Check a police report against bodycam

# Assemble Decosa report integrity on this machine

You are setting up a self-hosted report-integrity checker on this Linux machine. It takes the transcript of a recording (body-worn camera, security camera, EMS or workplace interview) and a written incident report, checks every sentence of the report against the transcript, lists key events on the recording the report leaves out, and signs the result. It can also draft a report from the transcript, keep a signed first draft, and seal a record of which sentences a person changed before signing. With the optional diarizer it turns a recording into a timed, speaker-labelled transcript. Work step by step, show me each command before running anything that needs sudo, and stop if a check fails.

**Before anything else, remind me:** incident reports, body-worn-camera audio and discovery hold personal and often confidential criminal-justice information. Keep everything on this machine: the model route stays local (`direct`) and nothing goes to a hosted service. "Not in the recording" means the transcript does not contain it, not that it is false. This is not legal advice; disclosure and certification duties (California Penal Code 13663 from SB 524, in force 1 Jan 2026; Utah Code 53-25-602 from SB 180, in force 7 May 2025) are for the agency and its counsel. Repeat these points in your final summary.

## Step 0: set up with a coding agent, rehearse on mock data, then go private

This prompt is for a coding agent running on the machine that will host the service. We recommend Claude Code with
Claude Opus 5.5; any capable coding agent works. Work in this order:

1. Set up on mock data only. During the whole setup you (the agent) work with the synthetic sample bundle below and
   nothing else. Do not ask me for real data, and do not open, read, list or copy files that hold real data, even to
   "test with something realistic".
2. Rehearse. When the steps below are done and the service is healthy, fetch the mock-data bundle for this tool,
   https://decosa.ai/samples/report-integrity.zip (4 KB, 13 checks, synthetic or openly licensed: see `licence` in expected.json),
   show me what is in it, and run the rehearsal against the local API:
   `docker compose exec api python scripts/rehearse.py report-integrity` (the api image carries the same bundle under /app/rehearsal/report-integrity/;
   with no key set, the script asks the local API for a short demo token). From a decosa-api checkout instead:
   `python scripts/rehearse.py report-integrity --bundle report-integrity.zip --base-url http://127.0.0.1:<PORT>`.
   It sends the mock inputs to the local API and prints PASS or FAIL for each expected property (for example: "every sentence got a verdict (none errored)", "'thirty feet' (the recording says ten) is flagged", "'the backup alarm was not working' (the recording says it was) is flagged"). Show me
   the full output. Every check must pass. If one fails, fix the install and run it again; never edit `expected.json`
   to make a check pass.
3. Stop there. Once the rehearsal passes, tell me, and I will run my own data against the local API myself, on this
   machine.

For the person running this: a coding agent that runs in the cloud sees everything in its context, including files it
reads, command output and anything pasted into the chat. Keep real data out of the chat and out of anything the agent
can read. Switch to your own data only after the rehearsal has passed and the agent's work is done.

## What you are building

| service | image | model | port |
|---|---|---|---|
| `llm` | `${DECOSA_REGISTRY}/decosa-llm:0.1.0` (vLLM 0.29.0, `vllm/vllm-openai@sha256:c2914767605584b6d8f45686b82de173ecc99e781897aa3d0a66dacd72c51ae1`) | `nvidia/Qwen3.8-27B-NVFP4` @ `482ca0f3832238542f8f5295dde86b5f22711d80`, Apache-2.0 | internal 8000 |
| `api` | `${DECOSA_REGISTRY}/decosa-api:0.1.0` (no GPU) | none | `127.0.0.1:8445` |
| `diarize` (optional, recordings only) | built from the decosa-api source (`services/diarize`) | `OpenMOSS-Team/MOSS-Transcribe-Diarize` @ `704aa4a9c304e8520be88901e0d1960158ef5b15`, Apache-2.0 | internal 8092 |

Typed, WebVTT or SRT transcripts need no speech model. `diarize` only turns a recording into a transcript.

