About this article

• Audience: Operators deploying a dedicated host for fleet VMS (COTA POC 2026 Bus AI)
• Goal: After reading, you can install the host, start the Phantom Vision stack, provision site-role-a and site-role-b, and run justified recording playback
• Type: How-to

Summary

Stand up Cost Sentinel / Phantom Vision on a dedicated host, point it at your two shadow devices, start the local MQTT broker and vms-proxy, then provision and validate the fleet. Precomputed RF-DETR detections remain authoritative on the edge; the host consumes A2A/MCP telemetry and justified H.265 clips. Gemma / local LLM weights stay host-only.

HIGHLY RECOMMENDED — Mac Studio

For COTA POC 2026, use a Mac Studio M4 Max (≥64 GB) as the primary host. Full desk BOM, brew/Ollama checklist, ports, and smoke tests: Host materials — Mac Studio.

Windows 11 Pro laptop remains a supported alternate path (sections below).

Program notes, topology, and playbook: COTA POC 2026.

Prerequisites

• Preferred: macOS on Mac Studio with Homebrew (see host materials)
• Alternate: Elevated PowerShell 7+ on Windows 11 Pro
• Network reachability to both shadows (<shadow-primary-ip>, <shadow-secondary-ip>)
• Matching A2A HMAC secret on the host and each shadow (YOUR_A2A_HMAC_SECRET)
• SSH credentials for shadows (YOUR_DEVICE_PASSWORD or key in generated .env)
• Docker (or Colima) for MQTT; Ollama for local Gemma 4 on the host only

0. Mac Studio path (recommended)

# After brew baseline + ollama pulls from host-materials-mac
cd cost-sentinel
npm install
npm run stack:up
npm run stack:status

Open the local UI (typically http://127.0.0.1:5173 or packaged :8080), set Proxy URL to http://localhost:8788, and continue at §3 Wire fleet configuration with macOS paths for .env / recordings-cache.

1. Install the VMS host (Windows alternate)

One-liner (elevated PowerShell):

irm https://raw.githubusercontent.com/ghostprotocol/gp-firmware/main/cost-sentinel/Install-CotaVmsHost.ps1 | iex

Recommended first run—review the script, then pass explicit wiring:

irm https://raw.githubusercontent.com/ghostprotocol/gp-firmware/main/cost-sentinel/Install-CotaVmsHost.ps1 -OutFile "$env:TEMP\Install-CotaVmsHost.ps1"
& "$env:TEMP\Install-CotaVmsHost.ps1" `
  -Shadow1IP "<shadow-primary-ip>" `
  -Shadow2IP "<shadow-secondary-ip>" `
  -A2ASecret "YOUR_A2A_HMAC_SECRET" `
  -InstallDir "C:\CotaVmsHost" `
  -UiPort 8080

Re-run anytime to refresh IPs, secrets, or launchers—the installer is idempotent.

2. Confirm hardware

Recommended (COTA POC 2026)

Component	Spec
Host	Mac Studio M4 Max, ≥64 GB unified (materials)
Network	Dedicated Gigabit Ethernet
UPS	1000–1500 VA pure sine preferred
LLM	Ollama Gemma 4 26B/31B on host only

Windows alternate (installer checks)

Component	Minimum
OS	Windows 11 Pro (latest)
CPU	8-core (i7 / Ryzen 7 class)
GPU	NVIDIA RTX 30/40-series, 6 GB+ VRAM
RAM	32 GB
Storage	1 TB NVMe SSD
Network	Gigabit Ethernet + Wi-Fi 6

GPU capacity matters most for smooth H.265 playback and local transcode on Windows.

3. Wire fleet configuration

Edit the generated host config at C:\CotaVmsHost\.env (also copied into cost-sentinel\.env):

VITE_SHADOW1_IP=<shadow-primary-ip>
VITE_SHADOW2_IP=<shadow-secondary-ip>
VITE_A2A_PORT=8765
VITE_A2A_HMAC_SECRET=YOUR_A2A_HMAC_SECRET
VITE_RECORDINGS_CACHE_DIR=C:\CotaVmsHost\recordings-cache

The HMAC secret must match each shadow's /data/config/a2a_hmac_secret. Set OLLAMA_MODEL to gemma4:e2b on 6 GB VRAM GPUs; default is gemma4:e4b.

4. Start the Phantom Vision stack

The VMS laptop runs the MQTT broker, vms-proxy, and setup wizard.

Windows (after install):

C:\CotaVmsHost\Start-PhantomVisionStack.bat

Mac / Linux (from repo):

cd [repo-root]/cost-sentinel/scripts
./phantom-vision-stack.sh up

Open http://localhost:8080/?setup=1, set Proxy URL to http://localhost:8788, and follow the readiness checklist. Topic map: cost-sentinel/mqtt-broker/PHANTOM_VISION_MQTT_TOPICS.md.

Component	Connects to	Topics
MQTT broker	VMS laptop 0.0.0.0:1883	—
vms-proxy	127.0.0.1:1883 (subscribe)	devices/+/health, /dets, /telemetry, /status
Each shadow	<vms-laptop-wlan-ip>:1883 (publish)	devices/{site-role-a|site-role-b}/…

PROVISION FLEET sets MQTT_HOST on each shadow to your laptop WLAN IP from fleet_registry.json.

5. Provision, launch, and shut down

1. Start the proxy; in VMS OPERATIONS set Proxy URL to http://localhost:8788.
2. Fleet Onboarding & Legitimacy → Provision fleet then Validate fleet (no routine SSH).
3. Expect Fleet legitimate — 2/2 shadows validated. Edit labels, SAVE LABELS, PROVISION FLEET again as needed.
4. Launch via COTA VMS Host (Ghost) shortcut or Start-CotaVmsHost.bat → http://localhost:8080.

Use VMS OPERATIONS for precomp queries, justified H.265 pulls, Hermes mesh, and M8 controls. PHANTOM AGENT uses the same proxy URL. Shadow APIs: POST http://<device-ip>:8765/a2a/query and /tools/call.

Production laptops stay on. Dev workstations: stop manual dev processes, then npm run stack:down from [repo-root]/cost-sentinel. Verify ports 8788, 1883, and 8080 are idle.

Troubleshooting

Symptom	Fix
ECONNREFUSED on MQTT	npm run stack:up or docker compose up -d in cost-sentinel/mqtt-broker
Recorder inventory HTTP 502	Confirm proxy up, SSH creds in vms-proxy/.env, shadow on LAN
Pull SFTP error	Laptop on same subnet; test ssh root@<device-ip>
Empty live precomp	Provision fleet with laptop WLAN IP; shadows publish to devices/{id}/dets
Off-LAN dev without Docker	MQTT_DISABLED=true in vms-proxy/.env (MCP-only mode)

Automated smoke (Mac/Linux):

cd [repo-root]/cost-sentinel && npm run stack:up && npm run test:playback
SKIP_PULL=1 npm run test:playback
TARGET=<device-ip> npm run test:playback

Security notes

• Enable BitLocker and restrict local admin on the VMS laptop.
• Store A2A HMAC secrets and shadow SSH keys only on approved operator laptops—not on jump hosts or shadows.
• Justified recordings (policy-triggered clips + sidecars) are the only video that leaves the bus.
• Off-site access: see REMOTE_SHADOW_ACCESS.md for approved tunnel paths.

Next steps

• Host/Phantom stack management
• Fleet monitoring via proxy
• VMS on-demand troubleshooting

Operator depth

Live fleet state, harness evidence, and session chronology live in private operator handoff (not published) (private).