diff --git a/papers/cosmo_val/config/config.yaml b/papers/cosmo_val/config/config.yaml index cbbe33cf..89425ff0 100644 --- a/papers/cosmo_val/config/config.yaml +++ b/papers/cosmo_val/config/config.yaml @@ -19,6 +19,11 @@ versions: [ # CosmologyValidation suite parameters (cosmo_val.py) # --------------------------------------------------------------------------- cosmo_val: + # Campaign run type: "data" or "mock". One switch: it gates Smokescreen + # blind-at-birth and is stamped as the SACC `type` of every part written + # (custody state at assembly — see blinding.assert_consistent_blind). + type: data + # CosmologyValidation constructor npatch: 100 theta_min: 1.0 diff --git a/scripts/blind_data_vector.py b/scripts/blind_data_vector.py new file mode 100644 index 00000000..e31cb5b3 --- /dev/null +++ b/scripts/blind_data_vector.py @@ -0,0 +1,146 @@ +#!/usr/bin/env python3 + +"""Script blind_data_vector.py + +CLI for :mod:`sp_validation.blinding`. ``blind-init`` fixes the blind for one +catalogue version; ``blind-part`` conceals one intermediate part SACC under it, +escrowing the true vector and deleting the plaintext; ``unblind`` verifies the +custody triple and restores a true part (or the assembled file); ``verify`` is +a cheap seedless check of a blinded file against a commitment. + +:Authors: Cail Daley + +Examples +-------- +Once per catalogue version:: + + blind_data_vector.py blind-init blinded/ + +Per intermediate part, at birth:: + + blind_data_vector.py blind-part parts/xi_integration.fits --blind-dir blinded/ + +Unblind one part:: + + blind_data_vector.py unblind parts/xi_integration_blinded.fits \\ + --blind-dir blinded/ -o parts/xi_integration.fits + +Verify:: + + blind_data_vector.py verify parts/xi_integration_blinded.fits \\ + blinded/commitment.json +""" + +import argparse +import json +import pathlib +import sys + +from sp_validation import blinding, sacc_io + + +def _config_from_args(args): + """A :class:`blinding.BlindingConfig` from optional CLI overrides.""" + overrides = {} + if args.s8_half_width is not None: + overrides["s8_half_width"] = args.s8_half_width + if args.omega_m_half_width is not None: + overrides["omega_m_half_width"] = args.omega_m_half_width + return blinding.BlindingConfig.from_overrides(overrides) + + +def _blind_init(args): + config = _config_from_args(args) + blind_dir = pathlib.Path(args.blind_dir) + blind_dir.mkdir(parents=True, exist_ok=True) + try: + blinding.blind_init(str(blind_dir), config=config, label=args.label) + except FileExistsError as exc: + raise SystemExit(f"{exc}\nPick a fresh blind dir (never overwrite a blind).") + print( + "Commit the commitment JSON to the repo; keep the bundle + key safe " + "and separated (colocation in the blind dir is not at-rest protection)." + ) + + +def _blind_part(args): + blinding.blind_part( + args.part, + args.blind_dir, + config=_config_from_args(args), + keep_input=args.keep_input, + ) + + +def _unblind(args): + blinding.unblind_part( + args.blinded, + args.blind_dir, + args.output, + config=_config_from_args(args), + ) + + +def _verify(args): + # allow_unblinded=True: reporting that a file is *not* concealed is one of + # the outcomes here, so the fail-closed loader must not pre-empt it. + s = sacc_io.load(args.blinded, allow_unblinded=True) + with open(args.commitment, encoding="utf-8") as f: + commitment = json.load(f) + problems = blinding.verify(s, commitment) + if problems: + raise SystemExit("verification FAILED:\n " + "\n ".join(problems)) + print( + f"OK: {args.blinded} matches {args.commitment} " + f"(blind {s.metadata.get('blind')!r})" + ) + + +def main(argv=None): + parser = argparse.ArgumentParser(description=__doc__.split("\n\n")[1]) + sub = parser.add_subparsers(dest="mode", required=True) + + for name in ("blind-init", "blind-part", "unblind"): + p = sub.add_parser(name) + p.add_argument("--s8-half-width", type=float, default=None) + p.add_argument("--omega-m-half-width", type=float, default=None) + if name == "blind-init": + p.add_argument( + "blind_dir", + help="directory for the blind's fixed state (commitment + " + "encrypted seed bundle)", + ) + p.add_argument("--label", default="A", help="blind label (default A)") + p.set_defaults(func=_blind_init) + elif name == "blind-part": + p.add_argument("part", help="intermediate part SACC file to blind") + p.add_argument( + "--blind-dir", required=True, help="blind-init state directory" + ) + p.add_argument( + "--keep-input", + action="store_true", + help="retain the plaintext input part (default: delete it " + "after blinding — the true vector is escrowed beside the " + "blinded output)", + ) + p.set_defaults(func=_blind_part) + else: + p.add_argument("blinded", help="blinded part (or assembled) SACC file") + p.add_argument( + "--blind-dir", required=True, help="blind-init state directory" + ) + p.add_argument("-o", "--output", required=True, help="output SACC path") + p.set_defaults(func=_unblind) + + p = sub.add_parser("verify") + p.add_argument("blinded", help="blinded SACC file") + p.add_argument("commitment", help="commitment JSON") + p.set_defaults(func=_verify) + + args = parser.parse_args(argv) + args.func(args) + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/src/sp_validation/blinding.py b/src/sp_validation/blinding.py new file mode 100644 index 00000000..90f93023 --- /dev/null +++ b/src/sp_validation/blinding.py @@ -0,0 +1,841 @@ +"""Blinding — conceal each intermediate data product behind a hidden cosmology. + +:Name: blinding.py + +:Description: Smokescreen blinding, per part, at birth. Each blindable + intermediate SACC product — reporting ξ±, integration ξ±, pseudo-Cℓ — is + shifted the moment the pipeline computes it by a difference of theory + vectors between the fiducial and a *hidden* cosmology drawn inside a fixed + amplitude envelope (Muir et al. 2019: ``d → d + t(hidden) − t(fiducial)``), + so S8 cannot be read off the data before the collaboration unblinds. Only + blinded parts persist on disk. + + The ``UNIONS-WL/Smokescreen`` fork draws the hidden cosmology and computes + the shift; blinding is a vector operation, so this module calls its vector + core (``smokescreen.concealing_factor``), which never sees a SACC. What is + sp_validation-specific is supplied here: the ``theory_fn`` backends + matching each part's row layout, and the SACC handling around the factors. + + Derived statistics are born blinded — COSEBIs and pure-E/B run downstream + on the already-blinded integration ξ±. Covariance and ρ/τ are never blinded: + blinding hides the vector, not the uncertainty, and the shift is pure + E-mode so B-mode null tests stay honest under the blind. + + **Custody: hash commitment, no keyholder.** A blind is reproduced by a + *triple* — seed, config digest, and Smokescreen ``DRAW_SCHEME`` (the seed + alone is not enough; see :func:`draw_scheme`). :func:`blind_init` fixes all + three per catalogue version, publishing the commitment triple as a + repo-committable ``commitment.json`` and encrypting the seed into a Fernet + bundle — the plaintext seed is never written. Every gate that draws or + subtracts a shift fails closed unless the triple matches + (:func:`_assert_draw_scheme`, :func:`assert_consistent_blind`, + :func:`unblind_sacc`), and there is no override. +""" + +import dataclasses +import functools +import hashlib +import json +import os +import secrets +import warnings + +import numpy as np + +from . import sacc_io +from .blinding_paths import init_paths, part_paths # noqa: F401 (re-exported) +from .blinding_theory import TheoryConfig, cl_ee, coerce_fields, xi_ccl, xi_ell_grid + + +# --------------------------------------------------------------------------- # +# Configuration surface — the blinding envelope +# --------------------------------------------------------------------------- # +@dataclasses.dataclass(frozen=True) +class BlindingConfig: + """Blinding envelope and fiducial. + + The hidden cosmology is drawn (by the fork) uniformly and independently + per key inside ``shifts_dict()``'s half-widths about the fiducial. The + half-widths are the deliberate, configurable size of the blind — config, + not code; the group may resize the envelope. ``theory`` carries the + fiducial :class:`TheoryConfig` whose defaults *are* the blinding + fiducial. + """ + + s8_half_width: float = 0.075 + omega_m_half_width: float = 0.1 + theory: TheoryConfig = dataclasses.field(default_factory=TheoryConfig) + + def shifts_dict(self): + """The (S8, Ωm) envelope as CCL-native ``{sigma8, Omega_c}`` half-widths. + + Evaluated at the fiducial: a ΔS8 half-width maps to + ``ΔS8/√(Ωm_fid/0.3)`` in σ8 (at fixed Ωm), and a ΔΩm half-width maps + one-to-one to Ω_c (Ω_b and Ω_ν fixed). Exact enough for a smear whose + target is a characteristic amplitude, not a precise posterior. + """ + return { + "sigma8": self.s8_half_width / np.sqrt(self.theory.Omega_m / 0.3), + "Omega_c": self.omega_m_half_width, + } + + def config_digest(self): + """sha256 of a canonical serialization of the full blinding config. + + Binds the envelope half-widths and the complete fiducial + :class:`TheoryConfig` into one digest, as JSON with sorted keys. + Fields go through :func:`~sp_validation.blinding_theory.coerce_fields`, + so the digest depends on the numeric value rather than on an + int-vs-float literal, and ``json`` emits floats by shortest round-trip + ``repr`` — two runs of one config give byte-identical digests. Checked + with the seed commitment at unblind. + """ + payload = coerce_fields( + type(self), + { + "s8_half_width": self.s8_half_width, + "omega_m_half_width": self.omega_m_half_width, + }, + ) + payload["theory"] = coerce_fields( + TheoryConfig, + { + f.name: getattr(self.theory, f.name) + for f in dataclasses.fields(self.theory) + }, + ) + return hashlib.sha256( + json.dumps(payload, sort_keys=True).encode("utf-8") + ).hexdigest() + + @classmethod + def from_overrides(cls, overrides): + """Build from a mapping of field overrides (fail loud on unknown keys). + + ``theory`` may be given as a :class:`TheoryConfig` or a mapping of + TheoryConfig overrides, mirroring :meth:`TheoryConfig.from_overrides`. + """ + overrides = coerce_fields(cls, overrides) + theory = overrides.get("theory") + if theory is not None and not isinstance(theory, TheoryConfig): + overrides["theory"] = TheoryConfig.from_overrides(dict(theory)) + return cls(**overrides) + + +# --------------------------------------------------------------------------- # +# Custody primitives +# --------------------------------------------------------------------------- # +def seed_commitment(seed): + """Public commitment for a seed: the fork's domain-separated sha256 digest. + + Domain-separated because the fork derives its RNG base seed from the bare + sha256 of the same string — an undomained commitment would publish it. + """ + from smokescreen import seed_commitment as _fork_seed_commitment + + return _fork_seed_commitment(seed) + + +def draw_scheme(): + """The installed Smokescreen fork's shift-draw semantics version. + + ``smokescreen.DRAW_SCHEME`` versions *how* a seed becomes parameter deltas + (scheme 1: upstream DESC's single global RNG over the sorted keys; scheme + 2: this fork's per-key RNG from ``(seed, key)``). Two installs agreeing on + ``(seed, config)`` but not on this number draw different hidden cosmologies. + + This is the one blinding failure with no loud symptom — a scheme mismatch + leaves a smooth residual cosmological shift in the "unblinded" vector, and + every hash, digest and escrow check still passes. Hence the scheme is + custody state, checked wherever a shift is drawn or subtracted. + """ + from smokescreen import DRAW_SCHEME + + return int(DRAW_SCHEME) + + +def _assert_draw_scheme(recorded, what): + """Fail closed unless ``recorded`` is the installed fork's draw scheme. + + ``what`` names the surface the scheme was read from, for the message. + A missing record (``None``) is a failure, not a pass: a blind whose scheme + is unknown cannot be shown to be reproducible by this install (see + :func:`draw_scheme`). + """ + installed = draw_scheme() + if recorded is None: + raise ValueError( + f"{what} carries no draw-scheme record — refusing to proceed. " + f"It predates draw-scheme binding, so there is no way to tell " + f"whether the installed Smokescreen (DRAW_SCHEME={installed}) " + f"reproduces the shift it was blinded with." + ) + if int(recorded) != installed: + raise ValueError( + f"{what} was drawn under Smokescreen DRAW_SCHEME={int(recorded)} " + f"but the installed fork implements DRAW_SCHEME={installed} — " + f"refusing to proceed. The same seed draws a different hidden " + f"cosmology under a different scheme, so this install would " + f"subtract the wrong shift and pass every other check. Install " + f"the Smokescreen the blind was made with." + ) + + +def hidden_params(seed, config): + """The hidden CCL parameter point the fork realizes for ``(seed, config)``. + + Re-runs the fork's draw and overlays the deltas on the fiducial, as + ``concealing_factor`` does internally. Introspection only (what *was* the + hidden cosmology, once revealed) — the blinding path never calls it, so it + does not gate on the draw scheme; every gate that acts on a shift does. + """ + from smokescreen.param_shifts import draw_param_shifts + + deltas = draw_param_shifts(config.shifts_dict(), seed) + params = dict(config.theory.ccl_params()) + for key, delta in deltas.items(): + params[key] += delta + return params + + +# --------------------------------------------------------------------------- # +# Block discovery on a SACC (a standalone part, or the assembled file) +# --------------------------------------------------------------------------- # +def source_bins(s): + """Sorted source-bin indices present in ``s`` (from ``source_i`` tracers).""" + return sorted( + int(name.split("_", 1)[1]) for name in s.tracers if name.startswith("source_") + ) + + +def _pairs(s, data_type, **tags): + """Unordered source-bin pairs ``(i ≤ j)`` carrying ``data_type`` in ``s``.""" + bins = source_bins(s) + return [ + (i, j) + for a, i in enumerate(bins) + for j in bins[a:] + if len(s.indices(data_type, sacc_io._pair((i, j)), **tags)) + ] + + +def xi_pairs(s, grid): + """Unordered source-bin pairs ``(i ≤ j)`` carrying ξ+ on ``grid``.""" + return _pairs(s, sacc_io.XI_PLUS, grid=grid) + + +def cl_pairs(s): + """Source-bin pairs ``(i ≤ j)`` carrying pseudo-Cℓ_EE.""" + return _pairs(s, sacc_io.CL_EE) + + +def _xi_indices(s, grid): + """Row indices of the ξ± block on ``grid`` (ascending).""" + return np.sort( + np.concatenate( + [ + s.indices(sacc_io.XI_PLUS, grid=grid), + s.indices(sacc_io.XI_MINUS, grid=grid), + ] + ) + ).astype(int) + + +def _cl_ee_indices(s): + """Row indices of the pseudo-Cℓ_EE block (ascending). + + Only EE: a pure E-mode cosmology shift leaves BB and EB identically + zero, so those blocks are never extracted, never concealed. + """ + return np.sort(s.indices(sacc_io.CL_EE)).astype(int) + + +def _pair_nz(s, i, j): + """The two per-bin n(z) for pair ``(i, j)`` as ``((z_i, n_i), (z_j, n_j))``.""" + z_i, n_i = sacc_io.get_nz(s, i) + z_j, n_j = sacc_io.get_nz(s, j) + return (np.asarray(z_i), np.asarray(n_i)), (np.asarray(z_j), np.asarray(n_j)) + + +# --------------------------------------------------------------------------- # +# The three theory backends — callables aligned to a sub-SACC block's rows +# --------------------------------------------------------------------------- # +def xi_theory_fn(block, theory, grid): + """``theory_fn`` for a ξ± sub-SACC block (reporting or integration grid). + + Reads each bin's n(z) from the block's own tracers and lays the output out + to match the block's SACC rows element-for-element: per pair, ξ± at that + pair's stored θ (the ``theta`` tag, arcmin), scattered to the rows + ``block.indices`` reports — never an assumed pairing. + """ + pairs = xi_pairs(block, grid) + layout = [] + for i, j in pairs: + tr = sacc_io._pair((i, j)) + idx_p = block.indices(sacc_io.XI_PLUS, tr, grid=grid) + idx_m = block.indices(sacc_io.XI_MINUS, tr, grid=grid) + theta = sacc_io._tag(block, sacc_io.XI_PLUS, tr, "theta", grid=grid) + layout.append(((i, j), idx_p, idx_m, np.asarray(theta, dtype=float))) + ell = xi_ell_grid() + + def theory_fn(params): + out = np.full(len(block.mean), np.nan) + for (i, j), idx_p, idx_m, theta in layout: + nz_i, nz_j = _pair_nz(block, i, j) + xip, xim = xi_ccl(params, theory, nz_i, nz_j, theta, ell) + out[idx_p] = xip + out[idx_m] = xim + return out + + return theory_fn + + +def cl_theory_fn(block, theory): + """``theory_fn`` for the pseudo-Cℓ_EE sub-SACC block. + + Per pair: theory Cℓ_EE on the stored ``BandpowerWindows`` support, binned + by the same window matrix the measurement used (``W @ Cℓ_EE``), scattered + to the block's own rows — so the shift lands in the measured bandpowers. + ΔBB = ΔEB ≡ 0 for a pure E-mode shift, hence EE-only rows. + """ + layout = [] + for i, j in cl_pairs(block): + tr = sacc_io._pair((i, j)) + idx = block.indices(sacc_io.CL_EE, tr) + window = block.get_bandpower_windows(idx) + layout.append( + ( + (i, j), + np.asarray(idx), + np.asarray(window.values, dtype=float), # (n_ell,) + np.asarray(window.weight, dtype=float), # (n_ell, n_bp) + ) + ) + + def theory_fn(params): + out = np.full(len(block.mean), np.nan) + for (i, j), idx, w_ell, w_mat in layout: + nz_i, nz_j = _pair_nz(block, i, j) + out[idx] = w_mat.T @ cl_ee(params, theory, nz_i, nz_j, w_ell) + return out + + return theory_fn + + +# --------------------------------------------------------------------------- # +# The concealing factor, per block +# --------------------------------------------------------------------------- # +def _blindable_blocks(s): + """The blindable blocks of a SACC as ``(name, indices, factory)``. + + Works identically on a standalone part (exactly one block) and on the + assembled file (integration rows selected by the ``grid`` tag). ``indices`` + are each block's recorded row indices (ascending); ``factory`` builds the + matching ``theory_fn``. Blocks absent from the file are not listed. + """ + blocks = [] + for grid in ("reporting", "integration"): + idx = _xi_indices(s, grid) + if len(idx): + blocks.append( + (f"{grid} ξ±", idx, functools.partial(xi_theory_fn, grid=grid)) + ) + idx = _cl_ee_indices(s) + if len(idx): + blocks.append(("pseudo-Cℓ_EE", idx, cl_theory_fn)) + return blocks + + +def _concealing_factor(s, indices, factory, config, seed): + """The fork-computed additive concealing factor for one block of ``s``. + + ``smokescreen.concealing_factor`` draws the hidden deltas from ``seed``, + evaluates the block's ``theory_fn`` at both cosmologies and differences + them. No data vector and no SACC reach the fork, and ``s`` is not modified. + Both :func:`blind_sacc` and :func:`unblind_sacc` come through here, so the + added and subtracted shifts cannot drift apart. + + A ``theory_fn`` fills only its own rows and leaves the rest NaN, so + slicing to ``indices`` drops the NaNs by construction and the finite check + proves the converse: that *all* of this block's rows were filled. A row + the block claims but the factory cannot cover (a pair with ξ− but no ξ+, + say) would otherwise be shifted by NaN, silently. + + Returns + ------- + np.ndarray + ``t(hidden) − t(fiducial)``, aligned to ``indices``. + """ + from smokescreen import concealing_factor + + full = np.asarray( + concealing_factor( + config.theory.ccl_params(), + config.shifts_dict(), + seed=seed, + theory_fn=factory(s, config.theory), + factor_type="add", + ), + dtype=float, + ) + factor = full[indices] + if not np.all(np.isfinite(factor)): + raise ValueError( + f"the theory backend left {int(np.sum(~np.isfinite(factor)))} of " + f"{len(indices)} blindable rows unfilled — refusing to apply the " + "concealing factor (these rows would be shifted by NaN). The " + "block's row layout is not fully covered by its theory_fn." + ) + return factor + + +def _set_values(s, indices, values): + """Overwrite ``s.data[i].value`` for ``indices`` with ``values`` (aligned).""" + for i, v in zip(indices, values): + s.data[int(i)].value = float(v) + + +def _concealed(s): + """Whether ``s`` is already a blinded file (its ``concealed`` mark is set).""" + return bool(s.metadata.get("concealed")) + + +def _apply_blocks(src, seed, config, sign, verb, log): + """Return a copy of ``src`` with each block's concealing factor