Score fresh quantum circuit and larger/nonlocal holdouts using independently frozen isolated executor

v2_execution/quantum_sandbox_v2.py

@@ -0,0 +1,317 @@
+"""V2 restricted quantum executor; v1 remains frozen in quantum_sandbox.py.
+
+AST screening is combined with nobody UID, cleared environment, process/resource
+limits and seccomp denial of filesystem opens, networking and process execution.
+Libraries are imported/warmed in the parent before any untrusted code runs.
+"""
+
+import ast
+import contextlib
+import ctypes
+import ctypes.util
+import errno
+import importlib
+import io
+import multiprocessing as mp
+import os
+import resource
+
+for variable in ["OPENBLAS_NUM_THREADS", "OMP_NUM_THREADS", "MKL_NUM_THREADS"]:
+    os.environ[variable] = "1"
+
+import numpy as np
+
+MODULES = {
+    "numpy",
+    "numpy.linalg",
+    "math",
+    "cmath",
+    "qiskit",
+    "qiskit.quantum_info",
+    "pennylane",
+    "cirq",
+}
+ATTRIBUTES = set(
+    "array asarray zeros ones eye pi sqrt exp sin cos conj conjugate transpose reshape flatten ravel squeeze astype complex64 complex128 float32 float64 norm kron real imag T shape size data QuantumCircuit Statevector from_instruction h x y z ry rx rz cx cz swap s sdg t tdg sx barrier append device qnode state RY RX RZ Rot PhaseShift Identity PauliX PauliY PauliZ Hadamard CNOT CZ SWAP LineQubit range Circuit Simulator simulate final_state_vector H X Y Z CXPowGate ZPowGate XPowGate HPowGate controlled on inverse quantum_info".split()
+)
+# Documented Cirq gate aliases, independent of any v2 model outputs. They were
+# absent from v1's conservative supported API. No isolation rule is relaxed.
+ATTRIBUTES.update({"CX", "Rx", "Ry", "Rz"})
+BUILTINS = {
+    "range": lambda *a: bounded_range(*a),
+    "enumerate": enumerate,
+    "zip": zip,
+    "len": len,
+    "list": list,
+    "tuple": tuple,
+    "float": float,
+    "int": int,
+    "complex": complex,
+    "print": print,
+    "abs": abs,
+    "sum": sum,
+    "min": min,
+    "max": max,
+    "reversed": reversed,
+}
+FORBIDDEN = (
+    ast.ClassDef,
+    ast.AsyncFunctionDef,
+    ast.Await,
+    ast.While,
+    ast.Try,
+    ast.With,
+    ast.AsyncWith,
+    ast.Raise,
+    ast.Delete,
+    ast.Global,
+    ast.Nonlocal,
+    ast.Lambda,
+    ast.Yield,
+    ast.YieldFrom,
+    ast.Match,
+)
+LIB = None
+
+
+def bounded_range(*args):
+    value = range(*args)
+    if len(value) > 1024:
+        raise ValueError("range limit")
+    return value
+
+
+def screen(program):
+    if len(program) > 25000:
+        raise ValueError("program length limit")
+    tree = ast.parse(program)
+    if sum(1 for _ in ast.walk(tree)) > 6000:
+        raise ValueError("AST node limit")
+    for node in ast.walk(tree):
+        if isinstance(node, FORBIDDEN):
+            raise ValueError("unsupported syntax: " + type(node).__name__)
+        if isinstance(node, ast.Name) and (
+            node.id.startswith("_")
+            or node.id
+            in {
+                "eval",
+                "exec",
+                "compile",
+                "open",
+                "getattr",
+                "setattr",
+                "globals",
+                "locals",
+                "vars",
+                "type",
+                "object",
+                "input",
+                "help",
+                "breakpoint",
+            }
+        ):
+            raise ValueError("forbidden name")
+        if isinstance(node, ast.Attribute) and node.attr not in ATTRIBUTES:
+            raise ValueError("unsupported attribute: " + node.attr)
+        if isinstance(node, ast.Import):
+            if any(a.name not in MODULES or (a.asname or "").startswith("_") for a in node.names):
+                raise ValueError("unsupported import")
+        if isinstance(node, ast.ImportFrom):
+            if (
+                node.level
+                or node.module not in MODULES
+                or any(
+                    a.name not in ATTRIBUTES or (a.asname or "").startswith("_") for a in node.names
+                )
+            ):
+                raise ValueError("unsupported from import")
+        if isinstance(node, ast.FunctionDef) and node.name.startswith("_"):
+            raise ValueError("forbidden function name")
+    return tree
+
+
+def initialize():
+    global LIB
+    assert os.name == "posix" and os.getuid() == 0, "Linux root parent required for UID isolation"
+    # Resolve/load seccomp before restricting filesystem access.