## 1. Check the GPU, driver and Docker

1. Run `nvidia-smi`. I need one NVIDIA GPU with at least 48 GB and driver 580 or newer.
   - Blackwell (RTX PRO 6000, B200): use the defaults below (NVFP4). This is the measured setup.
   - Hopper (H100/H200) or 48 GB Ada/L40S: set `LLM_MODEL=Qwen/Qwen3.8-27B-FP8`, `LLM_REVISION=main`; on 48 GB also `LLM_MAX_LEN=32768`. Not measured.
   - Under 48 GB: stop and tell me it will not fit.
2. Check `docker --version`, `docker compose version` and `docker run --rm --gpus all ubuntu nvidia-smi`. If Docker or the NVIDIA Container Toolkit is missing, install them from the official Docker and NVIDIA repositories (`sudo nvidia-ctk runtime configure --runtime=docker`, then restart Docker).
3. Confirm about 60 GB of free disk.

## 2. Get the images

The images are **on request** while self-host is in early access: ask at https://decosa.ai/contact?topic=self-host, and Decosa sends the registry (set it as `DECOSA_REGISTRY`), pull access and the compose file. Try `docker pull ${DECOSA_REGISTRY}/decosa-{llm,api}:0.1.0`. If a pull fails, build from source once the `decosa-api` source is published: clone it and run `docker build -f docker/api/Dockerfile -t ${DECOSA_REGISTRY}/decosa-api:0.1.0 .` in it (and `docker compose build llm` from its compose file). If neither works, stop and tell me.

## 3. Write the compose file

Create `~/decosa-report/.env`:

```bash
DECOSA_TAG=0.1.0
DECOSA_GPU=0
LLM_MODEL=nvidia/Qwen3.8-27B-NVFP4
LLM_REVISION=482ca0f3832238542f8f5295dde86b5f22711d80
LLM_MAX_LEN=65536
LLM_GPU_UTIL=0.85
DECOSA_SIGNER_NAME="<who signs these checks, e.g. County Public Defender, investigations>"
```

Create `~/decosa-report/docker-compose.yml` with exactly these services:

```yaml
name: decosa-report
x-health: &health
  interval: 15s
  timeout: 5s
  retries: 5
services:
  llm:
    image: ${DECOSA_REGISTRY}/decosa-llm:${DECOSA_TAG}
    deploy: { resources: { reservations: { devices: [ { driver: nvidia, device_ids: ["${DECOSA_GPU:-0}"], capabilities: [gpu] } ] } } }
    ipc: host
    restart: unless-stopped
    volumes: [hf-cache:/root/.cache/huggingface]
    command: ["${LLM_MODEL}", "--revision", "${LLM_REVISION}", "--served-model-name", "qwen3.8-27b",
              "--language-model-only", "--max-model-len", "${LLM_MAX_LEN}", "--gpu-memory-utilization", "${LLM_GPU_UTIL}",
              "--max-num-seqs", "16", "--kv-cache-dtype", "fp8_e4m3", "--speculative-config", '{"method":"mtp","num_speculative_tokens":3}',
              "--seed", "0", "--enable-force-include-usage", "--disable-uvicorn-access-log", "--host", "0.0.0.0", "--port", "8000"]
    healthcheck: { <<: *health, test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=4)"], start_period: 900s }
  api:
    image: ${DECOSA_REGISTRY}/decosa-api:${DECOSA_TAG}
    restart: unless-stopped
    depends_on: { llm: { condition: service_healthy } }
    environment:
      DECOSA_LLM_ROUTE: direct                  # local model only; receipts are signed by this box's key ("attested")
      DECOSA_LLM_URL: http://llm:8000/v1
      DECOSA_LLM_MODEL: qwen3.8-27b
      DECOSA_LOCAL_SIGNING: "on"                # Ed25519 key created at /data/attest/ed25519.pem on first start
      DECOSA_SIGNER_NAME: ${DECOSA_SIGNER_NAME}
      DECOSA_SESSIONS_PER_IP_HOUR: "1000"
      DECOSA_BUDGET_LLM_TOKENS: "200000"        # per session; a 15-sentence check with key events needs about 5,000
      DECOSA_SESSION_TTL_S: "28800"
      DECOSA_REPORT_AUDIO: "0"                  # "1" only with the diarize service
      DECOSA_DIARIZE_URL: ""
      DECOSA_CORS_ORIGIN_REGEX: '^https?://(localhost|127\.0\.0\.1)(:\d+)?$$'
    ports: ["127.0.0.1:8445:8445"]
    volumes: [decosa-data:/data]
    healthcheck: { <<: *health, test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8445/healthz', timeout=4)"], start_period: 20s }
volumes: { hf-cache: {}, decosa-data: {} }
```

Use the named volume `decosa-data` as written (a host bind mount owned by root makes the API fail on `/data/keys.sqlite`). Run `docker compose up -d` and poll `docker compose ps` until both are healthy (the LLM takes 5-10 minutes the first time). `curl -s localhost:8445/healthz` should show `"llm": true` (`asr` is false here and that is fine).

