Release independently executed all-framework quantum adapter with stress failures, helper parity and original negative study preserved

LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Alibaba Cloud
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

NOTICE

@@ -0,0 +1 @@
+QuantumCoder-9B: modified Qwen3.5-9B with a newly trained low-rank adapter by itsalissonsilva. Base model and software are Apache2.0. Original synthetic curriculum is separately CC BY4.0; see curriculum_v2/LICENSE.md. No upstream base weights redistributed.

README.md

@@ -0,0 +1,70 @@
+---
+license: apache-2.0
+library_name: peft
+pipeline_tag: text-generation
+base_model: Qwen/Qwen3.5-9B
+tags:
+- quantum-computing
+- circuit-to-code
+- lora
+- synthetic-data
+---
+# QuantumCoder-9B
+
+A rank 16 Qwen3.5-9B adapter for translating fully specified synthetic quantum circuits into Qiskit, PennyLane or Cirq Python. The independently executed follow-up passes 288/288 held-out circuit/framework cases and 282/288 larger stress cases. The saved-weight helper reproduces all eight fixed validation generations exactly.
+
+**A deterministic renderer already solves this structured task perfectly.** This is learned circuit-to-program translation, including framework APIs and little-endian state conventions. It is not quantum algorithm discovery, general quantum programming, full unitary verification or a result on real quantum hardware.
+
+## Results
+
+One greedy sample, 768 generated-token cap, thinking disabled. Passing requires requested-framework import, supported-Python execution, unit norm and global-phase-invariant zero-input state fidelity greater than 1−1e−6.
+
+| Split | Circuit groups | Framework cases | Base passes | Adapter passes |
+|---|---:|---:|---:|---:|
+| Validation |48|144|16 (11.11%)|144 (100%)|
+| Held-out circuits/angles |96|288|36 (12.50%)|288 (100%)|
+| Larger/nonlocal/deeper stress |96|288|47 (16.32%)|282 (97.92%)|
+
+Each circuit appears in all three frameworks; these are not 288 independent circuits. Circuit-group bootstrap 95% intervals for adapter-minus-base Pass@1 are [83.33,91.32] percentage points on the held-out split and [77.78,85.42] on stress. Six stress failures remain included. Per-framework results and every scored program are under [v2_execution](v2_execution/).
+
+The executor is deliberately restricted and may reject other valid Python/API implementations. These percentages measure supported-program compliance plus state correctness, not unrestricted programming ability. The base executed 130/288 held-out programs and 114/288 stress programs; 36 and 47 respectively had correct states. The adapter executed all 288 in each split. Import presence is a compliance proxy, not a formal data-flow proof.
+
+## Data and training
+
+The fresh [curriculum](curriculum_v2/) has 456 circuit groups / 1,368 framework views: 216/648 training, 48/144 validation and 96/288 in each test split. Training contains all three frameworks. All 2,000 original-study circuit groups were excluded. Group IDs, rotation-angle sets and input hashes are disjoint across partitions; an independent audit finds no exact zero-input-state duplicates between training and matching-dimension holdouts at fidelity tolerance 1e−8. This does not establish full process-equivalence separation.
+
+Training uses 2–4 qubits, adjacent CNOTs and 6–13 gates. Stress uses 5–6 qubits, nonlocal CNOTs and 16–24 gates. Gates are H/X/Z/RY/RZ/CX. All 1,368 reference programs passed the pinned three-framework executor before model scoring. Data are original synthetic circuits with exact statevectors, not experimental measurements.
+
+Base [Qwen3.5-9B](https://huggingface.co/Qwen/Qwen3.5-9B), revision `c202236235762e1c871ad0ccb60c8ee5ba337b9a`. One fixed epoch from the base, 648 examples, rank 16/alpha 32 on q_proj/v_proj/in_proj_qkv, AdamW learning rate 2e−5, gradient accumulation 8, seed 20261101, max training sequence 2,048. No test checkpoint selection. Training code, original programs, model outputs and audits remain in this repository.
+
+## Inference
+
+Download this repository and install `requirements-inference.txt` in a CUDA environment with enough memory for 9B weights (the checked configuration used an A100). From the downloaded repository:
+
+```python
+from quantum import QuantumCoder
+coder = QuantumCoder()
+result = coder.generate([{
+    "framework": "cirq", "qubits": 2,
+    "operations": [["h", [0], 0.0], ["ry", [1], 0.31],
+                   ["rz", [0], 0.67], ["cx", [0, 1], 0.0],
+                   ["h", [1], 0.0], ["z", [0], 0.0]]
+}])[0]
+print(result["program"])
+```
+
+The helper returns fallible source text and never executes it. `operations` follows [gate,qubit_indices,angle_in_radians]; non-rotation angles are 0. The measured limits are 2–6 qubits and at most 24 gates. Prompts beyond 2,048 tokens are rejected rather than truncated. Generation matches the frozen greedy 768-token protocol in batches of eight.
+
+## Reproduce execution
+
+Use an isolated Linux environment with Python 3.11, `libseccomp2` and `requirements-evaluation.txt`. The parent must run as root so workers can drop to UID/GID 65534. From a full repository snapshot, run `python reproduce_execution.py`. It first verifies the frozen sandbox/data hashes, isolation and every selected reference, then re-scores all 1,440 base/adapted programs and checks the published counts. This public reproducer was run successfully before release. Do not substitute direct host execution for the provided runner.
+
+Workers clear their environment, deny filesystem opens/network/process execution, apply resource/time limits and screen a bounded Python subset. This is an evaluation harness for these programs, not a general arbitrary-code sandbox service. Original full scoring source and circuit-group bootstrap remain under[v2_execution](v2_execution/); helper parity is under[helper_verification](helper_verification/).
+
+## Original negative study
+
+The earlier [hf_pilot](hf_pilot/) trained on Qiskit/PennyLane and held out Cirq. Its adapter passed 0/128 Cirq cases versus 3/128 for the base under the original strict executor. Some valid Cirq aliases were unsupported there. The failure and original evaluator remain under [execution](execution/) and [executor_preflight](executor_preflight/). The new study uses fresh groups and explicitly trains all frameworks; it is not a zero-shot Cirq success and does not replace that negative result.
+
+## Licensing
+
+Adapter/base-derived weights and code: Apache 2.0; base attribution retained in LICENSE/NOTICE. Original synthetic data: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), attributed to itsalissonsilva. Quantum frameworks have their own upstream licenses and are not redistributed as part of the adapter.

