wai-quantum: QIR and jeff read and written on every surface, each conversion checked, bounded against hostile input #554

Merged

dcharlot merged 10 commits from wai/quantum-interchange into main 2026-10-31 09:48:06 -04:00

Conversation 0 Commits 10 Files changed 128 +11985 -184

dcharlot commented 2026-10-31 07:17:18 -04:00

Owner

Copy link

Programs now move between OpenQASM 3, QIR and jeff. The engine reads QIR (1.x and 2.x, under the profile its entry point names) and jeff 0.3, and writes both. Every conversion is checked by the equivalence ladder, and the result says how. Every surface takes the other formats: the command line, both MCP servers, the job service, the browser engine, the Studio and the desktop app. The readers are bounded against hostile input, and a seeded mutation test over the whole conformance set holds them to that natively and under wasm32-wasip2.

What it adds

QIR (engine::formats, LLVM text)

• Reads QIR 1.x and 2.x under the profile the entry point names. The base profile's rules and the adaptive profile's module flags are enforced, and what a profile forbids is refused with its code and line.
• Rotations at arbitrary angles are read at their exact doubles, with a note that the double-precision methods take them. A Clifford+T module stays on the bit-exact path.
• Writes QIR 2.0: the base profile, or the adaptive profile with forward branches for a program that measures mid-circuit or branches.

jeff (format 0.3, through a small Cap'n Proto reader and writer of the crate's own)

• Structured control flow is decided or unrolled on reading. A switch on a measured bit is written as a condition.
• Pauli-product rotations are lowered exactly. Custom gates are read only by a standard name.
• Integers convert to floats and floats to integers as the schema says.

Refusals and checks

• Every refusal has a code (Q700–Q721) and its place.
• convert() checks each conversion with the equivalence ladder: written back to its format, read again and compared. The answer names the check and each of the reader's notes with its code.

The conformance set (wai/quantum-conformance/formats/)

• A module for each construct. Each lists the program it must read to (a reference the equivalence ladder holds), the outcomes it gives, a round trip back to its format, the formats it writes to, and every refusal with its code and place.
• It holds the QIR specification's two example programs, every intrinsic, a QIR 1 module with typed pointers, and the profiles' refusals.
• It holds jeff modules built field by field from the schema, and the jeff project's own structured benchmarks and examples, unchanged.
• It holds OpenQASM sources written to each format, the QIR written pinned by its BLAKE3.

Surfaces

• CLI: wai-quantum convert FILE --to qasm|qir|jeff [--profile base|adaptive] [-o FILE] [--json], the conversion checked and its notes on standard error. Every verb that reads a program reads .ll, .qir and .jeff by extension, or by the global --from.
• Both MCP servers: the new tool convert_program (one definition, from the engine), its answer the tools schema's new convert. The command line's run tools (run_quantum_circuit, plan_quantum_circuit, run_on_target) take a program's source, as the service's do: one schema (engine::formats::source_schema) and one refusal, the reader's code before the job layer's.
• Service: POST /v1/convert within its bounds. A job may carry its program as {"source": {"format", "program" | "program_base64"}} in place of qasm, read before anything else reads it.
• wasm: engine_convert.
• Studio: Open takes .ll, .qir and .jeff beside .qasm. The engine reads the file to OpenQASM 3 in the worker, and the program goes into the editor as a version from the file. The line under it names the format, its version, the check and the reader's notes. A module the reader refuses leaves the editor as it was, with the refusal and its code in the status line.
• Desktop: a convert command.
• Docs: docs/formats.md (its commands run under the documentation check), the engine, CLI and service READMEs with their translations, and the changelog.

