Update terminology to use "Agent" instead of "Kerberos Agent" for consistency across documentation and templates

2026-10-19 17:38:27 +00:00 · 2026-06-22 13:21:19 +00:00
12 changed files with 2987 additions and 488 deletions
@@ -1,6 +1,6 @@
 # Kerberos Hub

-Kerberos Hub is the single pane of glass for your Kerberos agents. It comes with a best of breed open source technology stack, modular and scale first mindset, and allows you to build and maintain an everless growing video surveillance and video analytics landscape.
+Kerberos Hub is the single pane of glass for your Agents. It comes with a best of breed open source technology stack, modular and scale first mindset, and allows you to build and maintain an everless growing video surveillance and video analytics landscape.

 ![Kerberos Hub Interface](assets/images/hub-dashboard.png)

@@ -273,7 +273,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.cleanup.defaultTaskRetentionDays` | Default retention (in days) applied to tasks without an explicit `retention_days`. Tasks older than this (anchored on `creation_date`) are deleted with their `case_media` rows. Set to `"0"` or a negative value to keep tasks forever. Must match `kerberoshub.api.defaultTaskRetentionDays`. | `"0"` |
 | `kerberoshub.cleanup.resources.requests.memory` | Memory request for `kerberoshub.cleanup`. | `"10Mi"` |
 | `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
-| `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Kerberos Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
+| `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
 | `kerberoshub.monitordevice.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.0"` |
 | `kerberoshub.monitordevice.replicas` | Number of replicas for `kerberoshub.monitordevice`. | `1` |
@@ -423,7 +423,7 @@ Below all configuration options and parameters are listed.
 | `email.templates.highupload` | The template which is send when an account is reaching a specific upload threshold, by default `'threshold'`. | `"highupload"` |
 | `email.templates.device` | The template which is send when a camera goes online or offline, by default `'device'`. | `"device"` |
 | `email.templates.alertTitle` | Email subject title for the `alert` template. | `"[Alert] Kerberos Hub detected something an event"` |
-| `email.templates.deviceTitle` | Email subject title for the `device` template. | `"[Device] A Kerberos Agent's status has been changed"` |
+| `email.templates.deviceTitle` | Email subject title for the `device` template. | `"[Device] An Agent's status has been changed"` |
 | `email.mailgun.apiKey` | The Mailgun API key linked to your Mailgun domain. | `""` |
 | `imagePullSecrets.name` | Docker registry secret name, which is also granted with the license. This allows you to download the Docker images. | `""` |
 | `kerberoshub.forwarder.pullPolicy` | The Docker registry pull policy. | `""` |
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: custom-i18n-claim
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: azurefile-premium
-  resources:
-    requests:
-      storage: 25Mi
@@ -1,9 +0,0 @@
-{
-  "nav": {
-    "cases": "Investigations",
-    "dashboard": "Home"
-  },
-  "login": {
-    "signInTo": "Sign in to {{domain}} \u2014 Acme Security"
-  }
-}
@@ -225,7 +225,7 @@
                                        margin-bottom: 0;
                                        padding-bottom: 0;
                                        padding-left: 0;
-                                        padding-right: 0;">One of your Kerberos Agents changed</h2>
+                                        padding-right: 0;">One of your Agents changed</h2>
                        <h2 style=" font-family: Inter;
                                        font-size: 20px;
                                        font-style: normal;
@@ -265,7 +265,7 @@
                                        letter-spacing: 0em;
                                        text-align: left;
                                        color: #262424;
-                                        width: 480px">The status your Kerberos Agent changed</h3>
+                                        width: 480px">The status your Agent changed</h3>
                        <p style=" font-family: Inter;
                                        font-size: 14px;
                                        font-style: normal;
@@ -275,8 +275,8 @@
                                        letter-spacing: 0em;
                                        text-align: left;
                                        color: #6D6666;
-                                        margin-top: 12px;">Kerberos Agents go offline due to a variety of reasons. The machine, node, micro controller on which your Kerberos Agent runs, gets corrupted or disconnected from the internet.
-The camera itself is broken, damaged or in the worst case tampered. Have a look into your Kerberos Hub account for the latest recordings and/or verify the connection and status of your Kerberos Agent.</p>
+                                        margin-top: 12px;">Agents go offline due to a variety of reasons. The machine, node, micro controller on which your Agent runs, gets corrupted or disconnected from the internet.