adapter_config.json

@@ -0,0 +1,42 @@
+{
+  "alora_invocation_tokens": null,
+  "alpha_pattern": {},
+  "arrow_config": null,
+  "auto_mapping": null,
+  "base_model_name_or_path": "Qwen/Qwen3.5-9B",
+  "bias": "none",
+  "corda_config": null,
+  "ensure_weight_tying": false,
+  "eva_config": null,
+  "exclude_modules": null,
+  "fan_in_fan_out": false,
+  "inference_mode": true,
+  "init_lora_weights": true,
+  "layer_replication": null,
+  "layers_pattern": null,
+  "layers_to_transform": null,
+  "loftq_config": {},
+  "lora_alpha": 32,
+  "lora_bias": false,
+  "lora_dropout": 0.0,
+  "megatron_config": null,
+  "megatron_core": "megatron.core",
+  "modules_to_save": null,
+  "peft_type": "LORA",
+  "peft_version": "0.18.1",
+  "qalora_group_size": 16,
+  "r": 16,
+  "rank_pattern": {},
+  "revision": null,
+  "target_modules": [
+    "in_proj_qkv",
+    "q_proj",
+    "v_proj"
+  ],
+  "target_parameters": null,
+  "task_type": "CAUSAL_LM",
+  "trainable_token_indices": null,
+  "use_dora": false,
+  "use_qalora": false,
+  "use_rslora": false
+}

adapter_model.safetensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0261aa5f75e7966692383136ec7d5ac7fc9ab9caaeb94483ceba5bcbda932823
+size 27799552

prompt_parity.json

@@ -0,0 +1,5 @@
+{
+  "cases": 1368,
+  "exact_training_prompt_parity": true,
+  "helper_sha256": "c11b9a8d6f74fec142a4568b50614ff574f9e2f1211e6260a7ddc0a15dcb256d"
+}

