quantbom 0.6.0__py3-none-any.whl

quantbom/actions/benchmark.py

@@ -0,0 +1,53 @@
+"""benchmark — circuit metrics and a hash-verified report, Roadmap §8.5 (feeds QBOM-BENCH-01)."""
+from __future__ import annotations
+
+import json
+
+from .base import PRODUCED, ActionResult, Context
+
+ID = "benchmark"
+
+
+def run(ctx: Context) -> ActionResult:
+    from .. import _collect as C
+
+    metrics = ctx.state["metrics"]
+    rr = ctx.state["runtime_result"]
+    counts = rr.get("counts") or {}
+    shots = rr.get("shots") or 0
+    report = {
+        "schema": "secqdevops.quantum-benchmark/v1",
+        "release_id": ctx.release_id,
+        "framing": {
+            "approach": "bottom-up structural characterization",
+            "reference": "CEN/CENELEC Standardization Roadmap on Quantum Technologies R1.1 §8.5",
+            "harmonisation_targets": ["IEEE P7131 (in development)", "IEC/ISO JTC 3 benchmarking (in progress)"],
+        },
+        "metrics": metrics,
+        "transpiled_metrics": C._circuit_metrics(ctx.state["transpiled"]),
+        "result_fidelity": {
+            "shots": shots,
+            "result_status": ctx.state["runtime_job"]["result_status"],
+            "distinct_outcomes": len(counts),
+            "top_outcome_probability": round(max(counts.values()) / shots, 6) if counts and shots else None,
+            "declared_expectation": ctx.state.get("fidelity_summary"),
+        },
+    }
+    raw = (json.dumps(report, indent=2, ensure_ascii=True) + "\n").encode("utf-8")
+    ctx.quantum_dir.mkdir(parents=True, exist_ok=True)
+    (ctx.quantum_dir / "benchmark-report.json").write_bytes(raw)
+    benchmark_sha = C.sha256_bytes(raw)
+    ctx.state["benchmark_sha"] = benchmark_sha
+
+    props = [
+        {"name": "secqdevops:qubit-count", "value": str(metrics["qubits"])},
+        {"name": "secqdevops:circuit-depth", "value": str(metrics["depth"])},
+        {"name": "secqdevops:two-qubit-depth", "value": str(metrics["two_qubit_depth"])},
+        {"name": "secqdevops:t-depth", "value": str(metrics["t_depth"])},
+        {"name": "secqdevops:gate-count", "value": str(metrics["size"])},
+        {"name": "secqdevops:benchmark-ref", "value": "quantum/benchmark-report.json"},
+        {"name": "secqdevops:benchmark-sha256", "value": benchmark_sha},
+    ]
+    if "cnot_depth" in metrics:
+        props.append({"name": "secqdevops:cnot-depth", "value": str(metrics["cnot_depth"])})
+    return ActionResult(ID, PRODUCED, props)

