Stage a listing photo with disclosure

# Assemble Decosa disclosed virtual staging on this machine

You are setting up self-hosted virtual staging on this Linux machine for a brokerage, a listing photographer or an MLS
vendor. It:
- stages an empty-room photo with furniture only (stage mode), or checks a photo staged by any other tool against its
  original (check mode);
- checks that walls, windows, doors, views, floors, fixtures and visible damage were left alone, pixel by pixel and with a
  side-by-side comparison by Qwen3.8-27B, and refuses requests to remove, hide or improve anything;
- burns in a "Virtually staged" label with a link to the unaltered original, adds a C2PA credential naming the original,
  and seals a signed pair record (California Business and Professions Code 10140.8, AB 723).

Work step by step. Show me each command before running anything that needs sudo, and stop if a check fails.

**Before anything else, remind me:**
- This is an automated aid, not legal advice or a compliance determination. A person should look at each pair before it is
  published.
- Pre-listing photos stay on this machine: the model route stays local (`direct`). A disclosed pair is meant to be public
  (the label links to it): publish it where you choose.

Repeat these points in your final summary.

## Step 0: set up with a coding agent, rehearse on mock data, then go private

This prompt is for a coding agent running on the machine that will host the service. We recommend Claude Code with
Claude Opus 5.5; any capable coding agent works. Work in this order:

1. Set up on mock data only. During the whole setup you (the agent) work with the synthetic sample bundle below and
   nothing else. Do not ask me for real data, and do not open, read, list or copy files that hold real data, even to
   "test with something realistic".
2. Rehearse. When the steps below are done and the service is healthy, fetch the mock-data bundle for this tool,
   https://decosa.ai/samples/virtual-staging.zip (578 KB, 13 checks, synthetic or openly licensed: see `licence` in expected.json),
   show me what is in it, and run the rehearsal against the local API:
   `docker compose exec api python scripts/rehearse.py virtual-staging` (the api image carries the same bundle under /app/rehearsal/virtual-staging/;
   with no key set, the script asks the local API for a short demo token). From a decosa-api checkout instead:
   `python scripts/rehearse.py virtual-staging --bundle virtual-staging.zip --base-url http://127.0.0.1:<PORT>`.
   It sends the mock inputs to the local API and prints PASS or FAIL for each expected property (for example: "the doctored image is not labelled", "the check fails it", "the changed view is named"). Show me
   the full output. Every check must pass. If one fails, fix the install and run it again; never edit `expected.json`
   to make a check pass.
3. Stop there. Once the rehearsal passes, tell me, and I will run my own data against the local API myself, on this
   machine.

For the person running this: a coding agent that runs in the cloud sees everything in its context, including files it
reads, command output and anything pasted into the chat. Keep real data out of the chat and out of anything the agent
can read. Switch to your own data only after the rehearsal has passed and the agent's work is done.

## What you are building

| service | image | model | port |
|---|---|---|---|
| `llm` | `${DECOSA_REGISTRY}/decosa-llm:0.1.0` (vLLM 0.29.0, `vllm/vllm-openai@sha256:c2914767605584b6d8f45686b82de173ecc99e781897aa3d0a66dacd72c51ae1`) | `nvidia/Qwen3.8-27B-NVFP4` @ `482ca0f3832238542f8f5295dde86b5f22711d80`, Apache-2.0, **with its vision tower** | internal 8000 |
| `api` | `${DECOSA_REGISTRY}/decosa-api:0.1.0` (no GPU; Tesseract and c2pa inside) | none | `127.0.0.1:8445` |
| ComfyUI (stage mode only) | installed on the host | `alibaba-pai/Wan2.2-VACE-Fun-A14B` (fp8) + `lightx2v/Wan2.2-Lightning`, both Apache-2.0 | `127.0.0.1:8189` |

Check mode needs only `llm` and `api`.

