fix(errors)!: forbid interpolated details in wire-facing internal errors

Merge pull request 'security: batch of fixes' (#95 ) from zeroized-bootstrap-token into main
Reviewed-on: #95
2026-08-09 00:11:03 +02:00 · 2026-06-29 18:00:14 +00:00 · 2026-06-28 12:06:06 +02:00 · 2026-06-27 13:25:27 +02:00 · 2026-06-25 20:09:18 +02:00 · 2026-06-22 17:53:34 +02:00
37 changed files with 1023 additions and 405 deletions
--- a/protobufs/operator/vault/unseal.proto
+++ b/protobufs/operator/vault/unseal.proto
@@ -20,6 +20,7 @@ enum UnsealResult {
  UNSEAL_RESULT_SUCCESS = 1;
  UNSEAL_RESULT_INVALID_KEY = 2;
  UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
+  UNSEAL_RESULT_LOCKED_OUT = 4;
 }

 message Request {
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -2,15 +2,6 @@
 # It is not intended for manual editing.
 version = 4

-[[package]]
-name = "addr2line"
-version = "0.25.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
-dependencies = [
- "gimli",
-]
-
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -771,6 +762,7 @@ dependencies = [
 "proptest",
 "prost-types",
 "rand 0.10.1",
+ "rand_core 0.10.1",
 "rcgen",
 "restructed",
 "rstest",
@@ -1165,30 +1157,6 @@ dependencies = [
 "tower-service",
 ]

-[[package]]
-name = "backtrace"
-version = "0.3.76"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
- "windows-link",
-]
-
-[[package]]
-name = "backtrace-ext"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "537beee3be4a18fb023b570f80e3ae28003db9167a751266b259926e25539d50"
-dependencies = [
- "backtrace",
-]
-
 [[package]]
 name = "base16ct"
 version = "0.2.0"
@@ -2364,12 +2332,6 @@ dependencies = [
 "wasip3",
 ]

-[[package]]
-name = "gimli"
-version = "0.32.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
-
 [[package]]
 name = "glob"
 version = "0.3.3"
@@ -2827,12 +2789,6 @@ dependencies = [
 "serde",
 ]

-[[package]]
-name = "is_ci"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7655c9839580ee829dfacba1d1278c2b7883e50a277ff7541299489d6bdfdc45"
-
 [[package]]
 name = "itertools"
 version = "0.10.5"
@@ -3168,18 +3124,9 @@ version = "7.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f98efec8807c63c752b5bd61f862c165c115b0a35685bdcfd9238c7aeb592b7"
 dependencies = [
- "backtrace",
- "backtrace-ext",
 "cfg-if",
 "miette-derive",
- "owo-colors",
- "serde",
- "supports-color",
- "supports-hyperlinks",
- "supports-unicode",
- "terminal_size",
- "textwrap",
- "unicode-width 0.1.14",
+ "unicode-width",
 ]

 [[package]]
@@ -3401,15 +3348,6 @@ dependencies = [
 "smallvec",
 ]

-[[package]]
-name = "object"
-version = "0.37.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "oid-registry"
 version = "0.8.1"
@@ -3437,12 +3375,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"

-[[package]]
-name = "owo-colors"
-version = "4.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
-
 [[package]]
 name = "parity-scale-codec"
 version = "3.7.5"
@@ -4246,12 +4178,6 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48fd7bd8a6377e15ad9d42a8ec25371b94ddc67abe7c8b9127bec79bebaaae18"

-[[package]]
-name = "rustc-demangle"
-version = "0.1.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.2"
@@ -4891,27 +4817,6 @@ version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

-[[package]]
-name = "supports-color"
-version = "3.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c64fc7232dd8d2e4ac5ce4ef302b1d81e0b80d055b9d77c7c4f51f6aa4c867d6"
-dependencies = [
- "is_ci",
-]
-
-[[package]]
-name = "supports-hyperlinks"
-version = "3.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e396b6523b11ccb83120b115a0b7366de372751aa6edf19844dfb13a6af97e91"
-
-[[package]]
-name = "supports-unicode"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7401a30af6cb5818bb64852270bb722533397edcfc7344954a38f420819ece2"
-
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -4985,16 +4890,6 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

-[[package]]
-name = "terminal_size"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
-dependencies = [
- "rustix",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "test-log"
 version = "0.2.20"
@@ -5026,16 +4921,6 @@ dependencies = [
 "test-log-core",
 ]

-[[package]]
-name = "textwrap"
-version = "0.16.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c13547615a44dc9c452a8a534638acdf07120d4b6847c8178705da06306a3057"
-dependencies = [
- "unicode-linebreak",
- "unicode-width 0.2.2",
-]
-
 [[package]]
 name = "thiserror"
 version = "2.0.18"
@@ -5475,12 +5360,6 @@ version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"

-[[package]]
-name = "unicode-linebreak"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
-
 [[package]]
 name = "unicode-segmentation"
 version = "1.13.2"
@@ -5493,12 +5372,6 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"

-[[package]]
-name = "unicode-width"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
-
 [[package]]
 name = "unicode-xid"
 version = "0.2.6"
@@ -6261,18 +6134,18 @@ dependencies = [

 [[package]]
 name = "zeroize"
-version = "1.8.2"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 dependencies = [
 "zeroize_derive",
 ]

 [[package]]
 name = "zeroize_derive"
-version = "1.4.3"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
 dependencies = [
 "proc-macro2",
 "quote",
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -15,12 +15,16 @@ k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
 kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 hmac = "0.13.0"
-miette = { version = "7.6.0", features = ["fancy", "serde"] }
+# `derive` only: nothing renders a miette Report yet, so `fancy` would drag the
+# terminal-formatting stack (owo-colors, supports-color, textwrap, terminal_size)
+# into the headless daemon. A CLI that wants pretty output enables `fancy` itself.
+miette = "7.6.0"
 ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
 mutants = "0.0.4"
 prost = "0.14.3"
 prost-types = { version = "0.14.3", features = ["chrono"] }
 rand = "0.10.1"
+rand_core = "0.10.1"
 rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
 rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
@@ -76,6 +80,7 @@ needless_pass_by_ref_mut = "allow"
 pub_underscore_fields = "allow"
 redundant_pub_crate = "allow" 
 uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {})
+too-many-lines = "allow" # this is a very common pattern in server code, and it's not always possible to break it down into smaller modules without hurting readability

 # restriction lints
 alloc_instead_of_core = "warn"
--- a/server/crates/arbiter-client/src/auth.rs
+++ b/server/crates/arbiter-client/src/auth.rs
@@ -23,6 +23,7 @@ use arbiter_proto::{
 use chrono::DateTime;

 #[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
 pub enum AuthError {
    #[error("Server sent invalid auth challenge")]
    InvalidChallenge,
@@ -100,7 +101,7 @@ async fn send_auth_challenge_solution(
    key: &SigningKey,
    challenge: AuthChallenge,
 ) -> Result<(), AuthError> {
-    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos as i64);
+    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos.cast_signed());
    let challenge = authn::AuthChallenge {
        nonce: *challenge
            .random
--- a/server/crates/arbiter-client/src/client.rs
+++ b/server/crates/arbiter-client/src/client.rs
@@ -17,6 +17,7 @@ use tokio_stream::wrappers::ReceiverStream;
 use tonic::transport::ClientTlsConfig;

 #[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
 pub enum ArbiterClientError {
    #[error("Authentication error")]
    Authentication(#[from] AuthError),
--- a/server/crates/arbiter-client/src/storage.rs
+++ b/server/crates/arbiter-client/src/storage.rs
@@ -4,6 +4,7 @@ use arbiter_proto::home_path;
 use std::path::{Path, PathBuf};

 #[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
 pub enum StorageError {
    #[error("Invalid signing key length in storage: expected {expected} bytes, got {actual} bytes")]
    InvalidKeyLength { expected: usize, actual: usize },
--- a/server/crates/arbiter-client/src/transport.rs
+++ b/server/crates/arbiter-client/src/transport.rs
@@ -11,6 +11,7 @@ pub fn next_request_id() -> i32 {
 }

 #[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
 pub enum ClientSignError {
    #[error("Transport channel closed")]
    ChannelClosed,
--- a/server/crates/arbiter-proto/src/url.rs
+++ b/server/crates/arbiter-proto/src/url.rs
@@ -30,6 +30,7 @@ impl Display for ArbiterUrl {
 }

 #[derive(Debug, thiserror::Error, miette::Diagnostic)]
+#[non_exhaustive]
 pub enum Error {
    #[error("Invalid URL scheme, expected '{ARBITER_URL_SCHEME}://'")]
    #[diagnostic(
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -31,6 +31,7 @@ diesel_migrations = { version = "2.3.2", features = ["sqlite"] }
 async-trait.workspace = true
 tokio-stream.workspace = true
 rand.workspace = true
+rand_core.workspace = true
 rcgen.workspace = true
 chrono.workspace = true
 kameo.workspace = true
--- a/server/crates/arbiter-server/src/actors/bootstrap.rs
+++ b/server/crates/arbiter-server/src/actors/bootstrap.rs
@@ -1,29 +1,48 @@
 use crate::db::{self, DatabasePool, schema};
+use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use arbiter_proto::{BOOTSTRAP_PATH, home_path};

 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
-use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
+use rand::{RngExt, distr::Alphanumeric, rngs::SysRng};
+use rand_core::UnwrapErr;
+use std::path::{Path, PathBuf};
 use subtle::ConstantTimeEq as _;
 use thiserror::Error;
+use tracing::warn;

 const TOKEN_LENGTH: usize = 64;

-pub async fn generate_token() -> Result<String, std::io::Error> {
-    let rng: StdRng = make_rng();
+async fn write_token_file(path: &Path, content: &str) -> Result<(), std::io::Error> {
+    tokio::fs::write(path, content.as_bytes()).await?;

-    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
-        String::default(),
-        |mut accum, char| {
-            accum += char.to_string().as_str();
-            accum
-        },
-    );
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        tokio::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600)).await?;
+    }

-    tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;
+    Ok(())
+}

-    Ok(token)
+async fn generate_token(path: &Path) -> Result<SafeCell<[u8; TOKEN_LENGTH]>, std::io::Error> {
+    let mut cell = SafeCell::new([0u8; TOKEN_LENGTH]);
+    {
+        let mut buf = cell.write();
+        for (slot, b) in buf
+            .iter_mut()
+            .zip(UnwrapErr(SysRng).sample_iter(Alphanumeric))
+        {
+            *slot = b;
+        }
+    }
+
+    let token_str = cell.read_inline(|buf| String::from_utf8_lossy(buf.as_ref()).into_owned());
+
+    write_token_file(path, &token_str).await?;
+
+    Ok(cell)
 }

 #[derive(Error, Debug)]
@@ -40,7 +59,8 @@ pub enum Error {

 #[derive(Actor)]
 pub struct Bootstrapper {
-    token: Option<String>,
+    token: Option<SafeCell<[u8; TOKEN_LENGTH]>>,
+    token_path: Option<PathBuf>,
 }

 impl Bootstrapper {
@@ -54,34 +74,37 @@ impl Bootstrapper {
                .await?
        };

-        let token = if row_count == 0 {
-            let token = generate_token().await?;
-            Some(token)
+        let (token, token_path) = if row_count == 0 {
+            let path = home_path()?.join(BOOTSTRAP_PATH);
+            let token = generate_token(&path).await?;
+            (Some(token), Some(path))
        } else {
-            None
+            (None, None)
        };

