🔍 Audit MLIR pass, verifier, and rewrite contracts by simon1hofmann · Pull Request #2287 · munich-quantum-toolkit/core

simon1hofmann · 2026-08-31T15:02:49Z

🤖 AI text below 🤖

Description

Records five reproduced correctness failures in MLIR lowering and JeFF import,
with minimal CLI examples, source evidence, ownership, and limits for each
proposed fix. The audit is based on main at 6cc98f059.

The diff contains only one 271-line audit report.
There are no production or test changes; the findings remain open for focused
fixes. The report also reconciles the merged and closed split PRs.

Passes may assume verified IR. The retained findings concern valid source
programs or an external import boundary. Generic pass-entry validation,
invalid-QCO regressions, blanket failure-atomicity requirements, and speculative
resource caps are excluded.

Confirmed findings

High: QIR Base moves a later gate before a measurement of the same qubit,
changing the recorded result.
High: QC-to-QCO aborts on valid branches that use the same dominating
qubit reference.
High: a malformed JeFF file aborts the importing process instead of
returning an import error.
Medium: sparse static qubit IDs produce insufficient QIR resource
metadata; ID 7 is emitted with required_num_qubits="1".
Medium: Adaptive QIR moves a branch-local qubit release into the epilogue,
producing a dominance error and failing compilation.

Validation

Built the compiler and compiler tests with LLVM/MLIR 23.1.0 and the pinned
jeff-mlir dependency.
All 163 compiler tests passed.
Executed all five CLI reproducers after rebuilding the merged branch. They
confirm the existing failures; this PR does not implement their fixes.
uvx nox -s lint and git diff --check passed.
Current GitHub CI has not been verified as part of this update.

Tracks #2255.

Checklist

The pull request's diff is focused and relevant to this change.
I have added appropriate tests that cover the new/changed functionality. — N/A: report only; executed reproducers are included in the report.
I have updated the documentation to reflect these changes.
I have added entries to the changelog for any noteworthy additions, changes, fixes, or removals. — N/A: internal audit report only.
I have added migration instructions to the upgrade guide (if needed). — N/A: no API or behavior changes.
The changes follow the project's style guidelines and introduce no new warnings.
The changes are fully tested and pass the CI checks. — Local checks passed; current CI is unverified.
The final report and diff have been reviewed.

If PR contains AI-assisted content:

Any agent that created, edited, or submitted GitHub content was explicitly authorized for that scope, as required by our AI Usage Guidelines.
Every agent-authored or agent-edited public text body begins with the visible disclosure 🤖 *AI text below* 🤖 (titles are exempt).
I have disclosed AI assistance in the PR description.
I confirm that I have personally reviewed and understood all AI-generated content, and accept full responsibility for it.

AI assistance disclosure: Codex refreshed the audit against current main,
reproduced the retained findings, removed the old implementation snapshot, and
updated this description under explicit human direction. Human review remains
required before acceptance or merge.

Audit every MQT-owned pass, verifier, rewrite pattern, conversion target, and registration surface. Harden diagnostics, atomicity, resource bounds, metadata checks, and importer boundaries. Add focused regressions across conversions, QIR, mapping, JEFF, OpenQASM, decision diagrams, and Qiskit interoperability. Assisted-by: GPT-5.6 Sol via Codex

