Reproducibility Checklist + Pinning

Complete this checklist on your own repo. The flagship gate (m5-l16) re-runs this exact checklist cold — every miss below is a gate failure there.

The checklist

1. Pinned dependencies (requirements.txt with ==, Python version pinned).
2. .dockerignore present (no .git, data, secrets in the image).
3. Dockerfile builds from a cold clone with zero manual steps.
4. Random seeds fixed and logged (train split, model init, sampling).
5. Data version recorded (checksum + source URL, train/holdout split hash).
6. One-command smoke run: docker build . -t app && docker run app pytest -q.
7. No secrets in code or image (env-only; verified by scanning the build log).
8. Run-comparison note: 3 runs logged in the tracker with params + metrics.

GCP parity note

Same checklist on Cloud Run: image from Artifact Registry, env via Secret Manager. Checklist items are identical; only the deploy target changes.