## 1. Check the GPU, driver and Docker

1. Run `nvidia-smi`. Check mode needs one NVIDIA GPU with at least 48 GB and driver 580 or newer; stage mode adds VACE A14B
   (fp8). The measured setup is two RTX PRO 6000 96 GB cards (model on one, ComfyUI on the other); both on one 96 GB card
   is not measured.
2. Check `docker --version`, `docker compose version` and `docker run --rm --gpus all ubuntu nvidia-smi`. If Docker or the
   NVIDIA Container Toolkit is missing, install them from the official repositories
   (`sudo nvidia-ctk runtime configure --runtime=docker`, then restart Docker).
3. Confirm about 60 GB of free disk (about 100 GB more for stage mode).

## 2. Get the images

The images are **on request** while self-host is in early access: ask at https://decosa.ai/contact?topic=self-host, and Decosa sends the registry (set it as `DECOSA_REGISTRY`), pull access and the compose file.
1. Try `docker pull ${DECOSA_REGISTRY}/decosa-{llm,api}:0.1.0`.
2. If a pull fails, build from source once the `decosa-api` source is published: in it,
   `docker build -f docker/api/Dockerfile -t ${DECOSA_REGISTRY}/decosa-api:0.1.0 .`, and `docker compose build llm`.
3. If neither works, stop and tell me.

## 3. Write the compose file

Create `~/decosa-staging/.env`:

```bash
DECOSA_TAG=0.1.0
DECOSA_GPU=0
LLM_MODEL=nvidia/Qwen3.8-27B-NVFP4
LLM_REVISION=482ca0f3832238542f8f5295dde86b5f22711d80
LLM_MAX_LEN=65536
LLM_GPU_UTIL=0.85
DECOSA_SIGNER_NAME="<who signs these records, e.g. Example Realty listing team>"
ORIGINAL_BASE="<the public address that will serve /staging/p, e.g. https://listings.example.com/staging/p>"
```

Create `~/decosa-staging/docker-compose.yml`:

```yaml
name: decosa-staging
x-health: &health
  interval: 15s
  timeout: 5s
  retries: 5
services:
  llm:
    image: ${DECOSA_REGISTRY}/decosa-llm:${DECOSA_TAG}
    deploy: { resources: { reservations: { devices: [ { driver: nvidia, device_ids: ["${DECOSA_GPU:-0}"], capabilities: [gpu] } ] } } }
    ipc: host
    restart: unless-stopped
    volumes: [hf-cache:/root/.cache/huggingface]
    # no --language-model-only: the staging check sends images
    command: ["${LLM_MODEL}", "--revision", "${LLM_REVISION}", "--served-model-name", "qwen3.8-27b",
              "--max-model-len", "${LLM_MAX_LEN}", "--gpu-memory-utilization", "${LLM_GPU_UTIL}", "--max-num-seqs", "16",
              "--kv-cache-dtype", "fp8_e4m3", "--speculative-config", '{"method":"mtp","num_speculative_tokens":3}',
              "--limit-mm-per-prompt", '{"image":4,"video":0}', "--seed", "0", "--enable-force-include-usage", "--host", "0.0.0.0", "--port", "8000"]
    healthcheck: { <<: *health, test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=4)"], start_period: 900s }
  api:
    image: ${DECOSA_REGISTRY}/decosa-api:${DECOSA_TAG}
    restart: unless-stopped
    depends_on: { llm: { condition: service_healthy } }
    extra_hosts: ["host.docker.internal:host-gateway"]
    environment:
      DECOSA_LLM_ROUTE: direct                  # local model only; receipts are signed by this box's key ("attested")
      DECOSA_LLM_URL: http://llm:8000/v1
      DECOSA_LLM_MODEL: qwen3.8-27b
      DECOSA_LOCAL_SIGNING: "on"
      DECOSA_SIGNER_NAME: ${DECOSA_SIGNER_NAME}
      DECOSA_PROVENANCE_DIR: /provenance        # C2PA signing material (step 4)
      DECOSA_STAGING_ORIGINAL_BASE: ${ORIGINAL_BASE}
      DECOSA_STAGING_PAIR_DAYS: "30"
      DECOSA_STUDIO_WORKER: command             # stage mode: renders through ComfyUI on the host (step 5)
      DECOSA_STUDIO_WORKER_CMD: python /app/scripts/studio_worker.py
      DECOSA_STUDIO_COMFY_URL: http://host.docker.internal:8189
      DECOSA_STUDIO_WORK_DIR: /work
      DECOSA_SESSIONS_PER_IP_HOUR: "1000"
      DECOSA_BUDGET_LLM_TOKENS: "200000"
      DECOSA_CORS_ORIGIN_REGEX: '^https?://(localhost|127\.0\.0\.1)(:\d+)?$$'
    ports: ["127.0.0.1:8445:8445"]
    volumes: [decosa-data:/data, decosa-provenance:/provenance]
    healthcheck: { <<: *health, test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8445/healthz', timeout=4)"], start_period: 20s }
volumes: { hf-cache: {}, decosa-data: {}, decosa-provenance: {} }
```

