quantbom 0.6.0__py3-none-any.whl

quantbom/harness.json

@@ -0,0 +1,1730 @@
+{
+  "schema": "secqdevops.harness-index/v1",
+  "harness_version": "0.16.0",
+  "schemes": {
+    "eu-cra": "EU-CRA",
+    "eu-ai-act-quantum": "EU-AI-ACT-QUANTUM"
+  },
+  "frameworks": {
+    "qiskit": {
+      "component": "qiskit",
+      "license": "Apache-2.0",
+      "bit_order": "qubit0_last",
+      "translation": null,
+      "inputs": [
+        "QuantumCircuit",
+        "QPY file",
+        "OpenQASM 2/3 file"
+      ],
+      "requires": "qiskit>=2.0,<3",
+      "capabilities": {
+        "dynamic": true,
+        "parameters": "bind-before-collect",
+        "reference": "none",
+        "max_reference_qubits": null,
+        "max_statevector_qubits": null
+      },
+      "conformance": {
+        "status": "verified",
+        "suite": "tests/frameworks/test_conformance.py",
+        "versions": "qiskit 2.5.2",
+        "host": "linux x86_64, Python 3.11 (cloud container)",
+        "date": "2026-10-04"
+      }
+    },
+    "qrisp": {
+      "component": "qrisp",
+      "license": "EUPL-1.2",
+      "bit_order": "by-input",
+      "translation": "qrisp-to_qiskit",
+      "inputs": [
+        "QuantumCircuit",
+        "QuantumSession (qv.qs)",
+        "Jaspr (make_jaspr(f)(), argument-free)"
+      ],
+      "requires": "qrisp>=0.8,<1",
+      "capabilities": {
+        "dynamic": true,
+        "parameters": "bind-before-collect",
+        "reference": "dense",
+        "max_reference_qubits": 10,
+        "max_statevector_qubits": 20
+      },
+      "conformance": {
+        "status": "verified",
+        "suite": "tests/frameworks/test_conformance.py",
+        "versions": "qrisp 0.9.10, qiskit 2.5.2, mqt.qcec 3.11",
+        "host": "macOS arm64, Python 3.13 (local)",
+        "date": "2026-10-23"
+      },
+      "bit_orders": {
+        "QuantumCircuit": "qubit0_last",
+        "QuantumSession": "qubit0_first",
+        "Jaspr": "qubit0_first"
+      },
+      "notes": "Three readings, pinned per input: QuantumCircuit.run() puts qubit 0 rightmost (Qiskit's order); QuantumVariable.get_measurement() puts qubit 0 leftmost; a Jasp program's measure() integer has bit 0 = qubit 0 and Jaspr.to_qc() allocates classical bits in reverse, so its lowered circuit's measured string reads qubit 0 first. Dynamic: classic Qrisp cannot express feed-forward (control(clbit) is refused by Qrisp); mid-circuit measurement and reset lower faithfully. Jasp feed-forward on a measured bit lowers to if_else. Real-time classical computation (repeat-until-success, arithmetic on results, measurement-bounded loops) is refused with the reason: Qrisp cannot convert it to a circuit (QIR route, K5). QCEC decides dynamic circuits that measure each qubit once and do not act on it afterwards; other shapes make QNT-05 unsupported (N-A) with QCEC's reason. Native support: the compiled Qrisp circuit is shipped in Qrisp's own terms (quantum/native-program.json, secqdevops.qrisp-program/v1: qubit identifiers, typed variables, instruction list with qb_alloc, Qrisp's own metrics), and QNT-06 checks Qrisp's to_qiskit() against Qrisp's own simulator (get_unitary up to 10 qubits, statevector_array up to 20). No decision-diagram method: Qrisp's OpenQASM exporters go through Qiskit. Qrisp < 0.9 simulates in complex64, so QNT-06 is inconclusive there with that reason."
