KC CCTV Monitor — YOLOv8 Loss Prevention on Existing Cameras

Detection versus inference is the line I care most about. What the system actually detects is narrow: YOLOv8 person and object boxes with confidence scores, 17 COCO keypoints per person from YOLOv8-pose, 33-point MediaPipe landmarks in the MVP, face embeddings and their cosine similarity to enrolled subjects, and raw pixel change inside a region. Everything else is inference layered on top of that. Idle, on a long break, theft-like behaviour and drawer open are all heuristics over geometry and time, and the code says so in its own comments.

Pose heuristics are normalised by torso length rather than pixels, and scored over time rather than per frame. The engine measures the shoulder-centre to hip-centre distance per person and expresses every threshold as a fraction of it, so a wrist within 0.55 torso-lengths of a hip and at or below it counts as hand-to-pocket regardless of how far the person stands from the camera. Each track then carries a smoothed suspicion score that decays toward zero at 0.80 every frame and blends in the fresh score at 0.45. A flag needs that smoothed score over 0.70, sustained for 1.25 seconds, with a two-frame grace so tracker jitter does not reset the streak, plus concealment-class evidence in at least 2 of the last 10 processed frames. Without that last gate, three weak posture signals could saturate the score on someone who is just browsing.

False positives got their own filters, because in a clothing shop the baseline behaviour looks exactly like the theft signals. A jacket on a rack that YOLO reads as a person yields few confident keypoints, so tracks under six valid keypoints are dropped. A real person's bounding box centre always jitters, so a track that stays within 0.008 of the frame diagonal for ten seconds is treated as a static object and excluded until it moves. A hand parked in a pocket loses most of its weight after four seconds, since only a fresh dive is interesting. Loitering is 30 seconds, not 8, because standing at a rack is shopping.

The MVP's cash module does not use an object detector for the drawer. It takes a normalised region of interest, converts to grayscale, blurs it, and compares consecutive frames: if more than 15 percent of pixels shift by more than 30 intensity levels, it toggles drawer state. That is deliberately crude and cheap, and it is why the module attributes the event to the nearest tracked person rather than claiming to see whose hand it was. Thresholds for how long a drawer may stay open and how long someone may linger near it live in one config file.

Compute is rationed at three points, because 23 streams on one box is the real engineering problem. Cameras are sampled at a configured frames-per-second rather than read at full rate, detection defaults to the NVR sub-stream with the main stream left as a documented switch for when face quality matters more than load, and a motion gate skips pose inference entirely when fewer than 0.4 percent of pixels changed. A shared frame hub means one RTSP connection per camera no matter how many workers consume it, and each behaviour engine owns its own model instance so one consumer's tracker state cannot corrupt another's.

Face recognition is quality-gated rather than single-threshold. The local InsightFace engine raises the similarity bar for small or weakly detected faces: below a minimum pixel height the embedding is not trusted at all, and faces under the strong-height cutoff must clear a higher cosine bar before the system will assert a match. A CompreFace service is also wired in behind a REST client as an alternative recognition backend, with its own configurable threshold and per-subject alert cooldown.

Privacy posture is in the schema, not just the docs. Enrolled offender records carry an expiry, and a retention job marks anything past it as expired while writing an audit row for each. Offender enrolment and edits, alert review and the retention run all write through one audit helper into an audit-log table, users carry admin, enroller, reviewer or viewer roles enforced by a route-prefix rule table, and alerts carry a pending, confirmed or dismissed status with the reviewer recorded. The PRD states the operating rules plainly: store embeddings and minimal images, no face data leaves the local network, no tracking of non-enrolled people beyond transient detection, and no enrolment before signage, a documented lawful basis and legal sign-off.