Build an EU GPSR listing

# Assemble the Decosa GPSR listing pack on this machine

You are setting up a preparation aid for sellers who list products in the EU and for responsible-person services. Given a
supplier's product sheet and the product label (text or a photo), it extracts the listing information Article 19 of
Regulation (EU) 2023/988 (GPSR) asks an online offer to show, looks every value up in the documents, marks each Article 19
element found or missing, flags a label that disagrees with the sheet, translates the warnings into up to five languages
with every number, unit, date, code, negation and name checked, and signs a record of what was checked. It never says an
offer meets the Regulation, and it is not a responsible person. Work step by step, show me each command before you run
anything with `sudo`, and stop to ask if a check fails.

## Step 0: set up with a coding agent, rehearse on mock data, then go private

This prompt is for a coding agent running on the machine that will host the service. We recommend Claude Code with
Claude Opus 5.5; any capable coding agent works. Work in this order:

1. Set up on mock data only. During the whole setup you (the agent) work with the synthetic sample bundle below and
   nothing else. Do not ask me for real data, and do not open, read, list or copy files that hold real data, even to
   "test with something realistic".
2. Rehearse. When the steps below are done and the service is healthy, fetch the mock-data bundle for this tool,
   https://decosa.ai/samples/gpsr-listing-pack.zip (2 KB, 6 checks, synthetic or openly licensed: see `licence` in expected.json),
   show me what is in it, and run the rehearsal against the local API:
   `docker compose exec api python scripts/rehearse.py gpsr-listing-pack` (the api image carries the same bundle under /app/rehearsal/gpsr-listing-pack/;
   with no key set, the script asks the local API for a short demo token). From a decosa-api checkout instead:
   `python scripts/rehearse.py gpsr-listing-pack --bundle gpsr-listing-pack.zip --base-url http://127.0.0.1:<PORT>`.
   It sends the mock inputs to the local API and prints PASS or FAIL for each expected property (for example: "only the elements this product has are found (manufacturer name and addresses, picture, type, identifier, warnings, language); the EU responsible person is not", "the three responsible-person elements are missing (Art. 19(b), 16(1))", "the overall status is fail"). Show me
   the full output. Every check must pass. If one fails, fix the install and run it again; never edit `expected.json`
   to make a check pass.
3. Stop there. Once the rehearsal passes, tell me, and I will run my own data against the local API myself, on this
   machine.

For the person running this: a coding agent that runs in the cloud sees everything in its context, including files it
reads, command output and anything pasted into the chat. Keep real data out of the chat and out of anything the agent
can read. Switch to your own data only after the rehearsal has passed and the agent's work is done.

## 0. Ground rules and licences
- Models: Qwen3.8-27B (Apache-2.0) reads a label photo and extracts the fields as JSON; Hy-MT2-7B (Apache-2.0, no
  territory clause) translates. The checklist, the lookups, the label-vs-sheet check, the translation checks and the record
  are decosa-api (AGPL-3.0-or-later) on CPU.
- Supplier sheets and unreleased labels can be confidential: bind every port to 127.0.0.1 and use the direct LLM route.
  Nothing is stored; logs carry counts only. Keep it that way.
- Do not add a "compliant" or "GPSR-ready" badge anywhere. The record says what was checked.

## 1. Check the machine
1. `nvidia-smi`: 96 GB of GPU in total for both models (Qwen3.8-27B NVFP4 has about 20 GB of weights, Hy-MT2-7B takes
   about 18 GB with its KV cache at `--gpu-memory-utilization 0.18` of a 96 GB card). We measured the two on two cards;
   one 96 GB card should fit with a smaller LLM KV cache (not measured). Driver 570 or newer; NVFP4 needs Blackwell,
   otherwise use `Qwen/Qwen3.8-27B-FP8`.
2. `docker --version` and `docker compose version`. If Docker or the NVIDIA container toolkit is missing, install them
   from the official Docker and NVIDIA repositories after asking me, then run
   `docker run --rm --gpus all nvidia/cuda:12.8.0-base-ubuntu24.04 nvidia-smi`.
3. Disk: about 45 GB free (Qwen3.8 NVFP4 about 20 GB, Hy-MT2-7B 15 GB).

## 2. Images and weights
- `${DECOSA_REGISTRY}/decosa-api:<tag>` (**publishing soon**). If the pull fails, build from source:
  `git clone <decosa-api source: on request at https://decosa.ai/contact?topic=self-host>` (access required), check out the newest release tag that
  contains `decosa_api/verticals/gpsr/` and `decosa_api/lang/` (`main` until one does), and build `docker/api/Dockerfile`.
- `vllm/vllm-openai:v0.29.0` for both models.
- Weights: `nvidia/Qwen3.8-27B-NVFP4` (revision `482ca0f3832238542f8f5295dde86b5f22711d80`) and `tencent/Hy-MT2-7B`
  (revision `9b0eb4e8f001def3e5ff6469a0ac96fdb39ec223`; its LICENSE.txt is Apache-2.0). Download with
  `hf download tencent/Hy-MT2-7B --revision 9b0eb4e8f001def3e5ff6469a0ac96fdb39ec223 --local-dir ~/models/Hy-MT2-7B`.

