Willis (2026) argues that a recursively self-improving system may increase its effective quantum capability without acquiring additional hardware, and that the resulting hybrid classical-quantum execution path becomes progressively harder to characterise exhaustively. The proposed response abandons exhaustive reconstruction as an assurance objective and instead requires that specified properties hold before computation is permitted to affect consequential state, with five quantum execution controls layered beneath substrate-independent constitutional invariants. This paper accepts that architecture and contests two of its load-bearing predicates. The compilation equivalence predicate. GovernanceEquivalent(C(a), C(e)) carries the entire compilation-integrity argument and is left undefined. It cannot be read as semantic equivalence: deciding circuit equivalence is QMA-complete (Janzing, Wocjan & Beth, 2005), and remains so for the shallow circuits typical of transpiled output, while semantic sameness is in any case the wrong target given what transpilation exists to do. The predicate must therefore be evaluated relative to a declared set of governance-relevant properties. That set is itself a governance object, and under recursive self-improvement it is reachable through the toolchain. An attack follows in which a compilation change justified purely on performance grounds renders a governance-relevant property unmeasurable over the executed representation, so that the permit gate continues to evaluate correctly over a test that no longer discriminates. Traceability of the executed artefact to the authorised one does not prevent this, because traceability and property preservation come apart precisely when a transformation is faithful in derivation and lossy in representation. The sampling boundary. The authorised shot count is specified as a ceiling. A ceiling bounds resource consumption; it does not bound evidentiary resolution, which varies in the same direction. Admissibility evaluated on a point estimate is therefore unsound under an adversarial or merely cost-optimising choice of sample size, and error mitigation supplies a second route that widens the uncertainty region while appearing to improve result quality. Evaluating admissibility over a confidence region rather than a point estimate is sound, imposes the necessary floor implicitly, and fails closed without requiring a separately specified minimum. An authorised sequential-sampling rule is a second sound form, subject to the condition that the stopping rule be fixed prior to sampling. Composition. The two results are not independent. The repair proposed for the second introduces a parameter that is vulnerable to the first, and the properties governing sampling can themselves be attenuated out of the property set. Sound sampling governance presupposes governed property-set membership. General form. Both attacks share a shape: an invariant is enforceable only to the extent that the instrument deciding it — its property set, tolerance, confidence level, sample size, or measurability assumption — is unreachable from inside the system it constrains. Under recursive self-improvement there is always gradient in those parameters, because they trade against latency, cost and throughput, which are the objectives the recursion optimises. No adversarial disposition is required. The paper closes by applying its own criterion reflexively. A response whose complaint is that declarations are mistaken for proof cannot end with declarations and leave the matter there. A governance requirement is structural when its violation is observable without relying on the cooperation of the governed system, and declarative when it is not; three of the four requirements proposed here are organisational by that test, and one is not. This work continues the author's earlier treatment of trajectory-level governance and the Constitutional Failure Boundary methodology (Zenodo 10.5281/zenodo.18980403) and of admissibility operators and bounded reachability in probabilistic decision systems (Zenodo 10.5281/zenodo.20057043), extended here from classical to hybrid quantum execution. No implementation is described and none should be inferred. Attribution: the counterfactual authorisation test adapted in §3.6 was proposed by R. Muro. The Layer 3 / Layer 1 redefinition formulation in §3.5 and the authorised sequential-sampling rule in §4.4 are J. M. Willis's, offered in public response to an earlier and shorter statement of these arguments.
