Validation through SimReady Central's validator: path + caption, verdict cache

/vlm_validate/search_result now goes to SimReady Central's validator (docker/hf-space/deeptag-validate/app.py, vendored from simready-central !582; supervisord's deeptag-validate on 127.0.0.1:8020) on the same engine: each hit's path and caption in words-only checks and an in-memory verdict cache (500k entries).

Dockerfile

@@ -284,6 +284,11 @@ COPY docker/hf-space/supervisord-gpu.conf /etc/supervisor/conf.d/hf-space.conf
 
 COPY docker/hf-space/nginx.conf.template /etc/nginx/hf-space.conf.template
 
+# SimReady Central's validator (supervisord's [program:deeptag-validate], nginx's
+# /vlm_validate/search_result): one vendored file, run by the app venv, which already
+# has its fastapi, uvicorn, httpx, pydantic and pillow (deepsearch-api's own).
+COPY docker/hf-space/deeptag-validate/app.py /app/deeptag-validate/app.py
+
 COPY services/explorer/dist /usr/share/nginx/explorer
 
 

docker/hf-space/deeptag-validate/app.py

@@ -0,0 +1,836 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+"""
+deeptag-validate — VLM relevance-validation shim.
+
+Two routes, one scorer:
+
+- `POST /vlm_validate/search_result` — the original per-image contract: the
+  browser uploads one base64 thumbnail per call (~100 requests per search).
+- `POST /vlm_validate/batch_stream` — the streamed batch contract (task #27):
+  ONE request per result page carrying only ids + image references; the shim
+  fetches each thumbnail ITSELF through the gateway's `/images` (LAN hop,
+  shared 7-day nginx cache the browsers already warmed, index-scoped by the
+  request's `index` slug) and streams verdicts back as NDJSON lines the
+  moment each lands — shim-cache hits first, then misses dispatched in
+  REQUEST (retrieval) order. Client disconnect cancels every queued engine
+  call (the whole point of the per-request task set — an abandoned query
+  must not strand work on the shared engine).
+
+Bridges the Explorer's `/vlm_validate/*` contract to the self-hosted
+unified vlm-parser-reranker engine (Qwen3.6-35B-A3B-FP8 on one RTX PRO 6000, served alias
+"reranker" — the same
+engine also serves query parsing under the alias "parser"). The engine is used
+as a relevance scorer via the first-token logprob trick: it reads the verdict
+distribution from one forward pass (enable_thinking=false; Qwen thinks by
+default, so a missed flag silently corrupts verdicts), ~20x faster than
+generating a verdict. We return the SAME shape and scale as usdsearch's own
+validator (llm_client's log-prob method), minus the `reasoning` the UI no
+longer shows:
+
+    {"is_match": bool, "confidence": float, "similarity_score": float, "model": str}
+
+ONE verdict method on every route, the Qwen Yes/No log-prob verdict: a Yes/No
+prompt (JUDGE_PROMPT for text queries, JUDGE_IMAGE_PROMPT for an image alone,
+JUDGE_IMAGE_TEXT_PROMPT for an image with words), P(Yes) read from the
+first-token log-probs (position scan, Yes/No mass renormalized), is_match =
+P(Yes) > 0.5, confidence = P(Yes) in [0,1] and similarity_score = P(Yes) x 100
+in [0,100] — usdsearch's scale, so the Explorer reads every validator's score
+the same way (2026-10-06: the shim sent P(Yes) in [0,1] until then, and the
+Explorer's per-value guess showed a usdsearch reject at P(Yes) 0.0076 as 76 %).
+With JUDGE_ASSET_CONTEXT on (2026-10-07), a words-only check also reads the
+candidate's file path and the index's caption, between the query and the
+question (_select_prompt); image checks never do.
+is_match coincides with the 50 % badge boundary the Explorer hardcodes (a
+false is_match renders the orange "VLM rejected, likely false positive" chip,
+and searchOutcome.js's WEAK state means "no hit at or above 50%"). This is the
+verdict the 2026-09-14/15 evaluations measured
+(docs/decisions/2026-09-search-quality.md). The graded 0/1/2 method and the
+Gemma-4 engine it targeted were evaluated on 2026-09-15 and rejected (user
+decision).
+
+Validator-contract semantics (the authoritative engine + client contracts
+live in INTEGRATION.md of https://gitlab-master.nvidia.com/omniverse/deeptag/parser-reranker):
+- ABSTAIN (Yes/No probability mass below threshold at every position) → retry
+  the call once; a persistent abstain is returned as is_match=true with
+  abstain=true and confidence 0.0 — the candidate KEEPS its retrieval-order
+  place, unscored. An abstain must never be treated as "No": rejecting on an
+  unreliable read silently deletes good results.
+- Transient failure (connect error / engine 5xx) → back off and retry once,
+  then fail-soft: 503/502, which the Explorer reads as "VLM unavailable": it
+  shows the VLM-unavailable banner and stops validating (verdicts already
+  collected keep their badges), leaving search intact. Scores are never
+  fabricated.
+
+Throughput: the serving owner's operational contract caps validation fan-out
+at 24 in-flight requests (engine-side 42.9 verdicts/s at that fan-out,
+measured on the earlier L40S engine; end-to-end the shim sustains less because it also fetches the
+thumbnails; more in-flight degrades p95 and adds nothing — the engine also
+serves query parsing), so this shim is tuned
+client-side:
+- ONE pooled keep-alive HTTP client (lifespan-managed) — no per-call TCP
+  handshake tax (~an RTT each on ~100 calls per search);
+- images reach the engine at most VALIDATE_MAX_EDGE (448) px on the longest
+  edge (2026-10-07): Isaac 6.2 stores every SimReady thumbnail at 1024x1024,
+  1,078 prompt tokens per verdict at that size against 250 at 448 (robots stay
+  256/512 px; anything at or under the cap passes through untouched). A JPEG
+  decodes at a reduced DCT scale first (draft), so the resize costs ~3 ms of
+  CPU per 1024-px image. Measured in docs/decisions/2026-09-search-quality.md:
+  65 vs 38 verdicts/s at saturation, 97 % of Yes/No verdicts unchanged;
+- an asyncio.Semaphore caps in-flight reranker calls at the contract's
+  fan-out ceiling, converting bursts into queueing at the sweet spot;
+- max_tokens 2: Qwen3.6 emits the verdict at position 0 (no wrapper tokens —
+  verified by probe); the position SCAN below is kept anyway, per the
+  integration contract, so a future wrapper-emitting model still extracts.
+
+Environment:
+    RERANKER_BASE_URL         OpenAI-compatible engine base URL
+                              (default http://simready-central-prod-cluster.nvidia.com/vlm-parser-reranker/v1)
+    RERANKER_MODEL            served model name (default "reranker")