+The camera itself is broken, damaged or in the worst case tampered. Have a look into your Kerberos Hub account for the latest recordings and/or verify the connection and status of your Agent.</p>

 						<a style="text-decoration: none;color: none;" href="{{link}}">
                            <p style="font-family: Inter;
@@ -286,7 +286,7 @@ Tomorrow your account will be reset, and recordings will be uploaded again to yo
                                        letter-spacing: 0em;
                                        text-align: left;
                                        color: #6D6666;
-                                        margin-top: 12px;">If you are hitting your daily limits a lot, you might consider upgrading your Kerberos Hub subscription, or fine-tune your Kerberos Agents so they record less recordings.</p>
+                                        margin-top: 12px;">If you are hitting your daily limits a lot, you might consider upgrading your Kerberos Hub subscription, or fine-tune your Agents so they record less recordings.</p>

 						<a style="text-decoration: none;color: none;" href="{{link}}">
                            <p style="font-family: Inter;
@@ -225,7 +225,7 @@
                                        margin-bottom: 0;
                                        padding-bottom: 0;
                                        padding-left: 0;
-                                        padding-right: 0;">High upload detected by one or more Kerberos Agents</h2>
+                                        padding-right: 0;">High upload detected by one or more Agents</h2>
                    </td>
                    <td class="corner-td" align="right"></td>
                </tr>
@@ -1,42 +0,0 @@
-{{/*
-Assemble the workflows engine stage registry (PIPELINE_STAGE_REGISTRY) as a
-JSON array from every *enabled* stage under kerberoshub.workflows.stages, so the
-engine's routing stays in lockstep with the deployed stage workers and the
-per-stage queue cannot drift. The `stages:` block is the routing source of truth;
-each stage's deployment (and its queue) lives under the matching
-kerberoshub.services.<name> entry.
-
-Each enabled stage contributes one descriptor:
-  operation  defaults to the stage's map key.
-  dispatch   defaults to "always".
-  queue      taken from the matching services.<key>.queue (authoritative; the
-             same value the worker consumes via <NAME>_QUEUE). Omitted when the
-             service or its queue is unset, so the engine derives
-             "kcloud-<operation>-queue.fifo".
-  needs      conditional stages only: the upstream dependencies (each
-             {operation, condition?}) carried through verbatim.
-  needsMode  conditional stages with more than one need: how they combine —
-             "any" (default; fire on the first matching upstream) or "all"
-             (a join; fire only once every need has resolved and matched).
-             Carried through verbatim; omitted when unset (engine defaults any).
-  kind       delegated-ingest stages only: the ingest handler the engine routes
-             the stage's typed payload through (e.g. "detection"). Carried
-             through verbatim; omitted when unset (engine treats the stage as
-             self-persisting).
-*/}}
-{{- define "kerberoshub.workflows.stageRegistry" -}}
-{{- $entries := list -}}
-{{- $services := .Values.kerberoshub.services | default dict -}}
-{{- range $name, $stage := .Values.kerberoshub.workflows.stages -}}
-{{- if $stage.enabled -}}
-{{- $entry := dict "operation" (default $name $stage.operation) "dispatch" (default "always" $stage.dispatch) -}}
-{{- $service := index $services $name -}}
-{{- if $service }}{{- with $service.queue }}{{- $_ := set $entry "queue" . -}}{{- end }}{{- end }}
-{{- with $stage.needs }}{{- $_ := set $entry "needs" . -}}{{- end }}
-{{- with $stage.needsMode }}{{- $_ := set $entry "needsMode" . -}}{{- end }}
-{{- with $stage.kind }}{{- $_ := set $entry "kind" . -}}{{- end }}
-{{- $entries = append $entries $entry -}}
-{{- end -}}
-{{- end -}}
-{{- $entries | toJson -}}
-{{- end -}}
@@ -1,124 +0,0 @@
-{{- /*
-  Generic workflow-stage worker.
-
-  Renders a Deployment + Service for every stage under
-  kerberoshub.workflows.stages that has a matching, enabled worker under
-  kerberoshub.services.<name>. A custom stage joins the pipeline by values
-  alone — no per-stage template needed.