applied. + + ``sign`` is ``+1`` to conceal and ``-1`` to reveal; the factor itself comes + from the one :func:`_concealing_factor` call both directions share. + """ + dst = src.copy() + for name, indices, factory in _blindable_blocks(src): + factor = _concealing_factor(src, indices, factory, config, seed) + _set_values(dst, indices, np.asarray(dst.mean)[indices] + sign * factor) + log(f"[{verb}] {name}: {len(indices)} points") + return dst + + +def blind_sacc(part, seed, config=None, label="smokescreen", log=print): + """Return a blinded copy of a part SACC (covariance and tags untouched). + + Adds each blindable block's concealing factor at the block's recorded + indices; only ``value`` changes, and only on blindable rows. Provenance is + stamped and any leaked seed key stripped. A file with no blindable block + (a ρ/τ diagnostic part, say) is refused loudly. + """ + config = config or BlindingConfig() + if _concealed(part): + raise ValueError("already concealed — unblind first") + if not _blindable_blocks(part): + raise ValueError( + "no blindable block (reporting/integration ξ± or pseudo-Cℓ_EE) in this SACC " + "— ρ/τ diagnostic parts are never blinded" + ) + + blinded = _apply_blocks(part, seed, config, +1, "blind", log) + _stamp_provenance(blinded, seed_commitment(seed), label, config.config_digest()) + return blinded + + +def unblind_sacc(blinded, seed, config=None, log=print): + """Recover the true part SACC from a blinded one + the revealed ``seed``. + + Verifies the custody triple — draw scheme, seed commitment, config digest — + against the file's stamps before subtracting anything, then recomputes each + block's shift the same way :func:`blind_sacc` added it. Works on a part or + on the assembled file. Derived statistics, if present, are *not* recomputed + here — the pipeline re-derives them from the unblinded integration ξ±. + """ + config = config or BlindingConfig() + if not _concealed(blinded): + raise ValueError("file is not concealed — nothing to unblind") + _assert_draw_scheme(blinded.metadata.get("blind_draw_scheme"), "this blinded file") + if seed_commitment(seed) != blinded.metadata["blind_commitment"]: + raise ValueError( + "seed does not match blind_commitment — refusing to unblind " + "(a wrong seed would silently produce a wrong data vector)" + ) + if config.config_digest() != blinded.metadata["blind_config_digest"]: + raise ValueError( + "blinding config does not match blind_config_digest — refusing to " + "unblind (this config would subtract a different shift than was " + "added)" + ) + + part = _apply_blocks(blinded, seed, config, -1, "unblind", log) + for key in ( + "concealed", + "blind", + "blind_commitment", + "blind_config_digest", + "blind_draw_scheme", + ): + part.metadata.pop(key, None) + return part + + +def _stamp_provenance(s, commitment, label, config_digest): + """Stamp the custody triple and the ``concealed``/``blind`` marks. + + Pops ``seed_smokescreen`` (which upstream Smokescreen's writer would + stamp): the seed never rides a kept file. The scheme stamped is the + installed fork's, which every caller has already checked the blind against. + """ + s.metadata.pop("seed_smokescreen", None) + s.metadata["concealed"] = True + s.metadata["blind"] = label + s.metadata["blind_commitment"] = commitment + s.metadata["blind_config_digest"] = config_digest + s.metadata["blind_draw_scheme"] = draw_scheme() + + +def stamp_concealed_passthrough(s, commitment_path): + """Stamp a part concealed under an existing blind, values untouched. + + The seam for parts already blind (COSEBIs / pure-E/B, re-derived from the + blinded integration ξ±) or blind-irrelevant (ρ/τ, no cosmological vector): + it shifts nothing and needs no blindable block, only the custody stamp that + lets the load gate and :func:`assert_consistent_blind` admit the part. The + stamp is read from the version's ``commitment.json``, so a pass-through + part carries the exact custody state of the blinded parts. The committed + scheme is checked first — stamping from an install that draws differently + would mint a custody claim it cannot honour. + """ + with open(commitment_path, encoding="utf-8") as f: + commitment = json.load(f) + _assert_draw_scheme( + commitment.get("draw_scheme"), f"the blind at {commitment_path}" + ) + _stamp_provenance( + s, + commitment["seed_commitment"], + commitment["label"], + commitment["config_digest"], + ) + return s + + +# --------------------------------------------------------------------------- # +# Assembly-time custody: one blind across all parts +# --------------------------------------------------------------------------- # +def assert_consistent_blind(parts): + """Assert every blindable part shares one blind; return the shared stamp. + + The assembly gate of :func:`sp_validation.sacc_io.gather`. A part is + *blindable* if it carries a blindable block (ξ± or pseudo-Cℓ_EE); ρ/τ and + covariance-only parts are exempt. Fails closed on a blinded/plaintext mix, + on parts whose custody triples disagree, or on a shared scheme this install + does not implement (it could not unblind what it is assembling). The + consistency key is the triple; the ``blind`` label is provenance, not + custody, so differing labels warn rather than fail. + + Unconcealed blindable parts must all be declared ``type == "mock"``: an + unconcealed ``type == "data"`` part, or one missing the tag, fails closed, + so skipping the blind can never silently expose real data. + + Returns + ------- + dict or None + The shared blind metadata (``concealed``, ``blind``, + ``blind_commitment``, ``blind_config_digest``, ``blind_draw_scheme``) + for the gather to stamp on the assembled file, or ``None`` when + nothing is blinded. + """ + blindable = [p for p in parts if _blindable_blocks(p)] + concealed = [p for p in blindable if _concealed(p)] + if not concealed: + # `.get` is deliberate here: a missing `type` tag must count as + # not-a-mock and fail closed, not KeyError with less context. + exposed = sorted( + {str(p.metadata.get("type", "")) for p in blindable} - {"mock"} + ) + if exposed: + raise ValueError( + f"unconcealed blindable parts with type {exposed} in assembly " + "— only parts declared `type: mock` may assemble without a " + "blind (an unconcealed data part exposes the real vector)" + ) + return None + if len(concealed) != len(blindable): + raise ValueError( + f"blinded and plaintext blindable parts mixed in one assembly " + f"({len(concealed)} of {len(blindable)} blinded) — refusing to " + "combine (a plaintext part beside blinded ones leaks the shift)" + ) + # `.get` on the scheme so a part predating scheme binding reads as None and + # fails at _assert_draw_scheme with its explanation, not with a KeyError. + stamps = { + ( + p.metadata["blind_commitment"], + p.metadata["blind_config_digest"], + p.metadata.get("blind_draw_scheme"), + ) + for p in concealed + } + if len(stamps) != 1: + raise ValueError( + "parts carry different blind commitments — they were blinded " + "under different seeds, configs or draw schemes and must never be " + "combined: " + + "; ".join(f"({c[:12]}…, {d[:12]}…, scheme {v})" for c, d, v in stamps) + ) + ((commitment, digest, scheme),) = stamps + _assert_draw_scheme(scheme, "the blind these parts share") + labels = sorted({p.metadata["blind"] for p in concealed}) + if len(labels) != 1: + warnings.warn( + f"blindable parts share one blind (commitment {commitment[:12]}…, " + f"config {digest[:12]}…) but carry different labels {labels} — " + "assembling anyway; the label is provenance, not custody state. " + f"Stamping the assembled file with label {labels[0]!r}." + ) + return { + "concealed": True, + "blind": labels[0], + "blind_commitment": commitment, + "blind_config_digest": digest, + "blind_draw_scheme": int(scheme), + } + + +# --------------------------------------------------------------------------- # +# File-level custody: blind-init / blind-part / unblind +# --------------------------------------------------------------------------- # +def verify(s, commitment): + """Problems found comparing a blinded SACC to a commitment, seedlessly. + + Returns a (possibly empty) list of human-readable strings. No seed is read, + so this cannot confirm the blind is *subtractable* — only that the file's + custody triple matches ``commitment`` (a parsed ``commitment.json``) and + that the recorded draw scheme is the one this install implements. That last + check is environment-dependent by design: a machine carrying a different + Smokescreen could not unblind the file, so it reports a problem. + """ + problems = [] + if not _concealed(s): + problems.append("file is not marked concealed") + if s.metadata.get("blind_commitment") != commitment["seed_commitment"]: + problems.append("blind_commitment does not match the committed seed commitment") + if s.metadata.get("blind_config_digest") != commitment["config_digest"]: + problems.append("blind_config_digest does not match the committed digest") + scheme = s.metadata.get("blind_draw_scheme") + if scheme != commitment.get("draw_scheme"): + problems.append( + f"blind_draw_scheme {scheme!r} does not match the committed " + f"draw_scheme {commitment.get('draw_scheme')!r}" + ) + try: + _assert_draw_scheme(scheme, "the blinded file") + except ValueError as exc: + problems.append(str(exc)) + if "seed_smokescreen" in s.metadata: + problems.append("PLAINTEXT SEED LEAKED into file metadata (seed_smokescreen)") + return problems + + +def blind_init(blind_dir, config=None, label="smokescreen", log=print): + """Fix the blind for one catalogue version: seed, commitment, seed bundle. + + Draws an OS-entropy seed (never written in plaintext, never returned), + writes the repo-committable ``commitment.json`` (the custody triple plus + the label), and encrypts the seed into a Fernet bundle. Every + :func:`blind_part` and :func:`unblind_part` call reads this fixed state. + + Custody caveat: the bundle and its Fernet key land in the *same* + ``blind_dir``, and anyone with both can decrypt the seed. Keep the key + out-of-band; colocation is convenience, not at-rest protection. + + Returns + ------- + dict + Paths written: ``commitment``, ``bundle``, ``key``. + """ + config = config or BlindingConfig() + paths = init_paths(blind_dir) + for path in paths.values(): + if os.path.exists(path): + raise FileExistsError( + f"refusing to overwrite existing blind state {path} — a blind " + "is a one-shot custody event; choose another directory" + ) + + seed = secrets.token_hex(16) + commitment = { + "label": label, + "seed_commitment": seed_commitment(seed), + "config_digest": config.config_digest(), + "draw_scheme": draw_scheme(), + } + with open(paths["commitment"], "w", encoding="utf-8") as f: + json.dump(commitment, f, indent=2, sort_keys=True) + _write_encrypted_json(paths["bundle"], {"label": label, "seed": seed}) + + log(f"[blind-init] commitment (repo-committable): {paths['commitment']}") + log(f"[blind-init] encrypted seed bundle + key: {paths['bundle']}, {paths['key']}") + log( + "[blind-init] custody: keep the bundle key out-of-band from the bundle " + "(colocation in the blind dir is not at-rest protection)" + ) + return paths + + +def _read_seed(blind_dir, config): + """Decrypt the seed bundle and verify it against the commitment. + + The whole custody triple is checked before the seed is handed to any + caller, whether it is about to blind or to unblind. + + Returns + ------- + tuple + ``(seed, commitment_dict)``. + """ + paths = init_paths(blind_dir) + bundle = _read_encrypted_json(paths["bundle"], paths["key"]) + with open(paths["commitment"], encoding="utf-8") as f: + commitment = json.load(f) + _assert_draw_scheme(commitment.get("draw_scheme"), f"the blind in {blind_dir}") + if seed_commitment(bundle["seed"]) != commitment["seed_commitment"]: + raise ValueError( + "bundle seed does not match the committed seed commitment — refusing " + "to proceed" + ) + if config.config_digest() != commitment["config_digest"]: + raise ValueError( + "blinding config does not match the committed config digest — " + "refusing to proceed (a wrong envelope or P(k) recipe would " + "silently produce a wrong shift)" + ) + return bundle["seed"], commitment + + +def blind_part(part_path, blind_dir, config=None, keep_input=False, log=print): + """Blind one intermediate part SACC at birth, under the fixed blind state. + + Reads the fixed state :func:`blind_init` wrote, conceals the part + (:func:`blind_sacc`), writes the blinded part beside the input with the + true vector escrowed into a per-part Fernet bundle, and deletes the + plaintext — only the blinded part persists. Each escrow is self-contained, + so corruption of one bundle loses one part, not all. ``keep_input=True`` + retains the plaintext part (and its custody implication). + + Returns + ------- + dict + Paths written: ``blinded``, ``escrow``, ``escrow_key``. + """ + config = config or BlindingConfig() + seed, commitment = _read_seed(blind_dir, config) + paths = part_paths(part_path) + for path in paths.values(): + if os.path.exists(path): + raise FileExistsError( + f"refusing to overwrite existing blind output {path} — a blind " + "is a one-shot custody event" + ) + + # The plaintext part is real, unblinded data — the blinding step is the one + # legitimate reader of the true vector, so it passes the load escape hatch. + part = sacc_io.load(part_path, allow_unblinded=True) + blinded = blind_sacc(part, seed, config=config, label=commitment["label"], log=log) + + _write_encrypted_json( + paths["escrow"], + { + "label": commitment["label"], + "seed_commitment": commitment["seed_commitment"], + "true_mean": np.asarray(part.mean, dtype=float).tolist(), + }, + ) + # The blinded file inherits the part's provenance (data vs mock); it also + # carries concealed=True (stamped by blind_sacc), so it loads without the + # escape hatch. + sacc_io.save(blinded, paths["blinded"], type=part.metadata["type"]) + if not keep_input: + os.remove(part_path) + log(f"[blind-part] deleted plaintext part {part_path}") + else: + log(f"[blind-part] plaintext part RETAINED at {part_path} (keep_input=True)") + log(f"[blind-part] wrote {paths['blinded']} (escrow beside it)") + return paths + + +def unblind_part(blinded_path, blind_dir, out_path, config=None, log=print): + """Unblind one blinded part (or the assembled file), verifying first. + + Verifies the custody triple against ``commitment.json`` and against the + file's own stamps, then subtracts the seed-recomputed shift + (:func:`unblind_sacc`). The seed-subtracted vector is the authority. + + A part's escrow bundle, when present beside the blinded file and only once + its stored ``seed_commitment`` is confirmed to be this blind's, plays two + subordinate roles: a tighter equality check (disagreement beyond ``1e-6`` + relative fails closed) and removal of the ~ulp residue float + add-then-subtract leaves, making the restore bit-for-bit. It is never the + source of correctness. The assembled file has no escrow and the + subtraction stands alone. + """ + config = config or BlindingConfig() + seed, commitment = _read_seed(blind_dir, config) + blinded = sacc_io.load(blinded_path) + part = unblind_sacc(blinded, seed, config=config, log=log) + + stem, ext = os.path.splitext(blinded_path) + unblinded_stem = os.path.join( + os.path.dirname(stem), os.path.basename(stem).replace("_blinded", "") + ) + escrow = part_paths(unblinded_stem + ext) + if os.path.exists(escrow["escrow"]): + bundle = _read_encrypted_json(escrow["escrow"], escrow["escrow_key"]) + if bundle.get("seed_commitment") != commitment["seed_commitment"]: + raise ValueError( + "escrow bundle beside the blinded file was written under a " + "different seed than the commitment — refusing to trust it " + "(the seed subtraction is authoritative; this escrow is not " + "bound to this blind)" + ) + true_mean = np.asarray(bundle["true_mean"], dtype=float) + recovered = np.asarray(part.mean, dtype=float) + residual = np.nanmax( + np.abs(recovered - true_mean) / (np.abs(true_mean) + 1e-30) + ) + if residual > 1e-6: + raise ValueError( + f"unblinded vector disagrees with the escrowed true vector " + f"(max rel {residual:.2e}) — wrong escrow for this part?" + ) + # Seed-bound escrow: clear the add-then-subtract ulp residue. + _set_values(part, range(len(true_mean)), true_mean) + log(f"[unblind] escrow verified (subtraction residual {residual:.2e})") + # unblind_sacc stripped the concealed/blind stamps, so this is the true + # revealed vector; it inherits the blinded file's provenance (data vs mock). + sacc_io.save(part, out_path, type=blinded.metadata["type"]) + log(f"[unblind] wrote {out_path}") + return out_path + + +def _write_encrypted_json(encrpt_path, payload): + """Encrypt ``payload`` (JSON) to ``encrpt_path`` + sibling ``.key``. + + Smokescreen's ``save_file`` mode names outputs from + ``basename.split('.')[0]``, which truncates our dotted catalogue-version + stems (``v1.4.6.3_…`` → ``v1.encrpt``) and collides across parts, so we + take the returned ``(ciphertext, key)`` and write them ourselves. + """ + from smokescreen.encryption import encrypt_file + + key_path = encrpt_path.replace(".encrpt", ".key") + plaintext = encrpt_path.replace(".encrpt", ".json") + with open(plaintext, "w", encoding="utf-8") as f: + json.dump(payload, f) + ciphertext, key = encrypt_file(plaintext, save_file=False, keep_original=False) + with open(encrpt_path, "wb") as f: + f.write(ciphertext) + with open(key_path, "wb") as f: + f.write(key) + + +def _read_encrypted_json(encrpt_path, key_path): + """Decrypt and parse a Fernet-encrypted JSON bundle.""" + from smokescreen.encryption import decrypt_file + + return json.loads(decrypt_file(encrpt_path, key_path).decode("utf-8")) diff --git a/src/sp_validation/blinding_paths.py b/src/sp_validation/blinding_paths.py new file mode 100644 index 00000000..42ddb415 --- /dev/null +++ b/src/sp_validation/blinding_paths.py @@ -0,0 +1,26 @@ +"""Blinding file-name conventions, with no dependencies. + +Separate from :mod:`sp_validation.blinding` so the Snakemake DAG build can +import the path layout without pulling in numpy, CCL and smokescreen. +""" + +import os + + +def init_paths(blind_dir): + """The fixed custody state ``blinding.blind_init`` writes in ``blind_dir``.""" + return { + "commitment": os.path.join(blind_dir, "commitment.json"), + "bundle": os.path.join(blind_dir, "blind_seed.encrpt"), + "key": os.path.join(blind_dir, "blind_seed.key"), + } + + +def part_paths(part_path): + """Blinded-output and escrow-bundle paths beside a part file.""" + stem, ext = os.path.splitext(str(part_path)) + return { + "blinded": f"{stem}_blinded{ext or '.fits'}", + "escrow": f"{stem}_escrow.encrpt", + "escrow_key": f"{stem}_escrow.key", + } diff --git a/src/sp_validation/blinding_theory.py b/src/sp_validation/blinding_theory.py new file mode 100644 index 00000000..de758aa9 --- /dev/null +++ b/src/sp_validation/blinding_theory.py @@ -0,0 +1,420 @@ +"""Blinding theory: fiducial configuration and the two ξ± theory paths. + +:Name: blinding_theory.py + +:Description: The blinding backend's theory surface — the fiducial + configuration (:class:`TheoryConfig`) and two independent routes to the + tomographic shear two-point prediction. + + The generic cosmology machinery here is destined for ``cs_util.cosmo`` + (cs_util#80). + + Two independent routes to the shear two-point prediction: + + - **CCL-native path** (:func:`xi_ccl`, :func:`cl_ee`): CCL builds the + nonlinear P(k) through its Boltzmann-CAMB HMCode2020 route + (``matter_power_spectrum='camb'`` + ``extra_parameters``) and projects + to Cℓ/ξ± via its own Limber (``angular_cl``) + FFTLog + (``correlation``). This is the recipe the blinding theory backends use. + - **Independent-CAMB path** (:func:`xi_camb`): a direct ``pycamb`` run + produces the HMCode2020 ``P(k, z)`` (σ8-matched via the closed-form + A_s rescale of :func:`camb_As_for_sigma8`), wrapped in a ``ccl.Pk2D`` + and projected through the same CCL Limber + FFTLog machinery. + + Because both paths route their nonlinear P(k) through CAMB's HMCode2020 + and both project through CCL, a common Limber+FFTLog bug cancels between + them: the CAMB↔CCL cross-check test built on these two paths validates + the **P(k) recipe** and the **σ8/A_s amplitude convention**, not the + projection machinery. + + This module imports only ``numpy`` at module level; CCL and CAMB are + imported inside the functions that need them, so importing + :class:`TheoryConfig` never drags in a theory backend. +""" + +import dataclasses + +import numpy as np + +# Fixed constants of the fiducial — load-bearing for the CAMB↔CCL amplitude +# match, so they are emitted explicitly to both stacks rather than left to +# either stack's default. Not user-facing TheoryConfig fields. +NEFF = 3.046 +T_CMB = 2.7255 + +# Matter-power redshift grid shared by `make_camb_params` and `xi_camb`, so the +# CAMB run and the Pk2D built from it sample the same redshifts. +PK_ZMAX = 3.0 +PK_NZ = 48 + + +def coerce_fields(cls, overrides): + """Validate ``overrides`` against ``cls``'s fields, coercing floats. + + Unknown keys raise. Every ``float``-declared field goes through + :func:`float`, so a YAML/CLI ``w0: -1`` (int) yields the same value — and + the same config digest — as the float default ``-1.0``. Digest stability + depends on this, so it is one helper rather than three copies. + """ + by_name = {f.name: f for f in dataclasses.fields(cls)} + unknown = set(overrides) - set(by_name) + if unknown: + raise ValueError( + f"unknown {cls.