From fd0273f9ddcb039f61f6559e3669822c4074ecc1 Mon Sep 17 00:00:00 2001
From: ryan <rpotter6298@gmail.com>
Date: Sat, 15 Aug 2026 10:29:53 +0200
Subject: [PATCH] Add an encrypted variant: smoke_enc.hdb decrypted to tmpfs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Exercises the pass-2 path end to end — key lookup, decrypt into tmpfs rather
than the on-disk cache, results written into tmpfs and returned as an encrypted
.hrb the server stores without a key. The .hek stays out of the repo.
---
 .gitignore                    |   3 ++
 configs/tabular_encrypted.hcf |  92 ++++++++++++++++++++++++++++++++++
 smoke_enc.hdb                 | Bin 0 -> 129 bytes
 3 files changed, 95 insertions(+)
 create mode 100644 configs/tabular_encrypted.hcf
 create mode 100644 smoke_enc.hdb

diff --git a/.gitignore b/.gitignore
index 4fbc306..b55c970 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,6 @@ __pycache__/
 *.py[cod]
 .venv/
 *.env
+
+# Keys never enter the repo.
+*.hek
diff --git a/configs/tabular_encrypted.hcf b/configs/tabular_encrypted.hcf
new file mode 100644
index 0000000..24ba7a9
--- /dev/null
+++ b/configs/tabular_encrypted.hcf
@@ -0,0 +1,92 @@
+{
+  "_notes": [
+    "Encrypted variant: the dataset arrives as smoke_enc.hdb and is decrypted",
+    "into tmpfs on the provider, never onto disk. Results follow the inputs and",
+    "come back as an encrypted .hrb the server stores without being able to read.",
+    "The provider needs f29fa64afbe1c51f.hek in its keys directory."
+  ],
+  "run_name": "tabular_encrypted",
+  "num_classes": 2,
+  "split_identity_level": 1,
+  "eval_stage": "cd_fuse",
+  "save_predictions": true,
+  "seed": 1234,
+  "folds": 3,
+  "fold_seed": 100,
+  "output_root": "results",
+  "data": {
+    "module": "hypertower_core.profiles.generic",
+    "args": {
+      "metadata_csv": "secret/smoke/labels.csv",
+      "id_column": "sample_id",
+      "label_col": "diagnosis",
+      "target_type": "classification",
+      "group_column": "patient_id",
+      "cat_cols": [
+        "site"
+      ],
+      "exclude_cols": [
+        "notes"
+      ]
+    }
+  },
+  "towers": [
+    {
+      "name": "cd",
+      "module": "hypertower_core.components.towers.clinical_tower",
+      "class": "ClinicalEncoder",
+      "data_source": "matrix",
+      "args": {
+        "hidden_dim": 64
+      }
+    }
+  ],
+  "stages": [
+    {
+      "name": "cd_warm",
+      "type": "warm",
+      "tower": "cd",
+      "head_name": "cd_aux",
+      "level": "sample",
+      "epochs": 8
+    },
+    {
+      "name": "cd_aux",
+      "type": "head",
+      "input": "cd",
+      "train_with": "cd_fuse"
+    },
+    {
+      "name": "cd_fuse",
+      "type": "fusion",
+      "module": "hypertower_core.components.bridges.mono_bridge",
+      "class": "MonoBridge",
+      "inputs": [
+        "cd"
+      ],
+      "level": "sample",
+      "epochs": 10,
+      "train_towers": true,
+      "args": {
+        "use_ln": false
+      }
+    }
+  ],
+  "training": {
+    "lr": 0.001,
+    "batch_size": 32,
+    "tune_binary_threshold": true
+  },
+  "data_bundles": [
+    {
+      "file": "smoke_enc.hdb",
+      "encrypted": true,
+      "mount": "secret",
+      "unpacked_mb": 1,
+      "sha256": "b4df36d1fe916891b679ac89a38ead7bc956783aa3ac1cc65d3becc8cb26523d"
+    }
+  ],
+  "dataset": {
+    "n_samples": 400
+  }
+}
\ No newline at end of file
diff --git a/smoke_enc.hdb b/smoke_enc.hdb
new file mode 100644
index 0000000000000000000000000000000000000000..d18628100fb78d370d78739c22992c8ad8b36e97
GIT binary patch
literal 129
zcmWN?K@!3s3;@78uiyigftUdOO$Z>&sC0z(;OliSdzH`Z<E`6T$J~v1^mTjIx&3cv
z+GM=UJc^jhs?oEajUCdS?zsYGTT8SQqD|x@ONb1iaP~<ek`KTPELMatLn<Ock|T7G
L)$HG*JqA=i=A<Y&

literal 0
HcmV?d00001