Quote a job from a walkthrough video

# Assemble Decosa Walkthrough-to-quote on this machine

You are setting up Walkthrough-to-quote: a phone video of a job walk (rooms or a yard, narrated by the customer or the
estimator) becomes a draft line-item scope and a draft quote. Every line cites a time range and a keyframe and is marked
seen, said or assumed. Quantities from the video are ranges with their method; a dimension nobody said and the video
cannot give stays empty. Prices come only from the business's own price sheet (a CSV), the arithmetic is done in code, and
a record of it is signed by this box's own key. Work step by step, show me each command before you run anything with
`sudo`, and stop to ask if a check fails.

## Step 0: set up with a coding agent, rehearse on mock data, then go private

This prompt is for a coding agent running on the machine that will host the service. We recommend Claude Code with
Claude Opus 5.5; any capable coding agent works. Work in this order:

1. Set up on mock data only. During the whole setup you (the agent) work with the synthetic sample bundle below and
   nothing else. Do not ask me for real data, and do not open, read, list or copy files that hold real data, even to
   "test with something realistic".
2. Rehearse. When the steps below are done and the service is healthy, fetch the mock-data bundle for this tool,
   https://decosa.ai/samples/walkthrough-to-quote.zip (2.2 MB, 11 checks, synthetic or openly licensed: see `licence` in expected.json),
   show me what is in it, and run the rehearsal against the local API:
   `docker compose exec api python scripts/rehearse.py walkthrough-to-quote` (the api image carries the same bundle under /app/rehearsal/walkthrough-to-quote/;
   with no key set, the script asks the local API for a short demo token). From a decosa-api checkout instead:
   `python scripts/rehearse.py walkthrough-to-quote --bundle walkthrough-to-quote.zip --base-url http://127.0.0.1:<PORT>`.
   It sends the mock inputs to the local API and prints PASS or FAIL for each expected property (for example: "the ceiling water stain (shown, never said) is a seen-only line", "the guest-bath ceiling (said, never filmed) is a said-only line", "the bedroom's length is the one said on camera (14 ft)"). Show me
   the full output. Every check must pass. If one fails, fix the install and run it again; never edit `expected.json`
   to make a check pass.
3. Stop there. Once the rehearsal passes, tell me, and I will run my own data against the local API myself, on this
   machine.

For the person running this: a coding agent that runs in the cloud sees everything in its context, including files it
reads, command output and anything pasted into the chat. Keep real data out of the chat and out of anything the agent
can read. Switch to your own data only after the rehearsal has passed and the agent's work is done.

## 0. Ground rules and licences
- Models: Qwen3.8-27B (Apache-2.0) with video input, and MOSS-Transcribe-Diarize (Apache-2.0) for the narration. The
  API is decosa-api (AGPL-3.0-or-later); ffmpeg runs inside it as a separate program (LGPL/GPL).
- Videos of customers' homes stay on this machine. Bind every port to 127.0.0.1. The API deletes each upload when its run
  ends and keeps reports in memory for one hour; logs carry counts only. Keep it that way.
- Be honest about what it does: a draft for the estimator. It never prices from anything but the sheet you give it, and
  its video quantities are estimates to measure. Film with the customer's knowledge and keep people out of frame.

## 1. Check the machine
1. `nvidia-smi`: one GPU with at least 32 GB (Qwen3.8-27B NVFP4 is about 20 GB of weights; a maximum video request adds
   about 32k tokens of KV cache). Measured on an RTX PRO 6000 96 GB. Blackwell cards run NVFP4; on older cards use the
   FP8 weights. The diarizer needs about 3 GB more (same card or a second one).
2. `docker --version`, `docker compose version`. If Docker or the NVIDIA container toolkit is missing, install them from
   the official Docker and NVIDIA repositories after asking me, then check
   `docker run --rm --gpus all nvidia/cuda:12.8.0-base-ubuntu24.04 nvidia-smi`.
3. Disk: about 35 GB free (model weights, images).

## 2. Images and weights
- `${DECOSA_REGISTRY}/decosa-api:<tag>` and `${DECOSA_REGISTRY}/decosa-llm:<tag>` (**publishing soon**). If a
  pull fails, build from source: `git clone <decosa-api source: on request at https://decosa.ai/contact?topic=self-host>` (access required), check out a
  release that contains `decosa_api/verticals/walkthrough/`, and build `docker/api/Dockerfile` as `decosa-api:local` and
  `docker/llm` as `decosa-llm:local` (vLLM 0.29.0, pinned by digest).
- The diarizer has no published image yet: build `services/diarize` from the same checkout as `decosa-diarize:local`
  (weights `OpenMOSS-Team/MOSS-Transcribe-Diarize` at revision `704aa4a9c304e8520be88901e0d1960158ef5b15`). Without
  it, send the transcript with each video (step 4.4).
- Weights `nvidia/Qwen3.8-27B-NVFP4` at revision `482ca0f3832238542f8f5295dde86b5f22711d80` download on the llm's
  first start into the named `hf-cache` volume.