__name__} fields {sorted(unknown)}; " + f"valid fields are {sorted(by_name)}" + ) + return { + name: (float(v) if by_name[name].type in (float, "float") else v) + for name, v in overrides.items() + } + + +# --------------------------------------------------------------------------- # +# Configuration surface — the ONE place fiducial cosmology + model choices live +# --------------------------------------------------------------------------- # +@dataclasses.dataclass(frozen=True) +class TheoryConfig: + """Fiducial cosmology and model configuration for the theory paths. + + Every field is a deliberate, configurable choice. The defaults mirror the + ``cosmo_inference`` CosmoSIS fiducial (the ``SP_v1.4.6.3_A_cell`` pipeline + + ``values_ia.ini`` central values), so the CCL theory computed here and + the CAMB theory CosmoSIS computes agree to the level the CAMB↔CCL + cross-check test asserts. Adopting a different named group fiducial is a + change to these *values*, not to any code. + + Cosmology is parametrised by the blind axes ``S8`` and ``Omega_m`` and + converted to CCL's native ``sigma8``/``Omega_c`` by :meth:`sigma8` / + :meth:`omega_c`. + + One nonlinear recipe is named by two tokens (``ccl_halofit_version``, + ``camb_halofit_version``) because CCL and CAMB could name it differently; + each stack is fed its own so a rename cannot silently split the recipe. + """ + + # Cosmological parameters (blind axes S8, Omega_m + the rest). + S8: float = 0.80 # values_ia.ini S_8_input central + Omega_m: float = 0.30 + Omega_b: float = 0.0469 # ombh2=0.023 at h=0.7 -> 0.023/0.7^2 + h: float = 0.70 + n_s: float = 0.96 + m_nu: float = 0.06 # Σm_ν in eV, distributed under `mass_split` + w0: float = -1.0 + wa: float = 0.0 + + # Neutrino mass split: normal hierarchy (CosmoSIS `neutrino_hierarchy=normal`). + mass_split: str = "normal" + + # Boltzmann backend for the CCL path (#280). `boltzmann_camb` shares one + # power-spectrum path with the CosmoSIS+CAMB inference stack; any other + # backend falls back to CCL's own halofit (see `ccl_cosmology`), a + # deliberate cross-check tool rather than a production setting. + transfer_function: str = "boltzmann_camb" + + # CAMB HMCode2020 + baryonic feedback — see the class docstring. + ccl_halofit_version: str = "mead2020_feedback" + camb_halofit_version: str = "mead2020_feedback" + hmcode_logT_AGN: float = 7.5 # values_ia.ini logT_AGN central + + # Intrinsic alignments: NLA. The fiducial defaults IA OFF (ia_bias=0) — + # the blinding shift is a difference of two theory vectors at the same IA, + # so IA nearly cancels there, and IA-off keeps the CAMB↔CCL cross-check a + # clean test of the shear calculation. Set `ia_bias` nonzero (CosmoSIS + # central A=1.0) to include NLA. + ia_bias: float = 0.0 + ia_z_piv: float = 0.62 + ia_alphaz: float = 0.0 + + def sigma8(self): + """CCL ``sigma8`` implied by ``S8`` and ``Omega_m``. + + ``S8 ≡ σ8 √(Ωm / 0.3)`` — the standard weak-lensing definition — so + ``σ8 = S8 / √(Ωm / 0.3)``. At the fiducial (S8=0.80, Ωm=0.30), + σ8 = 0.80. + """ + return self.S8 / np.sqrt(self.Omega_m / 0.3) + + def omega_c(self): + """CCL cold-dark-matter density ``Omega_c = Omega_m − Omega_b − Ω_ν``. + + The neutrino density ``Ω_ν h² = Σm_ν / 93.14 eV`` is subtracted so + the *total* matter density is exactly ``Omega_m`` (CCL treats massive + neutrinos as a separate species, not part of ``Omega_c``). + """ + omega_nu = self.m_nu / (93.14 * self.h**2) + return self.Omega_m - self.Omega_b - omega_nu + + def ccl_params(self): + """The fiducial point as a plain CCL-native parameter mapping. + + Exactly the keys ``Omega_c, Omega_b, h, n_s, sigma8, m_nu, + mass_split, w0, wa, Neff, T_CMB`` and no others — no CCL default + rides along. ``Neff``/``T_CMB`` are the fixed module constants. This + mapping is what the Smokescreen fork receives as ``fiducial_params`` + and what every ``theory_fn`` receives back (possibly with + ``sigma8``/``Omega_c`` overlaid by the hidden draw). + """ + return { + "Omega_c": self.omega_c(), + "Omega_b": self.Omega_b, + "h": self.h, + "n_s": self.n_s, + "sigma8": self.sigma8(), + "m_nu": self.m_nu, + "mass_split": self.mass_split, + "w0": self.w0, + "wa": self.wa, + "Neff": NEFF, + "T_CMB": T_CMB, + } + + @classmethod + def from_overrides(cls, overrides): + """Build from a mapping of field overrides (fail loud on unknown keys).""" + return cls(**coerce_fields(cls, overrides)) + + +# --------------------------------------------------------------------------- # +# CCL-native path: cosmology construction, Cℓ_EE, ξ± +# --------------------------------------------------------------------------- # +# The two cosmologies of a blind (fiducial + hidden) are evaluated by three +# theory backends over multiple blocks; caching the ccl.Cosmology per parameter +# point avoids re-running the CAMB P(k) computation for every block. +_COSMO_CACHE = {} + + +def ccl_cosmology(params, config): + """A ``pyccl.Cosmology`` at ``params`` with ``config``'s nonlinear recipe. + + ``params`` is a plain CCL-native mapping (:meth:`TheoryConfig.ccl_params`, + possibly with keys overlaid by the hidden draw); ``config`` supplies the + non-sampled recipe tokens. Under ``boltzmann_camb`` the nonlinear P(k) + runs through CAMB's HMCode2020; any other backend has no CAMB run to hand + tokens to and takes CCL's own halofit. Cached per parameter point: CCL + memoises P(k) on the object, so the cache saves repeated Boltzmann runs. + """ + import pyccl as ccl + + key = ( + tuple(sorted(params.items())), + config.transfer_function, + config.ccl_halofit_version, + config.hmcode_logT_AGN, + ) + if key not in _COSMO_CACHE: + nonlinear = ( + { + "matter_power_spectrum": "camb", + "extra_parameters": { + "camb": { + "halofit_version": config.ccl_halofit_version, + "HMCode_logT_AGN": config.hmcode_logT_AGN, + } + }, + } + if config.transfer_function == "boltzmann_camb" + else {"matter_power_spectrum": "halofit"} + ) + _COSMO_CACHE[key] = ccl.Cosmology( + **params, + transfer_function=config.transfer_function, + **nonlinear, + ) + return _COSMO_CACHE[key] + + +def xi_ell_grid(): + """The ℓ grid the ξ± Hankel projection integrates over. + + Integers 2…49, then 200 log-spaced multipoles up to 6·10⁴ — dense enough + at low ℓ (where ξ± at large θ lives) and wide enough for the small-θ + tail. ``ccl.correlation`` interpolates C(ℓ) internally, so this fixes the + resolution of every ξ± this module produces. + """ + return np.unique( + np.concatenate([np.arange(2, 50), np.geomspace(50, 6e4, 200)]).astype(float) + ) + + +# Tracers are rebuilt for every pair of every block at both cosmologies of a +# blind, and each build runs CCL's lensing-kernel integral over the bin's n(z). +# Cached for the same reason as `_COSMO_CACHE`, and keyed on `id(cosmo)` +# because that cache pins every cosmology for the process lifetime, so an id +# can never be recycled onto a different object. +_TRACER_CACHE = {} + + +def _tracer(cosmo, z, nz, config): + """A ``WeakLensingTracer`` for one bin's n(z), NLA from ``config``. + + With the fiducial ``ia_bias = 0`` the tracer is built bare — no IA term. + A nonzero ``ia_bias`` enters as the NLA amplitude + ``A(z) = ia_bias · ((1+z)/(1+z_piv))^alphaz``. + """ + z = np.asarray(z) + nz = np.asarray(nz) + key = ( + id(cosmo), + z.tobytes(), + nz.tobytes(), + config.ia_bias, + config.ia_z_piv, + config.ia_alphaz, + ) + if key not in _TRACER_CACHE: + _TRACER_CACHE[key] = _build_tracer(cosmo, z, nz, config) + return _TRACER_CACHE[key] + + +def _build_tracer(cosmo, z, nz, config): + import pyccl as ccl + + if config.ia_bias == 0.0: + return ccl.WeakLensingTracer(cosmo, dndz=(z, nz)) + a_ia = config.ia_bias * ((1 + z) / (1 + config.ia_z_piv)) ** config.ia_alphaz + return ccl.WeakLensingTracer(cosmo, dndz=(z, nz), ia_bias=(z, a_ia), use_A_ia=True) + + +def cl_ee(params, config, nz_i, nz_j, ell): + """Cross Cℓ_EE at ``ell`` for the bin pair with n(z) ``nz_i``, ``nz_j``. + + Two-tracer: one :class:`~pyccl.WeakLensingTracer` per bin from that bin's + own ``(z, nz)``, then ``angular_cl(cosmo, tracer_i, tracer_j, ell)`` — + the cross-spectrum for i ≠ j, the auto-spectrum when the two n(z) are the + same bin. The shear ``angular_cl`` is the E-mode spectrum; B and EB are + zero in theory, which is why only Cℓ_EE ever receives a blinding shift. + """ + import pyccl as ccl + + cosmo = ccl_cosmology(params, config) + tracer_i = _tracer(cosmo, *nz_i, config) + tracer_j = _tracer(cosmo, *nz_j, config) + return ccl.angular_cl(cosmo, tracer_i, tracer_j, np.asarray(ell, dtype=float)) + + +def xi_ccl(params, config, nz_i, nz_j, theta_arcmin, ell=None): + """CCL-native ξ± at ``theta_arcmin`` for one bin pair (Path A). + + Cross Cℓ_EE on :func:`xi_ell_grid` (or ``ell``), then ``ccl.correlation`` + (FFTLog Hankel transform) at θ in degrees, ``type="GG+"`` / ``"GG-"``. + + Returns + ------- + (np.ndarray, np.ndarray) + ``(xip, xim)`` aligned to ``theta_arcmin``. + """ + import pyccl as ccl + + ell = xi_ell_grid() if ell is None else np.asarray(ell, dtype=float) + cosmo = ccl_cosmology(params, config) + cl = cl_ee(params, config, nz_i, nz_j, ell) + theta_deg = np.asarray(theta_arcmin) / 60.0 + xip = ccl.correlation(cosmo, ell=ell, C_ell=cl, theta=theta_deg, type="GG+") + xim = ccl.correlation(cosmo, ell=ell, C_ell=cl, theta=theta_deg, type="GG-") + return xip, xim + + +# --------------------------------------------------------------------------- # +# Independent-CAMB path: A_s reconciliation + P(k) → Pk2D → CCL projection +# --------------------------------------------------------------------------- # +def make_camb_params(config, As, *, nonlinear, zmax=PK_ZMAX, n_z=PK_NZ, kmax=20.0): + """A ``CAMBparams`` at ``config``'s background with amplitude ``As``. + + Every :class:`TheoryConfig` field CCL sees is fed to CAMB from the same + source — ``w0``/``wa`` via ``set_dark_energy``, ``Neff``/``T_CMB`` as the + module constants, ``m_nu``/``mass_split`` through ``set_cosmology`` — so + the independent path differs from the CCL path only in who computes P(k), + never in an unmatched background parameter. + """ + import camb + + p = camb.CAMBparams() + p.set_cosmology( + H0=config.h * 100, + ombh2=config.Omega_b * config.h**2, + omch2=config.omega_c() * config.h**2, + mnu=config.m_nu, + num_massive_neutrinos=1, + neutrino_hierarchy=config.mass_split, + nnu=NEFF, + TCMB=T_CMB, + ) + p.set_dark_energy(w=config.w0, wa=config.wa, dark_energy_model="ppf") + p.InitPower.set_params(As=As, ns=config.n_s) + p.set_matter_power(redshifts=list(np.linspace(0.0, zmax, n_z)), kmax=kmax) + if nonlinear: + p.NonLinear = camb.model.NonLinear_both + p.NonLinearModel.set_params( + halofit_version=config.camb_halofit_version, + HMCode_logT_AGN=config.hmcode_logT_AGN, + ) + else: + p.NonLinear = camb.model.NonLinear_none + return p + + +def camb_linear_sigma8(config, As, **kwargs): + """CAMB's linear σ8(z=0) at amplitude ``As``.""" + import camb + + results = camb.get_results(make_camb_params(config, As, nonlinear=False, **kwargs)) + return float(results.get_sigma8_0()) + + +def camb_As_for_sigma8(config, sigma8_target, As_seed=2.1e-9, **kwargs): + """The CAMB ``A_s`` whose linear σ8 equals ``sigma8_target``. + + Closed-form: linear σ8² ∝ A_s exactly, so one CAMB linear-σ8 evaluation + at ``As_seed`` and one rescale ``As_seed · (σ8_target/σ8_seed)²`` land on + the target — no iteration. This settles the convention subtlety that our + fiducial fixes σ8 for CCL but A_s for CAMB: a nominal ``A_s = 2.1e-9`` + leaves CAMB's σ8 ≈3% off target, enough to blow a ξ± comparison to + ~9–10%. + """ + sigma8_seed = camb_linear_sigma8(config, As_seed, **kwargs) + return As_seed * (sigma8_target / sigma8_seed) ** 2 + + +def xi_camb(config, nz, theta_arcmin, *, n_ell=300, ell_max=60000, kmax=20.0, n_k=400): + """Independent-CAMB ξ± for one bin (Path B): CAMB P(k) → Pk2D → CCL. + + A direct pycamb run produces the HMCode2020 nonlinear ``P(k, z)`` at a + σ8-matched ``A_s`` (:func:`camb_As_for_sigma8`), wrapped in a ``Pk2D`` and + projected by CCL's Limber + FFTLog with a bare tracer (IA off — this path + exists for the cross-check). ``hubble_units=False, k_hunit=False`` already + returns CCL's native units (k in 1/Mpc, P in Mpc³), so applying an + ``·h``/``/h³`` conversion here would double-count an h³ amplitude error. + + Returns + ------- + (np.ndarray, np.ndarray, float) + ``(xip, xim, As)`` — the σ8-matched amplitude is returned for + assertion by the cross-check test. + """ + import camb + import pyccl as ccl + + sigma8 = config.sigma8() + As = camb_As_for_sigma8(config, sigma8, kmax=kmax) + results = camb.get_results(make_camb_params(config, As, nonlinear=True, kmax=kmax)) + interp = results.get_matter_power_interpolator( + nonlinear=True, hubble_units=False, k_hunit=False + ) + k = np.geomspace(1e-4, kmax * config.h, n_k) # 1/Mpc + z = np.linspace(0.0, PK_ZMAX, PK_NZ) # the grid make_camb_params computed + pk = interp.P(z, k) # (n_z, n_k), Mpc^3 + a = 1.0 / (1.0 + z) + order = np.argsort(a) # Pk2D wants ascending scale factor + pk2d = ccl.Pk2D( + a_arr=a[order], lk_arr=np.log(k), pk_arr=np.log(pk[order]), is_logp=True + ) + + cosmo = ccl_cosmology(config.ccl_params(), config) + z_nz, nz_vals = nz + lens = ccl.WeakLensingTracer(cosmo, dndz=(np.asarray(z_nz), np.asarray(nz_vals))) + ells = np.unique(np.geomspace(2, ell_max, n_ell).astype(int)).astype(float) + cl = ccl.angular_cl(cosmo, lens, lens, ells, p_of_k_a=pk2d) + theta_deg = np.asarray(theta_arcmin) / 60.0 + xip = ccl.correlation(cosmo, ell=ells, C_ell=cl, theta=theta_deg, type="GG+") + xim = ccl.correlation(cosmo, ell=ells, C_ell=cl, theta=theta_deg, type="GG-") + return xip, xim, As diff --git a/src/sp_validation/cosmo_val/core.py b/src/sp_validation/cosmo_val/core.py index bff3581a..a6391baf 100644 --- a/src/sp_validation/cosmo_val/core.py +++ b/src/sp_validation/cosmo_val/core.py @@ -14,6 +14,7 @@ _get_pte_from_scale_cut, find_conservative_scale_cut_key, ) +from ..blinding_paths import init_paths from ..statistics import chi2_and_pte from ..version import __version__ from .catalog_characterization import CatalogCharacterizationMixin @@ -132,6 +133,16 @@ class CosmologyValidation( noise debiasing, making those realizations reproducible run-to-run. cosmo_params : dict, optional Cosmological parameters to pass to get_cosmo(). If None, uses Planck 2018. + run_type : {'data', 'mock'}, default 'data' + The campaign's run type, stamped as the SACC ``type`` of every part this + object writes. Custody state, not decoration: a mock campaign must be + built with ``run_type='mock'`` for its parts to assemble at all (see + ``blinding.assert_consistent_blind``). + blind_root : str, optional + Directory holding one ``blind_init`` state directory per catalogue + version. Given, the part writers stamp born-blinded and blind-irrelevant + parts under the version's blind (see :meth:`commitment_path`); ``None`` + (mock runs) leaves them plaintext. Attributes ---------- @@ -258,6 +269,8 @@ def __init__( path_onecovariance=None, cosmo_params=None, blind=None, + run_type="data", + blind_root=None, ): self.rho_tau_method = rho_tau_method self.cov_estimate_method = cov_estimate_method @@ -287,6 +300,8 @@ def __init__( self.nside_mask = nside_mask self.path_onecovariance = path_onecovariance self.blind = blind + self.run_type = run_type + self.blind_root = blind_root assert self.cell_method in ["map", "catalog"], ( "cell_method must be 'map' or 'catalog'" @@ -520,6 +535,17 @@ def results_objectwise(self): self._results_objectwise = self.init_results(objectwise=True) return self._results_objectwise + def commitment_path(self, version): + """The version's ``commitment.json``, or ``None`` when not blinding. + + Resolved per version rather than held as one path, because a single + ``CosmologyValidation`` can span several catalogue versions and each + has its own blind. + """ + if self.blind_root is None: + return None + return init_paths(os.path.join(self.blind_root, version))["commitment"] + def basename(self, version, treecorr_config=None, npatch=None): cfg = treecorr_config or self.treecorr_config patches = npatch or self.npatch diff --git a/src/sp_validation/cosmo_val/pseudo_cl.py b/src/sp_validation/cosmo_val/pseudo_cl.py index cf74efc6..8243f818 100644 --- a/src/sp_validation/cosmo_val/pseudo_cl.py +++ b/src/sp_validation/cosmo_val/pseudo_cl.py @@ -730,7 +730,7 @@ def pseudo_cl_to_sacc_part(self, version, out_path, ell_eff, cl_all, wsp): cl_all, wsp, ) - sacc_io.save(s, out_path, type="data") + sacc_io.save(s, out_path, type=self.run_type) def plot_pseudo_cl(self): """Plot the EE/EB/BB pseudo-Cl spectra for every version.""" diff --git a/src/sp_validation/cosmo_val/psf_systematics.py b/src/sp_validation/cosmo_val/psf_systematics.py index b20d1085..de5feb19 100644 --- a/src/sp_validation/cosmo_val/psf_systematics.py +++ b/src/sp_validation/cosmo_val/psf_systematics.py @@ -26,6 +26,7 @@ class PSFSystematicsMixin: def calculate_rho_tau_stats(self): + """Measure ρ/τ statistics per version and write each version's SACC part.""" out_dir = f"{self.cc['paths']['output']}/rho_tau_stats" if not os.path.exists(out_dir): os.mkdir(out_dir) @@ -56,6 +57,10 @@ def rho_tau_to_sacc_part( ): """Write the ρ/τ SACC part for one version. + ρ/τ carries no cosmological vector and is never blinded; on a data run + it is stamped concealed pass-through (values untouched) so the + assembly's load gate admits it. + ρ_0…ρ_5 autos and τ_0/τ_2/τ_5 leakage from the handler tables. The ``CovTauTh`` theory covariance ``cov_tau_{base}_th.npy`` is passed as ``tau_cov_th`` when it exists; without it the τ block falls back — @@ -77,7 +82,9 @@ def rho_tau_to_sacc_part( tau_cov_th=tau_cov_th, ) out_path = os.path.join(out_dir, f"rho_tau_{base}.sacc") - sacc_io.save(s, out_path, type="data") + sacc_io.save( + s, out_path, type=self.run_type, commitment=self.commitment_path(version) + ) @property def rho_stat_handler(self): diff --git a/src/sp_validation/cosmo_val/sacc_writers.py b/src/sp_validation/cosmo_val/sacc_writers.py index 8b7f57b7..c410ef26 100644 --- a/src/sp_validation/cosmo_val/sacc_writers.py +++ b/src/sp_validation/cosmo_val/sacc_writers.py @@ -7,6 +7,9 @@ own covariance as its one block. :func:`assemble_analysis_sacc` rebuilds the single ``{version}.sacc`` analysis file from these parts. +The integration-grid ξ± part is an intermediate consumed by COSEBIs and +pure-E/B; it is blinded at birth but does not join ``{version}.sacc``. + Everything here is single-bin today (``bins=(0, 0)``); the interface is tomography-native so a future round supplies real bin pairs unchanged. """ diff --git a/src/sp_validation/sacc_io.py b/src/sp_validation/sacc_io.py index 99a0efe2..24fee0a4 100644 --- a/src/sp_validation/sacc_io.py +++ b/src/sp_validation/sacc_io.py @@ -942,7 +942,7 @@ def update_statistic(s, sub): s.data[idx[0]].value = point.value -def save(s, path, *, type): +def save(s, path, *, type, commitment=None): """Write ``s`` to ``path`` (FITS), overwriting any existing file. Parameters @@ -955,6 +955,12 @@ def save(s, path, *, type): the pipeline computing the data vector — knows whether its input catalogue is a mock; there is deliberately no default. ``load`` refuses ``type='data'`` files that are not blinded. + commitment : str, optional + Path to the version's ``commitment.json``. When given, the file is + stamped concealed under that blind + (:func:`sp_validation.blinding.stamp_concealed_passthrough`, values + untouched) before writing — the seam every born-blinded or + blind-irrelevant part uses to clear the fail-closed load gate. """ if type not in ("data", "mock"): raise ValueError(f"type must be 'data' or 'mock'; got {type!r}") @@ -964,6 +970,10 @@ def save(s, path, *, type): f"refusing to re-stamp as {type!r}" ) s.metadata["type"] = type + if commitment is not None: + from . import blinding + + blinding.stamp_concealed_passthrough(s, commitment) s.save_fits(path, overwrite=True) @@ -1539,3 +1549,42 @@ def covariance_blocks(cov_list, selectors, *, gaussian=True): return [ (selectors, cov_from_one_covariance(np.asarray(cov_list), gaussian=gaussian)) ] + + +# --------------------------------------------------------------------------- # +# Terminal assembly — gather() and its blind-custody call site. +# --------------------------------------------------------------------------- # +def gather(parts, metadata=None, assemble=None): + """Assemble standalone part SACCs into the one-file ``{version}.sacc``. + + The terminal seam: every path that combines parts into the one-file + product goes through here, because this is where the one thing an + assembler cannot know about is enforced — blind custody. + :func:`sp_validation.blinding.assert_consistent_blind` runs before the + assembly and its returned shared stamp is written onto the result. The + assembler is passed *in* rather than wrapping this guard, which is what + keeps the guard un-bypassable. + + Parameters + ---------- + parts : sequence of sacc.Sacc + The part SACCs, in the assembly (covariance) order. + metadata : dict, optional + Extra key/value pairs to store on the assembled file's metadata. + assemble : callable, optional + ``assemble(parts) -> sacc.Sacc``. Defaults to :func:`merge`. Bind any + further arguments (n(z), metadata) into the callable. + + Returns + ------- + sacc.Sacc + The assembled file. + """ + from . import blinding + + parts = list(parts) + stamp = blinding.assert_consistent_blind(parts) + s = (assemble or merge)(parts) + for key, value in {**(metadata or {}), **(stamp or {})}.items(): + s.metadata[key] = value + return s diff --git a/src/sp_validation/tests/test_blinding.py b/src/sp_validation/tests/test_blinding.py new file mode 100644 index 00000000..cdec4e8c --- /dev/null +++ b/src/sp_validation/tests/test_blinding.py @@ -0,0 +1,1304 @@ +"""Tests for :mod:`sp_validation.blinding` — per-part Smokescreen blinding. + +Acceptance criteria AC1–AC9 of the blinding PRD, plus fast unit coverage of +the config/custody surface. The theory tests (fork + CCL) are marked ``slow``; +the derived-statistics tests additionally ``importorskip`` ``cosmo_numba``. + +All fixtures are synthetic and deterministic. Each blindable intermediate is +its own standalone part SACC, as in the per-part-at-birth architecture; +derived statistics are computed downstream from the blinded integration ξ± +through the pipeline's own seams. The fork is handed no data vector at all, so +fixture ξ± values need only be smooth synthetic templates. +""" + +import json +import pathlib + +import numpy as np +import pytest + +from sp_validation import blinding as bd +from sp_validation import sacc_io as sio +from sp_validation.blinding_theory import TheoryConfig + +_NOLOG = lambda *a, **k: None # noqa: E731 + + +# --------------------------------------------------------------------------- # +# Synthetic part fixtures +# --------------------------------------------------------------------------- # +def _gauss_nz(z0, sigma, n=200): + z = np.linspace(0.0, 3.0, n) + nz = np.exp(-0.5 * ((z - z0) / sigma) ** 2) + return z, nz / np.trapezoid(nz, z) + + +def _reporting_theta(n=8): + return np.geomspace(5.0, 250.0, n) + + +def _integration_theta(n=80): + # The integration grid is the pure-E/B INTEGRATION grid, so it spans wider than + # the reporting range on both ends (production: ~0.08–300 arcmin). + return np.geomspace(0.1, 300.0, n) + + +def _xi_template(theta, k=0): + """Smooth synthetic ξ± for pair index ``k`` (no CCL needed).""" + theta = np.asarray(theta) + xip = 1e-4 * (1 + 0.1 * k) * (theta / 10.0) ** -0.6 + xim = 0.5e-4 * (1 + 0.1 * k) * (theta / 10.0) ** -0.9 + return xip, xim + + +def _b_mode_template(theta, amplitude): + """A smooth ξ_B(θ) template. B contributes +ξ_B to ξ+, −ξ_B to ξ−.""" + return amplitude * np.exp(-((np.log(np.asarray(theta) / 30.0)) ** 2) / 2.0) + + +def _nz_dict(nbins): + return {i: _gauss_nz(0.5 + 0.3 * i, 0.15 + 0.02 * i) for i in range(nbins)} + + +def _pairs(nbins): + return [(i, j) for i in range(nbins) for j in range(i, nbins)] + + +def make_xi_part(grid, nbins=1, b_amplitude=0.0): + """A standalone ξ± part SACC (one grid), synthetic values, eye covariance. + + ``b_amplitude`` injects a pure B-mode (+ξ_B to ξ+, −ξ_B to ξ−; + b_modes.py sign convention) — used on the integration part for AC4/AC9. + """ + theta = _reporting_theta() if grid == "reporting" else _integration_theta() + s = sio.new_sacc( + _nz_dict(nbins), metadata={"catalogue_version": "vTEST", "type": "mock"} + ) + blocks = [] + for k, (i, j) in enumerate(_pairs(nbins)): + xip, xim = _xi_template(theta, k) + xi_b = _b_mode_template(theta, b_amplitude) + sio.add_xi(s, (i, j), theta, xip + xi_b, xim - xi_b, grid=grid) + tr = sio._pair((i, j)) + idx = np.concatenate( + [ + s.indices(sio.XI_PLUS, tr, grid=grid), + s.indices(sio.XI_MINUS, tr, grid=grid), + ] + ) + blocks.append((idx, np.eye(len(idx)) * 1e-12)) + sio.assemble_covariance(s, blocks) + return s + + +def make_cl_part(nbins=1): + """A standalone pseudo-Cℓ part SACC (EE/BB/EB + bandpower windows).""" + s = sio.new_sacc( + _nz_dict(nbins), metadata={"catalogue_version": "vTEST", "type": "mock"} + ) + ell_eff = np.array([30.0, 80.0, 150.0, 280.0, 450.0]) + w_ell = np.arange(2, 501).astype(float) + w_mat = np.zeros((len(w_ell), len(ell_eff))) + for b, le in enumerate(ell_eff): + w_mat[:, b] = np.exp(-0.5 * ((w_ell - le) / 40.0) ** 2) + w_mat[:, b] /= w_mat[:, b].sum() + blocks = [] + for k, (i, j) in enumerate(_pairs(nbins)): + cl_ee = 1e-8 * (1 + 0.1 * k) * (ell_eff / 100.0) ** -1.2 + sio.add_pseudo_cl( + s, + (i, j), + ell_eff, + cl_ee, + np.zeros(5), + np.zeros(5), + window_ells=w_ell, + window_weights=w_mat, + ) + tr = sio._pair((i, j)) + idx = np.concatenate( + [s.indices(dt, tr) for dt in (sio.CL_EE, sio.CL_BB, sio.CL_EB)] + ) + blocks.append((idx, np.eye(len(idx)) * 1e-16)) + sio.assemble_covariance(s, blocks) + return s + + +def make_rho_part(): + """A standalone ρ/τ PSF-diagnostics part SACC — never blindable.""" + ctheta = _reporting_theta() + s = sio.new_sacc( + _nz_dict(1), metadata={"catalogue_version": "vTEST", "type": "mock"} + ) + blocks = [] + for k in range(2): + sio.add_rho( + s, k, ctheta, np.arange(len(ctheta)) * 1e-7, np.arange(len(ctheta)) * 2e-7 + ) + idx = np.concatenate( + [s.indices(sio.RHO_PLUS.format(k=k)), s.indices(sio.RHO_MINUS.format(k=k))] + ) + blocks.append((idx, np.eye(len(idx)) * 1e-18)) + sio.add_tau( + s, (0,), 0, ctheta, np.arange(len(ctheta)) * 3e-7, np.arange(len(ctheta)) * 4e-7 + ) + idx = np.concatenate( + [s.indices(sio.TAU_PLUS.format(k=0)), s.indices(sio.TAU_MINUS.format(k=0))] + ) + blocks.append((idx, np.eye(len(idx)) * 1e-18)) + sio.assemble_covariance(s, blocks) + return s + + +def make_parts(nbins=1, b_amplitude=0.0, with_rho=True): + """All intermediate parts of one catalogue version, keyed by name.""" + parts = { + "xi_reporting": make_xi_part("reporting", nbins), + "xi_integration": make_xi_part("integration", nbins, b_amplitude=b_amplitude), + "cl": make_cl_part(nbins), + } + if with_rho: + parts["rho_tau"] = make_rho_part() + return parts + + +def _derive_downstream(reporting_part, integration_part, nmodes=6): + """COSEBIs + pure-E/B the way the pipeline derives them downstream. + + COSEBIs from the integration ξ± (full-range scale cut); pure-E/B from the + measured reporting reporting ξ± + the integration integration ξ±, with the + edge-based bounds set to the reporting grid's span — the outermost + reporting point sits at tmax with no interior support and comes back + NaN (the AC9 boundary case). + """ + from sp_validation import b_modes + + theta_f, xip_f, xim_f = sio.get_xi(integration_part, (0, 0), grid="integration") + theta_c, xip_c, xim_c = sio.get_xi(reporting_part, (0, 0), grid="reporting") + En, Bn = b_modes.cosebis_from_xi( + theta_f, xip_f, xim_f, nmodes, scale_cut=(theta_f.min(), theta_f.max()) + ) + modes = b_modes.pure_eb_from_xi( + theta_c, + xip_c, + xim_c, + theta_f, + xip_f, + xim_f, + float(theta_c[0]), + float(theta_c[-1]), + ) + return En, Bn, modes + + +# --------------------------------------------------------------------------- # +# BlindingConfig: envelope calibration + digest (fast) +# --------------------------------------------------------------------------- # +def test_blinding_config_defaults(): + c = bd.BlindingConfig() + assert c.s8_half_width == 0.075 + assert c.omega_m_half_width == 0.1 + assert c.theory.S8 == 0.80 # fiducial TheoryConfig defaults + + +def test_blinding_config_overrides_fail_loud(): + c = bd.BlindingConfig.from_overrides({"s8_half_width": 0.05}) + assert c.s8_half_width == 0.05 + with pytest.raises(ValueError, match="unknown BlindingConfig fields"): + bd.BlindingConfig.from_overrides({"s8_half_width": 0.05, "bogus": 1}) + with pytest.raises(ValueError, match="unknown TheoryConfig fields"): + bd.BlindingConfig.from_overrides({"theory": {"nope": 1}}) + + +def test_blinding_config_is_frozen(): + with pytest.raises(Exception): + bd.BlindingConfig().s8_half_width = 0.2 + + +def test_envelope_calibration_maps_s8_box_to_ccl_halfwidths(): + """(S8, Ωm) half-widths → {sigma8, Omega_c} at the fiducial (exact forms).""" + c = bd.BlindingConfig() + shifts = c.shifts_dict() + assert set(shifts) == {"sigma8", "Omega_c"} + assert shifts["sigma8"] == pytest.approx( + c.s8_half_width / np.sqrt(c.theory.Omega_m / 0.3) + ) + assert shifts["Omega_c"] == c.omega_m_half_width + # every shift key must exist in the fiducial point (fork contract) + assert set(shifts) <= set(c.theory.ccl_params()) + + +def test_config_digest_stable_and_sensitive(): + """Canonical digest: byte-stable across runs, moves with every bound field.""" + c = bd.BlindingConfig() + assert c.config_digest() == bd.BlindingConfig().config_digest() + assert len(c.config_digest()) == 64 + assert bd.BlindingConfig(s8_half_width=0.05).config_digest() != c.config_digest() + assert ( + bd.BlindingConfig.from_overrides({"theory": {"S8": 0.79}}).config_digest() + != c.config_digest() + ) + # the P(k) recipe tokens are bound: a different halofit token = new digest + assert ( + bd.BlindingConfig.from_overrides( + {"theory": {"ccl_halofit_version": "takahashi"}} + ).config_digest() + != c.config_digest() + ) + # the Boltzmann backend (#280) is bound too — a different transfer + # function is a different P(k) path, so a different blind + assert ( + bd.BlindingConfig.from_overrides( + {"theory": {"transfer_function": "eisenstein_hu"}} + ).config_digest() + != c.config_digest() + ) + + +def test_theory_config_transfer_function_default_and_override(): + """#280: the Boltzmann backend is one config knob, CAMB by default (the + inference pipeline's Boltzmann code), overridable like any other field.""" + assert TheoryConfig().transfer_function == "boltzmann_camb" + cfg = TheoryConfig.from_overrides({"transfer_function": "eisenstein_hu"}) + assert cfg.transfer_function == "eisenstein_hu" + + +def test_config_digest_int_float_canonical(): + """One physical cosmology has one digest, regardless of int-vs-float literals. + + Configs come from YAML/CLI/humans, so a field can arrive as ``-1`` (int) or + ``-1.0`` (float). The digest must depend on the numeric *value*, not the + literal's Python type — otherwise an int-vs-float mismatch between the blind + and a later unblind would raise "config digest mismatch" and deny a + legitimate unblind. Every declared-float field must be canonical this way. + """ + for field, int_val, float_val in [ + ("w0", -1, -1.0), + ("wa", 0, 0.0), + ("Omega_m", 1, 1.0), + ("m_nu", 0, 0.0), + ("S8", 1, 1.0), + ]: + assert ( + bd.BlindingConfig.from_overrides( + {"theory": {field: int_val}} + ).config_digest() + == bd.BlindingConfig.from_overrides( + {"theory": {field: float_val}} + ).config_digest() + ), f"int-vs-float digest split on theory.{field}" + # the envelope half-widths (BlindingConfig's own float fields) too + assert ( + bd.BlindingConfig.from_overrides({"s8_half_width": 1}).config_digest() + == bd.BlindingConfig.from_overrides({"s8_half_width": 1.0}).config_digest() + ) + # and a full round-trip: an all-int override matches the float default digest + assert ( + bd.BlindingConfig.from_overrides( + {"theory": {"w0": -1, "Omega_m": 0, "wa": 0}} + ).config_digest() + == bd.BlindingConfig.from_overrides( + {"theory": {"w0": -1.0, "Omega_m": 0.0, "wa": 0.0}} + ).config_digest() + ) + + +def test_theory_config_ccl_params_exact_keyset(): + """ccl_params() carries exactly the contracted keys — nothing rides along.""" + params = TheoryConfig().ccl_params() + assert set(params) == { + "Omega_c", + "Omega_b", + "h", + "n_s", + "sigma8", + "m_nu", + "mass_split", + "w0", + "wa", + "Neff", + "T_CMB", + } + assert params["sigma8"] == pytest.approx(0.80) # S8=0.80 at Ωm=0.30 + assert params["Neff"] == 3.046 and params["T_CMB"] == 2.7255 + + +# --------------------------------------------------------------------------- # +# Commitment + the fork's draw (fast; smokescreen import is light) +# --------------------------------------------------------------------------- # +def test_commitment_is_the_forks_domain_separated_digest(): + """One definition of the commitment, and it is the fork's.""" + import smokescreen + + seed = "the-secret" + assert bd.seed_commitment(seed) == smokescreen.seed_commitment(seed) + assert bd.seed_commitment("right") != bd.seed_commitment("wrong") + + +def test_commitment_does_not_embed_the_rng_seed(): + """The published commitment must not carry the effective RNG seed. + + The fork derives the base seed for its per-key RNG from the *undomained* + sha256 of the seed string, taking the digest's first 8 bytes. A commitment + hashed over the bare seed would therefore publish that base seed verbatim in + its first 16 hex characters, and anyone holding the (public) commitment and + the (public) fiducial config could redraw the hidden cosmology and subtract + the blind. The domain prefix is what breaks that identity — this is the + regression guard for it. + """ + import secrets + + from smokescreen.param_shifts import _normalize_seed + + # The third seed is drawn exactly as blind_init draws a production one. + for seed in ("my_secret_seed", "the-secret", secrets.token_hex(16)): + commitment = bd.seed_commitment(seed) + assert int(commitment[:16], 16) != _normalize_seed(seed) + + +def test_hidden_params_deterministic_and_in_envelope(): + """Same (seed, config) ⇒ same hidden point; draws respect the envelope.""" + import secrets + + c = bd.BlindingConfig() + fid = c.theory.ccl_params() + h1, h2 = bd.hidden_params("a-seed", c), bd.hidden_params("a-seed", c) + assert h1 == h2 + assert bd.hidden_params("другой", c) != h1 + shifts = c.shifts_dict() + for _ in range(50): + h = bd.hidden_params(secrets.token_hex(8), c) + for key, half in shifts.items(): + assert abs(h[key] - fid[key]) <= half + # only the enveloped keys move + assert all(h[k] == fid[k] for k in fid if k not in shifts) + + +def test_hidden_params_no_global_rng_state(): + """The fork's draw uses a local RNG — global numpy state is untouched.""" + np.random.seed(0) + before = np.random.get_state()[1].copy() + bd.hidden_params("whatever", bd.BlindingConfig()) + assert np.array_equal(before, np.random.get_state()[1]) + + +# --------------------------------------------------------------------------- # +# Per-part merge + provenance with a monkeypatched factor (fast — no CCL) +# --------------------------------------------------------------------------- # +def _patch_constant_factor(monkeypatch, value=1e-6): + def fake(part, indices, factory, config, seed): + return np.arange(len(indices), dtype=float) * value + value + + monkeypatch.setattr(bd, "_concealing_factor", fake) + return fake + + +def test_merge_places_shift_at_recorded_indices_only(monkeypatch): + """AC5 (merge half), per part: the shift lands exactly on the blindable + rows, in stored order; covariance, n(z), and every tag are untouched.""" + _patch_constant_factor(monkeypatch) + for name, part in make_parts(nbins=2, with_rho=False).items(): + orig = np.array(part.mean) + orig_cov = part.covariance.dense.copy() + orig_nz = part.tracers["source_0"].nz.copy() + + blinded = bd.blind_sacc(part, "seed", log=_NOLOG) + + blocks = bd._blindable_blocks(part) + assert len(blocks) == 1, f"{name}: a part carries exactly one block" + shifted = np.zeros(len(orig), dtype=bool) + for _, indices, _ in blocks: + expected = orig[indices] + (np.arange(len(indices)) * 1e-6 + 1e-6) + assert np.array_equal(np.array(blinded.mean)[indices], expected) + shifted[indices] = True + assert np.array_equal(np.array(blinded.mean)[~shifted], orig[~shifted]) + assert np.array_equal(blinded.covariance.dense, orig_cov) + assert np.array_equal(blinded.tracers["source_0"].nz, orig_nz) + # row-order preservation: type/tracers/tags sequence is bitwise unchanged + for a, b in zip(part.data, blinded.data): + assert a.data_type == b.data_type + assert a.tracers == b.tracers + assert a.tags == b.tags + + +def test_provenance_metadata_contract(monkeypatch): + """Blinded parts carry concealed/blind/commitment/digest; no seed key.""" + _patch_constant_factor(monkeypatch) + s = make_xi_part("reporting") + s.metadata["seed_smokescreen"] = "leaked!" # must be stripped + c = bd.BlindingConfig() + blinded = bd.blind_sacc(s, "seed", config=c, label="B", log=_NOLOG) + assert blinded.metadata["concealed"] is True + assert blinded.metadata["blind"] == "B" + assert blinded.metadata["blind_commitment"] == bd.seed_commitment("seed") + assert blinded.metadata["blind_config_digest"] == c.config_digest() + assert blinded.metadata["blind_draw_scheme"] == bd.draw_scheme() + assert "seed_smokescreen" not in blinded.metadata + assert blinded.metadata["catalogue_version"] == "vTEST" + + +def test_blind_refuses_double_blind(monkeypatch): + _patch_constant_factor(monkeypatch) + s = make_xi_part("reporting") + blinded = bd.blind_sacc(s, "seed", log=_NOLOG) + with pytest.raises(ValueError, match="already concealed"): + bd.blind_sacc(blinded, "seed2", log=_NOLOG) + + +def test_blind_refuses_non_blindable_part(): + """A ρ/τ diagnostic part must never see a blind call — loud refusal.""" + with pytest.raises(ValueError, match="no blindable block"): + bd.blind_sacc(make_rho_part(), "seed", log=_NOLOG) + + +def test_unblind_fails_closed_on_wrong_seed_or_config(monkeypatch): + """AC6 (in-memory half): wrong seed and wrong config both refuse loudly.""" + _patch_constant_factor(monkeypatch) + s = make_xi_part("reporting") + blinded = bd.blind_sacc(s, "right-seed", log=_NOLOG) + with pytest.raises(ValueError, match="blind_commitment"): + bd.unblind_sacc(blinded, "wrong-seed", log=_NOLOG) + with pytest.raises(ValueError, match="blind_config_digest"): + bd.unblind_sacc( + blinded, + "right-seed", + config=bd.BlindingConfig(s8_half_width=0.01), + log=_NOLOG, + ) + with pytest.raises(ValueError, match="not concealed"): + bd.unblind_sacc(s, "right-seed", log=_NOLOG) + + +# --------------------------------------------------------------------------- # +# The vector core: full-length theory in, block slice out (fast — fake backend) +# --------------------------------------------------------------------------- # +def _fake_factory(indices, hole=None): + """A backend that fills ``indices`` with ``sigma8 * arange`` and nothing else. + + Mimics the real backends' contract — a block's ``theory_fn`` reads its + layout off the SACC it is given and returns a full-length vector, NaN on + every row outside its own block — without importing CCL. ``hole`` leaves + one row of the block itself unfilled. + """ + + def factory(s, theory): + def theory_fn(params): + out = np.full(len(s.mean), np.nan) + out[indices] = params["sigma8"] * np.arange(len(indices)) + if hole is not None: + out[hole] = np.nan + return out + + return theory_fn + + return factory + + +def test_concealing_factor_slices_its_own_block_from_a_full_length_vector(): + """The factor is the theory difference at the block's rows, and the rows + the backend does not fill are never read. + + This is the shape of the whole path after the sub-SACC carving came out: + the backend is driven off the assembled SACC directly, returns a + full-length vector that is NaN everywhere but its own block, and + ``_concealing_factor`` returns exactly that block's rows. Checked against + :func:`hidden_params`, which reaches the same hidden point by an + independent route. + """ + ordered = ["xi_reporting", "cl", "rho_tau", "xi_integration"] + s = sio.gather([make_parts(nbins=1)[k] for k in ordered]) + blocks = bd._blindable_blocks(s) + assert len(blocks) == 3, "assembled file carries all three blindable blocks" + + cfg = bd.BlindingConfig() + delta = bd.hidden_params("seed", cfg)["sigma8"] - cfg.theory.ccl_params()["sigma8"] + assert delta != 0.0 + for _, indices, _ in blocks: + factor = bd._concealing_factor(s, indices, _fake_factory(indices), cfg, "seed") + assert factor.shape == (len(indices),) + assert np.allclose(factor, delta * np.arange(len(indices))) + + +def test_concealing_factor_refuses_a_row_its_backend_cannot_fill(): + """A NaN on a row the block *claims* is a layout the backend cannot cover. + + Slicing to the block drops the NaNs outside it by construction; this is + the converse guard, and it has to be explicit — without it a row the + backend silently skipped would be shifted by NaN, destroying that point + with no error anywhere. + """ + part = make_xi_part("reporting") + ((_, indices, _),) = bd._blindable_blocks(part) + with pytest.raises(ValueError, match="unfilled"): + bd._concealing_factor( + part, + indices, + _fake_factory(indices, hole=indices[0]), + bd.BlindingConfig(), + "seed", + ) + + +# --------------------------------------------------------------------------- # +# Draw-scheme binding: the blind is (seed, config, draw semantics) +# --------------------------------------------------------------------------- # +def test_draw_scheme_is_the_installed_fork_constant(): + """The recorded scheme is read from Smokescreen, not hardcoded here.""" + import smokescreen + + assert bd.draw_scheme() == int(smokescreen.DRAW_SCHEME) + assert isinstance(bd.draw_scheme(), int) + + +def test_assert_draw_scheme_message_names_both_versions(monkeypatch): + """A scheme mismatch says which scheme made the blind and which is installed.""" + monkeypatch.setattr(bd, "draw_scheme", lambda: 2) + bd._assert_draw_scheme(2, "the blind") # matching scheme is silent + with pytest.raises(ValueError, match=r"DRAW_SCHEME=1.