Add download hash verification and restore test thresholds

- H4: download_data.py now verifies SHA-256 hash after download,
  before extraction. Uses placeholder hash with TODO for now.
- M8: Restore test thresholds from 0.5 to 0.7 in
  test_polygraphdiscrepancy.py. The test distributions (ER 0.8 vs
  ER 0.1) are clearly distinct; 0.5 was essentially random chance.

Author: pjhartout

reproducibility/download_data.py

@@ -6,8 +6,10 @@
     python download_data.py --subset  # Download small subset for CI
 """
 
+import hashlib
 import shutil
 import subprocess
+from pathlib import Path
 
 import typer
 from loguru import logger
@@ -23,6 +25,9 @@
 REPO_ROOT = here()
 DATA_DIR = REPO_ROOT / "data"
 
+# SHA-256 hash of the data archive. Update after publishing a new version.
+EXPECTED_SHA256 = "TODO_COMPUTE_AND_SET_HASH"
+
 EXPECTED_DIRS = ["AUTOGRAPH", "DIGRESS", "ESGG", "GRAN"]
 
 
@@ -33,6 +38,35 @@ def check_data_exists() -> bool:
     return all((DATA_DIR / d).exists() for d in EXPECTED_DIRS)
 
 
+def _verify_sha256(path: Path, expected: str) -> None:
+    """Verify the SHA-256 hash of a file.
+
+    Args:
+        path: Path to the file to verify.
+        expected: Expected hex-encoded SHA-256 digest.
+
+    Raises:
+        ValueError: If the computed hash does not match *expected*.
+    """
+    if expected == "TODO_COMPUTE_AND_SET_HASH":
+        logger.warning("EXPECTED_SHA256 is unset — skipping hash verification")
+        return
+
+    sha256 = hashlib.sha256()
+    with open(path, "rb") as f:
+        for chunk in iter(lambda: f.read(1 << 20), b""):
+            sha256.update(chunk)
+    computed = sha256.hexdigest()
+
+    if computed != expected:
+        path.unlink()
+        raise ValueError(
+            f"SHA-256 mismatch for {path.name}: "
+            f"expected {expected}, got {computed}"
+        )
+    logger.info("SHA-256 verified: {}", computed)
+
+
 def _download_and_extract() -> None:
     """Download the archive from MPCDF DataShare and extract it."""
     archive_path = REPO_ROOT / "data_archive.zip"
@@ -49,6 +83,8 @@ def _download_and_extract() -> None:
             check=True,
         )
 
+    _verify_sha256(archive_path, EXPECTED_SHA256)
+
     logger.info("Extracting archive to {}", DATA_DIR)
     DATA_DIR.mkdir(parents=True, exist_ok=True)
     shutil.unpack_archive(archive_path, DATA_DIR)

tests/test_polygraphdiscrepancy.py

@@ -53,8 +53,8 @@ def test_classifier_metric(
     train, test = clf_metric.compute(sparse_graphs)
 
     assert isinstance(train, float) and isinstance(test, float)
-    assert train >= 0.5, f"Train score {train} is less than 0.5"
-    assert test >= 0.5, f"Test score {test} is less than 0.5"
+    assert train >= 0.7, f"Train score {train} is less than 0.7"
+    assert test >= 0.7, f"Test score {test} is less than 0.7"
 
     train, test = clf_metric.compute(dense_graphs)
     assert train <= 0.2, f"Train score {train} is greater than 0.2"
@@ -87,8 +87,8 @@ def test_polygraphdiscrepancy(
     assert len(result["subscores"]) == len(descriptors)
     assert result["pgd"] == result["subscores"][result["pgd_descriptor"]]
 
-    assert result["pgd"] >= 0.5, (
-        f"PolyGraphDiscrepancy {result['pgd']} is less than 0.5"
+    assert result["pgd"] >= 0.7, (
+        f"PolyGraphDiscrepancy {result['pgd']} is less than 0.7"
     )
 
     result = pgd.compute(dense_graphs)