quantum.py

@@ -0,0 +1,84 @@
+"""Generate bounded circuit-to-Python candidates. This module never executes them."""
+
+import json
+import math
+
+import torch
+from peft import PeftModel
+from transformers import AutoTokenizer,Qwen3_5ForConditionalGeneration
+
+BASE="Qwen/Qwen3.5-9B"
+BASE_REVISION="c202236235762e1c871ad0ccb60c8ee5ba337b9a"
+ADAPTER="itsalissonsilva/QuantumCoder-9B"
+
+
+def circuit_prompt(framework,qubits,operations):
+    if framework not in {"qiskit","pennylane","cirq"}:
+        raise ValueError("framework must be qiskit, pennylane or cirq")
+    if type(qubits) is not int or not 2<=qubits<=6:
+        raise ValueError("The measured scope is two through six qubits")
+    if not isinstance(operations,(list,tuple)) or not 1<=len(operations)<=24:
+        raise ValueError("Provide one through24 operations")
+    normalized=[]
+    for operation in operations:
+        if not isinstance(operation,(list,tuple)) or len(operation)!=3:
+            raise ValueError("Each operation must be [gate,qubit_indices,angle]")
+        gate,indices,angle=operation
+        if gate not in {"h","x","z","ry","rz","cx"}:
+            raise ValueError("Supported gates: h, x, z, ry, rz, cx")
+        if not isinstance(indices,(list,tuple)) or len(indices)!=(2 if gate=="cx" else 1):
+            raise ValueError("Gate arity mismatch")
+        if any(type(k) is not int or not 0<=k<qubits for k in indices) or len(set(indices))!=len(indices):
+            raise ValueError("Invalid/repeated qubit index")
+        if type(angle) not in (int,float) or not math.isfinite(angle):
+            raise ValueError("Angle must be a finite real number")
+        if gate not in {"ry","rz"} and angle!=0:
+            raise ValueError("Non-rotation gates require angle0")
+        normalized.append([gate,list(indices),float(angle)])
+    return [
+        dict(role="system",content="Return only Python source code using the requested quantum framework. No prose or markdown."),
+        dict(role="user",content=f"Write a {framework} program preparing this circuit from zero on {qubits} qubits. Operations [gate,qubits,angle]: {json.dumps(normalized)}. Angles are radians. Store the final statevector in a variable named state. Use little-endian qubit order."),
+    ]
+
+
+class QuantumCoder:
+    def __init__(self,adapter=ADAPTER,revision=None,subfolder=None):
+        if not torch.cuda.is_available():
+            raise RuntimeError("This measured inference configuration requires a CUDA GPU with enough memory for9B weights")
+        self.tokenizer=AutoTokenizer.from_pretrained(BASE,revision=BASE_REVISION)
+        self.tokenizer.padding_side="left"
+        dtype=torch.bfloat16 if torch.cuda.is_bf16_supported() else torch.float16
+        base=Qwen3_5ForConditionalGeneration.from_pretrained(BASE,revision=BASE_REVISION,dtype=dtype,
+                device_map="cuda",attn_implementation="sdpa")
+        kwargs=dict(revision=revision)
+        if subfolder is not None:
+            kwargs["subfolder"]=subfolder
+        self.model=PeftModel.from_pretrained(base,adapter,**kwargs).eval()
+
+    @torch.no_grad()
+    def generate(self,circuits):
+        """Return program/token metadata for dictionaries with framework/qubits/operations.
+
+        Programs are fallible text, including possible unsupported APIs. For
+        measured execution use the separately provided isolated Linux evaluator.
+        """
+        prompts=[]
+        for circuit in circuits:
+            messages=circuit_prompt(circuit["framework"],circuit["qubits"],circuit["operations"])
+            text=self.tokenizer.apply_chat_template(messages,tokenize=False,add_generation_prompt=True,enable_thinking=False)
+            if len(self.tokenizer.encode(text))>2048:
+                raise ValueError("Prompt exceeds the measured2048-token bound; no truncation applied")
+            prompts.append(text)
+        results=[]
+        eos=self.model.generation_config.eos_token_id
+        eos=set(eos if isinstance(eos,list) else [eos])
+        for begin in range(0,len(prompts),8):
+            inputs=self.tokenizer(prompts[begin:begin+8],padding=True,return_tensors="pt").to("cuda")
+            generated=self.model.generate(**inputs,max_new_tokens=768,do_sample=False,
+                                           pad_token_id=self.tokenizer.pad_token_id)
+            for tokens in generated[:,inputs["input_ids"].shape[1]:]:
+                ids=tokens.tolist();stop=next((i for i,t in enumerate(ids) if t in eos),None)
+                used=ids if stop is None else ids[:stop+1]
+                results.append(dict(program=self.tokenizer.decode(used,skip_special_tokens=True),generated_tokens=len(used),
+                                    eos_observed=stop is not None,at_token_cap=stop is None and len(used)>=768))
+        return results

