Kapsamlı ve birleşik gürültü profilleri

• Status: proposed
• Revision: 2 (2026-08-09)
• Target contract: 0.1.0-experimental
• Feature flag: experimental.composedNoise=true
• Owners: language, runtime, verification, product
• Depends on: stable @seed, sample, and the browser-statevector runtime
• Does not change: the stable @noise(model, probability) directive, backend ceilings, hardware claims, or QEC contracts

1. Summary

The stable N/M noise directive selects one global channel. Extending its model string with scopes or multiple channels would silently change that contract. This RFC therefore introduces a separate, explicitly negotiated declaration:

noise profile bell_device {
  after H on q[0] apply phase_damping(0.02);
  after CNOT on q[0..1] apply correlated_pauli("XX", 0.08);
  before measure on q[0..1] apply readout(0.03);
}

@noise_profile("bell_device");

The active profile is compiled into a closed, resolved carrier before runtime. The statevector sampler applies matching channels in source order with a contract-owned seeded random stream and reports the exact placement/match evidence. It remains a bounded local trajectory experiment, not a device noise model.

2. Goals

• Scope local channels to an exact gate and compile-time register view.
• Express one atomic correlated Pauli event over two through five qubits.
• Scope symmetric readout flips to a compile-time register view.
• Compose at most eight channels in deterministic source order.
• Keep stable @noise behavior unchanged when the feature is disabled.
• Carry resolved placement and execution evidence through Core, CLI, Worker, Playground, documentation, and a dedicated Noise Composer Lab.
• Reject every target/export path that cannot preserve the contract.

3. Non-goals

• Leakage, crosstalk, erasure, non-Markovian dynamics, density matrices, Kraus input, pulse timing, idle-time noise, or calibration snapshots.
• Hardware fidelity, provider calibration, QEC thresholds, decoder quality, logical error rates, or fault-tolerance evidence.
• Stabilizer execution, raising the five-qubit statevector ceiling, runtime register sizing, symbolic probabilities, or dynamic profile selection.
• Reinterpreting @mitigation for a composed profile.

4. Closed, line-oriented grammar

Revision 2 deliberately keeps profile parsing line-oriented. The declaration header, every channel, the closing brace, and the activation MUST each occupy their own logical line. Comments may follow a complete line. An inline form such as noise profile p { after H ...; } is not part of contract 0.1 and fails closed with NM-NOISE-PROFILE-002. The EBNF below describes those logical lines, not whitespace-insensitive token concatenation.

noise-profile       = "noise" "profile" identifier "{" noise-channel+ "}" ;
noise-channel       = local-channel | correlated-channel | readout-channel ;
local-channel       = "after" gate "on" register-view "apply"
                      local-model "(" probability ")" ";" ;
correlated-channel  = "after" gate "on" register-view "apply"
                      "correlated_pauli" "(" pauli-word "," probability ")" ";" ;
readout-channel     = "before" "measure" "on" register-view "apply"
                      "readout" "(" probability ")" ";" ;
register-view       = identifier "[" integer "]"
                    | identifier "[" integer ".." integer "]" ;
local-model         = "pauli" | "amplitude_damping" | "phase_damping" ;
pauli-word          = string-literal ;
noise-profile-use   = "@noise_profile" "(" string-literal ")" ";" ;

gate is one exact built-in N/M gate name. Integers and probabilities are source literals in revision 1. A Pauli word contains only I, X, Y, or Z, has length two through five, is not all identity, and has exactly the resolved scope width.

5. Bounds and static rules

• A module contains at most four profiles and eight channels per profile.
• Exactly one @noise_profile activation is required when profiles are present.
• Profile names are unique and the activation names one declared profile.
• Probabilities are finite literals in the inclusive range 0..0.25.
• Register views are resolved at compile time, are ascending and non-empty, and must fit a declared qreg.
• Every after gate rule must match at least one executable source gate.
• A correlated rule's gate must touch every qubit in its resolved scope.
• The program must declare @target("browser-statevector"), @seed(...), and exactly one bounded sample block. The source shot literal MUST be in 1..4096; it is never clamped under this contract.
• The seed MUST be an unsigned 32-bit integer in 0..4294967295.
• The executable workload is a gate-only unitary prefix followed by terminal Z-basis measurements of every allocated qubit exactly once and at most one final return, all inside that single sample block. Gates after measurement, executable operations outside the sample block, barriers, reset, measurement-conditioned control, loops, syndrome operations, and other dynamic statements fail closed.
• A readout scope MUST resolve only to those terminal measurement targets.
• @noise, @mitigation, QEC experiment declarations, and composed profiles cannot coexist in contract 0.1.

The existing statevector maximum of five qubits and sampling maximum of 4,096 shots remain authoritative.