+    library = ctypes.util.find_library("seccomp")
+    assert library, "libseccomp is required; never fall back to AST-only execution"
+    LIB = ctypes.CDLL(library, use_errno=True)
+    LIB.seccomp_init.argtypes = [ctypes.c_uint32]
+    LIB.seccomp_init.restype = ctypes.c_void_p
+    LIB.seccomp_syscall_resolve_name.argtypes = [ctypes.c_char_p]
+    LIB.seccomp_syscall_resolve_name.restype = ctypes.c_int
+    LIB.seccomp_rule_add.argtypes = [ctypes.c_void_p, ctypes.c_uint32, ctypes.c_int, ctypes.c_uint]
+    LIB.seccomp_load.argtypes = [ctypes.c_void_p]
+    LIB.seccomp_release.argtypes = [ctypes.c_void_p]
+    from qiskit import QuantumCircuit
+    from qiskit.quantum_info import Statevector
+    import pennylane as qml
+    import cirq
+
+    qc = QuantumCircuit(2)
+    qc.h(0)
+    qc.ry(0.3, 1)
+    qc.rz(0.17, 0)
+    qc.x(0)
+    qc.z(1)
+    qc.cx(0, 1)
+    Statevector.from_instruction(qc)
+    device = qml.device("default.qubit", wires=[1, 0])
+
+    @qml.qnode(device)
+    def warm():
+        qml.Hadamard(0)
+        qml.RY(0.3, wires=1)
+        qml.RZ(0.17, wires=0)
+        qml.PauliX(0)
+        qml.PauliZ(1)
+        qml.CNOT(wires=[0, 1])
+        return qml.state()
+
+    warm()
+    qubits = cirq.LineQubit.range(2)
+    cirq.Simulator(dtype=np.complex128).simulate(
+        cirq.Circuit(
+            cirq.H(qubits[0]),
+            cirq.ry(0.3)(qubits[1]),
+            cirq.rz(0.17)(qubits[0]),
+            cirq.X(qubits[0]),
+            cirq.Z(qubits[1]),
+            cirq.CNOT(*qubits),
+        ),
+        qubit_order=list(reversed(qubits)),
+    )
+    # Warm Python import machinery and serialization before fork/lockdown.
+    for module in MODULES:
+        importlib.import_module(module)
+    importlib.import_module("socket")
+    return dict(
+        qiskit=importlib.import_module("qiskit").__version__,
+        pennylane=qml.__version__,
+        cirq=cirq.__version__,
+    )
+
+
+def lockdown():
+    os.environ.clear()
+    os.setgroups([])
+    os.setgid(65534)
+    os.setuid(65534)
+    resource.setrlimit(resource.RLIMIT_CPU, (15, 15))
+    # Native numeric runtimes reserve large virtual address spaces. Physical
+    # memory remains bounded by the HF CPU job container's memory allocation.