-        Ok(Self { token })
+        Ok(Self { token, token_path })
+    }
+}
+
+impl Bootstrapper {
+    fn is_correct_token(&mut self, token: &[u8]) -> bool {
+        self.token.as_mut().is_some_and(|expected| {
+            expected.read_inline(|exp| bool::from(exp.as_ref().ct_eq(token)))
+        })
    }
 }

 #[messages]
 impl Bootstrapper {
    #[message]
-    pub fn is_correct_token(&self, token: String) -> bool {
-        self.token.as_ref().is_some_and(|expected| {
-            let expected_bytes = expected.as_bytes();
-            let token_bytes = token.as_bytes();
-
-            let choice = expected_bytes.ct_eq(token_bytes);
-            bool::from(choice)
-        })
-    }
-
-    #[message]
-    pub fn consume_token(&mut self, token: String) -> bool {
-        if self.is_correct_token(token) {
+    pub async fn consume_token(&mut self, token: Vec<u8>) -> bool {
+        if self.is_correct_token(&token) {
            self.token = None;
+            if let Some(path) = self.token_path.take()
+                && let Err(e) = tokio::fs::remove_file(&path).await
+            {
+                warn!(error = ?e, path = ?path, "Failed to delete bootstrap token file after consumption");
+            }
            true
        } else {
            false
@@ -92,7 +115,9 @@ impl Bootstrapper {
 #[messages]
 impl Bootstrapper {
    #[message]
-    pub fn get_token(&self) -> Option<String> {
-        self.token.clone()
+    pub fn get_token(&mut self) -> Option<String> {
+        self.token
+            .as_mut()
+            .map(|cell| cell.read_inline(|buf| String::from_utf8_lossy(buf.as_ref()).into_owned()))
    }
 }
--- a/server/crates/arbiter-server/src/actors/evm/mod.rs
+++ b/server/crates/arbiter-server/src/actors/evm/mod.rs
@@ -1,6 +1,6 @@
 use crate::{
    actors::vault::{CreateNew, Decrypt, Vault},
-    crypto::integrity,
+    crypto::integrity::{self, Integrable},
    db::{
        DatabaseError, DatabasePool,
        models::{self},
@@ -25,14 +25,35 @@ use diesel::{
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, actor::ActorRef, messages};
 use rand::{SeedableRng, rng, rngs::StdRng};
+use tracing::error;

 pub use crate::evm::safe_signer;

+/// Integrity guard that binds a wallet's encrypted key ID to its Ethereum address.
+/// Both fields are included in the HMAC — swapping `aead_encrypted_id` in the DB
+/// invalidates the envelope MAC, and the AEAD ciphertext is also bound to `address`
+/// as AAD, so decryption fails too.
+#[derive(arbiter_macros::Hashable)]
+struct EvmWalletIntegrity {
+    aead_encrypted_id: i32,
+    address: Address,
+}
+
+impl Integrable for EvmWalletIntegrity {
+    const KIND: &'static str = "evm_wallet";
+}
+
 #[derive(Debug, thiserror::Error)]
 pub enum SignTransactionError {
    #[error("Wallet not found")]
    WalletNotFound,

+    #[error("Decrypted key does not match requested wallet address")]
+    KeyAddressMismatch,
+
+    #[error("Internal signing error")]
+    Internal,
+
    #[error("Database error: {0}")]
    Database(#[from] DatabaseError),

@@ -64,6 +85,12 @@ pub enum Error {
    Integrity(#[from] integrity::Error),
 }

+impl From<diesel::result::Error> for Error {
+    fn from(e: diesel::result::Error) -> Self {
+        Self::Database(DatabaseError::from(e))
+    }
+}
+
 #[derive(Actor)]
 pub struct EvmActor {
    pub vault: ActorRef<Vault>,
@@ -97,20 +124,39 @@ impl EvmActor {

        let aead_id: i32 = self
            .vault
-            .ask(CreateNew { plaintext })
+            .ask(CreateNew {
+                plaintext,
+                aad: address.as_slice().to_vec(),
+            })
            .await
            .map_err(|_| Error::VaultSend)?;

        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let wallet_id = insert_into(schema::evm_wallet::table)
-            .values(&models::NewEvmWallet {
-                address: address.as_slice().to_vec(),
-                aead_encrypted_id: aead_id,
+        let wallet_id = conn
+            .exclusive_transaction(async |conn| {
+                let wallet_id: i32 = insert_into(schema::evm_wallet::table)
+                    .values(&models::NewEvmWallet {
+                        address: address.as_slice().to_vec(),
+                        aead_encrypted_id: aead_id,
+                    })
+                    .returning(schema::evm_wallet::id)
+                    .get_result(conn)
+                    .await
+                    .map_err(DatabaseError::from)
+                    .map_err(Error::Database)?;
+
+                integrity::sign_entity(
+                    conn,
+                    &self.vault,
+                    &EvmWalletIntegrity { address, aead_encrypted_id: aead_id },
+                    wallet_id,
+                )
+                .await
+                .map_err(Error::Integrity)?;
+
+                Ok::<i32, Error>(wallet_id)
            })
-            .returning(schema::evm_wallet::id)
-            .get_result(&mut conn)
-            .await
-            .map_err(DatabaseError::from)?;
+            .await?;

        Ok((wallet_id, address))
    }
@@ -160,29 +206,14 @@ impl EvmActor {
    }

    #[message]
-    #[expect(clippy::unused_async, reason = "reserved for impl")]
-    pub async fn operator_delete_grant(&mut self, _grant_id: i32) -> Result<(), Error> {
-        // let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        // let vault = self.vault.clone();
-
-        // diesel_async::AsyncConnection::transaction(&mut conn, |conn| {
-        //     Box::pin(async move {
-        //         diesel::update(schema::evm_basic_grant::table)
-        //             .filter(schema::evm_basic_grant::id.eq(grant_id))
-        //             .set(schema::evm_basic_grant::revoked_at.eq(SqliteTimestamp::now()))
-        //             .execute(conn)
-        //             .await?;
-
-        //         let signed = integrity::evm::load_signed_grant_by_basic_id(conn, grant_id).await?;
-
-        //         diesel::result::QueryResult::Ok(())
-        //     })
-        // })
-        // .await
-        // .map_err(DatabaseError::from)?;
-
-        // Ok(())
-        todo!()
+    pub async fn useragent_delete_grant(
+        &mut self,
+        grant_id: i32,
+    ) -> Result<(), Error> {
+        self.engine
+            .revoke_grant(grant_id)
+            .await
+            .map_err(Error::from)
    }

    #[message]
@@ -256,16 +287,51 @@ impl EvmActor {
            .ok_or(SignTransactionError::WalletNotFound)?;
        drop(conn);

+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+        let attestation = integrity::verify_entity(
+            &mut conn,
+            &self.vault,
+            &EvmWalletIntegrity {
+                address: wallet_address,
+                aead_encrypted_id: wallet.aead_encrypted_id,
+            },
+            wallet.id,
+        )
+        .await
+        .map_err(|e| {
+            error!(?e, wallet_id = wallet.id, "EVM wallet integrity check failed");
+            SignTransactionError::Internal
+        })?;
+        drop(conn);
+
+        if attestation != integrity::AttestationStatus::Attested {
+            error!(
+                wallet_id = wallet.id,
+                "EVM wallet integrity unavailable; refusing to sign"
+            );
+            return Err(SignTransactionError::Internal);
+        }
+
        let raw_key: SafeCell<Vec<u8>> = self
            .vault
            .ask(Decrypt {
                aead_id: wallet.aead_encrypted_id,
+                aad: wallet.address.clone(),
            })
            .await
            .map_err(|_| SignTransactionError::VaultSend)?;

        let signer = safe_signer::SafeSigner::from_cell(raw_key)?;

+        if signer.address() != wallet_address {
+            error!(
+                expected = %wallet_address,
+                actual = %signer.address(),
+                "Decrypted private key address does not match requested wallet"
+            );
+            return Err(SignTransactionError::KeyAddressMismatch);
+        }
+
        self.engine
            .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
            .await?;
--- a/server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs
+++ b/server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs
@@ -11,7 +11,9 @@ use kameo::{
    prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
    reply::ReplySender,
 };
-use std::ops::ControlFlow;
+use std::{ops::ControlFlow, time::Duration};
+
+const APPROVAL_TIMEOUT: Duration = Duration::from_secs(30);

 pub struct Args {
    pub client: ClientProfile,
@@ -64,6 +66,14 @@ impl Actor for ClientApprovalController {
                .await;
        }

+        let weak = actor_ref.downgrade();
+        tokio::spawn(async move {
+            tokio::time::sleep(APPROVAL_TIMEOUT).await;
+            if let Some(r) = weak.upgrade() {
+                let _ = r.tell(OnApprovalTimeout {}).await;
+            }
+        });
+
        Ok(this)
    }

@@ -104,4 +114,14 @@ impl ClientApprovalController {
            ctx.stop();
        }
    }
+
+    /// Fired after `APPROVAL_TIMEOUT` elapses. Any operator that hasn't responded
+    /// by then is treated as a denial to prevent zombie sessions from blocking the flow.
+    #[message(ctx)]
+    pub fn on_approval_timeout(&mut self, ctx: &mut Context<Self, ()>) {
+        if self.pending > 0 {
+            self.send_reply(Ok(false));
+            ctx.stop();
+        }
+    }
 }
--- a/server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
+++ b/server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
@@ -20,6 +20,8 @@ pub mod client_connect_approval;

 pub struct FlowCoordinator {
    pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
+    /// Maps DB `client_id` → `ActorId` for fast connected-client lookup.
+    client_ids: HashMap<i32, ActorId>,
    operator_registry: ActorRef<OperatorRegistry>,
 }

@@ -27,6 +29,7 @@ impl FlowCoordinator {
    pub fn new(operator_registry: ActorRef<OperatorRegistry>) -> Self {
        Self {
            clients: HashMap::default(),
+            client_ids: HashMap::default(),
            operator_registry,
        }
    }
@@ -48,6 +51,7 @@ impl Actor for FlowCoordinator {
        _: ActorStopReason,
    ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
        if self.clients.remove(&id).is_some() {
+            self.client_ids.retain(|_, actor_id| *actor_id != id);
            info!(
                ?id,
                actor = "FlowCoordinator",
@@ -75,14 +79,28 @@ impl FlowCoordinator {
    #[message(ctx)]
    pub async fn register_client(
        &mut self,
+        client_id: i32,
        actor: ActorRef<ClientSession>,
        ctx: &mut Context<Self, ()>,
    ) {
-        info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected");
+        info!(id = %actor.id(), client_id, actor = "FlowCoordinator", event = "client.connected");
        ctx.actor_ref().link(&actor).await;
+        self.client_ids.insert(client_id, actor.id());
        self.clients.insert(actor.id(), actor);
    }

+    #[message]
+    pub fn is_client_connected(&self, client_id: i32) -> bool {
+        self.client_ids.contains_key(&client_id)
+    }
+
+    /// Returns the DB `client_ids` of all currently connected SDK clients.
+    /// Used by operator sessions on startup to seed their approved-client set.
+    #[message]
+    pub fn get_connected_client_ids(&self) -> Vec<i32> {
+        self.client_ids.keys().copied().collect()
+    }
+
    #[message(ctx)]
    pub async fn request_client_approval(
        &mut self,
--- a/server/crates/arbiter-server/src/actors/vault/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault/mod.rs
@@ -22,7 +22,7 @@ use hmac::{KeyInit as _, Mac as _};
 use kameo::{Actor, Reply, actor::ActorRef, messages};
 use kameo_actors::message_bus::{MessageBus, Publish};
 use strum::{EnumDiscriminants, IntoDiscriminant};
-use tracing::{error, info};
+use tracing::{error, info, warn};

 pub mod events {

@@ -46,6 +46,8 @@ pub enum Error {
    Sealed,
    #[error("Invalid key provided")]
    InvalidKey,
+    #[error("Vault locked: too many failed unseal attempts")]
+    LockedOut,