+    RERANKER_API_KEY          bearer key for an engine that wants one (default
+                              none: the cluster engine is open). Sent on the
+                              engine's chat calls only, never on an image fetch.
+    RERANKER_NAME             display name in responses (default "Qwen3.6-35B-A3B-FP8";
+                              the `model` field in every verdict)
+    RERANKER_COVER_MIN        Yes/No verdict-token mass below this → abstain
+                              (default 0.2).
+    RERANKER_TIMEOUT_S        per-call timeout (default 30, per the serving
+                              contract; a 50-hit page drained in ≈1.2 s, 1.46 s p95, on the earlier L40S)
+    RERANKER_MAX_TOKENS       decode steps per call (default 2; raise if a
+                              future model buries the verdict deeper)
+    RERANKER_MAX_CONCURRENCY  in-flight cap toward the engine (default 48 for
+                              the RTX PRO 6000 engine with async scheduling and
+                              two API servers: 3 clients x c48 = 120.9 verdicts/s
+                              at p95 1.41 s; 24 was the L40-class ceiling)
+    VALIDATE_MAX_EDGE         downscale images whose longest edge exceeds this
+                              many pixels before sending (default 448 since
+                              2026-10-07; 4096 = no resize from 2026-09-21,
+                              512 before 2026-09-15). The verdict cache key
+                              includes it: changing it starts the shim's cache
+                              cold.
+    RERANKER_BATCH_CONCURRENCY  per-batch fan-out cap INSIDE the global
+                              semaphore (default 24) — two users' concurrent
+                              batches interleave at the engine instead of one
+                              queueing whole behind the other.
+    SHIM_GATEWAY_BASE_URL     the gateway's public listener, for shim-side
+                              thumbnail fetches (default http://gateway:8080).
+    IMAGES_TIMEOUT_S          per-thumbnail fetch timeout on the dedicated
+                              image client (default 5; slow thumbnails must
+                              not starve the engine connection pool).
+    BATCH_MAX_ITEMS           batch size ceiling (default 200; larger → 413).
+    BATCH_HEARTBEAT_S         blank-line heartbeat cadence on an otherwise
+                              quiet stream. COUPLED CONSTANT — the gateway's
+                              batch_stream proxy_read_timeout (60 s, hard-
+                              coded) and the Explorer's stream stall guard
+                              (45 s) are both sized off the default 10:
+                              raising it past ~40 trips the client guard,
+                              past 60 the gateway severs healthy streams.
+    VALIDATE_CACHE_SIZE       verdict-cache entries (default 4000000, ~0.9 GB
+                              at 240 bytes an entry; two entries per verdict;
+                              0 disables; 20000 until 2026-10-07).
+                              Verdicts are deterministic (temperature 0), so one
+                              (model, max-edge, query, image-bytes) tuple always
+                              scores the same — caching makes repeat waves
+                              (re-searches, pagination bounces, other USERS
+                              asking the same query) free. Complements the
+                              Explorer's per-browser verdict cache: this one is
+                              shared across every client of this shim. Keyed on
+                              the prompt too (a different query never
+                              coalesces).
+
+Tests (tests/test_scoring.py: the scorer, the payload builder, the verdict
+contract and the cache keys as pure functions; tests/test_routes.py: both
+routes through fastapi.testclient with the engine call and the image fetch
+monkeypatched, i.e. the prompt selection, the two cache paths, the NDJSON line
+protocol and the per-item vs fatal error split; no engine, no network), from
+the repo root:
+
+    cd deeptag-validate && pip install -r requirements-dev.txt && python -m pytest -q
+    # or, with no install step:
+    uv run --with pytest --with fastapi --with httpx --with pillow pytest deeptag-validate/tests
+
+CI runs the first form as the `test-deeptag-validate` job, which gates
+`build-deeptag-validate` exactly like the simready-api suite gates its image.
+"""
+import asyncio
+import base64
+import hashlib
+import io
+import json
+import logging
+import math
+import os
+import re
+from collections import OrderedDict
+from contextlib import asynccontextmanager
+from typing import List, Optional
+
+import httpx
+from fastapi import FastAPI, HTTPException
+from fastapi.responses import StreamingResponse
+from PIL import Image
+from pydantic import BaseModel
+
+logger = logging.getLogger("deeptag-validate")
+
+# The unified vlm-parser-reranker engine's "reranker" alias, OpenAI-compatible. Defaults to
+# the cluster engine's ingress; override per deployment. It does not gate on an API key.
+RERANKER_BASE_URL = os.environ.get("RERANKER_BASE_URL", "http://simready-central-prod-cluster.nvidia.com/vlm-parser-reranker/v1").rstrip("/")
+RERANKER_MODEL = os.environ.get("RERANKER_MODEL", "reranker")
+# A hosted engine (the HF Spaces' NVCF function / Inference Endpoint) wants a bearer key. It rides the
+# engine's POSTs alone: the same pooled client also fetches http image URLs a request names, and a
+# default header there would hand the key to any origin.
+RERANKER_API_KEY = os.environ.get("RERANKER_API_KEY", "").strip()
+_ENGINE_HEADERS = {"Authorization": f"Bearer {RERANKER_API_KEY}"} if RERANKER_API_KEY else None
+RERANKER_NAME = os.environ.get("RERANKER_NAME", "Qwen3.6-35B-A3B-FP8")
+
+# Yes/No verdict-token probability mass below this is unreliable → abstain
+# (treat as unscored, never as "No").
+COVER_MIN = float(os.environ.get("RERANKER_COVER_MIN", "0.2"))
+TIMEOUT_S = float(os.environ.get("RERANKER_TIMEOUT_S", "30"))
+# Qwen3.6 emits the verdict at position 0; one spare decode step is plenty and
+# more only burns shared engine compute (it also serves query parsing).
+RERANKER_MAX_TOKENS = int(os.environ.get("RERANKER_MAX_TOKENS", "2"))
+# The serving contract's fan-out ceiling: past 24 in-flight, p95 degrades and
+# throughput gains nothing.