+    },
+    "cirq": {
+      "component": "cirq-core",
+      "license": "Apache-2.0",
+      "bit_order": "qubit0_first",
+      "translation": "openqasm2",
+      "inputs": [
+        "cirq.Circuit"
+      ],
+      "notes": "Qubits ordered by sorted LineQubit.",
+      "requires": "cirq-core>=1.4,<2",
+      "capabilities": {
+        "dynamic": false,
+        "parameters": "bind-before-collect",
+        "reference": "dense",
+        "max_reference_qubits": 10,
+        "max_statevector_qubits": 20
+      },
+      "conformance": {
+        "status": "verified",
+        "suite": "tests/frameworks/test_conformance.py",
+        "versions": "cirq-core 1.7.0, qiskit 2.5.2",
+        "host": "linux x86_64, Python 3.11 (cloud container)",
+        "date": "2026-10-04"
+      }
+    },
+    "braket": {
+      "component": "amazon-braket-sdk",
+      "license": "Apache-2.0",
+      "bit_order": "qubit0_first",
+      "translation": "openqasm3",
+      "inputs": [
+        "braket.circuits.Circuit"
+      ],
+      "notes": "23 standard gates and the 14 hardware-native gates (iswap, pswap, xy, xx, yy, zz, ecr, cv, cphaseshift00/01/10, gpi, gpi2, prx) verified against Braket's own unitary; no silent mismatch. Native gates are defined in the OpenQASM header the adapter prepends.",
+      "gates_unsupported": [],
+      "requires": "amazon-braket-sdk>=1.80,<2",
+      "capabilities": {
+        "dynamic": false,
+        "parameters": "bind-before-collect",
+        "reference": "dense",
+        "max_reference_qubits": 10,
+        "max_statevector_qubits": 20
+      },
+      "conformance": {
+        "status": "verified",
+        "suite": "tests/frameworks/test_conformance.py",
+        "versions": "amazon-braket-sdk 1.127.3, qiskit 2.5.2",
+        "host": "linux x86_64, Python 3.11 (cloud container)",
+        "date": "2026-10-04"
+      }
+    },
+    "pennylane": {
+      "component": "pennylane",
+      "license": "Apache-2.0",
+      "bit_order": "qubit0_first",
+      "translation": "openqasm2",
+      "inputs": [
+        "QNode"
+      ],
+      "notes": "Device wire order pinned for export and reference.",
+      "requires": "pennylane>=0.41,<1",
+      "capabilities": {
+        "dynamic": false,
+        "parameters": "bind-before-collect",
+        "reference": "dense",
+        "max_reference_qubits": 10,
+        "max_statevector_qubits": 20
+      },
+      "conformance": {
+        "status": "verified",
+        "suite": "tests/frameworks/test_conformance.py",
+        "versions": "pennylane 0.45.1, qiskit 2.5.2",
+        "host": "linux x86_64, Python 3.11 (cloud container)",
+        "date": "2026-10-04"
+      }
+    },
+    "cudaq": {
+      "component": "cudaq",
+      "license": "Apache-2.0",
+      "bit_order": "qubit0_first",
+      "translation": "openqasm2",
+      "inputs": [
+        "@cudaq.kernel kernel (no arguments)",
+        "cudaq.make_kernel() builder kernel (no arguments)"
+      ],
+      "notes": "Linux only (CUDA-Q ships no macOS wheels); the cu12/cu13 wheels bundle NVIDIA libraries under their own licences. Verified on CUDA-Q 0.16 (K1): cudaq.get_unitary indexes the basis qubit-0-most-significant and cudaq.get_state qubit-0-least-significant, each pinned by its own probe; the compiler drops idle qubits from get_unitary (then the state-vector method decides); kernels that branch on a measurement are refused (CUDA-Q cannot export them); mid-circuit measurement is refused after lowering.",
+      "conformance": {
+        "status": "verified",
+        "suite": "tests/frameworks/test_conformance.py",
+        "versions": "cudaq 0.16.0.post1 (cuda-quantum-cu13), qiskit 2.5.2",
+        "host": "linux x86_64, Python 3.11, qpp-cpu target (cloud container, no GPU)",
+        "date": "2026-10-05",
+        "note": "K1 run on the CPU simulator; the nvidia (GPU) target is unverified — CUDAQ_RUNBOOK.md §6 lists what the run found and changed"
+      },
+      "requires": "cudaq>=0.9,<1",
+      "capabilities": {
+        "dynamic": false,
+        "parameters": "refused (kernel arguments)",
+        "reference": "dense",
+        "max_reference_qubits": 10,
+        "max_statevector_qubits": 20
+      }
+    }
+  },
+  "actions": [
+    {
+      "id": "inventory",
+      "summary": "Pin the quantum stack, the normalized IR and the authoring framework as a component.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "evidence": [
+        "secqdevops:quantum-stack",
+        "secqdevops:normalized-ir",
+        "secqdevops:source-format",
+        "secqdevops:component-layer"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-ESR-01",
+        "CRA-ESR-02",
+        "CRA-ESR-05",
+        "QBOM-01",
+        "QNT-01",
+        "QBOM-BENCH-01",
+        "QNT-06"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1",
+          "CRA-I-3b",
+          "CRA-I-3d",
+          "CRA-II-1",
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15a"
+        ]
+      }
+    },
+    {
+      "id": "record_outcomes",
+      "summary": "Record what every action did and why, as a hash-bound log the gate uses to explain each N-A.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "evidence": [
+        "secqdevops:harness-log-ref",
+        "secqdevops:harness-log-sha256"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d",
