Review a Medicare sales call

# Assemble the Decosa Medicare sales-call record on this machine

You are setting up a self-hosted QA checker and record keeper for recorded Medicare Advantage and Part D sales calls, for a
third-party marketing organization (agency, FMO, call centre) or a plan's broker-oversight team. It takes the transcript of
a sales call, a call sheet (when the call was placed and who asked for it, the agency's plan counts, the Scope of
Appointment) and the plan's Summary of Benefits as text.
- **On the call**, each answer is yes, no or unclear, with a quote and a time:
  - the TPMO disclaimer (42 CFR 422.2267(e)(41)), and whether it came before benefits were discussed (the rule since 1 Jun 2026);
  - a Scope of Appointment taken on the call;
  - "free" used for a $0 premium, claiming to be from Medicare, calling an Advantage plan a supplement, gifts, pressure;
  - for an enrollment: the enrollment notice, a clear yes, where the Summary of Benefits is, the needs topics and the pre-enrollment checklist.
- **Benefit claims**: every premium, copay, allowance or giveback the agent states is judged against the Summary of Benefits.
- **From the call sheet**, in code: the SOA's date and scope, non-health products pitched, cold calls, the disclaimer numbers.
- It seals everything in a signed, hash-chained record with the retention dates of 422.2274(g)(2)(ii): audio for 3 years,
  audio or a complete and accurate transcript to year 6, and 10 years for the enrollment portion of a telephonic enrollment.
- With the optional diarizer, it turns a recording into a timed, speaker-labelled transcript.

Work step by step. Show me each command before running anything that needs sudo, and stop if a check fails.

**Before anything else, remind me:**
- Sales calls carry Medicare numbers, dates of birth and health conditions (PHI). Keep everything on this machine: the
  model route stays local (`direct`), and nothing goes to a hosted service.
- CMS requires the recording; some states require every party's consent to it (for example California Penal Code 632).
  Each check needs a consent statement, and the statement goes into the record.
- This is QA triage for a person to review. It is not a compliance verdict and not legal advice. A machine transcript is
  not a "complete and accurate transcript" for years 4-6 until a person has checked it.

Repeat these points in your final summary.

## Step 0: set up with a coding agent, rehearse on mock data, then go private

This prompt is for a coding agent running on the machine that will host the service. We recommend Claude Code with
Claude Opus 5.5; any capable coding agent works. Work in this order:

1. Set up on mock data only. During the whole setup you (the agent) work with the synthetic sample bundle below and
   nothing else. Do not ask me for real data, and do not open, read, list or copy files that hold real data, even to
   "test with something realistic".
2. Rehearse. When the steps below are done and the service is healthy, fetch the mock-data bundle for this tool,
   https://decosa.ai/samples/medicare-call-record.zip (4 KB, 12 checks, synthetic or openly licensed: see `licence` in expected.json),
   show me what is in it, and run the rehearsal against the local API:
   `docker compose exec api python scripts/rehearse.py medicare-call-record` (the api image carries the same bundle under /app/rehearsal/medicare-call-record/;
   with no key set, the script asks the local API for a short demo token). From a decosa-api checkout instead:
   `python scripts/rehearse.py medicare-call-record --bundle medicare-call-record.zip --base-url http://127.0.0.1:<PORT>`.
   It sends the mock inputs to the local API and prints PASS or FAIL for each expected property (for example: "the TPMO disclaimer itself was said (only late)", "benefits were discussed before the TPMO disclaimer", ""free premiums" is flagged with a time"). Show me
   the full output. Every check must pass. If one fails, fix the install and run it again; never edit `expected.json`
   to make a check pass.
3. Stop there. Once the rehearsal passes, tell me, and I will run my own data against the local API myself, on this
   machine.

For the person running this: a coding agent that runs in the cloud sees everything in its context, including files it
reads, command output and anything pasted into the chat. Keep real data out of the chat and out of anything the agent
can read. Switch to your own data only after the rehearsal has passed and the agent's work is done.

