qcheck-quantum 0.2.0__py3-none-any.whl

qcheck/__init__.py

@@ -0,0 +1,3 @@
+"""qcheck - verify LLM-generated quantum code (Qiskit / OpenQASM) statically and safely."""
+
+__version__ = "0.2.0"

qcheck/__main__.py

@@ -0,0 +1,6 @@
+import sys
+
+from .cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())

qcheck/checks_qasm.py

@@ -0,0 +1,169 @@
+"""Lightweight static checks for OpenQASM 2/3, pure stdlib (regex + line scan).
+
+Not a full parser. It catches the failure modes LLMs commonly produce: missing
+header, undeclared registers, out-of-range indices, malformed measurements,
+unsupported includes, and suspicious non-QASM content. One statement per line is
+assumed (true for almost all generated QASM); spanning statements degrade to a
+malformed-statement warning rather than a crash.
+"""
+from __future__ import annotations
+
+import re
+from typing import List, Tuple
+
+from .report import Finding
+
+_INDEXED = re.compile(r"([A-Za-z_][A-Za-z0-9_]*)\s*\[\s*(\d+)\s*\]")
+_QREG2 = re.compile(r"^qreg\s+([A-Za-z_]\w*)\s*\[\s*(\d+)\s*\]$")
+_CREG2 = re.compile(r"^creg\s+([A-Za-z_]\w*)\s*\[\s*(\d+)\s*\]$")
+_QUBIT3 = re.compile(r"^qubit\s*\[\s*(\d+)\s*\]\s*([A-Za-z_]\w*)$")
+_BIT3 = re.compile(r"^bit\s*\[\s*(\d+)\s*\]\s*([A-Za-z_]\w*)$")
+_INCLUDE = re.compile(r'include\s+"([^"]+)"')
+_SUSPICIOUS = re.compile(
+    r"(import\s+os|subprocess|os\.system|__import__|<script|rm\s+-rf|eval\(|exec\(|;\s*rm\s)",
+    re.IGNORECASE)
+_SAFE_INCLUDES = {"qelib1.inc", "stdgates.inc"}
+
+
+def check_qasm(text: str, framework: str) -> Tuple[bool, List[Finding], List[str]]:
+    findings: List[Finding] = []
+    fixes: List[str] = []
+    qregs: dict[str, int] = {}
+    cregs: dict[str, int] = {}
+    header_seen = False
+
+    for i, raw in enumerate(text.split("\n"), start=1):
+        line = raw.split("//", 1)[0].strip()
+        if not line:
+            continue
+
+        if _SUSPICIOUS.search(line):
+            findings.append(Finding(
+                "QASM-SUSPICIOUS", "error",
+                f"Suspicious non-QASM content on this line: {line[:50]!r}", i))
+            continue
+
+        if not line.endswith(";"):
+            # Block openers (gate defs) end with { -- ignore those.
+            if line.endswith("{") or line.endswith("}"):
+                continue
+            findings.append(Finding(
+                "QASM-NO-SEMICOLON", "warning",
+                "Statement does not end with ';' (possibly malformed or split "
+                "across lines).", i))
+            continue
+
+        stmt = line[:-1].strip()
+        low = stmt.lower()
+
+        if low.startswith("openqasm"):
+            header_seen = True
+            continue
+        if low.startswith("include"):
+            m = _INCLUDE.search(stmt)
+            inc = m.group(1) if m else ""
+            if inc not in _SAFE_INCLUDES:
+                findings.append(Finding(
+                    "QASM-INCLUDE", "warning",
+                    f"Unsupported/unknown include {inc!r}.", i))
+            continue
+        if low in ("", "qelib1.inc"):
+            continue
+
+        m = _QREG2.match(stmt)
+        if m:
+            qregs[m.group(1)] = int(m.group(2))
+            continue
+        m = _CREG2.match(stmt)
+        if m:
+            cregs[m.group(1)] = int(m.group(2))
+            continue
+        m = _QUBIT3.match(stmt)
+        if m:
+            qregs[m.group(2)] = int(m.group(1))
+            continue
+        m = _BIT3.match(stmt)
+        if m:
+            cregs[m.group(2)] = int(m.group(1))
+            continue
+
+        if low.startswith("gate ") or low.startswith("def "):
+            continue  # custom gate / subroutine definition, skip in v0
+
+        # measurement
+        if "measure" in low:
+            _check_measure(stmt, qregs, cregs, i, findings, fixes)
+            continue
+
+        # generic gate application: validate every indexed register reference
+        _check_refs(stmt, qregs, cregs, i, findings, declared_required=True)
+
+    if framework == "qasm2" and not header_seen:
+        findings.insert(0, Finding(
+            "QASM-NO-HEADER", "error",
+            "Missing 'OPENQASM 2.0;' header.", 1))
+        fixes.append("Add 'OPENQASM 2.0;' as the first line.")
+
+    syntax_valid = not any(f.id in ("QASM-SUSPICIOUS",) for f in findings)
+    return syntax_valid, findings, fixes
+
+
+def _check_refs(stmt, qregs, cregs, line, findings, declared_required):
+    for name, idx in _INDEXED.findall(stmt):
+        idx = int(idx)
+        if name in qregs:
+            size = qregs[name]
+        elif name in cregs:
+            size = cregs[name]
+        else:
+            if declared_required:
+                findings.append(Finding(
+                    "QASM-UNDECLARED-REG", "error",
+                    f"Register {name!r} used before declaration.", line))
+            continue
+        if idx >= size:
+            findings.append(Finding(
+                "QASM-INDEX-RANGE", "error",
+                f"Index {name}[{idx}] out of range (register size {size}).", line))
+
+
+def _check_measure(stmt, qregs, cregs, line, findings, fixes):
+    # qasm2: measure q[i] -> c[j] ; qasm3: c[j] = measure q[i]
+    if "->" in stmt:
+        src, _, tgt = stmt.partition("->")
+        src = src.replace("measure", "").strip()
+        tgt = tgt.strip()
+    elif "=" in stmt:
+        tgt, _, src = stmt.partition("=")
+        tgt = tgt.strip()
+        src = src.replace("measure", "").strip()
+    else:
+        # bare `measure q;` broadcast -- accept, just validate refs
+        _check_refs(stmt, qregs, cregs, line, findings, declared_required=True)
+        return
+
+    # source must be a qubit register, target a classical register
+    for name, idx in _INDEXED.findall(src):
+        idx = int(idx)
+        if name not in qregs:
+            findings.append(Finding(
+                "QASM-MEASURE-SRC", "error",
+                f"Measurement source {name!r} is not a declared qubit register.",
+                line))
+        elif idx >= qregs[name]:
+            findings.append(Finding(
+                "QASM-INDEX-RANGE", "error",
+                f"Index {name}[{idx}] out of range (register size {qregs[name]}).",
+                line))
+    for name, idx in _INDEXED.findall(tgt):
+        idx = int(idx)
+        if name not in cregs:
+            findings.append(Finding(
+                "QASM-MEASURE-TGT", "error",
+                f"Measurement target {name!r} is not a declared classical register.",
+                line))
+        elif idx >= cregs[name]:
+            findings.append(Finding(
+                "QASM-INDEX-RANGE", "error",
+                f"Index {name}[{idx}] out of range (register size {cregs[name]}).",
+                line))