+RERANKER_MAX_CONCURRENCY = int(os.environ.get("RERANKER_MAX_CONCURRENCY", "48"))
+# Vision-token cost scales with pixels; 448 px (longest edge) is the one view
+# the production Yes/No verdict was measured at — the same edge the server-side
+# verdict stage judges (docs/operations.md "Measured quality and the ordering
+# rule"). The cache key carries the edge, so changing it never re-serves a
+# verdict judged at another size.
+VALIDATE_MAX_EDGE = int(os.environ.get("VALIDATE_MAX_EDGE", "448"))
+
+# The asset's own facts in the words-only judge prompt (2026-10-07): "off" (the
+# 2026-09 prompt), "path" (the candidate's file path) or "path+caption" (+ the
+# index's one-line description). The client sends each hit's `path` and
+# `caption`; a hit without a path is judged without facts, and image queries
+# never use them (only words-only judging was evaluated). Measured in
+# docs/decisions/2026-09-search-quality.md.
+ASSET_CONTEXT_MODES = ("off", "path", "path+caption")
+JUDGE_ASSET_CONTEXT = os.environ.get("JUDGE_ASSET_CONTEXT", "off").strip().lower()
+if JUDGE_ASSET_CONTEXT not in ASSET_CONTEXT_MODES:
+    logger.warning(
+        "JUDGE_ASSET_CONTEXT=%r is not one of %s: judging without asset facts",
+        JUDGE_ASSET_CONTEXT, ", ".join(ASSET_CONTEXT_MODES),
+    )
+    JUDGE_ASSET_CONTEXT = "off"
+# Prompt-length bounds for the facts: a path keeps its tail (the file and its
+# folders name the asset), a caption its head.
+ASSET_PATH_MAX = 300
+ASSET_CAPTION_MAX = 200
+
+# Streamed batch validation (task #27). The per-batch cap nests INSIDE the
+# global engine semaphore: a 50-item batch occupies at most this many of the
+# 24 engine slots at once, so concurrent users' batches interleave fairly.
+RERANKER_BATCH_CONCURRENCY = int(os.environ.get("RERANKER_BATCH_CONCURRENCY", "24"))
+# Shim-side thumbnail fetches go through the gateway's public listener — the
+# same /images route (and shared nginx cache) the browsers use, index-scoped
+# by the x-usdsearch-storage-backend header. NEVER a client-supplied URL: the
+# base is pinned here and references travel as urlencoded query params only.
+SHIM_GATEWAY_BASE_URL = os.environ.get("SHIM_GATEWAY_BASE_URL", "http://gateway:8080").rstrip("/")
+IMAGES_TIMEOUT_S = float(os.environ.get("IMAGES_TIMEOUT_S", "5"))
+BATCH_MAX_ITEMS = int(os.environ.get("BATCH_MAX_ITEMS", "200"))
+BATCH_HEARTBEAT_S = float(os.environ.get("BATCH_HEARTBEAT_S", "10"))
+
+# Cross-user verdict cache: temperature-0 verdicts are pure functions of
+# (model, resize edge, query, image bytes), so identical pairs — from ANY
+# client — re-serve without an engine call. Insertion-order eviction. An entry
+# costs ~240 bytes (measured on python:3.11), and each fresh verdict writes two
+# (its reference key and its content key), so 4,000,000 entries hold 2,000,000
+# verdicts in ~0.9 GB: about half a day at the capacity plan's Phase 1 load
+# (2026-10-07; 20000 before was ~30 s of traffic at 600 checks/s). In-process
+# only: every shim restart starts cold.
+VALIDATE_CACHE_SIZE = int(os.environ.get("VALIDATE_CACHE_SIZE", "4000000"))
+_verdict_cache: "OrderedDict[str, object]" = OrderedDict()
+
+
+def _cache_key(query: str, image_url: str, query_image_digest: str = "") -> str:
+    """Content-keyed verdict-cache entry: the prompt, the PREPARED candidate
+    image and, for an image query, the query image's digest (every image query
+    shares one prompt, so without it two different query images would
+    coalesce)."""
+    h = hashlib.sha256()
+    for part in (RERANKER_MODEL, str(VALIDATE_MAX_EDGE), query, image_url, query_image_digest or ""):
+        h.update(part.encode())
+        h.update(b"\x00")
+    return h.hexdigest()
+
+
+def _ref_key(prompt: str, query_image_digest: str, index: str, ref: str) -> str:
+    """Reference-keyed verdict-cache entry for the batch path: keyed on the
+    IMAGE REFERENCE (image_key/asset_url + index slug) instead of prepared
+    bytes, so a cache hit costs no thumbnail fetch at all. The content key
+    (`_cache_key`) is still written alongside on every fresh verdict, so the
+    two paths coalesce. The query image participates as a PRE-COMPUTED digest
+    (image queries share one prompt and must not collide across different
+    reference images; hashing the multi-MB data URL per item would stall the
+    event loop; the route hashes it once)."""
+    h = hashlib.sha256()
+    for part in (RERANKER_MODEL, str(VALIDATE_MAX_EDGE), "ref", prompt, query_image_digest or "", index or "", ref):
+        h.update(part.encode())
+        h.update(b"\x00")
+    return h.hexdigest()
+
+
+def _cache_get(key: str):
+    p = _verdict_cache.get(key)
+    if p is not None:
+        _verdict_cache.move_to_end(key)
+    return p
+
+
+def _cache_put(key: str, score) -> None:
+    if VALIDATE_CACHE_SIZE <= 0:
+        return
+    _verdict_cache[key] = score
+    _verdict_cache.move_to_end(key)
+    while len(_verdict_cache) > VALIDATE_CACHE_SIZE:
+        _verdict_cache.popitem(last=False)
+
+# Firm, one-word judge prompt (a weak prompt makes GLM describe the image → the
+# logprob trick breaks). Text goes BEFORE the image in the message content.
+JUDGE_PROMPT_HEAD = 'You are a visual relevance judge for a 3D-asset search. Query: "{query}". '
+JUDGE_QUESTION = "Does the rendered asset match the query? Answer with exactly one word: Yes or No."
+JUDGE_PROMPT = JUDGE_PROMPT_HEAD + JUDGE_QUESTION
+# The asset facts (JUDGE_ASSET_CONTEXT), between the query and the question, as
+# evaluated on 2026-10-07.
+JUDGE_PATH_FACT = 'The candidate asset\'s file is "{path}". '
+JUDGE_CAPTION_FACT = 'Catalog description: "{caption}". '
+# An image alone (find-similar): usdsearch's own image-query question
+# (llm_client LOGPROB_JUDGE_PROMPT_IMAGE_QUERY without its caption clause),
+# word for word; the query image goes first. Without a dedicated prompt an
+# image search would be scored against 'Query: ""' — pure noise. On 40 known
+# pairs (2026-10-06) it matched the shim's earlier wording: every same-object
+# pair Yes, every unrelated pair No.
+JUDGE_IMAGE_PROMPT = (
+    "You are a visual relevance judge for a 3D-asset search. The first image is "
+    "the query image; the remaining images are rendered views of one asset. Does "
+    "the rendered asset match the query? Answer with exactly one word: Yes or No."
+)
+# An image WITH words: both count, the query image first. Not usdsearch's
+# caption clause ('… the query image and the text query is "…"; the remaining
+# images are rendered views of one asset'), which let the model judge the query