*DRAW_SCHEME=2"): + bd._assert_draw_scheme(1, "the blind") + with pytest.raises(ValueError, match="no draw-scheme record"): + bd._assert_draw_scheme(None, "the blind") + + +def test_unblind_refuses_a_blind_drawn_under_another_scheme(monkeypatch): + """The finding this closes: a blind added under one draw scheme and + subtracted under another silently produces a wrong data vector, because + the seed hash, the config digest and the escrow check all still pass. The + scheme must be part of the custody state, checked before any subtraction. + """ + _patch_constant_factor(monkeypatch) + blinded = bd.blind_sacc(make_xi_part("reporting"), "seed", log=_NOLOG) + assert blinded.metadata["blind_draw_scheme"] == bd.draw_scheme() + + # everything else about this file is valid — only the draw semantics moved + monkeypatch.setattr( + bd, "draw_scheme", lambda: blinded.metadata["blind_draw_scheme"] + 1 + ) + with pytest.raises(ValueError, match="DRAW_SCHEME"): + bd.unblind_sacc(blinded, "seed", log=_NOLOG) + + +def test_unblind_refuses_a_file_predating_scheme_binding(monkeypatch): + """A blinded file with no scheme record fails closed, not open.""" + _patch_constant_factor(monkeypatch) + blinded = bd.blind_sacc(make_xi_part("reporting"), "seed", log=_NOLOG) + del blinded.metadata["blind_draw_scheme"] + with pytest.raises(ValueError, match="no draw-scheme record"): + bd.unblind_sacc(blinded, "seed", log=_NOLOG) + + +def test_unblind_strips_the_scheme_stamp_with_the_rest(monkeypatch): + _patch_constant_factor(monkeypatch) + blinded = bd.blind_sacc(make_xi_part("reporting"), "seed", log=_NOLOG) + part = bd.unblind_sacc(blinded, "seed", log=_NOLOG) + assert "blind_draw_scheme" not in part.metadata + + +def test_read_seed_fails_closed_on_scheme_drift(tmp_path, monkeypatch): + """blind_part reads the seed through _read_seed, so a scheme change between + blinding part 1 and part 2 is caught before the second part is shifted.""" + bd.blind_init(str(tmp_path), log=_NOLOG) + monkeypatch.setattr(bd, "draw_scheme", lambda: 99) + with pytest.raises(ValueError, match="DRAW_SCHEME"): + bd._read_seed(str(tmp_path), bd.BlindingConfig()) + + +def test_stamp_passthrough_carries_the_committed_scheme(tmp_path, monkeypatch): + """A pass-through part inherits the blind's scheme, and cannot be stamped + from an install that draws differently.""" + paths = bd.blind_init(str(tmp_path), log=_NOLOG) + s = bd.stamp_concealed_passthrough(make_rho_part(), paths["commitment"]) + assert s.metadata["blind_draw_scheme"] == bd.draw_scheme() + + monkeypatch.setattr(bd, "draw_scheme", lambda: 99) + with pytest.raises(ValueError, match="DRAW_SCHEME"): + bd.stamp_concealed_passthrough(make_rho_part(), paths["commitment"]) + + +def test_assert_consistent_blind_refuses_divergent_or_foreign_schemes(monkeypatch): + """Parts blinded under different schemes never assemble; nor does a set + that agrees with itself but not with the installed fork.""" + parts = make_parts(nbins=1, with_rho=False) + for p in parts.values(): + _stamp(p) + parts["cl"].metadata["blind_draw_scheme"] = bd.draw_scheme() + 1 + with pytest.raises(ValueError, match="different blind commitments"): + bd.assert_consistent_blind(list(parts.values())) + + parts = make_parts(nbins=1, with_rho=False) + for p in parts.values(): + _stamp(p) + p.metadata["blind_draw_scheme"] = bd.draw_scheme() + 1 + with pytest.raises(ValueError, match="DRAW_SCHEME"): + bd.assert_consistent_blind(list(parts.values())) + + +# --------------------------------------------------------------------------- # +# blind-init custody + assembly hash assertion (fast — encryption only) +# --------------------------------------------------------------------------- # +def test_blind_init_writes_commitment_and_encrypted_bundle_only(tmp_path): + """AC6 (init): commitment.json + encrypted bundle; never a plaintext seed.""" + paths = bd.blind_init(str(tmp_path), log=_NOLOG) + with open(paths["commitment"], encoding="utf-8") as f: + commitment = json.load(f) + assert set(commitment) == { + "label", + "seed_commitment", + "config_digest", + "draw_scheme", + } + assert len(commitment["seed_commitment"]) == 64 + assert commitment["config_digest"] == bd.BlindingConfig().config_digest() + # exactly the three custody outputs, no plaintext bundle + assert {p.name for p in tmp_path.iterdir()} == { + "commitment.json", + "blind_seed.encrpt", + "blind_seed.key", + } + # the decrypted seed matches the public commitment + bundle = bd._read_encrypted_json(paths["bundle"], paths["key"]) + assert bd.seed_commitment(bundle["seed"]) == commitment["seed_commitment"] + # one-shot custody: a second init in the same dir refuses + with pytest.raises(FileExistsError, match="refusing to overwrite"): + bd.blind_init(str(tmp_path), log=_NOLOG) + + +def test_read_seed_fails_closed_on_drifted_config(tmp_path): + bd.blind_init(str(tmp_path), log=_NOLOG) + with pytest.raises(ValueError, match="config digest"): + bd._read_seed(str(tmp_path), bd.BlindingConfig(s8_half_width=0.01)) + + +def _stamp(s, seed="s", label="A", config=None): + bd._stamp_provenance( + s, + bd.seed_commitment(seed), + label, + (config or bd.BlindingConfig()).config_digest(), + ) + return s + + +def test_assert_consistent_blind_shared_stamp(): + """One commitment across all blindable parts ⇒ the shared stamp returns; + ρ/τ parts are exempt from the assertion.""" + parts = make_parts(nbins=1) + for name in ("xi_reporting", "xi_integration", "cl"): + _stamp(parts[name]) + stamp = bd.assert_consistent_blind(list(parts.values())) + assert stamp == { + "concealed": True, + "blind": "A", + "blind_commitment": bd.seed_commitment("s"), + "blind_config_digest": bd.BlindingConfig().config_digest(), + "blind_draw_scheme": bd.draw_scheme(), + } + + +def test_assert_consistent_blind_fails_closed(): + """AC6 (assembly): mismatched commitments and mixed states both refuse.""" + parts = make_parts(nbins=1, with_rho=False) + _stamp(parts["xi_reporting"], seed="one") + _stamp(parts["xi_integration"], seed="one") + _stamp(parts["cl"], seed="two") # different seed ⇒ different commitment + with pytest.raises(ValueError, match="different blind commitments"): + bd.assert_consistent_blind(list(parts.values())) + + parts = make_parts(nbins=1, with_rho=False) + _stamp(parts["xi_reporting"]) # blinded beside plaintext blindable parts + with pytest.raises(ValueError, match="mixed"): + bd.assert_consistent_blind(list(parts.values())) + + +def test_assert_consistent_blind_all_plaintext_is_none(): + """A declared-mock plaintext assembly (nothing blinded) asserts nothing.""" + assert bd.assert_consistent_blind(list(make_parts().values())) is None + + +def test_assert_consistent_blind_unconcealed_data_fails_closed(): + """PRD §4 "Mocks vs data": an unconcealed blindable part may assemble only + if its metadata declares ``type == "mock"`` — an unconcealed ``data`` part, + or one missing the tag, fails closed (skipping the blind can never + silently expose real data). Mixed concealed/plaintext still fails on the + mixed guard regardless of type.""" + parts = make_parts(nbins=1, with_rho=False) + parts["xi_integration"].metadata["type"] = "data" + with pytest.raises(ValueError, match="type"): + bd.assert_consistent_blind(list(parts.values())) + + parts = make_parts(nbins=1, with_rho=False) + del parts["cl"].metadata["type"] # missing tag counts as not-a-mock + with pytest.raises(ValueError, match=""): + bd.assert_consistent_blind(list(parts.values())) + + # concealed data parts assemble integration (that is the whole point of the blind) + parts = make_parts(nbins=1, with_rho=False) + for p in parts.values(): + p.metadata["type"] = "data" + _stamp(p) + assert bd.assert_consistent_blind(list(parts.values()))["concealed"] is True + + # mixed concealed/plaintext fails on the mixed guard even for mocks + parts = make_parts(nbins=1, with_rho=False) + _stamp(parts["xi_reporting"]) + with pytest.raises(ValueError, match="mixed"): + bd.assert_consistent_blind(list(parts.values())) + + +def test_gather_fails_closed_on_unconcealed_data_part(): + """The type guard reaches the terminal gather surface too.""" + parts = make_parts(nbins=1, with_rho=False) + parts["xi_reporting"].metadata["type"] = "data" + with pytest.raises(ValueError, match="type"): + sio.gather(list(parts.values())) + + +def test_assert_consistent_blind_differing_labels_warn_not_fail(): + """Same seed+config, different --label ⇒ assemble cleanly with a warning. + + The label is provenance, not custody state: parts blinded under one blind + but tagged with different labels must not be misread as different blinds. + The assembly succeeds (keyed on commitment+digest); a distinct warning + surfaces the label divergence rather than a false "different commitments". + """ + parts = make_parts(nbins=1, with_rho=False) + _stamp(parts["xi_reporting"], seed="one", label="A") + _stamp(parts["xi_integration"], seed="one", label="A") + _stamp(parts["cl"], seed="one", label="B") # same blind, different label + with pytest.warns(UserWarning, match="different labels"): + stamp = bd.assert_consistent_blind(list(parts.values())) + assert stamp["blind_commitment"] == bd.seed_commitment("one") + assert stamp["blind"] == "A" # deterministic: sorted-first label + + +def test_gather_assembles_parts_and_stamps_blind(): + """The sacc_io gather combines parts (points, tags, covariance blocks), + calls the assembly assertion, and stamps the shared blind.""" + parts = make_parts(nbins=1) + for name in ("xi_reporting", "xi_integration", "cl"): + _stamp(parts[name]) + ordered = [parts[k] for k in ("xi_reporting", "cl", "rho_tau", "xi_integration")] + s = sio.gather(ordered, metadata={"catalogue_version": "vTEST", "type": "mock"}) + + assert len(s.mean) == sum(len(p.mean) for p in ordered) + assert np.array_equal(np.array(s.mean), np.concatenate([p.mean for p in ordered])) + # covariance: block-diagonal of the parts, in order + cursor = 0 + for p in ordered: + n = len(p.mean) + assert np.array_equal( + s.covariance.dense[cursor : cursor + n, cursor : cursor + n], + p.covariance.dense, + ) + cursor += n + # the integration rows are addressable by the grid tag in the assembled file + assert len(s.indices(sio.XI_PLUS, grid="integration")) == len( + parts["xi_integration"].indices(sio.XI_PLUS, grid="integration") + ) + # bandpower windows survive assembly + assert s.get_bandpower_windows(s.indices(sio.CL_EE)) is not None + # blind stamp on the assembled file + assert s.metadata["concealed"] is True + assert s.metadata["blind_commitment"] == bd.seed_commitment("s") + assert s.metadata["catalogue_version"] == "vTEST" + + +def test_gather_fails_closed_on_mismatched_blinds(): + parts = make_parts(nbins=1, with_rho=False) + _stamp(parts["xi_reporting"], seed="one") + _stamp(parts["xi_integration"], seed="two") + _stamp(parts["cl"], seed="one") + with pytest.raises(ValueError, match="different blind commitments"): + sio.gather(list(parts.values())) + + +def test_cli_blind_init_refuses_existing_state(tmp_path): + """The blind-init CLI refuses to overwrite a previous blind's state.""" + import importlib.util + + script = ( + pathlib.Path(__file__).resolve().parents[3] / "scripts" / "blind_data_vector.py" + ) + spec = importlib.util.spec_from_file_location("_blind_cli", script) + cli = importlib.util.module_from_spec(spec) + spec.loader.exec_module(cli) + + (tmp_path / "commitment.json").write_text("{}") + with pytest.raises(SystemExit, match="refusing to overwrite"): + cli.main(["blind-init", str(tmp_path)]) + + +# --------------------------------------------------------------------------- # +# AC2 + AC3 + AC7: the shift itself (slow — fork + CCL) +# --------------------------------------------------------------------------- # +@pytest.mark.slow +@pytest.mark.parametrize( + "transfer_function", + ["boltzmann_camb", "eisenstein_hu"], + ids=["default-camb", "non-default-eh"], +) +def test_ac2_on_file_shift_equals_theory_difference_per_part(transfer_function): + """AC2: per-row shift on each blinded part == theory_fn(hidden) − + theory_fn(fiducial), hidden recovered by re-running the fork's draw — + for all three parts, on a two-bin fixture; and the recovered hidden + cosmology is identical across the three parts (one seed → one hidden). + + Scope: this verifies fork-draw recovery + placement (the shift on the + file is exactly what re-running the same backend at the recovered + hidden/fiducial points predicts, at the recorded rows). It is NOT a + backend-correctness test: both sides run the identical ``theory_fn``, so + any wrong-cosmology dependence cancels and a wrong backend would still + pass here. Backend correctness is carried by AC3. + + Parametrized over the Boltzmann backend (#280): the default CAMB route + and one non-default (Eisenstein–Hu — cheap, no CAMB run) both thread the + same ``transfer_function`` knob through all three theory backends.""" + cfg = bd.BlindingConfig.from_overrides( + {"theory": {"transfer_function": transfer_function}} + ) + seed = "ac2-seed" + parts = make_parts(nbins=2, with_rho=False) + + hiddens, worst = [], 0.0 + for name, part in parts.items(): + blinded = bd.blind_sacc(part, seed, config=cfg, log=_NOLOG) + hidden = bd.hidden_params(seed, cfg) # recovered per part + hiddens.append(hidden) + fiducial = cfg.theory.ccl_params() + ((block_name, indices, factory),) = bd._blindable_blocks(part) + # Independent of the blinding path: the factory is driven directly off + # the part, at the hidden point recovered by hidden_params, and the two + # theory vectors are differenced here rather than by the fork. The + # factory fills only its own block, so slice to it. + theory = factory(part, cfg.theory) + expected = (theory(hidden) - theory(fiducial))[indices] + actual = np.array(blinded.mean)[indices] - np.array(part.mean)[indices] + gap = np.max(np.abs(actual - expected)) + scale = np.max(np.abs(expected)) + worst = max(worst, gap / scale) + assert gap <= 1e-10 * max(scale, 1e-30), f"{name}/{block_name}: |Δ|={gap:.3e}" + # one seed → one hidden cosmology across all parts + assert hiddens[0] == hiddens[1] == hiddens[2] + print(f"\nAC2 max relative shift mismatch across parts: {worst:.3e}") + + +@pytest.mark.slow +def test_ac3_cross_backend_against_independent_ccl_reference(): + """AC3: the realized shift matches an independently written direct-CCL + reference (self-contained here; does not touch the blinding backends).""" + import pyccl as ccl + + cfg = bd.BlindingConfig() + seed = "ac3-seed" + reporting = make_xi_part("reporting", nbins=2) + cl_part = make_cl_part(nbins=2) + blinded_xi = bd.blind_sacc(reporting, seed, config=cfg, log=_NOLOG) + blinded_cl = bd.blind_sacc(cl_part, seed, config=cfg, log=_NOLOG) + hidden = bd.hidden_params(seed, cfg) + fiducial = cfg.theory.ccl_params() + + # ----- independent reference (from scratch; same fixture n(z), θ, ℓ) ---- + def ref_cosmo(params): + return ccl.Cosmology( + **params, + matter_power_spectrum="camb", + extra_parameters={ + "camb": {"halofit_version": "mead2020_feedback", "HMCode_logT_AGN": 7.5} + }, + ) + + ell = np.unique( + np.concatenate([np.arange(2, 50), np.geomspace(50, 6e4, 200)]).astype(float) + ) + + def ref_xi(params, nz_i, nz_j, theta): + cosmo = ref_cosmo(params) + ti = ccl.WeakLensingTracer(cosmo, dndz=nz_i) + tj = ccl.WeakLensingTracer(cosmo, dndz=nz_j) + cl = ccl.angular_cl(cosmo, ti, tj, ell) + xip = ccl.correlation(cosmo, ell=ell, C_ell=cl, theta=theta / 60.0, type="GG+") + xim = ccl.correlation(cosmo, ell=ell, C_ell=cl, theta=theta / 60.0, type="GG-") + return xip, xim + + worst = 0.0 + for i, j in bd.xi_pairs(reporting, "reporting"): + tr = sio._pair((i, j)) + theta = sio._tag(reporting, sio.XI_PLUS, tr, "theta", grid="reporting") + nz_i, nz_j = sio.get_nz(reporting, i), sio.get_nz(reporting, j) + xip_h, xim_h = ref_xi(hidden, nz_i, nz_j, theta) + xip_f, xim_f = ref_xi(fiducial, nz_i, nz_j, theta) + for dt, ref_shift in ( + (sio.XI_PLUS, xip_h - xip_f), + (sio.XI_MINUS, xim_h - xim_f), + ): + idx = reporting.indices(dt, tr, grid="reporting") + realized = np.array(blinded_xi.mean)[idx] - np.array(reporting.mean)[idx] + worst = max(worst, np.max(np.abs(realized - ref_shift))) + print(f"\nAC3 max |realized − independent reference| (reporting ξ±): {worst:.3e}") + assert worst < 1e-8 # observed ~1e-10; factor magnitudes ~1e-6 + + # pseudo-Cℓ: W @ ΔCℓ_EE against the same independent reference + for i, j in bd.cl_pairs(cl_part): + tr = sio._pair((i, j)) + idx = cl_part.indices(sio.CL_EE, tr) + window = cl_part.get_bandpower_windows(idx) + w_ell = np.asarray(window.values, dtype=float) + w_mat = np.asarray(window.weight, dtype=float) + nz_i, nz_j = sio.get_nz(cl_part, i), sio.get_nz(cl_part, j) + + def ref_cl(params): + cosmo = ref_cosmo(params) + ti = ccl.WeakLensingTracer(cosmo, dndz=nz_i) + tj = ccl.WeakLensingTracer(cosmo, dndz=nz_j) + return ccl.angular_cl(cosmo, ti, tj, w_ell) + + ref_shift = w_mat.T @ (ref_cl(hidden) - ref_cl(fiducial)) + realized = np.array(blinded_cl.mean)[idx] - np.array(cl_part.mean)[idx] + assert np.max(np.abs(realized - ref_shift)) < 1e-12 # bandpowers ~1e-9 + + +@pytest.mark.slow +def test_ac7_reproducibility_same_seed_same_shift(): + """AC7: two blind runs of the same part with the same (seed, config) + produce identical shifts; a different seed produces a different one.""" + part = make_xi_part("reporting") + b1 = bd.blind_sacc(part, "repro-seed", log=_NOLOG) + b2 = bd.blind_sacc(part, "repro-seed", log=_NOLOG) + assert np.array_equal(np.array(b1.mean), np.array(b2.mean)) + b3 = bd.blind_sacc(part, "other-seed", log=_NOLOG) + assert not np.array_equal(np.array(b1.mean), np.array(b3.mean)) + + +# --------------------------------------------------------------------------- # +# AC1, AC4, AC5, AC9: born-blinded derived