codecov · 2026-08-31T15:14:08Z

Codecov Report

❌ Patch coverage is 84.33476% with 365 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
mlir/lib/Compiler/Programs.cpp	63.8%	141 Missing ⚠️
...lir/lib/Dialect/QCO/Transforms/Mapping/Mapping.cpp	78.2%	44 Missing ⚠️
mlir/lib/Conversion/QCToQCO/QCToQCO.cpp	82.8%	34 Missing ⚠️
mlir/lib/Conversion/QCOToQC/QCOToQC.cpp	80.1%	20 Missing ⚠️
...lib/Dialect/QIR/Transforms/AttachQIRAttributes.cpp	91.2%	19 Missing ⚠️
...QCO/Transforms/Optimizations/QuantumLoopUnroll.cpp	84.7%	16 Missing ⚠️
...lir/lib/Conversion/QCToQIR/QIRCommon/QIRCommon.cpp	93.4%	14 Missing ⚠️
...lir/lib/Conversion/QCToQIR/QIRBase/QCToQIRBase.cpp	86.6%	12 Missing ⚠️
mlir/lib/Dialect/QCO/IR/Modifiers/PowOp.cpp	85.7%	9 Missing ⚠️
...Conversion/QCToQIR/QIRAdaptive/QCToQIRAdaptive.cpp	89.8%	7 Missing ⚠️
... and 16 more

📢 Thoughts on this report? Let us know!

…ontract # Conflicts: # mlir/lib/Compiler/Programs.cpp # mlir/lib/Dialect/QCO/IR/Modifiers/ModifierUtils.cpp # mlir/unittests/Conversion/QCToQCO/test_qc_to_qco.cpp

Preserve landed focused fixes while retaining the independent contract-audit guards and regressions. Assisted-by: GPT-5.6 via Codex

Preserve the dependency-safe behavior from #2301 while retaining terminal-reset handling from the contract audit. Assisted-by: GPT-5.6 via Codex

Record the focused pull request outcomes and revise the audit gate so passes may assume verifier-valid IR. Withdraw speculative and invalid-input findings across the original snapshot. Assisted-by: GPT-5.6 via Codex

Move the invalid-QCO finding from pending withdrawal to closed and refresh the focused audit counts. Assisted-by: GPT-5.6 via Codex

…ontract # Conflicts: # mlir/include/mlir/Conversion/CBitToMemRef/CBitToMemRef.td # mlir/lib/Conversion/CBitToMemRef/CBitToMemRef.cpp

Remove focused, merged, closed, malformed-IR, and speculative changes from the audit snapshot. Retain only uniquely owned boundary, verifier, resource, semantic, and output-atomicity findings, with valid regressions. Assisted-by: GPT-5.6 via Codex

…ontract # Conflicts: # mlir/unittests/Conversion/QCOToQC/test_qco_to_qc.cpp

Accept valid QC programs whose dynamic register indices cannot be proven distinct, and remove a registration-only assertion without an executable reproducer. Finalize the reconciled audit counts and validation record. Assisted-by: GPT-5.6 via Codex

Extract scalar floats from MLIR pass options before calling std::isfinite so the retained option validation compiles with MSVC. Assisted-by: GPT-5.6 via Codex

Retain the audit conversion validation and atomicity changes while integrating the focused constant-folding, benchmark-registration, and idempotent QIR metadata updates now on main. Assisted-by: GPT-5.6 via Codex

Remove the five implementation and regression copies now owned by #2318 through #2322 while preserving the complete audit ledger. Clear the remaining changed-file Clang-Tidy warnings exposed by the reduced snapshot. Assisted-by: GPT-5.6 via Codex

Preserve the audit mapping validation and failure-atomic rewrite while adopting the separated placement and routing implementation. Assisted-by: GPT-5.6 via Codex

Merge main and replace the residual implementation snapshot with five reproduced findings and their minimal CLI examples. Assisted-by: GPT-6 via Codex

Assisted-by: GPT-6 via Codex

simon1hofmann · 2026-09-07T13:22:57Z

@burgholzer I let Astra rerun the audit to only focus on reproducible and real findings. It identified 5 actionable items, let me know what you think and I'll be happy to implement them if needed.

burgholzer

Thanks @simon1hofmann 🙏🏼 commented on all five findings. SHould hopefully be enough for resolving them 😌 let me know if not!

burgholzer · 2026-09-07T13:52:01Z

+```qasm
+OPENQASM 3.0;
+include "stdgates.inc";
+qubit q;
+bit c;
+c = measure q;
+x q;
+```


Yeah, this can definitely not be a valid base profile program. (at least not without any passes commuting gates through measurements).
Let's fix this.

