Concepts

Dependency snapshot

The complete, resolved set of what a pipeline version depends on: engine version, every process's container (by digest), tool versions read from container tags, every parameter after profile and config layering, and the reference genome's checksum. It is serialised as canonical JSON (RFC 8785) and hashed with SHA-256.

The hash describes the pipeline, not the machine: local paths, output directories and per-run timestamps are excluded, and files are represented by their checksums.

For Nextflow, Aver reads the configuration and processes from nextflow config and nextflow inspect. For Snakemake, a pinned Snakemake loads the workflow and reports each rule's container, conda environment and wrapper, and the final config; Aver adds container digests, the SHA-256 of each environment file, the packages it declares, and any conda pin file. Loose conda specs, mutable tags (:latest) and wrappers not referenced by a release are recorded as unpinned, never guessed.

Reference materials and truth sets

Aver benchmarks only against public GIAB reference materials:

Code	Description
HG001	NA12878, CEU
HG002	Ashkenazi son (default; most complete truth set)
HG003 / HG004	Ashkenazi father / mother
HG005	Chinese son
HG006 / HG007	Chinese father / mother

Truth-set releases are confirmed against the upstream source before they enter the catalogue, and every file carries a recorded SHA-256. The default for HG002 on GRCh38 is the published v4.2.1 benchmark. GIAB's newer v5.0q set is listed but marked draft, and is never selected unless you ask for it explicitly.

Metrics

Metric	Definition
Recall	TP / (TP + FN), over truth variants inside the confident regions
Precision	TP / (TP + FP), over query variants inside the confident regions
F1	Harmonic mean of recall and precision
Delta	Percentage-point difference from the baseline, never a relative percentage

Comparison is haplotype-aware (hap.py with RTG vcfeval), restricted to the truth set's confident regions intersected with your target BED when you supply one. Headline figures use PASS variants; the ALL rows are kept in the report's appendix.

Severity

Change	Severity	Re-run	Blocks baseline
Documentation-only change	informational	no	no
Container rebuilt, identical tool versions	documentation	no	no
Tool patch, minor or major version change	review required	yes	no
Parameter change outside the declared-safe list	review required	yes	no
Annotation database release change	review required	yes	no
Reference genome change	revalidation required	yes	yes
Metric delta beyond your policy threshold	revalidation required	—	yes
Unpinned dependency in a clinical pipeline	critical	no	yes
Reference data checksum mismatch	critical	no	yes

The final severity is the highest of the dependency-derived and metric-derived results. Every classification lists each rule that fired and why.

Determinism

The same inputs produce the same snapshot hash, the same run cache key and a byte-identical report. Reports take every date from the recorded data, never from the clock, embed their fonts, and are sealed by a manifest of SHA-256 hashes that aver verify recomputes.