-
-  Every stage worker receives the same connection contract; the only value that
-  varies by stage is the consume-queue variable name, <NAME>_QUEUE (a stage
-  keyed "anpr" gets ANPR_QUEUE, "my-stage" gets MY_STAGE_QUEUE). To run a worker
-  outside the chart instead, leave services.<name>.enabled unset (or false)
-  while keeping the stage under workflows.stages so the engine still routes to
-  the queue you publish.
-*/ -}}
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
-{{- $root := . -}}
-{{- $services := .Values.kerberoshub.services | default dict -}}
-{{- range $name, $stage := .Values.kerberoshub.workflows.stages -}}
-{{- $svc := index $services $name -}}
-{{- if and $svc $svc.enabled -}}
-{{- $queueEnv := printf "%s_QUEUE" ($name | upper | replace "-" "_") -}}
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hub-{{ $name }}
-  namespace: {{ $root.Release.Namespace }}
-spec:
-  replicas: {{ $svc.replicas | default 1 }}
-  selector:
-    matchLabels:
-      app: hub-{{ $name }}
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      labels:
-        app: hub-{{ $name }}
-    spec:
-      {{- if $root.Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" $root.Release.Name $root.Chart.Name | trunc 63 | trimSuffix "-") $root.Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with $root.Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with $svc.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with $svc.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: hub-{{ $name }}
-        image: "{{ $root.Values.global.imageRegistry }}{{ $svc.repository }}:{{ $svc.tag }}"
-        imagePullPolicy: {{ $svc.pullPolicy | default "IfNotPresent" }}
-        {{- with $svc.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with $svc.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        env:
-        - name: LOG_LEVEL
-          value: "{{ $svc.logLevel | default "info" }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ $root.Values.queueProvider }}"
-
-        # The queue this stage worker consumes dispatched "{{ $name }}" stages
-        # from ({{ $queueEnv }}) and the workflows engine queue it routes its
-        # result back to (WORKFLOWS_QUEUE, so the run records the resolution and
-        # any stage that needs "{{ $name }}" can fire).
-        - name: {{ $queueEnv }}
-          value: "{{ $svc.queue }}"
-        - name: WORKFLOWS_QUEUE
-          value: "{{ $root.Values.kerberoshub.services.workflows.queue }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ $root.Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ $root.Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ $root.Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ $root.Values.rabbitmq.password }}"
-
-        # Kerberos Vault — global storage credentials this stage uses to fetch
-        # the media it operates on.
-        - name: KERBEROS_STORAGE_URI
-          value: "{{ $root.Values.kerberosvault.uri }}"
-        - name: KERBEROS_STORAGE_ACCESS_KEY
-          value: "{{ $root.Values.kerberosvault.accesskey }}"
-        - name: KERBEROS_STORAGE_SECRET
-          value: "{{ $root.Values.kerberosvault.secretkey }}"
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: hub-{{ $name }}
-  namespace: {{ $root.Release.Namespace }}
-  labels:
-    app: hub-{{ $name }}
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: hub-{{ $name }}
-{{- end }}
-{{- end }}
-{{- end }}
@@ -1,114 +0,0 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hub-workflows
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberoshub.services.workflows.replicas }}
-  selector:
-    matchLabels:
-      app: hub-workflows
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
-      labels:
-        app: hub-workflows
-    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.services.workflows.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: hub-workflows
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.services.workflows.repository }}:{{ .Values.kerberoshub.services.workflows.tag }}"
-        imagePullPolicy: {{ .Values.kerberoshub.services.workflows.pullPolicy }}
-        {{- with .Values.kerberoshub.services.workflows.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
-        env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberoshub.services.workflows.logLevel }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ .Values.queueProvider }}"
-
-        # Queue this service consumes from (WORKFLOWS_QUEUE) and the custom
-        # pipeline stage registry it may dispatch (PIPELINE_STAGE_REGISTRY).
-        # The registry is assembled from the enabled stages under
-        # kerberoshub.workflows.stages (see _workflows-helpers.tpl).
-        - name: WORKFLOWS_QUEUE
-          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
-        - name: PIPELINE_STAGE_REGISTRY
-          value: {{ include "kerberoshub.workflows.stageRegistry" . | quote }}
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
-        # Kerberos Vault — global storage credentials a dispatched stage worker
-        # uses to fetch the media. Per-recording vault overrides (site/account)
-        # are resolved at dispatch time from the database.