quantbom/actions/bind_backend.py

@@ -0,0 +1,71 @@
+"""bind_backend — the backend target and calibration snapshot, hash-verified (feeds QNT-03)."""
+from __future__ import annotations
+
+import json
+
+from .base import PRODUCED, ActionResult, Context
+
+ID = "bind_backend"
+
+
+def run(ctx: Context) -> ActionResult:
+    from .. import _collect as C
+
+    rr = ctx.state["runtime_result"]
+    metrics = ctx.state["metrics"]
+    q = ctx.quantum_dir
+    q.mkdir(parents=True, exist_ok=True)
+
+    calibration_sha = None
+    calibration = ctx.state.get("calibration")
+    age = C.calibration_age_hours(calibration) if calibration is not None else None
+    if age is not None:  # written INTO the snapshot so the declared age is hash-bound to it
+        calibration["calibration_age_hours"] = f"{age:.1f}"
+    if calibration is not None:
+        calibration_bytes = (json.dumps(calibration, indent=2, ensure_ascii=True) + "\n").encode("utf-8")
+        (q / "backend-calibration.json").write_bytes(calibration_bytes)
+        calibration_sha = C.sha256_bytes(calibration_bytes)
+    ctx.state["calibration_sha"] = calibration_sha
+
+    transpile_report = {
+        "target_backend": rr["backend_name"],
+        "basis_gates": C.BASIS_GATES,
+        "optimization_level": 2,
+        "seed_transpiler": C.SEED_TRANSPILER,
+        "execution_mode": ctx.state["execution_mode"],
+        "qiskit_version": ctx.qiskit_version,
+        "source_format": ctx.source_format,
+        "circuit_metrics": metrics,
+        "dynamic_features": ctx.circuit_info.get("dynamic_features", []),
+    }
+    backend_target = {
+        "provider": rr["provider"],
+        "backend_name": rr["backend_name"],
+        "num_qubits": metrics["qubits"],
+        "simulator": rr["simulator"],
+        # what the evidence may claim about where it ran; bound to
+        # secqdevops:execution-target by the gate (CRA-INTEG-01)
+        "execution_target": rr.get("execution_target", "simulator" if rr["simulator"] else "hardware"),
+        "noise": rr.get("noise"),
+        "native_gates": C.BASIS_GATES,
+    }
+    C._write_json(q / "transpile-report.json", transpile_report)
+    # The backend target carries the provenance claim — which device. Binding
+    # its digest is what lets QNT-03 affirm rather than report N-A.
+    backend_target_sha = C._write_json(q / "backend-target.json", backend_target)
+
+    props = [
+        {"name": "secqdevops:transpile-report-ref", "value": "quantum/transpile-report.json"},
+        {"name": "secqdevops:backend-provider", "value": rr["provider"]},
+        {"name": "secqdevops:backend-name", "value": rr["backend_name"]},
+        {"name": "secqdevops:execution-mode", "value": ctx.state["execution_mode"]},
+        {"name": "secqdevops:execution-target", "value": backend_target["execution_target"]},
+        {"name": "secqdevops:backend-target-ref", "value": "quantum/backend-target.json"},
+        {"name": "secqdevops:backend-target-sha256", "value": backend_target_sha},
+        *([{"name": "secqdevops:calibration-ref", "value": "quantum/backend-calibration.json"},
+           {"name": "secqdevops:calibration-sha256", "value": calibration_sha},
+           {"name": "secqdevops:calibration-captured-at", "value": calibration["captured_at"]}] if calibration_sha else []),
+        *([{"name": "secqdevops:calibration-age-hours", "value": f"{age:.1f}"}] if age is not None else []),
+        {"name": "secqdevops:backend-target-layer", "value": "hardware-abstraction-layer"},
+    ]
+    return ActionResult(ID, PRODUCED, props)

