Glossary

A to C

Ansatz

A parameterized quantum circuit that prepares a trial state in a variational algorithm. Section 7.3.

Attestation

A hardware-signed statement describing what software is running, checked by a remote party before it extends trust. Section 2.2.

Barren plateau

A variational optimization landscape whose gradient vanishes exponentially with qubit count, leaving the optimizer no direction to move. Section 7.3.

Bin packing

Placing workloads onto as few machines as possible, which raises density and concentrates the impact of a node failure. Section 8.3.

Carbon intensity

Grams of carbon dioxide equivalent per kilowatt hour of electricity, varying by region and by hour. Section 8.2.

Circuit knitting

Splitting a circuit that needs more qubits than a device has into fragments, at an exponential reconstruction cost per cut. Section 7.4.

Clifford plus T

A discrete universal gate set, in which the T gate is the expensive one under error correction. Section 7.1.

CNSA 2.0

The United States national security algorithm suite requiring post-quantum algorithms in new acquisitions from January 2027. Section 1.1.

Coherence time

How long a qubit holds its state before decaying, which divided by gate time bounds useful circuit depth. Section 7.1.

Component model

A WebAssembly interface definition layer with real types, so components in different languages interoperate without shared memory layout. Section 9.2.

Confidential computing

Protecting data while it is in use, with a hardware boundary that privileged software cannot cross. Section 2.1.

CO-RE

Compile Once Run Everywhere. Recording eBPF field accesses symbolically so one binary relocates across kernel versions. Section 9.3.

Crypto-agility

The property of changing cryptographic algorithm without changing application code. Section 1.4.

Crypto shredding

Encrypting a subject's data under a per-subject key and deleting the key to satisfy an erasure request. Section 8.4.

D to L

Differential flame graph

A profile comparison colored by whether each stack grew or shrank, which names the location of a regression. Section 6.3.

DORA metrics

Deployment frequency, change lead time, change fail rate, and failed deployment recovery time, measuring the delivery system. Section 5.4.

DSSE

Dead Simple Signing Envelope. The wrapper that signs an in-toto attestation. Section 3.2.

Dynamical decoupling

Pulse sequences on idle qubits that refocus low-frequency dephasing, at almost no cost. Section 7.2.

Embodied emissions

The manufacturing footprint of hardware, amortized over its lifetime, which for lightly used hardware can exceed operational emissions. Section 8.1.

Enclave

A memory region that the processor encrypts and integrity-protects, with a hardware-enforced boundary. Section 2.1.

Ephemeral environment

A complete environment created per pull request and destroyed on merge, replacing a shared staging queue. Section 5.2.

Fulcio

The Sigstore certificate authority that issues short-lived certificates bound to a workload identity. Section 3.2.

Golden path

A supported, opinionated route to production whose defining property is that it is genuinely easier than the alternative. Section 5.3.

Grover's algorithm

A quantum search giving a quadratic speedup, which halves symmetric key strength in the exponent and parallelizes poorly. Section 1.1.

Harvest now, decrypt later

Recording encrypted traffic today and decrypting it once a quantum computer exists. Section 1.1.

HQC

A code-based key encapsulation mechanism selected in March 2025 as a backup, for diversity against a lattice breakthrough. Section 1.2.

Hybrid key exchange

Deriving a session key from both a classical and a post-quantum exchange, so the session survives a flaw in either. Section 1.3.

in-toto attestation

A signed statement about an artifact identified by digest, carrying a typed predicate such as provenance. Section 3.2.

Linear memory

A WebAssembly module's bounds-checked byte array, which it cannot address outside. Section 9.2.

Liveness property

A claim that something good eventually happens. Its counterexample is an infinite trace, usually a cycle. Section 6.4.

M to R

Measurement, in attestation

A cryptographic hash of what was loaded, fixed for a given image, which is why reproducible builds matter. Section 2.2.

Metamorphic relation

A property relating two runs without knowing either answer, used where no oracle exists. Section 6.1.

ML-DSA

Module-Lattice Digital Signature Algorithm, FIPS 204, the general-purpose post-quantum signature. Section 1.2.

