Operator desk for COTA POC 2026 · Buy list first · Full install below

30-second buy list

Must have	Spec
Mac Studio	M4 Max class, ≥64 GB unified, ≥1 TB storage
UPS	1000–1500 VA pure sine
Network	Dedicated Gigabit Ethernet to lab switch
Display	27″+ 1440p/4K (second optional for IDE + VMS)

TIP

HIGHLY RECOMMENDED host. Gemma / Ollama / MLX stay host-only. Do not install Gemma on Shadows or OAK cameras.

Materials map

Chip	Contents
Desk BOM	Studio, monitor, KB/mouse, UPS, Ethernet, 1 TB+, cabling
Install · Mac	brew, Docker/Colima, Node, Ollama, Gemma 26B/31B host-only, stack:up
Install · Spark	Optional — Spark host
Ports	Listen / egress / optional
Updates	Hermes daily; OS/Docker weekly
Certs / SSH	Placeholders only

1. Desk BOM (Mac-first)

Item	Spec	Notes
Compute	Mac Studio M4 Max, ≥64 GB, ≥1 TB SSD	Primary host
Storage	1 TB minimum usable	Models + recordings-cache + OS
Monitor	27″+ 1440p or 4K	Dual optional
Keyboard / pointing	Low-latency	macOS layout
UPS	1000–1500 VA pure sine	~100–145 W under LLM load
Network	Gigabit Ethernet	MQTT fleet → host :1883
Cables	TB/USB-C, HDMI/DP, Cat6	Label S1 / S2 / WAN
Optional NVMe	2–4 TB external	Overflow archives

If Spark shares the desk, size UPS for ~180–240 W on Spark alone.

2. Install · Mac

Tools

Package	Required?	Why
Homebrew	Yes	Package hub
Python 3.12+	Yes	Scripts / helpers
Node 22+	Yes	Cost Sentinel UI + proxy
Docker Desktop or Colima	Yes*	Mosquitto (*or MQTT_DISABLED)
Ollama and/or MLX	Yes	Local Gemma on host
git, jq, curl, ffmpeg	Yes	Ops baseline
Hermes CLI	Recommended	Update daily
ssh	Recommended	Fleet access

Install sketch (no secrets)

brew install python@3.12 git jq ffmpeg curl wget node@22
brew install --cask docker
brew install ollama
ollama pull gemma4:26b
ollama pull gemma4:31b

cd cost-sentinel
npm install
npm run stack:up          # :1883 MQTT · :8788 proxy · :5173 UI
npm run stack:status

Full fleet wiring: COTA VMS host install.

Models

Pairing	Where
Gemma 4 26B / 31B	Mac host only
RF-DETR	Shadows only
Optional Spark LLM API	Second box — Spark

3. Ports

Listen on host: 1883 MQTT · 8788 proxy · 5173 UI · 11434 Ollama · 8080 packaged UI

Egress to fleet: 8765 A2A/MCP (proxy only, not browser) · 22 SSH · 8554 RTSP class · 80/443 registries

Optional: 3702 ONVIF · 8890 Hindsight · 9222 CDP

Do not public-bind 8788/1883 without reverse proxy + auth.

4. Updates

Cadence	What
Daily	Hermes; critical patches; stack:status
Weekly	OS check; Docker pins; UI smoke
Monthly	Dep refresh; UPS self-test
Deliberate	Model pulls; firmware

5. Certs / SSH (placeholders)

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_gp -C "gp-host-$(hostname)-$(date +%Y%m)"
openssl rand -hex 32   # A2A HMAC — .env only, never git

Browser → :8788 only.

6. Smoke checklist

• [ ] UPS + Ethernet up
• [ ] Host storage ≥1 TB usable
• [ ] ollama list shows gemma4 26B and/or 31B
• [ ] stack:status → 1883 / 8788 / 5173
• [ ] UI Proxy URL http://localhost:8788
• [ ] SSH to S1/S2; HMAC matches
• [ ] No Gemma on Shadows

Related

• Executive package $18,374
• Spark optional · Parts BOM