+# image itself against the words: on the same 40 pairs it passed 3-4 unrelated
+# candidates, this wording none (the words alone, the shim's earlier rule: 1).
+JUDGE_IMAGE_TEXT_PROMPT = (
+    'You are a visual relevance judge for a 3D-asset search. Query: "{query}", '
+    "together with the first image, which shows what the user is looking for. "
+    "The other image shows a candidate asset. Does the candidate asset match the "
+    "query? Answer with exactly one word: Yes or No."
+)
+YES_TOKENS = {"yes", "y", "true"}
+NO_TOKENS = {"no", "n", "false"}
+
+# One pooled keep-alive client for the process (created in lifespan): validation
+# is ~100 calls per search against a remote engine, and a per-request client
+# pays a fresh TCP handshake (an RTT) on every call.
+_reranker_client: Optional[httpx.AsyncClient] = None
+# Separate, short-timeout client for shim-side thumbnail fetches (batch path):
+# 50 image GETs must never compete with engine calls for the reranker pool,
+# and one slow origin must cost 5 s, not the engine's 30.
+_images_client: Optional[httpx.AsyncClient] = None
+# In-flight cap at the engine's measured saturation point — a burst beyond it
+# queues here instead of doubling everyone's latency engine-side.
+_reranker_sem = asyncio.Semaphore(RERANKER_MAX_CONCURRENCY)
+
+
+@asynccontextmanager
+async def _lifespan(app: FastAPI):
+    global _reranker_client, _images_client
+    _reranker_client = httpx.AsyncClient(
+        timeout=TIMEOUT_S,
+        limits=httpx.Limits(max_connections=64, max_keepalive_connections=64),
+    )
+    _images_client = httpx.AsyncClient(
+        # pool=None: waiting for a connection SLOT must queue, not error — a
+        # scalar timeout also bounds pool acquisition, and N concurrent
+        # batches × 12 workers over a finite pool would otherwise fabricate
+        # PoolTimeout "image fetch failed" verdicts for perfectly good
+        # thumbnails under load.
+        timeout=httpx.Timeout(connect=IMAGES_TIMEOUT_S, read=IMAGES_TIMEOUT_S, write=IMAGES_TIMEOUT_S, pool=None),
+        limits=httpx.Limits(max_connections=64, max_keepalive_connections=64),
+    )
+    try:
+        yield
+    finally:
+        await _reranker_client.aclose()
+        _reranker_client = None
+        await _images_client.aclose()
+        _images_client = None
+
+
+app = FastAPI(title="deeptag-validate", version="1.1.0", lifespan=_lifespan)
+
+
+class ValidateRequest(BaseModel):
+    query_text: Optional[str] = None
+    query_image: Optional[str] = None
+    images: List[str] = []
+    # The asset's facts for words-only judging (JUDGE_ASSET_CONTEXT).
+    path: Optional[str] = None
+    caption: Optional[str] = None
+
+
+def p_yes_from_logprobs(content):
+    """Scan token positions for the one carrying Yes/No mass (scan-mode is the
+    contract: robust to wrapper tokens some models emit before the verdict);
+    return (p_yes, cover) or (None, 0) if uncertain."""
+    for pos in content or []:
+        yes = no = 0.0
+        for entry in pos.get("top_logprobs", []) or []:
+            token = (entry.get("token") or "").strip().lower()
+            prob = math.exp(entry["logprob"])
+            if token in YES_TOKENS:
+                yes += prob
+            elif token in NO_TOKENS:
+                no += prob
+        if yes + no > COVER_MIN:
+            return yes / (yes + no), yes + no
+    return None, 0.0
+
+
+def _shrink_bytes(raw: bytes, src: str, was_data_url: bool) -> str:
+    """Sync (thread-pooled) half of image prep: decode, downscale if the longest
+    edge exceeds VALIDATE_MAX_EDGE (LANCZOS, JPEG q90), return a data URL. An
+    already-small data URL passes through UNTOUCHED; an already-small fetched
+    image is re-encoded as a data URL so the engine doesn't re-fetch it."""
+    with Image.open(io.BytesIO(raw)) as img:
+        w, h = img.size
+        if max(w, h) <= VALIDATE_MAX_EDGE:
+            logger.debug("image %dx%d <= %dpx: pass-through", w, h, VALIDATE_MAX_EDGE)
+            if was_data_url:
+                return src
+            fmt = (img.format or "png").lower()
+            mime = "image/jpeg" if fmt in ("jpg", "jpeg") else f"image/{fmt}"
+            return f"data:{mime};base64," + base64.b64encode(raw).decode()
+        # A JPEG decodes straight at a reduced DCT scale (1/2 for a 1024-px
+        # thumbnail; never below the cap): about half the shim CPU of a full
+        # decode before the resize. Other formats ignore it.
+        img.draft(None, (VALIDATE_MAX_EDGE, VALIDATE_MAX_EDGE))
+        rgb = img.convert("RGB")
+        rgb.thumbnail((VALIDATE_MAX_EDGE, VALIDATE_MAX_EDGE), Image.LANCZOS)
+        buf = io.BytesIO()
+        rgb.save(buf, format="JPEG", quality=90)
+        logger.debug(
+            "image resized %dx%d -> %dx%d (%d -> %d bytes)",
+            w, h, rgb.width, rgb.height, len(raw), buf.tell(),
+        )
+        return "data:image/jpeg;base64," + base64.b64encode(buf.getvalue()).decode()
+
+
+async def _prepare_image(src: str) -> str:
+    """Downscale-and-inline an image reference before it reaches the engine.
+    Defensive: anything unparseable is sent through untouched — a weird image
+    must degrade to the engine's own handling, never break validation."""
+    try:
+        if src.startswith("data:"):
+            _, _, b64 = src.partition(",")
+            raw = base64.b64decode(b64)
+            was_data_url = True
+        elif src.startswith(("http://", "https://")):
+            resp = await _reranker_client.get(src)
+            resp.raise_for_status()
+            raw = resp.content
+            was_data_url = False
+        else:
+            # Bare base64: the Explorer strips the data: prefix off its query
+            # image. Sent as is, the engine reads it as an image URL and 400s
+            # every image-only verdict; inline it as a data URL instead.
+            # Non-base64 strings still pass through (strict decode raises).
+            raw = base64.b64decode(src, validate=True)
+            was_data_url = False
+        return await asyncio.to_thread(_shrink_bytes, raw, src, was_data_url)
+    except Exception as exc:  # noqa: BLE001 — image prep must never break validation
+        logger.warning("image prep failed (%s: %s); sending original", type(exc).__name__, exc)
+        return src
+
+
+def _judge_payload(prompt: str, image_url: str, query_image_url: str = None) -> dict:
+    # Text before image(s) per the judge contract. For image queries the query