quantum_sandbox_v2.py

@@ -0,0 +1,317 @@
+"""V2 restricted quantum executor; v1 remains frozen in quantum_sandbox.py.
+
+AST screening is combined with nobody UID, cleared environment, process/resource
+limits and seccomp denial of filesystem opens, networking and process execution.
+Libraries are imported/warmed in the parent before any untrusted code runs.
+"""
+
+import ast
+import contextlib
+import ctypes
+import ctypes.util
+import errno
+import importlib
+import io
+import multiprocessing as mp
+import os
+import resource
+
+for variable in ["OPENBLAS_NUM_THREADS", "OMP_NUM_THREADS", "MKL_NUM_THREADS"]:
+    os.environ[variable] = "1"
+
+import numpy as np
+
+MODULES = {
+    "numpy",
+    "numpy.linalg",
+    "math",
+    "cmath",
+    "qiskit",
+    "qiskit.quantum_info",
+    "pennylane",
+    "cirq",
+}
+ATTRIBUTES = set(
+    "array asarray zeros ones eye pi sqrt exp sin cos conj conjugate transpose reshape flatten ravel squeeze astype complex64 complex128 float32 float64 norm kron real imag T shape size data QuantumCircuit Statevector from_instruction h x y z ry rx rz cx cz swap s sdg t tdg sx barrier append device qnode state RY RX RZ Rot PhaseShift Identity PauliX PauliY PauliZ Hadamard CNOT CZ SWAP LineQubit range Circuit Simulator simulate final_state_vector H X Y Z CXPowGate ZPowGate XPowGate HPowGate controlled on inverse quantum_info".split()
+)
+# Documented Cirq gate aliases, independent of any v2 model outputs. They were
+# absent from v1's conservative supported API. No isolation rule is relaxed.
+ATTRIBUTES.update({"CX", "Rx", "Ry", "Rz"})
+BUILTINS = {
+    "range": lambda *a: bounded_range(*a),
+    "enumerate": enumerate,
+    "zip": zip,
+    "len": len,
+    "list": list,
+    "tuple": tuple,
+    "float": float,
+    "int": int,
+    "complex": complex,
+    "print": print,
+    "abs": abs,
+    "sum": sum,
+    "min": min,
+    "max": max,
+    "reversed": reversed,
+}
+FORBIDDEN = (
+    ast.ClassDef,
+    ast.AsyncFunctionDef,
+    ast.Await,
+    ast.While,
+    ast.Try,
+    ast.With,
+    ast.AsyncWith,
+    ast.Raise,
+    ast.Delete,
+    ast.Global,
+    ast.Nonlocal,
+    ast.Lambda,
+    ast.Yield,
+    ast.YieldFrom,
+    ast.Match,
+)
+LIB = None
+
+
+def bounded_range(*args):
+    value = range(*args)
+    if len(value) > 1024:
+        raise ValueError("range limit")
+    return value
+
+
+def screen(program):
+    if len(program) > 25000:
+        raise ValueError("program length limit")
+    tree = ast.parse(program)
+    if sum(1 for _ in ast.walk(tree)) > 6000:
+        raise ValueError("AST node limit")
+    for node in ast.walk(tree):
+        if isinstance(node, FORBIDDEN):
+            raise ValueError("unsupported syntax: " + type(node).__name__)
+        if isinstance(node, ast.Name) and (
+            node.id.startswith("_")
+            or node.id
+            in {
+                "eval",
+                "exec",
+                "compile",
+                "open",
+                "getattr",
+                "setattr",
+                "globals",
+                "locals",
+                "vars",
+                "type",
+                "object",
+                "input",
+                "help",
+                "breakpoint",
+            }
+        ):
+            raise ValueError("forbidden name")
+        if isinstance(node, ast.Attribute) and node.attr not in ATTRIBUTES:
+            raise ValueError("unsupported attribute: " + node.attr)
+        if isinstance(node, ast.Import):