    #[error("Requested aead entry not found")]
    NotFound,
@@ -61,6 +63,9 @@ pub enum Error {

    #[error("Broken database")]
    BrokenDatabase,
+
+    #[error("Integrity key version mismatch: envelope uses key {envelope}, current key is {current}")]
+    KeyVersionMismatch { envelope: i32, current: i32 },
 }

 struct Unsealed {
@@ -79,6 +84,8 @@ enum State {
    Unsealed(Unsealed),
 }

+const MAX_UNSEAL_ATTEMPTS: u32 = 5;
+
 /// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed).
 ///
 /// Provides API for encrypting and decrypting data using the vault root key.
@@ -88,6 +95,7 @@ pub struct Vault {
    db: db::DatabasePool,
    state: State,
    events: ActorRef<MessageBus>,
+    unseal_failures: u32,
 }

 #[messages]
@@ -110,7 +118,7 @@ impl Vault {
            }
        };

-        Ok(Self { db, state, events })
+        Ok(Self { db, state, events, unseal_failures: 0 })
    }

    // Exclusive transaction to avoid race condtions if multiple vaults write
@@ -219,6 +227,10 @@ impl Vault {

    #[message]
    pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
+        if self.unseal_failures >= MAX_UNSEAL_ATTEMPTS {
+            return Err(Error::LockedOut);
+        }
+
        let State::Sealed {
            root_key_history_id,
        } = &self.state
@@ -251,13 +263,27 @@ impl Vault {
                Error::BrokenDatabase
            })?;

-        seal_key
+        if seal_key
            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
-            .map_err(|err| {
-                error!(?err, "Failed to unseal root key: invalid seal key");
-                Error::InvalidKey
-            })?;
+            .is_err()
+        {
+            self.unseal_failures += 1;
+            if self.unseal_failures >= MAX_UNSEAL_ATTEMPTS {
+                error!(
+                    attempts = self.unseal_failures,
+                    "Vault locked: maximum failed unseal attempts reached"
+                );
+            } else {
+                warn!(
+                    attempts = self.unseal_failures,
+                    remaining = MAX_UNSEAL_ATTEMPTS - self.unseal_failures,
+                    "Failed unseal attempt"
+                );
+            }
+            return Err(Error::InvalidKey);
+        }

+        self.unseal_failures = 0;
        self.state = State::Unsealed(Unsealed {
            root_key_history_id: current_key.id,
            root_key: KeyCell::try_from(root_key).map_err(|err| {
@@ -272,8 +298,10 @@ impl Vault {
        Ok(())
    }

+    /// Decrypts an AEAD entry. The `aad` must match the value used at encryption time;
+    /// a mismatch causes authentication failure, preventing cross-wallet key swaps.
    #[message]
-    pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
+    pub async fn decrypt(&mut self, aead_id: i32, aad: Vec<u8>) -> Result<SafeCell<Vec<u8>>, Error> {
        let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?;

        let row: models::AeadEncrypted = {
@@ -295,13 +323,15 @@ impl Vault {
            Error::BrokenDatabase
        })?;
        let mut output = SafeCell::new(row.ciphertext);
-        root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?;
+        root_key.decrypt_in_place(&nonce, &aad, &mut output)?;
        Ok(output)
    }

+    /// Creates a new `aead_encrypted` entry and returns its ID.
+    /// The `aad` is bound into the ciphertext and must be reproduced exactly at decryption time.
    // Creates new `aead_encrypted` entry in the database and returns it's ID
    #[message]
-    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>) -> Result<i32, Error> {
+    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>, aad: Vec<u8>) -> Result<i32, Error> {
        let Unsealed {
            root_key,
            root_key_history_id,
@@ -313,7 +343,7 @@ impl Vault {

        let mut ciphertext_buffer = plaintext.write();
        let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut();
-        root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?;
+        root_key.encrypt_in_place(&nonce, &aad, &mut *ciphertext_buffer)?;

        let ciphertext = std::mem::take(ciphertext_buffer);

@@ -346,12 +376,10 @@ impl Vault {
            root_key_history_id,
        } = Self::expect_unsealed(&mut self.state)?;

-        let mut hmac = root_key
-            .0
-            .read_inline(|k| match HmacSha256::new_from_slice(k) {
-                Ok(v) => v,
-                Err(_) => unreachable!("HMAC accepts keys of any size"),
-            });
+        let mut hmac = root_key.0.read_inline(|k| {
+            HmacSha256::new_from_slice(k)
+                .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
+        });
        hmac.update(&root_key_history_id.to_be_bytes());
        hmac.update(&mac_input);

@@ -372,15 +400,16 @@ impl Vault {
        } = Self::expect_unsealed(&mut self.state)?;

        if *root_key_history_id != key_version {
-            return Ok(false);
+            return Err(Error::KeyVersionMismatch {
+                envelope: key_version,
+                current: *root_key_history_id,
+            });
        }

-        let mut hmac = root_key
-            .0
-            .read_inline(|k| match HmacSha256::new_from_slice(k) {
-                Ok(v) => v,
-                Err(_) => unreachable!("HMAC accepts keys of any size"),
-            });
+        let mut hmac = root_key.0.read_inline(|k| {
+            HmacSha256::new_from_slice(k)
+                .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
+        });
        hmac.update(&key_version.to_be_bytes());
        hmac.update(&mac_input);

@@ -423,12 +452,13 @@ mod tests {
    async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
        let db = db::create_test_pool().await;
        let mut actor = bootstrapped_actor(&db).await;
-        let root_key_history_id = match actor.state {
-            State::Unsealed(Unsealed {
-                root_key_history_id,
-                ..
-            }) => root_key_history_id,
-            _ => panic!("expected unsealed state"),
+
+        let State::Unsealed(Unsealed {
+            root_key_history_id,
+            ..
+        }) = actor.state
+        else {
+            panic!("expected unsealed state")
        };

        let n1 = Vault::get_new_nonce(&db, root_key_history_id)
@@ -440,15 +470,15 @@ mod tests {
        assert!(n2.to_vec() > n1.to_vec(), "nonce must increase");

        let mut conn = db.get().await.unwrap();
-        let root_row: models::RootKeyHistory = schema::root_key_history::table
-            .select(models::RootKeyHistory::as_select())
+        let root_row: RootKeyHistory = schema::root_key_history::table
+            .select(RootKeyHistory::as_select())
            .first(&mut conn)
            .await
            .unwrap();
        assert_eq!(root_row.data_encryption_nonce, n2.to_vec());

        let id = actor
-            .create_new(SafeCell::new(b"post-interleave".to_vec()))
+            .create_new(SafeCell::new(b"post-interleave".to_vec()), b"test-aad".to_vec())
            .await
            .unwrap();
        let row: models::AeadEncrypted = schema::aead_encrypted::table
--- a/server/crates/arbiter-server/src/crypto/integrity/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/integrity/v1.rs
@@ -13,6 +13,7 @@ use diesel_async::{AsyncConnection, RunQueryDsl};
 use hmac::Hmac;
 use kameo::{actor::ActorRef, error::SendError};
 use sha2::{Digest as _, Sha256};
+use tracing::error;

 #[derive(Debug, thiserror::Error)]
 pub enum Error {
@@ -121,7 +122,10 @@ pub async fn sign_entity<E: Integrable>(
            .await
            .map_err(|err| match err {
                SendError::HandlerError(inner) => Error::Vault(inner),
-                _ => Error::VaultSend,
+                other => {
+                    error!(?other, "Vault unreachable while signing integrity envelope");
+                    Error::VaultSend
+                }
            })?;

    insert_into(integrity_envelope::table)
@@ -192,13 +196,21 @@ pub async fn verify_entity<E: Integrable>(
        Ok(false) => Err(Error::MacMismatch {
            entity_kind: E::KIND,
        }),
-        Err(SendError::HandlerError(vault::Error::Sealed)) => Ok(AttestationStatus::Unavailable),
-        Err(_) => Err(Error::VaultSend),
+        Err(SendError::HandlerError(
+            vault::Error::Sealed | vault::Error::KeyVersionMismatch { .. },
+        )) => Ok(AttestationStatus::Unavailable),
+        Err(other) => {
+            error!(?other, "Vault unreachable while verifying integrity envelope");
+            Err(Error::VaultSend)
+        }
    }
 }

 pub async fn is_signing_available(vault: &ActorRef<Vault>) -> Result<bool, Error> {
-    let state = vault.ask(GetState).await.map_err(|_| Error::VaultSend)?;
+    let state = vault.ask(GetState).await.map_err(|err| {
+        error!(?err, "Vault unreachable while querying signing availability");
+        Error::VaultSend
+    })?;
    Ok(matches!(state, vault::VaultState::Unsealed))
 }

@@ -331,4 +343,47 @@ mod tests {
            .unwrap_err();
        assert!(matches!(err, Error::MacMismatch { .. }));
    }
+
+    #[tokio::test]
+    async fn key_version_mismatch_returns_unavailable_not_mac_mismatch() {
+        use crate::db::schema::integrity_envelope;
+        use super::AttestationStatus;
+
+        const ENTITY_ID: &[u8] = b"entity-id-rotation-test";
+
+        let db = db::create_test_pool().await;
+        let vault = bootstrapped_vault(&db).await;
+        let mut conn = db.get().await.unwrap();
+
+        let entity = DummyEntity {
+            payload_version: 1,
+            payload: b"payload-v1".to_vec(),
+        };
+
+        sign_entity(&mut conn, &vault, &entity, ENTITY_ID)
+            .await
+            .unwrap();
+
+        // Simulate key rotation: update the stored key_version to a stale value.
+        // After real rotation the vault's root_key_history_id would advance, but
+        // here we achieve the same mismatch by back-dating the envelope's key_version.
+        diesel::update(integrity_envelope::table)
+            .filter(integrity_envelope::entity_kind.eq("dummy_entity"))
+            .filter(integrity_envelope::entity_id.eq(ENTITY_ID))
+            .set(integrity_envelope::key_version.eq(0))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+
+        // Must NOT error — version mismatch is Unavailable, not tampered.
+        let status = verify_entity(&mut conn, &vault, &entity, ENTITY_ID)
+            .await
+            .expect("key version mismatch must not be treated as an error");
+
+        assert_eq!(
+            status,
+            AttestationStatus::Unavailable,
+            "stale key_version must yield Unavailable, not MacMismatch"
+        );
+    }
 }
--- a/server/crates/arbiter-server/src/evm/mod.rs
+++ b/server/crates/arbiter-server/src/evm/mod.rs
@@ -1,28 +1,34 @@
+use diesel_async::{AsyncConnection, RunQueryDsl};
+use kameo::actor::ActorRef;
+
 use crate::{
    actors::vault::Vault,
    crypto::integrity,
    db::{
        self, DatabaseError,
        models::{
-            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+            EvmBasicGrant, EvmEtherTransferGrant, EvmEtherTransferGrantTarget,
+            EvmEtherTransferLimit, EvmTokenTransferGrant, EvmTokenTransferVolumeLimit,
+            EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
        },
        schema::{self, evm_transaction_log},
    },
    evm::policies::{
        CombinedSettings, DatabaseID, EvalContext, EvalViolation, Grant, Policy,
-        SharedGrantSettings, SpecificGrant, SpecificMeaning, ether_transfer::EtherTransfer,
-        token_transfers::TokenTransfer,
+        SharedGrantSettings, SpecificGrant, SpecificMeaning, VolumeRateLimit,
+        ether_transfer::EtherTransfer, token_transfers::TokenTransfer,
    },
 };

 use alloy::{
    consensus::TxEip1559,
-    primitives::{TxKind, U256},
+    primitives::{Address, TxKind, U256},
 };
 use chrono::Utc;
-use diesel::{ExpressionMethods as _, QueryDsl as _, QueryResult, insert_into, sqlite::Sqlite};
-use diesel_async::{AsyncConnection, RunQueryDsl};
-use kameo::actor::ActorRef;
+use diesel::{
+    ExpressionMethods as _, OptionalExtension, QueryDsl as _, QueryResult, SelectableHelper,
+    insert_into, sqlite::Sqlite, update,
+};

 pub mod abi;
 pub mod safe_signer;
@@ -272,6 +278,151 @@ impl Engine {
        Ok(id)
    }

