Tamper-Evident Provenance for Secure IoT Edge Actuation with Signature-Independent On-Chain Commitments

IoT edge actuation requires records that remain auditable after an incident. We present a crypto-agile provenance framework that keeps decision records and signatures off-chain while a Sui Move contract stores a 32-byte SHA-256 anchor, bounded metadata, and a one-byte scheme identifier. Public keys and their ledger-time validity windows are registered on-chain for historical auditing. For a fixed multi-key endpoint, measured commitment gas is identical across Ed25519, ML-DSA-44, and SLH-DSA-SHA2-128f despite a 267-fold signature-size range; it also remains unchanged across a 3301-fold record-size range. Different endpoint key sets introduce up to 5.66% variation through state-rewrite costs on the evaluated localnet. On a Raspberry Pi 5, the mean of three ML-DSA-44 run medians is 0.65 ms, with a signing-latency coefficient of variation of approximately 78% and substantial upper tails. Additional crossed key-by-message measurements show no nominally significant ML-DSA key-factor result on the Pi, but two nominally significant ML-DSA-44 key-factor results in the desktop sessions, one of which remains significant after Bonferroni correction across 72 comparisons. These results do not establish key independence or a variance upper bound; they support budgeting for observed signing tails while preserving uncertainty about persistent key effects. The framework establishes tamper evidence and conditional endpoint attribution, not physical truthfulness of telemetry or the time a signature was created.