wai-quantum-serve 0.5.1: limits a request cannot pass, and a body is read whole or refused #235

Merged

dcharlot merged 1 commit from wai/quantum-serve-limits into main 2026-10-13 06:38:19 -04:00

Conversation 0 Commits 1 Files changed 3 +163 -23

2026-10-13

Transaction Science

wai-quantum-serve 0.5.1: limits a request cannot pass, and a body is read whole or refused ...

A circuit the algorithm library builds is small (its builders clamp to 12
qubits), but a caller's own OpenQASM could name 26 qubits and any number
of gates, and a receipt any number of shots: one request could hold a
host's memory and CPU. Every such request is now refused before it is
simulated or sealed:

- a POST body over 256 KiB: 413. Before, the body was cut at 4 MiB and the
  cut text parsed as if it were the request;
- a circuit on more than 20 qubits, or of more than 2^27 amplitude
  updates (gates × 2^n): 422. Served as a component on an M4 Max core,
  2^30 took 15 s and 2^27 about 2 s;
- a measurement of more than 1,000,000 shots: 422;
- top above 1024 is read as 1024.

GET / states the limits. The module docs say a host should bound the
component too: time per request, memory per instance, instances at once.

Checked under wasmtime serve 49.0.1 with a 10 s timeout, a 256 MiB memory
limit and a pool of 8 memories: every endpoint, every refusal, a tampered
receipt refused, a circuit at the work limit run in 1.9 s, and of 14
concurrent requests at that limit 8 served and 6 refused at once by the
pool, the server unaffected after.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

3d3ff815c9

• View at this point in history

2026-10-13 02:43:12 -04:00