+    resource.setrlimit(resource.RLIMIT_AS, (16 * 1024**3, 16 * 1024**3))
+    resource.setrlimit(resource.RLIMIT_FSIZE, (0, 0))
+    resource.setrlimit(resource.RLIMIT_CORE, (0, 0))
+    resource.setrlimit(resource.RLIMIT_NPROC, (32, 32))
+    libc = ctypes.CDLL(None, use_errno=True)
+    assert libc.prctl(38, 1, 0, 0, 0) == 0, "PR_SET_NO_NEW_PRIVS failed"
+    policy = LIB.seccomp_init(0x7FFF0000)  # SCMP_ACT_ALLOW
+    assert policy
+    deny = 0x00050000 | errno.EPERM  # SCMP_ACT_ERRNO(EPERM)
+    for name in [
+        "open",
+        "openat",
+        "openat2",
+        "creat",
+        "socket",
+        "socketpair",
+        "connect",
+        "accept",
+        "accept4",
+        "bind",
+        "listen",
+        "sendto",
+        "sendmsg",
+        "execve",
+        "execveat",
+        "ptrace",
+        "process_vm_readv",
+        "process_vm_writev",
+        "mount",
+        "umount2",
+        "bpf",
+        "userfaultfd",
+    ]:
+        syscall = LIB.seccomp_syscall_resolve_name(name.encode())
+        if syscall >= 0:
+            assert LIB.seccomp_rule_add(policy, deny, syscall, 0) == 0, name
+    assert LIB.seccomp_load(policy) == 0, "seccomp load failed"
+    LIB.seccomp_release(policy)
+
+
+def safe_import(name, globals=None, locals=None, fromlist=(), level=0):
+    if name not in MODULES or level:
+        raise ImportError("module not allowed")
+    module = importlib.import_module(name)
+    return module if fromlist else importlib.import_module(name.split(".")[0])
+
+
+def worker(program, qubits, connection, mode):
+    try:
+        lockdown()
+        if mode == "isolation_check":
+            import socket
+
+            file_blocked = network_blocked = False
+            try:
+                open("/etc/hostname").read()
+            except PermissionError:
+                file_blocked = True
+            try:
+                socket.socket()
+            except PermissionError:
+                network_blocked = True
+            connection.send(
+                dict(
+                    file_opens_blocked=file_blocked,
+                    network_blocked=network_blocked,
+                    uid=os.getuid(),
+                    environment_empty=not os.environ,
+                )
+            )
+            return
+        tree = screen(program)
+        safe = dict(BUILTINS, __import__=safe_import)
+        namespace = {"__builtins__": safe}
+        with contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(io.StringIO()):
+            exec(compile(tree, "<restricted-quantum>", "exec"), namespace, namespace)
+        value = np.asarray(namespace["state"], dtype=np.complex128).reshape(-1)
+        assert value.shape == (2**qubits,) and np.isfinite(value).all()
+        connection.send(
+            dict(
+                status="executed",
+                real=value.real.tolist(),
+                imag=value.imag.tolist(),
+                norm=float(np.linalg.norm(value)),
+            )
+        )
+    except BaseException as error:
+        connection.send(
+            dict(status="rejected_or_error", error=type(error).__name__, detail=str(error)[:300])
+        )
+    finally:
+        connection.close()
+
+
+def run(program, qubits, mode="program"):
+    assert 1 <= qubits <= 8
+    ctx = mp.get_context("fork")
+    receive, send = ctx.Pipe(duplex=False)
+    process = ctx.Process(target=worker, args=(program, qubits, send, mode))
+    process.start()
+    send.close()
+    if receive.poll(20):
+        try:
+            result = receive.recv()
+        except EOFError:
+            result = dict(status="worker_exit", exitcode=process.exitcode)
+    else:
+        result = dict(status="timeout")
+    process.join(1)
+    if process.is_alive():
+        process.kill()
+        process.join(2)
+    receive.close()
+    return result

v2_execution/train_quantum_v2_execute_pilot.py

@@ -0,0 +1,119 @@
+"""Score fresh quantum generations with the independently frozen v2 executor."""