## What you are building

| service | image | model | port |
|---|---|---|---|
| `llm` | `${DECOSA_REGISTRY}/decosa-llm:0.1.0` (vLLM 0.29.0, `vllm/vllm-openai@sha256:c2914767605584b6d8f45686b82de173ecc99e781897aa3d0a66dacd72c51ae1`) | `nvidia/Qwen3.8-27B-NVFP4` @ `482ca0f3832238542f8f5295dde86b5f22711d80`, Apache-2.0 | internal 8000 |
| `api` | `${DECOSA_REGISTRY}/decosa-api:0.1.0` (no GPU) | none | `127.0.0.1:8445` |
| `diarize` (optional, recordings only) | built from the decosa-api source (`services/diarize`) | `OpenMOSS-Team/MOSS-Transcribe-Diarize` @ `704aa4a9c304e8520be88901e0d1960158ef5b15`, Apache-2.0 | internal 8092 |

Typed, WebVTT or SRT transcripts need no speech model. The call-sheet items (disclaimer timing and numbers, SOA, scope, cold calls) are computed in code.

## 1. Check the GPU, driver and Docker

1. Run `nvidia-smi`. I need one NVIDIA GPU with at least 48 GB and driver 580 or newer.
   - Blackwell (RTX PRO 6000, B200): use the defaults below (NVFP4). This is the measured setup.
   - Hopper (H100/H200) or 48 GB Ada/L40S: set `LLM_MODEL=Qwen/Qwen3.8-27B-FP8` and `LLM_REVISION=main`; on 48 GB also
     set `LLM_MAX_LEN=32768`. Not measured.
   - Under 48 GB: stop and tell me it will not fit.
2. Check `docker --version`, `docker compose version` and `docker run --rm --gpus all ubuntu nvidia-smi`. If Docker or the NVIDIA Container Toolkit is missing, install them from the official Docker and NVIDIA repositories (`sudo nvidia-ctk runtime configure --runtime=docker`, then restart Docker).
3. Confirm about 60 GB of free disk.

## 2. Get the images

The images are **on request** while self-host is in early access: ask at https://decosa.ai/contact?topic=self-host, and Decosa sends the registry (set it as `DECOSA_REGISTRY`), pull access and the compose file.
1. Try `docker pull ${DECOSA_REGISTRY}/decosa-{llm,api}:0.1.0`.
2. If a pull fails, build from source once the `decosa-api` source is published. Clone it, then run
   `docker build -f docker/api/Dockerfile -t ${DECOSA_REGISTRY}/decosa-api:0.1.0 .` in it, and
   `docker compose build llm` from its compose file.
3. If neither works, stop and tell me.

## 3. Write the compose file

Create `~/decosa-mc/.env`:

```bash
DECOSA_TAG=0.1.0
DECOSA_GPU=0
LLM_MODEL=nvidia/Qwen3.8-27B-NVFP4
LLM_REVISION=482ca0f3832238542f8f5295dde86b5f22711d80
LLM_MAX_LEN=65536
LLM_GPU_UTIL=0.85
DECOSA_SIGNER_NAME="<who signs these records, e.g. Example Benefits compliance>"
```