statistics (slow + cosmo_numba) +# --------------------------------------------------------------------------- # +@pytest.mark.slow +def test_ac1_zero_shift_is_identity(): + """AC1: a zero envelope reproduces every part exactly, and the integration part + run downstream through the b_modes seams yields COSEBIs and pure-E/B + identical to the unblinded run — the per-part plumbing and the + born-blinded derivation path are the identity at zero shift.""" + pytest.importorskip("cosmo_numba") + zero = bd.BlindingConfig(s8_half_width=0.0, omega_m_half_width=0.0) + parts = make_parts(nbins=1, with_rho=False) + blinded = { + name: bd.blind_sacc(p, "any-seed", config=zero, log=_NOLOG) + for name, p in parts.items() + } + for name, part in parts.items(): + assert np.array_equal(np.array(part.mean), np.array(blinded[name].mean)), ( + f"zero-shift blind changed {name}" + ) + # derived statistics downstream: identical inputs ⇒ identical numbers + En_t, Bn_t, modes_t = _derive_downstream( + parts["xi_reporting"], parts["xi_integration"] + ) + En_b, Bn_b, modes_b = _derive_downstream( + blinded["xi_reporting"], blinded["xi_integration"] + ) + assert np.array_equal(En_t, En_b) and np.array_equal(Bn_t, Bn_b) + for key in modes_t: + t, b = modes_t[key], modes_b[key] + both_nan = np.isnan(t) & np.isnan(b) + assert np.array_equal(t[~both_nan], b[~both_nan]), key + assert np.array_equal(np.isnan(t), np.isnan(b)), key + + +@pytest.mark.slow +def test_ac4_b_mode_invariance_and_leakage_floor(): + """AC4: the ΔBₙ induced by deriving B-modes from the blinded integration ξ± is + independent of the injected B amplitude (a fixed absolute E→B leakage + offset, not fractional). The magnitude is measured and reported, never + asserted against a constant.""" + pytest.importorskip("cosmo_numba") + seed = "ac4-seed" + deltas, reports = [], [] + for amp in (2e-6, 2e-5): + reporting = make_xi_part("reporting") + integration = make_xi_part("integration", b_amplitude=amp) + blinded_reporting = bd.blind_sacc(reporting, seed, log=_NOLOG) + blinded_integration = bd.blind_sacc(integration, seed, log=_NOLOG) + _, Bn_t, modes_t = _derive_downstream(reporting, integration) + _, Bn_b, modes_b = _derive_downstream(blinded_reporting, blinded_integration) + d_bn = Bn_b - Bn_t + d_xib = modes_b["xip_B"] - modes_t["xip_B"] + finite = np.isfinite(d_xib) + deltas.append((d_bn, d_xib[finite])) + reports.append( + f"B={amp:.0e}: max|ΔBₙ|={np.max(np.abs(d_bn)):.3e} " + f"(ΔBₙ/Bₙ={np.max(np.abs(d_bn)) / np.max(np.abs(Bn_t)):.2e}), " + f"max|Δξ+_B|={np.max(np.abs(d_xib[finite])):.3e} " + f"({np.max(np.abs(d_xib[finite])) / amp:.2%} of injected B)" + ) + print("\nAC4 " + "\nAC4 ".join(reports)) + + (d_bn_1, d_xib_1), (d_bn_2, d_xib_2) = deltas + scale = max(np.max(np.abs(d_bn_1)), 1e-30) + gap = np.max(np.abs(d_bn_1 - d_bn_2)) + print( + f"AC4 ΔBₙ amplitude-independence: max|ΔBₙ(2e-6) − ΔBₙ(2e-5)| = " + f"{gap:.3e} ({gap / scale:.2e} of |ΔBₙ|)" + ) + assert gap <= 1e-9 * scale + 1e-24, ( + "ΔBₙ depends on the injected B amplitude — the shift is not pure E" + ) + # The pure-ξ_B leakage is also amplitude-independent, but only to the + # adaptive-quadrature floor: cosmo_numba's Schneider integrals subdivide + # adaptively, so the estimator is not bit-linear in its inputs and the + # two runs differ at a small fraction of the (tiny) leakage itself. The + # COSEBIs assertion above carries the exact-identity criterion; this one + # bounds the quadrature wobble. + scale_x = max(np.max(np.abs(d_xib_1)), 1e-30) + gap_x = np.max(np.abs(d_xib_1 - d_xib_2)) + print( + f"AC4 Δξ+_B amplitude-independence: {gap_x:.3e} " + f"({gap_x / scale_x:.2e} of the leakage)" + ) + assert gap_x <= 0.05 * scale_x + + +@pytest.mark.slow +def test_ac5_untouched_blocks_and_row_order(): + """AC5: each part's covariance byte-identical; the Cℓ BB/EB rows and the + ρ/τ part never blinded; every part's shifted rows land at their original + within-part indices (order-preservation).""" + parts = make_parts(nbins=1) + seed = "ac5-seed" + blinded = { + name: bd.blind_sacc(parts[name], seed, log=_NOLOG) + for name in ("xi_reporting", "xi_integration", "cl") + } + for name, b in blinded.items(): + part = parts[name] + assert np.array_equal(b.covariance.dense, part.covariance.dense), name + # row order: the identity of every row (type/tracers/tags) unchanged + for a, c in zip(part.data, b.data): + assert (a.data_type, a.tracers, a.tags) == (c.data_type, c.tracers, c.tags) + # BB/EB rows of the Cℓ part untouched (pure E-mode shift) + for dt in (sio.CL_BB, sio.CL_EB): + idx = parts["cl"].indices(dt) + assert np.array_equal( + np.array(blinded["cl"].mean)[idx], np.array(parts["cl"].mean)[idx] + ), f"{dt} was touched by the blind" + # the blindable rows did move (the blind actually blinded) + for name, grid in ( + ("xi_reporting", "reporting"), + ("xi_integration", "integration"), + ): + idx = bd._xi_indices(parts[name], grid) + assert not np.allclose( + np.array(blinded[name].mean)[idx], np.array(parts[name].mean)[idx], atol=0 + ) + # ρ/τ: refused by blind_sacc (test_blind_refuses_non_blindable_part) and + # exempt in assembly — pass through gather untouched + s = sio.gather( + [ + blinded["xi_reporting"], + parts["rho_tau"], + blinded["cl"], + blinded["xi_integration"], + ] + ) + idx = s.indices(sio.RHO_PLUS.format(k=0)) + assert np.array_equal( + np.array(s.mean)[idx], + np.array(parts["rho_tau"].mean)[ + parts["rho_tau"].indices(sio.RHO_PLUS.format(k=0)) + ], + ) + + +@pytest.mark.slow +def test_ac9_pure_eb_nan_parity_under_blind(): + """AC9: the pure-E/B NaN pattern born from the blinded parts is identical + to the true parts' — blinding never moves a NaN. + + The Schneider estimator returns NaN wherever a reporting point lacks + interior support against the edge-based integration bounds. Whatever + that pattern is on the true parts (the fixture puts the outermost + reporting point at the boundary, so it is non-empty here; on production + files it is empty), the blinded derivation must reproduce it bit-for-bit: + the blind is a pure shift of the estimator's inputs, not a change of + estimator support. The finite values move (the ξ± shifted); the NaN mask + does not.""" + pytest.importorskip("cosmo_numba") + seed = "ac9-seed" + reporting, integration = make_xi_part("reporting"), make_xi_part("integration") + _, _, modes_t = _derive_downstream(reporting, integration) + _, _, modes_b = _derive_downstream( + bd.blind_sacc(reporting, seed, log=_NOLOG), + bd.blind_sacc(integration, seed, log=_NOLOG), + ) + for key in modes_t: + t, b = modes_t[key], modes_b[key] + assert np.array_equal(np.isnan(t), np.isnan(b)), ( + f"blinding moved the pure-E/B NaN pattern for {key}" + ) + # the finite values did move (the blind actually shifted the ξ±) + t, b = modes_t["xip_E"], modes_b["xip_E"] + finite = np.isfinite(t) + assert finite.any() and not np.allclose(t[finite], b[finite], atol=0) + + +# --------------------------------------------------------------------------- # +# AC6 + AC8: end-to-end custody through the file surface (slow + cosmo_numba) +# --------------------------------------------------------------------------- # +@pytest.mark.slow +def test_ac6_ac8_end_to_end_init_parts_gather_unblind(tmp_path): + """AC8: blind-init → blind-part on each intermediate part → terminal + gather (hash assertion passes, stamp lands) → unblind restores each part + bit-for-bit, and the derived statistics re-derived from the unblinded + integration part reproduce the truth. AC6: no plaintext part or seed survives + on disk, no ``seed_smokescreen`` key; unblind fails closed on a tampered + commitment.""" + pytest.importorskip("cosmo_numba") + parts = make_parts(nbins=1) + En_true, Bn_true, modes_true = _derive_downstream( + parts["xi_reporting"], parts["xi_integration"] + ) + + blind_dir = tmp_path / "blind" + blind_dir.mkdir() + init = bd.blind_init(str(blind_dir), log=_NOLOG) + + part_files, out_paths = {}, {} + for name in ("xi_reporting", "xi_integration", "cl"): + path = tmp_path / f"{name}.fits" + sio.save(parts[name], str(path), type="mock") + out_paths[name] = bd.blind_part(str(path), str(blind_dir), log=_NOLOG) + part_files[name] = path + + # -- custody hygiene (AC6) --------------------------------------------- -- + for name, path in part_files.items(): + assert not path.exists(), f"plaintext part {name} was not deleted" + blinded = sio.load(out_paths[name]["blinded"]) + assert blinded.metadata["concealed"] is True + assert "seed_smokescreen" not in blinded.metadata + assert pathlib.Path(out_paths[name]["escrow"]).exists() + assert not np.array_equal(np.array(blinded.mean), np.array(parts[name].mean)) + with open(init["commitment"], encoding="utf-8") as f: + commitment = json.load(f) + assert set(commitment) == { + "label", + "seed_commitment", + "config_digest", + "draw_scheme", + } + blinded_parts = {n: sio.load(p["blinded"]) for n, p in out_paths.items()} + for b in blinded_parts.values(): + assert b.metadata["blind_commitment"] == commitment["seed_commitment"] + # no plaintext json anywhere beside the blind outputs + assert not list(tmp_path.rglob("*escrow.json")) + assert not (blind_dir / "blind_seed.json").exists() + + # -- terminal assembly: hash assertion + stamp (AC8) -------------------- -- + assembled = sio.gather( + [ + blinded_parts["xi_reporting"], + blinded_parts["cl"], + parts["rho_tau"], + blinded_parts["xi_integration"], + ], + metadata={"catalogue_version": "vTEST", "type": "mock"}, + ) + assert assembled.metadata["blind_commitment"] == commitment["seed_commitment"] + # born-blinded derived statistics from the blinded parts differ from truth + En_b, Bn_b, _ = _derive_downstream( + blinded_parts["xi_reporting"], blinded_parts["xi_integration"] + ) + assert not np.allclose(En_b, En_true, atol=0) + + # -- fail-closed on tampered commitment (AC6) --------------------------- -- + tampered = dict(commitment, seed_commitment="0" * 64) + with open(init["commitment"], "w", encoding="utf-8") as f: + json.dump(tampered, f) + with pytest.raises(ValueError, match="committed seed commitment"): + bd.unblind_part( + out_paths["xi_integration"]["blinded"], + str(blind_dir), + str(tmp_path / "never.fits"), + log=_NOLOG, + ) + with open(init["commitment"], "w", encoding="utf-8") as f: + json.dump(commitment, f) + with pytest.raises(ValueError, match="config digest"): + bd.unblind_part( + out_paths["xi_integration"]["blinded"], + str(blind_dir), + str(tmp_path / "never.fits"), + config=bd.BlindingConfig(s8_half_width=0.01), + log=_NOLOG, + ) + + # -- bit-for-bit restoration per part (AC8) ----------------------------- -- + restored = {} + for name in ("xi_reporting", "xi_integration", "cl"): + out = tmp_path / f"{name}_restored.fits" + bd.unblind_part( + out_paths[name]["blinded"], str(blind_dir), str(out), log=_NOLOG + ) + restored[name] = sio.load(str(out)) + assert np.array_equal( + np.array(restored[name].mean), np.array(parts[name].mean) + ), f"{name} not restored bit-for-bit" + assert not restored[name].metadata.get("concealed", False) + assert "blind_commitment" not in restored[name].metadata + + # unblinding then re-deriving reproduces the true derived statistics + En_r, Bn_r, modes_r = _derive_downstream( + restored["xi_reporting"], restored["xi_integration"] + ) + assert np.array_equal(En_r, En_true) and np.array_equal(Bn_r, Bn_true) + for key in modes_true: + t, r = modes_true[key], modes_r[key] + both_nan = np.isnan(t) & np.isnan(r) + assert np.array_equal(t[~both_nan], r[~both_nan]), key + assert np.array_equal(np.isnan(t), np.isnan(r)), key + + +def test_ac8_dotted_versioned_part_names_escrow_and_restore(tmp_path): + """AC8 under the canonical catalogue-version naming (dotted stems). + + Production part files carry the versioned name ``v1.4.6.3_xi_reporting.fits`` + etc. ``smokescreen.encryption.encrypt_file`` names its outputs from + ``basename.split('.')[0]``, so both these parts would misfile onto + ``v1.encrpt``/``v1.key`` and the second would silently overwrite the + first's escrowed truth. Guard: the escrow lands at the exact + :func:`part_paths` name, two dot-prefix-sharing parts do not collide, and + each restores bit-for-bit.""" + parts = make_parts(nbins=1) + blind_dir = tmp_path / "blind" + blind_dir.mkdir() + bd.blind_init(str(blind_dir), log=_NOLOG) + + version = "v1.4.6.3" + out_paths, part_files = {}, {} + for name in ("xi_reporting", "xi_integration"): + path = tmp_path / f"{version}_{name}.fits" + sio.save(parts[name], str(path), type="mock") + out_paths[name] = bd.blind_part(str(path), str(blind_dir), log=_NOLOG) + part_files[name] = path + + # escrow bundles landed at the declared names (no split('.') truncation), + # and the two dot-prefix-sharing parts did not collide onto one bundle. + escrow_files = {n: p["escrow"] for n, p in out_paths.items()} + assert escrow_files["xi_reporting"] != escrow_files["xi_integration"] + for name, path in part_files.items(): + assert not path.exists(), f"plaintext part {name} was not deleted" + assert pathlib.Path(out_paths[name]["escrow"]).exists(), name + assert pathlib.Path(out_paths[name]["escrow_key"]).exists(), name + # the truncated-name collision target must not exist + assert not (tmp_path / "v1.encrpt").exists() + assert not (tmp_path / "v1.key").exists() + assert not list(tmp_path.rglob("*escrow.json")) + + # each part restores bit-for-bit via its own escrow (not subtraction-only) + for name in ("xi_reporting", "xi_integration"): + out = tmp_path / f"{version}_{name}_restored.fits" + bd.unblind_part( + out_paths[name]["blinded"], str(blind_dir), str(out), log=_NOLOG + ) + restored = sio.load(str(out)) + assert np.array_equal(np.array(restored.mean), np.array(parts[name].mean)), ( + f"{name} not restored bit-for-bit" + ) diff --git a/src/sp_validation/tests/test_blinding_wiring.py b/src/sp_validation/tests/test_blinding_wiring.py new file mode 100644 index 00000000..c5e01029 --- /dev/null +++ b/src/sp_validation/tests/test_blinding_wiring.py @@ -0,0 +1,389 @@ +"""Tests for the Snakemake blind-at-birth wiring, independent of a live cluster. + +Covers ``workflow/common.py``'s part-path and run-type helpers, and the +data-run fail-closed assembly: ``assemble_sacc`` must refuse an unblinded +``type='data'`` part and succeed once every part is concealed under one +commitment. A candide-only test additionally asserts the blinding subgraph +resolves in the cosmo_val DAG dry-run. +""" + +import importlib.util +import json +import os +import re +import subprocess +import sys +import types +from pathlib import Path + +import numpy as np +import pytest + +from sp_validation import blinding +from sp_validation import sacc_io as sio +from sp_validation.cosmo_val import sacc_writers as sw + + +def _repo_root(): + return next( + p for p in Path(__file__).resolve().parents if (p / "pyproject.toml").exists() + ) + + +def _load_module(rel_path, name): + """Import a workflow module/script by file path (off the package path).""" + path = _repo_root() / rel_path + spec = importlib.util.spec_from_file_location(name, path) + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + return module + + +common = _load_module("workflow/common.py", "wf_common") +asm = _load_module("workflow/scripts/assemble_sacc.py", "assemble_sacc") + + +# --------------------------------------------------------------------------- # +# 1. common.py part-path and run-type helpers +# --------------------------------------------------------------------------- # +_STEMS = [ + "SP_v1.4.6.3_xi_minsep=1.0_maxsep=250.0_nbins=20_npatch=100", + "SP_v1.4.6.3_leak_corr_xi_minsep=0.08_maxsep=300.0_nbins=1000_npatch=1", + "pseudo_cl_analysis_SP_v1.4.6.3_powspace_nbins=32", + "pseudo_cl_analysis_SP_v1.4.6.3_leak_corr_powspace_nbins=32", +] + + +@pytest.mark.parametrize( + "stem,expected", + [ + (_STEMS[0], "SP_v1.4.6.3"), + (_STEMS[1], "SP_v1.4.6.3_leak_corr"), + (_STEMS[2], "SP_v1.4.6.3"), + (_STEMS[3], "SP_v1.4.6.3_leak_corr"), + ], +) +def test_version_of_extracts_catalogue_version(stem, expected): + assert common.version_of(stem) == expected + + +def test_version_of_raises_without_version(): + with pytest.raises(ValueError, match="no catalogue version"): + common.version_of("cosebis_no_version_here") + + +def test_blindable_part_switches_on_run_type(monkeypatch): + part = "/out/SP_v1.4.6.3_xi_minsep=0.08_maxsep=300_nbins=1000_npatch=1.sacc" + monkeypatch.setattr(common, "RUN_TYPE", "data") + assert common.blindable_part(part) == common.blinded_path(part) + monkeypatch.setattr(common, "RUN_TYPE", "mock") + assert common.blindable_part(part) == part + + +# --------------------------------------------------------------------------- # +# 2. Data-run fail-closed assembly (#252 terminal custody gate) +# --------------------------------------------------------------------------- # +META = {"catalogue_version": "vSYNTH", "npatch": 1} +# Two arbitrary-but-consistent hex stamps standing in for a real blind's +# seed commitment / config digest; the assembly only checks they agree across parts. +_COMMIT = "a" * 64 +_DIGEST = "b" * 64 + + +def _nz(): + return np.linspace(0.01, 2.0, 40), np.random.default_rng(0).uniform(0.1, 1.0, 40) + + +def _spd(n, seed): + a = np.random.default_rng(seed).normal(size=(n, n)) + return a @ a.T + n * np.eye(n) + + +def _xi_cov(tmp_path, n_theta=6): + """The analytic ξ± covariance assembly injects, as a CosmoCov-format .txt. + + Custody is what these tests are about, and the injected covariance carries + none of it — it is a theory product — so any SPD block of the right size + stands in. + """ + path = tmp_path / "xi_cov_processed.txt" + np.savetxt(str(path), _spd(2 * n_theta, 77)) + return str(path) + + +def _data_parts(tmp_path, *, conceal, one_plaintext=False, run_type="data"): + """Write the five per-statistic parts, stamped ``type=run_type``. + + ``conceal`` stamps every part with the shared blind (concealed=True). With + ``one_plaintext`` the ξ± reporting part is left unconcealed — a blinded / + plaintext mix the assembly must refuse. ``run_type='mock'`` writes the parts + as a mock campaign's producers do, which is the only way an unconcealed + blindable part is allowed through the assembly. + """ + nz = {0: _nz()} + theta = np.geomspace(1.0, 100.0, 6) + + xi = sw.xi_to_sacc( + nz, META, theta, np.arange(6) * 1e-5, np.arange(6) * 2e-5, grid="reporting" + ) + xi.add_covariance(_spd(len(xi.mean), 1)) + co = sw.cosebis_to_sacc( + nz, + META, + { + "En": np.arange(1, 6) * 1e-6, + "Bn": np.arange(1, 6) * 1e-7, + "cov": _spd(10, 3), + }, + (1.0, 100.0), + ) + eb_arrays = {k: np.arange(6) * (i + 1) * 1e-6 for i, k in enumerate(sio.PURE_KEYS)} + eb = sw.pure_eb_to_sacc(nz, META, theta, eb_arrays, covariance=_spd(36, 4)) + rho = {"theta": theta} + tau = {"theta": theta} + rng = np.random.default_rng(5) + for k in sw.RHO_K: + for s in ("p", "m"): + rho[f"rho_{k}_{s}"] = rng.normal(size=6) * 1e-6 + rho[f"varrho_{k}_{s}"] = rng.uniform(1e-14, 1e-13, 6) + for k in sw.TAU_K: + for s in ("p", "m"): + tau[f"tau_{k}_{s}"] = rng.normal(size=6) * 1e-6 + tau[f"vartau_{k}_{s}"] = rng.uniform(1e-14, 1e-13, 6) + rt = sw.rho_tau_to_sacc(nz, META, rho, tau) + + parts = {"xi_reporting": xi, "cosebis": co, "pure_eb": eb, "rho_tau": rt} + paths = {} + for name, part in parts.items(): + if conceal and not (one_plaintext and name == "xi_reporting"): + blinding._stamp_provenance(part, _COMMIT, "A", _DIGEST) + p = tmp_path / f"{name}.sacc" + sio.save(part, str(p), type=run_type) + paths[name] = str(p) + return paths + + +def test_data_assemble_fails_closed_on_unblinded_part(tmp_path): + """A data run refuses to assemble an unconcealed real part (fail closed).""" + paths = _data_parts(tmp_path, conceal=False) + with pytest.raises(ValueError, match="refusing to load an unblinded"): + asm.assemble_sacc( + "vSYNTH", + paths, + str(tmp_path / "vSYNTH.sacc"), + xi_cov=_xi_cov(tmp_path), + ) + + +def test_data_assemble_passes_on_blinded_parts(tmp_path): + """With every part concealed under one blind, the data-run assembly succeeds + and stamps the shared commitment on the terminal file.""" + paths = _data_parts(tmp_path, conceal=True) + out = tmp_path / "vSYNTH.sacc" + s = asm.assemble_sacc("vSYNTH", paths, str(out), xi_cov=_xi_cov(tmp_path)) + assert s.metadata["concealed"] is True + assert s.metadata["blind_commitment"] == _COMMIT + assert s.metadata["blind_config_digest"] == _DIGEST + # Round-trips through the fail-closed load gate without an escape