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "capture",
+      "summary": "Capture source and compiled circuit (QPY, OpenQASM 3, QIR via the QDK) with byte digests and the compile profile.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "limits": "QIR is compiled by Microsoft's QDK from the hash-bound OpenQASM 3 export — Base profile for a static circuit, Adaptive_RI for a dynamic one — when `quantbom[qir]` (qdk, pyqir, qirrunner) is installed; otherwise the harness log records why it is absent. The QIR is a derived format and is checked by check_qir (QNT-07) before it counts for anything.",
+      "evidence": [
+        "secqdevops:circuit-artifact-ref",
+        "secqdevops:circuit-sha256",
+        "secqdevops:circuit-format",
+        "secqdevops:circuit-layer",
+        "secqdevops:transpiled-circuit-ref",
+        "secqdevops:transpiled-circuit-sha256",
+        "secqdevops:transpiled-circuit-layer",
+        "secqdevops:qasm-program-ref",
+        "secqdevops:qasm-program-sha256",
+        "secqdevops:qir-program-ref",
+        "secqdevops:qir-program-sha256",
+        "secqdevops:ir-standard",
+        "secqdevops:transpile-profile-hash",
+        "secqdevops:circuit-dynamic",
+        "secqdevops:qir-profile"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "QNT-02",
+        "QNT-03",
+        "QNT-05",
+        "QNT-06",
+        "QNT-07"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1",
+          "CRA-I-3d",
+          "CRA-II-1",
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-12",
+          "AIA-15a",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "verify_conversion",
+      "summary": "Prove the framework-to-Qiskit translation faithful against the framework's own simulator, and ship the native program hash-bound.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "limits": "Up to QUANTBOM_FIDELITY_MAX_QUBITS (default 10): dense unitary comparison against the framework's own simulator. Beyond it (K3): a state-vector comparison on |0...0> against the framework's own simulator up to QUANTBOM_STATEVECTOR_MAX_QUBITS (default 20) — one input state, weaker — together with decision-diagram equivalence (mqt.qcec) of the hash-bound native export parsed by mqt-core, whose reference is the exported text, not the simulator. Any unfaithful method decides unfaithful; the method that decided is recorded on the report, the CSNAP and the certificate. Beyond both caps without mqt.qcec: inconclusive (N-A). The native program is written as quantum/native-program.qasm (an OpenQASM export) or quantum/native-program.json (Qrisp's compiled circuit in Qrisp's terms, secqdevops.qrisp-program/v1), the exact bytes recorded, hash-bound and bound to the report's own digest of them. Qrisp has no decision-diagram method (its OpenQASM exporters go through Qiskit), and Qrisp < 0.9 simulates in single precision: inconclusive there, with the reason.",
+      "evidence": [
+        "secqdevops:conversion-fidelity-ref",
+        "secqdevops:conversion-fidelity-sha256",
+        "secqdevops:conversion-fidelity-verdict",
+        "secqdevops:conversion-fidelity-method",
+        "secqdevops:native-program-ref",
+        "secqdevops:native-program-sha256",
+        "secqdevops:native-program-format"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "not_applicable",
+          "reason": "no translation: Qiskit input already is the normalized IR"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "QNT-06"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d",
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15a",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "compare_native",
+      "summary": "Run the native program on its own framework's simulator and check the shared-format run behaves the same.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "limits": "The native program is sampled on the framework's own simulator (Qrisp QuantumCircuit.run, cirq.Simulator, Braket LocalSimulator, PennyLane's device probabilities, cudaq.sample) with QUANTBOM_NATIVE_SHOTS shots (default 8192), keyed as the shared-format run's measured string, and compared with that run by total-variation distance with the two samples' joint sampling error at 95% confidence against QUANTBOM_NATIVE_TOLERANCE (default 0.15): agree, disagree or undecided. Statistical: it detects a translation that changes outcome probabilities, including dynamic programs QNT-06 cannot decide, not a phase alone. Up to QUANTBOM_STATEVECTOR_MAX_QUBITS (default 20); only when the shared-format run is on an ideal local simulator (a noisy device or hardware would make the difference measure noise). Written to quantum/native-result.json with Qrisp sessions' outcomes per typed variable; the gate re-derives the comparison from it and result-summary.json.",
+      "evidence": [
+        "secqdevops:native-result-ref",
+        "secqdevops:native-result-sha256",
+        "secqdevops:native-result-verdict",
+        "secqdevops:native-result-tvd"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "not_applicable",
+          "reason": "Qiskit input is the shared format itself: there is no native program to compare"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "QNT-09"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d",
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15a",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "prove_equivalence",