quantbom/actions/capture.py

@@ -0,0 +1,106 @@
+"""capture — source and compiled circuit (QPY, OpenQASM 3, QIR via the QDK) with byte digests.
+
+Feeds QNT-02, QNT-05/06 (the circuits they compare) and CRA-INTEG-01.
+"""
+from __future__ import annotations
+
+from .base import PRODUCED, ActionResult, Context
+
+ID = "capture"
+
+
+def run(ctx: Context) -> ActionResult:
+    from qiskit import transpile
+
+    from .. import _collect as C
+
+    qc = ctx.qiskit_circuit
+    metrics = C._circuit_metrics(qc, ctx.qrisp_circuit)
+    transpiled = transpile(qc, basis_gates=C.BASIS_GATES, optimization_level=2, seed_transpiler=C.SEED_TRANSPILER)
+    circuit_qpy = C._qpy_bytes(qc)
+    transpiled_qpy = C._qpy_bytes(transpiled)
+    try:  # OpenQASM3 export from the normalized IR (works for any frontend)
+        from qiskit import qasm3
+
+        qasm_text = qasm3.dumps(qc)
+    except Exception:
+        qasm_text = ""
+
+    q = ctx.quantum_dir
+    q.mkdir(parents=True, exist_ok=True)
+    (q / "circuit.qpy").write_bytes(circuit_qpy)
+    (q / "transpiled.qpy").write_bytes(transpiled_qpy)
+    # write_bytes (not write_text) so the hash-verified bytes are platform-independent
+    qasm_bytes = qasm_text.encode("utf-8")
+    (q / "program.qasm").write_bytes(qasm_bytes)
+    qasm_sha = C.sha256_bytes(qasm_bytes)
+
+    # QIR (K5): the QDK compiles the same OpenQASM 3 text that is hash-bound as
+    # program.qasm — Base profile for a static circuit, Adaptive_RI for a dynamic
+    # one. It is a derived format from a second compiler, so check_qir compares
+    # it with the circuit and the measured counts before QNT-07 can affirm it.
+    # Without the toolchain QIR is honestly absent and the harness log says why.
+    qir_text, qir_profile, qir_reason = _qir_export(qasm_text, bool(ctx.circuit_info.get("dynamic")),
+                                                    measured=any(i.operation.name == "measure" for i in qc.data))
+    qir_sha = None
+    if qir_text:
+        qir_bytes = qir_text.encode("utf-8")
+        (q / "program.ll").write_bytes(qir_bytes)
+        qir_sha = C.sha256_bytes(qir_bytes)
+
+    transpile_profile = {
+        "basis_gates": C.BASIS_GATES,
+        "optimization_level": 2,
+        "seed_transpiler": C.SEED_TRANSPILER,
+        "qiskit_version": ctx.qiskit_version,
+    }
+    circuit_sha = C.sha256_bytes(circuit_qpy)
+    transpiled_sha = C.sha256_bytes(transpiled_qpy)
+    ctx.state.update(metrics=metrics, transpiled=transpiled, circuit_qpy=circuit_qpy, transpiled_qpy=transpiled_qpy,
+                     circuit_sha=circuit_sha, transpiled_sha=transpiled_sha, qasm_sha=qasm_sha, qir_sha=qir_sha,
+                     qir_text=qir_text or None, qir_profile=qir_profile, qir_reason=qir_reason)
+
+    props = [
+        {"name": "secqdevops:circuit-format", "value": "qpy"},
+        {"name": "secqdevops:circuit-artifact-ref", "value": "quantum/circuit.qpy"},
+        {"name": "secqdevops:circuit-sha256", "value": circuit_sha},
+        {"name": "secqdevops:transpiled-circuit-ref", "value": "quantum/transpiled.qpy"},
+        {"name": "secqdevops:transpiled-circuit-sha256", "value": transpiled_sha},
+        {"name": "secqdevops:qasm-program-ref", "value": "quantum/program.qasm"},
+        {"name": "secqdevops:qasm-program-sha256", "value": qasm_sha},
+        *([{"name": "secqdevops:qir-program-ref", "value": "quantum/program.ll"},
+           {"name": "secqdevops:qir-program-sha256", "value": qir_sha},
+           {"name": "secqdevops:qir-profile", "value": qir_profile}] if qir_sha else []),
+        {"name": "secqdevops:transpile-profile-hash",
+         "value": C.sha256_bytes(C.canonical_json(transpile_profile).encode("utf-8"))},
+        {"name": "secqdevops:circuit-layer", "value": "assembly-ir"},
+        # dynamic circuits are accepted (K0); recorded because they change how
+        # the circuit is executed (qiskit-aer) and proved equivalent (QCEC)
+        {"name": "secqdevops:circuit-dynamic", "value": "true" if ctx.circuit_info.get("dynamic") else "false"},
+        {"name": "secqdevops:transpiled-circuit-layer", "value": "programming"},
+    ]
+    ir_standards = [n for n, present in (("openqasm3", bool(qasm_text)), ("qir", bool(qir_sha))) if present]
+    if ir_standards:  # standards-named IRs exported alongside the vendor IR (Roadmap §8.3 / QIR Alliance)
+        props.append({"name": "secqdevops:ir-standard", "value": ",".join(ir_standards)})
+    return ActionResult(ID, PRODUCED, props, reason=qir_reason)
+
+
+def _qir_export(qasm_text: str, dynamic: bool, measured: bool = True) -> tuple[str, str | None, str | None]:
+    """(QIR text, profile, reason it is absent) — the QDK route (_qir.py)."""
+    from .. import _qir
+
+    if not qasm_text:
+        return "", None, "QIR not emitted: the OpenQASM 3 export is empty"
+    if not measured:
+        return "", None, ("QIR not emitted: the source circuit declares no measurements, and QIR records only declared "
+                          "outputs (the run measured every qubit, but the hash-bound program is the circuit as given); "
+                          "declare measurements to get QIR and its consistency check")
+    available, why = _qir.toolchain()
+    if not available:
+        return "", None, why
+    try:
+        text, profile = _qir.compile_qir(qasm_text, dynamic)
+    except Exception as err:  # recorded, never hidden; the release is still collected without QIR
+        first = str(err).strip().splitlines()[0] if str(err).strip() else ""
+        return "", None, f"QIR not emitted: the QDK could not compile the OpenQASM 3 export: {type(err).__name__}: {first[:160]}"
+    return text, profile, None

