[HackTuah]

A new public module for artifacts too large to hold whole. Nothing in core changes, the callback stays one sign/2, and BeamMCP.Signer.COSE still exports only sign/2. Non-claimed: the signature is pure ML-DSA-87, not HashML-DSA, but no NSA, NIST or IETF text yet names the construction.

Why. COSE.sign/2 and MLDSA87.sign/2 take one binary, so a 10 GB clip, tile bundle or model file would have to be in memory whole; the first new test shows neither takes a stream. A raw signature over a digest would leave the hash algorithm unsigned and the digest indistinguishable from content. BeamMCP.Signer.COSE.HashEnvelope streams the artifact into SHA-384 and signs the digest as an RFC 9995 COSE Hash Envelope.

What it returns. The same N6 single-signer carrier as COSE's, with the digest as its payload: {0: 0xFFFF0003, 1: digest, 2: [protected, {}, null, signature]}.

• Protected header: {1: -50, 2: [258], 4: kid, 16: typ, 258: -43, 259: preimage type}, plus 260: location when given. crit lists 258, so a COSE verifier that does not know hash envelopes refuses instead of taking the digest for content. Label 3 is never written.
• Signature: pure ML-DSA-87 over ["Signature1", protected, h'', digest], made and checked by BeamMCP.Signer.MLDSA87.
• The typ is the host's and required, because a hash envelope has no body and its typ alone names the kind of statement. It must be a lowercase media type ending +cose; the connectome's is refused. The preimage type (259) is per artifact. payload_hash: :sha512 gives -44.
• Memory is one chunk and the hash state. Every option is judged before the first chunk, so a long stream is never hashed and then refused. A seed function is called only after the last chunk, so the seed is not held through the stream.

Evidence

• Red first: the new tests fail before the module exists (21 failures, each an undefined module).
• Green: OTP 28.5.0.8 over OpenSSL 3.5.9 with Elixir 1.20.4, three runs; and over 3.0.13 with Elixir 1.18.4, where the ML-DSA tests are excluded and the refusal runs before any chunk is read.
• 10 GiB: a sparse 10 GiB file streamed in 1 MiB chunks in 14 s locally. The VM's memory grew 6.6 MB (the limit is 64 MiB), the digest equals sha384sum's, and a test-side verifier holding only the envelope and the public key validates it. CI's box leg runs it (mix test --only ten_gb).
• Tampering: with any protected label or the digest changed, the signature is refused, here and in both cross-verifiers.
• Mutants: eleven, and each fails the suite: crit dropped, 258 under another label, a digest length off by one, options judged after the stream, chunks dropped or a non-binary skipped, the seed read early, the 259 or 260 grammar loosened, +cose not required, the connectome typ admitted.
• Outside Elixir: the cross-verify job reads the box leg's envelope with Go (fxamacker/cbor v2.9.6, crypto/mldsa) and Rust (ciborium 0.2.2, coset 0.4.2, aws-lc-rs). coset predates RFC 9995 and refuses the Sign1 over crit [258], the fail-closed refusal crit exists for; the Rust check asserts that, then verifies with coset's ToBeSigned. Both pass locally and both refuse a copy with one signature byte flipped. The job keeps its name, so the required check is unchanged.
• Census: COSE now calls the shared private Keys for the option walk, the key read and the kid, and its answers are unchanged. The hash envelope's :crypto calls are the streaming hash and supports/1 only; it signs only through MLDSA87.sign/2 and does no I/O.

Not yet measured

• The floor leg (OTP 27, Elixir 1.17), the 10 GiB test on the arm64 runner and the cross-verify job on CI. This run is their first with this change.