qcheck/checks_qiskit.py

@@ -0,0 +1,107 @@
+"""Static checks for Qiskit Python snippets via the stdlib `ast` module.
+
+No execution. Detects: syntax errors, missing QuantumCircuit import, missing
+measurement, and Qiskit 1.0 breaking changes that LLMs still emit constantly
+(execute(), `from qiskit import Aer/execute`, deprecated gate aliases).
+"""
+from __future__ import annotations
+
+import ast
+from typing import List, Tuple
+
+from .report import Finding
+from .safety import scan_python_safety
+
+_REMOVED_FROM_QISKIT = {"execute", "Aer", "IBMQ", "BasicAer"}
+_DEPRECATED_METHODS = {
+    "cnot": "cx", "toffoli": "ccx", "fredkin": "cswap", "iden": "id",
+    "mct": "mcx",
+}
+
+
+def check_qiskit(text: str) -> Tuple[bool, bool, List[Finding], List[str]]:
+    """Return (syntax_valid, unsafe, findings, suggested_fixes)."""
+    findings: List[Finding] = []
+    fixes: List[str] = []
+
+    try:
+        tree = ast.parse(text)
+    except SyntaxError as e:
+        findings.append(Finding(
+            "PY-SYNTAX", "error", f"Python syntax error: {e.msg}", e.lineno))
+        return False, False, findings, fixes
+
+    safety = scan_python_safety(tree)
+    if safety:
+        findings.extend(safety)
+        return True, True, findings, [
+            "Remove filesystem/network/process/dynamic-exec code; quantum "
+            "circuit snippets should not need it."]
+
+    imported_names: set[str] = set()
+    module_imports: set[str] = set()
+    uses_quantumcircuit = False
+    has_measure = False
+
+    for node in ast.walk(tree):
+        if isinstance(node, ast.ImportFrom):
+            mod = (node.module or "")
+            for alias in node.names:
+                imported_names.add(alias.asname or alias.name)
+                if mod == "qiskit" and alias.name in _REMOVED_FROM_QISKIT:
+                    findings.append(Finding(
+                        "QISKIT-REMOVED-IMPORT", "error",
+                        f"'from qiskit import {alias.name}' was removed in "
+                        f"Qiskit 1.0; this code will not run on modern Qiskit.",
+                        getattr(node, "lineno", None)))
+                    if alias.name == "execute":
+                        fixes.append("Replace execute() with a primitive "
+                                     "(Sampler/Estimator) or backend.run().")
+                    if alias.name == "Aer":
+                        fixes.append("Import Aer from qiskit_aer: "
+                                     "'from qiskit_aer import Aer'.")
+        elif isinstance(node, ast.Import):
+            for alias in node.names:
+                module_imports.add(alias.name.split(".")[0])
+        elif isinstance(node, ast.Call):
+            func = node.func
+            if isinstance(func, ast.Name):
+                if func.id == "QuantumCircuit":
+                    uses_quantumcircuit = True
+                elif func.id == "execute":
+                    findings.append(Finding(
+                        "QISKIT-EXECUTE", "error",
+                        "execute() was removed in Qiskit 1.0; use Sampler/"
+                        "Estimator primitives or backend.run().",
+                        getattr(node, "lineno", None)))
+            elif isinstance(func, ast.Attribute):
+                if func.attr in ("measure", "measure_all", "measure_active"):
+                    has_measure = True
+                elif func.attr in _DEPRECATED_METHODS:
+                    repl = _DEPRECATED_METHODS[func.attr]
+                    findings.append(Finding(
+                        "QISKIT-DEPRECATED-GATE", "warning",
+                        f"QuantumCircuit.{func.attr}() is deprecated; use "
+                        f".{repl}().", getattr(node, "lineno", None)))
+                    fixes.append(f"Replace .{func.attr}() with .{repl}().")
+
+    if uses_quantumcircuit and "QuantumCircuit" not in imported_names:
+        findings.append(Finding(
+            "QISKIT-MISSING-IMPORT", "error",
+            "QuantumCircuit is used but never imported "
+            "('from qiskit import QuantumCircuit').", 1))
+        fixes.append("Add 'from qiskit import QuantumCircuit'.")
+
+    if uses_quantumcircuit and not has_measure:
+        findings.append(Finding(
+            "QISKIT-NO-MEASURE", "warning",
+            "Circuit has no measurement; sampling it returns nothing useful.",
+            None))
+        fixes.append("Add qc.measure_all() (or explicit measure) before running.")
+
+    if not uses_quantumcircuit:
+        findings.append(Finding(
+            "QISKIT-NO-CIRCUIT", "warning",
+            "No QuantumCircuit(...) construction detected.", None))
+
+    return True, False, findings, fixes

