sign: cache signatures by content and reuse them across frames while the price is unchanged

[kaisbaccour]

Problem

KMS signing is most of the production oracle bill (~GBP 29 of GBP 35/day on 2026-09-02). Every /context/* request made its own Cloud HSM AsymmetricSign. The signed price, publish time and expiry come from the pricing frame, the token addresses from the pair, and the session window from the market-hours cache, so two requests for one pair inside one frame sign byte-identical data. And a new frame every ~5s does not mean a new price: an unchanged price was re-signed on every frame because only the two timestamps had moved.

Measured on production logs, 2026-09-01 15:00–15:05 UTC:

signatures built	10,793
distinct inputs (symbol, direction, frame)	4,575
re-signing identical bytes	58%
price frames per symbol	one every ~5s

Change, two layers

1. Content cache within a frame (sign.rs). Signer::sign_context caches by the keccak256 of the packed context, the exact hash that gets signed. A hit returns the earlier signature, over the same bytes and therefore exactly as valid, with the same quote expiry. A miss spawns a detached task that signs and broadcasts the outcome on a watch channel; every request for those bytes waits on it with a bounded timeout. So a client hanging up cannot abort a KMS call it started, and a failure reaches all waiters at once (the dead slot is evicted first, so a retry finds a fresh one) instead of each waiter retrying in series. Eviction: idle TTL of 2 minutes from the last hit, swept every 256 inserts, 16k hard cap that never drops an in-flight sign.

2. Reuse across frames for v5 and v6 (reuse.rs). The handler keeps the last response per (schema, symbol, direction) with a fingerprint of everything signed except the two timestamps: price bytes, session tag and bounds, input and output token, and the v6 NAV ratio. A new frame with the same fingerprint, while the previous quote still has at least signing.reuse_min_remaining_secs (default 10) before its expiry, gets the previous response back unchanged. The taker reads the older publish time and the original expiry in the signed bytes and judges freshness itself. A moving price, a session change or a NAV change signs fresh. v1 and v4 never reuse: they sign no expiry. [signing] reuse_min_remaining_secs = 0 in the runtime TOML disables the layer; the t0.devops config needs no change for the default.

Metrics, declared from boot: oracle_signature_cache_hits_total, oracle_signature_cache_misses_total, oracle_signature_cache_entries, oracle_signature_reuse_total. The KMS bill follows the misses.

Consumers change nothing.

Known limit

If the market-hours calendar failed to load (the server starts anyway and retries hourly) the session window is now, the signed bytes change every second, and layer 1 stops helping until the calendar loads. Still correct, just no saving; the misses counter shows it.

Expected effect

Layer 1 caps signatures at one per pair per frame (~900k/day vs 2.66M today, however hard takers poll). Layer 2 brings a stable pair from one per 5s frame to one per ~20s (expiry is stamped 20 to 30s after the frame). Together the KMS line follows how often prices actually change.

Tests

Layer 1: identical bytes hit, different bytes never do; idle TTL expiry and refresh; cap overflow; 32 overlapping requests (delayed sign) produce one miss and 31 hits; the request that started a sign is aborted mid-flight and the sign is still reused; a failed sign fails all 8 waiters at once then the next request signs fresh; determinism test bypasses the cache; roundtrip fuzz unchanged.
Layer 2: reuse on unchanged price, no reuse under the expiry margin, v4 always fresh, disabled setting signs every frame, v6 requires the same NAV ratio.

cargo test 103 passed, clippy and fmt clean.

🤖 Generated with Claude Code