The secp256k1 Hardware-Weighted Window Challenge

Build the lowest-cost reversible circuit for

|j>|Q>|0^a> -> |j>|Q + T[j]>|0^a>

on secp256k1, where j is a 16-qubit index, Q is a 512-qubit affine point, and T is an evaluator-owned hidden table with T[0] = O. Lower scores are better.

This repository contains three independent challenges. They share a frozen evaluator but have separate participant crates and hardware profiles:

Challenge	Editable submission	Benchmark
Neutral atom	neutral_atom/src/window_point_add/	./benchmark.neutral-atom.sh
Trapped-ion QCCD	trapped_ion/src/window_point_add/	./benchmark.trapped-ion.sh
Superconducting	superconducting/src/window_point_add/	./benchmark.superconducting.sh

Each track crate depends only on hardware_challenge_harness; no track can import or compile another track's submission. The three benchmark manifests enforce the same isolation through their editablePaths.

Quick local check

Run a deterministic 64-shot, one-bit-window smoke test:

./scripts/smoke.sh neutral-atom 1 64

For development artifacts with w=1,2,3, the evaluator cycles through every index, repeatedly, while using an independent hidden table binding per shot. Change the first argument to trapped-ion or superconducting to test another submission. Artifacts and records are written under artifacts/.

The plan's reduced-population pipeline check is available with:

./scripts/smoke.sh neutral-atom 3 16384

Reduced runs are diagnostic only. They cannot qualify or rank a submission.

Authoritative benchmark

Run the selected track's wrapper, for example:

./setup.sh neutral-atom
./benchmark.neutral-atom.sh

The wrapper:

1. compiles only the selected track and the frozen evaluator;
2. runs participant circuit construction without a table binding or sample seed, in a no-network/read-only sandbox when the host provides one;
3. copies out the canonical, track-bound artifact;
4. runs the trusted evaluator with w=16 and 2^20 shots;
5. writes the signed local result record to score.json.

The untrusted build stage never receives concrete table data or official sample randomness. eval imports only the canonical artifact, never participant code. On hosts without Bubblewrap or macOS Seatbelt, the wrapper warns and uses an unconfined local-development fallback; the scoring platform must always provide the sandbox.

Circuit API

The harness allocates the three public registers and invokes one fixed function:

pub fn build(
    builder: &mut CircuitBuilder,
    instance: &WindowInstance<'_>,
    registers: &WindowRegisters<'_>,
) -> Result<(), BuildError>;

WindowInstance exposes curve parameters, the logical table schema, an opaque base-table handle, and an instance digest. It does not expose a table seed, point, coordinate, or entry array.

Participants may derive total evaluator-owned views with TableExpr, then use lookup and the matching unlookup. Every lookup creates a linear lease. Its output is counted as live quantum storage and must be restored to zero by the matching unlookup.

The included readable starter uses the TrailMix arithmetic from the latest main branch and the standard three-access construction:

1. full T[j] for the initial coordinate subtraction;
2. the derived 3*T[j].x field view;
3. full T[j] for the final coordinate update.

It explicitly protects the j=0 infinity branch so the accumulator remains unchanged.

Correctness and score

Each official shot receives an independent hidden lazy-table binding and a valid random accumulator point. The evaluator independently checks the public result, phase, all free_zero obligations, lookup cleanup, and final ancillas. A result is accepted when at most 2,097 of the 2^20 shots fail the union of the cls, pha, and anc categories.

For a track profile h, the score is

Q_peak * mean(weighted logical work under h) / p_success

A forward lookup adds 2^16 CCX-equivalent work; unlookup is free. Hardware weights are exact rationals normalized so CCX = 1 independently in each profile. Scores are comparable only within the same leaderboard.

Repository map

• harness/: frozen builder, opcodes, artifact, validator, lazy tables, simulator, profiles, score, and eval binary.
• neutral_atom/, trapped_ion/, superconducting/: isolated track binaries; only each src/window_point_add/ subtree is participant-editable.
• profiles/: versioned raw timing anchors and derivations.
• hardware-challenge-description.md: normative v1.0 specification.
• PLAN.md: implementation and operational plan.
• scripts/smoke.sh: deterministic non-authoritative local pipeline.

The artifact limit is 250,000,000 operations, 16,384 simultaneously live logical qubits, 1,048,576 classical bits, and condition depth 1,024.

Credits

The starter arithmetic is adapted from the ECDSA.fail point-addition challenge and the public resource-estimation work cited in the specification. See NOTICE for attribution.