+
+import ast
+import hashlib
+import json
+import re
+from collections import defaultdict
+from pathlib import Path
+
+import numpy as np
+from huggingface_hub import HfApi, hf_hub_download
+import quantum_sandbox_v2 as sandbox
+
+REPO = "itsalissonsilva/QuantumCoder-9B"
+
+
+def main():
+    api = HfApi()
+    revision = api.model_info(REPO).sha
+    assert api.model_info(REPO).private
+
+    def get(path, rev=revision):
+        return Path(hf_hub_download(REPO, path, revision=rev))
+
+    preflight = json.loads(get("v2_executor_preflight/preflight.json").read_text())
+    source_hash = hashlib.sha256(Path(sandbox.__file__).read_bytes()).hexdigest()
+    assert preflight["all_passed"] and len(preflight["reference_checks"]) == 1368
+    assert source_hash == preflight["executor_sha256"]
+    assert source_hash == hashlib.sha256(get("v2_executor_preflight/quantum_sandbox_v2.py").read_bytes()).hexdigest()
+    # No model output is opened until reference and immutable-executor checks pass.
+    generations = json.loads(get("curriculum_v2_run/generation_report.json").read_text())
+    assert set(generations["conditions"]) == {"base", "adapted"}, "Training/generation incomplete"
+    data_file = get("curriculum_v2/rows.json", generations["data_revision"])
+    assert hashlib.sha256(data_file.read_bytes()).hexdigest() == preflight["manifest"]["rows_sha256"]
+    data = {r["id"]: r for r in json.loads(data_file.read_text()) if r["split"] != "train"}
+    assert len(data) == 720
+    expected = set(data)
+    versions = sandbox.initialize()
+    isolation = sandbox.run("", 1, mode="isolation_check")
+    assert isolation == preflight["isolation"] and versions == preflight["versions"]
+    records = []
+    for condition in ["base", "adapted"]:
+        outputs = generations["conditions"][condition]
+        assert len(outputs) == len(expected) and {r["id"] for r in outputs} == expected
+        for output in outputs:
+            row = data[output["id"]]
+            assert all(row[k] == output[k] for k in ["group_id", "split", "framework", "qubits"])
+            program = output["program"]
+            wrapped = re.fullmatch(r"\s*```(?:python)?\s*\n(.*?)\n```\s*", program, flags=re.S)
+            clean = wrapped.group(1) if wrapped else program
+            syntax = True
+            imports = set()
+            try:
+                tree = ast.parse(clean)
+                for node in ast.walk(tree):
+                    if isinstance(node, ast.Import):
+                        imports.update(a.name.split(".")[0] for a in node.names)
+                    elif isinstance(node, ast.ImportFrom):
+                        imports.add((node.module or "").split(".")[0])
+            except SyntaxError:
+                syntax = False
+            outcome = sandbox.run(clean, row["qubits"])
+            fidelity = None
+            correct = False
+            if outcome.get("status") == "executed":
+                actual = np.array(outcome["real"])+1j*np.array(outcome["imag"])
+                target = np.array(row["state_real"])+1j*np.array(row["state_imag"])
+                fidelity = float(abs(np.vdot(target, actual))**2)
+                correct = abs(outcome["norm"]-1)<1e-6 and fidelity>1-1e-6
+            requested = row["framework"] in imports
+            records.append(dict(condition=condition, id=row["id"], group_id=row["group_id"], split=row["split"], framework=row["framework"],
+                                passed=bool(correct and requested), state_pass=bool(correct), fidelity=fidelity,
+                                syntax_parses=syntax, requested_framework_import=requested,
+                                single_fence_unwrapped=wrapped is not None, generated_tokens=output["generated_tokens"],
+                                at_token_cap=output["at_token_cap"], eos_observed=output["eos_observed"],
