Projective Sampling Issuer

Projective measurement in the computational basis

Each harvest job prepares 128 transmon qubits of an IBM Heron- or Nighthawk-class processor in |0⟩, applies a Hadamard gate to every one of them, and measures. No two-qubit gate is ever applied: the register is a product state, so the 128 outcomes of a shot are, ideally, independent and unbiased.

The readout is a projective (von Neumann) measurement with the rank-one projectors Π_x = |x⟩⟨x|, x ∈ {0,1}¹²⁸. By the Born rule each string occurs with probability p(x) = ⟨ψ|Π_x|ψ⟩ = 2⁻¹²⁸; by the Lüders rule the post-measurement state is Π_x|ψ⟩/√p(x) = |x⟩. The superposition does not survive the measurement. One classical string does. The circuit runs 4,096 times per job (shots), with the register re-initialised between shots.

Native gates

IBM executes instruction-set-architecture circuits verbatim, so the Hadamard is compiled to the native basis by hand: H ≃ R_z(π/2) · √X · R_z(π/2), equal up to a global phase no measurement can observe. Both R_z rotations are physically inert here. The first acts on |0⟩, an eigenstate of Z, contributing only a phase. The last is diagonal in the measurement basis and commutes with every Π_x. On hardware they are virtual frame changes with zero duration. The outcome is decided by a single calibrated π/2 microwave pulse, √X|0⟩ = (|0⟩ − i|1⟩)/√2 up to phase.

Readout physics

Each transmon is dispersively coupled to a readout resonator whose frequency is pulled by ±χ depending on the qubit's state. A probe tone is integrated into a single point in the IQ plane and thresholded. The measurement is not ideal. The assignment errors P(0|1) and P(1|0) are of order 10⁻² and asymmetric, because T₁ relaxation during the integration window drags |1⟩ toward |0⟩. Residual thermal population and readout crosstalk add small biases and correlations. The raw bits are therefore not exactly 2⁻¹²⁸-uniform, and they are never used as keys directly.

Qubits per shot

128 of 120–156 physical

Shots per job

4,096

Bits per job

524,288

Gate depth

1 physical pulse per qubit

Two-qubit gates

0

Bit order

Qiskit little-endian, c[127] … c[0]

Sampling an Ed25519 key from the record

The job's bit stream is every shot's 128-bit string, in shot order. A slice is 256 consecutive bits, exactly two shots. Slices are allocated by an atomic counter, so a slice is used for at most one key, by construction, even with concurrent growers.

Min-entropy, conservatively

We do not assume ideal statistics. We bound them. If every bit satisfies P(b) ≤ ½ + ε given everything before it, the min-entropy of a slice is at least

ε = 0.02 is deliberately worse than typical assignment bias. The bound is what matters: a key is only as unpredictable as the min-entropy behind it, not its Shannon entropy.

Extraction

The seed is seed = SHA-256(e ‖ n), with n a 64-bit big-endian counter. SHA-256 acts as a computational randomness extractor in the random-oracle model. A 256-bit output computed from a source with at least 241.5 bits of min-entropy is computationally indistinguishable from uniform, so the device's bias is washed out and its unpredictability is kept.

Key derivation (RFC 8032)

h = SHA-512(seed). The scalar a is h_0..31, clamped: clearing the three low bits makes a a multiple of the cofactor 8, so a small-order component can never leak into [a]P; clearing bit 255 and setting bit 254 fixes its length for a constant-time ladder. That leaves 2²⁵¹ possible scalars. The public key is A = [a]B on the twisted Edwards curve

The contract address is the 32-byte encoding of A (y, with the sign of x in the top bit), written in base58.

Conditioning on the suffix

The last k base58 digits of an address are A, read as a big-endian integer, mod 58^k. For the suffix psi (k = 3) a trial succeeds with probability 58⁻³ = 1/195,112, so the counter n is geometric with E[n] = 195,112. Rejection sampling leaves the key distributed exactly as before, restricted to the admissible set. Conditioning costs log₂ 195,112 ≈ 17.6 bits of key space and leaves about 2^{251 − 17.6} ≈ 2²³³ admissible keys. The suffix is a signature, not a weakness.