## 3. docker-compose.yml
Write this in `~/decosa/walkthrough/`:

```yaml
services:
  llm:
    image: ${DECOSA_REGISTRY}/decosa-llm:<tag>
    command: ["nvidia/Qwen3.8-27B-NVFP4", "--revision", "482ca0f3832238542f8f5295dde86b5f22711d80",
              "--served-model-name", "qwen3.8-27b", "--limit-mm-per-prompt", "{\"image\":4,\"video\":1}",
              "--media-io-kwargs", "{\"video\":{\"num_frames\":240,\"fps\":1}}", "--max-model-len", "65536",
              "--gpu-memory-utilization", "0.60", "--kv-cache-dtype", "fp8_e4m3", "--host", "0.0.0.0", "--port", "8000"]
    ipc: host
    volumes: ["hf-cache:/root/.cache/huggingface"]
    deploy: { resources: { reservations: { devices: [{ driver: nvidia, count: 1, capabilities: [gpu] }] } } }
    healthcheck: { test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=4)"], interval: 15s, retries: 60 }
  diarize:
    image: decosa-diarize:local
    deploy: { resources: { reservations: { devices: [{ driver: nvidia, count: 1, capabilities: [gpu] }] } } }
  api:
    image: ${DECOSA_REGISTRY}/decosa-api:<tag>
    ports: ["127.0.0.1:8445:8445"]
    environment:
      DECOSA_HOST: 0.0.0.0
      DECOSA_PORT: "8445"
      DECOSA_DATA_DIR: /data
      DECOSA_LLM_ROUTE: direct
      DECOSA_LLM_URL: http://llm:8000/v1
      DECOSA_LLM_MODEL: qwen3.8-27b
      DECOSA_DIARIZE_URL: http://diarize:8092
    volumes: ["decosa-data:/data"]
    depends_on: { llm: { condition: service_healthy } }
    healthcheck: { test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8445/walkthrough/info', timeout=4)"], interval: 30s, retries: 10 }
volumes:
  decosa-data:
  hf-cache:
```

The api keeps its state (keys, receipts, this box's signing key) in the named volume `decosa-data`, not a host folder:
the image runs as uid 10001, and a host folder Docker creates is owned by root (`PermissionError ... /data/keys.sqlite`).
Start with `docker compose up -d`; the llm's first start downloads the weights and takes several minutes.

Video budget: with these flags the model's own processor caps one video at 12,288 video tokens. The hosted service raises
it to 32,768 by mounting a copy of the model's `processor_config.json` and `video_preprocessor_config.json` whose
`video_processor.size.longest_edge` is 67108864 (read-only, over the files in the model folder). Do that only with a
local model folder and room for the extra KV cache; do not use `--mm-processor-kwargs` for it (vLLM 0.29.0 fails at start).

On the first start the api creates this box's Ed25519 key in the volume (`/data/attest/`, mode 0600). Back it up with
`docker compose cp api:/data/attest ./attest-backup`, keep it private, never print it.

## 4. Smoke test
1. `curl -s localhost:8445/walkthrough/info | jq '.serving, .steps.asr'`: 1 video, 1 fps, 240 frames; ASR "on".
2. Token: `T=$(curl -s -XPOST localhost:8445/demo/session -H 'content-type: application/json' -d '{"vertical":"walkthrough-to-quote"}' | jq -r .token)`.
3. Draft the painter sample with its own price sheet:
   `curl -s -XPOST localhost:8445/walkthrough/draft -H "authorization: Bearer $T" -H 'content-type: application/json' -d '{"sample":"painter-bedroom-hall","stream":false}' > draft.json`.
   Expect 6-10 lines with a keyframe each; the ceiling water stain as a `seen` line; the guest-bath ceiling as a `said`
   line with quantity `missing`; the bedroom's length 14 in `.report.areas[].said_dims`; a subtotal range in
   `.report.quote.totals`. On our card it took 40-60 s with other work on the GPU.
4. Your own video without the diarizer: send `"video_b64"` (the file as base64), `"price_sheet_csv"` (your sheet as CSV
   text: `code,description,unit,unit_price`; units sq ft, sq yd, lin ft, each, room, day, hour) and
   `"transcript": [{"start": 2.1, "end": 3.8, "text": "..."}]` (seconds) instead of `"sample"`. MP4, MOV or WebM, up to
   10 minutes and 64 MB.
5. Check the arithmetic and the record: `curl -s localhost:8445/walkthrough/samples/painter-bedroom-hall/prices > prices.csv`,
   then `jq -n --slurpfile d draft.json --rawfile p prices.csv '{quote: $d[0].report, price_sheet_csv: $p}' | curl -s -XPOST localhost:8445/walkthrough/check-arithmetic -H 'content-type: application/json' -d @-`
   must say `"ok": true`, and `jq '{record: .record}' draft.json | curl -s -XPOST localhost:8445/record/verify -H 'content-type: application/json' -d @-`
   must say `"ok": true`; change one amount in the record and verify again: it must fail.
6. Measure and sign: `curl -s -XPOST localhost:8445/walkthrough/runs/$(jq -r .run_id draft.json)/price -H "authorization: Bearer $T" -H 'content-type: application/json' -d '{"measurements":{"1": 250}}'`
   re-prices line 1 with your figure (no model call); then `.../signoff` with `{"name":"Your Name","role":"estimator","confirm":true}`.
7. Rehearse on the bundled mock walkthrough before any real one: `python scripts/rehearse.py walkthrough-to-quote --base-url http://127.0.0.1:8445`
   (from the decosa-api checkout) must print 11/11 checks passed.

Every model call on the direct route gets a receipt signed with this box's key (status `attested`): an attestation by
me, the operator, not a proof of computation.

## 5. Point the app at the local API
Set `NEXT_PUBLIC_DECOSA_API=http://127.0.0.1:8445` in the site's `.env.local`, or call `POST /walkthrough/draft` from your
own tooling and keep the Markdown or CSV export and the signed record with each quote. Contract: `API_CONTRACT.md`,
section "walkthrough-to-quote".

Off by default. Joining serves other people's requests on this GPU; never do it on a box that holds customers' videos.
Follow the provider guide at `/provide` on the site only if I ask, and do not enable it without my explicit yes.