open-standards/wai/extensions/quantum-ops.md

WAI Extension: Quantum-Operations Attestation (wai.quantum.calibration · wai.quantum.job)

Status: Draft. Engine: wai-rs/src/quantum_ops.rs (feature quantum_ops). The verify-half of WAI (wai.asset.provenance's lineage, specialized) applied to the quantum processing industry.

0. The gap this closes

Every quantum-control stack in the field — Q-CTRL, QuantrolOx, Qruise, Quantum Machines, Qblox, Zurich Instruments, OrangeQS, QuEL, Origin, Conductor, Classiq — emits the same three unsigned things: an HDF5 dataset, a JSON state snapshot, and a dashboard/log. Not one signs, content-addresses, ports, or meters the joules of a single operation. The industry already reaches for reproducibility (QM's __package_versions__, QBOM bills-of-materials, QCIVET hash-chained audit traces, "Vibe Calibration" internal audit records) but stops exactly short of two axes:

1. cryptographic signature + portability — a receipt a third party verifies, not a mutable vendor-cloud dashboard;
2. measured joules — every stack sits on a kW-scale dilution fridge + control racks, yet none emits joules-per-calibration or joules-per-job.

This extension is those two axes. It is not a control system and runs no hardware: the calibration/job is performed by the sink's control stack, exactly as WAI dispatches a decode to a sink's codec. WAI owns the receipt.

1. Two receipts, cross-linked

wai.quantum.calibration — CalibrationReceipt

A signed record of one bring-up / tune-up run:

• device_id, target ("q3", "cz(q3,q4)", "readout:q3")
• config_hash — content hash of the applied pulse/gate config
• evidence[] — each an {kind, blob_hash, summary}: a benchmark outcome (RB / T1·T2 / Rabi / readout-GMM) content-addressed to its raw dataset bytes, so a fidelity claim binds to the exact bytes that produced it (evidence_matches()) — checkable, not asserted
• joules_micro — measured energy of the run (attested), with its acquisition class as an optional signed label: quantum_energy::Labelled wraps any receipt here and re-signs it with the class inside the signature, and LabelledQbom labels a bill of materials per entry (energy-measurement §2.8). An unlabelled receipt keeps its legacy bytes.
• grant — the authorization (below)
• parent_receipt_hash — the prior device state this supersedes: the signed "digital twin" lineage vendors keep only as mutable, unsigned data

merkle_root covers [config_hash] ++ evidence leaves; one Ed25519 signature covers the whole payload.

wai.quantum.job — JobReceipt

A signed record of one dispatched circuit:

• backend_id — which QPU/sim actually ran it ("ionq:aria-1", "wai.quantum.circuit")
• circuit_hash, result_hash (counts histogram / statevector), shots
• calibration_ref — the CalibrationReceipt::receipt_hash of the device state the job ran under. verify_against_calibration(cal) confirms the job names that calibration and both verify — the QCIVET "the claimed calibration was actually in effect" property, signed. None for a simulator.
• joules_micro, grant, parent_receipt_hash

2. The grant — gate ⊗ meter ⊗ receipt in one object

GrantRef = capability ⊗ joule-ceiling (⊗ optional funds-ceiling, JCP §4.8 dual ceiling). The full grant lives in the JCP layer; the receipt binds its content hash plus the ceilings it enforces.

The enforcement is the sharp part: the joule ceiling is checked inside verify(). A receipt whose measured joules_micro exceeds its grant ceiling is not valid — an operation that blew its energy grant cannot produce a passing receipt. This is the whole portfolio thesis (gate, meter, receipt) collapsed into a single verifiable object. honors_budget() exposes the check on its own; a grant with joule_ceiling_micro = u64::MAX opts out (still signs everything else).

3. Conformance

• A conforming producer (a control stack, or an adapter over one — see §5) MUST seal a CalibrationReceipt per calibration run and a JobReceipt per dispatched job, with joules_micro a measured figure (never fabricated; 0/unbounded if genuinely unmetered) and every hash the real content hash.
• A conforming verifier MUST accept a receipt iff verify() passes — Merkle root recomputes, joules within the grant ceiling, signature valid — and, for a job that claims a calibration state, verify_against_calibration() passes.
• Receipts are portable: JSON with hex hashes (to_json/from_json), verifiable with only the public key. No vendor cloud required.

4. What this is NOT

• Not a control system, not a simulator, not a calibration ML. It attests operations others perform. The physical control electronics and the ML tuning models are the dispatched backend — WAI's founding "don't reinvent, dispatch" philosophy (SPEC Appendix B), applied to quantum control.
• Not a reconstruction. joules_micro and the result are attested (only the signer can vouch for their own silicon's energy draw); the hashes, Merkle root, grant ceiling, and cross-link are verifiable by anyone. The receipt states plainly which half is which.

5. Integration (where it attaches)

The natural attach point is the control-system → cloud boundary: the moment a calibration node or a job completes, the control system already holds everything a receipt needs (config, evidence datasets, result, timing, backend identity), and the power rails are already instrumented — so adding a signature + a joule figure is incremental. Ranked open-source insertion points:

1. Quantify (quantify-core) — one HDF5-write chokepoint, co-owned by Qblox + OrangeQS: one adapter covers two vendors (Phase 1 target).
2. OrangeQS Juice — open lab-OS whose Task-Management + DB layer is a natural control plane; production chip-testing, where a signed pass/fail has direct commercial value.
3. QUAlibrate/QUAM — largest install base; the per-node boundary + the existing __package_versions__ hook upgrade cleanly to a signed, metered receipt.
4. Qubex/qube-calib (QuEL) — fully open, clean CalibrationNote artifact.

Adoptability is openness-first: Japan (QuEL/OQTOPUS), India (NQM), Korea (SDT/ NVQLink, Norma/PQC), and the Western merchant vendors (receipt as an anti-lock-in feature). Sovereign closed champions are parallel, not addressable.

6. The unclaimed metric

"Joules per verified calibration" and "joules per QPU job" are unmeasured and unclaimed across the entire field. This extension is the object that carries them — signed, portable, content-addressed, and grant-bounded.