Commitment before use

When a job is harvested, and before any of its slices is used, the root of a Merkle tree over all 2,048 of its slices is published. Leaves and nodes are domain-separated: leaf = SHA-256(0x00 ‖ e_k) and node = SHA-256(0x01 ‖ L ‖ R). By collision resistance the root binds every slice in advance, so no entropy can be chosen after the fact. Each proof page carries an inclusion path of depth ⌈log₂ 2048⌉ = 11.

The Issuer: issuance as one atomic state transition

Grown keypairs are sealed with AES-256-GCM and held in a pool. A reservation is a single atomic script: pop, check never spent, mark reserved. It is linearisable, so no keypair is ever handed out twice. A reservation returns to the pool only after the last valid block height of every transaction it signed has passed, so an expired reservation can never race a launch that is still in flight.

The launch is one Solana v0 transaction, signed by the launcher's wallet and co-signed by the mint key. It holds create_v2 (a Token-2022 mint), the fee-sharing configuration with its shareholder split (launcher 50%, PSI treasury 50%), and a memo psi:<backend>:<job>:<slice>:<counter> that anchors provenance on chain. The mint key signs only a message that contains the split, so the create and the split are one state transition: there is no execution in which the coin exists without it.

Every coin's bonding curve is quoted in $PSI: a pump-coin quote at curve depth 1, its virtual reserves seeded from $PSI's own. Creator fees therefore accrue in $PSI. The launcher's half is theirs to claim. The treasury's half is burned with BurnChecked, so each issuance couples the coin's volume to $PSI supply.

After the create, the mint keypair has no authority left: the mint authority is a program-derived address, and there is no freeze authority to hold. Its seed carries no power, so it is published, and the secret becomes the proof. Anyone holding (shots, offset, counter, path, root) can recompute e, check its inclusion in the root, rebuild the seed, a and A, and compare A with the contract address, in the browser, with no trust in the server.

One irreducible random event, then only checkable steps

1. quantum|0⟩^⊗128 → H^⊗128 → {Π_x} × 4096
2. commitrecord → Merkle root, published before use
3. allocateslice e_k, 256 bits, used once
4. extractSHA-256(e_k ‖ n) → seed
5. sampleEd25519(seed) = A, reject until A ≡ …psi
6. custodyAES-256-GCM pool → linearisable reservation
7. issuecreate_v2 ‖ split ‖ memo, atomic
8. proveseed revealed → browser re-derives every step
9. couplefees in $PSI → 50% launcher, 50% burned

Quantum mechanics supplies exactly one thing: the irreducible randomness of step 1. Everything after it is classical, deterministic and public. That is the property a proof needs. A measurement outcome cannot be reproduced, but everything derived from it can be.

What the physics does and does not certify

Trusted-device, not device-independent

Certifying randomness without trusting the hardware requires a loophole-free Bell test: a CHSH value S > 2 certifies min-entropy against any no-signalling adversary. PSI is a trusted-device QRNG. It trusts IBM's processor and the harvest relay. The mitigations are structural. The job ID and backend are published, the Merkle root precedes every use, and once a job's slices are exhausted its full raw result is published so its SHA-256 can be checked.

Quantum origin is not post-quantum security

Ed25519's discrete logarithm falls to Shor's algorithm on a cryptographically relevant quantum computer. A key born from qubits is no more quantum-resistant than any other key. For a mint key this is moot, because it holds no authority after the create, but it should never be claimed otherwise.

The suffix alone proves nothing

Any computer grinds three base58 characters in about 2×10⁵ tries. What PSI adds is the chain above it, end to end: a committed measurement record, a single-use slice, a deterministic derivation and a public seed, all checkable by anyone.