ci: fix step name

Reviewed-on: #45

.woodpecker/server-compile.yaml

@@ -0,0 +1,26 @@
+when:
+  - event: pull_request
+    path:
+      include: [".woodpecker/server-*.yaml", "server/**"]
+  - event: push
+    branch: main
+    path:
+      include: [".woodpecker/server-*.yaml", "server/**"]
+
+steps:
+  - name: compile
+    image: jdxcode/mise:latest
+    directory: server
+    environment:
+      CARGO_TERM_COLOR: always
+      CARGO_TARGET_DIR: /usr/local/cargo/target
+      CARGO_HOME: /usr/local/cargo/registry
+    volumes:
+      - cargo-target:/usr/local/cargo/target
+      - cargo-registry:/usr/local/cargo/registry
+    commands:
+      - apt-get update && apt-get install -y pkg-config
+      # Install only the necessary Rust toolchain
+      - mise install rust
+      - mise install protoc
+      - cargo check --all-features

IMPLEMENTATION.md

@@ -67,7 +67,18 @@ The `program_client.nonce` column stores the **next usable nonce** — i.e. it i
 ## Cryptography
 
 ### Authentication
-- **Signature scheme:** ed25519
+- **Client protocol:** ed25519
+
+### User-Agent Authentication
+
+User-agent authentication supports multiple signature schemes because platform-provided "hardware-bound" keys do not expose a uniform algorithm across operating systems and hardware.
+
+- **Supported schemes:** RSA, Ed25519, ECDSA (secp256k1)
+- **Why:** the user agent authenticates with keys backed by platform facilities, and those facilities differ by platform
+- **Apple Silicon Secure Enclave / Secure Element:** ECDSA-only in practice
+- **Windows Hello / TPM 2.0:** currently RSA-backed in our integration
+
+This is why the user-agent auth protocol carries an explicit `KeyType`, while the SDK client protocol remains fixed to ed25519.
 
 ### Encryption at Rest
 - **Scheme:** Symmetric AEAD — currently **XChaCha20-Poly1305**
@@ -148,7 +159,7 @@ The central abstraction is the `Policy` trait. Each implementation handles one s
 Every grant has two layers:
 
 - **Shared (`evm_basic_grant`)** — wallet, chain, validity period, gas fee caps, transaction count rate limit. One row per grant regardless of type.
-- **Specific** — policy-owned tables (`evm_ether_transfer_grant`, `evm_token_transfer_grant`, etc.) holding type-specific configuration.
+- **Specific** — policy-owned tables (`evm_ether_transfer_grant`, `evm_token_transfer_grant`) holding type-specific configuration.
 
 `find_all_grants` uses a `#[diesel::auto_type]` base join between the specific and shared tables, then batch-loads related rows (targets, volume limits) in two additional queries to avoid N+1.
 
@@ -171,7 +182,6 @@ These are checked centrally in `check_shared_constraints` before policy evaluati
 - **Only EIP-1559 transactions are supported.** Legacy and EIP-2930 types are rejected outright.
 - **No opaque-calldata (unknown contract) grant type.** The architecture describes a category for unrecognised contracts, but no policy implements it yet. Any transaction that is not a plain ETH transfer or a known ERC-20 transfer is unconditionally rejected.
 - **Token registry is static.** Tokens are recognised only if they appear in the hard-coded `arbiter_tokens_registry` crate. There is no mechanism to register additional contracts at runtime.
-- **Nonce management is not implemented.** The architecture lists nonce deduplication as a core responsibility, but no nonce tracking or enforcement exists yet.
 
 ---
 
@@ -179,5 +189,5 @@ These are checked centrally in `check_shared_constraints` before policy evaluati
 
 The unsealed root key must be held in a hardened memory cell resistant to dumps, page swaps, and hibernation.
 