+      "summary": "Formally prove the compiled circuit computes the same function as the source (mqt.qcec).",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": true,
+      "how": {
+        "cli": "quantbom certify --equivalence",
+        "sdk": "certify(..., equivalence=True)",
+        "install": "pip install 'quantbom[verify]'"
+      },
+      "requires": [
+        "mqt.qcec"
+      ],
+      "limits": "Comfortable to roughly 20-30 qubits; beyond, or on timeout, the verdict is inconclusive (N-A). Dynamic circuits are checked with QCEC's dynamic-circuit transformation; a circuit QCEC cannot handle is `unsupported` (N-A), never an aborted collection. QCEC's dynamic-circuit transformation needs every measured qubit measured once and not acted on afterwards (reset-and-reuse is fine); a qubit measured then reused is `unsupported` (N-A) with QCEC's reason. A `not_equivalent` on a circuit whose measurements are all final is re-checked for observational equivalence (identical measurement statistics, QCEC partial equivalence); the kind of equivalence is evidence.",
+      "evidence": [
+        "secqdevops:equivalence-ref",
+        "secqdevops:equivalence-sha256",
+        "secqdevops:equivalence-verdict",
+        "secqdevops:equivalence-tool",
+        "secqdevops:equivalence-kind"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "QNT-05"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d",
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15a",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "bind_backend",
+      "summary": "Bind the backend target and a calibration snapshot, both hash-verified.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "how": {
+        "cli": "quantbom certify --backend generic",
+        "sdk": "certify(..., backend='generic')",
+        "install": "pip install 'quantbom[sim]' for noise and dynamic circuits"
+      },
+      "limits": "Backends: `basic` (local ideal simulator; qiskit-aer for dynamic circuits), `generic` (Qiskit GenericBackendV2 — a synthetic, seeded device; its noise is simulated only with qiskit-aer, and the evidence says so), `ibm` (real hardware with credentials). Locally produced evidence always records execution-target `simulator`.",
+      "notes": "The snapshot records its capture time; with the provider's calibration_last_update the age at the run is evidence, bound to the snapshot. QNT-03 is N-A when the calibration was older than 24 h at the run (policy).",
+      "evidence": [
+        "secqdevops:backend-provider",
+        "secqdevops:backend-name",
+        "secqdevops:backend-target-ref",
+        "secqdevops:backend-target-sha256",
+        "secqdevops:backend-target-layer",
+        "secqdevops:calibration-ref",
+        "secqdevops:calibration-sha256",
+        "secqdevops:execution-mode",
+        "secqdevops:execution-target",
+        "secqdevops:calibration-captured-at",
+        "secqdevops:calibration-age-hours"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "QNT-03",
+        "QNT-04"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1",
+          "CRA-I-3d",
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-12",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "disclose_error_handling",
+      "summary": "Record what the backend reports about error mitigation and suppression, as a hash-bound document with a bound status.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "limits": "The disclosure is what the provider reports (local simulators: raw counts, no mitigation; IBM SamplerV2: raw counts, dynamical decoupling and twirling listed when enabled). A backend that reports nothing yields `unknown` and QNT-08 N-A.",
+      "evidence": [
+        "secqdevops:error-handling-ref",
+        "secqdevops:error-handling-sha256",
+        "secqdevops:error-mitigation"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "QNT-08"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1",
+          "CRA-I-3d",
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-13",
+          "AIA-15a",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "execute",
+      "summary": "Run the circuit and bind the job receipt.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "notes": "result-summary.json (measured counts) is hash-bound since harness 0.7.0: CRA-INTEG-01 re-derives the declared TVD and verdict from it and the hash-verified expectation, and QBOM-BENCH-02 is N-A when the summary carries no digest (bundles from older SDKs). A run that cannot happen (a dynamic circuit without qiskit-aer, a failed simulation) is recorded with its status and reason and reported `unsupported`; QNT-04 is then N-A and QBOM-BENCH-02 is not judged (K0). A hardware claim must carry the provider's job id.",
+      "evidence": [
+        "secqdevops:runtime-job-id",
+        "secqdevops:runtime-job-ref",
+        "secqdevops:runtime-job-sha256",
+        "secqdevops:runtime-job-layer",
+        "secqdevops:runtime-session-id",
+        "secqdevops:runtime-job-status",
+        "secqdevops:provider-job-id",
+        "secqdevops:result-summary-ref",
+        "secqdevops:result-summary-sha256"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "QNT-04",
+        "QBOM-BENCH-02",
+        "QNT-08",