qcheck/cli.py

@@ -0,0 +1,292 @@
+"""qcheck command-line interface (argparse, stdlib only).
+
+Exit codes:
+  0  pass (or pass-with-warnings)
+  1  verification failed (errors found)
+  2  unsafe input / unsupported framework
+  3  internal error
+"""
+from __future__ import annotations
+
+import argparse
+import ast
+import json
+import os
+import sys
+from typing import List, Optional, Tuple
+
+from . import __version__
+from .detect import detect_framework
+from .report import Report
+from .checks_qasm import check_qasm
+from .checks_qiskit import check_qiskit
+from .safety import scan_python_safety
+from .sarif import build_sarif
+
+EXIT_PASS = 0
+EXIT_FAIL = 1
+EXIT_UNSAFE = 2
+EXIT_INTERNAL = 3
+
+
+def verify_text(path: str, text: str) -> Report:
+    framework = detect_framework(path, text)
+
+    if framework in ("qasm2", "qasm3"):
+        syntax_valid, findings, fixes = check_qasm(text, framework)
+        return Report(framework=framework, syntax_valid=syntax_valid,
+                      findings=findings, suggested_fixes=fixes)
+
+    if framework == "qiskit":
+        syntax_valid, unsafe, findings, fixes = check_qiskit(text)
+        return Report(framework=framework, syntax_valid=syntax_valid,
+                      findings=findings, suggested_fixes=fixes, unsafe=unsafe)
+
+    # Any .py is safety-screened even if it does not look like qiskit: the RCE
+    # threat is identical regardless of imports (defense in depth).
+    if framework == "python_unknown":
+        r = Report(framework=framework, syntax_valid=True)
+        try:
+            safety = scan_python_safety(ast.parse(text))
+        except SyntaxError as e:
+            r.syntax_valid = False
+            from .report import Finding
+            r.findings.append(Finding("PY-SYNTAX", "error",
+                                      f"Python syntax error: {e.msg}", e.lineno))
+            return r
+        if safety:
+            r.unsafe = True
+            r.findings.extend(safety)
+        else:
+            r.findings.append(_unsupported_finding(framework))
+        return r
+
+    # unknown extension / non-python, non-qasm
+    r = Report(framework=framework, syntax_valid=True)
+    r.findings.append(_unsupported_finding(framework))
+    return r
+
+
+def _unsupported_finding(framework):
+    from .report import Finding
+    return Finding(
+        "UNSUPPORTED", "error",
+        f"Framework '{framework}' is not supported in qcheck v0 "
+        f"(supported: OpenQASM 2/3, Qiskit Python).", None)
+
+
+def _exit_code(report: Report) -> int:
+    if report.unsafe:
+        return EXIT_UNSAFE
+    if any(f.id == "UNSUPPORTED" for f in report.findings):
+        return EXIT_UNSAFE
+    if report.status == "fail":
+        return EXIT_FAIL
+    return EXIT_PASS
+
+
+def _print_human(report: Report, path: str) -> None:
+    icon = {"pass": "PASS", "warning": "WARN", "fail": "FAIL"}[report.status]
+    print(f"qcheck {__version__}  [{icon}]  {path}  ({report.framework})")
+    print(f"  syntax_valid={report.syntax_valid}  "
+          f"unsafe={report.unsafe}  confidence={report.confidence}")
+    print(f"  runnable_in_simulator={report.runnable_in_simulator} "
+          f"(static-only in v0)")
+    if not report.findings:
+        print("  no issues found.")
+    for f in report.findings:
+        loc = f" (line {f.line})" if f.line else ""
+        print(f"  [{f.level}] {f.id}: {f.message}{loc}")
+    for fix in report.suggested_fixes:
+        print(f"  fix -> {fix}")
+
+
+_LANG_EXT = {"qasm2": ".qasm", "qasm3": ".qasm", "qiskit": ".py", "python": ".py"}
+
+# Directories skipped during recursion: virtualenvs, VCS, caches, build output,
+# vendored deps. Without this, `qcheck verify .` in a repo with a .venv would
+# review thousands of third-party files (pip, etc.) and flag them as unsafe.
+# Explicit file/dir paths passed on the command line are never pruned.
+_SKIP_DIRS = frozenset({
+    ".git", ".hg", ".svn", ".venv", "venv", "env", "ENV", "virtualenv",
+    "node_modules", "__pycache__", ".tox", ".nox", ".mypy_cache",
+    ".pytest_cache", ".ruff_cache", "site-packages", "build", "dist",
+    ".eggs", ".idea", ".vscode",
+})
+
+
+def _expand_targets(paths: List[str]) -> List[str]:
+    """Expand directories into their .py/.qasm files (recursive, sorted).
+    Keeps '-' (stdin) and explicit file paths. Deterministic order.
+    Recursion skips vendored/build/VCS dirs (see _SKIP_DIRS); hidden dirs
+    (dot-prefixed) are skipped too, but an explicitly named dir still descends."""
+    out: List[str] = []
+    for p in paths:
+        if p == "-":
+            out.append("-")
+        elif os.path.isdir(p):
+            found = []
+            for root, dirs, files in os.walk(p):
+                # Prune in place (topdown walk): don't descend into vendor/hidden dirs.
+                dirs[:] = [d for d in dirs
+                           if d not in _SKIP_DIRS and not d.startswith(".")]
+                for fn in files:
+                    if fn.endswith((".py", ".qasm")):
+                        found.append(os.path.join(root, fn))
+            out.extend(sorted(found))
+        else:
+            out.append(p)
+    # de-dupe while preserving first occurrence
+    seen, uniq = set(), []
+    for t in out:
+        if t not in seen:
+            seen.add(t)
+            uniq.append(t)
+    return uniq
+
+
+def _detect_name(display: str, text: str, lang: Optional[str]) -> str:
+    if lang:
+        return "stdin" + _LANG_EXT[lang]
+    if display == "-":
+        return "stdin.qasm" if "openqasm" in text.lower() else "stdin.py"
+    return display
+
+