+            if any(a.name not in MODULES or (a.asname or "").startswith("_") for a in node.names):
+                raise ValueError("unsupported import")
+        if isinstance(node, ast.ImportFrom):
+            if (
+                node.level
+                or node.module not in MODULES
+                or any(
+                    a.name not in ATTRIBUTES or (a.asname or "").startswith("_") for a in node.names
+                )
+            ):
+                raise ValueError("unsupported from import")
+        if isinstance(node, ast.FunctionDef) and node.name.startswith("_"):
+            raise ValueError("forbidden function name")
+    return tree
+
+
+def initialize():
+    global LIB
+    assert os.name == "posix" and os.getuid() == 0, "Linux root parent required for UID isolation"
+    # Resolve/load seccomp before restricting filesystem access.
+    library = ctypes.util.find_library("seccomp")
+    assert library, "libseccomp is required; never fall back to AST-only execution"
+    LIB = ctypes.CDLL(library, use_errno=True)
+    LIB.seccomp_init.argtypes = [ctypes.c_uint32]
+    LIB.seccomp_init.restype = ctypes.c_void_p
+    LIB.seccomp_syscall_resolve_name.argtypes = [ctypes.c_char_p]
+    LIB.seccomp_syscall_resolve_name.restype = ctypes.c_int
+    LIB.seccomp_rule_add.argtypes = [ctypes.c_void_p, ctypes.c_uint32, ctypes.c_int, ctypes.c_uint]
+    LIB.seccomp_load.argtypes = [ctypes.c_void_p]
+    LIB.seccomp_release.argtypes = [ctypes.c_void_p]
+    from qiskit import QuantumCircuit
+    from qiskit.quantum_info import Statevector
+    import pennylane as qml
+    import cirq
+
+    qc = QuantumCircuit(2)
+    qc.h(0)
+    qc.ry(0.3, 1)
+    qc.rz(0.17, 0)
+    qc.x(0)
+    qc.z(1)
+    qc.cx(0, 1)
+    Statevector.from_instruction(qc)
+    device = qml.device("default.qubit", wires=[1, 0])
+
+    @qml.qnode(device)
+    def warm():
+        qml.Hadamard(0)
+        qml.RY(0.3, wires=1)
+        qml.RZ(0.17, wires=0)
+        qml.PauliX(0)
+        qml.PauliZ(1)
+        qml.CNOT(wires=[0, 1])
+        return qml.state()
+
+    warm()
+    qubits = cirq.LineQubit.range(2)
+    cirq.Simulator(dtype=np.complex128).simulate(
+        cirq.Circuit(
+            cirq.H(qubits[0]),
+            cirq.ry(0.3)(qubits[1]),
+            cirq.rz(0.17)(qubits[0]),
+            cirq.X(qubits[0]),
+            cirq.Z(qubits[1]),
+            cirq.CNOT(*qubits),
+        ),
+        qubit_order=list(reversed(qubits)),
+    )
+    # Warm Python import machinery and serialization before fork/lockdown.
+    for module in MODULES:
+        importlib.import_module(module)
+    importlib.import_module("socket")
+    return dict(
+        qiskit=importlib.import_module("qiskit").__version__,
+        pennylane=qml.__version__,
+        cirq=cirq.__version__,
+    )
+
+
+def lockdown():
+    os.environ.clear()
+    os.setgroups([])
+    os.setgid(65534)
+    os.setuid(65534)
+    resource.setrlimit(resource.RLIMIT_CPU, (15, 15))
+    # Native numeric runtimes reserve large virtual address spaces. Physical
+    # memory remains bounded by the HF CPU job container's memory allocation.
+    resource.setrlimit(resource.RLIMIT_AS, (16 * 1024**3, 16 * 1024**3))
+    resource.setrlimit(resource.RLIMIT_FSIZE, (0, 0))
+    resource.setrlimit(resource.RLIMIT_CORE, (0, 0))
+    resource.setrlimit(resource.RLIMIT_NPROC, (32, 32))
+    libc = ctypes.CDLL(None, use_errno=True)
+    assert libc.prctl(38, 1, 0, 0, 0) == 0, "PR_SET_NO_NEW_PRIVS failed"
