QSec 0.5 nonce-bound quantum capability challenges

[Inserian]

QSec 0.5 adds independently checked, nonce-bound QSA 0.2 capability challenges without moving QSec's policy or replay authority into QSA.

Exact Grover challenge

• domain-separated QSEC-QSA-GROVER/1 request and policy hashes
• marked states derived from request identity + one-time nonce
• isolated QSA GroverSearch execution
• independent QSec recomputation of optimal iteration count, success probability, and marked/unmarked amplitudes
• version, memory, membership, request, policy, receipt, and replay gates

Exact Hamming-weight symmetry challenge

• domain-separated QSEC-QSA-SYMMETRY/1 request and policy hashes
• independent nonce-derived phase challenge for every Hamming-weight class
• isolated QSA SymmetryState.hamming_weight execution
• independent QSec verification of every C(n,k) class size, amplitude, probability, and selected basis membership
• version, memory, shape, request, policy, receipt, and replay gates

Measured real-QSA gates

Pinned QSA 0.2.0 in GitHub Actions:

• 50-qubit structured GHZ: 5,568 B QSA state memory, 333 B QSC, 16 PiB dense equivalent, 3,235,344,559,892x reduction.
• 60-qubit Grover: 2^60 logical states, 96 B QSA engine memory, 16 EiB dense equivalent, 192,153,584,101,141,162x reduction. QSA and QSec independently selected 843,314,856 optimal iterations; probability error was 0 at the 10^-15 receipt scale.
• 60-qubit Hamming-weight symmetry: 2^60 logical basis, 61 exact classes, 1,592 B QSA state memory, 16 EiB dense equivalent, 11,587,150,800,068,813x reduction. Maximum class-amplitude and class-probability error were both 0 at the 10^-15 receipt scale.

The worker's accepted bit is never sufficient by itself. The parent re-derives challenge data and analytic references, verifies receipt/request/policy bindings, and fails closed on mismatch.

These are exact classical structural-execution receipts under QSA's stated representation contracts. They are not presented as physical-QPU results or physical quantum advantage claims.

The README and existing quantum-core documentation now lead with measured capability and explicit scientific boundaries rather than prospective architecture.