6. Normative trajectory order

Each shot starts in |0...0>. The compiler emits one validated execution plan; the resolver and runtime MUST consume that same gate prefix and terminal measurement map. Gates execute in source order. Immediately after each gate, matching after channels execute in profile source order:

1. A local channel visits the intersection of the gate operands and its scope in ascending resolved-qubit order.
2. pauli(p) performs one Bernoulli draw per visited qubit and, on success, one uniform draw selecting X, Y, or Z.
3. Amplitude- and phase-damping use the existing statevector trajectory semantics with one channel invocation per visited qubit.
4. correlated_pauli(word, p) performs one Bernoulli draw for the whole word; on success all non-identity letters are applied in word/scope order.
5. After the quantum state is sampled, matching before measure readout rules execute only for their resolved terminal measurement targets, in profile source order and resolved-qubit order.

The composed-noise runtime creates its own mulberry32-v1 stream from the validated uint32 seed. Earlier measurements or unrelated random draws in the ordinary simulator MUST NOT advance or replace this stream.

Changing channel order is observable and changes the carrier identity. No implementation may merge, commute, deduplicate, or parallelize these events.

7. Typed carrier and evidence

The compiler carrier contains the contract/RFC identity, every declared profile, the active profile name, ordered channel records, source lines, exact resolved indices, the canonical gate plan (gate, resolved targets, and numeric parameters), the terminal measurement index map, and a deterministic FNV-1a-32 checksum over that complete identity. Raw source is not carried. Before any allocation or sampling, the public runtime MUST derive the same canonical gate plan from its gate input and require exact equality with the validated carrier. This checksum detects accidental or unvalidated mutation; it is not collision-resistant, authentication, a signature, or a security identity.

Runtime evidence contains:

• active profile and carrier identity;
• seed, mulberry32-v1 random-source version, shots, backend, and ordering policy;
• per-channel source order, placement, gate, resolved scope, matching operation count, and stochastic attempt count; and
• an explicit limitation that the result is a finite-shot local-statevector trajectory estimate.

Evidence reports attempts and placement, not an inferred physical error rate.

8. Diagnostics

Disabled syntax is removed before ordinary parsing and produces code 001; it never degrades into an unknown statement or stable @noise behavior.

9. Export and compatibility

N/M JSON IR may carry the closed profile metadata. OpenQASM 2/3, Quantikz, framework exporters, and target-native lowering fail closed until their own versioned carrier explicitly preserves channel order and resolved scopes. Stable programs without noise profile syntax parse and execute exactly as before.

10. Product surface

The Noise Composer Lab constructs the closed profile, runs it through the real Worker with explicit negotiation, and compares it with the same ideal circuit. It displays the generated source, resolved scope, channel order, operation-match/attempt counts, seeded histogram, and evidence boundary. The default YZ correlated word is observable in the shown Z-basis histogram; XX and ZZ are Bell-state stabilizers and can legitimately leave that chart unchanged. Accepted product probabilities have at most six decimal places and are emitted without value-changing rounding. The Playground deep link must include composedNoise=1; opening source alone must not enable the proposal.

11. Rollout

1. Freeze flag-off behavior and the grammar/carrier validator.
2. Land deterministic local, correlated-Pauli, and scoped-readout trajectories.
3. Add CLI/Worker/Playground negotiation and fail-closed exporters.
4. Add the localized Noise Composer Lab and discovery surfaces.
5. Close parser/runtime fuzz, maximum-workload, cross-platform, browser, accessibility, security, and named language/runtime/product review evidence.

The RFC remains proposed and the capability remains experimental until the full evidence matrix is reviewed. Implementing revision 1 is not approval.

12. Acceptance criteria

• Flag-off source produces 001 and leaves no executable profile residue.
• Parser metadata and carrier validation reject unknown fields and tampering.
• A runtime gate-plan mismatch against the carrier fails with 010 before allocation or sampling.
• Same source/seed/shots produces the same histogram and evidence identity.
• The public runtime revalidates the closed carrier, uint32 seed, 1..5 qubits, 1..4096 shots, gate targets, and scopes before allocating or sampling.
• The composed random stream is derived solely from the reported seed and random-source version; unrelated simulator draws do not change it.
• Reordering non-commuting channels changes both execution and identity.
• Local rules affect only matching gate operands inside the resolved scope.
• A correlated word is attempted once per matching gate and never decomposed into independent Bernoulli events.
• Scoped readout flips only selected terminally measured bits and reports their measurement matches.
• Zero, oversized, normalized, or multiple sample blocks and post-measurement operations fail closed before runtime.
• Missing negotiation/target/seed/sample, invalid bounds, unknown gates/scopes, unmatched channels, incompatible directives, and unsupported exporters fail closed with the specified diagnostics.
• Core, CLI, Worker, Playground, lab, spec catalog, EN/TR documentation, and share-state negotiation publish the same limits and evidence boundary.
• Published text never describes the result as calibration, crosstalk, density-matrix, hardware-fidelity, QEC-threshold, or fault-tolerance evidence.