Willis (2026) argues that a recursively self-improving system may increase its effective quantum capability without acquiring additional hardware, and that the resulting hybrid classical-quantum execution path becomes progressively harder to characterise exhaustively. The proposed response abandons exhaustive reconstruction as an assurance objective and instead requires that specified properties hold before computation is permitted to affect consequential state, with five quantum execution controls layered beneath substrate-independent constitutional invariants. This paper accepts that architecture and contests two of its load-bearing predicates. The compilation equivalence predicate. GovernanceEquivalent(C(a), C(e)) carries the entire compilation-integrity argument and is left undefined. It cannot be read as semantic equivalence: deciding circuit equivalence is QMA-complete (Janzing, Wocjan & Beth, 2005), and remains so for the shallow circuits typical of transpiled output, while semantic sameness is in any case the wrong target given what transpilation exists to do. The predicate must therefore be evaluated relative to a declared set of governance-relevant properties. That set is itself a governance object, and under recursive self-improvement it is reachable through the toolchain. An attack follows in which a compilation change justified purely on performance grounds renders a governance-relevant property unmeasurable over the executed representation, so that the permit gate continues to evaluate correctly over a test that no longer discriminates. Traceability of the executed artefact to the authorised one does not prevent this, because traceability and property preservation come apart precisely when a transformation is faithful in derivation and lossy in representation. The sampling boundary. The authorised shot count is specified as a ceiling. A ceiling bounds resource consumption; it does not bound evidentiary resolution, which varies in the same direction. Admissibility evaluated on a point estimate is therefore unsound under an adversarial or merely cost-optimising choice of sample size, and error mitigation supplies a second route that widens the uncertainty region while appearing to improve result quality. Evaluating admissibility over a confidence region rather than a point estimate is sound, imposes the necessary floor implicitly, and fails closed without requiring a separately specified minimum. An authorised sequential-sampling rule is a second sound form, subject to the condition that the stopping rule be fixed prior to sampling. Composition. The two results are not independent. The repair proposed for the second introduces a parameter that is vulnerable to the first, and the properties governing sampling can themselves be attenuated out of the property set. Sound sampling governance presupposes governed property-set membership. General form. Both attacks share a shape: an invariant is enforceable only to the extent that the instrument deciding it — its property set, tolerance, confidence level, sample size, or measurability assumption — is unreachable from inside the system it constrains. Under recursive self-improvement there is always gradient in those parameters, because they trade against latency, cost and throughput, which are the objectives the recursion optimises. No adversarial disposition is required. The paper closes by applying its own criterion reflexively. A response whose complaint is that declarations are mistaken for proof cannot end with declarations and leave the matter there. A governance requirement is structural when its violation is observable without relying on the cooperation of the governed system, and declarative when it is not; three of the four requirements proposed here are organisational by that test, and one is not. This work continues the author's earlier treatment of trajectory-level governance and the Constitutional Failure Boundary methodology (Zenodo 10.5281/zenodo.18980403) and of admissibility operators and bounded reachability in probabilistic decision systems (Zenodo 10.5281/zenodo.20057043), extended here from classical to hybrid quantum execution. No implementation is described and none should be inferred. Attribution: the counterfactual authorisation test adapted in §3.6 was proposed by R. Muro. The Layer 3 / Layer 1 redefinition formulation in §3.5 and the authorised sequential-sampling rule in §4.4 are J. M. Willis's, offered in public response to an earlier and shorter statement of these arguments.
Existing artificial intelligence governance and runtime execution governance frameworks were developed primarily within classical computing environments. While autonomous and agentic systems have introduced new governance challenges, most governance architectures continue to rely upon assumptions regarding deterministic execution, reproducibility, authorization validity, and auditability. Quantum and hybrid classical-quantum systems introduce execution characteristics that challenge these assumptions. Probabilistic measurement, circuit compilation and transpilation, hardware-dependent execution behavior, calibration drift, shot-based execution, hybrid computational workflows, and emerging distributed quantum architectures create governance obligations not fully addressed by existing execution-governance models. This paper proposes an extension of execution-layer governance into quantum environments through the introduction of Quantum Runtime Governance Invariants and corresponding Quantum Governance Requirements. The proposed invariants identify governance properties that must remain true regardless of implementation details, hardware platforms, programming models, or execution environments. These invariants are explicitly tied to governance properties including authorization integrity, admissibility integrity, provenance continuity, governance evidence integrity, replayability, governance continuity, and governance authority. The paper further introduces the concept of Probabilistic Admissibility, in which governance systems evaluate and authorize bounded outcome distributions rather than deterministic outcomes. Building upon this foundation, the paper derives a structured set of Quantum Governance Requirements spanning quantum resource governance, circuit governance, compilation governance, probabilistic outcome governance, shot governance, calibration governance, hybrid classical-quantum governance, quantum artificial intelligence governance, and distributed quantum governance. Finally, the paper examines the implications of these concepts for the Artificial Intelligence Governance Control Plane (AGCP), arguing that quantum systems do not require a fundamentally new governance architecture. Rather, they require an extension of existing execution-governance semantics capable of operating over probabilistic execution environments. The resulting framework establishes an initial foundation for AGCP-Quantum profiles, governance conformance assessment methodologies, registry assessment frameworks, governance assurance models, and future standards development activities.