+def _verify_one(display: str, lang: Optional[str], stdin_text: Optional[str]) -> Tuple[str, Optional[Report], Optional[str]]:
+    """Return (display, report, read_error)."""
+    try:
+        text = stdin_text if display == "-" else open(display, "r", encoding="utf-8").read()
+    except OSError as e:
+        return (display, None, f"cannot read {display}: {e}")
+    try:
+        return (display, verify_text(_detect_name(display, text, lang), text), None)
+    except Exception as e:  # never crash on one bad file
+        return (display, None, f"internal error: {e}")
+
+
+def _worst_exit(units) -> int:
+    """Worst-case exit code across verified units (findings-based, not format)."""
+    worst = EXIT_PASS
+    for _display, report, err in units:
+        if err is not None:
+            worst = max(worst, EXIT_INTERNAL)
+            continue
+        rc = _exit_code(report)
+        worst = EXIT_UNSAFE if EXIT_UNSAFE in (worst, rc) else max(worst, rc)
+    return worst
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="qcheck",
+        description="Review LLM-generated quantum code (Qiskit / OpenQASM).")
+    parser.add_argument("--version", action="version",
+                        version=f"qcheck {__version__}")
+    sub = parser.add_subparsers(dest="command")
+    p_verify = sub.add_parser("verify", help="review .qasm/.py files, directories, or stdin")
+    p_verify.add_argument("paths", nargs="+",
+                          help="one or more files or directories, or '-' for stdin")
+    p_verify.add_argument("--format", choices=("human", "json", "sarif"),
+                          default=None,
+                          help="output format (default: human). 'sarif' emits "
+                               "SARIF 2.1.0 for GitHub Code Scanning.")
+    p_verify.add_argument("--json", action="store_true",
+                          help="alias for --format json (backwards compatible)")
+    p_verify.add_argument("--output", metavar="FILE",
+                          help="write SARIF output to FILE instead of stdout "
+                               "(used with --format sarif)")
+    p_verify.add_argument("--lang", choices=sorted(_LANG_EXT),
+                          help="force language for stdin input")
+
+    args = parser.parse_args(argv)
+    if args.command != "verify":
+        parser.print_help()
+        return EXIT_INTERNAL
+
+    # Resolve format. --format wins when given; --json is a backwards-compatible
+    # alias; default stays human. Exit codes never depend on the format.
+    if args.format is not None:
+        fmt = args.format
+    elif args.json:
+        fmt = "json"
+    else:
+        fmt = "human"
+    emit_json = fmt == "json"
+
+    targets = _expand_targets(args.paths)
+    if not targets:
+        print("qcheck: no .py or .qasm files found.", file=sys.stderr)
+        return EXIT_PASS
+
+    stdin_text = sys.stdin.read() if "-" in targets else None
+    units = [_verify_one(t, args.lang, stdin_text) for t in targets]
+
+    # SARIF: a single-run document over all units, regardless of count.
+    if fmt == "sarif":
+        doc = build_sarif(
+            [(d, r) for (d, r, e) in units if r is not None],
+            execution_successful=all(e is None for (_d, _r, e) in units))
+        text = json.dumps(doc, indent=2)
+        if args.output:
+            with open(args.output, "w", encoding="utf-8") as fh:
+                fh.write(text + "\n")
+        else:
+            print(text)
+        return _worst_exit(units)
+
+    # Single unit -> preserve legacy output + exit code exactly.
+    if len(units) == 1:
+        display, report, err = units[0]
+        if err is not None:
+            print(f"qcheck: {err}", file=sys.stderr)
+            return EXIT_INTERNAL
+        if emit_json:
+            print(json.dumps(report.to_dict(), indent=2))
+        else:
+            _print_human(report, display)
+        return _exit_code(report)
+
+    # Aggregate over multiple units.
+    results, worst = [], EXIT_PASS
+    passed = failed = unsafe = err_count = 0
+    for display, report, err in units:
+        if err is not None:
+            err_count += 1
+            worst = max(worst, EXIT_INTERNAL)
+            results.append({"path": display, "error": err})
+            if not emit_json:
+                print(f"  [ERROR] {display}: {err}")
+            continue
+        rc = _exit_code(report)
+        worst = EXIT_UNSAFE if EXIT_UNSAFE in (worst, rc) else max(worst, rc)
+        if report.unsafe:
+            unsafe += 1
+        elif report.status == "fail":
+            failed += 1
+        else:
+            passed += 1
+        if emit_json:
+            d = report.to_dict()
+            d["path"] = display
+            results.append(d)
+        else:
+            icon = "UNSAFE" if report.unsafe else {"pass": "PASS", "warning": "WARN", "fail": "FAIL"}[report.status]
+            errs = len(report.errors)
+            print(f"  [{icon}] {display} ({report.framework})"
+                  + (f"  {errs} error(s)" if errs else ""))
+
+    summary = {"files": len(units), "passed": passed, "failed": failed,
+               "unsafe": unsafe, "read_errors": err_count}
+    if emit_json:
+        print(json.dumps({"qcheck_version": __version__, "results": results,
+                          "summary": summary}, indent=2))
+    else:
+        print(f"qcheck {__version__}: {summary['files']} file(s) - "
+              f"{passed} passed, {failed} failed, {unsafe} unsafe"
+              + (f", {err_count} unreadable" if err_count else ""))
+    return worst
+
+
+if __name__ == "__main__":
+    sys.exit(main())

