Halos Outside-In Safety — Deploy by Profile (VSS 3.2)

This skill deploys from the HOISA OSS repository you cloned — the compose files, profiles, configs, and this skill all live in the repo. When active, ALWAYS read the relevant reference document before running commands. Deployment has two stacks that must come up in order — do NOT skip or reorder.

Targets VSS Warehouse 3.2.

Profiles

Pick one profile (set COMPOSE_PROFILES in the profile run-env). Services started:

2D today. A 3D (Sparse4D) profile is 🚧 under development — see references/vss_3d_overrides.md when it lands.

base on IGX Thor (aarch64) — the skill detects the platform and, on Thor, asks whether to run the SDM on CCPLEX or FSI (covered in references/halos_thor.md). The CCPLEX path follows the x86 flow; the FSI path is advanced (a one-time firmware reflash).

Architecture (sil profile)

Isaac Sim (forklift + digital humans, segments-driven)
     ↓ RTSP (3 cameras, H265, via MediaMTX)
VSS Warehouse 3.2 (AI Perception)
     ├─ vss-rtvi-cv: detection + tracking
     └─ vss-behavior-analytics: ROI / tripwire (forklift-in-trailer)
     ↓ Kafka events (mdx-events topic)
Safety Core (PSF)
     ├─ SEI: multi-camera fusion + event validation
     └─ SDM: ATL decision logic (MUTE/UNMUTE)
     ↓ UDP 64-byte packet (port 12346)
Communication Layer → ROS2 /safety/is_muted → Isaac Sim Action Graph (forklift safety disc)

Two separate stacks:

• Stack 1: VSS Warehouse 3.2 (perception) — deploy via the vss-deploy-profile skill (or the public VSS Warehouse docs: github.com/NVIDIA-AI-Blueprints/video-search-and-summarization); must be up + healthy first.
• Stack 2: Halos (base/sil/hil) — this skill.

Agent Autonomy Rules

When invoked autonomously (no human in the loop):

1. Proceed through all phases without asking for confirmation at phase boundaries. Only stop on a real error or a missing input that the user must provide (e.g., NGC API key not present anywhere).
2. Use the Ready Signals table below as phase gates, not narrative time estimates ("wait ~15 min") and not process existence (pgrep -f "compose up"). compose up --detach exits before containers are actually serving.
3. Never use docker logs -f or any blocking follow command in the main flow. Use a poll loop with a non-blocking grep instead.
4. Pre-pull large images in parallel with the VSS Warehouse build: the PSF image (PSF_IMAGE) and the Isaac Sim base (ISAAC_SIM_IMAGE), both from the profile run-env (~30 GB total), to save wall time.
5. Emit a heartbeat line every poll iteration so the user can see the agent is alive during long phases (TensorRT build, Isaac Sim shader compile).
6. Do NOT declare "deployment complete" until the final ready signal fires: sim-driven safety transitions in <sil-data>/comm-layer/opc_server.log. "All containers Up" is not the same as "system working".

Ready Signals

Each phase ends when its ready signal becomes true. Poll, don't wait by time.

The exact poll command for each signal is in the corresponding reference doc.

Quick Start Workflow

Deploy in strict order. Stack 1 (VSS) must be running before Stack 2 (Halos).

- [ ] 1. Clone the HOISA OSS repo (this skill lives in skills/)
- [ ] 2. Check prerequisites (host setup overlaps VSS — run VSS prereq first) → references/prerequisites.md
- [ ] 3. Pull NGC artifacts (sil-data + PSF image + VSS images)  → references/ngc_artifacts.md
- [ ] 4. Deploy VSS Warehouse 3.2 via `vss-deploy-profile`,
        apply SIL overrides BEFORE its compose up                → references/vss_2d_overrides.md
- [ ] 5. Poll VSS perception + Kafka ready signals
- [ ] 6. Configure deployments/profiles/<profile>.env, then
        deploy Halos (setup.sh + cleanup + compose up --build)   → references/halos_deploy.md
- [ ] 7. Set a unique ROS_DOMAIN_ID (0-232) + verify Publisher count=1
- [ ] 8. (sil) Run the Isaac Sim test scenario                   → references/test_scenario.md
- [ ] 9. Monitor until sim-driven safety transitions appear (the "complete" signal)

Reference Documents

Critical Rules

Deployment Stack Summary

Key URLs (after deployment)

Cleanup

# Stop Halos (from the repo's deployments/ directory)
cd <repo>/deployments && docker compose --env-file profiles/<profile>.env down
bash ../closed-loop-testing/scripts/cleanup_all_datalog.sh <profile>
docker volume prune -f

# Stop VSS Warehouse — see the vss-deploy-profile skill