Bounds against hostile input

• A jeff register's size is checked against the qubit cap before anything is allocated (Q111). Before, one of 2³² − 1 qubits asked for 34 GB, and under wasm32-wasip2 it trapped.
• The wire reader bounds every pointer, segment and list in 64-bit arithmetic (a segment count of u32::MAX overflowed a 32-bit usize), and counts each list element against the words it may visit.
• The jeff reader counts every register slot, array element, call frame and condition term against one budget. It caps arrays, values per function, operations run and gates written (Q210), and no longer truncates a 64-bit size, index, selector or shift.
• The QIR reader no longer copies a block's lines on each visit. It bounds the nesting of branches (64), the instructions run over every path and the state each path copies.
• A written condition is at most 1 024 terms and 32 deep.
• A conversion's check is not run past 262 144 gates applied or 4×10⁹ amplitudes, and says so. Before, 70 000 repeated gates took 33 s in the check; that module now takes about 1.2 s.
• Both readers take modules of up to 16 MiB.

tests/formats_mutation.rs mutates every QIR and jeff file of the conformance set from a fixed seed: 45 153 inputs, with bits flipped, files cut short and spliced, and every length, count, offset and 32-bit field inflated. Each must convert or be refused with a code of the table, within 20 s and 1 GiB as measured by a counting allocator. wai-quantum-formats.yml runs it natively and under wasm32-wasip2 (a release build with overflow checks), the count pinned.

Two more fixes:

• The service's MCP run tools expanded a source twice and then refused their own expanded run with J003. Reading a source is now idempotent.
• The service smoke now makes more submissions than a default window's 30 (pulse and the other formats together), so it reads where the client stands from GET /v1/health before each POST and waits when none are left. CI starts each instance it smokes with WAI_QSVC_CLIENT_BURST=60, so it never waits there.

Checked

Where	Result
Linux build host	formats lib tests: 24 passed. formats_conformance: 2 passed. Mutation test: 45 153 inputs held (16 627 converted, 28 526 refused with a code; slowest 0.868 s; largest peak 245 MB). wasip2 under wasmtime: conformance 1 passed; mutation test (release, overflow checks on) 1 passed, slowest 0.689 s, peak 149 MB. CLI and service smoke: every check held. Breaking gate: no unacknowledged break. Repository checks: all 10 lines ok.
Linux build host, docs check	check_docs.py --cli --service --rust against a local service: docs/formats.md, the CLI README and its zh-CN page (28 shell blocks, 28 receipts), the service README (5 blocks, 3 receipts), docs/README and its zh page, the Studio README and its zh page, the engine README and its zh page. All passed.
After rebasing onto #551 (Linux build host)	Service mcp::: 14 passed. CLI: 71 passed (bin) and every integration target. Service: 37 + 1. wai-web native: 28 passed. Engine --features full --lib: 1111 passed. formats_conformance: 2 passed. Mutation test: 45 153 held (slowest 0.815 s). CLI smoke: every check held. Service smoke in three windows: CI's (burst 60) in 4 s, never paced; production's default (30 in 600 s) in 601 s, paced twice; a small one (3 in 20 s) in 205 s, paced 26 times. Breaking gate: no unacknowledged break.
After rebasing onto #551 (macOS build host)	wai-web wasm32: 20 passed. The Studio's browserless tests passed (hardware, telemetry, update, locales). build-views --check passed after the views page was rebuilt (see below). studio.test.mjs run twice: every check passed, including a QIR module opened and checked, a jeff module with its Q715 notes, and a base-profile module refused with Q704 and the editor kept. Desktop: 19 passed, including a_program_in_another_format_opens_in_the_app; clippy clean.
After rebasing onto main 55524840f	The tree is the one checked above plus main's one change since, to wai-conformance.yml (two arm64 jobs built without debuginfo). Nothing was run again by hand for it; this PR's CI runs every leg.

The views page. The Studio's Open names QIR and jeff in locales/*/frame.json, which the views page is built from, so the page was rebuilt (fbe0cb0fb) with wai/wai-quantum-views/build.sh in catthehacker/ubuntu:act-22.04 with Rust 1.98.0, as the views workflow rebuilds it.

Two tests that write QIR 1 need quantum_qir, which quantum_engine does not include, so they carry #[cfg(feature = "quantum_qir")]. Two pulse tests that seal their answers carry #[cfg(feature = "quantum_receipt")]. The contract workflow's test build compiles again, and the formats workflow still runs all four in the full build.