qcheck/detect.py

@@ -0,0 +1,28 @@
+"""Detect which framework a snippet is, from extension + content."""
+from __future__ import annotations
+
+import os
+
+
+def detect_framework(path: str, text: str) -> str:
+    """Return one of: qasm2, qasm3, qiskit, python_unknown, unknown."""
+    ext = os.path.splitext(path)[1].lower()
+    low = text.lower()
+
+    if ext == ".qasm" or "openqasm" in low:
+        if "openqasm 3" in low:
+            return "qasm3"
+        if "openqasm 2" in low:
+            return "qasm2"
+        if "qubit[" in low or "bit[" in low:
+            return "qasm3"
+        if "qreg" in low or "creg" in low:
+            return "qasm2"
+        return "qasm2"
+
+    if ext == ".py":
+        if "qiskit" in low or "quantumcircuit" in low:
+            return "qiskit"
+        return "python_unknown"
+
+    return "unknown"

qcheck/report.py

@@ -0,0 +1,73 @@
+"""Report and Finding data structures + status/confidence logic.
+
+Pure stdlib (dataclasses) so qcheck v0 installs with zero runtime dependencies.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, asdict, field
+from typing import List, Optional
+
+from . import __version__
+
+
+@dataclass
+class Finding:
+    id: str            # stable check id, e.g. "QASM-UNDECLARED-REG"
+    level: str         # "error" | "warning" | "info"
+    message: str
+    line: Optional[int] = None
+
+
+@dataclass
+class Report:
+    framework: str
+    syntax_valid: bool
+    findings: List[Finding] = field(default_factory=list)
+    suggested_fixes: List[str] = field(default_factory=list)
+    unsafe: bool = False
+    # v0 does NOT execute code. This field documents that explicitly.
+    runnable_in_simulator: str = "not_run"
+    runnable_reason: str = (
+        "qcheck v0 performs static verification only; it never executes the "
+        "input. Simulator execution is deferred to a sandboxed v1 (see SECURITY.md)."
+    )
+
+    @property
+    def errors(self) -> List[Finding]:
+        return [f for f in self.findings if f.level == "error"]
+
+    @property
+    def warnings(self) -> List[Finding]:
+        return [f for f in self.findings if f.level == "warning"]
+
+    @property
+    def status(self) -> str:
+        if not self.syntax_valid or self.errors:
+            return "fail"
+        if self.warnings:
+            return "warning"
+        return "pass"
+
+    @property
+    def confidence(self) -> float:
+        """Deterministic rubric: high when it parses cleanly with no findings."""
+        c = 1.0 - 0.4 * len(self.errors) - 0.1 * len(self.warnings)
+        if not self.syntax_valid:
+            c = min(c, 0.2)
+        return round(max(0.0, min(1.0, c)), 2)
+
+    def to_dict(self) -> dict:
+        return {
+            "qcheck_version": __version__,
+            "status": self.status,
+            "framework": self.framework,
+            "syntax_valid": self.syntax_valid,
+            "unsafe": self.unsafe,
+            "runnable_in_simulator": self.runnable_in_simulator,
+            "runnable_reason": self.runnable_reason,
+            "static_checks": [asdict(f) for f in self.findings],
+            "errors": [asdict(f) for f in self.errors],
+            "warnings": [asdict(f) for f in self.warnings],
+            "suggested_fixes": self.suggested_fixes,
+            "confidence": self.confidence,
+        }

qcheck/safety.py

@@ -0,0 +1,61 @@
+"""Static safety screen for Python snippets, using the stdlib `ast` module.
+
+qcheck NEVER executes the input. This module only inspects the parsed AST and
+flags constructs that would let an untrusted snippet touch the filesystem,
+network, processes, or dynamic code execution. If any are present the snippet is
+marked unsafe and qcheck refuses to treat it as a benign circuit.
+"""
+from __future__ import annotations
+
+import ast
+from typing import List
+
+from .report import Finding
+
+UNSAFE_MODULES = {
+    "os", "sys", "subprocess", "shutil", "socket", "requests", "urllib",
+    "http", "ctypes", "pickle", "marshal", "importlib", "pty", "signal",
+    "multiprocessing", "threading", "asyncio", "pathlib", "glob", "tempfile",
+}
+
+UNSAFE_BUILTINS = {"eval", "exec", "compile", "__import__", "open", "input"}
+
+UNSAFE_ATTRS = {
+    "system", "popen", "spawn", "spawnl", "spawnv", "call", "run", "Popen",
+    "remove", "rmtree", "unlink", "rename", "chmod", "chown", "kill",
+    "connect", "urlopen", "get", "post", "request", "load", "loads",
+}
+
+
+def scan_python_safety(tree: ast.AST) -> List[Finding]:
+    findings: List[Finding] = []
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                root = alias.name.split(".")[0]
+                if root in UNSAFE_MODULES:
+                    findings.append(Finding(
+                        "PY-UNSAFE-IMPORT", "error",
+                        f"Unsafe import '{alias.name}' is not allowed in quantum "
+                        f"code; qcheck rejects it as a potential RCE vector.",
+                        getattr(node, "lineno", None)))
+        elif isinstance(node, ast.ImportFrom):
+            root = (node.module or "").split(".")[0]
+            if root in UNSAFE_MODULES:
+                findings.append(Finding(
+                    "PY-UNSAFE-IMPORT", "error",
+                    f"Unsafe import 'from {node.module} import ...' is not allowed.",
+                    getattr(node, "lineno", None)))
+        elif isinstance(node, ast.Call):
+            func = node.func
+            if isinstance(func, ast.Name) and func.id in UNSAFE_BUILTINS:
+                findings.append(Finding(
+                    "PY-UNSAFE-CALL", "error",
+                    f"Unsafe call '{func.id}(...)' is not allowed.",
+                    getattr(node, "lineno", None)))
+            elif isinstance(func, ast.Attribute) and func.attr in UNSAFE_ATTRS:
+                findings.append(Finding(
+                    "PY-UNSAFE-CALL", "error",
+                    f"Unsafe call '.{func.attr}(...)' is not allowed.",
+                    getattr(node, "lineno", None)))
+    return findings