+    # image precedes the candidate (the image prompts' "first image" wording
+    # depends on this order). Plain sampling parameters only:
+    # no structured-outputs grammar (that belonged to the retired graded
+    # method), so an engine without a grammar backend serves this unchanged.
+    content = [{"type": "text", "text": prompt}]
+    if query_image_url:
+        content.append({"type": "image_url", "image_url": {"url": query_image_url}})
+    content.append({"type": "image_url", "image_url": {"url": image_url}})
+    return {
+        "model": RERANKER_MODEL,
+        "temperature": 0,
+        "max_tokens": RERANKER_MAX_TOKENS,
+        "logprobs": True,
+        "top_logprobs": 20,
+        "chat_template_kwargs": {"enable_thinking": False},
+        "messages": [{"role": "user", "content": content}],
+    }
+
+
+async def _call_reranker(payload: dict) -> dict:
+    # Transient-failure semantics from the validator contract: back off and
+    # retry ONCE on connect errors / engine 5xx before failing soft. The
+    # semaphore holds in-flight calls at the engine's saturation point.
+    for attempt in (1, 2):
+        try:
+            async with _reranker_sem:
+                resp = await _reranker_client.post(
+                    f"{RERANKER_BASE_URL}/chat/completions", json=payload, headers=_ENGINE_HEADERS
+                )
+            resp.raise_for_status()
+            return resp.json()
+        except (httpx.ConnectError, httpx.ConnectTimeout, httpx.ReadTimeout):
+            if attempt == 1:
+                await asyncio.sleep(0.25)
+                continue
+            # Engine down / slow → fail-soft. The Explorer reads 503 as
+            # "VLM unavailable": banner, validation stops; search is unaffected.
+            raise HTTPException(status_code=503, detail="reranker unavailable")
+        except httpx.HTTPStatusError as exc:
+            if attempt == 1 and exc.response.status_code >= 500:
+                await asyncio.sleep(0.25)
+                continue
+            raise EngineRejected(exc.response.status_code, f"reranker error: {exc}")
+        except httpx.HTTPError as exc:
+            raise HTTPException(status_code=502, detail=f"reranker error: {exc}")
+
+
+# The configuration refusal's message: fixed, never the engine's own error (it names the engine's URL).
+IMAGE_QUERY_REFUSED = "the validation engine refused an image query (it may take one image per prompt)"
+
+
+class EngineRejected(HTTPException):
+    """The engine ANSWERED with an error status (a 502 to the client, as before; the batch route keeps
+    treating it per item). `engine_status` lets the per-image route tell a refused request shape apart."""
+
+    def __init__(self, engine_status: int, detail: str):
+        super().__init__(status_code=502, detail=detail)
+        self.engine_status = engine_status
+
+
+def _abstain_verdict() -> dict:
+    # Persistent abstain → keep the candidate in retrieval order, unscored
+    # (is_match=true so the Explorer does not reject it; confidence 0.0 and
+    # abstain=true make the non-verdict explicit rather than a fabricated
+    # score).
+    return {"is_match": True, "confidence": 0.0, "similarity_score": 0.0, "abstain": True, "model": RERANKER_NAME}
+
+
+def _verdict_from_score(score: float) -> dict:
+    """The ONE place a verdict dict is built from a cached or fresh SCORE
+    RECORD (the P(Yes) float), for both routes and both cache paths — a
+    boundary that lived in three copies would silently regress on cache hits.
+    similarity_score is P(Yes) x 100 (usdsearch's scale); confidence stays
+    P(Yes)."""
+    return {
+        "is_match": score > 0.5,
+        "confidence": round(score, 4),
+        "similarity_score": round(score * 100, 2),
+        "model": RERANKER_NAME,
+    }
+
+
+def _extract_score(data: dict):
+    """Pull the P(Yes) score record out of one engine response, or None
+    (abstain)."""
+    content = ((data.get("choices") or [{}])[0].get("logprobs") or {}).get("content")
+    p_yes, _cover = p_yes_from_logprobs(content)
+    return p_yes
+
+
+def _fact_text(value, limit: int, keep_tail: bool = False) -> str:
+    """One asset fact as prompt text: whitespace collapsed, double quotes made
+    single (the fact sits inside a quoted span), at most `limit` characters."""
+    text = " ".join(str(value or "").split()).replace('"', "'")
+    if len(text) > limit:
+        text = text[-limit:] if keep_tail else text[:limit]
+    return text
+
+
+_ISAAC_ROOT = re.compile(r"/Isaac/[^/]+/Isaac/(.+)$")
+# A Hugging Face dataset file (the hf-* indexes, the HF Spaces): below the dataset, and below
+# `resolve|blob/<revision>/` where the key pins one, e.g.
+# hf://huggingface.co/datasets/nvidia/simready-assets/resolve/2464ca32…/fixture_island_a01/simready_usd/x.usd
+# → fixture_island_a01/simready_usd/x.usd.
+_HF_DATASET_ROOT = re.compile(
+    r"^(?:[a-z][a-z0-9+.-]*://)?huggingface\.co/datasets/[^/]+/[^/]+/(?:(?:resolve|blob)/[^/]+/)?(.+)$", re.I
+)
+
+
+def _asset_path(path) -> str:
+    """The path as the judge reads it: below the release-agnostic Isaac content
+    root (`Robots/Unitree/H2/H2.usda`, as evaluated), or below a Hugging Face
+    dataset's root, else without its leading slash."""
+    p = str(path or "").strip()
+    m = _ISAAC_ROOT.search(p) or _HF_DATASET_ROOT.match(p)
+    return _fact_text(m.group(1) if m else p.lstrip("/"), ASSET_PATH_MAX, keep_tail=True)
+
+
+def _asset_facts(path, caption) -> str:
+    """The words-only prompt's asset facts under JUDGE_ASSET_CONTEXT, or "":
+    the file path, then (path+caption) the caption. No path → no facts, so
+    only the evaluated combinations are ever sent."""
+    if JUDGE_ASSET_CONTEXT == "off":
+        return ""
+    p = _asset_path(path)
+    if not p:
+        return ""
+    facts = JUDGE_PATH_FACT.format(path=p)
+    caption_text = _fact_text(caption, ASSET_CAPTION_MAX) if JUDGE_ASSET_CONTEXT == "path+caption" else ""
+    if caption_text:
+        facts += JUDGE_CAPTION_FACT.format(caption=caption_text)
+    return facts
+
+
+def _select_prompt(query_text: str, has_query_image: bool, path=None, caption=None) -> str:
+    """The judge prompt for one candidate, over the stripped query text: an
+    image with words → JUDGE_IMAGE_TEXT_PROMPT, an image alone →
+    JUDGE_IMAGE_PROMPT, words alone → JUDGE_PROMPT, with the candidate's facts
+    before the question when JUDGE_ASSET_CONTEXT is on (a request with neither