burgholzer · 2026-09-07T13:53:56Z

+    cf.cond_br %c, ^then, ^else
+  ^then:
+    qc.x %q : !qc.qubit
+    return
+  ^else:
+    qc.z %q : !qc.qubit


we do not really support generic cf flow (yet). And I would rather like to hard-fail here with a diagnostic.
None of the input programs/program formats should currently produce such instructions; we just need to make this more explicit.

burgholzer · 2026-09-07T13:54:29Z

+Observed: exit 134 (`SIGABRT`) and `LLVM ERROR: No functions found in module`.
+The stack reaches `deserializeFromFile` from `loadJeffFile`. The CLI failure was
+executed; the byte/file library methods' use of the same fatal dependency was
+checked in source, not in a separate host-process experiment.


This definitely needs to be fixed 👍🏼

burgholzer · 2026-09-07T13:55:32Z

+Observed: exit 0; `x` receives `inttoptr (i64 7 to ptr)`, but the entry point
+declares `required_num_qubits="1"`. Preserving ID 7 requires a capacity of at
+least 8. The emitted program therefore violates the target contract.
+
+**Limits and disposition.** Proposed. Preserve physical-qubit identity; do not
+silently renumber mapped qubits. The regression should check capacity and the
+retained ID. Sparse result IDs and other pointer-provenance cases were not
+separately reproduced and are not additional findings here.


Yeah, this should also be fixed. This is a valid program.

burgholzer · 2026-09-07T13:57:07Z

+    scf.if %c {
+      %q = qco.alloc : !qco.qubit
+      %out = qco.x %q : !qco.qubit -> !qco.qubit
+      qco.sink %out : !qco.qubit
+    }


Puh. I am not sure we actually should allow this at the moment.
I believe none of the frontends we currently support allow qubit allocations in SCF constructs. Maybe we should just be rather explicit on forbidding this?

simon1hofmann marked this pull request as draft August 31, 2026 15:14

simon1hofmann added code quality Code quality improvements MLIR Anything related to MLIR refactor Anything related to code refactoring labels Aug 31, 2026

mergify Bot added the conflict label Aug 31, 2026

simon1hofmann added 2 commits August 31, 2026 22:45

Merge remote-tracking branch 'origin/main' into codex/2255-qir-base-c…

d53e682

…ontract # Conflicts: # mlir/lib/Compiler/Programs.cpp # mlir/lib/Dialect/QCO/IR/Modifiers/ModifierUtils.cpp # mlir/unittests/Conversion/QCToQCO/test_qc_to_qco.cpp

🐛 Fix contract audit portability regressions

0c8556a

simon1hofmann self-assigned this Sep 1, 2026

simon1hofmann added 2 commits September 1, 2026 10:51

🔀 Merge main into contract audit

8293506

Preserve landed focused fixes while retaining the independent contract-audit guards and regressions. Assisted-by: GPT-5.6 via Codex

🔀 Merge terminal-measurement routing fix

2d4b8c9

Preserve the dependency-safe behavior from #2301 while retaining terminal-reset handling from the contract audit. Assisted-by: GPT-5.6 via Codex

mergify Bot removed the conflict label Sep 1, 2026

📝 Reconcile MLIR contract audit

164ef96

Record the focused pull request outcomes and revise the audit gate so passes may assume verifier-valid IR. Withdraw speculative and invalid-input findings across the original snapshot. Assisted-by: GPT-5.6 via Codex

simon1hofmann changed the title ~~♻️ Harden MLIR pass, verifier, and rewrite contracts~~ 🔍 Audit MLIR pass, verifier, and rewrite contracts Sep 1, 2026

simon1hofmann mentioned this pull request Sep 1, 2026

🐛 Reject nonlinear Hadamard-lifting inputs safely #2309

Closed

12 tasks

📝 Record #2309 audit withdrawal

9fcc02e

Move the invalid-QCO finding from pending withdrawal to closed and refresh the focused audit counts. Assisted-by: GPT-5.6 via Codex

