Derive the randomizer exactly as the clause says, from the stored secret material and the message. Do not substitute a random nonce, and do not reseed from a generator. Prove determinism with a test that signs the same message twice and compares the output.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.