+    words nor image keeps the historical 'Query: ""' prompt)."""
+    text = (query_text or "").strip()
+    if has_query_image:
+        return JUDGE_IMAGE_TEXT_PROMPT.format(query=text) if text else JUDGE_IMAGE_PROMPT
+    facts = _asset_facts(path, caption)
+    if not facts:
+        return JUDGE_PROMPT.format(query=text)
+    return JUDGE_PROMPT_HEAD.format(query=text) + facts + JUDGE_QUESTION
+
+
+def _query_image_digest(query_image: Optional[str]) -> str:
+    """Hash the (possibly multi-MB) query image ONCE per request — the cache
+    keys run per item, and per-item sha256 over a full data URL would stall
+    the loop."""
+    return hashlib.sha256(query_image.encode()).hexdigest() if query_image else ""
+
+
+async def _score_prepared(prompt: str, image_url: str, query_image_url: str = None):
+    """One verdict for a PREPARED (downscaled, inlined) image. Returns
+    (score | None, verdict_dict); score None means persistent abstain (the
+    dict already carries abstain=true; the CALLER decides caching, and
+    abstains are never cached). The score is the cache record (see
+    _verdict_from_score). Raises HTTPException 502/503 when the engine is
+    unreachable (fail-soft to the Explorer's "VLM unavailable")."""
+    data = await _call_reranker(_judge_payload(prompt, image_url, query_image_url))
+    score = _extract_score(data)
+    if score is None:
+        # Abstain semantics: retry once — never treat an unreliable read as "No".
+        data = await _call_reranker(_judge_payload(prompt, image_url, query_image_url))
+        score = _extract_score(data)
+    if score is None:
+        return None, _abstain_verdict()
+    return score, _verdict_from_score(score)
+
+
+@app.get("/health")
+def health():
+    return {"status": "ok", "reranker": RERANKER_BASE_URL, "model": RERANKER_MODEL, "asset_context": JUDGE_ASSET_CONTEXT}
+
+
+@app.post("/vlm_validate/search_result")
+async def validate(req: ValidateRequest):
+    if not req.images:
+        raise HTTPException(status_code=400, detail="no image provided")
+    # The same judge as the batch route: a query image (the Explorer sends it
+    # bare base64 when it finishes a cut batch stream here) goes to the engine
+    # first, under the image prompts.
+    prompt = _select_prompt(req.query_text, bool(req.query_image), req.path, req.caption)
+    query_image_url = await _prepare_image(req.query_image) if req.query_image else None
+    image_url = await _prepare_image(req.images[0])
+    # Serve deterministic repeats from the verdict cache — no engine call. The
+    # key hashes the PREPARED image (post-resize), so the same asset arriving
+    # as a data URL or a fetched http URL coalesces once prepared.
+    ckey = _cache_key(prompt, image_url, _query_image_digest(req.query_image))
+    cached = _cache_get(ckey) if VALIDATE_CACHE_SIZE > 0 else None
+    if cached is not None:
+        return {**_verdict_from_score(cached), "cached": True}
+    try:
+        score, verdict = await _score_prepared(prompt, image_url, query_image_url)
+    except EngineRejected as exc:
+        # An engine that takes one image per prompt (the dev HF Space's NVCF function) answers an image
+        # query (query image + candidate) with a 4xx. Nothing is down: answer usdsearch's configuration
+        # refusal, which the Space's Explorer reads as "this search goes unvalidated" instead of the
+        # VLM-unavailable banner. Central's Explorer reads any 503 as before.
+        if query_image_url and 400 <= exc.engine_status < 500 and exc.engine_status not in (408, 429):
+            raise HTTPException(
+                status_code=503,
+                detail={"error_type": "configuration", "retryable": False, "message": IMAGE_QUERY_REFUSED},
+            ) from exc
+        raise
+    if score is not None:
+        _cache_put(ckey, score)
+    return verdict
+
+
+class BatchItem(BaseModel):
+    id: str
+    image_key: Optional[str] = None
+    asset_url: Optional[str] = None
+    # The hit's source.path and the index's caption for it: facts for
+    # words-only judging (JUDGE_ASSET_CONTEXT).
+    path: Optional[str] = None
+    caption: Optional[str] = None
+
+
+class BatchValidateRequest(BaseModel):
+    query_text: Optional[str] = None
+    query_image: Optional[str] = None
+    # The index SLUG (x-usdsearch-storage-backend value) the shim forwards on
+    # its /images fetches — routing, api-key injection, and the shared image
+    # cache all key off it upstream. Empty → the gateway's default index.
+    index: Optional[str] = None
+    # In the client's DISPLAY (retrieval) order — dispatch preserves it, so
+    # the most-likely matches score first and the ranked flow fills top-down.
+    items: List[BatchItem] = []
+
+
+def _ndjson(obj) -> str:
+    return json.dumps(obj, separators=(",", ":")) + "\n"
+
+
+@app.post("/vlm_validate/batch_stream")
+async def validate_batch(req: BatchValidateRequest):
+    """Streamed batch validation (NDJSON). Line protocol:
+
+        {"id", "cached", "verdict": {is_match, confidence, similarity_score,
+                                     model[, abstain]}}   — one per scored hit
+        {"id", "error": "..."}          — per-hit failure (bad thumbnail etc.);
+                                          NEVER poisons the rest of the batch
+        ""                              — blank heartbeat every BATCH_HEARTBEAT_S
+        {"fatal": "..."}                — engine unreachable; treat as 502/503
+        {"done": {completed, errored, cached}}  — ALWAYS last on a clean finish;
+                                          its absence means the stream was cut
+                                          (the client re-POSTs the missing ids)
+
+    Shim-cache hits flush first (no engine, no image fetch — the reference-
+    keyed entries); misses dispatch in request order under the per-batch cap.
+    Client disconnect cancels every pending worker; `async with _reranker_sem`
+    releases on cancellation, so an abandoned query frees its engine slots."""
+    if not req.items:
+        raise HTTPException(status_code=400, detail="no items")
+    if len(req.items) > BATCH_MAX_ITEMS:
+        raise HTTPException(status_code=413, detail=f"batch exceeds {BATCH_MAX_ITEMS} items")
+    if not (req.query_text or req.query_image):
+        raise HTTPException(status_code=400, detail="no query")
+    index = (req.index or "").strip()
+    qimg_digest = _query_image_digest(req.query_image)
+    # An image query (alone or with words): the judge sees the query image