+    pub async fn revoke_grant(
+        &self,
+        basic_grant_id: i32,
+    ) -> Result<(), DatabaseError> {
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+        let vault = self.vault.clone();
+
+        conn.transaction(async move |conn| {
+            use crate::db::schema::{
+                evm_basic_grant, evm_ether_transfer_grant, evm_ether_transfer_grant_target,
+                evm_ether_transfer_limit, evm_token_transfer_grant,
+                evm_token_transfer_volume_limit,
+            };
+
+            update(evm_basic_grant::table)
+                .filter(evm_basic_grant::id.eq(basic_grant_id))
+                .set(evm_basic_grant::revoked_at.eq(SqliteTimestamp(Utc::now())))
+                .execute(&mut *conn)
+                .await?;
+
+            let basic_grant: EvmBasicGrant = evm_basic_grant::table
+                .filter(evm_basic_grant::id.eq(basic_grant_id))
+                .select(EvmBasicGrant::as_select())
+                .first(&mut *conn)
+                .await?;
+
+            let shared = SharedGrantSettings::try_from_model(basic_grant)?;
+
+            if let Some(ether_grant) = evm_ether_transfer_grant::table
+                .filter(evm_ether_transfer_grant::basic_grant_id.eq(basic_grant_id))
+                .select(EvmEtherTransferGrant::as_select())
+                .first(&mut *conn)
+                .await
+                .optional()?
+            {
+                let target_rows: Vec<EvmEtherTransferGrantTarget> =
+                    evm_ether_transfer_grant_target::table
+                        .filter(evm_ether_transfer_grant_target::grant_id.eq(ether_grant.id))
+                        .select(EvmEtherTransferGrantTarget::as_select())
+                        .load(&mut *conn)
+                        .await?;
+                let targets: Vec<Address> = target_rows
+                    .into_iter()
+                    .filter_map(|target| {
+                        let arr: [u8; 20] = target.address.try_into().ok()?;
+                        Some(Address::from(arr))
+                    })
+                    .collect();
+
+                let limit: EvmEtherTransferLimit = evm_ether_transfer_limit::table
+                    .filter(evm_ether_transfer_limit::id.eq(ether_grant.limit_id))
+                    .select(EvmEtherTransferLimit::as_select())
+                    .first(&mut *conn)
+                    .await?;
+
+                let settings = CombinedSettings {
+                    shared: shared.clone(),
+                    specific: policies::ether_transfer::Settings {
+                        target: targets,
+                        limit: VolumeRateLimit {
+                            max_volume: utils::try_bytes_to_u256(&limit.max_volume).map_err(
+                                |err| {
+                                    diesel::result::Error::DeserializationError(Box::new(err))
+                                },
+                            )?,
+                            window: chrono::Duration::seconds(limit.window_secs.into()),
+                        },
+                    },
+                };
+
+                integrity::sign_entity(&mut *conn, &vault, &settings, basic_grant_id)
+                    .await
+                    .map_err(|_| diesel::result::Error::RollbackTransaction)?;
+
+                return QueryResult::Ok(());
+            }
+
+            if let Some(token_grant) = evm_token_transfer_grant::table
+                .filter(evm_token_transfer_grant::basic_grant_id.eq(basic_grant_id))
+                .select(EvmTokenTransferGrant::as_select())
+                .first(&mut *conn)
+                .await
+                .optional()?
+            {
+                let volume_limit_rows: Vec<EvmTokenTransferVolumeLimit> =
+                    evm_token_transfer_volume_limit::table
+                        .filter(evm_token_transfer_volume_limit::grant_id.eq(token_grant.id))
+                        .select(EvmTokenTransferVolumeLimit::as_select())
+                        .load(&mut *conn)
+                        .await?;
+                let volume_limits: Vec<VolumeRateLimit> = volume_limit_rows
+                    .into_iter()
+                    .map(|row| {
+                        Ok(VolumeRateLimit {
+                            max_volume: utils::try_bytes_to_u256(&row.max_volume).map_err(
+                                |err| {
+                                    diesel::result::Error::DeserializationError(Box::new(err))
+                                },
+                            )?,
+                            window: chrono::Duration::seconds(row.window_secs.into()),
+                        })
+                    })
+                    .collect::<QueryResult<Vec<_>>>()?;
+
+                let target: Option<Address> = match token_grant.receiver {
+                    None => None,
+                    Some(bytes) => {
+                        let arr: [u8; 20] = bytes.try_into().map_err(|_| {
+                            diesel::result::Error::DeserializationError(
+                                "Invalid receiver address length".into(),
+                            )
+                        })?;
+                        Some(Address::from(arr))
+                    }
+                };
+
+                let token_contract: [u8; 20] =
+                    token_grant.token_contract.clone().try_into().map_err(|_| {
+                        diesel::result::Error::DeserializationError(
+                            "Invalid token contract address length".into(),
+                        )
+                    })?;
+
+                let settings = CombinedSettings {
+                    shared,
+                    specific: policies::token_transfers::Settings {
+                        token_contract: Address::from(token_contract),
+                        target,
+                        volume_limits,
+                    },
+                };
+
+                integrity::sign_entity(&mut *conn, &vault, &settings, basic_grant_id)
+                    .await
+                    .map_err(|_| diesel::result::Error::RollbackTransaction)?;
+
+                return QueryResult::Ok(());
+            }
+
+            Err(diesel::result::Error::NotFound)
+        })
+        .await
+        .map_err(DatabaseError::from)
+    }
+
    async fn list_one_kind<Kind: Policy, Y>(
        &self,
        conn: &mut impl AsyncConnection<Backend = Sqlite>,
@@ -351,11 +502,15 @@ impl Engine {
 #[cfg(test)]
 mod tests {
    use alloy::primitives::{Address, Bytes, U256, address};
+    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
    use chrono::{Duration, Utc};
    use diesel::{SelectableHelper, insert_into};
    use diesel_async::RunQueryDsl;
+    use kameo::{actor::ActorRef, prelude::Spawn};
    use rstest::rstest;

+    use crate::actors::{GlobalActors, vault::{Bootstrap, Vault}};
+    use crate::crypto::integrity;
    use crate::db::{
        self, DatabaseConnection,
        models::{
@@ -363,8 +518,10 @@ mod tests {
        },
        schema::{evm_basic_grant, evm_transaction_log},
    };
+    use crate::evm::policies::ether_transfer::EtherTransfer;
    use crate::evm::policies::{
-        EvalContext, EvalViolation, SharedGrantSettings, TransactionRateLimit,
+        CombinedSettings, EvalContext, EvalViolation, Policy, SharedGrantSettings,
+        TransactionRateLimit, VolumeRateLimit,
    };

    use super::check_shared_constraints;
@@ -396,6 +553,7 @@ mod tests {
            chain: CHAIN_ID,
            valid_from: None,
            valid_until: None,
+            revoked_at: None,
            max_gas_fee_per_gas: None,
            max_priority_fee_per_gas: None,
            rate_limit: None,
@@ -604,4 +762,115 @@ mod tests {
            assert!(violations.is_empty());
        }
    }
+
+    async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> {
+        let actor = Vault::spawn(
+            Vault::new(db.clone(), GlobalActors::spawn_message_bus())
+                .await
+                .unwrap(),
+        );
+        actor
+            .ask(Bootstrap {
+                seal_key_raw: SafeCell::new(b"integrity-test-seal-key".to_vec()),
+            })
+            .await
+            .unwrap();
+        actor
+    }
+
+    #[tokio::test]
+    async fn revoke_grant_preserves_revoked_integrity() {
+        use crate::db::schema::evm_basic_grant;
+        use diesel::ExpressionMethods as _;
+
+        let db = db::create_test_pool().await;
+        let vault = bootstrapped_vault(&db).await;
+        let engine = super::Engine::new(db.clone(), vault.clone());
+
+        let full_grant = CombinedSettings {
+            shared: SharedGrantSettings {
+                wallet_access_id: WALLET_ACCESS_ID,
+                chain: CHAIN_ID,
+                valid_from: None,
+                valid_until: None,
+                revoked_at: None,
+                max_gas_fee_per_gas: None,
+                max_priority_fee_per_gas: None,
+                rate_limit: None,
+            },
+            specific: super::policies::ether_transfer::Settings {
+                target: vec![RECIPIENT],
+                limit: VolumeRateLimit {
+                    max_volume: U256::from(100u64),
+                    window: Duration::hours(1),
+                },
+            },
+        };
+
+        let grant_id = engine
+            .create_grant::<EtherTransfer>(full_grant)
+            .await
+            .unwrap();
+
+        engine.revoke_grant(grant_id).await.unwrap();
+
+        let mut conn = db.get().await.unwrap();
+        diesel::update(evm_basic_grant::table)
+            .filter(evm_basic_grant::id.eq(grant_id))
+            .set(evm_basic_grant::revoked_at.eq::<Option<SqliteTimestamp>>(None))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+
+        let wallet_access = EvmWalletAccess {
+            id: WALLET_ACCESS_ID,
+            wallet_id: 10,
+            client_id: 20,
+            created_at: SqliteTimestamp(Utc::now()),
+        };
+        let context = EvalContext {
+            target: wallet_access,
+            chain: CHAIN_ID,
+            to: RECIPIENT,
+            value: U256::ONE,
+            calldata: Bytes::new(),
+            max_fee_per_gas: 1,
+            max_priority_fee_per_gas: 1,
+        };
+
+        let grant = EtherTransfer::try_find_grant(
+            &context, &mut conn,
+        )
+        .await
+        .unwrap()
+        .unwrap();
+
+        let result =
+            integrity::verify_entity(&mut conn, &vault, &grant.settings, grant.id).await;
+
+        assert!(matches!(
+            result,
+            Err(integrity::Error::MacMismatch { .. })
+        ));
+    }
+
+    #[test]
+    fn shared_settings_hash_changes_when_revoked_at_changes() {
+        use arbiter_crypto::hashing::Hashable;
+        use sha2::Digest;
+
+        let active = shared_settings();
+        let revoked = SharedGrantSettings {
+            revoked_at: Some(Utc::now()),
+            ..shared_settings()
+        };
+
+        let mut active_hash = sha2::Sha256::new();
+        active.hash(&mut active_hash);
+
+        let mut revoked_hash = sha2::Sha256::new();
+        revoked.hash(&mut revoked_hash);
+
+        assert_ne!(active_hash.finalize(), revoked_hash.finalize());
+    }
 }
--- a/server/crates/arbiter-server/src/evm/policies.rs
+++ b/server/crates/arbiter-server/src/evm/policies.rs
@@ -144,6 +144,7 @@ pub struct SharedGrantSettings {

