Evidence & Audit Trail

Every claim Atlas makes, with its source. Measured, not asserted — a self-characterising instrument for quantum-compute triage: it routes a circuit to its cheapest correct compute tier, and it measures the limits of that judgment.

1 Scale — the ceiling is time, not qubit count

The practical ceiling is a function of three things: time budget × circuit entanglement × your hardware — not a fixed qubit count. Below: per-estimator wall-clock on a dev Apple M4 (30 s/case), for bounded-entanglement (area-law) circuits — 1D nearest-neighbour chains. Reproducible: benchmarks/scale_ceiling.py.

Read honestly (audited by an adversarial reviewer): only Clifford (Stim) scales generically — it's polynomial. The MPS and treewidth numbers hold for bounded-entanglement / structured circuits; for volume-law or 2D-dense circuits the bond saturates (≈2^(n/2)) and these n drop sharply. Above n=20 the MPS bond is a truncated lower bound (cap 64), not exact. We state the regime, not just the number. Source: benchmarks/scale_ceiling.md · scale_ceiling.json.

2 Validated on real quantum hardware

Atlas's core claim — "if it routes CPU, the classical distribution reproduces the hardware result within error" — is grounded in real QPU job submissions on public-access superconducting hardware (Heron r2 class, 156-qubit, open-instance), not simulation. Every row below is a real job submission whose job_id is recorded in qpu_jobs.json (result JSONs ship with the validation dataset) — one device (ibm_kingston), per the scope we declare.

Result: TVD(ideal, QPU) ≈ 0.059 / 0.055 for the validated families (GHZ-4, Clifford+T-5); mirror-RB per-layer error rate (r_per_layer) 6.7 %–11.2 %, readout-corrected. Full data, formulas & all job-ids: benchmarks/QPU_RESULTS.md · qpu_jobs.json · qpu_mirror_results.json.

Scope (honest): validated on specific circuit families, one device (ibm_kingston, Heron r2), specific dates (2026-06-22/24). Real data, narrow scope — growing. Every job-id above resolves in qpu_jobs.json.

3 The certified benchmark — 2,517 circuits, certified how

"2,517 certified" answers the only question that matters: certified against an exact classical oracle, on a corpus that is fully specified, hash-pinned and regenerable — and on which Atlas was never fitted (pure held-out evaluation, no train split).

Honest boundary (the hard question): the genuinely quantum-hard regime (no classical oracle) has no ground truth by construction — false-security there is unmeasurable, not zero. The honest denominator is the cases where false-safety is even possible — the 25 circuits the oracle routes to the hardest classical tier (HPC); there false-safety is 1/25 ≈ 4% — but the 25 rows collapse to 9 independent generator cells (seed replicates are near-duplicates, n_eff≈12), so the honest cluster-corrected 95% CI is [0.4%, 29.9%] (the row-iid Wilson [0.7%, 19.5%] was optimistic — cluster audit 2026-07, benchmarks/ci_cluster_audit/). Wide, and we say so. Atlas claims neither classical impossibility nor quantum advantage. Download: benchmark_manifest.json · scaled_results.csv (+ext, moat) · benchmarks/oracle.py. Per-slice manifests, each pinning its slice CSV by sha256: core-800 (served live) · ext-90 · moat-1627 · aggregate-2517.

External validation (circuits others assumed hard): beyond this self-generated corpus, Atlas was run on 115 published / advantage circuits — the QASMBench suite + MQT-Bench algorithm circuits + canonical advantage circuits (Sycamore RCS, the IBM 127-qubit kicked-Ising). Result: 108 routed to a classical tier · 7 escalated · 0 timed out, with Atlas correctly escalating the genuine advantage frontier (Sycamore RCS, the hard kicked-Ising point, and large/entangled circuits like QV_n100 / qft_n160) rather than rubber-stamping it. Per-circuit over named suites — no generalizable percentage. Full write-up: Benchmark §6. Public data + QASM: benchmarks/external_corpus/.

