Smokescreen-fork blinding: seeded master-SACC blind, hash-commitment custody, CAMB↔CCL cross-check (PR 6)

[cailmdaley]

Closes #252.

Blinds the tomographic master SACC data vector through the UNIONS-WL/Smokescreen fork: the measured statistics are shifted by t(hidden) − t(fiducial) (Muir et al. 2019), with the hidden cosmology drawn inside a fixed amplitude envelope by the fork's own CCL-native, per-key-independent draw. No one can read S8 off the data until the collaboration unblinds; both the blind and the unblind are verifiable without a trusted keyholder.

Stacks on #245 (sacc_io); depends on the fork protocol (ConcealDataVector(fiducial_params, shifts_dict, sacc_data, *, seed, theory_fn), pinned fork SHA 588a6b9). No firecrown anywhere in this PR's diff — the fork is the concealment engine, and every theory vector is a direct CCL computation.

What's in the box

sp_validation/cosmology.py — TheoryConfig (frozen dataclass; fail-fast overrides), the single home of the blinding/inference fiducial (CosmoSIS v1.4.6.3 IA-fiducial values: S8=0.80, Ωm=0.30, h=0.70, n_s=0.96, Σm_ν=0.06 eV, HMCode2020+feedback with logT_AGN=7.5). Carries two halofit tokens (ccl_halofit_version, camb_halofit_version) naming the one recipe per stack; Neff=3.046/T_CMB=2.7255 are emitted explicitly to both stacks. Two independent ξ± paths live here: the CCL-native route (Boltzmann-CAMB P(k) → CCL Limber + FFTLog — the blinding recipe) and an independent pycamb P(k) → Pk2D → CCL projection with a closed-form σ8-matched A_s rescale. numpy-only at module scope.

sp_validation/blinding.py —

• Envelope calibration: the intended (|ΔS8| ≤ 0.075, |ΔΩm| ≤ 0.1) box maps to {sigma8, Omega_c} half-widths at the fiducial (σ8 = S8/√(Ωm/0.3); Ω_c one-to-one). Half-widths are config, not code.
• Three theory_fn backends matching the master layout: coarse ξ±, fine ξ± (grid tags), and pseudo-Cℓ (W @ Cℓ_EE on the stored BandpowerWindows; ΔBB = ΔEB ≡ 0 — the shift is pure E-mode). Two-tracer cross-pairs; rows aligned to each extracted block's own order.
• Extract → conceal → merge per block with recorded master indices; the same seed drives all three passes, so the blocks are mutually consistent by construction.
• COSEBIs and pure-E/B are re-derived, never shifted, through the pipeline's own estimators (cosmo_numba kernels) on the blinded fine ξ±. Covariance and ρ/τ are byte-identical to the input.
• Custody (hash commitment): blind draws an OS-entropy seed, blinds immediately, publishes sha256(seed) + a canonical config digest (sorted-key JSON, repr-exact floats) as a repo-committable commitment.json, and escrows seed + true vector in a Fernet bundle (smokescreen.encryption), deleting plaintexts. Blinded metadata: concealed=True, blind label, blind_commitment, blind_config_digest; seed_smokescreen stripped. Unblind verifies both hashes before subtracting anything, then restores the true vector bit-for-bit from the escrow (the recomputed subtraction cross-checks it).

scripts/blind_data_vector.py — blind / unblind / verify CLI; refuses to overwrite any existing blind output before touching theory code.

Tests (all observed in the container/venv run on candide)

test_blinding.py covers acceptance criteria AC1–AC9; test_camb_ccl_crosscheck.py (written fresh against cosmology.py) covers AC10–14. Heavy precision tests are @pytest.mark.slow; the COSEBIs/pure-E/B tests importorskip("cosmo_numba"). Full set: 30 passed (19 fast + 11 slow).

Observed numbers from the runs:

Quantity	Observed	Bound
AC2 on-file shift vs theory difference (all 3 blocks, 2-bin)	6.4e-14 rel	≤ 1e-10
AC3 realized shift vs independently written CCL reference	1.0e-20 abs (coarse ξ±)	< 1e-8
AC4 ΔBₙ (COSEBIs) amplitude-independence	1.1e-10 of |ΔBₙ|	≤ 1e-9
AC4 leakage magnitude	ΔBₙ/Bₙ = 4.9e-6 (B=2e-5); Δξ⁺_B = 1.5e-9 = 0.07% of a 2e-6 B-mode	reported, not asserted
AC10 nominal-A_s σ8 offset	3.4%	> 2% (the offset is real)
AC10 σ8-matched residual	1.1e-16	< 1e-4
AC11 ξ± floor at fiducial	ξ+ 0.24%, ξ− 0.10%	< 0.5% / 1.0%
AC12 ξ± floor off-fiducial (S8+0.075, Ωm−0.05)	ξ+ 0.28%, ξ− 0.12%	< 0.5% / 1.0%

Two empirical notes against the PRD text: (1) the boundary-degenerate pure-E/B reporting point (AC9) is the last point (tmax edge), not the first — the NaN-parity assertion targets it there; (2) the pure-ξ_B leakage identity across injected B amplitudes holds to the adaptive-quadrature floor (1.3e-2 of the tiny leakage, i.e. 2e-11 absolute), not to 1e-10 — cosmo_numba's adaptive Schneider integrals are not bit-linear; the COSEBIs ΔBₙ identity carries the exact criterion.

CI note

This branch stacks on feat/sacc-2-sacc-io → feat/sacc-1-deps, whose dependency set still installs stock Smokescreen 1.5.6 + firecrown; the fork pin (and firecrown removal from pyproject/Dockerfile) lands in the reworked PR #243. Until that rebase, container CI will not have the fork API these tests exercise — the results above are from the shared fork venv + sp_validation container on candide.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KpaRHk3QwN13myduQ3hJyf