hatch. + assert sio.load(str(out)).metadata["concealed"] is True + + +def test_data_assemble_refuses_blinded_plaintext_mix(tmp_path): + """A concealed ξ± beside a plaintext one is a custody violation — refuse.""" + paths = _data_parts(tmp_path, conceal=True, one_plaintext=True) + # The plaintext ξ± reporting part fails the load gate first (data + not + # concealed), so the mix can never even reach assembly. + with pytest.raises(ValueError, match="refusing to load an unblinded"): + asm.assemble_sacc( + "vSYNTH", + paths, + str(tmp_path / "vSYNTH.sacc"), + xi_cov=_xi_cov(tmp_path), + ) + + +def test_data_assemble_runs_behind_the_custody_guard(tmp_path, monkeypatch): + """The custody guard is reached *through* the production assembly. + + Every part here is concealed, so every part clears the fail-closed load + gate — the earlier tests all stop there. Only + ``blinding.assert_consistent_blind`` can catch what is wrong with this + assembly: the install's Smokescreen draws shifts under a different scheme + than the one that made the blind, so it could never unblind what it is + about to write. That ``assemble_sacc`` raises is the check that it runs + through :func:`sacc_io.gather` like every other assembly path, rather than + reimplementing the custody wrapper around its own assembler. + """ + paths = _data_parts(tmp_path, conceal=True) + monkeypatch.setattr(blinding, "draw_scheme", lambda: 99) + with pytest.raises(ValueError, match="DRAW_SCHEME"): + asm.assemble_sacc( + "vSYNTH", + paths, + str(tmp_path / "vSYNTH.sacc"), + xi_cov=_xi_cov(tmp_path), + ) + + +def test_data_assemble_stamps_the_draw_scheme_on_the_terminal_file(tmp_path): + """The assembled file carries the blind's draw scheme, like its parts.""" + paths = _data_parts(tmp_path, conceal=True) + out = tmp_path / "vSYNTH.sacc" + asm.assemble_sacc("vSYNTH", paths, str(out), xi_cov=_xi_cov(tmp_path)) + assert sio.load(str(out)).metadata["blind_draw_scheme"] == blinding.draw_scheme() + + +def test_mock_assemble_succeeds_without_a_blind(tmp_path): + """A mock campaign assembles its plaintext parts — the gate's mock branch is + reachable from real producers, not only from test fixtures. + + Every part writer stamps the campaign's run type (CosmologyValidation's + ``run_type``, ``run_2pcf``'s ``run_type=`` / ``--run-type``), so a ``mock`` campaign's parts declare themselves mocks and + ``assert_consistent_blind`` lets them through unconcealed. The same parts + stamped ``type='data'`` fail closed — that is + ``test_data_assemble_fails_closed_on_unblinded_part``. + """ + paths = _data_parts(tmp_path, conceal=False, run_type="mock") + out = tmp_path / "vSYNTH.sacc" + s = asm.assemble_sacc("vSYNTH", paths, str(out), xi_cov=_xi_cov(tmp_path)) + assert "concealed" not in s.metadata + # No escape hatch: a mock part is not gated by the fail-closed loader. + assert sio.load(str(out)).metadata["type"] == "mock" + + +def test_rho_tau_part_is_stamped_concealed_from_the_commitment(tmp_path): + """ρ/τ carries no cosmological vector, but a data run's assembly still opens + it through the fail-closed load gate — so its writer must stamp it. + + This drives the real writer (``PSFSystematicsMixin.rho_tau_to_sacc_part``) + with the commitment the ``rho_tau_stats`` rule binds on a data run, and + checks the emitted part loads without the escape hatch. Without the stamp a + data run's ``assemble_sacc`` dies on the ρ/τ part before custody is ever + checked. + """ + from sp_validation.cosmo_val.core import CosmologyValidation + from sp_validation.cosmo_val.psf_systematics import PSFSystematicsMixin + + root = tmp_path / "blind" + blind_dir = root / "vSYNTH" + blind_dir.mkdir(parents=True) + commitment = blinding.blind_init(str(blind_dir), log=lambda *_: None)["commitment"] + theta = np.geomspace(1.0, 100.0, 6) + rng = np.random.default_rng(11) + rho = {"theta": theta} + tau = {"theta": theta} + for k in sw.RHO_K: + for sign in ("p", "m"): + rho[f"rho_{k}_{sign}"] = rng.normal(size=6) * 1e-6 + rho[f"varrho_{k}_{sign}"] = rng.uniform(1e-14, 1e-13, 6) + for k in sw.TAU_K: + for sign in ("p", "m"): + tau[f"tau_{k}_{sign}"] = rng.normal(size=6) * 1e-6 + tau[f"vartau_{k}_{sign}"] = rng.uniform(1e-14, 1e-13, 6) + + class _Writer(PSFSystematicsMixin): + """The writer's collaborators, stubbed — the method under test is real.""" + + run_type = "data" + blind_root = str(root) + # The real per-version resolution is part of what this test covers. + commitment_path = CosmologyValidation.commitment_path + + def sacc_nz(self, version): + return {0: _nz()} + + def sacc_metadata(self, version): + return dict(META) + + def print_magenta(self, *args, **kwargs): + pass + + out_dir = tmp_path / "rho_tau_stats" + out_dir.mkdir() + _Writer().rho_tau_to_sacc_part( + "vSYNTH", + str(out_dir), + "vSYNTH", + types.SimpleNamespace(rho_stats=rho), + types.SimpleNamespace(tau_stats=tau), + ) + + written = sio.load(str(out_dir / "rho_tau_vSYNTH.sacc")) + assert written.metadata["concealed"] is True + assert written.metadata["blind_draw_scheme"] == blinding.draw_scheme() + with open(commitment, encoding="utf-8") as f: + committed = json.load(f) + assert written.metadata["blind_commitment"] == committed["seed_commitment"] + assert written.metadata["blind_config_digest"] == committed["config_digest"] + + +def test_assert_consistent_blind_rejects_divergent_commitments(tmp_path): + """Two ξ± parts blinded under different commitments must never combine.""" + nz = {0: _nz()} + theta = np.geomspace(1.0, 100.0, 6) + a = sw.xi_to_sacc( + nz, META, theta, np.arange(6) * 1e-5, np.arange(6) * 2e-5, grid="reporting" + ) + b = sw.xi_to_sacc( + nz, META, theta, np.arange(6) * 1e-5, np.arange(6) * 2e-5, grid="integration" + ) + blinding._stamp_provenance(a, _COMMIT, "A", _DIGEST) + blinding._stamp_provenance(b, "c" * 64, "A", _DIGEST) + with pytest.raises(ValueError, match="different blind commitments"): + blinding.assert_consistent_blind([a, b]) + + +# --------------------------------------------------------------------------- # +# 3. The blinding subgraph resolves in the cosmo_val DAG (candide-only) +# --------------------------------------------------------------------------- # +requires_candide_data = pytest.mark.skipif( + not Path("/n17data/cdaley/unions").exists(), + reason="candide-local workflow config/data (/n17data) absent — off-cluster", +) + + +@requires_candide_data +def test_blinding_subgraph_in_cosmo_val_dry_run(): + """A data-run cosmo_val assemble pulls blind_init + blind_part, and binds the + ξ± / pseudo-Cℓ parts to their *_blinded siblings.""" + env = os.environ | {"PYTHONNOUSERSITE": "1", "PYTHONUNBUFFERED": "1"} + env.pop("SNAKEMAKE_PROFILE", None) + result = subprocess.run( + [ + sys.executable, + "-m", + "snakemake", + "assemble_sacc_all", + "--dry-run", + "--cores", + "1", + "--configfile", + "config/config.yaml", + ], + cwd=_repo_root() / "papers/cosmo_val", + env=env, + text=True, + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + timeout=180, + check=False, + ) + assert result.returncode == 0, result.stdout + out = result.stdout + assert "rule blind_init:" in out, out + assert "rule blind_part:" in out, out + # assemble consumes the blinded ξ± reporting and pseudo-Cℓ. The integration + # ξ± is not gathered into the terminal file (per the #247 ruling), but the + # COSEBIs / pure-E/B consumers now bind the blinded integration part (via + # blindable_part) to re-derive their concealed E-modes, so blind_part enters + # the subgraph for it too. + assert "_xi_minsep=1.0_maxsep=250.0_nbins=20_npatch=100_blinded.sacc" in out + # maxsep=300.0, not 300: the grid table canonicalises before it names files. + assert "_xi_minsep=0.08_maxsep=300.0_nbins=1000_npatch=1_blinded.sacc" in out + assert "pseudo_cl_analysis_SP_v1.4.6.3_powspace_nbins=32_blinded.sacc" in out + # Every blindable plaintext part is temp() on a data run, the analysis + # pseudo-Cℓ included (its own rule exists so it can be). + assert "Would remove temporary output" in out, out + assert re.search( + r"Would remove temporary output \S*pseudo_cl_analysis_\S+\.sacc", out + ), out diff --git a/src/sp_validation/tests/test_bmodes_workflow_dry_run.py b/src/sp_validation/tests/test_bmodes_workflow_dry_run.py index 3b7eecae..fa963b55 100644 --- a/src/sp_validation/tests/test_bmodes_workflow_dry_run.py +++ b/src/sp_validation/tests/test_bmodes_workflow_dry_run.py @@ -82,7 +82,7 @@ def test_cosmo_val_workflow_assemble_dry_runs(): # covariance (not the untagged cv_pseudo_cl diagnostic), plus every part. out = result.stdout assert "rule assemble_sacc:" in out, out - assert f"pseudo_cl_{version}_blind=A_powspace_nbins=32.sacc" in out, out + assert f"pseudo_cl_analysis_{version}_powspace_nbins=32.sacc" in out, out assert f"pseudo_cl_cov_{version}_blind=A_powspace_nbins=32.fits" in out, out for part in ("_xi_minsep=", "_cosebis.sacc", "_pure_eb.sacc", "rho_tau_"): assert part in out, f"missing {part} part in assemble DAG:\n{out}" diff --git a/src/sp_validation/tests/test_camb_ccl_crosscheck.py b/src/sp_validation/tests/test_camb_ccl_crosscheck.py new file mode 100644 index 00000000..3f286474 --- /dev/null +++ b/src/sp_validation/tests/test_camb_ccl_crosscheck.py @@ -0,0 +1,175 @@ +"""CAMB↔CCL theory cross-check (blinding PRD AC10–14). + +The blinding shift is a difference of CCL theory vectors; downstream +inference runs CAMB (CosmoSIS). The shift only means what it is intended to +mean if CCL and CAMB predict the same ξ± at a fixed cosmology on our θ grid. +This module asserts that agreement between the two independent ξ± paths in +:mod:`sp_validation.blinding_theory`: + +- **Path A** (:func:`~sp_validation.blinding_theory.xi_ccl`): CCL-native — CCL's + Boltzmann-CAMB HMCode2020 P(k) route, projected by CCL Limber + FFTLog. +- **Path B** (:func:`~sp_validation.blinding_theory.xi_camb`): an independent + pycamb run produces the HMCode2020 ``P(k, z)`` (σ8-matched ``A_s``), + wrapped in a ``ccl.Pk2D`` and projected through the same CCL machinery. + +Because both paths route their nonlinear P(k) through CAMB's HMCode2020 and +both project through CCL, a common Limber+FFTLog bug cancels: this test +validates the **P(k) recipe** and the **σ8/A_s amplitude convention**, not +the projection. The one convention subtlety it settles: the fiducial fixes +σ8 for CCL but A_s for CAMB; a nominal ``A_s = 2.1e-9`` leaves CAMB's σ8 +≈3% off target — enough to blow a ξ± comparison to ~9–10%. +""" + +import pathlib +import re + +import numpy as np +import pytest + +from sp_validation import blinding_theory as cm + +# Tolerances (AC11/AC12). Observed floor on this fixture: see the printed +# numbers in the slow tests — the tolerances sit above the floor with +# headroom; version bumps move the floor and that is not a regression. +XIP_RTOL = 0.005 # 0.5 % +XIM_RTOL = 0.010 # 1.0 % +# ξ− crosses zero on this grid: the relative assertion applies only where +# |ξ−| exceeds an absolute floor set from the fixture's peak |ξ−|. +XIM_FLOOR_FRAC = 0.05 + + +# --------------------------------------------------------------------------- # +# Deterministic fixture: one Gaussian source bin, 12-point θ grid +# --------------------------------------------------------------------------- # +def _gauss_nz(n=400): + z = np.linspace(0.01, 3.0, n) + nz = np.exp(-0.5 * ((z - 0.7) / 0.2) ** 2) + return z, nz / np.trapezoid(nz, z) + + +THETA_ARCMIN = np.geomspace(5.0, 250.0, 12) + + +def _both_paths(config, **camb_kwargs): + z, nz = _gauss_nz() + xip_a, xim_a = cm.xi_ccl( + config.ccl_params(), config, (z, nz), (z, nz), THETA_ARCMIN + ) + xip_b, xim_b, As = cm.xi_camb(config, (z, nz), THETA_ARCMIN, **camb_kwargs) + return (xip_a, xim_a), (xip_b, xim_b), As + + +def _assert_xi_agreement(a, b, label): + (xip_a, xim_a), (xip_b, xim_b) = a, b + assert np.all(xip_a > 0) and np.all(xip_b > 0) # sensible cosmic shear + rel_p = np.abs(xip_b - xip_a) / np.abs(xip_a) + assert rel_p.max() < XIP_RTOL, ( + f"{label}: ξ+ max rel diff {rel_p.max():.3%} ≥ {XIP_RTOL:.1%}" + ) + floor = XIM_FLOOR_FRAC * np.max(np.abs(xim_a)) + above = np.abs(xim_a) > floor + rel_m = np.abs(xim_b - xim_a)[above] / np.abs(xim_a)[above] + assert rel_m.max() < XIM_RTOL, ( + f"{label}: ξ− max rel diff {rel_m.max():.3%} ≥ {XIM_RTOL:.1%} (on |ξ−| > floor)" + ) + # near the zero crossing: absolute agreement at the floor scale + abs_m = np.abs(xim_b - xim_a)[~above] + if len(abs_m): + assert abs_m.max() < XIM_RTOL * floor, ( + f"{label}: ξ− absolute diff {abs_m.max():.3e} near zero crossing" + ) + print( + f"\n{label}: ξ+ max rel {rel_p.max():.3%}; " + f"ξ− max rel {rel_m.max():.3%} (above floor, " + f"{above.sum()}/{len(above)} points)" + ) + + +# --------------------------------------------------------------------------- # +# AC10: σ8/A_s reconciliation +# --------------------------------------------------------------------------- # +@pytest.mark.slow +def test_ac10_sigma8_As_reconciliation(): + """(a) nominal A_s leaves CAMB's σ8 >2% off target — the convention + offset is real; (b) the closed-form rescale lands on target to <1e-4.""" + cfg = cm.TheoryConfig() + target = cfg.sigma8() + + nominal = cm.camb_linear_sigma8(cfg, 2.1e-9) + offset = abs(nominal / target - 1) + print(f"\nAC10 nominal-A_s σ8 offset: {offset:.4f}") + assert offset > 0.02 + + As = cm.camb_As_for_sigma8(cfg, target) + matched = cm.camb_linear_sigma8(cfg, As) + print(f"AC10 σ8-matched residual: {abs(matched - target):.2e} (A_s={As:.4e})") + assert abs(matched - target) < 1e-4 + + +# --------------------------------------------------------------------------- # +# AC11 + AC12: ξ± agreement at and off the fiducial +# --------------------------------------------------------------------------- # +@pytest.mark.slow +def test_ac11_xi_agreement_at_fiducial(): + cfg = cm.TheoryConfig() + a, b, _ = _both_paths(cfg) + _assert_xi_agreement(a, b, "AC11 fiducial") + + +@pytest.mark.slow +def test_ac12_xi_agreement_off_fiducial(): + """A representative in-envelope offset — the *shift* (a difference of two + theory vectors) must not inherit a stack-disagreement bias.""" + cfg = cm.TheoryConfig.from_overrides({"S8": 0.80 + 0.075, "Omega_m": 0.30 - 0.05}) + a, b, _ = _both_paths(cfg) + _assert_xi_agreement(a, b, "AC12 off-fiducial") + + +# --------------------------------------------------------------------------- # +# AC13: halofit token pinned to the inference config (fast) +# --------------------------------------------------------------------------- # +def test_ac13_halofit_token_matches_inference_config(): + """The blinding fiducial's CCL halofit token equals the CosmoSIS + inference config's ``halofit_version`` — asserted against the config + file itself. All three blinding backends share one recipe by + construction and would agree with each other while jointly diverging + from the inference stack, so this cannot be caught by the cross-backend + test and is asserted independently here.""" + ini = ( + pathlib.Path(__file__).resolve().parents[3] + / "cosmo_inference" + / "cosmosis_config" + / "templates" + / "cosmosis_pipeline_A_ia_cell.ini" + ) + match = re.search(r"^halofit_version\s*=\s*(\S+)", ini.read_text(), re.MULTILINE) + assert match, f"no halofit_version in {ini}" + inference_token = match.group(1) + cfg = cm.TheoryConfig() + assert cfg.ccl_halofit_version == inference_token + # the two stack tokens denote ONE recipe; a divergence is a config bug + assert cfg.camb_halofit_version == cfg.ccl_halofit_version + # #280: the shipped Boltzmann backend is CAMB-through-CCL, matching the + # CosmoSIS+CAMB inference stack — one power-spectrum path. The cross-check + # tests above (AC10–12, 14) all run at this default configuration. + assert cfg.transfer_function == "boltzmann_camb" + + +# --------------------------------------------------------------------------- # +# AC14: fast smoke — broken wiring caught in the fast suite +# --------------------------------------------------------------------------- # +def test_ac14_crosscheck_smoke(): + """Both paths run at coarse resolution: finite, positive, + few-percent-agreeing ξ+, and a σ8-matched A_s in a sane range.""" + cfg = cm.TheoryConfig() + z, nz = _gauss_nz(n=150) + theta = np.geomspace(10.0, 100.0, 4) + xip_a, _ = cm.xi_ccl(cfg.ccl_params(), cfg, (z, nz), (z, nz), theta) + xip_b, _, As = cm.xi_camb( + cfg, (z, nz), theta, n_ell=120, ell_max=30000, kmax=10.0, n_k=200 + ) + assert np.all(np.isfinite(xip_a)) and np.all(np.isfinite(xip_b)) + assert np.all(xip_a > 0) and np.all(xip_b > 0) + assert 1e-9 < As < 3e-9 + rel = np.abs(xip_b - xip_a) / np.abs(xip_a) + assert rel.max() < 0.05, f"smoke ξ+ rel diff {rel.max():.3%} unexpectedly large" diff --git a/workflow/Snakefile b/workflow/Snakefile index 7d91db81..6621a723 100644 --- a/workflow/Snakefile +++ b/workflow/Snakefile @@ -37,6 +37,9 @@ wildcard_constraints: # Compute rules (infrastructure — raw outputs, no evidence.json) include: "rules/twopoint.smk" +# Smokescreen blind-at-birth custody, generic over the blindable parts +# twopoint.smk produces. Included before its consumers in covariance/cosmo_val. +include: "rules/blinding.smk" include: "rules/covariance.smk" include: "rules/inference.smk" include: "rules/masks.smk" diff --git a/workflow/common.py b/workflow/common.py index ca6901d9..26b94a71 100644 --- a/workflow/common.py +++ b/workflow/common.py @@ -5,12 +5,19 @@ import re from pathlib import Path +from snakemake.io import temp + +# Dependency-free by design: the DAG build gets the blinding file-name +# conventions without importing numpy + smokescreen. +from sp_validation.blinding_paths import init_paths, part_paths + # The running checkout, for rules that shell out to a script directly rather # than through Snakemake's `script:` directive. Anchored on this module's own # location, not workflow.basedir — under `module` composition basedir reflects # the composing paper, not the running checkout. REPO_ROOT = Path(os.path.realpath(__file__)).parents[1] -WORKFLOW_SCRIPTS = os.path.join(os.path.dirname(os.path.realpath(__file__)), "scripts") +WORKFLOW_SCRIPTS = str(REPO_ROOT / "workflow" / "scripts") +REPO_SCRIPTS = str(REPO_ROOT / "scripts") # Output roots are env-overridable so a reproduction run can write into a # fresh tree without clobbering (or silently reusing) prior products. @@ -44,6 +51,10 @@ "version": r"SP_v[\d.]+(_w_iv)?(_ecut\d+)?(_leak_corr)?", "blind": r"[ABC]", "nbins": r"\d+", + # Constrained so a producer's ξ± output pattern cannot greedily absorb the + # "_blinded" suffix into npatch (which would make it ambiguous with the + # blind_part rule's {stem}_blinded output). npatch is always an integer. + "npatch": r"\d+", "min_sep": r"[0-9.]+", "max_sep": r"[0-9.]