-        - name: KERBEROS_STORAGE_URI
-          value: "{{ .Values.kerberosvault.uri }}"
-        - name: KERBEROS_STORAGE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.accesskey }}"
-        - name: KERBEROS_STORAGE_SECRET
-          value: "{{ .Values.kerberosvault.secretkey }}"
-
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: hub-workflows
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: hub-workflows
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: hub-workflows
-{{- end }}
@@ -81,12 +81,6 @@ spec:
          value: "{{ .Values.rabbitmq.username }}"
        - name: RABBITMQ_PASSWORD
          value: "{{ .Values.rabbitmq.password }}"
-
-        # When true, analysis tees the classify result to the hub-workflows
-        # service in parallel with the throttler/notification tail (which still
-        # runs unchanged). Kept in sync with whether the workflows service runs.
-        - name: WORKFLOWS_ENABLED
-          value: "{{ .Values.kerberoshub.workflows.enabled }}"
          
        # Kerberos Vault
        - name: KERBEROS_STORAGE_URI
@@ -66,7 +66,7 @@ mongodb:
 # A MQTT broker (vernemq or other like mosquitto) is used to have a bi-directional communication between Agents and Hub.
 # We recommend to use VernemQ (as part of this installation), but a stand-alone mosquitto broker is also possible.
 mqtt:
-  host: "mqtt.yourdomain.com" # this needs to be a public accessible DNS name (it's used to communicate between Kerberos Agents and Kerberos Hub)
+  host: "mqtt.yourdomain.com" # this needs to be a public accessible DNS name (it's used to communicate between Agents and Kerberos Hub)
  port: "8443"
  protocol: "wss"
  username: "yourusername"
@@ -372,8 +372,8 @@ kerberoshub:
    #  - hosts:
    #      - "demo.yourdomain.com"
    #    secretName: kerberoshub-demo
-    # You can disable the Kerberos agent buttons, this make sense
-    # in a white-label setup, or where you are managing the Kerberos Agents for your customers.
+    # You can disable the Agent buttons, this make sense
+    # in a white-label setup, or where you are managing the Agents for your customers.
    hideAddAgent: "false"
    # Multi tenancy (domains)
    # By default the Kerberos Hub allows multi-tenancy through the concept
@@ -391,32 +391,17 @@ kerberoshub:
    logo: "custom"
    # Custom layout: override css, favicons and translations (i18n)
    # By providing a style.css file in the custom folder this file will override
-    # any css styling. Favicons are mounted into the favicon folder.
-    #
-    # Translations (i18n): for each language the served strings are
-    #   deepMerge(assets/i18n/<lang>.json, assets/i18n-custom/<lang>.json)
-    # — your optional overrides layered on top of the shipped base file. To
-    # customise, mount a volume at assets/i18n-custom holding <lang>.json files
-    # with the keys you want to change. Any key you omit falls back to the shipped
-    # value, so keys added in future releases always render a real string (never a
-    # raw key) and you only maintain your diffs. Put as little or as much here as
-    # you like — even a complete file — but mounting at this overlay layer is
-    # always the safe choice, because missing keys can never leak into the UI.
-    # You only need files for the languages you actually customise. A partial
-    # example lives in custom-layout/i18n-custom/en.json; the matching complete
-    # files (handy to copy keys from) are published as hub-frontend release assets
-    # (en.json / i18n-<tag>.zip) and ship in the image at assets/i18n.
-    #
-    # (Backward compatibility: deployments that instead mount complete files over
-    # assets/i18n keep working, but that layer has no fallback — any key you do
-    # not supply shows as a raw key — so prefer assets/i18n-custom for new setups.)
+    # any css styling. Favicons are mounted into the favicon folder. Custom
+    # translation files (e.g. en.json, nl.json, ...) can be mounted into the
+    # i18n folder to override the built-in translations shipped in the image.
+    # An example translation file can be found in custom-layout/i18n/en.json.
