%s\n' \
+  'pipe-event 10' 'pipe-notify 20' 'pipe-throttler 30' 'pipe-analysis 40' \
+  'pipe-thumbnail 50' 'pipe-sprite 50' 'pipe-dominantcolor 50' \
+  'pipe-counting 50' 'pipe-sequence 60' 'pipe-monitor 70' | sort)"
+
+for mode in all pipeline; do
+  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  assert_waves "$default_render" ""
+  if printf '%s\n' "$default_render" | grep -q '^  annotations: null'; then
+    echo "Empty annotations must be omitted" >&2
+    exit 1
+  fi
+  configured_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  assert_waves "$configured_render" "$expected"
+  echo "OK ($mode): defaults opt out; per-service values assign all ten Deployment waves"
+done
+
+disabled_sprite="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=pipeline)"
+assert_waves "$disabled_sprite" "$(printf '%s\n' "$expected" | grep -v '^pipe-sprite ')"
+
+ui_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=ui --set kerberospipeline.sprite.enabled=true)"
+assert_waves "$ui_render" ""
+
+# Exercise zero/negative strings and an unrelated annotation on the same map.
+for wave in 0 -10; do
+  override="$(helm template hub "$CHART_DIR" --set mode=pipeline \
+    --set-string "kerberospipeline.event.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=$wave" \
+    --set-string 'kerberospipeline.event.deploymentAnnotations.example\.com/owner=queue-team')"
+  assert_waves "$override" "pipe-event $wave"
+  printf '%s\n' "$override" | grep -q "^    argocd.argoproj.io/sync-wave: \"$wave\"$"
+  printf '%s\n' "$override" | grep -q '^    example.com/owner: queue-team$'
+done
+
+echo "All pipeline Deployment annotation checks passed."