+    # first, then each candidate. Prepared (downscaled) once. With asset facts
+    # on, the prompt (and so every cache key) is per item.
+    def prompt_for(it: BatchItem) -> str:
+        return _select_prompt(req.query_text, bool(req.query_image), it.path, it.caption)
+
+    query_image_url = await _prepare_image(req.query_image) if req.query_image else None
+
+    # Phase 0 — reference-keyed cache pass: free verdicts, emitted first.
+    cached_lines = []  # (kind, line) — kind: "verdict" | "error"
+    misses = []
+    for it in req.items:
+        ref = it.image_key or it.asset_url
+        if not ref:
+            cached_lines.append(("error", _ndjson({"id": it.id, "error": "no image reference"})))
+            continue
+        cached = _cache_get(_ref_key(prompt_for(it), qimg_digest, index, ref)) if VALIDATE_CACHE_SIZE > 0 else None
+        if cached is not None:
+            cached_lines.append(
+                ("verdict", _ndjson({
+                    "id": it.id,
+                    "cached": True,
+                    "verdict": _verdict_from_score(cached),
+                }))
+            )
+        else:
+            misses.append(it)
+
+    queue: asyncio.Queue = asyncio.Queue()
+    batch_sem = asyncio.Semaphore(RERANKER_BATCH_CONCURRENCY)
+
+    async def worker(it: BatchItem):
+        async with batch_sem:
+            ref = it.image_key or it.asset_url
+            prompt = prompt_for(it)
+            # Pinned base + urlencoded params ONLY — a reference can never
+            # change the request target (no SSRF surface); image_key (a
+            # specific matched view) wins over asset_url, mirroring the
+            # Explorer's own /images precedence.
+            params = {"image_key": it.image_key} if it.image_key else {"asset_url": it.asset_url}
+            headers = {"x-usdsearch-storage-backend": index} if index else {}
+            try:
+                resp = await _images_client.get(f"{SHIM_GATEWAY_BASE_URL}/images", params=params, headers=headers)
+                resp.raise_for_status()
+                raw = resp.content
+            except Exception as exc:  # noqa: BLE001 — one bad thumbnail must not poison the batch
+                await queue.put(("error", _ndjson({"id": it.id, "error": f"image fetch failed: {type(exc).__name__}"})))
+                return
+            try:
+                # Raw bytes straight into the thread-pooled shrink: no base64
+                # round-trip on the loop, and the data URL's mime comes from
+                # PIL's own sniff (img.format), never the upstream's
+                # content-type header (S3-ish origins say octet-stream, which
+                # OpenAI-compatible engines 400 on).
+                image_url = await asyncio.to_thread(_shrink_bytes, raw, "", False)
+            except Exception as exc:  # noqa: BLE001 — undecodable bytes must not reach the engine
+                await queue.put(("error", _ndjson({"id": it.id, "error": f"image decode failed: {type(exc).__name__}"})))
+                return
+            try:
+                score, verdict = await _score_prepared(prompt, image_url, query_image_url)
+            except HTTPException as exc:
+                if exc.status_code == 503:
+                    # Engine UNREACHABLE — the whole batch is over.
+                    await queue.put(("fatal", _ndjson({"fatal": exc.detail})))
+                else:
+                    # Engine rejected THIS item (4xx→502: e.g. an image it
+                    # can't decode) — per-hit, never batch-fatal.
+                    await queue.put(("error", _ndjson({"id": it.id, "error": f"engine rejected item: {exc.detail}"})))
+                return
+            except Exception as exc:  # noqa: BLE001 — a dead worker with no line would
+                # strand `remaining` and heartbeat the stream FOREVER (the
+                # blank lines reset every downstream timeout). Anything
+                # unexpected (non-JSON 200 from a proxy, logprob shape drift)
+                # settles the hit as a per-hit error instead.
+                logger.warning("batch worker failed (%s: %s)", type(exc).__name__, exc)
+                await queue.put(("error", _ndjson({"id": it.id, "error": f"scoring failed: {type(exc).__name__}"})))
+                return
+            if score is not None:
+                _cache_put(_ref_key(prompt, qimg_digest, index, ref), score)
+                _cache_put(_cache_key(prompt, image_url, qimg_digest), score)
+            await queue.put(("verdict", _ndjson({"id": it.id, "cached": False, "verdict": verdict})))
+
+    async def stream():
+        completed = sum(1 for kind, _ in cached_lines if kind == "verdict")
+        errored = len(cached_lines) - completed
+        cached_count = completed
+        # Workers are created INSIDE the generator: a client that aborts
+        # before the body is ever iterated (POST → immediate abort) must not
+        # leak a batch onto the shared engine — a never-started generator
+        # never runs its finally, so task lifetime has to live in this frame.
+        # Dispatch in REQUEST order — the per-batch semaphore wakes FIFO, so
+        # completion approximates retrieval order and the flow's top fills
+        # first.
+        tasks = [asyncio.create_task(worker(it)) for it in misses]
+        try:
+            for _, ln in cached_lines:
+                yield ln
+            remaining = len(tasks)
+            while remaining > 0:
+                try:
+                    kind, ln = await asyncio.wait_for(queue.get(), timeout=BATCH_HEARTBEAT_S)
+                except asyncio.TimeoutError:
+                    yield "\n"  # heartbeat — keeps proxies from severing a quiet stream
+                    continue
+                yield ln
+                if kind == "fatal":
+                    return  # finally cancels the rest; no `done` line on a fatal
+                remaining -= 1
+                if kind == "error":
+                    errored += 1
+                else:
+                    completed += 1
+            yield _ndjson({"done": {"completed": completed, "errored": errored, "cached": cached_count}})
+        finally:
+            # Client gone, fatal, or clean finish — nothing may keep burning
+            # shared engine slots. Cancellation releases the semaphores.
+            for t in tasks:
+                t.cancel()
+
+    return StreamingResponse(stream(), media_type="application/x-ndjson")