4 Adversarially audited — 0 false-security

The classifier was attacked across multiple vectors — irrational rotations, T-identity camouflage (T⁸=I), maximal cross-topology entanglement, mid-circuit measurements, permutation-camouflage, MPS-truncation, depth-ignoring statevector — to make it route an expensive circuit as cheap (a "false-security" verdict, the dangerous failure).

0 false-security across all attack rounds. The adjudicator holds because it invalidates truncated-MPS lower bounds, uses an always-valid statevector certificate, and takes the cheapest valid route. A separate finding — a triage denial-of-service via a C-level hang in the contraction optimizer — was found and closed (topology-aware reach-2q guard → killable subprocess; degrades to an honest "compute-bound → HPC" verdict instead of hanging).

Source & permanent regression test: benchmarks/adversarial_attack.py · adversarial_findings.json. CPython refs for the DoS fix: bugs.python.org/issue27422, cpython#96971.

5 Calibrated confidence — "88" against what, exactly

The raw confidence score is a heuristic 0–100 index. We recalibrated it into a true P(correct route) — fit on a selection half, measured on an untouched validation half — so the number means what it says.

The conformal certificate is the headline guarantee: at the selected threshold, held-out coverage 100% with self-consistency ≥ 98.67% under row-iid — ≥ 97.6% cluster-corrected (vs. exact same-formalism oracle; error bound ≤ 1.33% iid → ≤ 2.4% cluster-corrected at generator-cell level, design effect 5.1; ≤ 3.2% at family level) — a valid held-out bound, not an in-sample one. The α=5% conformal guarantee itself passes 100% of 2,000 cluster-aware re-splits; what the audit corrected is the variance arithmetic, not the framework (benchmarks/ci_cluster_audit/). All 11 errors in the corpus sit at raw confidence ≤ 34; above that, 0 / 2,517. We never display "100%" — the honest ceiling is the Wilson bound. The borderline zone (MPS bond ~2⁶–2¹⁰) and out-of-distribution circuits decline to "verify" rather than feign certainty. A two-layer noise model separates a measured local channel (real device data) from a clearly-labeled "toy global" heuristic.

Reproduce: engine/atlas_recalibrate.py (isotonic + Platt + reliability diagram) · atlas_conformal.py (split conformal) · route_adjudicator.py. Data: calibration_report.json · kingston_calibration.json.

Why "MEDIUM" is honesty, not a gap — and why we never claim certainty: deciding exact membership in the stabilizer polytope (zero effective magic — the resource behind classical hardness) is provably super-exponential, Ω(2^(n²)), under ETH (Leone, Eisert & Oliviero, arXiv:2602.22330, 2026). Note the scope: polytope membership is the magic-resource decision problem, not every notion of classical simulability (strong/weak, error-tolerant). An exact magic-resource classifier cannot exist at scale. A multi-estimator verdict with calibrated, sometimes-MEDIUM confidence is therefore not a workaround — it is the only epistemically honest architecture for an undecidable problem. When Atlas says MEDIUM, that is the theoretical ceiling speaking, not a bug.

6 Field context — the problem the field just named (mid-2026)

Pre-flight simulability triage went from folklore to an active research topic in May–June 2026. Atlas is the measured, multi-engine, hardware-corroborated point in that space — the device noise model reproduces hardware behavior (TVD ≈ 0.03–0.10 on tested families); independent QPU routing corroboration was attempted and honestly abstained — complementary to the predict-from-features and pure-theory work.

The field recognised the gap; the published approaches predict (ML) or theorise. Atlas is the multi-engine system that measures and validates on real hardware. We cite this work because honesty about the landscape is the point — Atlas is first as a running product, not first to ask the question.