+    policy = LIB.seccomp_init(0x7FFF0000)  # SCMP_ACT_ALLOW
+    assert policy
+    deny = 0x00050000 | errno.EPERM  # SCMP_ACT_ERRNO(EPERM)
+    for name in [
+        "open",
+        "openat",
+        "openat2",
+        "creat",
+        "socket",
+        "socketpair",
+        "connect",
+        "accept",
+        "accept4",
+        "bind",
+        "listen",
+        "sendto",
+        "sendmsg",
+        "execve",
+        "execveat",
+        "ptrace",
+        "process_vm_readv",
+        "process_vm_writev",
+        "mount",
+        "umount2",
+        "bpf",
+        "userfaultfd",
+    ]:
+        syscall = LIB.seccomp_syscall_resolve_name(name.encode())
+        if syscall >= 0:
+            assert LIB.seccomp_rule_add(policy, deny, syscall, 0) == 0, name
+    assert LIB.seccomp_load(policy) == 0, "seccomp load failed"
+    LIB.seccomp_release(policy)
+
+
+def safe_import(name, globals=None, locals=None, fromlist=(), level=0):
+    if name not in MODULES or level:
+        raise ImportError("module not allowed")
+    module = importlib.import_module(name)
+    return module if fromlist else importlib.import_module(name.split(".")[0])
+
+
+def worker(program, qubits, connection, mode):
+    try:
+        lockdown()
+        if mode == "isolation_check":
+            import socket
+
+            file_blocked = network_blocked = False
+            try:
+                open("/etc/hostname").read()
+            except PermissionError:
+                file_blocked = True
+            try:
+                socket.socket()
+            except PermissionError:
+                network_blocked = True
+            connection.send(
+                dict(
+                    file_opens_blocked=file_blocked,
+                    network_blocked=network_blocked,
+                    uid=os.getuid(),
+                    environment_empty=not os.environ,
+                )
+            )
+            return
+        tree = screen(program)
+        safe = dict(BUILTINS, __import__=safe_import)
+        namespace = {"__builtins__": safe}
+        with contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(io.StringIO()):
+            exec(compile(tree, "<restricted-quantum>", "exec"), namespace, namespace)
+        value = np.asarray(namespace["state"], dtype=np.complex128).reshape(-1)
+        assert value.shape == (2**qubits,) and np.isfinite(value).all()
+        connection.send(
+            dict(
+                status="executed",
+                real=value.real.tolist(),
+                imag=value.imag.tolist(),
+                norm=float(np.linalg.norm(value)),
+            )
+        )
+    except BaseException as error:
+        connection.send(
+            dict(status="rejected_or_error", error=type(error).__name__, detail=str(error)[:300])
+        )
+    finally:
+        connection.close()
+
+
+def run(program, qubits, mode="program"):
+    assert 1 <= qubits <= 8
+    ctx = mp.get_context("fork")
+    receive, send = ctx.Pipe(duplex=False)
+    process = ctx.Process(target=worker, args=(program, qubits, send, mode))
+    process.start()
+    send.close()
+    if receive.poll(20):
+        try:
+            result = receive.recv()
+        except EOFError:
+            result = dict(status="worker_exit", exitcode=process.exitcode)
+    else:
+        result = dict(status="timeout")
+    process.join(1)
+    if process.is_alive():
+        process.kill()
+        process.join(2)
+    receive.close()
+    return result