docker/hf-space/nginx.conf.template

@@ -73,10 +73,11 @@ server {
         proxy_pass http://127.0.0.1:8000;
     }
 
+    # SimReady Central's validator (supervisord's deeptag-validate, 127.0.0.1:8020) answers here in
+    # place of deepsearch-api's: the same judge plus each hit's path and caption and a verdict cache.
     location /vlm_validate/search_result {
         if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
-        rewrite ^/vlm_validate/search_result(.*)$ /v3/deepsearch/vlm_validate/search_result$1 break;
-        proxy_pass http://127.0.0.1:8000;
+        proxy_pass http://127.0.0.1:8020;
     }
 
     location /llm_parse/ {

docker/hf-space/supervisord-gpu.conf

@@ -155,6 +155,24 @@ stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 
+[program:deeptag-validate]
+; SimReady Central's validator (docker/hf-space/deeptag-validate/app.py, vendored from
+; simready-central deeptag-validate/, !582) answers /vlm_validate/search_result in place of
+; deepsearch-api's: the same Yes/No log-prob judge on the same engine, plus each hit's path
+; and caption in words-only checks (JUDGE_ASSET_CONTEXT) and an in-memory verdict cache
+; (VALIDATE_CACHE_SIZE, ~120 MB at 500k entries). The engine settings are deepsearch-api's
+; USDSEARCH_* variables, read when the shell execs (an unset one never stops supervisord).
+command=/usr/bin/env -u PYTHONPATH /bin/sh -c 'RERANKER_BASE_URL="$USDSEARCH_LLM_BASE_URL" RERANKER_MODEL="$USDSEARCH_VISION_VALIDATION_MODEL" RERANKER_NAME="$USDSEARCH_VISION_VALIDATION_MODEL" RERANKER_API_KEY="$USDSEARCH_LLM_API_KEY" exec /app/.venv/bin/python -m uvicorn app:app --host 127.0.0.1 --port 8020 --log-level warning'
+environment=JUDGE_ASSET_CONTEXT="path+caption",VALIDATE_CACHE_SIZE="500000",VALIDATE_MAX_EDGE="448",RERANKER_MAX_CONCURRENCY="32",RERANKER_BATCH_CONCURRENCY="16",RERANKER_COVER_MIN="0.2"
+directory=/app/deeptag-validate
+user=1000
+autorestart=true
+startsecs=3
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
 [program:nginx]
 command=/bin/sh -c "until curl -sf http://localhost:8000/health >/dev/null 2>&1 && curl -sf http://localhost:8010/docs >/dev/null 2>&1; do sleep 2; done; dl=false; case '%(ENV_DOWNLOAD_ENABLED)s' in [Tt]rue|1) if [ -f /app/hf-space-pipeline/.build/restore/hf-storage-api-catalog.yaml ]; then dl=true; else echo 'nginx: no hf-storage-api catalog, rendering download:false' >&2; fi;; esac; sed -e 's/__PORT__/%(ENV_PORT)s/' -e 's|__CORPUS_NAME__|%(ENV_CORPUS_NAME)s|g' -e 's/__DOWNLOAD_ENABLED__/'$dl'/' -e 's|__SUBMIT_CONTENT_URL__|%(ENV_SUBMIT_CONTENT_URL)s|g' /etc/nginx/hf-space.conf.template > /etc/nginx/conf.d/hf-space.conf && exec nginx -g 'daemon off;'"
 user=root

docker/hf-space/supervisord.conf

@@ -159,6 +159,24 @@ stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 
+[program:deeptag-validate]
+; SimReady Central's validator (docker/hf-space/deeptag-validate/app.py, vendored from
+; simready-central deeptag-validate/, !582) answers /vlm_validate/search_result in place of
+; deepsearch-api's: the same Yes/No log-prob judge on the same engine, plus each hit's path
+; and caption in words-only checks (JUDGE_ASSET_CONTEXT) and an in-memory verdict cache
+; (VALIDATE_CACHE_SIZE, ~120 MB at 500k entries). The engine settings are deepsearch-api's
+; USDSEARCH_* variables, read when the shell execs (an unset one never stops supervisord).
+command=/usr/bin/env -u PYTHONPATH /bin/sh -c 'RERANKER_BASE_URL="$USDSEARCH_LLM_BASE_URL" RERANKER_MODEL="$USDSEARCH_VISION_VALIDATION_MODEL" RERANKER_NAME="$USDSEARCH_VISION_VALIDATION_MODEL" RERANKER_API_KEY="$USDSEARCH_LLM_API_KEY" exec /app/.venv/bin/python -m uvicorn app:app --host 127.0.0.1 --port 8020 --log-level warning'
+environment=JUDGE_ASSET_CONTEXT="path+caption",VALIDATE_CACHE_SIZE="500000",VALIDATE_MAX_EDGE="448",RERANKER_MAX_CONCURRENCY="32",RERANKER_BATCH_CONCURRENCY="16",RERANKER_COVER_MIN="0.2"
+directory=/app/deeptag-validate
+user=1000
+autorestart=true
+startsecs=3
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
 [program:nginx]
 ; nginx is the *only* process bound to the externally-proxied port, and
 ; Hugging Face's own Space "ready" detection is just "does something answer