Verify a Bell Binding

The claim you are checking

Every session key is bound to a CHSH-verified, Tsirelson-window-validated Bell-game transcript both peers seed and any auditor can verify — and to an operator-signed transcript from real quantum processors where the v2 lane is active. The binding sits above the X25519 + ML-KEM-1024 hybrid floor: breaking a session requires breaking both X25519 and ML-KEM-1024, and the Bell layer never enters that bar.

This is not QKD. Not quantum networking. Not quantum teleportation. We do not violate the no-communication theorem. We bind a key-derivation function to a verifiable physical measurement no classical adversary can fabricate in advance.

CHSH in ninety seconds

S = E(a,b) − E(a,b′) + E(a′,b) + E(a′,b′)

|S| ≤ 2        every local-hidden-variable (classical) model
|S| ≤ 2√2      quantum mechanics (Tsirelson bound, ≈ 2.828)

E(x,y) is the expectation of the product of ±1 outcomes under settings x and y. A transcript with S above 2 cannot have been produced by a classical process operating on the public inputs — that is the entire physics you need for this recipe. Anything above the Tsirelson bound (plus numerical slack) is treated as tampering evidence, never as new physics: the session aborts.

Ground truth today — read before verifying

Read this section before you run anything. What ships today is narrower than the lane’s full design, and this is exactly how.

• The shipping v1 lane is a dual-peer deterministic CHSH ritual — both peers seed a simulation of the Bell-game mathematics, commit, reveal, and independently compute S. Forging its 623-byte canonical transcript without running the ritual means producing a hash preimage that satisfies the CHSH constraint; no known classical algorithm does this in sub-exponential time. It is a cryptographic construction and is labeled as one.
• The operator-signed transcript lane from real quantum processors is v2 — it ships in the client and activates per deployment. Where active, transcripts additionally carry ML-DSA-87 signatures over raw measurement counts, and a 2-of-3 multi-witness quorum (verify-only today — operator equivocation is detected, not prevented) plus three external Ed25519 auditor slots that ship dormant, holding placeholder keys until auditors are onboarded; registry expansion is release-gated by design.
• No phone-to-phone entanglement exists in this or any deployed system, and the key never depends on the Bell layer for confidentiality — absence or failure degrades to the hybrid floor.

Run the verification recipe

1. Fetch the entanglement-witness leaf for the session ID from the Key Transparency log.
2. Verify the Merkle inclusion proof against the published, signed tree head.
3. Parse the canonical Bell transcript — 623 bytes in the v1 lane.
4. Recompute S from the transcript's measurement counts. Your arithmetic, not ours.
5. Confirm S sits inside the acceptance window (§5). Reject a mismatch against the reported value larger than ±0.005.
6. Where the v2 lane is active: fetch the attestation leaf, verify the operator's ML-DSA-87 signature over the raw counts, and recompute S from those counts independently.

Each step is mechanical. A verifier needs the published log, the pinned operator key, and a CHSH implementation small enough to audit in an afternoon.

Read the acceptance window

References

1. Source tutorial — docs/Q_ENTANGLE_BELL_TUTORIAL_2026_05_29.md; standards drafts authored (draft-qeryx-q-entangle-bell-00/-01); submission packages prepared.
2. Entanglement-Anchored Key Agreement — the research-preview construction and its honest limits.
3. Clauser, Horne, Shimony, Holt — Phys. Rev. Lett. 23, 880 (1969); Tsirelson — Lett. Math. Phys. 4, 93 (1980).
4. The QERYX Threat Model — where the security bar actually sits.