qcheck/sarif.py

@@ -0,0 +1,95 @@
+"""SARIF 2.1.0 formatter for qcheck results (GitHub Code Scanning compatible).
+
+Pure formatter over Report objects - no execution, no new dependencies, and it
+does not touch the human or --json output. SARIF reports static qcheck findings;
+it does not assert quantum correctness. Output ordering is deterministic.
+"""
+from __future__ import annotations
+
+from typing import List, Optional, Tuple
+
+from . import __version__
+from .report import Report
+
+INFORMATION_URI = "https://github.com/JCQuankey/qcheck"
+SCHEMA = "https://json.schemastore.org/sarif-2.1.0.json"
+
+# qcheck level -> SARIF level. SARIF levels: none | note | warning | error.
+_LEVEL = {"error": "error", "warning": "warning", "info": "note"}
+
+# Stable, human-readable rule metadata. Unknown ids still get a rule entry
+# (falling back to the id) so results always reference a defined rule.
+_RULE_DESC = {
+    "QASM-NO-HEADER": "OpenQASM header missing",
+    "QASM-UNDECLARED-REG": "Use of an undeclared quantum/classical register",
+    "QASM-INDEX-RANGE": "Register index out of declared range",
+    "QASM-MEASURE-SRC": "Invalid measurement source operand",
+    "QASM-MEASURE-TGT": "Invalid measurement target operand",
+    "QASM-INCLUDE": "Unsupported or missing include",
+    "QASM-NO-SEMICOLON": "Statement missing a terminating semicolon",
+    "QASM-SUSPICIOUS": "Content does not look like valid OpenQASM",
+    "QISKIT-MISSING-IMPORT": "QuantumCircuit used without importing it",
+    "QISKIT-NO-CIRCUIT": "No QuantumCircuit construction detected",
+    "QISKIT-NO-MEASURE": "Circuit has no measurement",
+    "QISKIT-EXECUTE": "Use of execute(), removed in Qiskit 1.0",
+    "QISKIT-REMOVED-IMPORT": "Import removed in Qiskit 1.0 (e.g. execute, Aer)",
+    "QISKIT-DEPRECATED-GATE": "Deprecated gate alias",
+    "PY-SYNTAX": "Python syntax error",
+    "PY-UNSAFE-IMPORT": "Unsafe import (potential remote-code-execution vector)",
+    "PY-UNSAFE-CALL": "Unsafe call (potential remote-code-execution vector)",
+    "UNSUPPORTED": "Unsupported framework or file type",
+}
+
+
+def _sarif_uri(display: str) -> str:
+    # stdin has no path on disk; use a stable synthetic URI (not uploadable).
+    return "stdin" if display == "-" else display.replace("\\", "/")
+
+
+def build_sarif(results: List[Tuple[str, Report]],
+                execution_successful: bool = True) -> dict:
+    """Build a single-run SARIF 2.1.0 document from (display_path, Report) pairs."""
+    sarif_results = []
+    rule_ids = set()
+    for display, report in results:
+        uri = _sarif_uri(display)
+        for f in report.findings:
+            rule_ids.add(f.id)
+            loc = {"physicalLocation": {"artifactLocation": {"uri": uri}}}
+            if f.line:
+                loc["physicalLocation"]["region"] = {"startLine": int(f.line)}
+            sarif_results.append({
+                "ruleId": f.id,
+                "level": _LEVEL.get(f.level, "warning"),
+                "message": {"text": f.message},
+                "locations": [loc],
+            })
+
+    # Deterministic ordering: by file, then rule, then line, then message.
+    sarif_results.sort(key=lambda r: (
+        r["locations"][0]["physicalLocation"]["artifactLocation"]["uri"],
+        r["ruleId"],
+        r["locations"][0]["physicalLocation"].get("region", {}).get("startLine", 0),
+        r["message"]["text"],
+    ))
+
+    rules = [{
+        "id": rid,
+        "name": rid,
+        "shortDescription": {"text": _RULE_DESC.get(rid, rid)},
+    } for rid in sorted(rule_ids)]
+
+    return {
+        "version": "2.1.0",
+        "$schema": SCHEMA,
+        "runs": [{
+            "tool": {"driver": {
+                "name": "qcheck",
+                "informationUri": INFORMATION_URI,
+                "version": __version__,
+                "rules": rules,
+            }},
+            "results": sarif_results,
+            "invocations": [{"executionSuccessful": bool(execution_successful)}],
+        }],
+    }