mergify Bot added the conflict label Sep 1, 2026

Merge remote-tracking branch 'origin/main' into codex/2255-qir-base-c…

baf2749

…ontract # Conflicts: # mlir/include/mlir/Conversion/CBitToMemRef/CBitToMemRef.td # mlir/lib/Conversion/CBitToMemRef/CBitToMemRef.cpp

burgholzer added this to the v4.0.0 - IEEE Quantum Week milestone Sep 1, 2026

simon1hofmann added 3 commits September 1, 2026 13:45

♻️ Keep only valid audit findings

55b7dce

Remove focused, merged, closed, malformed-IR, and speculative changes from the audit snapshot. Retain only uniquely owned boundary, verifier, resource, semantic, and output-atomicity findings, with valid regressions. Assisted-by: GPT-5.6 via Codex

Merge remote-tracking branch 'origin/main' into codex/2255-qir-base-c…

2cc5c0d

…ontract # Conflicts: # mlir/unittests/Conversion/QCOToQC/test_qco_to_qc.cpp

simon1hofmann removed the conflict label Sep 1, 2026

mergify Bot added conflict and removed conflict labels Sep 1, 2026

🐛 Validate mapping option values portably

c029124

Extract scalar floats from MLIR pass options before calling std::isfinite so the retained option validation compiles with MSVC. Assisted-by: GPT-5.6 via Codex

mergify Bot added the conflict label Sep 1, 2026

simon1hofmann added 3 commits September 1, 2026 16:19

🔀 Merge origin/main into the MLIR contract audit

e0cd5a6

Retain the audit conversion validation and atomicity changes while integrating the focused constant-folding, benchmark-registration, and idempotent QIR metadata updates now on main. Assisted-by: GPT-5.6 via Codex

🔀 Merge origin/main into the reduced MLIR audit

cb9fdea

Preserve the audit mapping validation and failure-atomic rewrite while adopting the separated placement and routing implementation. Assisted-by: GPT-5.6 via Codex

simon1hofmann removed the conflict label Sep 1, 2026

mergify Bot added the conflict label Sep 1, 2026

simon1hofmann removed the conflict label Sep 1, 2026

mergify Bot added conflict and removed conflict labels Sep 1, 2026

simon1hofmann added 2 commits September 7, 2026 15:01

📝 Refresh the MLIR contract audit

3c4fd8c

Merge main and replace the residual implementation snapshot with five reproduced findings and their minimal CLI examples. Assisted-by: GPT-6 via Codex

🔀 Update the audit baseline from main

b2f4a62

Assisted-by: GPT-6 via Codex

mergify Bot removed the conflict label Sep 7, 2026

simon1hofmann requested a review from burgholzer September 7, 2026 13:24

simon1hofmann marked this pull request as ready for review September 7, 2026 13:24

burgholzer reviewed Sep 7, 2026

View reviewed changes

Navigation Menu

Uh oh!

Uh oh!

🔍 Audit MLIR pass, verifier, and rewrite contracts - #2287

🔍 Audit MLIR pass, verifier, and rewrite contracts#2287
simon1hofmann wants to merge 17 commits into
mainfrom
codex/2255-qir-base-contract

simon1hofmann commented Aug 31, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

simon1hofmann commented Sep 7, 2026

Uh oh!

burgholzer left a comment

Uh oh!

burgholzer Sep 7, 2026

Uh oh!

burgholzer Sep 7, 2026

Uh oh!

burgholzer Sep 7, 2026

Uh oh!

burgholzer Sep 7, 2026

Uh oh!

burgholzer Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

simon1hofmann commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Confirmed findings

Validation

Checklist

Uh oh!

codecov Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

simon1hofmann commented Sep 7, 2026

Uh oh!

burgholzer left a comment

Choose a reason for hiding this comment

Uh oh!

burgholzer Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

burgholzer Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

burgholzer Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

burgholzer Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

burgholzer Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

simon1hofmann commented Aug 31, 2026 •

edited

Loading

codecov Bot commented Aug 31, 2026 •

edited

Loading