NIST P-256 (secp256r1) / ECDSA (ES256) for Ada 2022 with SPARK flow analysis. Constant-time field, scalar, and point arithmetic; Jacobian coordinates with a 4-bit fixed-window scalar multiply; deterministic nonces per RFC 6979; low-S signature normalisation. Stack-resident secrets are wiped at function exit. Suitable for embedded and safety-critical systems. Tests and SPARK proofs live in the nested prove/ crate; from the repo root: cd prove && alr exec – gnatprove -P ../p256_ada.gpr -j0 –mode=flow