    #volumeMounts:
    #  - name: custom-layout
    #    mountPath: /usr/share/nginx/html/assets/custom
    #  - name: custom-favicon
    #    mountPath: /usr/share/nginx/html/assets/favicon
    #  - name: custom-i18n
-    #    mountPath: /usr/share/nginx/html/assets/i18n-custom
+    #    mountPath: /usr/share/nginx/html/assets/i18n
    #volumes:
    #  - name: custom-layout
    #    persistentVolumeClaim:
@@ -607,155 +592,6 @@ kerberoshub:
      requests:
        memory: 10Mi
        cpu: 10m
-  # hub-workflows is the standalone, queue-driven workflow engine. It consumes
-  # pipeline events and dispatches custom stages declared in the stage registry,
-  # tracking each run in its own `workflow_runs` collection. It shares events
-  # (not a document) with the analysis pipeline and is meant to grow into the
-  # primary orchestrator. See https://github.com/uug-ai/hub-workflows.
-  workflows:
-    # Disabled by default. When enabled, the analysis service tees each
-    # classify result to this service (via WORKFLOWS_ENABLED on pipe-analysis)
-    # in parallel with the normal throttler/notification tail, which still runs
-    # unchanged. Flip to true to run the workflows engine.
-    enabled: false
-    # This block is purely behaviour: the master switch above plus the stage
-    # routing below. The engine's own deployment (image/tag/replicas/queue/
-    # resources) lives under kerberoshub.services.workflows, in the same uniform
-    # shape as the stage workers it dispatches to.
-    #
-    # Stage routing — how each custom stage fits into the workflow. The engine's
-    # PIPELINE_STAGE_REGISTRY is assembled automatically from the *enabled*
-    # stages below: each contributes its operation and dispatch/needs routing,
-    # plus the queue from its matching `services.<name>` entry — so the engine's
-    # routing stays in lockstep with the deployed worker and the queue cannot
-    # drift. There is nothing to set for the registry directly.
-    #
-    # Each stage is keyed to a worker of the same name under kerberoshub.services.
-    # Routing (here) and deployment (services) are toggled independently:
-    #   workflows.stages.<name>.enabled  -> include the stage in the registry (route to it)
-    #   services.<name>.enabled          -> deploy the worker (pipe-<name>.yaml)
-    stages:
-      # hub-anpr — automatic number-plate recognition stage. Routing only; its
-      # worker deployment lives under kerberoshub.services.anpr.
-      anpr:
-        # Include this stage in the engine's registry (route to it).
-        enabled: false
-        # operation  unique stage id (defaults to the key "anpr" if omitted);
-        #            binds the queue (taken from services.anpr.queue) and how
-        #            the result is recorded.
-        # dispatch   "always" (run on every workflow) | "conditional".
-        # needs      conditional stages only: upstream dependencies, each
-        #            {operation?, condition}. operation is the readiness GATE —
-        #            the upstream op whose data must be present before the
-        #            condition is read; leave it empty for a check on the run
-        #            root itself (device/user/identity), read as soon as the run
-        #            opens. condition shape:
-        #            {path: <abs-path>, op: eq|ne|contains|in|exists|gt|gte|lt|lte, value: <operand>}.
-        #            path is ABSOLUTE from the run root and resolves through
-        #            string-keyed maps only (it CANNOT index into arrays):
-        #            inputs.<op>.<field> (a trigger result, e.g. classify),
-        #            results.<op>.<field> (a finished stage), device.<field>,
-        #            user.<field>, or a top-level scalar (operation/runId/key).
-        #            classify is the only operation teed to workflows, so it is
-        #            the reliable upstream: match inputs.classify.properties (the
-        #            detected class strings) with `contains` — there is no
-        #            top-level `label`, and inputs.classify.details is an array a
-        #            path cannot index into — or gate on inputs.classify.objectCount
-        #            (top-level int) numerically. The engine rejects an unknown
-        #            path at boot.
-        # needsMode  conditional stages with more than one need: how they
-        #            combine. "any" (default) fires on the first matching
-        #            need; "all" is a join — the stage fires only once every
-        #            need has resolved and each condition matches, and only once.
-        operation: anpr
-        dispatch: conditional
-        # kind routes this stage's typed result (the PostDetectionsRequest its
-        # demo worker compiles from the classify car boxes and returns in the run
-        # Payload) through the engine's shared ingest core, which persists it into
-        # the detections collection so the recording's edit-media modal shows the
-        # car boxes. Without it the result is only recorded for routing, not
-        # persisted.