qcheck_quantum-0.2.0.dist-info/METADATA

@@ -0,0 +1,226 @@
+Metadata-Version: 2.4
+Name: qcheck-quantum
+Version: 0.2.0
+Summary: Verify LLM-generated quantum code (Qiskit / OpenQASM) statically and safely.
+Author: qcheck contributors
+Maintainer-email: JCQuankey <dev@quankey.xyz>
+License: Apache-2.0
+Project-URL: Homepage, https://github.com/JCQuankey/qcheck
+Project-URL: Repository, https://github.com/JCQuankey/qcheck
+Project-URL: Issues, https://github.com/JCQuankey/qcheck/issues
+Keywords: quantum,qiskit,openqasm,llm,linter,code-review,static-analysis,sarif
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Scientific/Engineering :: Physics
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Provides-Extra: release
+Requires-Dist: build>=1; extra == "release"
+Requires-Dist: twine>=5; extra == "release"
+Dynamic: license-file
+
+# qcheck
+
+**AI writes quantum code. qcheck reviews it.**
+
+`qcheck` is a lightweight review layer for AI-generated Qiskit and OpenQASM
+snippets. It catches common issues early - removed-in-1.0 APIs, unsafe patterns,
+missing measurements, parse errors - so agents and developers can improve quantum
+code before it reaches humans, CI, or simulators. Tiny, dependency-free, and it
+reviews code without ever executing it.
+
+Why it matters: LLMs write quantum code that fails to run **40-70% of the time**
+one-shot (QuanBench+ 2026: Qiskit 59.5% / PennyLane 42.9% pass; QCoder 2026: ~70%
+one-shot failure). qcheck catches the avoidable share of that early.
+
+```bash
+qcheck verify circuit.qasm
+qcheck verify snippet.py --json
+```
+
+## Why this exists
+
+An LLM agent (or a developer pasting from a chat assistant) produces a Qiskit/QASM snippet.
+Will it run? Is it using an API that was removed in Qiskit 1.0? Does it measure?
+Is it even safe to touch? Today you find out by running it - wasting time, and
+in an agent loop, running untrusted model output. `qcheck` answers in
+milliseconds, statically.
+
+## Install
+
+```bash
+# From source (works today)
+git clone https://github.com/JCQuankey/qcheck && cd qcheck
+pip install -e ".[dev]"     # editable install + pytest
+```
+
+Once the first release is published, install from PyPI:
+
+```bash
+pip install qcheck-quantum   # available after the first PyPI release
+```
+
+The PyPI **distribution** name is `qcheck-quantum` (the bare `qcheck` name is
+taken on PyPI); the installed **command** and the import package are both
+`qcheck`. v0 has **zero runtime dependencies** (standard library only). Release
+process: [`docs/RELEASING.md`](https://github.com/JCQuankey/qcheck/blob/main/docs/RELEASING.md).
+
+## Quickstart
+
+```bash
+qcheck verify examples/broken_qiskit_execute.py   # one file
+qcheck verify examples/                            # a whole directory (recursive)
+qcheck verify a.py b.qasm circuits/                # several paths at once
+cat snippet.py | qcheck verify -                   # stdin (for agents)
+```
+
+Example output:
+
+```
+qcheck 0.2.0  [FAIL]  examples/broken_qiskit_execute.py  (qiskit)
+  [error] QISKIT-REMOVED-IMPORT: 'from qiskit import execute' was removed in Qiskit 1.0
+  [warning] QISKIT-DEPRECATED-GATE: QuantumCircuit.cnot() is deprecated; use .cx().
+  fix -> Replace execute() with a primitive (Sampler/Estimator) or backend.run().
+```
+
+Reviewing multiple files prints a per-file summary and exits with the worst
+result found (unsafe > failed > passed). Directory recursion skips virtualenvs,
+VCS, caches, and build output (`.venv`, `node_modules`, `.git`, `site-packages`,
+`build`, `dist`, ...) so it reviews your code, not your dependencies. To review a
+file inside one of those, pass it explicitly.
+
+## JSON output (for agents & CI)
+
+```bash
+qcheck verify snippet.py --json
+```
+
+For a single file, returns `{status, framework, syntax_valid, unsafe,
+static_checks, errors, warnings, suggested_fixes, confidence,
+runnable_in_simulator, qcheck_version}`. For multiple files or a directory,
+returns an envelope `{qcheck_version, results: [<per-file object + "path">...],
+summary: {files, passed, failed, unsafe, read_errors}}`. Designed to be parsed by
+an LLM agent that just generated the code, or by a CI gate. Exit codes: `0` pass,
+`1` verification failed, `2` unsafe/unsupported, `3` internal error.
+
+## Use it in CI (GitHub Action)
+
+qcheck ships a composite GitHub Action. In your repo's
+`.github/workflows/qcheck.yml`:
+
+```yaml
+- uses: actions/checkout@v4
+- uses: JCQuankey/qcheck@main
+  with:
+    paths: "."     # or a folder, e.g. "circuits/"
+```
+
+The step fails the job when qcheck finds errors or unsafe code. See
+[`examples/github-action.yml`](https://github.com/JCQuankey/qcheck/blob/main/examples/github-action.yml).
+
+## SARIF output (GitHub Code Scanning)
+
+qcheck can emit SARIF 2.1.0 so findings show up as **code scanning alerts** on
+the Security tab and inline on pull requests, instead of only in the log:
+
+```bash
+qcheck verify . --format sarif --output qcheck.sarif
+```
+
+In a workflow, generate the SARIF and let the caller upload it (upload needs
+`security-events: write`, best granted by the consuming repo):
+
+```yaml
+permissions:
+  contents: read
+  security-events: write
+steps:
+  - uses: actions/checkout@v4
+  - uses: JCQuankey/qcheck@main
+    with:
+      format: sarif
+      output: qcheck.sarif
+  - uses: github/codeql-action/upload-sarif@v3
+    with:
+      sarif_file: qcheck.sarif
+```
+
+SARIF reports static qcheck findings (rule id, level, file, line) - it does not
+prove quantum correctness. `stdin` input uses a synthetic `stdin` URI and is not
+meant for code-scanning upload.
+
+## What v0 checks
+
+**OpenQASM 2/3:** missing header, undeclared registers, index-out-of-range,
+malformed measurements, unsupported includes, suspicious non-QASM content.
+**Qiskit Python:** Python syntax, missing `QuantumCircuit` import, missing
+measurement, and Qiskit-1.0 breaking changes LLMs still emit (`execute()`,
+`from qiskit import Aer/execute`, deprecated gate aliases like `cnot`->`cx`).
+
+## Safety policy
+
+`qcheck` **never executes the input.** Qiskit snippets are analyzed with the
+Python `ast` module (parse, don't run). Any filesystem/network/process/dynamic-
+exec construct (`os`, `subprocess`, `eval`, `open`, ...) marks the snippet
+**unsafe** and exits `2`. QASM input is text-scanned. This is deliberate: an
+agent-facing verifier that *ran* untrusted model output would be a remote-code-
+execution vector (see Qiskit CVE-2025-2000 for the QPY/pickle precedent). See
+[`SECURITY.md`](https://github.com/JCQuankey/qcheck/blob/main/SECURITY.md) for the full threat model.
+
+## Scope
+
+qcheck v0 focuses on static review signals for Qiskit and OpenQASM: API usage
+(including Qiskit 1.0 removals), unsafe patterns, missing measurements, parse
+issues, and common LLM-generated mistakes. It reviews code without executing it,
+so it's safe to run on untrusted model output inside an agent loop or CI.
+
+It's a fast first-pass reviewer - pair it with your tests and simulators for the
+rest. For methodology and scope details, see the
+[leaderboard methodology](https://github.com/JCQuankey/qcheck/blob/main/leaderboard/methodology.md).
+
+## Roadmap
+
+- v0 (this): CLI, Qiskit + OpenQASM static checks, JSON, safety screen. **Zero runtime deps.**
+- v1: sandboxed simulation (opt-in), PennyLane + Cirq, LLM-powered fix suggestions, GitHub Action, MCP server (`verify_quantum_code`).
+- Public **static-check leaderboard** for LLM-generated quantum code (see `leaderboard/`) + anonymized error dataset.
+
+## Leaderboard
+
+qcheck includes a **static review benchmark** for AI-generated quantum code: it
+tracks how often model outputs pass qcheck's current review checks
+(`static_pass_rate`) on a small public Qiskit/OpenQASM task set - an early quality
+signal for agents and LLM workflows. The rows shown today are labelled **SAMPLE/demo**.
+
+- [`leaderboard/README.md`](https://github.com/JCQuankey/qcheck/blob/main/leaderboard/README.md) - how to add a submission and run it
+- [`leaderboard/methodology.md`](https://github.com/JCQuankey/qcheck/blob/main/leaderboard/methodology.md) - scope and methodology
+- [`leaderboard/site/leaderboard.md`](https://github.com/JCQuankey/qcheck/blob/main/leaderboard/site/leaderboard.md) - the generated table
+
+## Contributing
+
+Issues and PRs welcome - especially new failure fixtures (a real LLM-generated
+snippet that should fail but currently passes, or vice versa). Each fixture
+makes qcheck sharper and feeds the public error taxonomy.
+
+## Contact
+
+- Technical questions / maintainer contact: **dev@quankey.xyz**
+- Security issues: **security@quankey.xyz** (see [`SECURITY.md`](https://github.com/JCQuankey/qcheck/blob/main/SECURITY.md))
+
+Maintained by JCQuankey / qcheck contributors. qcheck runs locally, sends no
+telemetry, and reviews code without executing it.
+
+## License
+
+Apache-2.0.

