diff --git a/cloud/src/Security/Hmac.php b/cloud/src/Security/Hmac.php
new file mode 100644
index 0000000..6d0709d
--- /dev/null
+++ b/cloud/src/Security/Hmac.php
@@ -0,0 +1,17 @@
+<?php
+declare(strict_types=1);
+namespace App\Security;
+
+final class Hmac
+{
+    public static function sign(string $secret, string $nonce, string $ts, string $body): string
+    {
+        return hash_hmac('sha256', $nonce . $ts . $body, $secret);
+    }
+
+    public static function verify(string $secret, string $nonce, string $ts, string $body, string $sig): bool
+    {
+        $expected = self::sign($secret, $nonce, $ts, $body);
+        return hash_equals($expected, $sig);
+    }
+}
diff --git a/cloud/tests/HmacTest.php b/cloud/tests/HmacTest.php
new file mode 100644
index 0000000..74af0ba
--- /dev/null
+++ b/cloud/tests/HmacTest.php
@@ -0,0 +1,25 @@
+<?php
+declare(strict_types=1);
+namespace App\Tests;
+use App\Security\Hmac;
+use PHPUnit\Framework\TestCase;
+
+final class HmacTest extends TestCase
+{
+    public function testSignMatchesPythonEdgeContract(): void
+    {
+        // P1-A edge/alert.py::sign = HMAC-SHA256(nonce+ts+body, secret) hex
+        $sig = Hmac::sign('secret', 'n1', '1000.0', '{"a":1}');
+        $expected = hash_hmac('sha256', 'n1' . '1000.0' . '{"a":1}', 'secret');
+        $this->assertSame($expected, $sig);
+        $this->assertSame(64, strlen($sig));
+    }
+
+    public function testVerifyTrueOnMatchFalseOnTamper(): void
+    {
+        $sig = Hmac::sign('secret', 'n1', '1000.0', 'body');
+        $this->assertTrue(Hmac::verify('secret', 'n1', '1000.0', 'body', $sig));
+        $this->assertFalse(Hmac::verify('secret', 'n1', '1000.0', 'body-TAMPERED', $sig));
+        $this->assertFalse(Hmac::verify('wrong', 'n1', '1000.0', 'body', $sig));
+    }
+}