The increasing adoption of autonomous systems, artificial intelligence (AI), Large Quantitative Models (LQMs), high-performance computing (HPC) infrastructures, and quantum computing introduces new challenges for execution-layer governance. Existing governance models frequently assume deterministic execution environments in which proposed actions, execution outcomes, and resulting state transitions can be evaluated using deterministic semantics. Emerging computational systems increasingly violate these assumptions by producing probabilistic outputs, confidence intervals, uncertainty distributions, optimization result spaces, and quantum measurement distributions. This paper extends prior work on Artificial Intelligence Governance Control Planes (AGCPs), formal execution semantics, and Quantum Runtime Governance by introducing a formal execution model for hybrid probabilistic execution environments spanning classical systems, HPC infrastructures, AI systems, LQMs, and quantum computing resources. The paper formalizes the concepts of Probabilistic Admissibility and Replay-by-Distribution, demonstrating how deterministic governance authority may be preserved even when governed execution environments exhibit probabilistic behavior. Building upon previously proposed Quantum Runtime Governance Invariants, the paper develops a mathematical formalization of governance-preservation properties and establishes a collection of governance-preservation theorems addressing commit safety, governance continuity, hybrid execution graph safety, replayability, auditability, and non-bypass execution. The analysis demonstrates that governance authority, authorization integrity, admissibility integrity, provenance continuity, and commit-bound control can remain preserved across heterogeneous execution environments despite probabilistic computational behavior. The paper argues that quantum computing is not an isolated governance challenge but rather an instance of a broader class of probabilistic execution systems. Accordingly, the work provides a foundation for extending execution-layer governance into future computational environments that combine classical computing, artificial intelligence, quantitative modeling, quantum computing, and autonomous decision-making systems.
Quantum compiler assurance requires a semantic relation that matches the intended use and observations that can expose violations at the delivered interface. This critical integrative survey compares verified transformations, equivalence checking, differential and metamorphic testing, property-based testing, and evidence for assurance across revisions. A source catalogue and focused extraction matrix distinguish formal guarantees, reported empirical findings, analytical deductions, and proposed practice. A recorded coverage update and source-level selection decisions make the review auditable within its declared scope. Four documented failure cases connect conditional applicability, parameter association, termination, and phase conventions to method selection. A worked example involving layout metadata, parameter bindings, and ancillary qubits demonstrates why validating a circuit under a reconstructed interpretation can leave the delivered interface unchecked. An illustrative revision scenario then separates fault detection from change attribution. The resulting guidance specifies applicability, complementary observations, and treatment of inconclusive outcomes. Published bug counts, mutation results, and processing benchmarks support different claims and do not establish a common effectiveness ranking. The proposed regression architecture remains unevaluated as a complete system; its practical value requires controlled comparisons on independently adjudicated compiler-change events.
Quantum-control optimisation typically begins with calibration records assumed to remain applicable to the intended operation. Yet coherence, phase references, coupling, read-out response and subsystem interactions vary with time and operating context. Local calibration success may therefore be insuffi- cient to justify joint or changed-context control, allowing optimisation to pursue candidates founded on stale, incomplete or inapplicable evidence. We propose an evidence-governed admissibility framework that checks evidence role, scope, freshness, provenance and composition authority before constructing control candidates. Its computational layers have distinct functions: Layer 1 classifies routes as Permit, Withhold or Revalidate, retaining auditable native states and reasons; Layer 2A constructs and screens reduced-model candidates only for permitted routes; and Layer 2B checks applicable end-to-end workflows. Synthetic integration and authority-ablation tests demonstrate enforceable differences in permission, and the implementation passed 150/150 core and 10/10 slew-specific tests. These are computational findings, not hardware validation. We also provide two complementary prospective experimental arms for evaluating practical benefit. Arm 1 (predictive lift) freezes assessments before hardware outcomes are known and tests whether they predict the performance of independently authorised ordinary-baseline operations better than calibration- or availability-only benchmarks. Arm 2 (constructive recovery) tests whether initially unsuitable cases can yield authorised alternative controls after evidence refresh or reconfirmation, a new Layer 1 decision and downstream construction, while preserving the original classification. We release code, schemas, guided workbooks, fixtures and prespecified protocols for independent pilots. Hardware validation could establish whether this approach reduces wasted searches and improves control reliability or qubit performance.