Not done

• jeff for a program that branches on a measurement. In jeff, a measurement inside a switch merges as a condition over SSA arrays, while OpenQASM bits are mutable and written only by measurement. Writing one needs register allocation for bits. Until then such a program is refused with Q720.

Breaking

None. The breaking gate passes, and the changelog acknowledges no break.

🤖 Generated with Claude Code

Programs now move between OpenQASM 3, QIR and jeff. The engine reads QIR (1.x and 2.x, under the profile its entry point names) and jeff 0.3, and writes both. Every conversion is checked by the equivalence ladder, and the result says how. Every surface takes the other formats: the command line, both MCP servers, the job service, the browser engine, the Studio and the desktop app. The readers are bounded against hostile input, and a seeded mutation test over the whole conformance set holds them to that natively and under wasm32-wasip2. ## What it adds **QIR** (`engine::formats`, LLVM text) - Reads QIR 1.x and 2.x under the profile the entry point names. The base profile's rules and the adaptive profile's module flags are enforced, and what a profile forbids is refused with its code and line. - Rotations at arbitrary angles are read at their exact doubles, with a note that the double-precision methods take them. A Clifford+T module stays on the bit-exact path. - Writes QIR 2.0: the base profile, or the adaptive profile with forward branches for a program that measures mid-circuit or branches. **jeff** (format 0.3, through a small Cap'n Proto reader and writer of the crate's own) - Structured control flow is decided or unrolled on reading. A switch on a measured bit is written as a condition. - Pauli-product rotations are lowered exactly. Custom gates are read only by a standard name. - Integers convert to floats and floats to integers as the schema says. **Refusals and checks** - Every refusal has a code (`Q700`–`Q721`) and its place. - `convert()` checks each conversion with the equivalence ladder: written back to its format, read again and compared. The answer names the check and each of the reader's notes with its code. **The conformance set** (`wai/quantum-conformance/formats/`) - A module for each construct. Each lists the program it must read to (a reference the equivalence ladder holds), the outcomes it gives, a round trip back to its format, the formats it writes to, and every refusal with its code and place. - It holds the QIR specification's two example programs, every intrinsic, a QIR 1 module with typed pointers, and the profiles' refusals. - It holds jeff modules built field by field from the schema, and the jeff project's own structured benchmarks and examples, unchanged. - It holds OpenQASM sources written to each format, the QIR written pinned by its BLAKE3. **Surfaces** - CLI: `wai-quantum convert FILE --to qasm|qir|jeff [--profile base|adaptive] [-o FILE] [--json]`, the conversion checked and its notes on standard error. Every verb that reads a program reads `.ll`, `.qir` and `.jeff` by extension, or by the global `--from`. - Both MCP servers: the new tool `convert_program` (one definition, from the engine), its answer the tools schema's new `convert`. The command line's run tools (`run_quantum_circuit`, `plan_quantum_circuit`, `run_on_target`) take a program's `source`, as the service's do: one schema (`engine::formats::source_schema`) and one refusal, the reader's code before the job layer's. - Service: `POST /v1/convert` within its bounds. A job may carry its program as `{"source": {"format", "program" | "program_base64"}}` in place of `qasm`, read before anything else reads it. - wasm: `engine_convert`. - Studio: Open takes `.ll`, `.qir` and `.jeff` beside `.qasm`. The engine reads the file to OpenQASM 3 in the worker, and the program goes into the editor as a version from the file. The line under it names the format, its version, the check and the reader's notes. A module the reader refuses leaves the editor as it was, with the refusal and its code in the status line. - Desktop: a `convert` command. - Docs: `docs/formats.md` (its commands run under the documentation check), the engine, CLI and service READMEs with their translations, and the changelog. ## Bounds against hostile input - A jeff register's size is checked against the qubit cap before anything is allocated (`Q111`). Before, one of 2³² − 1 qubits asked for 34 GB, and under wasm32-wasip2 it trapped. - The wire reader bounds every pointer, segment and list in 64-bit arithmetic (a segment count of `u32::MAX` overflowed a 32-bit `usize`), and counts each list element against the words it may visit. - The jeff reader counts every register slot, array element, call frame and condition term against one budget. It