Production signer

The SHA-256 signer accepts one fused private-seed job and returns the signature plus public key produced from that same one-time key.

Work per job

Each job consumes exactly 1,258 SHA-256 compression blocks:

• one private-seed hash;
• one public-seed PRF;
• sixteen mask PRFs;
• 67 secret PRFs;
• two blocks for each 64-byte secret-segment hash;
• 67 × 15 chain transitions; and
• 34 blocks for the 2,144-byte endpoint hash.

The context captures each signature segment when its chain reaches the message digit, while continuing to endpoint 15 for public-key derivation. Fixed work removes message-digit variation from signer task count.

One cluster

Four contexts share one compression lane. Context state records task dependencies, expected tags, retained signature banks, endpoint state, and result ownership. The cluster:

1. allocates a free context to a complete input job;
2. issues ready tasks fairly without breaking dependencies;
3. routes exact-tag lane returns to the owning context;
4. captures one finished context into a bounded 35-beat framer; and
5. releases the context exactly once on a successful final transfer or an identified error completion.

Global top

The top rotates whole-job admission over three clusters. It never stripes one job across clusters. The registered output merge holds a complete beat stable under backpressure and keeps frames noninterleaved.

There are twelve live contexts, not nine. Three compression lanes can each accept one block per cycle after fill, but scheduler dependencies and framing determine the observed result interval.

Reset and faults

Reset flushes valid ownership, requests, retained frames, releases, and errors. Data registers whose valid bits are clear need not hold a defined value. A job accepted before an uncertain reset must still be treated as a consumed one-time key by the surrounding system.

Cluster faults become identified error completions. The top does not convert a fault into a successful frame and does not release credit more than once.

Current evidence

The signer has production source simulation, finite generated-RTL equivalence, and sustained generated-RTL cycle evidence. Open the evidence matrix for exact commits and nonclaims. Those tiers alone do not establish a U280 clock, resource count, route, or card rate.