Reproducible rice-genomics QC that proves every result it publishes, from laptop to AWS Batch.
Genomics pipelines are easy to run and hard to trust. Results quietly go stale when a filtering policy changes, a cached task gets reused, or a reference file differs from the one the data was called against. RiceFlow treats provenance as a first-class output. It runs quality control on public rice data along two deliberately separate tracks: a 3,024-sample CoreSNP cohort (already filtered and LD-pruned) and individual-accession VCFs checked against the IRGSP-1.0 reference. The two tracks share one report but are never merged into an invented joint-called cohort. A Python launcher fingerprints every source, policy value and implementation, so a changed input can never silently reuse an old result, and a run is only marked SUCCESS after every artifact hash and output check passes.
Discovers remote file sizes, enforces download budgets (500 MiB full / 16 MiB regional by default) and refuses servers that ignore Range requests, so no multi-gigabyte VCF is ever downloaded. Every source is recorded in a SHA-256 manifest, and cached copies are re-verified before reuse.
A Python launcher stamps each run with its identity, policy, source fingerprint and deadline. Those values feed into Nextflow task inputs, so changing a threshold or the code invalidates exactly the tasks it affects.
Nextflow DSL2 schedules COHORT_QC (Python + PLINK 2: sample QC and recomputed site statistics) and VCF_QC (Python + BCFtools + SAMtools: REF-base validation against IRGSP-1.0, SNP scoping, genotype masking and recomputed metrics) in parallel.
A finalizer builds the report, validates outputs and checksums, then atomically publishes SUCCESS.json. Failed or incomplete runs keep that status permanently and can never inherit an old success marker.
An exporter selects certified public fields into a six-file static site, served from a private S3 bucket through CloudFront with Origin Access Control and AWS WAF. Visitors can browse runs, samples, variant decisions and policy comparisons with no backend or sign-in.
Real cloud run on AWS Batch passed both QC tracks in 262.5 seconds, with all 80 artifact hashes validated
31 biological comparisons matched the same-source local run exactly
Every observed REF base matched the publisher-verified IRGSP-1.0 reference, with no contig aliases or allele swaps needed
Recovery drill: a synthetic failure resumes cleanly, and a policy change correctly invalidates cached results
48 native tests, 48 container tests and an nf-test integration test pass on current source