Declared next — future work, not yet shipped (cited so the path is honest, not claimed as done): family-aware MPS auto-tuning (Leonteva et al. arXiv:2606.23262) to cut dense-case latency; a noise-induced simulability regime via operator-scrambling γ_c (Dowling et al. arXiv:2605.18943) as a third noise verdict; an SRE second-order magic estimator (Lipardi et al. arXiv:2509.16799) beyond raw T-count; a ZX rank-width contraction bound (Kuyanov & Kissinger arXiv:2603.06764) to tighten the treewidth↔MPS divergence. The field is converging from separate resource measures toward coupled ones (magic × entanglement × interference); Atlas sits on that frontier as the measured layer. Roadmap, not claims.

Structural estimators with sharp theoretical thresholds (declared roadmap): a QAOA degree threshold — 2-local + depth O(log n) is exactly classically samplable (Āboliņš & Ambainis arXiv:2605.22758); an entanglement-graph topology check — circle/planar graph states look hard yet are topology-simulable (Hahn et al. arXiv:2603.08847); and an input-data wavelet exponent α=½ area-law/volume-law cut for QML (Kam et al. arXiv:2605.11557). Plus an original contribution only this corpus enables — the meta-triage question: when does measuring the estimators cost more than just simulating? We hold triage-time and simulation-time for all 2,517 circuits. Roadmap, not claims.

7 Atlas as an instrument — the information it transports

A measuring instrument, not just a tool. We computed — in bits — how much information about the true simulation route Atlas's verdict actually carries, and how much each physical estimator carries alone versus combined. This is the Shannon view of triage, and to our knowledge the first such measurement — possible only because we hold the predictor, the ground-truth corpus, and the QPU validation together.

Two experiments, two denominators — reported separately (so the bound is never violated). The verdict-level MI is measured on the full n = 2,517 corpus; the single-estimator ablation exists only on the stratified n = 800 slice, whose richer route mix has a higher H(route). Absolute bits from the two are not comparable — placing 0.305 (slice) next to 0.245 (corpus) would appear to violate I ≤ H(route), which is exactly why they are split below. Both denominators are published in channel_capacity.json (verdict_level_n, estimator_ablation_n, H_route_800_bits).

The combined adjudicator demonstrably carries more information than any single estimator — the multi-estimator design earns its keep in bits, not rhetoric. Every value respects I ≤ H(route) within its own distribution; the two baselines live on different corpora and are never mixed. The residual is irreducible: deciding exact stabilizer-polytope membership (effective magic) is super-exponential (Leone et al.), so a perfect channel cannot exist — what Atlas reports is a measured lower bound on how much signal passes.

Reproduce: engine/atlas_channel_capacity.py (mutual information in bits, Miller–Madow corrected). Data: channel_capacity.json — carries both denominators (verdict_level_n=2517, estimator_ablation_n=800) and the slice entropy (H_route_800_bits=0.4689). The measured MI is a lower bound on channel capacity (capacity = sup over input distributions).

8 When to trust the instrument — its Applicability Domain

Third order. §7 measured how much signal the triage transports; this measures the validity boundary of the instrument itself — the Applicability Domain (a 20-year standard in QSAR/pharma cheminformatics, to our knowledge never applied to quantum-compute triage), the FalseVerify rate (the AlphaFold2 confidence pathology), and the split of remaining uncertainty into reducible vs. irreducible.

Two consequences. First, every Atlas error lives in the low-confidence, already-flagged region — the exact opposite of the AlphaFold2 pathology where a high score can be confidently wrong. Second, ~87% of the remaining uncertainty is aleatoric, not epistemic: Atlas is already near the data limit; what is left is the theoretical floor (deciding exactly is super-exponential, Leone et al. arXiv:2602.22330), not missing data. Separating these two sources of ignorance — reducible vs. irreducible — is standard in pharma/QSAR and, to our knowledge, has never been done for a quantum-simulability predictor.

Reproduce: engine/atlas_applicability_domain.py (leverage AD, FalseVerify, epistemic/aleatoric). Data: applicability_domain.json. FalseVerify measured on the certified region; in the genuinely quantum-hard regime it is unmeasurable by construction. Epistemic/aleatoric is an operational proxy (out-of-domain vs in-domain), not a fundamental decomposition.

