Verify a Bell Binding

The claim you are checking

A session key can additionally be bound to a CHSH-verified, Tsirelson-window-validated Bell-game transcript both peers seed and any auditor can verify — after both peers complete the Entanglement Ceremony; off by default. The binding sits above the X25519 + ML-KEM-1024 hybrid floor: breaking a session requires breaking both X25519 and ML-KEM-1024, and the Bell layer never enters that bar.

This is not QKD. Not quantum networking. Not quantum teleportation. We do not violate the no-communication theorem. Above an X25519 + ML-KEM-1024 floor that alone provides confidentiality, a session can fold a Tsirelson-bounded CHSH witness transcript into its key derivation — a deterministic classical co-possession witness, not physical entanglement; security never depends on it.

CHSH in ninety seconds

S = E(a,b) − E(a,b′) + E(a′,b) + E(a′,b′)

|S| ≤ 2        every local-hidden-variable (classical) model
|S| ≤ 2√2      quantum mechanics (Tsirelson bound, ≈ 2.828)

E(x,y) is the expectation of the product of ±1 outcomes under settings x and y. A transcript with S above 2 cannot have been produced by a classical process operating on the public inputs — that is the entire physics you need for this recipe. Anything above the Tsirelson bound (plus numerical slack) is treated as tampering evidence, never as new physics: the session aborts.

Ground truth — read before verifying

Read this section before you run anything. What is built is narrower than the lane’s full design, and this is exactly how.

• The v1 lane is a dual-peer deterministic CHSH ritual — both peers seed a simulation of the Bell-game mathematics, commit, reveal, and independently compute S. The 623-byte canonical transcript is a deterministic function of the two committed seeds: any auditor recomputes it, neither peer can steer it after commit, and a peer that alters it derives a different key and fails the first AEAD. It is a cryptographic construction and is labeled as one.
• The operator-signed transcript lane from real quantum processors is v2 — designed and not active on any deployment. The v2 record pins the backend name, the shot count, the CHSH statistic in fixed point, and a SHA3-256 hash of the circuit source, under an operator tag. The ML-DSA-87 operator-signature lane and the raw-count record are specified and not yet the shape in code; the witness quorum starts dormant — no witness check runs yet. The log itself is a 2-of-3 multi-witness quorum that starts dormant — all three ML-DSA-87 slots and all three external Ed25519 auditor slots hold placeholder keys, so no cosignature is carried and no witness check runs yet. Every root, until the witnesses enroll, is signed by one operator ML-DSA-87 key, which your device verifies against a SHA-384 anchor compiled into the app and cross-checks peer-to-peer through gossiped log roots. Enrolling a witness takes a new app release, by design.
• No phone-to-phone entanglement exists in this design or any deployed system, and the key never depends on the Bell layer for confidentiality — absence or failure degrades to the hybrid floor.

Run the verification recipe

Steps 1 and 2 require a published witness leaf. The relay publishes downgrade and entanglement counters; the per-session leaf endpoint is not yet served, so once QERYX arrives, run steps 3-5 against a transcript you hold — the ceremony shows both peers the same S.

1. Fetch the entanglement-witness leaf for the session ID from the Key Transparency log.
2. Verify the Merkle inclusion proof against the published, signed tree head.
3. Parse the canonical Bell transcript — 623 bytes in the v1 lane.
4. Recompute S from the transcript's measurement counts. Your arithmetic, not ours.
5. Confirm S sits inside the acceptance window (§5). Reject a mismatch against the reported value larger than ±0.005.
6. Where the v2 lane is active: fetch the attestation leaf, verify the operator's ML-DSA-87 signature over the raw counts, and recompute S from those counts independently.

Each step is mechanical. A verifier needs the published log, the pinned operator key, and a CHSH implementation small enough to audit in an afternoon.

Read the acceptance window

References

1. Source tutorial — docs/Q_ENTANGLE_BELL_TUTORIAL_2026_05_29.md; standards drafts authored (draft-qeryx-q-entangle-bell-00/-01); submission packages prepared.
2. Entanglement-Anchored Key Agreement — the construction, in research, and its honest limits.
3. Clauser, Horne, Shimony, Holt — Phys. Rev. Lett. 23, 880 (1969); Tsirelson — Lett. Math. Phys. 4, 93 (1980).
4. The QERYX Threat Model — where the security bar actually sits.