quantbom/actions/check_qir.py

@@ -0,0 +1,44 @@
+"""check_qir — the QIR derived from the source program behaves like the program (feeds QNT-07).
+
+QIR is produced by a second compiler (the QDK), so it is checked, not trusted:
+qubit and result counts against the circuit, qirrunner's output distribution
+against the counts the release actually measured, the output order pinned by
+a probe. The gate fails the release on `inconsistent` (K5 decision).
+"""
+from __future__ import annotations
+
+import json
+
+from .base import NOT_APPLICABLE, PRODUCED, UNSUPPORTED, ActionResult, Context
+
+ID = "check_qir"
+
+
+def run(ctx: Context) -> ActionResult:
+    qir_text = ctx.state.get("qir_text")
+    if not qir_text:
+        return ActionResult(ID, NOT_APPLICABLE, reason=ctx.state.get("qir_reason") or "no QIR was emitted for this release")
+    if ctx.state.get("run_status", "completed") != "completed":
+        rr = ctx.state.get("runtime_result") or {}
+        return ActionResult(ID, NOT_APPLICABLE,
+                            reason=f"no measured results to compare the QIR with — {rr.get('reason') or 'the run did not complete'}")
+    from .. import _collect as C
+    from .. import _qir
+
+    rr = ctx.state["runtime_result"]
+    try:
+        report = _qir.assess(qir_text, ctx.qiskit_circuit, rr.get("counts") or {}, int(rr.get("shots") or 0))
+    except Exception as err:  # the module never raises for undecidable cases; this is a toolchain failure
+        return ActionResult(ID, UNSUPPORTED, reason=f"QIR consistency check could not run: {type(err).__name__}: {str(err)[:200]}")
+    report["release_id"] = ctx.release_id
+    raw = (json.dumps(report, indent=2, ensure_ascii=True, sort_keys=True) + "\n").encode("utf-8")
+    ctx.quantum_dir.mkdir(parents=True, exist_ok=True)
+    (ctx.quantum_dir / "qir-consistency.json").write_bytes(raw)
+    ctx.state["qir_verdict"] = report["verdict"]
+    props = [
+        {"name": "secqdevops:qir-consistency-ref", "value": "quantum/qir-consistency.json"},
+        {"name": "secqdevops:qir-consistency-sha256", "value": C.sha256_bytes(raw)},
+        {"name": "secqdevops:qir-consistency-verdict", "value": report["verdict"]},
+    ]
+    reason = report.get("reason") if report["verdict"] == "inconclusive" else None
+    return ActionResult(ID, PRODUCED, props, reason=reason)