+        "QNT-09"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1",
+          "CRA-I-3d",
+          "CRA-II-1",
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-12",
+          "AIA-13",
+          "AIA-15a",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "record_provenance",
+      "summary": "Record the build provenance and a manifest-digest record.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "notes": "The collector's signature-ref points to an UNSIGNED placeholder (signature_type manifest-digest/unsigned). CRA-ESR-04 (H3) and QNT-04 (Phase A, harness 0.7.0) report it as N-A unless a real signature (signing-pubkey-ref, written by sign_evidence.py and verified by CRA-SIGN-01) is present.",
+      "evidence": [
+        "secqdevops:provenance-ref",
+        "secqdevops:signature-ref"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-ESR-04",
+        "CRA-SIGN-01",
+        "QNT-04"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1",
+          "CRA-I-3b",
+          "CRA-I-3d",
+          "CRA-II-1",
+          "CRA-II-7"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-12",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "benchmark",
+      "summary": "Record circuit metrics and a hash-verified benchmark report (Roadmap §8.5).",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "evidence": [
+        "secqdevops:benchmark-ref",
+        "secqdevops:benchmark-sha256",
+        "secqdevops:qubit-count",
+        "secqdevops:circuit-depth",
+        "secqdevops:gate-count",
+        "secqdevops:two-qubit-depth",
+        "secqdevops:t-depth",
+        "secqdevops:cnot-depth"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "QBOM-BENCH-01"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1",
+          "CRA-I-3d",
+          "CRA-II-1",
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15a",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "check_results",
+      "summary": "Compare measured outcomes to declared expected results, read in the framework's own bit order, with the sampling error of the comparison; undecided when the shots cannot decide the tolerance.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": true,
+      "how": {
+        "cli": "quantbom certify --expect 0101=1.0 --tolerance 0.05 --expected-order native",
+        "sdk": "certify(..., expected={'0101': 1.0}, tolerance=0.05, expected_order='native')"
+      },
+      "limits": "Native bit order on a translated framework measuring into several classical registers is rejected; declare in Qiskit order there. Shots are sized for the declared tolerance at 95% confidence (Weissman bound, outcomes outside the declared support collapsed into one class), capped at 65,536; QUANTBOM_SHOTS overrides and is recorded.",
+      "evidence": [
+        "secqdevops:expected-distribution-ref",
+        "secqdevops:expected-distribution-sha256",
+        "secqdevops:result-tvd",
+        "secqdevops:result-tolerance",
+        "secqdevops:result-fidelity-verdict",
+        "secqdevops:result-confidence",
+        "secqdevops:result-sampling-error",
+        "secqdevops:result-shots-required"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "QBOM-BENCH-02"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d",
+          "CRA-II-1",
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15a",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "check_qir",
+      "summary": "Check the QIR derived from the source program against the program and the measured counts (second compiler, second check).",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "limits": "Statistical where it must be: qirrunner's sample is compared with the measured counts at a tolerance of max(0.1, 1.5*sqrt(outcomes/shots)), recorded in the report. Qubit and result counts are exact. Gate inventories are recorded, not compared (the QDK rewrites p, u, cp). Needs the source circuit to declare measurements (otherwise `inconclusive`, N-A) and the QIR output order to be pinned by the probe.",
+      "evidence": [
+        "secqdevops:qir-consistency-ref",
+        "secqdevops:qir-consistency-sha256",
+        "secqdevops:qir-consistency-verdict"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "QNT-07"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d",
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15a",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "scan_environment",
+      "summary": "Merge an environment SBOM (syft) and scan it for known vulnerabilities (grype).",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": true,
+      "how": {
+        "cli": "quantbom certify --environment",
+        "sdk": "certify(..., environment=True)",
+        "install": "syft on PATH (or --syft-sbom FILE with a pre-generated CycloneDX SBOM)"
+      },
+      "requires": [
+        "syft",
+        "grype"
+      ],
+      "evidence": [],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-ESR-02",
+        "CRA-ESR-03",
+        "CRA-ESR-05"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-2",
+          "CRA-I-3b",
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "protect",
+      "summary": "Strict privacy: withhold circuit IR, record digests as client-attested.",
+      "provider": "sdk",
+      "owner": "MOD-08",
+      "opt_in": true,
+      "how": {
+        "cli": "quantbom certify --privacy strict",