Create `~/decosa-mc/docker-compose.yml` with exactly these services:

```yaml
name: decosa-mc
x-health: &health
  interval: 15s
  timeout: 5s
  retries: 5
services:
  llm:
    image: ${DECOSA_REGISTRY}/decosa-llm:${DECOSA_TAG}
    deploy: { resources: { reservations: { devices: [ { driver: nvidia, device_ids: ["${DECOSA_GPU:-0}"], capabilities: [gpu] } ] } } }
    ipc: host
    restart: unless-stopped
    volumes: [hf-cache:/root/.cache/huggingface]
    command: ["${LLM_MODEL}", "--revision", "${LLM_REVISION}", "--served-model-name", "qwen3.8-27b",
              "--language-model-only", "--max-model-len", "${LLM_MAX_LEN}", "--gpu-memory-utilization", "${LLM_GPU_UTIL}",
              "--max-num-seqs", "16", "--kv-cache-dtype", "fp8_e4m3", "--speculative-config", '{"method":"mtp","num_speculative_tokens":3}',
              "--seed", "0", "--enable-force-include-usage", "--disable-uvicorn-access-log", "--host", "0.0.0.0", "--port", "8000"]
    healthcheck: { <<: *health, test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=4)"], start_period: 900s }
  api:
    image: ${DECOSA_REGISTRY}/decosa-api:${DECOSA_TAG}
    restart: unless-stopped
    depends_on: { llm: { condition: service_healthy } }
    environment:
      DECOSA_LLM_ROUTE: direct                  # local model only; receipts are signed by this box's key ("attested")
      DECOSA_LLM_URL: http://llm:8000/v1
      DECOSA_LLM_MODEL: qwen3.8-27b
      DECOSA_LOCAL_SIGNING: "on"                # Ed25519 key created at /data/attest/ed25519.pem on first start
      DECOSA_SIGNER_NAME: ${DECOSA_SIGNER_NAME}
      DECOSA_SESSIONS_PER_IP_HOUR: "1000"
      DECOSA_BUDGET_LLM_TOKENS: "200000"        # per session; a call needs about 6,000-8,000 generated tokens
      DECOSA_SESSION_TTL_S: "28800"
      DECOSA_MEDICARE_AUDIO: "0"             # "1" only with the diarize service
      DECOSA_DIARIZE_URL: ""
      DECOSA_CORS_ORIGIN_REGEX: '^https?://(localhost|127\.0\.0\.1)(:\d+)?$$'
    ports: ["127.0.0.1:8445:8445"]
    volumes: [decosa-data:/data]
    healthcheck: { <<: *health, test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8445/healthz', timeout=4)"], start_period: 20s }
volumes: { hf-cache: {}, decosa-data: {} }
```

Use the named volume `decosa-data` as written: a host bind mount owned by root makes the API fail on
`/data/keys.sqlite`.
1. Run `docker compose up -d`.
2. Poll `docker compose ps` until both services are healthy. The LLM takes 5-10 minutes the first time.
3. `curl -s localhost:8445/healthz` should show `"llm": true`. `asr` is false here, and that is fine.

## 4. Optional: recordings (diarize)

Do this only if I want transcripts made from call recordings.
1. Build `services/diarize` from the decosa-api source on a CUDA PyTorch base image. Give it the env
   `DIARIZE_HOST=0.0.0.0 DIARIZE_PORT=8092 DIARIZE_DEVICE=cuda:0`, the `hf-cache` volume, the same GPU, and a health
   check on `GET /health`.
2. Lower `LLM_GPU_UTIL` to 0.80. On the api, set `DECOSA_DIARIZE_URL: http://diarize:8092` and
   `DECOSA_MEDICARE_AUDIO: "1"`.
3. `POST /medicare/transcribe` then takes a 16 kHz mono 16-bit WAV
   (`ffmpeg -i in.m4a -ac 1 -ar 16000 -sample_fmt s16 out.wav`) and returns timed segments with a speech receipt.
4. Pass the segments to `/medicare/check` as `segments`, with `speakers` to name S01 and S02.

The fit beside the LLM is an estimate, not measured.

