Identity, Lineage, and Attestation Schemas — Operating Quantum Computers

This appendix provides starter schemas for the identity, traceability, lineage, and attestation controls introduced in chapters 155 through 158.

Identity envelope

Illustrative listing · yaml

identity_envelope:
  schema: q.identity_envelope.v1
  subject:
    user: user:researcher@example.org
    project: project:materials-vqe
    organization: org:quantum-lab
  authentication:
    protocol: oidc
    issuer: https://id.example.org
    token_id: redacted-jti
    authenticated_at: 2026-04-20T16:00:44Z
  delegation:
    chain:
      - service: portal
        identity: spiffe://quantum.example/portal
      - service: broker
        identity: spiffe://quantum.example/broker
      - service: scheduler
        identity: spiffe://quantum.example/scheduler
  authorization:
    decision_id: authz-2026-04-20-919
    policy_version: q-authz.44
    allowed_scopes:
      - submit:benchmark
      - read:evidence

Diagram loads as you read

Identity envelope · Figure 1

View diagram source

flowchart LR
    OIDC[OIDC user identity] --> Envelope[Identity envelope]
    SPIFFE[SPIFFE workload identity] --> Envelope
    Authz[Authorization decision] --> Envelope
    Envelope --> Evidence[Evidence package]

Trace envelope

Illustrative listing · yaml

trace_envelope:
  schema: q.trace_envelope.v1
  traceparent: 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01
  root_span: experiment.run
  provider_job_map:
    provider: provider-a
    provider_job_id: job-abc-123
  critical_spans:
    - circuit.compile
    - admission.evaluate
    - qpu.execute
    - evidence.write
  retention: claim-bearing-7y

Diagram loads as you read

Trace envelope · Figure 2

View diagram source

flowchart TB
    Trace[Trace context] --> JobMap[Provider job map]
    Trace --> Spans[Critical spans]
    Trace --> Retention[Retention rule]
    Trace --> Evidence[Evidence manifest]

Lineage event

Illustrative listing · json

{
  "eventType": "COMPLETE",
  "eventTime": "2026-04-20T16:18:00Z",
  "run": {
    "runId": "018f0d58-7b2c-7000-8000-000000000001",
    "facets": {
      "quantum_execution": {
        "qpuId": "redacted-qpu-17",
        "baselineId": "baseline-2026-04-20-02",
        "circuitHash": "sha256:4e7c...",
        "shotsCompleted": 10000,
        "evidenceId": "qev-2026-04-20-219",
        "_producer": "https://quantum.example/lineage-producer/1.0.0",
        "_schemaURL": "https://quantum.example/schemas/1.0.0/QuantumExecutionRunFacet.json"
      }
    }
  },
  "job": {
    "namespace": "quantum.platform",
    "name": "materials-vqe-benchmark"
  },
  "inputs": [],
  "outputs": [],
  "producer": "https://quantum.example/lineage-producer/1.0.0",
  "schemaURL": "https://openlineage.io/spec/2-0-2/OpenLineage.json#/$defs/RunEvent"
}

The quantum.example URLs are placeholders for producer identity and a published, immutable custom-facet schema. Replace them before emission and validate against the pinned OpenLineage schema and the custom schema.

Attestation manifest

Illustrative listing · yaml

attestation_manifest:
  schema: q.attestation_manifest.v1
  subject:
    name: compiled-circuit.qasm
    digest: sha256:1199...
  predicate_type: quantum.compiler.provenance.v1
  builder:
    identity: spiffe://quantum.example/compiler
    version: compiler-8.2.0
  inputs:
    - name: source-circuit.qasm
      digest: sha256:aa11...
    - name: compiler-target.json
      digest: sha256:bb22...
  output:
    name: compiled-circuit.qasm
    digest: sha256:1199...
  policy:
    equivalence_check: passed
    benchmark_gate: passed

Diagram loads as you read

Attestation manifest · Figure 3

View diagram source

flowchart LR
    Input[Input hashes] --> Attestation[Attestation]
    Builder[Builder identity] --> Attestation
    Policy[Policy result] --> Attestation
    Attestation --> Subject[Signed subject]

Verification checklist

Verify identity envelope exists.
Verify delegation chain is complete.
Verify root trace ID and provider job map exist.
Verify lineage connects input, execution, result, analysis, and claim.
Verify every critical artifact has a digest.
Verify signatures or signed attestations are present.
Verify evidence retention matches the claim class.

Additional technical sources: [R216], [R293], [R294].