qcheck_quantum-0.2.0.dist-info/RECORD

@@ -0,0 +1,16 @@
+qcheck/__init__.py,sha256=THEuFJgbl0NHWNs7Lv1pxuv6zQzMPcVt3JZWdFUrE_U,115
+qcheck/__main__.py,sha256=4JMK66Wj4uLZTKbF-sT3LAxOsr6buig77PmOkJCRRxw,83
+qcheck/checks_qasm.py,sha256=Go-8YSUvZrIICcGN7su5UDrpCjU-6rKyOEOCokB1JbE,6265
+qcheck/checks_qiskit.py,sha256=o079k31bvSIn4mAHridX33zhK-QgJZDX8TahpT3iZlk,4585
+qcheck/cli.py,sha256=GjhvqAZfbgCi7SpWClucVQu_f1HGJyUQFYaBK08lLBA,11032
+qcheck/detect.py,sha256=OCSShS_x-XQv9oM48CVYEVnT3kIYzEUdBVfCAqH4p6Y,794
+qcheck/report.py,sha256=-92ArAfcjloFR6oGxI-qSckC_74cZQoh33xFyRN6Dik,2420
+qcheck/safety.py,sha256=rGpl2nwSfKn6sqy7osNs4cNm5GmgAttRp8nj_Dgz4XY,2680
+qcheck/sarif.py,sha256=VFBY86TkR5nNUcjyRAwddqP6m6p32fmC_JH372xhMO4,3913
+qcheck_quantum-0.2.0.dist-info/licenses/LICENSE,sha256=1uosaGUyZNi9NB1owMQ3fBSvbYKsYsJ0npz8LkOpfp4,11349
+qcheck_quantum-0.2.0.dist-info/licenses/NOTICE,sha256=RllYEZnvRdNM-pKatYuabngvGfJwoYz2AHDoW82Abq8,260
+qcheck_quantum-0.2.0.dist-info/METADATA,sha256=Kr12giY4ZQWD6bUtJplvi3toi0eZNaQ3Wmjbh1hnFew,9262
+qcheck_quantum-0.2.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+qcheck_quantum-0.2.0.dist-info/entry_points.txt,sha256=s4vW7QZCD9UgdLowDyb8InjTUztIe5xE5_kF0bgXquY,43
+qcheck_quantum-0.2.0.dist-info/top_level.txt,sha256=iUSFtYU7wY0yWnHxUFu0PDq7VvtK4_3QW8T7f7U3YAQ,7
+qcheck_quantum-0.2.0.dist-info/RECORD,,

qcheck_quantum-0.2.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

qcheck_quantum-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+qcheck = qcheck.cli:main

qcheck_quantum-0.2.0.dist-info/licenses/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 qcheck contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

qcheck_quantum-0.2.0.dist-info/licenses/NOTICE

@@ -0,0 +1,8 @@
+qcheck
+Copyright 2026 qcheck contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

qcheck_quantum-0.2.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+qcheck