release_audit.json

@@ -0,0 +1,11 @@
+{
+  "circuit_groups": 456,
+  "framework_views": 1368,
+  "cross_split_group_overlap": 0,
+  "train_holdout_exact_state_matches": 0,
+  "max_train_holdout_state_fidelity": 0.9991002699676015,
+  "state_match_tolerance": 1e-08,
+  "independent_execution_gate": true,
+  "saved_helper_all_passed": true,
+  "scope": "Exact zero-input-state duplicate check across matching dimensions; does not assert full unitary/process or semantic equivalence separation."
+}

reproduce_execution.py

@@ -0,0 +1,69 @@
+"""Offline re-scoring of frozen programs; Linux/root/libseccomp are required.
+
+Never replace the sandbox with direct exec. All generated programs run only in
+its credential-cleared nobody workers with filesystem/network denial.
+"""
+import ast
+import hashlib
+import json
+import re
+from collections import defaultdict
+from pathlib import Path
+import numpy as np
+import quantum_sandbox_v2 as sandbox
+
+ROOT=Path(__file__).resolve().parent
+
+
+def score(program,row):
+    wrapped=re.fullmatch(r"\s*```(?:python)?\s*\n(.*?)\n```\s*",program,flags=re.S)
+    clean=wrapped.group(1) if wrapped else program
+    imports=set()
+    try:
+        for node in ast.walk(ast.parse(clean)):
+            if isinstance(node,ast.Import):imports.update(a.name.split(".")[0] for a in node.names)
+            elif isinstance(node,ast.ImportFrom):imports.add((node.module or "").split(".")[0])
+    except SyntaxError:
+        pass
+    result=sandbox.run(clean,row["qubits"])
+    passed=False
+    if result.get("status")=="executed":
+        actual=np.array(result["real"])+1j*np.array(result["imag"])
+        target=np.array(row["state_real"])+1j*np.array(row["state_imag"])
+        passed=abs(result["norm"]-1)<1e-6 and abs(np.vdot(target,actual))**2>1-1e-6 and row["framework"] in imports
+    return bool(passed)
+
+
+def main():
+    frozen=json.loads((ROOT/"v2_execution/execution.json").read_text())
+    preflight=json.loads((ROOT/"v2_executor_preflight/preflight.json").read_text())
+    assert preflight["all_passed"] and len(preflight["reference_checks"])==1368
+    assert hashlib.sha256(Path(sandbox.__file__).read_bytes()).hexdigest()==frozen["executor_sha256"]==preflight["executor_sha256"]
+    file=ROOT/"curriculum_v2/rows.json"
+    assert hashlib.sha256(file.read_bytes()).hexdigest()==preflight["manifest"]["rows_sha256"]
+    rows={r["id"]:r for r in json.loads(file.read_text()) if r["split"]!="train"}
+    assert len(rows)==720
+    versions=sandbox.initialize()
+    assert versions==frozen["versions"]
+    assert sandbox.run("",1,mode="isolation_check")==preflight["isolation"]
+    for row in rows.values():
+        assert score(row["program"],row),"Reference failed; stop before scoring generated programs"
+    outputs=json.loads((ROOT/"curriculum_v2_run/generation_report.json").read_text())["conditions"]
+    totals=defaultdict(lambda:dict(n=0,passed=0))
+    for condition in ["base","adapted"]:
+        assert len(outputs[condition])==720 and {r["id"] for r in outputs[condition]}==set(rows)
+        for output in outputs[condition]:
+            row=rows[output["id"]];passed=score(output["program"],row)
+            for framework in ["all",row["framework"]]:
+                key=condition+"/"+row["split"]+"/"+framework
+                totals[key]["n"]+=1;totals[key]["passed"]+=passed
+    for key,value in totals.items():
+        condition,split,framework=key.split("/")
+        original=frozen["summary"][condition][split+"/"+framework]
+        assert value==dict(n=original["n"],passed=original["passed"]),(key,value,original)
+    result=dict(versions=versions,all_counts_reproduced=True,summary=dict(totals))
+    (ROOT/"reproduced_counts.json").write_text(json.dumps(result,indent=2)+"\n")
+    print(json.dumps(result,indent=2))
+
+
+if __name__=="__main__":main()

requirements-evaluation.txt

@@ -0,0 +1,7 @@
+numpy==2.1.3
+qiskit==2.2.3
+pennylane==0.43.1
+cirq-core==1.6.1
+scipy==1.15.3
+gast==0.6.0
+astunparse==1.6.3

requirements-inference.txt

@@ -0,0 +1,8 @@
+torch==2.10.0
+torchvision==0.25.0
+torchaudio==2.10.0
+transformers==5.5.4
+peft==0.18.1
+accelerate==1.12.0
+huggingface_hub==1.33.0
+safetensors==0.5.3