caps arrays, values per function, operations run and gates written (`Q210`), and no longer truncates a 64-bit size, index, selector or shift. - The QIR reader no longer copies a block's lines on each visit. It bounds the nesting of branches (64), the instructions run over every path and the state each path copies. - A written condition is at most 1 024 terms and 32 deep. - A conversion's check is not run past 262 144 gates applied or 4×10⁹ amplitudes, and says so. Before, 70 000 repeated gates took 33 s in the check; that module now takes about 1.2 s. - Both readers take modules of up to 16 MiB. `tests/formats_mutation.rs` mutates every QIR and jeff file of the conformance set from a fixed seed: 45 153 inputs, with bits flipped, files cut short and spliced, and every length, count, offset and 32-bit field inflated. Each must convert or be refused with a code of the table, within 20 s and 1 GiB as measured by a counting allocator. `wai-quantum-formats.yml` runs it natively and under wasm32-wasip2 (a release build with overflow checks), the count pinned. Two more fixes: - The service's MCP run tools expanded a `source` twice and then refused their own expanded run with `J003`. Reading a source is now idempotent. - The service smoke now makes more submissions than a default window's 30 (pulse and the other formats together), so it reads where the client stands from `GET /v1/health` before each POST and waits when none are left. CI starts each instance it smokes with `WAI_QSVC_CLIENT_BURST=60`, so it never waits there. ## Checked | Where | Result | |---|---| | Linux build host | formats lib tests: 24 passed. `formats_conformance`: 2 passed. Mutation test: 45 153 inputs held (16 627 converted, 28 526 refused with a code; slowest 0.868 s; largest peak 245 MB). wasip2 under wasmtime: conformance 1 passed; mutation test (release, overflow checks on) 1 passed, slowest 0.689 s, peak 149 MB. CLI and service smoke: every check held. Breaking gate: no unacknowledged break. Repository checks: all 10 lines ok. | | Linux build host, docs check | `check_docs.py --cli --service --rust` against a local service: `docs/formats.md`, the CLI README and its zh-CN page (28 shell blocks, 28 receipts), the service README (5 blocks, 3 receipts), `docs/README` and its zh page, the Studio README and its zh page, the engine README and its zh page. All passed. | | After rebasing onto #551 (Linux build host) | Service `mcp::`: 14 passed. CLI: 71 passed (bin) and every integration target. Service: 37 + 1. wai-web native: 28 passed. Engine `--features full --lib`: 1111 passed. `formats_conformance`: 2 passed. Mutation test: 45 153 held (slowest 0.815 s). CLI smoke: every check held. Service smoke in three windows: CI's (burst 60) in 4 s, never paced; production's default (30 in 600 s) in 601 s, paced twice; a small one (3 in 20 s) in 205 s, paced 26 times. Breaking gate: no unacknowledged break. | | After rebasing onto #551 (macOS build host) | wai-web wasm32: 20 passed. The Studio's browserless tests passed (hardware, telemetry, update, locales). `build-views --check` passed after the views page was rebuilt (see below). `studio.test.mjs` run twice: every check passed, including a QIR module opened and checked, a jeff module with its `Q715` notes, and a base-profile module refused with `Q704` and the editor kept. Desktop: 19 passed, including `a_program_in_another_format_opens_in_the_app`; clippy clean. | | After rebasing onto main `55524840f` | The tree is the one checked above plus main's one change since, to `wai-conformance.yml` (two arm64 jobs built without debuginfo). Nothing was run again by hand for it; this PR's CI runs every leg. | **The views page.** The Studio's Open names QIR and jeff in `locales/*/frame.json`, which the views page is built from, so the page was rebuilt (`fbe0cb0fb`) with `wai/wai-quantum-views/build.sh` in `catthehacker/ubuntu:act-22.04` with Rust 1.98.0, as the views workflow rebuilds it. Two tests that write QIR 1 need `quantum_qir`, which `quantum_engine` does not include, so they carry `#[cfg(feature = "quantum_qir")]`. Two pulse tests that seal their answers carry `#[cfg(feature = "quantum_receipt")]`. The contract workflow's test build compiles again, and the formats workflow still runs all four in the full build. ## Not done - jeff for a program that branches on a measurement. In jeff, a measurement inside a switch merges as a condition over SSA arrays, while OpenQASM bits are mutable and written only by measurement. Writing one needs register allocation for bits. Until then such a program is refused with `Q720`. ## Breaking None. The breaking gate passes, and the changelog acknowledges no break. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 10 commits 2026-10-31 07:17:18 -04:00