-        kind: detection
-        # Default routing — run anpr whenever classify reports a car (any camera).
-        needsMode: any
-        needs:
-          - operation: classify
-            condition: {path: "inputs.classify.properties", op: contains, value: car}
-        # Restrict plate recognition to a SINGLE camera: add an ungated need on
-        # the recording's device (empty operation = checked as soon as the run
-        # opens) and switch needsMode to "all", so both must hold — "that camera
-        # AND a car was detected". For several cameras use op: in with a list.
-        #needsMode: all
-        #needs:
-        #  - operation: classify
-        #    condition: {path: "inputs.classify.properties", op: contains, value: car}
-        #  - operation:
-        #    condition: {path: "device.deviceKey", op: eq, value: device02}
-          
-  # Workflow deployments. Every workflows-subsystem Deployment's image/tag/
-  # replicas/resources/queue lives here in a single, uniform shape:
-  #   - `workflows` is the engine itself (the orchestrator). It is deployed
-  #     whenever kerberoshub.workflows.enabled is true and has no `enabled` of
-  #     its own — the master switch already gates the whole subsystem.
-  #   - every other entry is a stage worker the engine dispatches to, keyed to
-  #     match a kerberoshub.workflows.stages entry of the same name. A worker
-  #     consumes its own queue and routes its result back to the engine queue.
-  #     Deploying a worker (services.<name>.enabled) is independent from routing
-  #     to it (workflows.stages.<name>.enabled) — it runs only when its own
-  #     `enabled` is true AND the workflows engine is enabled.
-  services:
-    # hub-workflows — the workflows engine (orchestrator). Consumes the engine
-    # queue, evaluates the stage registry (assembled from workflows.stages) and
-    # dispatches to the stage workers below. Deployed when workflows.enabled is
-    # true; it has no separate `enabled` here.
-    workflows:
-      repository: ghcr.io/uug-ai/hub-workflows
-      pullPolicy: IfNotPresent
-      tag: "v1.0.0"
-      replicas: 1 # Number of pods for the service.
-      topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-      # Optional extra volumes / volumeMounts for this deployment (empty = none).
-      #volumes:
-      #  - name: extra
-      #    emptyDir: {}
-      #volumeMounts:
-      #  - name: extra
-      #    mountPath: /data
-      logLevel: "info" # possible values: trace, debug, info, warn, error
-      # Queue this service consumes ingest events and upstream results from
-      # (WORKFLOWS_QUEUE). Must be fed the same messages the analysis service sees.
-      queue: "kcloud-workflows-queue"
-      resources:
-        requests:
-          memory: 10Mi
-          cpu: 10m
-    # hub-anpr — automatic number-plate recognition worker. Lives in the
-    # hub-workflows repository as its own module. See
-    # https://github.com/uug-ai/hub-workflows/tree/main/hub-anpr.
-    anpr:
-      # Deploy the hub-anpr worker.
-      enabled: false
-      repository: ghcr.io/uug-ai/hub-anpr
-      pullPolicy: IfNotPresent
-      tag: "v1.0.0"
-      replicas: 1 # Number of pods for the worker.
-      topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-      #volumes:
-      #  - name: extra
-      #    emptyDir: {}
-      #volumeMounts:
-      #  - name: extra
-      #    mountPath: /data
-      logLevel: "info" # possible values: trace, debug, info, warn, error
-      # Queue this worker consumes dispatched messages from (ANPR_QUEUE). This
-      # same value is read into the engine's generated registry entry for the
-      # matching stage, so the engine dispatches and the worker consumes the same
-      # queue with no drift. Convention: "kcloud-<operation>-queue.fifo".
-      queue: "kcloud-anpr-queue.fifo"
-      resources:
-        requests:
-          memory: 10Mi
-          cpu: 10m
  monitordevice:
    repository: ghcr.io/uug-ai/hub-monitor-device
    pullPolicy: IfNotPresent
@@ -1123,4 +959,4 @@ email:
    highupload: "highupload"
    device: "device"
    alertTitle: "[Alert] Kerberos Hub detected something an event"
-    deviceTitle: "[Device] A Kerberos Agent's status has been changed"
+    deviceTitle: "[Device] An Agent's status has been changed"