quantbom/actions/check_results.py

@@ -0,0 +1,75 @@
+"""check_results — measured outcomes vs the declared expectation (feeds QBOM-BENCH-02).
+
+The SDK has already translated the declaration into measured (Qiskit) order and
+validated its width (`_bitorder`); this action records it, measures the
+deviation (total-variation distance) with its sampling error (`_stats`, one
+definition shared with the gate) and leaves the verdict to the gate. A
+comparison the shots cannot decide at the declared tolerance is `undecided`
+— recorded as such, never rounded to within or exceeded (Q1.1).
+"""
+from __future__ import annotations
+
+import json
+
+from .base import NOT_APPLICABLE, NOT_REQUESTED, PRODUCED, ActionResult, Context
+
+ID = "check_results"
+
+
+def run(ctx: Context) -> ActionResult:
+    ctx.state["fidelity_summary"] = None
+    if not ctx.expected_distribution:
+        return ActionResult(ID, NOT_REQUESTED, reason="no expected results declared")
+    from .. import _collect as C
+
+    rr = ctx.state["runtime_result"]
+    if ctx.state.get("run_status", "completed") != "completed":
+        # nothing was measured: comparing an expectation with no results would
+        # blame the circuit for a run that never happened
+        return ActionResult(ID, NOT_APPLICABLE,
+                            reason=f"no measured results to compare — {rr.get('reason') or 'the run did not complete'}")
+    from .._stats import CONFIDENCE, assess
+
+    declared = {str(k).replace(" ", ""): float(v) for k, v in ctx.expected_distribution.items()}
+    tolerance = float(ctx.expected_tolerance)
+    stats = assess(rr.get("counts") or {}, int(rr.get("shots") or 0), declared, tolerance, CONFIDENCE)
+    tvd, verdict = stats["tvd"], stats["verdict"]
+    doc = {
+        "schema": "secqdevops.expected-distribution/v1",
+        "release_id": ctx.release_id,
+        "metric": "total_variation_distance",
+        "tolerance": tolerance,
+        "confidence": CONFIDENCE,
+        "distribution": declared,
+    }
+    decl = ctx.expected_declaration
+    if decl:
+        # `distribution` is what was compared, in measured order. Record the
+        # declaration as the producer wrote it and the order it was read in,
+        # so the translation itself is hash-bound and auditable.
+        doc["distribution_order"] = decl.get("measured_order")
+        doc["declared_order"] = decl.get("declared_order")
+        doc["width"] = decl.get("width")
+        if decl.get("translated"):
+            doc["declared_distribution"] = decl.get("declared_distribution")
+    exp_bytes = (json.dumps(doc, indent=2, ensure_ascii=True, sort_keys=True) + "\n").encode("utf-8")
+    ctx.quantum_dir.mkdir(parents=True, exist_ok=True)
+    (ctx.quantum_dir / "expected-distribution.json").write_bytes(exp_bytes)
+    ctx.state["fidelity_summary"] = {**stats, "tolerance": tolerance}
+
+    props = [
+        {"name": "secqdevops:expected-distribution-ref", "value": "quantum/expected-distribution.json"},
+        {"name": "secqdevops:expected-distribution-sha256", "value": C.sha256_bytes(exp_bytes)},
+        {"name": "secqdevops:result-tvd", "value": f"{tvd:.6f}"},
+        {"name": "secqdevops:result-tolerance", "value": f"{tolerance:.6f}"},
+        {"name": "secqdevops:result-fidelity-verdict", "value": verdict},
+        {"name": "secqdevops:result-confidence", "value": f"{CONFIDENCE:.2f}"},
+        {"name": "secqdevops:result-sampling-error", "value": f"{stats['sampling_error']:.6f}"},
+        {"name": "secqdevops:result-shots-required", "value": str(stats["required_shots"])},
+    ]
+    if verdict == "undecided":
+        reason = (f"undecided: {stats['shots']} shots give a sampling error of {stats['sampling_error']:.4f} at "
+                  f"{CONFIDENCE:.0%} confidence, which cannot decide tolerance {tolerance} for a TVD of {tvd:.4f}; "
+                  f"{stats['required_shots']} shots would")
+        return ActionResult(ID, PRODUCED, props, reason=reason)
+    return ActionResult(ID, PRODUCED, props)

