How the verdict is produced.

The claim "this circuit is classically tractable" is only worth the method that backs it. Atlas does not predict simulability from features — it measures it, four independent ways, and certifies the case only when independent methods agree. That is how "you don't need the QPU" becomes a constructive, checkable result instead of a guess. Here is the full mechanism, including where it abstains.

1 Four independent estimators

Each estimator measures the same circuit from a different mathematical space. Independence is the point: agreement among methods built on different mathematics is corroboration a single tool cannot fake.

These are open SoTA engines (Stim, quimb, cotengra) plus a measured operator-spread signal. Atlas's contribution is not the engines — it is the layer that runs them as independent witnesses and adjudicates the result. Reproduce: route_adjudicator.py.

Why this order. The estimators run cheapest-first — Clifford/#T pre-check, then MPS bond, then treewidth — and that order is measured, not assumed: on the 800-circuit certified corpus the pre-check alone buys 0.1344 of the 0.4141 bits of route-entropy for a median 0.01 ms, and the pre-check buys orders of magnitude more bits per millisecond than either later step. The full chain leaves 0.0809 bits unresolved, which is exactly where the certificate abstains (NULL / SPLIT) instead of spending more compute for no information — kinetic proofreading, with compute as the dissipation. Curve, costs and caveats: Benchmark §7b.

2 The Certificate — agreement as convergent validity

When ≥2 independent folds agree "cheap", that is corroboration, not a single prediction. Atlas turns that agreement into a hash-stamped certificate with five levels. Hash-stamped, not signed: the certificate carries a SHA-256 content digest of the circuit, which identifies the input and lets anyone re-derive the verdict — it is not a cryptographic signature and proves nothing about who issued it (the certificate says so itself, in attestation.signed: false). A real signature over the whole payload is on the roadmap.

What the oracle certifies (definition C, 2026-09-05). The benchmark oracle and the routing adjudicator share one declared definition: the task is sampling the output to ε = 10⁻², every certificate is a named algorithm with a source (Stim; exact MPS; exact treewidth; statevector within memory and runtime; stabilizer rank priced per Qassim–Pashayan–Gosset 2021 and Bravyi–Gosset 2016; the contraction path cotengra found, as a constructive witness), and every operation count is banded with the same declared budgets. Agreement is published as three numbers — independent certificates, constructive ones, and rows with no certificate within budget — with a robustness table over the alternative definitions (Benchmark §2).

Each certificate also carries a proofreading block: which step of the three-estimator chain the run reached, which steps were skipped by design (Clifford, matchgate) or abstained at their wall-clock guard, and — for NULL/SPLIT — a reading of the abstention as the optimal stop against the corpus curve. The bits it quotes are corpus-level, never a per-circuit quantity.

Each certificate carries a SHA-256 content hash of the circuit, the per-fold signers (axis · cost · vote), the level, and the engine's actual route — an archivable, citable audit artifact, not a black-box verdict. Soundness battery: as the compute budget tightens, the level degrades STRONG → SPLIT → WEAK exactly as the independent folds begin to disagree, and 0 false-STRONG is ever issued on a hard verdict.

Reproduce: physics_magnitude_lab.certificate.certificate(n, circuit, budget_log2=30) → level + signers + hash. Soundness: deploy/gate_certificate_coherence.py → certificate_validation.json. Full discussion: Evidence §10.

3 The Convergence Map — disagreement made observable

The same call that certifies agreement also names which fold dissents, and in which direction. A SPLIT is not noise — it is the classically-intractable frontier (Leone-region) becoming visible.

When the treewidth axis and the MPS-bond axis disagree, that divergence is not a failure of the tool — it is a measurement of where the cheap structural proxies and the entanglement proxy stop agreeing about the same circuit. Atlas surfaces that divergence as a map rather than hiding it inside a single score. The disagreement tells a researcher exactly where the circuit sits on the simulability frontier, and which resource (magic, entanglement, topology, locality) is the one pushing it across. Two faces, one call: agreement certifies; disagreement maps the frontier.

The map, measured. On the 2,468 certified circuits each axis is binned by the adjudicator's own thresholds (CPU / TENSOR / HPC_FIRST / ESCALATE) — the raw exponents are not comparable, a bond exponent against a contraction exponent — and Δ = tier(treewidth) − tier(MPS) is read as a shape, never as an absolute number. 50.3% of circuits sit on the diagonal (the two axes agree), 63.7% within one tier, 36.3% split by two tiers or more. When they split it is almost always treewidth that is stricter (1,173 circuits against 54): the treewidth figure is a greedy upper bound that saturates on wide circuits, and the map names its worst case — moat_cycle2_n42_t0_s1 (n = 42), which treewidth places at ESCALATE while the MPS bond is 2⁰ and the oracle route is CPU. That divergence is exactly what the adjudicator's soundness rule is for: an over-estimate can never make a circuit false-cheap, and the cheapest exact route governs.