    pub valid_from: Option<DateTime<Utc>>,
    pub valid_until: Option<DateTime<Utc>>,
+    pub revoked_at: Option<DateTime<Utc>>,

    pub max_gas_fee_per_gas: Option<U256>,
    pub max_priority_fee_per_gas: Option<U256>,
@@ -158,6 +159,7 @@ impl SharedGrantSettings {
            chain: model.chain_id.into(),
            valid_from: model.valid_from.map(Into::into),
            valid_until: model.valid_until.map(Into::into),
+            revoked_at: model.revoked_at.map(Into::into),
            max_gas_fee_per_gas: model
                .max_gas_fee_per_gas
                .map(|b| utils::try_bytes_to_u256(&b))
--- a/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
@@ -79,6 +79,7 @@ fn shared() -> SharedGrantSettings {
        chain: CHAIN_ID,
        valid_from: None,
        valid_until: None,
+        revoked_at: None,
        max_gas_fee_per_gas: None,
        max_priority_fee_per_gas: None,
        rate_limit: None,
--- a/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
@@ -98,6 +98,7 @@ fn shared() -> SharedGrantSettings {
        chain: CHAIN_ID,
        valid_from: None,
        valid_until: None,
+        revoked_at: None,
        max_gas_fee_per_gas: None,
        max_priority_fee_per_gas: None,
        rate_limit: None,
--- a/server/crates/arbiter-server/src/grpc/client/auth.rs
+++ b/server/crates/arbiter-server/src/grpc/client/auth.rs
@@ -200,7 +200,7 @@ impl Convert for auth::Outbound {
                        .timestamp
                        .timestamp_nanos_opt()
                        .expect("timestamp within range")
-                        as u64,
+                        .cast_unsigned(),
                    random: challenge.nonce.to_vec(),
                })
            }
--- a/server/crates/arbiter-server/src/grpc/operator/auth.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/auth.rs
@@ -80,7 +80,7 @@ impl Sender<Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {
                        .timestamp
                        .timestamp_nanos_opt()
                        .expect("timestamp within range")
-                        as u64,
+                        .cast_unsigned(),
                    random: challenge.nonce.to_vec(),
                })
            }
@@ -171,7 +171,7 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {

                Some(auth::Inbound::AuthChallengeRequest {
                    pubkey,
-                    bootstrap_token,
+                    bootstrap_token: bootstrap_token.map(String::into_bytes),
                })
            }
            AuthRequestPayload::ChallengeSolution(ProtoAuthChallengeSolution { signature }) => {
--- a/server/crates/arbiter-server/src/grpc/operator/evm.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/evm.rs
@@ -217,6 +217,11 @@ async fn handle_sign_transaction(
                result: Some(vet_error.convert()),
            }
        }
+        Err(kameo::error::SendError::HandlerError(
+            SessionSignTransactionError::ClientNotConnected,
+        )) => {
+            return Err(Status::permission_denied("client not connected"));
+        }
        Err(kameo::error::SendError::HandlerError(SessionSignTransactionError::Internal)) => {
            EvmSignTransactionResponse {
                result: Some(EvmSignTransactionResult::Error(
--- a/server/crates/arbiter-server/src/grpc/operator/inbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/inbound.rs
@@ -87,6 +87,7 @@ impl TryConvert for ProtoSharedSettings {
                .valid_until
                .map(ProtoTimestamp::try_convert)
                .transpose()?,
+            revoked_at: None,
            max_gas_fee_per_gas: self
                .max_gas_fee_per_gas
                .as_deref()
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
@@ -87,6 +87,7 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(()) => ProtoUnsealResult::Success,
                    Err(vault_gate::Error::InvalidKey) => ProtoUnsealResult::InvalidKey,
+                    Err(vault_gate::Error::LockedOut) => ProtoUnsealResult::LockedOut,
                    Err(err) => {
                        warn!(?err, "unseal failed");
                        return Err(Status::internal("Failed to unseal vault"));
--- a/server/crates/arbiter-server/src/peers/client/auth.rs
+++ b/server/crates/arbiter-server/src/peers/client/auth.rs
@@ -8,7 +8,7 @@ use crate::{
    crypto::integrity::{self, AttestationStatus},
    db::{
        self,
-        models::{ProgramClientMetadata, SqliteTimestamp},
+        models::ProgramClientMetadata,
        schema::program_client,
    },
 };
@@ -18,14 +18,13 @@ use arbiter_proto::{
    transport::{Bi, expect_message},
 };

-use chrono::Utc;
 use diesel::{
    ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, SelectableHelper as _,
-    dsl::insert_into, update,
+    dsl::insert_into,
 };
 use diesel_async::RunQueryDsl as _;
 use kameo::{actor::ActorRef, error::SendError};
-use tracing::error;
+use tracing::{error, warn};

 #[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
 pub enum Error {
@@ -211,71 +210,47 @@ async fn insert_client(
    .await
 }

-async fn sync_client_metadata(
+/// Compares stored metadata against what a reconnecting client presents.
+/// Metadata is frozen after initial operator approval and must not be silently
+/// overwritten. Doing so would let an approved client forge its displayed
+/// identity in later approval prompts. Drift is logged and ignored.
+async fn check_metadata_drift(
    db: &db::DatabasePool,
    client_id: i32,
-    metadata: &ClientMetadata,
+    presented: &ClientMetadata,
 ) -> Result<(), Error> {
-    use crate::db::schema::{client_metadata, client_metadata_history};
-
-    let now = SqliteTimestamp(Utc::now());
+    use crate::db::schema::client_metadata;

    let mut conn = db.get().await.map_err(|e| {
        error!(error = ?e, "Database pool error");
        Error::DatabasePoolUnavailable
    })?;

-    conn.exclusive_transaction(async |conn| {
-        let (current_metadata_id, current): (i32, ProgramClientMetadata) = program_client::table
-            .find(client_id)
-            .inner_join(client_metadata::table)
-            .select((
-                program_client::metadata_id,
-                ProgramClientMetadata::as_select(),
-            ))
-            .first(&mut *conn)
-            .await?;
+    let current: ProgramClientMetadata = program_client::table
+        .find(client_id)
+        .inner_join(client_metadata::table)
+        .select(ProgramClientMetadata::as_select())
+        .first(&mut conn)
+        .await
+        .map_err(|e| {
+            error!(error = ?e, "Database error");
+            Error::DatabaseOperationFailed
+        })?;

-        let unchanged = current.name == metadata.name
-            && current.description == metadata.description
-            && current.version == metadata.version;
-        if unchanged {
-            return Ok(());
-        }
+    let changed = current.name != presented.name
+        || current.description != presented.description
+        || current.version != presented.version;

-        insert_into(client_metadata_history::table)
-            .values((
-                client_metadata_history::metadata_id.eq(current_metadata_id),
-                client_metadata_history::client_id.eq(client_id),
-            ))
-            .execute(&mut *conn)
-            .await?;
+    if changed {
+        warn!(
+            client_id,
+            stored_name = %current.name,
+            presented_name = %presented.name,
+            "reconnecting client presented different metadata; ignoring - metadata is frozen after operator approval"
+        );
+    }

-        let metadata_id = insert_into(client_metadata::table)
-            .values((
-                client_metadata::name.eq(&metadata.name),
-                client_metadata::description.eq(&metadata.description),
-                client_metadata::version.eq(&metadata.version),
-            ))
-            .returning(client_metadata::id)
-            .get_result::<i32>(&mut *conn)
-            .await?;
-
-        update(program_client::table.find(client_id))
-            .set((
-                program_client::metadata_id.eq(metadata_id),
-                program_client::updated_at.eq(now),
-            ))
-            .execute(&mut *conn)
-            .await?;
-
-        Ok::<(), diesel::result::Error>(())
-    })
-    .await
-    .map_err(|e| {
-        error!(error = ?e, "Database error");
-        Error::DatabaseOperationFailed
-    })
+    Ok(())
 }

 async fn challenge_client<T>(
@@ -298,7 +273,7 @@ where

    let signature = expect_message(transport, |req: Inbound| match req {
        Inbound::AuthChallengeSolution { signature } => Some(signature),
-        _ => None,
+        Inbound::AuthChallengeRequest { .. } => None,
    })
    .await
    .map_err(|e| {
@@ -324,6 +299,7 @@ where

    let client_id = if let Some(id) = get_client_id(&props.db, &pubkey).await? {
        verify_integrity(&props.db, &props.actors.vault, &pubkey).await?;
+        check_metadata_drift(&props.db, id, &metadata).await?;
        id
    } else {
        approve_new_client(
@@ -337,8 +313,6 @@ where
        insert_client(&props.db, &props.actors.vault, &pubkey, &metadata).await?
    };

-    sync_client_metadata(&props.db, client_id, &metadata).await?;
-
    let challenge = AuthChallenge::generate(&mut rand::rng());
    challenge_client(transport, pubkey, challenge).await?;

--- a/server/crates/arbiter-server/src/peers/client/session.rs
+++ b/server/crates/arbiter-server/src/peers/client/session.rs
@@ -83,7 +83,7 @@ impl Actor for ClientSession {
        args.props
            .actors
            .flow_coordinator
-            .ask(RegisterClient { actor: this })
+            .ask(RegisterClient { client_id: args.client_id, actor: this })
            .await
            .map_err(|_| Error::ConnectionRegistrationFailed)?;
        Ok(args)
--- a/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
@@ -14,7 +14,7 @@ mod state;
 pub enum Inbound {
    AuthChallengeRequest {
        pubkey: authn::PublicKey,
-        bootstrap_token: Option<String>,
+        bootstrap_token: Option<Vec<u8>>,
    },
    AuthChallengeSolution {
        signature: Vec<u8>,
@@ -26,21 +26,22 @@ pub enum Error {
    UnregisteredPublicKey,
    InvalidChallengeSolution,
    InvalidBootstrapToken,
-    Internal { details: String },
+    /// Reaches the operator verbatim via `Status::internal`, so the payload is
+    /// `&'static str`: the type makes it impossible to interpolate an inner
+    /// error. Log the cause, send the constant.
+    Internal { details: &'static str },
    Transport,
 }

 impl Error {
-    fn internal(details: impl Into<String>) -> Self {
-        Self::Internal {
-            details: details.into(),
-        }
+    const fn internal(details: &'static str) -> Self {
+        Self::Internal { details }
    }
 }

 impl From<diesel::result::Error> for Error {
    fn from(e: diesel::result::Error) -> Self {
-        error!(?e, "Database error");
+        error!(error = %crate::utils::error_chain(&e), "Database error");
        Self::internal("Database error")
    }
 }
--- a/server/crates/arbiter-server/src/peers/operator/auth/state.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/state.rs
@@ -16,13 +16,12 @@ use tracing::error;

 pub(super) struct ChallengeRequest {
    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<String>,
+    pub(super) bootstrap_token: Option<Vec<u8>>,
 }