quantbom/actions/compare_native.py

@@ -0,0 +1,88 @@
+"""compare_native — the program on its own framework's simulator agrees with the shared-format run (feeds QNT-09).
+
+Every framework is lowered to one Qiskit circuit and the evidence run executes
+that. The SDK also samples the NATIVE program on the framework's own simulator
+(`FrameworkAdapter.native_run`, where the native object is still in hand); this
+action compares the two samples by total-variation distance with their joint
+sampling error (`_stats.compare_samples`, which the gate re-derives) and writes
+`quantum/native-result.json`, hash-bound: both readings of the native run (the
+framework's own, and keyed as the measured string), Qrisp's per-variable view,
+and the comparison.
+
+Unlike QNT-06's unitary comparison it reaches dynamic programs (mid-circuit
+measurement, feed-forward), which have no unitary; unlike it, it is statistical:
+it catches a translation that changes outcome probabilities, not a phase.
+
+Not applicable when there is nothing native to compare (Qiskit and file inputs
+are the shared format), when the framework could not run the program, when the
+shared-format run did not complete, or when it ran on a noisy device or hardware:
+the framework's simulator is ideal, so a disagreement would measure noise.
+"""
+from __future__ import annotations
+
+import json
+import os
+
+from .base import NOT_APPLICABLE, PRODUCED, ActionResult, Context
+
+ID = "compare_native"
+SCHEMA = "secqdevops.native-result/v1"
+IDEAL_BACKENDS = ("basic_simulator", "aer_simulator")
+
+
+def tolerance() -> float:
+    return float(os.environ.get("QUANTBOM_NATIVE_TOLERANCE", "0.15"))
+
+
+def run(ctx: Context) -> ActionResult:
+    native = ctx.native_result
+    if native is None:
+        return ActionResult(ID, NOT_APPLICABLE, reason=f"{ctx.source_format} input is the shared format itself: "
+                                                        "there is no native program to run")
+    if native.get("reason"):
+        return ActionResult(ID, NOT_APPLICABLE, reason=f"the {ctx.source_format} simulator could not run the program: "
+                                                       f"{native['reason']}")
+    if ctx.state.get("run_status", "completed") != "completed":
+        return ActionResult(ID, NOT_APPLICABLE, reason="the shared-format run did not complete, so there is nothing to compare")
+    shared_run = ctx.state.get("runtime_result") or {}
+    backend = str(shared_run.get("backend_name") or "")
+    if ctx.backend_choice != "basic" or backend not in IDEAL_BACKENDS:
+        return ActionResult(ID, NOT_APPLICABLE, reason=f"the shared-format run used {backend or ctx.backend_choice}, which is not "
+                                                       "an ideal simulator: compared with the framework's ideal one, a "
+                                                       "difference would measure noise, not the translation")
+    from .. import _collect as C
+    from .._stats import CONFIDENCE, compare_samples
+
+    shared = {str(k).replace(" ", ""): int(v) for k, v in (shared_run.get("counts") or {}).items()}
+    stats = compare_samples(shared, int(shared_run.get("shots") or 0), native["measured"], int(native["shots"]),
+                            tolerance(), CONFIDENCE)
+    document = {
+        "schema": SCHEMA,
+        "release_id": ctx.release_id,
+        "framework": native["framework"],
+        "simulator": native["simulator"],
+        "shots": int(native["shots"]),
+        "reading_order": native["reading_order"],
+        "reading": native["reading"],
+        "measured": native["measured"],
+        **({"by_variable": native["by_variable"]} if native.get("by_variable") else {}),
+        "shared_backend": backend,
+        "comparison": stats,
+        "tvd": stats["tvd"],
+        "verdict": stats["verdict"],
+    }
+    raw = (json.dumps(document, indent=2, ensure_ascii=True) + "\n").encode("utf-8")
+    ctx.quantum_dir.mkdir(parents=True, exist_ok=True)
+    (ctx.quantum_dir / "native-result.json").write_bytes(raw)
+    ctx.state["native_verdict"] = stats["verdict"]
+    props = [
+        {"name": "secqdevops:native-result-ref", "value": "quantum/native-result.json"},
+        {"name": "secqdevops:native-result-sha256", "value": C.sha256_bytes(raw)},
+        {"name": "secqdevops:native-result-verdict", "value": stats["verdict"]},
+        {"name": "secqdevops:native-result-tvd", "value": f"{stats['tvd']:.6f}"},
+    ]
+    why = None
+    if stats["verdict"] == "undecided":
+        why = (f"the samples cannot decide agreement at tolerance {stats['tolerance']}: TVD {stats['tvd']} with joint "
+               f"sampling error {stats['sampling_error']} over {stats['classes']} outcome classes — more shots would decide")
+    return ActionResult(ID, PRODUCED, props, reason=why)

