# Mission Core CVAT D-only profile

This profile installs the annotation control plane in a dedicated WSL2
distribution named `MissionCore-CVAT`. Its VHDX, Docker image store, CVAT
source, persistent volumes, reports, and imported datasets live below
`D:\NDC_MISSIONCORE`. It does not use the Docker Desktop image store that backs
the Triton, Frigate, and Ollama containers.

Pinned inputs:

- Ubuntu 24.04.4 WSL AMD64 image, SHA-256
  `9b2f7730dc68227dd04a9f3e5eab86ad85caf556b8606ad94f1f29ff5c4fd3f5`
- CVAT `v2.70.0`
- D free-space floor: `360 GiB`
- WSL VHD logical ceiling: `32 GB` (sparse allocation)

The official CVAT Compose topology is retained. The override only replaces its
named volumes with explicit bind-backed directories inside the D-hosted WSL
VHD. Images are pulled serially and the D free-space floor is checked before and
after every image.

Run from the Windows host:

```powershell
wsl -d MissionCore-CVAT -u root -- bash /mnt/d/NDC_MISSIONCORE/workspace/mission-core-compute/cvat/provision_cvat_wsl.sh
wsl -d MissionCore-CVAT -u root -- bash /mnt/d/NDC_MISSIONCORE/workspace/mission-core-compute/cvat/ensure_cvat_admin.sh
wsl -d MissionCore-CVAT -u root -- bash /mnt/d/NDC_MISSIONCORE/workspace/mission-core-compute/cvat/import_e2_workspace.sh
```

After a Windows reboot, start the existing deployment without pulling images or
re-provisioning it:

```powershell
& D:\NDC_MISSIONCORE\workspace\mission-core-compute\cvat\Start-Cvat.ps1
```

The launcher checks the `360 GiB` D-drive floor, starts the pinned Compose
topology in the D-hosted WSL distribution, waits for the API, and keeps the WSL
runtime alive. It writes startup logs only below
`D:\NDC_MISSIONCORE\runtime\annotation\cvat\logs`.

From the Mission Core repository on the Mac, start CVAT if needed, discover the
current WSL address, and open the SSH tunnel without a hard-coded IP:

```bash
bash experiments/perception/worker/cvat/open_cvat_tunnel.sh
```

Keep that terminal open and use `http://localhost:18080`. The same SSH session
keeps the WSL runtime alive. Pass `--background` when detached runtime and
tunnel sessions are preferred; rerun the helper after a Mac or Windows reboot.

The generated administrator password is stored only in
`D:\NDC_MISSIONCORE\secrets\cvat\admin.env`; it is not printed by the script or
committed to Git.

Traefik binds inside the dedicated WSL environment to `127.0.0.1:8080` and
`127.0.0.1:8090`. It also publishes container port `8080` as WSL-internal port
`18080` so the existing Windows SSH service can forward it without relying on
Windows-to-WSL localhost forwarding. Remote review still uses the exact SSH
host alias and a local forward; this profile does not add routes, Windows port
proxies, DNS changes, or firewall rules.