Source: benchmarks/convergence_map/generate_convergence_map.py; data Benchmark §7c · atlas_data/convergence_map.json. Witness independence is reported there as measured: rank correlation of the raw values (MPS↔treewidth ρ = 0.054 on 2,517, 0.502 on the 800 slice; magic↔MPS ρ = 0.504). A vote-level "effective folds" count is not identifiable on this corpus — magic and MPS dissent on 0% and 0% of circuits, treewidth on 32.4% — so the vote-level figure published earlier (July 2026) is retracted. Concordance with the noise-bound theory of Shao et al. (arXiv:2606.00474) remains roadmap.

3b The other axes — one question each, and never the route's

The route verdict answers exactly one question: is there an exact classical route inside a declared budget? Three more questions matter to a real decision, and each has a different epistemology. Atlas answers them on separate axes that never govern the route — their estimators are structurally barred from the set that may certify a cheap route, no layer that decides reads them, and the route verdict is byte-identical with and without them.

OBPPP — where the noise axis stops being an indicator

Shao, Wei, Cheng and Liu (arXiv:2306.05804, Phys. Rev. Lett. 133, 120603) give a polynomial classical method with bounded truncation error for a precise class — Clifford {H, S, CNOT} plus single-parameter Pauli rotations, under single-qubit Pauli noise — which is almost exactly the class Atlas's angle-faithful stream already represents. Their Proposition 2 gives a two-sided threshold on the minimum non-zero noise rate γ: polynomial when γ = Ω(1/log L), and exponential in L when γ = O(1/L).

Three things we do not let that sentence hide. The guarantee is probabilistic over the variational parameters, not worst-case over them; it is about the expectation value of an observable, not about the circuit's sampling route; and the paper states Ω and O without a constant, so where the boundary is drawn is our choice — Atlas publishes the constant it uses in the payload, and the band between the two thresholds is the width of that ignorance, not a result. The honest consequence: at device-realistic noise rates and moderate depth, the polynomial guarantee does not apply.

Same group, later paper: arXiv:2606.00474 (Shao, Zhao, Cheng, Liu, 2026) is already tracked above as roadmap. What was missing was the earlier result, which is the one that is implementable today.

The verdict is not a pure function of the circuit — and we measured which way it moves

Atlas's estimators run under per-estimator wall-clock budgets. Under machine load one of them can abstain on one call and complete on the next, so the same circuit can yield a different verdict. The mechanism was already disclosed per estimator; the fact was not.

What makes that variability safe is its direction, and direction is not something to assume: an estimator that abstains can only withdraw a cheap route, never add one. Measured across 4 circuits × 5 budgets, from 15s down to 0.05s: 0 verdicts got cheaper under pressure. That is verdict stability, and it is a permanent regression gate.

A blind spot we cannot close, stated rather than papered over

Atlas's matchgate witness is built on the Jordan–Wigner mapping. Making it basis-invariant closed the case of a compiled Gaussian circuit. It does not close, and cannot close, the family known as free fermions in disguise (arXiv:2509.22585): circuits whose Floquet operator is diagonalised by no Jordan–Wigner transformation at all, yet whose local observables are efficiently simulable. That is a provable blind spot of every structural recogniser built on JW, not an implementation gap of ours. It heads the certificate's untracked-paradigms list.

4 Five honesty principles

The architecture is constrained, by design, against the failure modes that make confidence scores dangerous — fail-closed guards plus a permanent regression battery where each is measured at zero. Design + zero observed, not a proof of impossibility.

1. No false-STRONG. A STRONG certificate on a hard circuit is the failure Atlas is built to never make — and the permanent regression battery measures it at 0 false-STRONG to date. That is a measured zero under fail-closed design, not a guarantee of impossibility.
2. Honest abstention = MEDIUM. Deciding exact stabilizer-polytope membership is provably super-exponential (Leone et al., arXiv:2602.22330). When the evidence splits, Atlas returns a calibrated MEDIUM — the theoretical ceiling speaking, not a bug. An exact classifier cannot exist, so feigning one would be the lie.
3. No black box — an Evidence Ledger. Every verdict ships with the per-estimator signers, costs, votes, and a content hash. The reasoning is re-derivable from named scripts and data; nothing is asserted that cannot be reproduced.
4. No lying translation. The plain-language layer never states more than the estimators measured. Natural-language summaries are constrained to the ledger — no constructive hallucination beyond what the numbers license.
5. No anonymity. Every certificate is attributable: the operator, the engine version and the content digest are on the record, so a number can always be traced back to the run that produced it — attributable by provenance, not by signature

5 Field context — the papers it builds on, cited honestly

Pre-flight simulability triage went from folklore to an active research topic in mid-2026. Atlas is the measured, multi-engine point in that space whose noise model is hardware-corroborated (TVD ≈ 0.06 on two shallow families, GHZ-4 and Clifford+T-5; the route verdict itself claims no QPU corroboration — Benchmark §4c) — complementary to the predict-from-features and pure-theory work. Precisely: the device noise model reproduces hardware behavior (TVD ≈ 0.03–0.10 on tested families); independent QPU routing corroboration was attempted and honestly abstained. We cite this work because honesty about the landscape is the point; Atlas is first as a running product, not first to ask the question.

Every citation above links to its arXiv primary source — don't take our word for the characterisation, click through and check it yourself. That is the review. Full landscape: Evidence §6.