quantbom/actions/disclose_error_handling.py

@@ -0,0 +1,66 @@
+"""disclose_error_handling — what the backend did about errors (feeds QNT-08).
+
+Error mitigation (readout correction, ZNE, PEC) and error suppression (dynamical
+decoupling, twirling) change results after the fact, often by provider defaults
+the developer did not choose, and a mitigated distribution can look right for
+the wrong reason. This action records what the run's backend reports about
+them — as a hash-bound document and a bound status — so a certificate reader
+knows whether the measured counts are raw, corrected, or of unknown treatment.
+
+  mitigation_status  none     the backend reports raw counts with no mitigation
+                              (every local simulator; IBM SamplerV2)
+                     applied  the backend reports mitigation; the methods are listed
+                     unknown  the backend does not report what it did — the gate
+                              reports QNT-08 as N-A with that reason. Absence of
+                              the record is the record.
+
+Q1.2 of QUANTUM_CHALLENGES_PLAN.md. Limit stated: the disclosure is what the
+provider *reports*; mitigation a provider applies silently is not visible here.
+"""
+from __future__ import annotations
+
+import json
+
+from .base import PRODUCED, ActionResult, Context
+
+ID = "disclose_error_handling"
+STATUSES = ("none", "applied", "unknown")
+
+
+def run(ctx: Context) -> ActionResult:
+    from .. import _collect as C
+
+    rr = ctx.state["runtime_result"]
+    eh = dict(rr.get("error_handling") or {})
+    status = eh.get("mitigation_status") or "unknown"
+    if status not in STATUSES:
+        status = "unknown"
+    if status == "applied" and not eh.get("mitigation"):
+        # a backend that says "mitigated" without saying how has not disclosed anything
+        status, eh["note"] = "unknown", "backend reported mitigation without naming a method"
+    doc = {
+        "schema": "secqdevops.error-handling/v1",
+        "release_id": ctx.release_id,
+        "backend": rr.get("backend_name"),
+        "provider": rr.get("provider"),
+        "execution_target": rr.get("execution_target", "simulator" if rr.get("simulator") else "hardware"),
+        "declared": status != "unknown",
+        "source": eh.get("source", "backend reports nothing about error handling"),
+        "mitigation_status": status,
+        "mitigation": eh.get("mitigation", []),
+        "suppression": eh.get("suppression", []),
+        "raw_counts": eh.get("raw_counts"),
+        "noise": rr.get("noise"),
+        **({"note": eh["note"]} if eh.get("note") else {}),
+    }
+    ctx.quantum_dir.mkdir(parents=True, exist_ok=True)
+    sha = C._write_json(ctx.quantum_dir / "error-handling.json", doc)
+    ctx.state["error_handling"] = doc
+    props = [
+        {"name": "secqdevops:error-handling-ref", "value": "quantum/error-handling.json"},
+        {"name": "secqdevops:error-handling-sha256", "value": sha},
+        {"name": "secqdevops:error-mitigation", "value": status},
+    ]
+    if status == "unknown":
+        return ActionResult(ID, PRODUCED, props, reason=f"the backend does not report its error handling ({doc['source']})")
+    return ActionResult(ID, PRODUCED, props)

