Per-task admission control for genomics pipelines
A gate that decides, for every task in a bioinformatics pipeline, whether it may run — and records why either way.
Measured on a real nf-core pipeline rather than a synthetic one: 119 µs median for the whole gate process over 210 decisions, independently replayable from the published corpus.
The finding was not the latency. AWS's own Nextflow linter listed the hook the gate depends on among directives their managed service does not support, which would have put per-task governance out of reach. That file was two years stale and already contradicted by AWS's current documentation for a neighbouring directive. Treated as a hypothesis and probed against a local control: it runs. The gate now permits and refuses per task on the managed service.
Transferable principle: when an enforcement boundary matters, validate it experimentally rather than assume the documented boundary is the real one.