-pub(super) struct ChallengeContext {
+pub struct ChallengeContext {
    pub(super) challenge: AuthChallenge,
    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<String>,
 }

 pub(super) struct ChallengeSolution {
@@ -79,11 +78,16 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
 pub(super) struct AuthContext<'a, T: ?Sized> {
    pub(super) conn: &'a mut OperatorConnection,
    pub(super) transport: &'a mut T,
+    bootstrap_token: Option<Vec<u8>>,
 }

 impl<'a, T: ?Sized> AuthContext<'a, T> {
    pub(super) const fn new(conn: &'a mut OperatorConnection, transport: &'a mut T) -> Self {
-        Self { conn, transport }
+        Self {
+            conn,
+            transport,
+            bootstrap_token: None,
+        }
    }
 }

@@ -108,6 +112,8 @@ where
            }
        }

+        self.bootstrap_token = bootstrap_token;
+
        let challenge = AuthChallenge::generate(&mut rand::rng());

        self.transport
@@ -120,22 +126,12 @@ where
                Error::Transport
            })?;

-        Ok(ChallengeContext {
-            challenge,
-            pubkey,
-            bootstrap_token,
-        })
+        Ok(ChallengeContext { challenge, pubkey })
    }

-    #[allow(missing_docs)]
-    #[allow(clippy::unused_unit)]
    async fn verify_solution(
        &mut self,
-        ChallengeContext {
-            challenge,
-            pubkey,
-            bootstrap_token,
-        }: &ChallengeContext,
+        ChallengeContext { challenge, pubkey }: &ChallengeContext,
        ChallengeSolution { solution }: ChallengeSolution,
    ) -> Result<Credentials, Self::Error> {
        let signature = authn::Signature::try_from(solution.as_slice()).map_err(|()| {
@@ -154,15 +150,13 @@ where
        }

        // Resolve client id: bootstrap (consume token + register) or lookup
-        let id = match bootstrap_token {
+        let id = match self.bootstrap_token.take() {
            Some(token) => {
                let token_ok: bool = self
                    .conn
                    .actors
                    .bootstrapper
-                    .ask(ConsumeToken {
-                        token: token.clone(),
-                    })
+                    .ask(ConsumeToken { token })
                    .await
                    .map_err(|e| {
                        error!(?e, "Failed to consume bootstrap token");
--- a/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
@@ -4,9 +4,12 @@ use crate::{
        ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
        SignTransactionError as EvmSignError,
    },
-    actors::flow_coordinator::client_connect_approval::ClientApprovalAnswer,
+    actors::flow_coordinator::{IsClientConnected, client_connect_approval::ClientApprovalAnswer},
    actors::vault::VaultState,
-    db::models::{EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata},
+    db::{
+        models::{EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata},
+        schema::program_client,
+    },
    evm::policies::{Grant, SpecificGrant},
 };
 use arbiter_crypto::authn;
@@ -15,13 +18,16 @@ use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
 use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
 use diesel_async::{AsyncConnection, RunQueryDsl};
 use kameo::{error::SendError, messages, prelude::Context};
-use tracing::error;
+use tracing::{error, info, warn};

 #[derive(Debug, Error)]
 pub enum SignTransactionError {
    #[error("Policy evaluation failed")]
    Vet(#[from] crate::evm::VetError),

+    #[error("Client not connected")]
+    ClientNotConnected,
+
    #[error("Internal signing error")]
    Internal,
 }
@@ -141,6 +147,30 @@ impl OperatorSession {
        wallet_address: Address,
        transaction: TxEip1559,
    ) -> Result<Signature, SignTransactionError> {
+        if !self.approved_client_ids.contains(&client_id) {
+            warn!(
+                client_id,
+                "operator attempted to sign for client not in its approved set"
+            );
+            return Err(SignTransactionError::ClientNotConnected);
+        }
+
+        let connected = self
+            .props
+            .actors
+            .flow_coordinator
+            .ask(IsClientConnected { client_id })
+            .await
+            .unwrap_or(false);
+
+        if !connected {
+            self.approved_client_ids.remove(&client_id);
+            warn!(client_id, "operator attempted to sign for disconnected client");
+            return Err(SignTransactionError::ClientNotConnected);
+        }
+
+        info!(client_id, event = "sign_transaction", "operator.sign_transaction");
+
        match self
            .props
            .actors
@@ -196,7 +226,7 @@ impl OperatorSession {
            use crate::db::schema::evm_wallet_access;
            for entry in entries {
                diesel::delete(evm_wallet_access::table)
-                    .filter(evm_wallet_access::wallet_id.eq(entry))
+                    .filter(evm_wallet_access::id.eq(entry))
                    .execute(&mut *conn)
                    .await?;
            }
@@ -212,8 +242,7 @@ impl OperatorSession {
        &mut self,
    ) -> Result<Vec<EvmWalletAccess>, Error> {
        let mut conn = self.props.db.get().await?;
-        use crate::db::schema::evm_wallet_access;
-        let access_entries = evm_wallet_access::table
+        let access_entries = crate::db::schema::evm_wallet_access::table
            .select(EvmWalletAccess::as_select())
            .load::<_>(&mut conn)
            .await?;
@@ -250,6 +279,30 @@ impl OperatorSession {

        ctx.actor_ref().unlink(&pending_approval.controller).await;

+        if approved {
+            let pubkey_bytes = pending_approval.pubkey.to_bytes();
+            match self.props.db.get().await {
+                Ok(mut conn) => {
+                    match program_client::table
+                        .filter(program_client::public_key.eq(pubkey_bytes.as_slice()))
+                        .select(program_client::id)
+                        .first::<i32>(&mut conn)
+                        .await
+                    {
+                        Ok(client_id) => {
+                            self.approved_client_ids.insert(client_id);
+                        }
+                        Err(err) => {
+                            error!(?err, "Failed to look up client_id for approved pubkey");
+                        }
+                    }
+                }
+                Err(err) => {
+                    error!(?err, "DB pool error after client approval");
+                }
+            }
+        }
+
        Ok(())
    }

@@ -272,3 +325,142 @@ impl OperatorSession {
        Ok(clients)
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::db::{self, models::NewEvmWalletAccess, schema::evm_wallet_access};
+    use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
+    use diesel_async::{AsyncConnection, RunQueryDsl};
+
+    /// Regression test: revocation must delete by access-entry `id`, not by `wallet_id`.
+    ///
+    /// Before the fix, revoking `entry_id=1` would delete all rows where `wallet_id=1`,
+    /// wiping out every client's access to wallet #1.
+    #[tokio::test]
+    async fn revoke_deletes_by_entry_id_not_wallet_id() {
+        use crate::db::models::EvmWalletAccess;
+
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.expect("pool connection");
+
+        // Insert two access entries for the same wallet but different clients.
+        // entry A: id will be 1, wallet_id=1, client_id=10
+        // entry B: id will be 2, wallet_id=1, client_id=20
+        let entry_a = diesel::insert_into(evm_wallet_access::table)
+            .values(NewEvmWalletAccess {
+                wallet_id: 1,
+                client_id: 10,
+            })
+            .returning(EvmWalletAccess::as_select())
+            .get_result(&mut *conn)
+            .await
+            .expect("insert entry A");
+
+        let entry_b = diesel::insert_into(evm_wallet_access::table)
+            .values(NewEvmWalletAccess {
+                wallet_id: 1,
+                client_id: 20,
+            })
+            .returning(EvmWalletAccess::as_select())
+            .get_result(&mut *conn)
+            .await
+            .expect("insert entry B");
+
+        // Revoke only entry A by its primary key id.
+        conn.transaction(async |conn| {
+            diesel::delete(evm_wallet_access::table)
+                .filter(evm_wallet_access::id.eq(entry_a.id))
+                .execute(&mut *conn)
+                .await
+        })
+        .await
+        .expect("revoke entry A");
+
+        // Entry A must be gone.
+        let gone = evm_wallet_access::table
+            .filter(evm_wallet_access::id.eq(entry_a.id))
+            .count()
+            .get_result::<i64>(&mut *conn)
+            .await
+            .expect("count entry A");
+        assert_eq!(gone, 0, "revoked entry must be deleted");
+
+        // Entry B (same wallet, different client) must still exist.
+        let still_there = evm_wallet_access::table
+            .filter(evm_wallet_access::id.eq(entry_b.id))
+            .count()
+            .get_result::<i64>(&mut *conn)
+            .await
+            .expect("count entry B");
+        assert_eq!(still_there, 1, "unrelated entry must not be deleted");
+    }
+
+    /// Regression test: when `entry_id` and `wallet_id` differ, only the correct row is removed.
+    ///
+    /// This specifically catches the case where `entry.id=5` and `wallet_id=1` are different values;
+    /// the old bug would delete by `wallet_id`, potentially matching a completely different entry.
+    #[tokio::test]
+    async fn revoke_with_mismatched_wallet_and_entry_ids() {
+        use crate::db::models::EvmWalletAccess;
+
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.expect("pool connection");
+
+        // Insert entries to force auto-increment IDs to diverge from wallet_ids.
+        // We'll insert 5 placeholder entries first so that the real entry gets id=6.
+        for i in 1_i32..=5 {
+            diesel::insert_into(evm_wallet_access::table)
+                .values(NewEvmWalletAccess {
+                    wallet_id: 99,
+                    client_id: i,
+                })
+                .execute(&mut *conn)
+                .await
+                .expect("insert placeholder");
+        }
+
+        // Real target: wallet_id=1, will get id=6.
+        let target = diesel::insert_into(evm_wallet_access::table)
+            .values(NewEvmWalletAccess {
+                wallet_id: 1,
+                client_id: 1,
+            })
+            .returning(EvmWalletAccess::as_select())
+            .get_result(&mut *conn)
+            .await
+            .expect("insert target");
+
+        // Sanity: target.id != target.wallet_id
+        assert_ne!(
+            target.id, target.wallet_id,
+            "test prerequisite: id and wallet_id must differ"
+        );
+
+        // Revoke by entry id.
+        conn.transaction(async |conn| {
+            diesel::delete(evm_wallet_access::table)
+                .filter(evm_wallet_access::id.eq(target.id))
+                .execute(&mut *conn)
+                .await
+        })
+        .await
+        .expect("revoke target");
+
+        let remaining = evm_wallet_access::table
+            .filter(evm_wallet_access::id.eq(target.id))
+            .count()
+            .get_result::<i64>(&mut *conn)
+            .await
+            .expect("count target");
+        assert_eq!(remaining, 0, "target must be deleted by its entry id");
+
+        // Placeholders for wallet_id=99 must be untouched.
+        let placeholders = evm_wallet_access::table
+            .filter(evm_wallet_access::wallet_id.eq(99))
+            .count()
+            .get_result::<i64>(&mut *conn)
+            .await
+            .expect("count placeholders");
+        assert_eq!(placeholders, 5, "unrelated entries must survive");
+    }
+}
--- a/server/crates/arbiter-server/src/peers/operator/session/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/mod.rs
@@ -1,16 +1,14 @@
 use super::{OutOfBand, OperatorConnection};
 use crate::{
    actors::{
-        flow_coordinator::client_connect_approval::ClientApprovalController,
-        operator_registry::ConnectOperator,
-    },
-    peers::client::ClientProfile,
+        flow_coordinator::{GetConnectedClientIds, client_connect_approval::{ClientApprovalAnswer, ClientApprovalController}}, operator_registry::ConnectOperator,
+    }, peers::client::ClientProfile,
 };
 use arbiter_crypto::authn;
 use arbiter_proto::transport::Sender;

 use kameo::{Actor, actor::ActorRef, messages};
-use std::{borrow::Cow, collections::HashMap};
+use std::{borrow::Cow, collections::{HashMap, HashSet}};
 use thiserror::Error;
 use tracing::error;