wai-quantum: QIR 2.x under its profiles, and jeff, read and written ... 4866dd9159

engine::formats reads QIR (LLVM text, 1.x and 2.x) under the profile its
entry point names: the base profile's rules and the adaptive profile's
module flags are enforced, and what a profile forbids is refused with its
code and line. Rotations at arbitrary angles are read at their exact
doubles, with a note that the double-precision methods take them; a
Clifford+T module stays on the bit-exact path. A program is written as
QIR 2.0: the base profile, or the adaptive profile with forward branches
for a program that measures in the middle or branches.

jeff (format 0.3) is read and written through a small Cap'n Proto reader
and writer of the crate's own: structured control flow decided or
unrolled on reading, a switch on a measured bit written as a condition,
Pauli-product rotations lowered exactly, custom gates read only by a
standard name. Every refusal has a code (Q700 to Q721) and its place, and
convert() checks each conversion with the equivalence ladder.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

quantum-conformance: other formats, natively and under wasm32-wasip2 ... 5fe6f317c1

wai/quantum-conformance/formats/ holds a module for each construct, each
with the program it must read to (a reference held by the equivalence
ladder), the outcomes it gives, a round trip back to its format, the
formats it writes to, and every refusal with its code and its place: the
QIR specification's two example programs, every intrinsic, a QIR 1 module
with typed pointers, the profiles' refusals; jeff modules built field by
field from the schema; the jeff project's own structured benchmarks and
examples, unchanged; and OpenQASM sources written to each format, the QIR
written pinned by its BLAKE3. CI runs it in wai-quantum-formats.yml, with
the readers' and writers' unit tests.

The jeff reader now converts integers to floats and floats to integers,
and a QIR conversion is checked against the type it gives.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-quantum: other formats on every surface ... 421a165493

The command line converts with `wai-quantum convert FILE --to
qasm|qir|jeff [--profile base|adaptive] [-o FILE] [--json]`, the
conversion checked and its notes on standard error, and every verb that
reads a program reads QIR (.ll, .qir) and jeff (.jeff) by its extension,
or by the global --from. Both MCP servers serve convert_program (the one
definition, from the engine), its answer the tools schema's new convert;
the job service answers POST /v1/convert within its bounds, and a job may
carry its program as {"source": {"format", "program" | "program_base64"}}
in place of qasm, read before anything else reads it. The Studio's engine
has engine_convert. The agent docs are regenerated; both smoke scripts
convert, run a QIR module and check a profile's refusal; the wasm32 and
native pins in wai-web-wasm.yml move to 19 and 27.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-quantum: other formats documented, and a jeff module's gates capped ... 2c6bc9e980

The engine, command line and service READMEs (and their translations)
describe the readers and writers, convert, --from, convert_program,
POST /v1/convert and a job's source; docs/formats.md, whose commands now
run under the documentation check, says what each reader takes; the
changelog has the section. A jeff module that unrolls to more gates than
the reader holds is refused (Q210) instead of growing without bound.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-quantum: other formats bounded against hostile input, in CI ... cb059d7a0b

A jeff register's size reached Vec::with_capacity before the qubit cap,
so one of 2^32 - 1 qubits asked for 34 GB: under wasm32-wasip2 the test
written first trapped in qureg_op. It is now refused (Q111) before
anything is made. The audit of every allocation and loop sized by the
input:

- the wire reader bounds every pointer, segment and list in 64 bits (a
  segment count of u32::MAX overflowed a 32-bit usize), and counts each
  list element against the words it may visit;
- the jeff reader counts every register slot, array element (an array
  copied by setIndex included), call frame and condition term against
  one budget, caps arrays, values per function, operations run and gates
  written, shares conditions between copies, and no longer truncates a
  64-bit size, index, selector or shift to fit;
- the QIR reader no longer copies a block's lines on each visit, bounds
  the nesting of branches, the instructions run over every path and the
  state each path copies, and dedups a condition's reads;
- a condition is at most 1 024 terms and 32 deep once written, a run of
  one operator written flat;
- a conversion's check is not run past 262 144 gates applied or 4e9
  amplitudes, and says so; both readers take modules of up to 16 MiB.

tests/formats_mutation.rs mutates every QIR and jeff file of the
conformance set from a fixed seed (45 153 inputs: bits flipped, files cut
short and spliced, every length, count, offset and 32-bit field inflated)
and holds each to converting or a refusal with a code of the table,
within 20 s and 1 GiB measured by a counting allocator.
wai-quantum-formats.yml runs it natively and under wasm32-wasip2 (a
release build with overflow checks), the count pinned.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-quantum-cli: the stdio MCP run tools take a program's source ... f72c8d1250

run_quantum_circuit, plan_quantum_circuit and run_on_target on the
command line's server take {"source": {"format", "program" |
"program_base64"}} in place of qasm, read to the job's qasm first, as the
job service's run tools now declare it too: one schema
(engine::formats::source_schema) and one refusal, the reader's code
before the job layer's. Reading a source is idempotent: a request whose
qasm is what its source reads to (one read already, or sealed) reads as
it is, and the service no longer refused its own expanded runs. The
tools-list tests call each with a source and with a refusal; the agent
docs are re-blessed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

quantum-studio: open QIR and jeff files through the engine ... f55e7c03a0

"Open" takes .ll, .qir and .jeff beside .qasm: the engine reads the file
to OpenQASM 3 in the page (engine_convert, in the worker), the program
goes into the editor as a version from the file, and the line under it
names the format and its version, the check (written back to its format
and read again) and each of the reader's notes with its code. A module
the reader refuses leaves the editor as it was, the refusal and its code
in the status line. The desktop app answers the same request with a
convert command. The Studio e2e opens a QIR module, a jeff module and a
module its profile forbids; the desktop's test is pinned in CI.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-quantum views: the page rebuilt with the Studio's words for other formats, in the image CI rebuilds it in ... 3d0760fa71

The Studio's file open names QIR and jeff in locales/*/frame.json, which the views page is built
from, so build-views --check refused the page. Rebuilt with wai/wai-quantum-views/build.sh in
catthehacker/ubuntu:act-22.04 with Rust 1.98.0, as the views workflow rebuilds it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-quantum-service smoke: paced within the client's window; the agent docs for pulse and other formats together ... a80fb98c32

With the pulse and the other-format checks both in it, the smoke makes more submissions than a
default window's 30, and the service refused the last with J030. Before each POST the script
now reads where the client stands from GET /v1/health (RateLimit: r left, t seconds until one
more is), and with none left it waits for one. Against production it takes longer and checks
the same things. CI starts each instance it smokes with WAI_QSVC_CLIENT_BURST=60, so it never
waits there.

The agent docs (llms-full.txt, service-mcp.json) are blessed again from both branches' tools.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-quantum: the tests that need the dyadic QIR writer or the receipts built only with them ... 3cafd3f532

Two of the other formats' tests write QIR 1 with crate::quantum_qir, which quantum_engine does not
include, so the contract workflow's test build (quantum_engine with quantum_receipt, quantum_qec and
quantum_noise) did not compile. They now carry #[cfg(feature = "quantum_qir")] and still run in the
full build, where the formats workflow runs them. Two pulse tests seal their answers, so they carry
#[cfg(feature = "quantum_receipt")], as error correction's sealing test does.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit de3fce0d31 into main 2026-10-31 09:48:06 -04:00

dcharlot referenced this pull request from a commit 2026-10-31 09:48:08 -04:00

Merge pull request 'wai-quantum: QIR and jeff read and written on every surface, each conversion checked, bounded against hostile input' (#554) from wai/quantum-interchange into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!554

No description provided.