+        "sdk": "certify(..., privacy='strict')"
+      },
+      "evidence": [
+        "secqdevops:privacy-mode"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d",
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "sign",
+      "summary": "Producer signature: Ed25519 / in-toto DSSE over the evidence, by the releasing organisation — from the wheel (quantbom sign) or the repository tool.",
+      "provider": "tool",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "how": {
+        "cli": "quantbom sign --bundle {bundle}",
+        "sdk": "certify(..., sign=True)",
+        "install": "pip install 'quantbom[signing]'",
+        "commands": [
+          "python sign_evidence.py keygen --key-dir {keys}",
+          "python sign_evidence.py sign --sbom {bundle}/sbom.cdx.json --private-key {keys}/signing.key --out-dir {bundle}"
+        ],
+        "placeholders": {
+          "bundle": "evidence bundle from `quantbom collect`",
+          "keys": "directory holding the release signing key"
+        },
+        "note": "one-time `quantbom keygen` makes the key; `quantbom certify ... --sign` collects, signs and certifies in one step"
+      },
+      "notes": "Role 'producer' (quantbom sign, or sign_evidence.py --role producer, the default); the two make the same attestation and either verifies in the gate. CRA-SIGN-01 rests on this signature and fails without it; the service's countersignature is a receipt, never a substitute (hybrid model step 3, 17 Oct 2026).",
+      "evidence": [
+        "secqdevops:signature-ref",
+        "secqdevops:signing-pubkey-ref",
+        "secqdevops:signing-key-id"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-ESR-04",
+        "CRA-SIGN-01",
+        "QNT-04"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1",
+          "CRA-I-3b",
+          "CRA-I-3d",
+          "CRA-II-1",
+          "CRA-II-7"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-12",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "countersign",
+      "summary": "Service countersignature over the evidence as received — a timestamped receipt under its own properties; never replaces the producer's signature and never satisfies CRA-SIGN-01 on its own.",
+      "provider": "service",
+      "owner": "MOD-08",
+      "opt_in": false,
+      "how": {
+        "note": "performed by the certifying service on receipt when MOD08_SIGNING_KEY is configured (sign_evidence.sign(role='service')); nothing for the producer to do"
+      },
+      "evidence": [
+        "secqdevops:service-attestation-ref",
+        "secqdevops:service-signing-pubkey-ref",
+        "secqdevops:service-signing-key-id"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "supported"
+        },
+        "qrisp": {
+          "status": "supported"
+        },
+        "cirq": {
+          "status": "supported"
+        },
+        "braket": {
+          "status": "supported"
+        },
+        "pennylane": {
+          "status": "supported"
+        },
+        "cudaq": {
+          "status": "supported"
+        }
+      },
+      "controls": [
+        "CRA-SIGN-01"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3b",
+          "CRA-I-3d",
+          "CRA-II-7"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "assess_crypto",
+      "summary": "Cryptographic inventory (CBOM) and post-quantum migration readiness.",
+      "provider": "tool",
+      "owner": "MOD-03/MOD-09",
+      "opt_in": true,
+      "how": {
+        "cli": "quantbom attest crypto --bundle {bundle}",
+        "commands": [
+          "python cbom_agility.py assess --cbom {bundle}/crypto/cbom.cdx.json --report-out {bundle}/crypto/cbom-agility.json --inject-sbom {bundle}/sbom.cdx.json"
+        ],
+        "placeholders": {
+          "bundle": "evidence bundle from `quantbom collect`; the CBOM is read from crypto/cbom.cdx.json inside it (`quantbom attest crypto --cbom FILE` copies one there)"
+        }
+      },
+      "evidence": [
+        "secqdevops:cbom-ref",
+        "secqdevops:cbom-sha256",
+        "secqdevops:crypto-agility-ref",
+        "secqdevops:crypto-agility-sha256",
+        "secqdevops:crypto-agility-score",
+        "secqdevops:crypto-migration-readiness"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-03/MOD-09; framework-independent"
+        },
+        "qrisp": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-03/MOD-09; framework-independent"
+        },
+        "cirq": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-03/MOD-09; framework-independent"
+        },
+        "braket": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-03/MOD-09; framework-independent"
+        },
+        "pennylane": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-03/MOD-09; framework-independent"
+        },
+        "cudaq": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-03/MOD-09; framework-independent"
+        }
+      },
+      "controls": [
+        "CRA-ESR-06",
+        "CRA-INTEG-01",
+        "CRA-CRYPTO-01"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3c",
+          "CRA-I-3d",
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "prove_constant_time",
+      "summary": "Side-channel (constant-time) proof for cryptographic components.",
+      "provider": "tool",
+      "owner": "MOD-09",
+      "opt_in": true,