+", "gaussian": r"(g|ng)", @@ -58,16 +69,22 @@ DEFAULT_MASK_SUFFIX = "" CATALOG_CONFIG = None PLANCK18 = None +# Run type gates Smokescreen blind-at-birth (see the blind custody section +# below): "data" blinds the three blindable parts and binds ξ-derived consumers +# to the blinded siblings; "mock" bypasses blinding entirely. Set from +# config["cosmo_val"]["type"] in configure(); "data" is the production default. +RUN_TYPE = "data" def configure(workflow_config): """Install config-derived values after Snakemake has loaded configfiles.""" - global CATALOG_CONFIG, DEFAULT_MASK_SUFFIX, FIDUCIAL, PLANCK18 + global CATALOG_CONFIG, DEFAULT_MASK_SUFFIX, FIDUCIAL, PLANCK18, RUN_TYPE CATALOG_CONFIG = workflow_config FIDUCIAL = workflow_config["fiducial"] DEFAULT_MASK_SUFFIX = ( "_masked" if workflow_config["covariance"].get("default_masked", False) else "" ) + RUN_TYPE = workflow_config.get("cosmo_val", {}).get("type", "data") with open(COSMOLOGY_PARAMS) as f: PLANCK18 = json.load(f) @@ -275,8 +292,28 @@ def grid_of(grids, binning): def pseudo_cl_tag(config): """Fiducial harmonic-binning tag stamped into pseudo-Cl filenames.""" + return f"blind={config['harmonic']['fiducial']['blind']}_{pseudo_cl_binning_tag(config)}" + + +def pseudo_cl_binning_tag(config): + """The `{binning}_nbins={n}` half of the tag — the binning alone.""" fiducial = config["harmonic"]["fiducial"] - return f"blind={fiducial['blind']}_{fiducial['binning']}_nbins={fiducial['nbins']}" + return f"{fiducial['binning']}_nbins={fiducial['nbins']}" + + +def pseudo_cl_analysis_stem(config, version): + """Stem of the analysis pseudo-Cℓ part for a version. + + Its own name (and its own producing rule, twopoint.smk), distinct from the + generic `pseudo_cl` variants the bmodes and mock workflows request: only + this part is blindable, so only it can be temp()'d on a data run. Single + definition shared by the producer, the assembler (cosmo_val.smk) and the + blindable-stem regex (blinding.smk). + + Carries the binning but no `blind=` field: the A/B/C blind is the legacy + n(z) vocabulary (#312), not this part's concealment. + """ + return f"pseudo_cl_analysis_{version}_{pseudo_cl_binning_tag(config)}" def get_shear_catalog(wildcards): @@ -289,6 +326,98 @@ def get_shear_catalog(wildcards): return str(Path(subdir) / shear_path) +# --------------------------------------------------------------------------- +# Smokescreen blind-at-birth custody +# --------------------------------------------------------------------------- +# Distinct from the glass-mock A/B/C `blind` wildcard above: this is Smokescreen +# concealment (see sp_validation.blinding). RUN_TYPE is the single switch: a +# `data` run binds every ξ-derived consumer to the *_blinded parts, pulling the +# blind_part → blind_init subgraph into the DAG; a `mock` run binds the +# plaintext parts and the subgraph never appears. + + +def run_type(): + """The campaign's run type, ``"data"`` or ``"mock"``. + + Every part writer stamps this as the SACC ``type`` metadata, which is what + ``blinding.assert_consistent_blind`` reads at assembly. A function + rather than the ``RUN_TYPE`` global because ``from common import *`` binds + names before ``configure()`` runs, so only a call reads the configured + value. + """ + return RUN_TYPE + + +def is_data_run(): + """True when blinding is active (production data runs); False for mocks.""" + return run_type() == "data" + + +def blind_root(): + """Root holding one blind-init directory per version, or None on mock runs. + + What `CosmologyValidation(blind_root=...)` takes, so its part writers can + resolve each version's commitment.json themselves. + """ + return str(COSMO_VAL / "blind") if is_data_run() else None + + +def blind_state_dir(version): + """Per-version blind-init custody directory (commitment + encrypted seed).""" + return str(COSMO_VAL / "blind" / version) + + +def blind_state_paths(version): + """The fixed custody-state files blind_init writes for a version.""" + return init_paths(blind_state_dir(version)) + + +def commitment_input(version): + """Input mapping binding a version's commitment.json, on data runs only. + + A part writer stamps its output concealed from that file (sacc_io.save's + `commitment=`), which is what lets a born-blinded or blind-irrelevant part + clear the fail-closed load gate at assembly. + """ + if not is_data_run(): + return {} + return {"commitment": blind_state_paths(version)["commitment"]} + + +def blinded_path(part_path): + """The *_blinded sibling blind_part writes beside a plaintext part.""" + return part_paths(part_path)["blinded"] + + +def version_of(stem): + """Catalogue version embedded in a blindable part's stem. + + blind_part needs it to locate the version's blind state. + """ + m = re.search(WILDCARD_CONSTRAINTS["version"], stem) + if m is None: + raise ValueError(f"no catalogue version found in part stem {stem!r}") + return m.group(0) + + +def blindable_part(part_path): + """On-disk path a run persists for one blindable part. + + Data run -> the blinded sibling (binding it pulls blind_part + blind_init + into the DAG); mock run -> the plaintext part. + """ + return blinded_path(part_path) if is_data_run() else str(part_path) + + +def maybe_temp(part_path): + """temp() a producer's blindable plaintext part on data runs. + + Its only consumer there is blind_part, which escrows the true vector before + Snakemake removes the file, so no plaintext blindable part persists. + """ + return temp(str(part_path)) if is_data_run() else str(part_path) + + # --------------------------------------------------------------------------- # CosmologyValidation diagnostic suite (cosmo_val.py) # --------------------------------------------------------------------------- @@ -347,6 +476,10 @@ def cv_init_params(config, version_list=None): nrandom_cell=cv["nrandom_cell"], cell_method=cv["cell_method"], nside_mask=cv["nside_mask"], + # Custody state the cv's part writers need: the SACC `type` they stamp, + # and the blind whose commitment born-blinded parts are stamped under. + run_type=run_type(), + blind_root=blind_root(), ) if cv.get("path_onecovariance"): params["path_onecovariance"] = cv["path_onecovariance"] diff --git a/workflow/rules/blinding.smk b/workflow/rules/blinding.smk new file mode 100644 index 00000000..d951ab80 --- /dev/null +++ b/workflow/rules/blinding.smk @@ -0,0 +1,61 @@ +# Smokescreen blind-at-birth custody rules (sp_validation.blinding). +# +# Dormant unless a consumer binds a *_blinded part through common.blindable_part, +# which only a `data` run does. The terminal assemble_sacc rule (cosmo_val.smk) +# asserts the shared blind across parts. + +import re + +# The blindable stems, derived from the same name-builders the producing rules +# use so part names have one authority: the binning-named ξ± parts (rule xi, one +# per named grid) and the analysis pseudo-Cℓ. None contains "_blinded", so the +# generic blind_part rule can never blind its own output twice. +_VERSION_SLOT = "0VERSION0" # regex-inert placeholder, substituted after escaping +BLINDABLE_STEM = "(?:{})".format( + "|".join( + re.escape(stem) + for stem in ( + [f"{_VERSION_SLOT}_xi_{xi_binning(grid)}" for grid in XI_GRIDS] + + [pseudo_cl_analysis_stem(config, _VERSION_SLOT)] + ) + ).replace(_VERSION_SLOT, WILDCARD_CONSTRAINTS["version"]) +) + + +rule blind_init: + """Draw the seed and publish the commitment + encrypted bundle for a version.""" + output: + commitment=str(COSMO_VAL / "blind" / "{version}" / "commitment.json"), + bundle=str(COSMO_VAL / "blind" / "{version}" / "blind_seed.encrpt"), + key=str(COSMO_VAL / "blind" / "{version}" / "blind_seed.key"), + params: + blind_dir=lambda w: blind_state_dir(w.version), + resources: + runtime=5, + shell: + "python {REPO_SCRIPTS}/blind_data_vector.py" + " blind-init {params.blind_dir}" + + +rule blind_part: + """Conceal one part, escrowing its true vector beside the blinded output.""" + input: + part=str(COSMO_VAL / "{stem}.sacc"), + commitment=lambda w: blind_state_paths(version_of(w.stem))["commitment"], + bundle=lambda w: blind_state_paths(version_of(w.stem))["bundle"], + key=lambda w: blind_state_paths(version_of(w.stem))["key"], + output: + blinded=str(COSMO_VAL / "{stem}_blinded.sacc"), + escrow=str(COSMO_VAL / "{stem}_escrow.encrpt"), + escrow_key=str(COSMO_VAL / "{stem}_escrow.key"), + wildcard_constraints: + stem=BLINDABLE_STEM, + params: + blind_dir=lambda w: blind_state_dir(version_of(w.stem)), + resources: + runtime=10, + # --keep-input: the plaintext part is the producing rule's temp() output, so + # Snakemake removes it once this, its only consumer, finishes. + shell: + "python {REPO_SCRIPTS}/blind_data_vector.py" + " blind-part {input.part} --blind-dir {params.blind_dir} --keep-input" diff --git a/workflow/rules/cosmo_val.smk b/workflow/rules/cosmo_val.smk index 87138bc0..69829bce 100644 --- a/workflow/rules/cosmo_val.smk +++ b/workflow/rules/cosmo_val.smk @@ -158,8 +158,8 @@ _PSEUDO_CL_TAG = pseudo_cl_tag(config) def cv_pseudo_cl_analysis_sacc(version): - """Tagged pseudo-Cl SACC part: the harmonic block of the analysis file.""" - return str(COSMO_VAL / f"pseudo_cl_{version}_{_PSEUDO_CL_TAG}.sacc") + """Analysis pseudo-Cl SACC part: the harmonic block of the analysis file.""" + return str(COSMO_VAL / f"{pseudo_cl_analysis_stem(config, version)}.sacc") def cv_pseudo_cl_cov(version): @@ -384,7 +384,9 @@ def cv_pseudo_cl_figures(): rule cv_plot_pseudo_cl: """The EE/EB/BB pseudo-Cl figures, from the analysis parts.""" input: - pseudo_cl=[cv_pseudo_cl_analysis_sacc(v) for v in CV_VERSIONS], + pseudo_cl=[ + blindable_part(cv_pseudo_cl_analysis_sacc(v)) for v in CV_VERSIONS + ], pseudo_cl_cov=[cv_pseudo_cl_cov(v) for v in CV_VERSIONS], output: **cv_pseudo_cl_figures(), @@ -405,6 +407,24 @@ rule cv_plot_pseudo_cl: # Pure E/B modes and COSEBIs (per version), then the B-mode summary # --------------------------------------------------------------------------- +# On a data run these re-derive their E-mode vector from the *blinded* ξ± parts, +# so they are born blinded; the commitment binds only there. +def cv_cosebis_inputs(w): + return { + "xi": blindable_part(cv_xi_sacc(w.version, "cosebis")), + **commitment_input(w.version), + } + + +def cv_pure_eb_inputs(w): + return { + "xi_reporting": blindable_part(cv_xi_sacc(w.version, "reporting")), + "xi_integration": blindable_part(cv_xi_sacc(w.version, "integration")), + "cov_integration": cv_xi_cov_integration(w.version), + **commitment_input(w.version), + } + + rule cv_pure_eb: """Pure E/B-mode decomposition for one version, from its ξ± parts. @@ -412,15 +432,14 @@ rule cv_pure_eb: integration-grid covariance model, so no patched estimator run is involved. """ input: - xi_reporting=lambda w: cv_xi_sacc(w.version, "reporting"), - xi_integration=lambda w: cv_xi_sacc(w.version, "integration"), - cov_integration=lambda w: cv_xi_cov_integration(w.version), + unpack(cv_pure_eb_inputs), output: npz=cv_pure_eb_npz("{version}"), sacc=cv_pure_eb_sacc("{version}"), **cv_pure_eb_figures("{version}"), params: version="{version}", + type=CV.get("type", "data"), min_sep=CV["theta_min"], max_sep=CV["theta_max"], nbins=CV["nbins"], @@ -443,13 +462,14 @@ rule cv_cosebis: is the part's ξ± covariance through the same kernel as the modes. """ input: - xi=lambda w: cv_xi_sacc(w.version, "cosebis"), + unpack(cv_cosebis_inputs), output: npz=cv_cosebis_npz("{version}"), sacc=cv_cosebis_sacc("{version}"), **cv_cosebis_figures("{version}"), params: version="{version}", + type=CV.get("type", "data"), min_sep=CV["cosebis"]["min_sep_int"], max_sep=CV["cosebis"]["max_sep_int"], nbins=CV["cosebis"]["nbins_int"], @@ -471,7 +491,7 @@ rule cv_summarize_bmodes: pure_eb=[cv_pure_eb_npz(v) for v in CV_VERSIONS], cosebis=[cv_cosebis_npz(v) for v in CV_VERSIONS], pseudo_cl=( - [cv_pseudo_cl_analysis_sacc(v) for v in CV_VERSIONS] + [blindable_part(cv_pseudo_cl_analysis_sacc(v)) for v in CV_VERSIONS] if CV.get("include_pseudo_cl", False) else [] ), pseudo_cl_cov=( @@ -509,15 +529,18 @@ def cv_assemble_inputs(version): Each part's filename carries enough to bind its producing rule's wildcards. """ + # blindable_part binds the raw-signal parts to their blinded siblings on a + # data run. COSEBIs, pure-E/B and ρ/τ are stamped concealed by their own + # writers, so they bind by name either way. parts = dict( - xi_reporting=cv_xi_sacc(version, "reporting"), + xi_reporting=blindable_part(cv_xi_sacc(version, "reporting")), xi_cov=cv_xi_cov(version), cosebis=cv_cosebis_sacc(version), pure_eb=cv_pure_eb_sacc(version), rho_tau=cv_rho_tau_sacc(version), ) if CV.get("include_pseudo_cl", False): - parts["pseudo_cl"] = cv_pseudo_cl_analysis_sacc(version) + parts["pseudo_cl"] = blindable_part(cv_pseudo_cl_analysis_sacc(version)) parts["pseudo_cl_cov"] = cv_pseudo_cl_cov(version) return parts diff --git a/workflow/rules/twopoint.smk b/workflow/rules/twopoint.smk index a3ba7e74..889641e8 100644 --- a/workflow/rules/twopoint.smk +++ b/workflow/rules/twopoint.smk @@ -28,7 +28,8 @@ rule xi: catalog=get_shear_catalog, output: txt=str(COSMO_VAL / "{version}_xi_minsep={min_sep}_maxsep={max_sep}_nbins={nbins}_npatch={npatch}.txt"), - sacc=str(COSMO_VAL / "{version}_xi_minsep={min_sep}_maxsep={max_sep}_nbins={nbins}_npatch={npatch}.sacc"), + # Blindable part: temp() on a data run so only its blinded sibling persists. + sacc=maybe_temp(str(COSMO_VAL / "{version}_xi_minsep={min_sep}_maxsep={max_sep}_nbins={nbins}_npatch={npatch}.sacc")), threads: 24 params: ver="{version}", @@ -38,6 +39,7 @@ rule xi: npatch="{npatch}", cat_config=CAT_CONFIG, grid=lambda w: xi_grid_of(w), + type=run_type(), # the part's SACC `type` — custody state at assembly cov=lambda w: XI_GRIDS[xi_grid_of(w)]["cov"], resources: # The fine integration grid needs more memory and wall time than the @@ -68,6 +70,10 @@ rule run_cosmo_val: rule rho_tau_stats: + # ρ/τ has no blindable input; it binds the commitment only to stamp its part + # concealed pass-through. + input: + unpack(lambda w: commitment_input(w.version)), output: rho_stats=str(COSMO_VAL / "rho_tau_stats/rho_stats_{version}_minsep={min_sep}_maxsep={max_sep}_nbins={nbins}_npatch={npatch}.fits"), tau_stats=str(COSMO_VAL / "rho_tau_stats/tau_stats_{version}_minsep={min_sep}_maxsep={max_sep}_nbins={nbins}_npatch={npatch}.fits"), @@ -80,6 +86,8 @@ rule rho_tau_stats: max_sep="{max_sep}", nbins="{nbins}", npatch="{npatch}", + type=run_type(), + blind_root=blind_root(), resources: mem_mb=30000, disk_mb=20000, @@ -94,8 +102,22 @@ wildcard_constraints: binning="linear|logspace|powspace", +HARMONIC_FIDUCIAL = config["harmonic"]["fiducial"] +PSEUDO_CL_PARAMS = dict( + cat_config=CAT_CONFIG, + nside=1024, + npatch=1, + cosmo_params=PLANCK18, + power=0.5, +) + + rule pseudo_cl: - """Generate pseudo-Cl data vector (born as SACC) with configurable binning.""" + """Generate pseudo-Cl data vector (born as SACC) with configurable binning. + + The diagnostic variants (bmodes claims, mocks, the fine COSEBIs binning); + the analysis part has its own rule below. + """ output: pseudo_cl=str(COSMO_VAL / "pseudo_cl_{version}_blind={blind}_{binning}_nbins={nbins}.sacc"), wildcard_constraints: @@ -103,13 +125,34 @@ rule pseudo_cl: params: version="{version}", blind="{blind}", - cat_config=CAT_CONFIG, - nside=1024, - npatch=1, - cosmo_params=PLANCK18, binning="{binning}", nbins=lambda w: int(w.nbins), - power=0.5, + **PSEUDO_CL_PARAMS, + resources: + mem_mb=32000, + runtime=120, + threads: 12 + script: + "../scripts/generate_pseudo_cl.py" + + +rule pseudo_cl_analysis: + """The analysis pseudo-Cℓ part, at the fiducial harmonic binning. + + Split from the generic `pseudo_cl` rule because this variant alone is + blindable: on a data run the plaintext part is temp(), consumed only by + blind_part, so only the blinded sibling persists. + """ + output: + pseudo_cl=maybe_temp( + str(COSMO_VAL / f"{pseudo_cl_analysis_stem(config, '{version}')}.sacc") + ), + params: + version="{version}", + blind=HARMONIC_FIDUCIAL["blind"], + binning=HARMONIC_FIDUCIAL["binning"], + nbins=int(HARMONIC_FIDUCIAL["nbins"]), + **PSEUDO_CL_PARAMS, resources: mem_mb=32000, runtime=120, diff --git a/workflow/scripts/assemble_sacc.py b/workflow/scripts/assemble_sacc.py index 50d1d62e..9c6198f4 100644 --- a/workflow/scripts/assemble_sacc.py +++ b/workflow/scripts/assemble_sacc.py @@ -136,7 +136,9 @@ def assemble_sacc( parts.append(_attach_cov(part, name, xi_cov, pseudo_cl_cov)) if not parts: raise ValueError(f"no parts found for {version}: {part_paths}") - s = assemble_analysis_sacc(parts) + # Through sacc_io.gather, the one terminal seam: it fails closed unless every + # blindable part shares one blind, and stamps that blind on the result. + s = sacc_io.gather(parts, assemble=assemble_analysis_sacc) sacc_io.save(s, out_path, type=s.metadata["type"]) print(f"Assembled {len(parts)} parts -> {out_path}") return s diff --git a/workflow/scripts/cv_cosebis.py b/workflow/scripts/cv_cosebis.py index 170341a3..2acba391 100644 --- a/workflow/scripts/cv_cosebis.py +++ b/workflow/scripts/cv_cosebis.py @@ -4,6 +4,9 @@ derive from it, so nothing here touches a catalogue. The part's ξ± covariance goes through the same linear kernel as the modes to give the COSEBIs covariance; its ``npatch`` metadata sets the Hartlap debiasing. + +On a data run the part it reads is the blinded one, so these COSEBIs are born +blinded and the output is stamped under the same commitment. """ from cv_runner import _unbuffer_streams, verify_outputs @@ -63,9 +66,19 @@ save_cosebis_results(results, snakemake.output["npz"], fiducial_scale_cut) -# The part inherits the ξ± part's provenance; `type` is re-stamped on save. -metadata = {k: v for k, v in part.metadata.items() if k != "type"} +# The part inherits the ξ± part's provenance; `type` and the blind stamp are +# re-applied on save, from the run type and the version's commitment. +metadata = { + k: v + for k, v in part.metadata.items() + if k not in ("type", "concealed", "blind_commitment", "blind_config_digest") +} s = cosebis_to_sacc({0: sacc_io.get_nz(part, 0)}, metadata, fiducial, fiducial_key) -sacc_io.save(s, snakemake.output["sacc"], type="data") +sacc_io.save( + s, + snakemake.output["sacc"], + type=p["type"], + commitment=snakemake.input.get("commitment", None), +) verify_outputs(snakemake) diff --git a/workflow/scripts/cv_pure_eb.py b/workflow/scripts/cv_pure_eb.py index d2acdbfe..3c064d3a 100644 --- a/workflow/scripts/cv_pure_eb.py +++ b/workflow/scripts/cv_pure_eb.py @@ -7,6 +7,9 @@ it depends on the covariance model and the grids rather than on the measured vector. A jackknife of the transformed modes would need per-patch realisations, which are never persisted. + +On a data run the parts it reads are the blinded ones, so these modes are born +blinded and the output is stamped under the same commitment. """ import numpy as np @@ -100,8 +103,13 @@ save_pure_eb_results(results, snakemake.output["npz"]) -# The part inherits the ξ± part's provenance; `type` is re-stamped on save. -metadata = {k: v for k, v in reporting.metadata.items() if k != "type"} +# The part inherits the ξ± part's provenance; `type` and the blind stamp are +# re-applied on save, from the run type and the version's commitment. +metadata = { + k: v + for k, v in reporting.metadata.items() + if k not in ("type", "concealed", "blind_commitment", "blind_config_digest") +} s = pure_eb_to_sacc( {0: (z, nz)}, metadata, @@ -109,6 +117,11 @@ {key: results[key] for key in sacc_io.PURE_KEYS}, covariance=cov, ) -sacc_io.save(s, snakemake.output["sacc"], type="data") +sacc_io.save( + s, + snakemake.output["sacc"], + type=p["type"], + commitment=snakemake.input.get("commitment", None), +) verify_outputs(snakemake) diff --git a/workflow/scripts/run_2pcf.py b/workflow/scripts/run_2pcf.py index 78281c73..611aaeb7 100644 --- a/workflow/scripts/run_2pcf.py +++ b/workflow/scripts/run_2pcf.py @@ -44,9 +44,10 @@ def run_2pcf( output_dir, sacc_out=None, grid="reporting", + run_type="data", cov="none", ): - """Measure ξ±(θ) for ``ver`` and write its reporting SACC part. + """Measure ξ±(θ) for ``ver`` and write its born-as-SACC part. Parameters mirror the TreeCorr reporting/integration grids: ``min_sep`` / ``max_sep`` in arcmin, ``nbins`` logarithmic bins, ``npatch`` spatial @@ -55,7 +56,10 @@ def run_2pcf( ``cat_config['paths']['output']`` so the ``.txt`` byproduct lands where lc expects. ``sacc_out`` is the exact destination for the SACC part (the Snakemake-declared output); it defaults to a binning-derived name under - the resolved output directory for the CLI path. + the resolved output directory for the CLI path. ``cov`` is the grid's + covariance mode — ``"jackknife"`` (needs ``npatch`` > 1), ``"diagonal"`` or + ``"none"``. ``run_type`` (``"data"`` or ``"mock"``) is stamped as the part's + SACC ``type``. Returns ------- @@ -100,7 +104,7 @@ def run_2pcf( output_dir or cv.cc["paths"]["output"], f"{ver}_xi_minsep={min_sep}_maxsep={max_sep}_nbins={nbins}_npatch={npatch}.sacc", ) - sacc_io.save(s, out_path, type="data") + sacc_io.save(s, out_path, type=run_type) print(f"Wrote {grid} ξ± SACC part: {out_path}") return gg @@ -124,6 +128,7 @@ def _from_snakemake(smk): # The SACC part goes exactly where the rule declares it; the .txt # byproduct still lands under the resolved output dir. sacc_out=smk.output["sacc"], + run_type=p["type"], ) @@ -159,6 +164,12 @@ def _from_cli(argv=None): choices=["jackknife", "diagonal", "none"], help="Covariance the part carries", ) + ap.add_argument( + "--run-type", + default="data", + choices=("data", "mock"), + help="Campaign run type stamped as the part's SACC `type`", + ) a = ap.parse_args(argv) run_2pcf( ver=a.ver, @@ -169,6 +180,7 @@ def _from_cli(argv=None): cat_config=a.cat_config, output_dir=a.out, grid=a.grid, + run_type=a.run_type, cov=a.cov, ) diff --git a/workflow/scripts/run_rho_tau.py b/workflow/scripts/run_rho_tau.py index 71e3deb7..9a099deb 100644 --- a/workflow/scripts/run_rho_tau.py +++ b/workflow/scripts/run_rho_tau.py @@ -44,6 +44,8 @@ theta_max=float(params["max_sep"]), nbins=int(params["nbins"]), npatch=int(params["npatch"]), + run_type=params["type"], + blind_root=params["blind_root"], ) cv.calculate_rho_tau_stats()