Determinism & no fabrication

Every pipeline tool is pure given its inputs: same session parameters, same manifest, same result. This is what makes the reviewer step trustworthy and what lets sessions be reproduced from a replay script — see Replay & reproducibility for how the log is captured and the script generated.

No fabricated data

• Theory Cℓ come only from a provided file (theory_path/theory_paths) or a CCL computation — plotting tools render existing results, they never synthesise a curve to fill a gap. This was a real failure mode with a small local model: a script-authoring agent once fabricated theory curves when asked to plot a comparison it didn't have data for. The fix was making plot_cls_comparison cover the request (a show_noise= parameter, CCL fallback) rather than leaving a gap for the model to fill in — see Development.
• Covariance is either computed by compute_covariance* or explicitly flagged — output_validation.py's gate FAILs a covariance JSON that carries no cls_theory, i.e. one that didn't actually come from compute_covariance.

The deterministic reviewer

build_review_evidence pre-computes every check Python can answer — the Knox-formula validation, output shape/schema checks, the Nyquist constraint, a manifest of what plots exist — into one evidence block. @reviewer only judges the numbers already in that block and emits REVIEW: PASS/FAIL; it never re-derives a check itself — the part of the pipeline that actually needs to not depend on model quality.

The systematics gate

build_systematics_evidence (Phase D) is the equivalent hard gate for systematics: c-term, PSF leakage, B-mode null tests, and template contamination are all computed deterministically, and a FAIL/MISSING verdict opens a human gate that only authorise_gate — behind a runtime confirmation dialogue — can close. There is no override_systematics_gate tool a model can call directly any more; see Human gates for why an argument-based override was not enough.

B-mode nulls are a special case: a naive test over-rejects clean simulations, and a prior run once explained the false detections with fabricated physics and self-authorised the override. The B-mode validation layers (purification, a deterministic advisory discriminant, an empirical rotation ensemble) replace that narrative with numbers; Human gates is what keeps the override an actual human decision rather than one the model can author for itself.

The inference dry-run gate

Inference has the same shape: an InferenceSpec is compiled deterministically, then dry_run_inference runs the config once through CosmoSIS's test sampler plus static parameter-coverage checks and emits a deterministic PASS/FAIL — a finite log-likelihood and zero coverage errors, no model judgement — before any real chain is launched. See The InferenceSpec.