+      "how": {
+        "cli": "quantbom attest constant-time --bundle {bundle} --tool dudect --target {target} --measurements {timings}",
+        "commands": [
+          "python emit_ct_evidence.py --tool dudect --target {target} --measurements {timings} --report-out {bundle}/crypto/ct-proof.json --inject-sbom {bundle}/sbom.cdx.json"
+        ],
+        "placeholders": {
+          "bundle": "evidence bundle from `quantbom collect`",
+          "target": "analysed component (purl or symbol)",
+          "timings": "two-column dudect CSV (class,nanoseconds)"
+        }
+      },
+      "evidence": [
+        "secqdevops:ct-proof-ref",
+        "secqdevops:ct-proof-sha256",
+        "secqdevops:ct-target",
+        "secqdevops:ct-tool",
+        "secqdevops:ct-verdict"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-09; framework-independent"
+        },
+        "qrisp": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-09; framework-independent"
+        },
+        "cirq": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-09; framework-independent"
+        },
+        "braket": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-09; framework-independent"
+        },
+        "pennylane": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-09; framework-independent"
+        },
+        "cudaq": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-09; framework-independent"
+        }
+      },
+      "controls": [
+        "CRA-ESR-06",
+        "CRA-INTEG-01"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3c",
+          "CRA-I-3d",
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "attest_tests",
+      "summary": "Security test report from the testing module.",
+      "provider": "tool",
+      "owner": "MOD-05",
+      "opt_in": true,
+      "how": {
+        "cli": "quantbom attest tests --bundle {bundle} --suite {suite} --outcome passed --passed {passed}",
+        "commands": [
+          "python emit_test_evidence.py emit --suite {suite} --outcome passed --passed {passed} --failed 0 --out {bundle}/evidence/mod05/test-report.json --inject-sbom {bundle}/sbom.cdx.json"
+        ],
+        "placeholders": {
+          "bundle": "evidence bundle from `quantbom collect`",
+          "suite": "MOD-05 suite name",
+          "passed": "number of passing tests"
+        }
+      },
+      "evidence": [
+        "secqdevops:test-outcome",
+        "secqdevops:test-report-ref",
+        "secqdevops:test-report-sha256"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-05; framework-independent"
+        },
+        "qrisp": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-05; framework-independent"
+        },
+        "cirq": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-05; framework-independent"
+        },
+        "braket": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-05; framework-independent"
+        },
+        "pennylane": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-05; framework-independent"
+        },
+        "cudaq": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-05; framework-independent"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "QBOM-01",
+        "MOD05-TEST-01"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d",
+          "CRA-II-1",
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11",
+          "AIA-15b"
+        ]
+      }
+    },
+    {
+      "id": "attest_vulnerability_handling",
+      "summary": "VEX over the release's findings and a coordinated-disclosure policy.",
+      "provider": "tool",
+      "owner": "MOD-07",
+      "opt_in": true,
+      "how": {
+        "cli": "quantbom attest vulns --bundle {bundle} --policy-url {policy_url} --contact {contact}",
+        "commands": [
+          "python emit_vuln_evidence.py emit --sbom {bundle}/sbom.cdx.json --vex-out {bundle}/evidence/vex.cdx.json --cvd-out {bundle}/evidence/cvd-policy.json --cvd-policy-url {policy_url} --cvd-contact {contact} --inject-sbom {bundle}/sbom.cdx.json"
+        ],
+        "placeholders": {
+          "bundle": "evidence bundle from `quantbom collect`",
+          "policy_url": "public CVD policy URL",
+          "contact": "security contact (mailto: or URL)"
+        }
+      },
+      "evidence": [
+        "secqdevops:vex-ref",
+        "secqdevops:vex-sha256",
+        "secqdevops:cvd-contact",
+        "secqdevops:cvd-policy-ref",
+        "secqdevops:cvd-policy-sha256"
+      ],
+      "framework_status": {
+        "qiskit": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-07; framework-independent"
+        },
+        "qrisp": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-07; framework-independent"
+        },
+        "cirq": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-07; framework-independent"
+        },
+        "braket": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-07; framework-independent"
+        },
+        "pennylane": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-07; framework-independent"
+        },
+        "cudaq": {
+          "status": "external",
+          "reason": "evidence supplied by MOD-07; framework-independent"
+        }
+      },
+      "controls": [
+        "CRA-INTEG-01",
+        "CRA-VULN-01",
+        "CRA-VDP-01"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d",
+          "CRA-II-2",