## 3. docker-compose.yml
Write this in `~/decosa/gpsr/`:

```yaml
services:
  llm:
    image: vllm/vllm-openai:v0.29.0
    command: ["--model", "nvidia/Qwen3.8-27B-NVFP4", "--served-model-name", "qwen3.8-27b", "--max-model-len", "32768",
              "--limit-mm-per-prompt", "{\"image\":4}", "--gpu-memory-utilization", "0.70"]
    ports: ["127.0.0.1:8114:8000"]
    volumes: ["~/.cache/huggingface:/root/.cache/huggingface"]
    deploy: { resources: { reservations: { devices: [{ driver: nvidia, count: 1, capabilities: [gpu] }] } } }
    healthcheck: { test: ["CMD", "curl", "-fs", "http://localhost:8000/v1/models"], interval: 30s, retries: 20 }
  mt:
    image: vllm/vllm-openai:v0.29.0
    # vLLM 0.29 serves Hy-MT2 through its Transformers backend; CUDA-graph capture fails there, hence --enforce-eager
    command: ["/model", "--served-model-name", "hy-mt2-7b", "--max-model-len", "8192", "--gpu-memory-utilization", "0.18",
              "--max-num-seqs", "16", "--enforce-eager", "--generation-config", "vllm"]
    ports: ["127.0.0.1:8491:8000"]
    volumes: ["~/models/Hy-MT2-7B:/model:ro"]
    deploy: { resources: { reservations: { devices: [{ driver: nvidia, count: 1, capabilities: [gpu] }] } } }
    healthcheck: { test: ["CMD", "curl", "-fs", "http://localhost:8000/v1/models"], interval: 30s, retries: 20 }
  api:
    image: ${DECOSA_REGISTRY}/decosa-api:<tag>
    ports: ["127.0.0.1:8445:8445"]
    environment:
      DECOSA_HOST: 0.0.0.0
      DECOSA_PORT: "8445"
      DECOSA_DATA_DIR: /data
      DECOSA_LLM_ROUTE: direct
      DECOSA_LLM_URL: http://llm:8000/v1
      DECOSA_LLM_MODEL: qwen3.8-27b
      DECOSA_LANG_MT_URL: http://mt:8000/v1
      DECOSA_LANG_MT_MODEL: hy-mt2-7b
      DECOSA_GPSR_MAX_CONCURRENT: "3"
    volumes: ["decosa-data:/data"]
    depends_on: { llm: { condition: service_healthy }, mt: { condition: service_healthy } }
    healthcheck: { test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8445/gpsr/info', timeout=4)"], interval: 30s, retries: 10 }
volumes:
  decosa-data:
```

The api keeps its state (keys, receipts, this box's signing key) in the named volume `decosa-data`, not in a host folder:
the image runs as an unprivileged user (uid 10001), and a host folder Docker creates is owned by root. Start everything:
`docker compose up -d`. On a single card, lower the llm's `--gpu-memory-utilization` so both fit and tell me what you set.

On the first start the api creates this box's Ed25519 key in the volume (`/data/attest/`, mode 0600). Back it up with
`docker compose cp api:/data/attest ./attest-backup`, keep it private, never print it. Every model call on the direct
route, and every translation call, gets a receipt signed with that key (status `attested`): an operator attestation.

## 4. Smoke test
1. `curl -s localhost:8445/gpsr/info | jq '{applies: .source.applies_from, elements: (.elements | length)}'` shows
   `2024-12-13` and 11 elements.
2. No model: check a bad German translation of a warning with the language pack's code check.
   ```
   curl -s -XPOST localhost:8445/lang/check -H 'content-type: application/json' -d '{"source":"Do not charge above 40 °C.","target":"Bei über 45 °C laden.","target_lang":"de"}' | jq '[.segments[0].flags[].kind]'
   ```
   Expect `number_changed` and `negation_missing`.
3. Token: `T=$(curl -s -XPOST localhost:8445/demo/session -H 'content-type: application/json' -d '{"vertical":"gpsr-listing-pack"}' | jq -r .token)`.
4. `curl -s -XPOST localhost:8445/gpsr/pack -H "authorization: Bearer $T" -H 'content-type: application/json' -d '{"sample_id":"charger-no-rp"}' > pack.json`,
   then `jq '{status, missing: [.elements[] | select(.status=="missing") | .id], langs: (.translations | map_values(.status))}' pack.json`.
   Expect `fail`, the three `rp_*` elements missing (a UK manufacturer with no EU responsible person), and `ok` for
   German, Spanish and Dutch.
5. `jq '{record: .record}' pack.json | curl -s -XPOST localhost:8445/record/verify -H 'content-type: application/json' -d @- | jq .ok`
   must print `true`.
6. If decosa-api's source is at hand, `python scripts/rehearse.py gpsr-listing-pack --base-url http://127.0.0.1:8445` and
   `python scripts/rehearse.py language-pack --base-url http://127.0.0.1:8445` print PASS or FAIL per property.
7. Time it and tell me what you measure (about 6 s per pack with five languages on our shared GPUs).

## 5. Point the app at the local API
Set `NEXT_PUBLIC_DECOSA_API=http://127.0.0.1:8445` in the site's `.env.local`, or call `POST /gpsr/pack` from your
listing workflow and keep `record` with the listing. Contract: `API_CONTRACT.md`, section "Changes (language pack block,
gpsr-listing-pack, lay summary Member-State versions, 2026-09-27)".

Off by default. Joining serves other people's requests on this GPU; never do it on a box that holds confidential supplier
documents. If I ask for it, follow the provider guide at `/provide` on the site, and do not enable it without my explicit yes.