## 5. Smoke test

```bash
API=localhost:8445
TOKEN=$(curl -s $API/demo/session -H 'content-type: application/json' -d '{"vertical":"medicare-call-record"}' | jq -r .token)
curl -s $API/medicare/check -H "authorization: Bearer $TOKEN" -H 'content-type: application/json' \
  -d '{"sample_id":"tb1-showcase"}' > /tmp/mc.json
jq '{counts, retention, receipts: (.receipts|length), statuses: [.receipts[].status] | unique}' /tmp/mc.json
jq -r '.checklist[] | "\(.status)\t\(.answer // "-")\t\(.at // "")\t\(.id)"' /tmp/mc.json
jq -r '.claims[] | "\(.status)\t\(.verdict)\t\(.at // "")\t\(.claim)"' /tmp/mc.json
jq '{record}' /tmp/mc.json | curl -s $API/record/verify -H 'content-type: application/json' -d @- | jq '{ok, summary}'
```

In this sample a fictional agency pitches a fictional HMO: "free premiums" and a "$3,000 dental allowance" before the
disclaimer, then a final-expense life policy. Pass if:
- `tpmo_disclaimer_timing` is `flag`, `free_misuse` is `flag` with a time, and `non_health` is `flag`;
- the dental claim is `flag` with verdict `contradicted` (the plan facts say $1,500 a year);
- every receipt has `"status": "attested"`;
- the record verifies (`ok: true`); `retention.audio_until` is `2029-11-05` and `retain_until` is `2032-11-05`.

Then a pasted call with your own call sheet, plan facts and consent:

```bash
curl -s $API/medicare/check -H "authorization: Bearer $TOKEN" -H 'content-type: application/json' -d '{
  "transcript": "[00:00] AGENT: Hi, I am calling from Medicare about your benefits. This call is recorded.\n[00:06] BENEFICIARY: Oh, okay.\n[00:08] AGENT: The Example HMO is free, no premium, with a two thousand dollar dental allowance.",
  "call_sheet": {"call": {"at": "2026-11-02T18:00:00-05:00", "direction": "outbound", "contact_basis": "none"},
                 "agency": {"tpmo": true, "organizations": 3, "plans": 14}, "soa": {"status": "none"}},
  "plan_facts": {"title": "Example SB", "text": "Monthly plan premium: $0.\nComprehensive dental allowance of $1,000 per year."},
  "consent": {"recorded_lawfully": true, "method": "all_parties_notified_on_call"}}' | jq -r '.checklist[], .claims[] | "\(.status)\t\(.id)"'
```

Pass if `medicare_endorsed`, `free_misuse`, `unsolicited`, `soa_documented` and the dental claim are `flag`. Without
`consent`, the API answers 400.

## 6. Point the app at the local API

- The base URL is `http://localhost:8445` (web app: `NEXT_PUBLIC_DECOSA_API=http://localhost:8445`). Add other origins to
  `DECOSA_CORS_ORIGINS`.
- `POST /medicare/check` returns JSON, or streams Server-Sent Events with `Accept: text/event-stream`.
  `GET /medicare/info` lists the call-sheet fields, product types and check ids.
- Build the call sheet from your CRM or dialer: the call time with a UTC offset; `inbound` or `outbound` and who asked
  for the call; your organization and product counts for the caller's area; the SOA status, date and product types.
- Paste the plan's Summary of Benefits as `plan_facts.text` (up to 20,000 characters). Claims it does not mention come back
  "not in the plan facts", so give the full summary.
- The server stores nothing. Keep each signed record (JSON) with the recording until its retention dates. Once a person has
  checked the transcript against the audio, send `transcript_attestation: {"complete_and_accurate": true, "by": "..."}` so the
  record says so. Anyone can re-check a record with `POST /record/verify` against the key at `GET /attest/signing-key`.
- Keep the API on 127.0.0.1. For other users on the LAN, put a TLS reverse proxy with authentication in front and set
  `DECOSA_TRUSTED_PROXIES`.

## 7. Keep the direct route

`DECOSA_LLM_ROUTE=gateway` would send prompts, which contain the call transcript and PHI, to the hosted Decosa
API. Never use it
for real calls; at most, use it for synthetic training material.

Finish with a summary: what is running, the health output, the smoke-test results, and the reminders above.