Ed25519

Seams preserves the standard seed-derived Ed25519 identity so an explicitly exported key reproduces the registered public key:

d = LE32(y_client + y_server mod 2^256)
h = SHA-512(d)
a = clamp(h[0..32]) mod l

The approved lifecycle protocol computes this relation through actively secure Streaming Yao A/B. Deriver A and Deriver B receive separate client and server contributions. Neither role learns the joined d, a, client signing output, or server signing output.

Lifecycle And Signing

Registration, recovery, signing-share refresh, SigningWorker activation, authorized export, and new-recipient share provisioning use the lifecycle protocol. Normal transaction, message, and delegate-action signing uses the already-activated threshold session:

Client -> Router -> SigningWorker -> Router -> Client

Normal signing performs zero Yao work and makes zero Deriver calls. A presign pool hit takes one client-to-Router request and response. A pool miss uses a prepare request followed by the final signing request.

Export Invariant

Export is a distinct, freshly authorized ceremony. The client receives two recipient-encrypted seed shares, reconstructs d, derives its Ed25519 public key, and requires equality with the registered public key before returning the exported key.

Ordinary activation circuits have no seed-output branch. Recovery cannot reuse the export request shape.