+                                execution={k:v for k,v in outcome.items() if k not in ["real","imag"]},
+                                program_sha256=hashlib.sha256(program.encode()).hexdigest()))
+            if len(records)%100==0:
+                print(json.dumps(dict(stage="scoring", n=len(records), condition=condition)), flush=True)
+    summary = {}
+    for condition in ["base", "adapted"]:
+        summary[condition] = {}
+        for split in ["validation", "test_iid", "test_stress"]:
+            for framework in ["all", "qiskit", "pennylane", "cirq"]:
+                chosen = [r for r in records if r["condition"]==condition and r["split"]==split and (framework=="all" or r["framework"]==framework)]
+                summary[condition][split+"/"+framework] = dict(n=len(chosen), passed=sum(r["passed"] for r in chosen),
+                    pass_at_1=float(np.mean([r["passed"] for r in chosen])), state_correct=sum(r["state_pass"] for r in chosen),
+                    executed=sum(r["execution"].get("status")=="executed" for r in chosen), syntax_valid=sum(r["syntax_parses"] for r in chosen),
+                    token_cap=sum(r["at_token_cap"] for r in chosen))
+    paired = {}
+    for split in ["test_iid", "test_stress"]:
+        base = {r["id"]:r for r in records if r["condition"]=="base" and r["split"]==split}
+        adapted = {r["id"]:r for r in records if r["condition"]=="adapted" and r["split"]==split}
+        grouped = defaultdict(list)
+        for identifier in sorted(base):
+            grouped[base[identifier]["group_id"]].append(int(adapted[identifier]["passed"])-int(base[identifier]["passed"]))
+        delta = np.array(list(grouped.values()))
+        assert delta.shape == (96,3)
+        rng = np.random.default_rng(20261101)
+        boot = delta[rng.integers(0,len(delta),size=(5000,len(delta)))].mean(axis=(1,2))
+        paired[split] = dict(groups=len(delta), improved=int((delta==1).sum()), regressed=int((delta==-1).sum()),
+                             pass_delta=float(delta.mean()), group_bootstrap_95=np.quantile(boot,[.025,.975]).tolist())
+    report = dict(source_revision=revision, data_revision=generations["data_revision"], executor_sha256=source_hash,
+                  versions=versions,isolation=isolation,summary=summary,paired=paired,records=records,
+                  deterministic_renderer_reference_pass_at_1=1.0,
+                  release_gate_pass=all(p["group_bootstrap_95"][0]>0 for p in paired.values()),
+                  limitations="One seed, synthetic structured circuit-to-program translation. A deterministic renderer already solves this task perfectly. State fidelity from zero input is not full unitary/process equivalence or novel algorithm discovery. Import presence is a framework-compliance proxy, not data-flow proof. Supported-Python executor may reject other valid implementations. No repair/retry/target-informed edits; only one full-output code fence may be removed. Fresh v2 circuit groups are disjoint from the original failed held-out-Cirq study; v2 explicitly trains all frameworks. V1 failure remains separately reported.")
+    folder = Path("v2_execution")
+    folder.mkdir(exist_ok=True)
+    (folder/"execution.json").write_text(json.dumps(report,indent=2))
+    (folder/"train_quantum_v2_execute_pilot.py").write_bytes(Path(__file__).read_bytes())
+    (folder/"quantum_sandbox_v2.py").write_bytes(Path(sandbox.__file__).read_bytes())
+    commit = api.upload_folder(repo_id=REPO, folder_path=str(folder), path_in_repo="v2_execution",
+                              commit_message="Score fresh quantum circuit and larger/nonlocal holdouts using independently frozen isolated executor")
+    print(json.dumps(dict(revision=commit.oid,summary=summary,paired=paired,gate=report["release_gate_pass"])),flush=True)
+
+
+if __name__ == "__main__":
+    main()