## 4. Optional: recordings (diarize)

Only if I want transcripts made from recordings: build `services/diarize` from the decosa-api source on a CUDA PyTorch base image (env `DIARIZE_HOST=0.0.0.0 DIARIZE_PORT=8092 DIARIZE_DEVICE=cuda:0`, the `hf-cache` volume, the same GPU, a health check on `GET /health`), lower `LLM_GPU_UTIL` to 0.80, and set `DECOSA_DIARIZE_URL: http://diarize:8092` and `DECOSA_REPORT_AUDIO: "1"`. `POST /report/transcribe` then takes a 16 kHz mono 16-bit WAV (`ffmpeg -i in.mp4 -ac 1 -ar 16000 -sample_fmt s16 out.wav`) and returns timed segments with a speech receipt; pass them as `segments` (with `speakers` to name S01, S02) to `/report/check` or `/report/draft`. The fit beside the LLM is an estimate, not measured.

## 5. Smoke test

```bash
API=localhost:8445
TOKEN=$(curl -s $API/demo/session -H 'content-type: application/json' -d '{"vertical":"report-integrity"}' | jq -r .token)
curl -s $API/report/check -H "authorization: Bearer $TOKEN" -H 'content-type: application/json' \
  -d '{"sample_id":"traffic-stop-audio","report":{"sample":"tampered"}}' > /tmp/check.json
jq '{counts, omission_counts, missing, receipts: (.receipts|length)}' /tmp/check.json
jq -r '.sentences[] | "\(.verdict)\t\(.text)"' /tmp/check.json
jq '{statement: .signed}' /tmp/check.json | curl -s $API/report/verify -H 'content-type: application/json' -d @- | jq .
```

Pass if: the 62 mph and "did not have proof of insurance" sentences are `contradicted`, the odor and center-console sentences are `unsupported`, key events about the one beer and the refused search are `missing`, every receipt has `"status": "attested"`, and the verify shows `valid_signature` and `signed_by_this_server` true. Then the faithful report, `{"sample":"faithful"}`, should come back with few or no flags. On the measured card a check takes 30-80 s depending on load.

Then the draft and record path:

```bash
curl -s $API/report/draft -H "authorization: Bearer $TOKEN" -H 'content-type: application/json' -d '{"sample_id":"bar-fight-audio"}' > /tmp/draft.json
jq '{first: .first_draft.id, sentences: (.draft.sentences|length), to_confirm: .draft.to_confirm}' /tmp/draft.json
jq '{first_draft, draft: .draft.text, versions: [{text: (.draft.text + " I did not see who threw the first punch.")}], jurisdiction: "CA", certification: {name: "Test Author", accepted: true}}' /tmp/draft.json \
  | curl -s $API/report/finalize -H "authorization: Bearer $TOKEN" -H 'content-type: application/json' -d @- > /tmp/final.json
jq '{counts, disclosure: .disclosure.text, self_check}' /tmp/final.json
jq '{record}' /tmp/final.json | curl -s $API/record/verify -H 'content-type: application/json' -d @- | jq '{ok, summary}'
```

Pass if the counts show one `human` sentence, the disclosure starts "This report was written either fully or in part using artificial intelligence.", and the record verifies (`ok: true`).

## 6. Point the app at the local API

- Base URL `http://localhost:8445` (web app: `NEXT_PUBLIC_DECOSA_API=http://localhost:8445`). Add other origins to `DECOSA_CORS_ORIGINS`.
- `POST /report/check` and `/report/draft` return JSON, or stream Server-Sent Events with `Accept: text/event-stream`. Keep the signed statement (and in draft mode the signed first draft) with the report; they hold hashes, not text.
- Keep the API on 127.0.0.1. For other users on the LAN, put a TLS reverse proxy with authentication in front and set `DECOSA_TRUSTED_PROXIES`.

## 7. Keep the direct route

`DECOSA_LLM_ROUTE=gateway` would send prompts, which contain the transcript and the report, to the hosted Decosa
API. Never use it for real incidents. Synthetic training material at most.

Finish with a summary: what is running, the health output, the smoke-test results, and the reminders above.