@@ -54,6 +52,10 @@ pub struct OperatorSession {
    sender: Box<dyn Sender<OutOfBand>>,

    pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>,
+    /// DB `client_ids` this operator session is allowed to sign for.
+    /// Seeded from currently-connected clients on start, then updated as
+    /// approvals are granted or denied during the session lifetime.
+    approved_client_ids: HashSet<i32>,
 }

 pub mod handlers;
@@ -63,7 +65,8 @@ impl OperatorSession {
        Self {
            props,
            sender,
-            pending_client_approvals: Default::default(),
+            pending_client_approvals: HashMap::default(),
+            approved_client_ids: HashSet::default(),
        }
    }
 }
@@ -88,6 +91,7 @@ impl OperatorSession {
                actor = "operator",
                event = "failed to announce new client connection"
            );
+            let _ = controller.tell(ClientApprovalAnswer { approved: false }).await;
            return;
        }

@@ -106,7 +110,7 @@ impl Actor for OperatorSession {

    type Error = Error;

-    async fn on_start(args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
+    async fn on_start(mut args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
        args.props
            .actors
            .operator_registry
@@ -121,6 +125,16 @@ impl Actor for OperatorSession {
                );
                Error::internal("Failed to register operator connection with operator registry")
            })?;
+
+        // Seed approved set with clients already connected when this session starts.
+        // New clients will be added via handle_new_client_approve as they are approved.
+        match args.props.actors.flow_coordinator.ask(GetConnectedClientIds {}).await {
+            Ok(ids) => args.approved_client_ids.extend(ids),
+            Err(err) => {
+                error!(?err, "Failed to fetch connected client IDs on operator session start");
+            }
+        }
+
        Ok(args)
    }

--- a/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
@@ -25,17 +25,17 @@ pub enum Error {
    AlreadyBootstrapped,
    #[error("Invalid key provided")]
    InvalidKey,
+    #[error("Vault locked: too many failed unseal attempts")]
+    LockedOut,

    #[error("State transition failed")]
    State,

+    /// Reaches the operator verbatim via `Status::internal`, so the payload is
+    /// `&'static str`: the type makes it impossible to interpolate an inner
+    /// error. Log the cause, send the constant.
    #[error("Internal error: {0}")]
-    Internal(String),
-}
-impl Error {
-    fn internal(message: impl Into<String>) -> Self {
-        Self::Internal(message.into())
-    }
+    Internal(&'static str),
 }

 pub struct HandshakeResponse {
@@ -170,13 +170,14 @@ impl VaultGate {
                Ok(())
            }
            Err(SendError::HandlerError(vault::Error::InvalidKey)) => Err(Error::InvalidKey),
+            Err(SendError::HandlerError(vault::Error::LockedOut)) => Err(Error::LockedOut),
            Err(SendError::HandlerError(err)) => {
                error!(?err, "Vault failed to unseal key");
                Err(Error::InvalidKey)
            }
            Err(err) => {
                error!(?err, "Failed to send unseal request to vault");
-                Err(Error::internal("Vault actor error"))
+                Err(Error::Internal("Vault actor error"))
            }
        }
    }
@@ -218,7 +219,7 @@ impl VaultGate {
            }
            Err(err) => {
                error!(?err, "Failed to send bootstrap request to vault");
-                Err(Error::internal("Vault error"))
+                Err(Error::Internal("Vault error"))
            }
        }
    }
@@ -230,7 +231,10 @@ impl VaultGate {
            .vault
            .ask(GetState {})
            .await
-            .map_err(|_| Error::internal("failed to query vault"))?;
+            .map_err(|err| {
+                error!(?err, "Failed to query vault state");
+                Error::Internal("failed to query vault")
+            })?;

        Ok(answer)
    }
@@ -249,7 +253,10 @@ impl Message<events::Bootstrapped> for VaultGate {
                .db
                .get()
                .await
-                .map_err(|_| Error::internal("DB unavailable"))?;
+                .map_err(|err| {
+                    error!(error = %crate::utils::error_chain(&err), "DB unavailable on bootstrap");
+                    Error::Internal("DB unavailable")
+                })?;
            integrity::sign_entity(
                &mut conn,
                &self.actors.vault,
@@ -257,9 +264,12 @@ impl Message<events::Bootstrapped> for VaultGate {
                self.auth_creds.id,
            )
            .await
-            .map_err(|e| {
-                error!(?e, "Failed to sign integrity envelope on bootstrap");
-                Error::internal("Integrity sign failed")
+            .map_err(|err| {
+                error!(
+                    error = %crate::utils::error_chain(&err),
+                    "Failed to sign integrity envelope on bootstrap"
+                );
+                Error::Internal("Integrity sign failed")
            })?;
            Ok(())
        }
--- a/server/crates/arbiter-server/src/utils.rs
+++ b/server/crates/arbiter-server/src/utils.rs
@@ -14,3 +14,47 @@ impl<F: FnOnce()> Drop for DeferClosure<F> {
 pub fn defer<F: FnOnce()>(f: F) -> impl Drop + Sized {
    DeferClosure { f: Some(f) }
 }
+
+/// Renders an error together with its full `source` chain as `outer: inner: root`.
+///
+/// Error variants in this crate deliberately keep `Display` terse so that no
+/// internal detail can leak across the gRPC boundary. That same terseness would
+/// hide the cause in the logs, so use this for `tracing` fields, never in a
+/// wire payload.
+pub fn error_chain(err: &dyn core::error::Error) -> String {
+    let mut out = err.to_string();
+    let mut current = err.source();
+    while let Some(source) = current {
+        out.push_str(": ");
+        out.push_str(&source.to_string());
+        current = source.source();
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::error_chain;
+
+    #[derive(Debug, thiserror::Error)]
+    #[error("root")]
+    struct Root;
+
+    #[derive(Debug, thiserror::Error)]
+    #[error("middle")]
+    struct Middle(#[source] Root);
+
+    #[derive(Debug, thiserror::Error)]
+    #[error("outer")]
+    struct Outer(#[source] Middle);
+
+    #[test]
+    fn walks_the_whole_source_chain() {
+        assert_eq!(error_chain(&Root), "root", "a leaf error renders alone");
+        assert_eq!(
+            error_chain(&Outer(Middle(Root))),
+            "outer: middle: root",
+            "every source link must appear, in order"
+        );
+    }
+}
--- a/server/crates/arbiter-server/tests/client/auth.rs
+++ b/server/crates/arbiter-server/tests/client/auth.rs
@@ -266,7 +266,7 @@ pub async fn metadata_unchanged_does_not_append_history() {

 #[tokio::test]
 #[test_log::test]
-pub async fn metadata_change_appends_history_and_repoints_binding() {
+pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;
    let new_key = MlDsa87::key_gen(&mut rand::rng());
@@ -287,6 +287,7 @@ pub async fn metadata_change_appends_history_and_repoints_binding() {
        connect_client(props, &mut server_transport).await;
    });

+    // Reconnect presenting different metadata — must be silently ignored.
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
@@ -313,6 +314,7 @@ pub async fn metadata_change_appends_history_and_repoints_binding() {
            client_metadata, client_metadata_history, program_client,
        };
        let mut conn = db.get().await.unwrap();
+        // Metadata is frozen: no new row, no history entry.
        let metadata_count: i64 = client_metadata::table
            .count()
            .get_result(&mut conn)
@@ -338,15 +340,16 @@ pub async fn metadata_change_appends_history_and_repoints_binding() {
            .first::<(String, Option<String>, Option<String>)>(&mut conn)
            .await
            .unwrap();
-        assert_eq!(metadata_count, 2);
-        assert_eq!(history_count, 1);
+        assert_eq!(metadata_count, 1, "frozen: no new metadata row on reconnect");
+        assert_eq!(history_count, 0, "frozen: no history entry on reconnect");
        assert_eq!(
            current,
            (
                "client".to_owned(),
-                Some("new".to_owned()),
-                Some("2.0.0".to_owned())
-            )
+                Some("old".to_owned()),
+                Some("1.0.0".to_owned())
+            ),
+            "frozen: original metadata must be preserved"
        );
    }
 }
--- a/server/crates/arbiter-server/tests/operator/auth.rs
+++ b/server/crates/arbiter-server/tests/operator/auth.rs
@@ -174,7 +174,7 @@ pub async fn bootstrap_token_auth() {
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some(token),
+            bootstrap_token: Some(token.into_bytes()),
        })
        .await
        .unwrap();
@@ -231,7 +231,7 @@ pub async fn bootstrap_invalid_token_auth() {
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some("invalid_token".to_owned()),
+            bootstrap_token: Some(b"invalid_token".to_vec()),
        })
        .await
        .unwrap();
@@ -400,7 +400,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
    let challenge = match response {
        Ok(resp) => match resp {
            auth::Outbound::AuthChallenge { challenge } => challenge,
-            other => panic!("Expected AuthChallenge, got {other:?}"),
+            other @ auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got {other:?}"),
        },
        Err(err) => panic!("Expected Ok response, got Err({err:?})"),
    };
--- a/server/crates/arbiter-server/tests/vault/concurrency.rs
+++ b/server/crates/arbiter-server/tests/vault/concurrency.rs
@@ -14,6 +14,8 @@ use kameo::actor::{ActorRef, Spawn as _};
 use std::collections::{HashMap, HashSet};
 use tokio::task::JoinSet;

+const TEST_AAD: &[u8] = b"test-aad";
+
 async fn write_concurrently(
    actor: ActorRef<Vault>,
    prefix: &'static str,
@@ -27,6 +29,7 @@ async fn write_concurrently(
            let id = actor
                .ask(CreateNew {
                    plaintext: SafeCell::new(plaintext.clone()),
+                    aad: TEST_AAD.to_vec(),
                })
                .await
                .unwrap();
@@ -120,7 +123,7 @@ async fn insert_failure_does_not_create_partial_row() {
    drop(conn);

    let err = actor
-        .create_new(SafeCell::new(b"should fail".to_vec()))
+        .create_new(SafeCell::new(b"should fail".to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap_err();
    assert!(matches!(err, Error::DatabaseTransaction(_)));
@@ -171,7 +174,7 @@ async fn decrypt_roundtrip_after_high_concurrency() {
        .unwrap();

    for (id, plaintext) in expected {
-        let mut decrypted = decryptor.decrypt(id).await.unwrap();
+        let mut decrypted = decryptor.decrypt(id, TEST_AAD.to_vec()).await.unwrap();
        assert_eq!(*decrypted.read(), plaintext);
    }
 }
--- a/server/crates/arbiter-server/tests/vault/lifecycle.rs
+++ b/server/crates/arbiter-server/tests/vault/lifecycle.rs
@@ -12,9 +12,11 @@ use arbiter_server::{
 use diesel::{QueryDsl, SelectableHelper};
 use diesel_async::RunQueryDsl;

+const TEST_AAD: &[u8] = b"test-aad";
+
 #[tokio::test]
 #[test_log::test]
-async fn test_bootstrap() {
+async fn bootstrap() {
    let db = db::create_test_pool().await;
    let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
        .await
@@ -39,7 +41,7 @@ async fn test_bootstrap() {

 #[tokio::test]
 #[test_log::test]
-async fn test_bootstrap_rejects_double() {
+async fn bootstrap_rejects_double() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