Incomplete access to quantum states does not imply that a hybrid quantum–AI system cannot be controlled. Physical isolation, restricted interfaces and independent enforcement can limit a system's effects without reconstructing its complete internal state. Quantum information theory nevertheless matters for the evidence available to auditors, particularly when an execution consumes an unknown quantum input that cannot be prepared again. This conceptual paper separates four assurance objectives: state reconstruction, verification of computation, behavioural evaluation and boundary control. It then distinguishes repeatable state preparation from access to a single, unreproducible quantum input. The distinction identifies when repeated experiments, targeted measurements and verification protocols may support an audit, and when retrospective reconstruction cannot substitute for evidence collected during execution. A hypothetical hybrid classifier illustrates how execution records, statistical tests and an independent action policy address different claims. The paper proposes an evidence plan that specifies the access model, the property to be assessed and the assumptions supporting each assurance statement. It offers neither a new physical principle nor a general impossibility result for containment. Its narrower argument is that governance should plan for the evidence an architecture can actually preserve, rather than treating complete state access as either necessary for control or available on demand after an incident.
This preregistration describes a confirmatory study of an upstream conditioning architecture in a quantum error-correction workflow. The project’s purpose is to test whether an intervention applied prior to the primary decoder produces a real and reproducible decoder-relevant effect, remains compatible with more than one downstream decoder family, generates a measurable exposed-observable statistical footprint, and improves or preserves performance across a preregistered regime rather than only at a single operating point. The study is intentionally limited to architecture-level evaluation, with the public claim set confined to exposed observables, frozen transformations, preregistered statistical tests, explicit negative controls, and bounded interpretation rules. The confirmatory design is organized around five preregistered tests: category existence, decoder compatibility, structural footprint, observable statistical signature, and regime robustness. Across these tests, the central comparison is between a baseline control pipeline and a conditioned pipeline in which the upstream intervention is applied while all non-conditioning settings are held fixed. The study uses frozen observables and frozen execution rules, including matched seeds, shot counts, code distances, physical error rates, geometry, and baseline decoder settings, so that any supported effect can be interpreted as evidence about the architecture under test rather than as a byproduct of post hoc tuning. To preserve a clean-room boundary, the registration restricts primary analysis to exposed, decoder-facing quantities only. These include logical failure, an exposed defect-count summary, and an exposed decoder-difficulty proxy, along with a locked scalar error-load construction derived from control-only standardization. The study does not rely on decoder-internal state variables, hidden confidence traces, or implementation-specific internal diagnostics in its primary confirmatory analyses. This structure is intended to let readers evaluate whether the architecture leaves a reproducible footprint in decoder-facing behavior without disclosing reconstruction-level mechanism details. Expected outcomes are defined in confirmatory rather than speculative terms. If the preregistered hypotheses are supported, the study is expected to provide evidence that an upstream conditioning intervention exists as a real architectural category in QEC, acts before the primary decoder, is compatible with downstream decoding, changes decoder-relevant exposed structure, and produces a reproducible observable statistical footprint in logical-failure behavior. If support is absent, mixed, or null, those outcomes will still be recorded under the frozen rules without rescue through post hoc metric changes, reweighting, or reinterpretation. In either case, the expected result of the registration is a bounded, auditable public record of whether this architecture class shows reproducible category-level behavior under a preregistered confirmatory design. The preregistration is not intended to establish a unique mechanism identity, identify a privileged implementation, disclose implementation-specific reconstruction details, or support claims about exact targeting logic, suppression laws, subset-sizing logic, telemetry-governed control, or broader cross-domain theory narratives. Public-facing interpretation is therefore intentionally limited to category validation and exposed-observable behavior. This is meant to support rigorous public evaluation while preserving strict clean-room limits around protected implementation detail.