Sealed

Duo agents write the study, the pipeline seals it before the data arrives, and CI runs it exactly once.