Build QSec foundation, trust mesh, and cross-code quantum core

[Inserian]

QSec 0.1 foundation

The first commit establishes the physical validation, circuit identity, calibration, entropy, cryptographic inventory, evidence-ledger, threat-taxonomy, CLI, documentation, test, and benchmark foundation.

QSec 0.2 trust mesh

The second commit adds authenticated artifacts, pulse-schedule verification, stabilizer evidence checks, governed capability leases, thermal consistency checks, deterministic incident reconstruction, and the 17-case trust-mesh acceptance matrix.

QSec 0.3 cross-code quantum core

The third commit prevents one implementation from approving its own quantum result.

It adds:

• the strict QSEC-QH/1 request protocol and QSEC-QW/1 witness protocol;
• isolated Python and independent C++17 quantum workers;
• randomized worker order and unanimous fail-closed comparison;
• phase-sensitive state commitments without exposing statevectors;
• durable SQLite WAL nonce replay protection;
• an optional isolated QSA worker that receives no QSec policy authority, route information, replay database, or other worker result;
• a rewritten README, detailed quantum-core documentation, working example, CLI commands, tests, controlled scenarios, and benchmarks.

The protocol accepts bounded values only. It does not accept executable objects, callbacks, shared-memory objects, shell commands, plugins, or reusable internal handles.

Final validation

Final commit: 23792d1916ab2aea253a47620c82988ce7555308

The branch contains exactly three intentional commits. Temporary publication files and workflows are absent.

GitHub Actions run 30723744904 passed on Python 3.10, 3.11, and 3.12. Every lane completed native compilation, source compilation, all 103 tests, all three benchmark families, and artifact upload.

The controlled quantum matrix produced seven true positives, three true negatives, zero false positives, and zero false negatives on every runner. The existing trust-mesh matrix remained at 12 true positives, five true negatives, zero false positives, and zero false negatives.

These are deterministic acceptance matrices, not production detection-rate estimates.

Cross-code quantum throughput

• independent native C++ worker: 744–781 operations/second;
• isolated Python worker: 21.3–27.1 operations/second;
• unanimous two-worker mesh: 20.5–26.0 operations/second.

Trust-mesh throughput

• attestation verification: 18,905–24,690 operations/second;
• pulse verification: 6,565–8,493 operations/second;
• QEC verification: 14,984–18,630 operations/second;
• governed action authorization: 7,328–8,676 operations/second;
• thermal verification: 156,142–195,100 operations/second.

Boundaries

Cross-code agreement prevents one worker from approving itself, but independent implementations can still share a conceptual defect. Process isolation also cannot defeat a fully compromised host kernel, malicious compiler, equal-privilege debugger, or physical memory observer. High-risk deployments still require a measured VM, separate machine, TPM-backed appliance, enclave, or another independently controlled boundary.

The controlled matrices do not establish performance on real quantum hardware. Hardware-rooted signing, measured boot, remote-channel proofs, real backend captures, and host containment remain separate implementation layers.

[Inserian]

GitHub Actions validation completed successfully on Python 3.10, 3.11, and 3.12. Each lane installed the package, compiled the source, passed all 43 focused tests, ran the bounded benchmark, and uploaded its receipt.

Clean-runner benchmark results:

Python	Entropy analysis	Circuit comparison	Ledger append	Ledger verification
3.10	5.16 MiB/s	95,429 ops/s	121.1 records/s	72,239 records/s
3.11	6.06 MiB/s	107,217 ops/s	148.8 records/s	90,179 records/s
3.12	5.23 MiB/s	91,493 ops/s	125.1 records/s	75,317 records/s

The append path intentionally verifies the complete existing chain and acquires an exclusive writer lock before writing, so it trades throughput for stronger append safety. These are infrastructure measurements for this workload, not attack-detection claims.

Workflow run: 30718289481
Commit: 2e0677bcb1578b80da544767f9c56f1a337bc9e5

[Inserian]

QSec 0.2 trust-mesh validation is complete on final commit 8940dd7001e8aa11690f6f00b0bd8350bf51cdb6.

Permanent matrix run 30722197357 passed on Python 3.10, 3.11, and 3.12. Each lane completed installation, compilation, all 89 combined tests, both benchmark programs, and artifact upload.

Controlled trust-mesh result on every runner:

• 12 malicious mutations detected;
• five benign controls accepted;
• zero false positives;
• zero false negatives.

Clean-runner throughput ranges:

• attestation: 22,140–27,189 verifications/second;
• pulse: 8,839–11,908 checks/second;
• QEC: 16,325–21,828 proofs/second;
• action authorization: 7,450–10,116 decisions/second;
• thermal: 159,899–204,241 interval checks/second.

The branch has two intentional commits. The trust-mesh commit is one commit ahead of the foundation, and the temporary transport and materialization files are absent from the final tree. The PR remains draft because real hardware captures, realistic benign variation, asymmetric or hardware-rooted attestation, and production false-positive evaluation are still separate evidence gates.

[Inserian]

QSec 0.3 is complete at 23792d1916ab2aea253a47620c82988ce7555308.

Final acceptance:

• exactly three intentional commits;
• no temporary publication files or workflow;
• independent C++17 law worker compiled on Python 3.10, 3.11, and 3.12 lanes;
• 103 tests passed on every lane;
• foundation, trust-mesh, and cross-code quantum benchmarks passed;
• quantum matrix: 7 true positives, 3 true negatives, 0 false positives, 0 false negatives;
• trust matrix: 12 true positives, 5 true negatives, 0 false positives, 0 false negatives;
• README and quantum-core documentation completed.

Final CI run: 30723744904.