2026-04-02 - 2026-04-09
Overview
13 Pull requests merged by 2 users
Merged
#82 refactor(hashing): introduce Hashable derive macro and migrate server types
Merged
#80 Post-quantum crypto and better useragent security
Merged
#78 feat(server): add integrity verification for client keys
Merged
#77 fix(server): replaced postcard-based integrity fingerprint with custom trait providing order-independent hashing
Merged
#76 fix(server): added chain_id check and covered check_shared_constraints with unit tests
Merged
#51 feat(server): integrity envelope engine for EVM grants with HMAC verification
Merged
#46 doc: multi-operator rules
Merged
#43 feat(auth): add seal-key-derived pubkey integrity tags with auth enforcement and unseal backfill
Merged
#47 refactor(server): removed miette out of server
Merged
#49 fix(client): evm-feature's code for new proto
Merged
#50 ci(server-test): ensure that all features are compiling
Merged
#45 refactor(protocol): split into domain-based nesting
Merged
#38 feat(evm): implement EVM sign transaction handling in client and user agent
3 Pull requests proposed by 1 user
Proposed
#53 feat(server): implement useragent_delete_grant hard delete cleanup
Proposed
#81 feat(server): unify integrity API and propagate verified IDs through auth/EVM flows
Proposed
#83 security(server): bind grant revocation state (revoked_at) to integrity hash
11 Issues closed from 1 user
Closed
#58 Client key is not integrity-protected
Closed
#72 Bootstrap token comparison is not constant-time
Closed
#61 User-agent auth accepts integrity-unavailable state while sealed
Closed
#55 Client identity rebinding
Closed
#69 Integrity MAC depends on unordered SQLite row ordering
Closed
#57 Chain id is not verified
Closed
#11 Implement User Agent client library
Closed
#40 Client key replacement attack
Closed
#10 Implement Rust SDK client library
Closed
#3 Implement SDK client registration via User Agent
Closed
#12 Implement Flutter desktop app
27 Issues created by 2 users
Opened
#52 Come up with mechanism for enforcing integrity protection usage
Opened
#54 Encrypted key material not bound to wallet address — cross-wallet signing possible
Opened
#55 Client identity rebinding
Opened
#56 revoked_at is not included in signature
Opened
#57 Chain id is not verified
Opened
#58 Client key is not integrity-protected
Opened
#60 Unseal and bootstrap handshake lack brute-force protection
Opened
#59 Bootstrap token persists on disk with weak file permissions
Opened
#61 User-agent auth accepts integrity-unavailable state while sealed
Opened
#62 Bootstrap token registration lacks proof of possession
Opened
#63 SDK client metadata is silently rewritten on reconnect
Opened
#64 User-agent signing endpoint accepts arbitrary client_id
Opened
#66 Transaction logs can be tampered with to reset rate limits
Opened
#65 Integrity envelopes do not survive root key rotation
Opened
#67 Bootstrap token RNG seeding should be made explicit
Opened
#68 RequestTracker allows arbitrary gaps across request flows
Opened
#69 Integrity MAC depends on unordered SQLite row ordering
Opened
#70 Client approval quorum differs from documented consensus model
Opened
#71 Wallet-access revocation deletes by wallet_id instead of entry id
Opened
#72 Bootstrap token comparison is not constant-time
Opened
#73 Consumed bootstrap token is not zeroized in memory
Opened
#74 Zombie user-agent sessions can block all new client approvals
Opened
#75 Mutation Testing: Missing Test Coverage (~184 genuine gaps from 225 mutations)
Opened
#79 Not using quantum-resistant schemes
Opened
#84 The apocalypse due to casting i64 timestamp to sql Integer(i32)
Opened
#85 push_len_prefixed casts usize to u32 that may truncate on 64-bit targets
Opened
#86 suspicious as keywords
1 Unresolved Conversation
Open
#44
refactor(server): extract shared runtime and implement service install/run in arbiter-server.exe