+          "CRA-II-5"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    }
+  ],
+  "controls": {
+    "CRA-ESR-01": {
+      "fed_by": [
+        "inventory"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11"
+        ]
+      }
+    },
+    "CRA-ESR-02": {
+      "fed_by": [
+        "inventory",
+        "scan_environment"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3b"
+        ]
+      }
+    },
+    "CRA-ESR-03": {
+      "fed_by": [
+        "scan_environment"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-2"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    "CRA-ESR-04": {
+      "fed_by": [
+        "record_provenance",
+        "sign"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11"
+        ]
+      }
+    },
+    "CRA-ESR-05": {
+      "fed_by": [
+        "inventory",
+        "scan_environment"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11"
+        ]
+      }
+    },
+    "CRA-ESR-06": {
+      "fed_by": [
+        "assess_crypto",
+        "prove_constant_time"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3c",
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    "CRA-INTEG-01": {
+      "fed_by": [
+        "record_outcomes",
+        "capture",
+        "verify_conversion",
+        "compare_native",
+        "prove_equivalence",
+        "bind_backend",
+        "disclose_error_handling",
+        "execute",
+        "benchmark",
+        "check_results",
+        "check_qir",
+        "protect",
+        "assess_crypto",
+        "prove_constant_time",
+        "attest_tests",
+        "attest_vulnerability_handling"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    "CRA-CRYPTO-01": {
+      "fed_by": [
+        "assess_crypto"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3c"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    "QBOM-01": {
+      "fed_by": [
+        "inventory",
+        "record_outcomes",
+        "capture",
+        "verify_conversion",
+        "compare_native",
+        "prove_equivalence",
+        "bind_backend",
+        "disclose_error_handling",
+        "execute",
+        "benchmark",
+        "check_results",
+        "check_qir",
+        "protect",
+        "attest_tests"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-II-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-11"
+        ]
+      }
+    },
+    "CRA-SIGN-01": {
+      "fed_by": [
+        "record_provenance",
+        "sign",
+        "countersign"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3b",
+          "CRA-I-3d",
+          "CRA-II-7"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    "QNT-01": {
+      "fed_by": [
+        "inventory"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1"
+        ]
+      }
+    },
+    "QNT-02": {
+      "fed_by": [
+        "capture"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1",
+          "CRA-II-3"
+        ]
+      }
+    },
+    "QNT-03": {
+      "fed_by": [
+        "capture",
+        "bind_backend"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-12"
+        ]
+      }
+    },
+    "QNT-04": {
+      "fed_by": [
+        "bind_backend",
+        "execute",
+        "record_provenance",
+        "sign"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-12"
+        ]
+      }
+    },
+    "QBOM-BENCH-01": {
+      "fed_by": [
+        "inventory",
+        "benchmark"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1",
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15a"
+        ]
+      }
+    },
+    "QBOM-BENCH-02": {
+      "fed_by": [
+        "execute",
+        "check_results"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15a"
+        ]
+      }
+    },
+    "QNT-05": {
+      "fed_by": [
+        "capture",
+        "prove_equivalence"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15a"
+        ]
+      }
+    },
+    "QNT-06": {
+      "fed_by": [
+        "inventory",
+        "capture",
+        "verify_conversion"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15a"
+        ]
+      }
+    },
+    "QNT-07": {
+      "fed_by": [
+        "capture",
+        "check_qir"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15a"
+        ]
+      }
+    },
+    "MOD05-TEST-01": {
+      "fed_by": [
+        "attest_tests"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-II-3"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    "CRA-VULN-01": {
+      "fed_by": [
+        "attest_vulnerability_handling"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-II-2"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    "CRA-VDP-01": {
+      "fed_by": [
+        "attest_vulnerability_handling"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-II-5"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15b"
+        ]
+      }
+    },
+    "QNT-08": {
+      "fed_by": [
+        "disclose_error_handling",
+        "execute"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-1"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-13",
+          "AIA-15a"
+        ]
+      }
+    },
+    "QNT-09": {
+      "fed_by": [
+        "compare_native",
+        "execute"
+      ],
+      "requirements": {
+        "eu-cra": [
+          "CRA-I-3d"
+        ],
+        "eu-ai-act-quantum": [
+          "AIA-15a"
+        ]
+      }
+    }
+  }
+}