Use the named volumes as written: a host bind mount owned by root makes the API fail on `/data/keys.sqlite`.

## 4. Start it and create the C2PA signing material

1. `docker compose up -d llm`, then `docker compose run --rm api python scripts/provenance_devcert.py` (a development CA
   and signer in the `decosa-provenance` volume; public C2PA validators will show it as untrusted until you use a
   certificate from a C2PA-trusted CA).
2. `docker compose up -d`, then poll `docker compose ps` until both are healthy (the LLM takes 5-10 minutes the first time).
3. `curl -s localhost:8445/staging/info | jq '{render, model: .model.route, record}'`: route `direct`, `record.signed: true`.

## 5. Stage mode: ComfyUI with Wan2.2-VACE-Fun-A14B (optional)

Check mode works without this. For stage mode, on the host (or a second GPU):
1. Install ComfyUI (tested at v0.34.0-36-g30bdda1e) and listen on `0.0.0.0:8189` (or bridge it to the api container).
2. Put `alibaba-pai/Wan2.2-VACE-Fun-A14B` (high- and low-noise experts) in `models/diffusion_models` as
   `vace-fun-a14b-high-noise.safetensors` / `vace-fun-a14b-low-noise.safetensors`, `umt5_xxl_fp16.safetensors` in
   `models/clip`, `Wan2.1_VAE.pth` in `models/vae`, and the two `lightx2v/Wan2.2-Lightning` T2V 4-step LoRAs in `models/loras`
   (the names in `services/animatic/workflows/vace-still.api.json`).
3. The worker uploads a copy of each photo to ComfyUI's `input/` folder. ComfyUI in another container or on the host keeps
   those copies: delete `input/decosa-staging-*` and `output/decosa-staging/*` on a schedule.

## 6. Smoke test

```bash
cd ~/decosa-staging && docker compose exec api python scripts/rehearse.py virtual-staging --base-url http://127.0.0.1:8445
```

Pass if all 13 checks pass: the doctored view is refused (`not_disclosed`, a `view` violation), the honest staging is
labelled and paired (`disclosed`), its label reads back, it carries a C2PA credential, its pair record verifies and fails
once tampered, "remove the power lines" is refused with category `surroundings` before any model call, and every receipt
is `attested`. For stage mode also run:

```bash
API=localhost:8445
TOKEN=$(curl -s $API/demo/session -H 'content-type: application/json' -d '{"vertical":"virtual-staging"}' | jq -r .token)
curl -s $API/staging/runs -H "authorization: Bearer $TOKEN" -H 'content-type: application/json' \
  -d '{"sample":"berlin-living","stream":false}' | jq '{status, verdict, pair_id, seconds, receipts: (.receipts|length)}'
```

Expect `disclosed` and `pass` in about 15 s once VACE is loaded (the first render also loads the model).

## 7. Point your listing tools at it

- The console on the Decosa site talks to `NEXT_PUBLIC_DECOSA_API_BASE`; set it to `http://127.0.0.1:8445` for a local build.
- Serve `/staging/p/*` at the address in `ORIGINAL_BASE` (a reverse proxy to the api), or download each pair
  (`/staging/p/<id>/original`, `/staged`, `/record`) and publish it on your listing site: the label's link must work.