Watch

Transaction Science a4dee88425 wai-quantum contract over the durable service: sets, provenance, dry runs, the receipt key set and the lease, each with its schema

The durable service's documents join the version contract. A set's result
(wai.quantum.set/1) and a result's provenance (wai.quantum.provenance/1) are
engine schemas; the service's receipt key set (wai.quantum.receipt-keys/1,
with its signed transitions) and the command line's scheduler lease
(wai.quantum.lease/1) are their hosts'. The job request names programs, sweep
and dry_run, a job's result may be a set's, an energy figure may be the
processor packages', and a job names its store digests.

A set's head now names the engine and its schema, inside what its receipt
seals, as every other result does. A result's provenance names the gate set
its compile wrote as basis (it read the compile summary's old target field,
which the rename left empty).

run_quantum_set and dry_run_quantum_job answer to output schemas, each with
its verdict whether refused or not, and run_quantum_circuit asked as a dry
run answers as one. The strict tests call both and hold every answer, the
job's set form and the key set after a rotation to their schemas; the
contract workflow requires the new tests by name, and check_schemas.py reads
the new files and holds a set's run to its schema.

The service's store stays at ~/.local/share/wai-quantum-service/store by
default; the Python check and its tests start the service with a store in
their own scratch, as the service workflow's legs already do.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-28 08:42:53 -04:00

7.1 KiB

Raw Permalink Blame History

What a result's receipt says about where it came from

Provenance surveys of quantum computing platforms sort what a run can record into five categories: the circuit submitted, the computer that ran it, the compilation that carried the one onto the other, the execution of the job, and the software around it. Two more sit beside them: the provider that operated the run, and the evidence for each record (supplied by the provider, derived, captured by the application, unavailable or not applicable). Compilation is the category recorded least: which passes ran, under what options, and from what input to what output, is mostly left on the client and not linked to the job.

This page maps every field of the service's job, its result and its receipt to those categories. A field marked sealed is inside the body the receipt signs, so it cannot be changed without the receipt failing. The receipt seals the request as submitted and the result as returned (receipts).

Since this release, each new result carries provenance (wai.quantum.provenance/1), which fills the gaps below. A result from before it carries none, and its receipt verifies as it always did, since a receipt signs whatever result it was given. A result without provenance reads as before.

Circuit

What	Where	Evidence
The program's text	`request.qasm` (a set: each item's `request.qasm`)	sealed
Its digest	`result.provenance.circuit.program`: BLAKE3 of the text, the name the store keeps it under (`digests.programs`)	sealed; derived
Its size	`result.qubits`, `result.gates`, `result.provenance.circuit`	sealed; derived
Its measurements	the program's own `measure` statements; `result.counts` is keyed by its classical bits	sealed
A generator's inputs, a sweep's point	the item's request holds the program written out at the point; `result.items[i].point`	sealed (the set's request and each item's)
What was repaired first	`result.repaired`: the program that ran and each repair	sealed
What it must do	`request.intent`; `result.verdict`	sealed

Computer

What	Where	Evidence
The machine	a classical simulator: `result.provenance.computer.kind`	sealed
The method, and why	`result.method`; `result.provenance.execution.plan.why`	sealed
Its accuracy	`result.accuracy` (`class`, and a bound, a standard error or a fidelity estimate as the class gives)	sealed
A device target modelled	`result.target`: its hash, the calibration snapshot, the noise derived from it; `result.provenance.computer.target`	sealed
Noise modelled	`request.noise`	sealed
A physical device	none: the service runs no job on a quantum device	not applicable

Compilation

What	Where	Evidence
Whether it was compiled	`result.provenance.compilation.asked`	sealed
Each pass that ran, in order, and its check's verdict	`result.provenance.compilation.passes`: `[{"pass", "verdict"}]`: lowering, checked rewrites, phase folding, one- and two-qubit resynthesis, the Clifford+T approximation	sealed
The options	`request.compile` (`epsilon`, `level`, `basis`); `result.compiled` (`basis`, `level`, `epsilon`); `result.provenance.compilation` (`basis`, `level`, `epsilon`)	sealed
The certificate	`result.compiled.certificate`: the BLAKE3 of the compile certificate's canonical text, which lists every pass with its counts before and after, its check and its distance. `POST /v1/compile` returns the certificate itself, sealed	sealed
The input and output circuits	the input is `request.qasm`; `result.compiled.source` and `.output` count each, and the certificate's own compile (`POST /v1/compile`, with `stages`) gives each pass's circuit	sealed
The distance it carries	`result.compiled.distance`: the bound on the output's distance from the program, within the budget	sealed
Logical to physical qubits	for a device target, `result.target.placement`: the layout chosen, its routes and its expected success	sealed
Random seeds	none: no pass draws a random number (`result.provenance.compilation.seeded: false`)	sealed
The compiler	the engine, by name and version (Software)	sealed
When	the job's times (Execution)	not sealed

A job that asks for no compile says so, "status": "not-applicable", with the reason: the program ran as the reader read it, on the method's own gates.

Execution

What	Where	Evidence
The job's identifier	`id` (128 random bits)	not sealed; the service's
Its status and times	`status`, `submitted_ms`, `started_ms`, `finished_ms`; its status as events (`GET /v1/jobs/{id}/events`)	not sealed; the service's
Interruption	`status: interrupted` and `error`, for a job the service stopped while it ran	not sealed
Shots and seed	`request.shots`, `request.seed`; `result.provenance.execution`	sealed
The plan it ran under	`estimate` (memory, work) beside the job; `result.provenance.execution.plan`	sealed (in provenance)
The results	`result.counts`, `expectations`, `amplitudes`, `dynamic`, `ideal`	sealed
Its time	`result.elapsed_ms`	sealed
Its energy	`result.energy`: a counter reading with its class, scope, attribution and declared uncertainty, or why it is unmetered	sealed
A set's items	`result.items`, each with its own result and receipt; the set's `root`	sealed
Where it is kept	`digests`: the BLAKE3 digests of its request, programs, result and receipt in the store	not sealed; each digest can be recomputed

Software

What	Where	Evidence
The engine	`result.provenance.software.engine`: `wai-quantum <version>`	sealed
The host	`result.provenance.software.host`: `wai-quantum-service <version>`	sealed
The access path	the HTTP API or its MCP tools; a run an agent asks for over MCP carries `"verdict": true` in its request	sealed (the request)
The interface	`GET /v1/openapi.json`	not sealed

Provider and evidence

What	Where	Evidence
Who sealed it	`result.receipt.key` (an Ed25519 key, in hex); `did:key` in the key set	the signature
When that key signed	`GET /.well-known/wai-quantum-receipt-keys`: each key's window and its signed transition to the next	signed transitions
That nothing changed	the receipt's signature over the BLAKE3 digest of the request and result (RFC 8785); `POST /v1/verify` and `wai-quantum verify` check it	the signature
A set's items	the set's receipt over its head, which holds the Merkle root of every item's leaf; each item's `path` to it	the signature

What a receipt does not say

A receipt proves who signed which request and which result. It does not prove the physics is right. How far the engine checked an answer is the verdict's to say (result.verdict: parsed, executed, evidence, proof), and an energy figure is the platform's own reading, relayed and labelled, not independently rooted. The job's identifier and times are the service's account, kept beside the result, not inside the signed body.

7.1 KiB Raw Permalink Blame History