ML-KEM

Module-Lattice Key Encapsulation Mechanism, FIPS 203, replacing Diffie-Hellman key agreement. Section 1.2.

Mosca's inequality

If confidentiality lifetime plus migration time exceeds time to a quantum computer, today's data is already exposed. Section 1.1.

Ownership, in Rust

One owner per value, dropped at scope exit, with either one mutable borrow or many shared ones. Section 9.1.

PCR

Platform Configuration Register. A TPM register that can only be extended, giving an append-only ordered boot record. Section 2.2.

Probabilistic error cancellation

Expressing an ideal quantum operation as a signed combination of noisy ones, unbiased at exponential sampling cost. Section 7.2.

Progressive interface

A platform abstraction with a near-empty default, declarative overrides, and a visible escape hatch. Section 5.1.

Property-based test

A test asserting something true for all inputs, with a framework generating inputs to break it. Section 6.1.

Provenance

A signed statement of where an artifact came from: which source, which build system, which configuration. Section 3.2.

QAOA

Quantum Approximate Optimization Algorithm. Alternating cost and mixer layers with classically tuned parameters. Section 7.3.

Reachability analysis

Determining whether a vulnerable code path is callable, which turns hundreds of findings into the few that matter. Section 3.1.

Rekor

The Sigstore append-only transparency log, which makes a short-lived signing certificate durable. Section 3.2.

Reproducible build

A build producing bit-identical output from the same inputs, which lets a third party detect builder tampering. Section 3.2.

Reverse Map Table

The AMD SEV-SNP hardware structure recording page ownership, which blocks replay, remapping, and aliasing. Section 2.1.

S to Z

Safety property

A claim that something bad never happens. Its counterexample is a finite trace. Section 6.4.

SBOM

Software Bill of Materials. A machine-readable inventory of an artifact's components, versions, and relationships. Section 3.1.

SCI

Software Carbon Intensity. Energy times carbon intensity plus embodied emissions, divided by a functional unit. Section 8.1.

Scorecard

A published per-service evaluation against automatic, owned, and fixable checks. Section 5.3.

Secure key release

Releasing a decryption key only to an environment whose attestation satisfies a policy. Section 2.4.

SEAM

The Intel processor mode in which the TDX Module runs, which the hypervisor cannot enter or inspect. Section 2.1.

Shor's algorithm

A quantum algorithm turning factoring and discrete logarithms into period finding, solvable in polynomial time. Section 1.1.

Shrinking

Searching for the smallest input that still fails a property, which is what makes property testing usable. Section 6.1.

Sigstore

Keyless signing using a short-lived certificate bound to a workload identity, made durable by a transparency log. Section 3.2.

SLH-DSA

Stateless Hash-Based Digital Signature Algorithm, FIPS 205, resting on hash security alone. Section 1.2.

SLSA

Supply-chain Levels for Software Artifacts. A graduated framework for build integrity. Section 3.2.

Solovay-Kitaev

The theorem guaranteeing that any single-qubit unitary is approximable from a discrete gate set with polylogarithmic overhead. Section 7.1.

SVID

SPIFFE Verifiable Identity Document. A short-lived credential derived from workload attestation. Section 3.4.

TDX Module

The Intel component in SEAM mode that mediates every transition into and out of a Trust Domain. Section 2.1.

TLA+

A specification language for describing a system as a state machine and model-checking properties over reachable states. Section 6.4.

Transpilation

Translating, placing, routing, optimizing, and scheduling a quantum circuit for specific hardware. Section 7.1.

VEX

Vulnerability Exploitability eXchange. A supplier's machine-readable statement of whether a product is affected, and why. Section 3.1.

VQE

Variational Quantum Eigensolver. Finding a Hamiltonian's lowest eigenvalue through a classically optimized parameterized circuit. Section 7.3.

WASI

The WebAssembly System Interface. Version 0.3, ratified June 2026, rebased it on native asynchronous primitives. Section 9.2.

Zero-noise extrapolation

Running a circuit at amplified noise levels and extrapolating the expectation value back to zero noise. Section 7.2.