Exercises the pass-2 path end to end — key lookup, decrypt into tmpfs rather
than the on-disk cache, results written into tmpfs and returned as an encrypted
.hrb the server stores without a key. The .hek stays out of the repo.
This repo carries data/smoke/labels.csv for the loose-file config and the same
data inside smoke.hdb. Mounting the bundle at data/ made two sources claim one
path, which the provider refuses. Giving the bundle its own mount keeps both
configs working.
Exercises the provider bundle path — verify sha256, unpack to the
content-addressed cache, symlink in at mount="data" so the config metadata_csv
path resolves. The loose-file config stays alongside it as the plain case.
400 rows / 200 patients, two samples each, so grouped splitting is actually
exercised. Signal is modest and noisy on purpose — a separable toy would score
1.0 with a broken model and prove nothing.
ryan