quantbom/actions/execute.py

@@ -0,0 +1,85 @@
+"""execute — run the circuit and bind the job receipt (feeds QNT-04).
+
+The receipt says what actually happened. A run that could not happen (a
+dynamic circuit without qiskit-aer, a failed simulation) is recorded with its
+status and reason, and the action reports `unsupported` — never `produced`
+with empty results that a later check would judge as if they were measured.
+"""
+from __future__ import annotations
+
+import os
+
+from .base import PRODUCED, UNSUPPORTED, ActionResult, Context
+
+ID = "execute"
+DEFAULT_SHOTS = 1024
+MAX_SHOTS = 65536
+
+
+def shots_for(ctx: Context) -> tuple[int, str]:
+    """How many shots, and why: enough to decide the declared tolerance (Q1.1),
+    the default otherwise; QUANTBOM_SHOTS overrides (cost control, recorded)."""
+    override = os.environ.get("QUANTBOM_SHOTS")
+    if override:
+        return max(1, int(override)), "QUANTBOM_SHOTS override"
+    if ctx.expected_distribution:
+        from .._stats import CONFIDENCE, outcome_classes, required_shots
+
+        need = required_shots(outcome_classes(ctx.expected_distribution), float(ctx.expected_tolerance), CONFIDENCE)
+        shots = min(max(DEFAULT_SHOTS, need), MAX_SHOTS)
+        return shots, (f"sized for tolerance {ctx.expected_tolerance} at {CONFIDENCE:.0%} confidence "
+                       f"({need} required{'; capped' if need > MAX_SHOTS else ''})")
+    return DEFAULT_SHOTS, "default"
+
+
+def run(ctx: Context) -> ActionResult:
+    from .. import _collect as C
+
+    shots, shots_policy = shots_for(ctx)
+    runtime_result = C._run_backend(ctx.qiskit_circuit, ctx.backend_choice, shots=shots,
+                                    dynamic=bool(ctx.circuit_info.get("dynamic")))
+    runtime_result["shots_policy"] = shots_policy
+    status = runtime_result.get("status", "completed")
+    calibration = runtime_result.pop("calibration", None)  # its own artifact (bind_backend)
+    job_id = runtime_result.get("job_id") or f"job-{ctx.release_id}-001"
+    session_id = runtime_result.get("session_id")
+    execution_mode = "sampler/session" if session_id else "sampler"
+    runtime_job = {
+        "runtime_job_id": job_id,
+        "job_status": status,
+        "shots": runtime_result["shots"],
+        "result_status": "success" if status == "completed" else status,
+        **({"reason": runtime_result["reason"]} if runtime_result.get("reason") else {}),
+        "execution_mode": execution_mode,
+        "backend": runtime_result["backend_name"],
+        "session_id": session_id,
+    }
+    q = ctx.quantum_dir
+    q.mkdir(parents=True, exist_ok=True)
+    # The job receipt carries the provenance claim — which job. Binding its
+    # digest is what lets QNT-04 affirm rather than report N-A.
+    runtime_job_sha = C._write_json(q / "runtime-job.json", runtime_job)
+    # The measured counts are what the result-fidelity score is computed from;
+    # binding their digest lets the gate re-derive that score (CRA-INTEG-01)
+    # and QBOM-BENCH-02 affirm rather than report N-A.
+    summary_sha = C._write_json(q / "result-summary.json", {"release_id": ctx.release_id, **runtime_result})
+    ctx.state.update(runtime_result=runtime_result, calibration=calibration, runtime_job=runtime_job,
+                     execution_mode=execution_mode, session_id=session_id, run_status=status)
+
+    props = [
+        {"name": "secqdevops:runtime-job-id", "value": runtime_job["runtime_job_id"]},
+        {"name": "secqdevops:runtime-job-ref", "value": "quantum/runtime-job.json"},
+        {"name": "secqdevops:runtime-job-sha256", "value": runtime_job_sha},
+        {"name": "secqdevops:runtime-job-status", "value": status},
+        {"name": "secqdevops:result-summary-ref", "value": "quantum/result-summary.json"},
+        {"name": "secqdevops:result-summary-sha256", "value": summary_sha},
+        {"name": "secqdevops:runtime-job-layer", "value": "service"},
+    ]
+    if session_id:
+        props.append({"name": "secqdevops:runtime-session-id", "value": str(session_id)})
+    if runtime_result.get("execution_target") == "hardware" and runtime_result.get("job_id"):
+        # the provider's own job id: what a hardware claim must carry (QNT-04)
+        props.append({"name": "secqdevops:provider-job-id", "value": str(runtime_result["job_id"])})
+    if status != "completed":
+        return ActionResult(ID, UNSUPPORTED, props, reason=runtime_result.get("reason") or f"run {status}")
+    return ActionResult(ID, PRODUCED, props)

quantbom/actions/inventory.py

@@ -0,0 +1,24 @@
+"""inventory — the quantum stack, the normalized IR and the standards anchors (feeds QNT-01).
+
+The framework's SBOM component itself comes from its adapter, placed by the
+SBOM builder (`_collect._build_sbom`).
+"""
+from __future__ import annotations
+
+from .base import PRODUCED, ActionResult, Context
+
+ID = "inventory"
+
+
+def run(ctx: Context) -> ActionResult:
+    props = [
+        {"name": "secqdevops:quantum-stack", "value": ctx.frontend_label},
+        {"name": "secqdevops:normalized-ir", "value": "qiskit.quantumcircuit"},
+        {"name": "secqdevops:source-format", "value": ctx.source_format},
+        # CEN/CLC TR 18202 layer model + standards anchors (RECOMMENDED, forward-compatible)
+        {"name": "secqdevops:layer-model-ref", "value": "CEN/CLC/TR 18202:2025"},
+        {"name": "secqdevops:vocabulary-ref", "value": "ISO/IEC 4879:2024"},
+        {"name": "secqdevops:cyclonedx-edition", "value": "ECMA-424:2025"},  # 2nd ed. = CycloneDX 1.7
+        {"name": "secqdevops:qbom-profile-version", "value": "0.3.0"},
+    ]
+    return ActionResult(ID, PRODUCED, props)