@@ -50,14 +52,14 @@ async fn test_bootstrap_rejects_double() {

 #[tokio::test]
 #[test_log::test]
-async fn test_create_new_before_bootstrap_fails() {
+async fn create_new_before_bootstrap_fails() {
    let db = db::create_test_pool().await;
    let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
        .await
        .unwrap();

    let err = actor
-        .create_new(SafeCell::new(b"data".to_vec()))
+        .create_new(SafeCell::new(b"data".to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap_err();
    assert!(matches!(err, Error::NotBootstrapped));
@@ -65,19 +67,19 @@ async fn test_create_new_before_bootstrap_fails() {

 #[tokio::test]
 #[test_log::test]
-async fn test_decrypt_before_bootstrap_fails() {
+async fn decrypt_before_bootstrap_fails() {
    let db = db::create_test_pool().await;
    let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
        .await
        .unwrap();

-    let err = actor.decrypt(1).await.unwrap_err();
+    let err = actor.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
    assert!(matches!(err, Error::NotBootstrapped));
 }

 #[tokio::test]
 #[test_log::test]
-async fn test_new_restores_sealed_state() {
+async fn new_restores_sealed_state() {
    let db = db::create_test_pool().await;
    let actor = common::bootstrapped_vault(&db).await;
    drop(actor);
@@ -85,19 +87,19 @@ async fn test_new_restores_sealed_state() {
    let mut actor2 = Vault::new(db, GlobalActors::spawn_message_bus())
        .await
        .unwrap();
-    let err = actor2.decrypt(1).await.unwrap_err();
+    let err = actor2.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
    assert!(matches!(err, Error::Sealed));
 }

 #[tokio::test]
 #[test_log::test]
-async fn test_unseal_correct_password() {
+async fn unseal_correct_password() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

    let plaintext = b"survive a restart";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();
    drop(actor);
@@ -108,19 +110,19 @@ async fn test_unseal_correct_password() {
    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
    actor.try_unseal(seal_key).await.unwrap();

-    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }

 #[tokio::test]
 #[test_log::test]
-async fn test_unseal_wrong_then_correct_password() {
+async fn unseal_wrong_then_correct_password() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

    let plaintext = b"important data";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();
    drop(actor);
@@ -136,6 +138,6 @@ async fn test_unseal_wrong_then_correct_password() {
    let good_key = SafeCell::new(b"test-seal-key".to_vec());
    actor.try_unseal(good_key).await.unwrap();

-    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }
--- a/server/crates/arbiter-server/tests/vault/storage.rs
+++ b/server/crates/arbiter-server/tests/vault/storage.rs
@@ -10,45 +10,47 @@ use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper, dsl::update};
 use diesel_async::RunQueryDsl;
 use std::collections::HashSet;

+const TEST_AAD: &[u8] = b"test-aad";
+
 #[tokio::test]
 #[test_log::test]
-async fn test_create_decrypt_roundtrip() {
+async fn create_decrypt_roundtrip() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

    let plaintext = b"hello arbiter";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();

-    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }

 #[tokio::test]
 #[test_log::test]
-async fn test_decrypt_nonexistent_returns_not_found() {
+async fn decrypt_nonexistent_returns_not_found() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

-    let err = actor.decrypt(9999).await.unwrap_err();
+    let err = actor.decrypt(9999, TEST_AAD.to_vec()).await.unwrap_err();
    assert!(matches!(err, Error::NotFound));
 }

 #[tokio::test]
 #[test_log::test]
-async fn test_ciphertext_differs_across_entries() {
+async fn ciphertext_differs_across_entries() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

    let plaintext = b"same content";
    let id1 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();
    let id2 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();

@@ -68,22 +70,22 @@ async fn test_ciphertext_differs_across_entries() {

    assert_ne!(row1.ciphertext, row2.ciphertext);

-    let mut d1 = actor.decrypt(id1).await.unwrap();
-    let mut d2 = actor.decrypt(id2).await.unwrap();
+    let mut d1 = actor.decrypt(id1, TEST_AAD.to_vec()).await.unwrap();
+    let mut d2 = actor.decrypt(id2, TEST_AAD.to_vec()).await.unwrap();
    assert_eq!(*d1.read(), plaintext);
    assert_eq!(*d2.read(), plaintext);
 }

 #[tokio::test]
 #[test_log::test]
-async fn test_nonce_never_reused() {
+async fn nonce_never_reused() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

    let n = 5;
    for i in 0..n {
        actor
-            .create_new(SafeCell::new(format!("secret {i}").into_bytes()))
+            .create_new(SafeCell::new(format!("secret {i}").into_bytes()), TEST_AAD.to_vec())
            .await
            .unwrap();
    }
@@ -137,7 +139,7 @@ async fn broken_db_nonce_format_fails_closed() {
    drop(conn);

    let err = actor
-        .create_new(SafeCell::new(b"must fail".to_vec()))
+        .create_new(SafeCell::new(b"must fail".to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap_err();
    assert!(matches!(err, Error::BrokenDatabase));
@@ -145,7 +147,7 @@ async fn broken_db_nonce_format_fails_closed() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;
    let id = actor
-        .create_new(SafeCell::new(b"decrypt target".to_vec()))
+        .create_new(SafeCell::new(b"decrypt target".to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();
    let mut conn = db.get().await.unwrap();
@@ -156,6 +158,6 @@ async fn broken_db_nonce_format_fails_closed() {
        .unwrap();
    drop(conn);

-    let err = actor.decrypt(id).await.unwrap_err();
+    let err = actor.decrypt(id, TEST_AAD.to_vec()).await.unwrap_err();
    assert!(matches!(err, Error::BrokenDatabase));
 }
Author	SHA1	Message	Date
CleverWild	e79fc055d4	fix(errors)!: forbid interpolated details in wire-facing internal errors	2026-08-09 00:11:03 +02:00
Stas	357726bc5d	Merge pull request 'security: batch of fixes' (#95 ) from zeroized-bootstrap-token into main Some checks failed ci/woodpecker/push/server-audit Pipeline failed Details ci/woodpecker/push/server-vet Pipeline failed Details ci/woodpecker/push/server-lint Pipeline was successful Details ci/woodpecker/push/server-test Pipeline was successful Details Reviewed-on: #95	2026-06-29 18:00:14 +00:00
Clippy Bot	23827c613e	test(client-auth): update metadata test to reflect frozen-metadata behavior Some checks failed ci/woodpecker/pr/server-audit Pipeline failed Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline was successful Details ci/woodpecker/pr/useragent-analyze Pipeline failed Details	2026-06-28 12:06:06 +02:00
Clippy Bot	8381b68a52	Merge branch 'main' into zeroized-bootstrap-token Some checks failed ci/woodpecker/pr/server-audit Pipeline failed Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-27 13:25:27 +02:00
Clippy Bot	022003ac5e	fix: lints Some checks failed ci/woodpecker/pr/server-audit Pipeline failed Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-25 20:09:18 +02:00
CleverWild	00ddf99d77	fix!: protect evm_wallet integrity and bind key ciphertext to wallet address Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details Three independent failures allowed an offline attacker with DB write access to sign transactions using a different wallet's private key: 1. evm_wallet had no HMAC envelope — aead_encrypted_id could be swapped silently. 2. AEAD used a static tag as AAD — any valid ciphertext decrypted as any wallet key. 3. No post-decryption check that the derived address matched the requested wallet. Fix: sign_entity covers (address, aead_encrypted_id) in a single transaction; CreateNew/Decrypt take caller-provided AAD (wallet address bytes); after decryption signer.address() is verified against the requested wallet address.	2026-06-22 17:53:34 +02:00
CleverWild	b7ab5c79b7	fix(client-auth): freeze client metadata after initial operator approval Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-22 16:07:58 +02:00
CleverWild	b8e092b9d7	fix(operator): bind sign-transaction to operator-approved client set Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-22 15:58:40 +02:00
CleverWild	9c9dc1fbb5	fix(integrity): return AttestationStatus::Unavailable for key version mismatch Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-22 15:50:43 +02:00
CleverWild	77bf19f99e	fix(wallet): delete access entries by entry ID instead of wallet ID Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-22 14:55:32 +02:00
CleverWild	f0456157d5	security(bootstrap): use SafeCell for token storage instead of zeroize Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-19 22:53:28 +02:00
CleverWild	c12c12d73e	fix(UA): signing endpoint accepts arbitrary `client_id` Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-19 22:21:48 +02:00
CleverWild	670448292a	security: feat unseal and bootstrap handshake brute-force protection Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-18 21:16:38 +02:00
CleverWild	85f27d8f09	fix(bootstrap): token persists on disk with weak file permissions #59 Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-18 20:59:24 +02:00
CleverWild	32ceb27d77	security(server): use SysRng directly for bootstrap token generation Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline failed Details Replace make_rng()/StdRng with UnwrapErr(SysRng) to eliminate the PRNG intermediate layer and make OS entropy derivation explicit and unambiguous. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-18 19:30:31 +02:00
CleverWild	dc03923c24	security(memory): zeroization of bootstrap token Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-18 17:16:06 +02:00
CleverWild	b843105533	fix(user-agent): zombie sessions #74 Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline was successful Details ci/woodpecker/push/server-audit Pipeline was successful Details ci/woodpecker/push/server-vet Pipeline failed Details ci/woodpecker/push/server-lint Pipeline was successful Details ci/woodpecker/push/server-test Pipeline was successful Details	2026-06-18 16:29:43 +02:00
Stas	a8e4a710f1	Merge pull request 'security(server): bind grant revocation state (revoked_at) to integrity hash' (#83 ) from security-hash-revoke_at into main Some checks failed ci/woodpecker/push/server-audit Pipeline was successful Details ci/woodpecker/push/server-vet Pipeline failed Details ci/woodpecker/push/server-lint Pipeline was successful Details ci/woodpecker/push/server-test Pipeline was successful Details ci/woodpecker/push/useragent-analyze Pipeline failed Details Reviewed-on: #83	2026-06-11 09:44:28 +00:00
CleverWild	d99c87c473	fix: lints Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-09 21:07:01 +02:00
CleverWild	303120c9ac	Merge branch 'main' into security-hash-revoke_at Some checks failed ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-09 20:58:20 +02:00
CleverWild	32f317384d	security(evm): remove client-controlled wallet_access_id from grant revocation Some checks failed ci/woodpecker/pr/server-audit Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-09 19:36:44 +02:00
CleverWild	4bb2c062dc	feat(evm): add wallet_access_id to grant deletion requests and revocation logic Some checks failed ci/woodpecker/pr/server-audit Pipeline failed Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-09 19:16:21 +02:00
CleverWild	b0a3f37cea	refactor(evm): implement revoke_grant method for grant revocation	2026-06-09 19:11:39 +02:00
CleverWild	58a72da46c	Merge branch 'security-hash-revoke_at' of ssh://git.markettakers.org:22222/MarketTakers/arbiter into security-hash-revoke_at Some checks failed ci/woodpecker/pr/server-audit Pipeline failed Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-09 19:10:57 +02:00
CleverWild	e287459b10	revert(server): bind grant revocation state (revoked_at) to integrity hash	2026-06-09 18:45:30 +02:00
CleverWild	3c482da917	fix(smlang::statemachine): macro invocation requires inner types to be public Some checks failed ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details ci/woodpecker/push/server-audit Pipeline was successful Details ci/woodpecker/push/server-lint Pipeline failed Details ci/woodpecker/push/server-vet Pipeline failed Details ci/woodpecker/push/server-test Pipeline was successful Details	2026-06-08 18:00:52 +02:00
CleverWild	5a34463228	security(server): bind grant revocation state (revoked_at) to integrity hash Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-04-08 12:09:54 +02:00