9 The cost of knowing — a proofreading curve

Biology buys precision with dissipation, in steps (Hopfield–Ninio kinetic proofreading; Landauer; the Thermodynamic Uncertainty Relation). Atlas is the same, unnamed: each estimator is a proofreading step that costs compute and buys information about the true route. We measured the curve.

Information efficiency falls 732× after the cheap pre-check and keeps falling — a textbook diminishing-returns (proofreading) signature. Two consequences, now empirical rather than assumed: the cheapest estimator carries the most bits per second, so Atlas's early-exit ordering is the thermodynamically efficient one; and when the full chain still leaves residual route-uncertainty, paying more dissipation is wasted — MEDIUM is the optimal stopping point, not a failure. To our knowledge, the first thermodynamic-proofreading characterisation of a quantum-simulability triage.

Reproduce: engine/atlas_proofreading.py. Data: proofreading.json. Marginal gains are chain-rule conditional increments on the n=800 stratified slice — they sum to the joint 0.305 bits against that slice's H(route)=0.469 (see §7's two-denominator split). Information is exact (bits, Miller–Madow); cost is representative per-estimator wall-clock (threshold_calibration.json / scale_ceiling.json). Landauer/TUR are the lens — we quantify bits and compute-cost, not Joules.

10 Simulability Certificate — agreement as convergent validity

The engine routes over physically-independent folds (magic, complexity, locality, free-fermion, BGC) — each measuring the same circuit from a different mathematical space. Honesty note: the free-fermion (matchgate) fold is the newest — live since 2026-07 as a theorem route (Valiant 2001), internally validated (detection 12/12+16/16, sim 32/32 exact vs statevector) but pending independent external review (Jordan–Wigner / Majorana); every matchgate verdict carries this caveat in the API. The other folds are externally-grounded (Gottesman–Knill, standard tensor networks). When ≥2 independent folds agree "cheap", that is corroboration, not a single prediction. Honest measure of "independent": the folds are distinct mathematical axes, but their votes correlate — measured on the 800-circuit corpus (2026-07), treewidth↔MPS share an entanglement cluster (Spearman +0.61; magic ≈ independent), giving ≈2.3 effective independent witnesses of the 3 single-method folds (eigenvalue participation ratio). The overlap is published, not hidden. Atlas turns that agreement into a signed, hash-stamped certificate; and the disagreement into a frontier map. Two faces, one call.

Each certificate carries a SHA-256 content hash of the circuit, the per-fold signers (axis · cost · vote), the level, and the engine's actual route — an archivable, citable audit artifact, not a black-box verdict. Soundness battery (Clifford → STRONG; as the budget tightens the level degrades STRONG → SPLIT → WEAK exactly as the independent folds begin to disagree): 0 false-STRONG — no STRONG is ever issued on a hard verdict. The disagreement names which fold dissents and in which direction — that is the convergence map, from the same call.

Reproduce: physics_magnitude_lab.certificate.certificate(n, circuit, budget_log2=30) → STRONG/FIRM/WEAK/SPLIT/NULL + signers + hash. Soundness: scripts/certificate_validate.py → certificate_validation.json. Independence is the moat — agreement among methods built on different mathematics is corroboration a single tool cannot fake.

11 Cross-domain corroboration — the design is not ad-hoc

The same structure — stage cheap signals first, certify when independent witnesses agree, map the frontier when they split, and abstain honestly under irreducible uncertainty — appears independently across fields that never talk to each other. Each is an independent witness that this architecture is the right shape; their agreement is itself a STRONG certificate (convergent validity, one level up).

Honest where the bridge splits (we flag it, we don't sell it): the credit-rating mirror carries a warning — the 2008 "issuer-pays" failure means whoever submits a circuit must never pay for a favourable certificate; the rating stays independent of payment, or it is worth zero. And the ribosome mirror is STRONG on "staged fidelity" but not on "voting" — the ribosome proofreads in series, the certificate's folds vote in parallel. Naming where an analogy stops crossing is the same discipline as naming where an estimator dissents.