-- **Current:** Using the `memsafe` crate as an interim solution
-- **Planned:** Custom implementation based on `mlock` (Unix) and `VirtualProtect` (Windows)
+- **Current:** A dedicated memory-protection abstraction is in place, with `memsafe` used behind that abstraction today
+- **Planned:** Additional backends can be introduced behind the same abstraction, including a custom implementation based on `mlock` (Unix) and `VirtualProtect` (Windows)

docs/superpowers/plans/2026-03-28-grant-grid-view.md

@@ -1,821 +0,0 @@
-# Grant Grid View Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Add an "EVM Grants" dashboard tab that displays all grants as enriched cards (type, chain, wallet address, client name) with per-card revoke support.
-
-**Architecture:** A new `walletAccessListProvider` fetches wallet accesses with their DB row IDs. The screen (`grants.dart`) watches only `evmGrantsProvider` for top-level state. Each `GrantCard` widget (its own file) watches enrichment providers (`walletAccessListProvider`, `evmProvider`, `sdkClientsProvider`) and the revoke mutation directly — keeping rebuilds scoped to the card. The screen is registered as a dashboard tab in `AdaptiveScaffold`.
-
-**Tech Stack:** Flutter, Riverpod (`riverpod_annotation` + `build_runner` codegen), `sizer` (adaptive sizing), `auto_route`, Protocol Buffers (Dart), `Palette` design tokens.
-
----
-
-## File Map
-
-| File | Action | Responsibility |
-|---|---|---|
-| `useragent/lib/theme/palette.dart` | Modify | Add `Palette.token` (indigo accent for token-transfer cards) |
-| `useragent/lib/features/connection/evm/wallet_access.dart` | Modify | Add `listAllWalletAccesses()` function |
-| `useragent/lib/providers/sdk_clients/wallet_access_list.dart` | Create | `WalletAccessListProvider` — fetches full wallet access list with IDs |
-| `useragent/lib/screens/dashboard/evm/grants/widgets/grant_card.dart` | Create | `GrantCard` widget — watches enrichment providers + revoke mutation; one card per grant |
-| `useragent/lib/screens/dashboard/evm/grants/grants.dart` | Create | `EvmGrantsScreen` — watches `evmGrantsProvider`; handles loading/error/empty/data states; renders `GrantCard` list |
-| `useragent/lib/router.dart` | Modify | Register `EvmGrantsRoute` in dashboard children |
-| `useragent/lib/screens/dashboard.dart` | Modify | Add Grants entry to `routes` list and `NavigationDestination` list |
-
----
-
-## Task 1: Add `Palette.token`
-
-**Files:**
-- Modify: `useragent/lib/theme/palette.dart`
-
-- [ ] **Step 1: Add the color**
-
-Replace the contents of `useragent/lib/theme/palette.dart` with:
-
-```dart
-import 'package:flutter/material.dart';
-
-class Palette {
-  static const ink = Color(0xFF15263C);
-  static const coral = Color(0xFFE26254);
-  static const cream = Color(0xFFFFFAF4);
-  static const line = Color(0x1A15263C);
-  static const token = Color(0xFF5C6BC0);
-}
-```
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd useragent && flutter analyze lib/theme/palette.dart
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(theme): add Palette.token for token-transfer grant cards"
-jj new
-```
-
----
-
-## Task 2: Add `listAllWalletAccesses` feature function
-
-**Files:**
-- Modify: `useragent/lib/features/connection/evm/wallet_access.dart`
-
-`readClientWalletAccess` (existing) filters the list to one client's wallet IDs and returns `Set<int>`. This new function returns the complete unfiltered list with row IDs so the grant cards can resolve wallet_access_id → wallet + client.
-
-- [ ] **Step 1: Append function**
-
-Add at the bottom of `useragent/lib/features/connection/evm/wallet_access.dart`:
-
-```dart
-Future<List<SdkClientWalletAccess>> listAllWalletAccesses(
-  Connection connection,
-) async {
-  final response = await connection.ask(
-    UserAgentRequest(listWalletAccess: Empty()),
-  );
-  if (!response.hasListWalletAccessResponse()) {
-    throw Exception(
-      'Expected list wallet access response, got ${response.whichPayload()}',
-    );
-  }
-  return response.listWalletAccessResponse.accesses.toList(growable: false);
-}
-```
-
-Each returned `SdkClientWalletAccess` has:
-- `.id` — the `evm_wallet_access` row ID (same value as `wallet_access_id` in a `GrantEntry`)
-- `.access.walletId` — the EVM wallet DB ID
-- `.access.sdkClientId` — the SDK client DB ID
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd useragent && flutter analyze lib/features/connection/evm/wallet_access.dart
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(evm): add listAllWalletAccesses feature function"
-jj new
-```
-
----
-
-## Task 3: Create `WalletAccessListProvider`
-
-**Files:**
-- Create: `useragent/lib/providers/sdk_clients/wallet_access_list.dart`
-- Generated: `useragent/lib/providers/sdk_clients/wallet_access_list.g.dart`
-
-Mirrors the structure of `EvmGrants` in `providers/evm/evm_grants.dart` — class-based `@riverpod` with a `refresh()` method.
-
-- [ ] **Step 1: Write the provider**
-
-Create `useragent/lib/providers/sdk_clients/wallet_access_list.dart`:
-
-```dart
-import 'package:arbiter/features/connection/evm/wallet_access.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:arbiter/providers/connection/connection_manager.dart';
-import 'package:mtcore/markettakers.dart';
-import 'package:riverpod_annotation/riverpod_annotation.dart';
-
-part 'wallet_access_list.g.dart';
-
-@riverpod
-class WalletAccessList extends _$WalletAccessList {
-  @override
-  Future<List<SdkClientWalletAccess>?> build() async {
-    final connection = await ref.watch(connectionManagerProvider.future);
-    if (connection == null) {
-      return null;
-    }
-
-    try {
-      return await listAllWalletAccesses(connection);
-    } catch (e, st) {
-      talker.handle(e, st);
-      rethrow;
-    }
-  }
-
-  Future<void> refresh() async {
-    final connection = await ref.read(connectionManagerProvider.future);
-    if (connection == null) {
-      state = const AsyncData(null);
-      return;
-    }
-
-    state = const AsyncLoading();
-    state = await AsyncValue.guard(() => listAllWalletAccesses(connection));
-  }
-}
-```
-
-- [ ] **Step 2: Run code generation**
-
-```sh
-cd useragent && dart run build_runner build --delete-conflicting-outputs
-```
-
-Expected: `useragent/lib/providers/sdk_clients/wallet_access_list.g.dart` created. No errors.
-
-- [ ] **Step 3: Verify**
-
-```sh
-cd useragent && flutter analyze lib/providers/sdk_clients/
-```
-
-Expected: no issues.
-
-- [ ] **Step 4: Commit**
-
-```sh
-jj describe -m "feat(providers): add WalletAccessListProvider"
-jj new
-```
-
----
-
-## Task 4: Create `GrantCard` widget
-
-**Files:**
-- Create: `useragent/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`
-
-This widget owns all per-card logic: enrichment lookups, revoke action, and rebuild scope. The screen only passes it a `GrantEntry` — the card fetches everything else itself.
-
-**Key types:**
-- `GrantEntry` (from `proto/evm.pb.dart`): `.id`, `.shared.walletAccessId`, `.shared.chainId`, `.specific.whichGrant()`
-- `SpecificGrant_Grant.etherTransfer` / `.tokenTransfer` — enum values for the oneof
-- `SdkClientWalletAccess` (from `proto/user_agent.pb.dart`): `.id`, `.access.walletId`, `.access.sdkClientId`
-- `WalletEntry` (from `proto/evm.pb.dart`): `.id`, `.address` (List<int>)
-- `SdkClientEntry` (from `proto/user_agent.pb.dart`): `.id`, `.info.name`
-- `revokeEvmGrantMutation` — `Mutation<void>` (global; all revoke buttons disable together while any revoke is in flight)
-- `executeRevokeEvmGrant(ref, grantId: int)` — `Future<void>`
-
-- [ ] **Step 1: Write the widget**
-
-Create `useragent/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`:
-
-```dart
-import 'package:arbiter/proto/evm.pb.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:arbiter/providers/evm/evm.dart';
-import 'package:arbiter/providers/evm/evm_grants.dart';
-import 'package:arbiter/providers/sdk_clients/list.dart';
-import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
-import 'package:arbiter/theme/palette.dart';
-import 'package:flutter/material.dart';
-import 'package:hooks_riverpod/experimental/mutation.dart';
-import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:sizer/sizer.dart';
-
-String _shortAddress(List<int> bytes) {
-  final hex = bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();
-  return '0x${hex.substring(0, 6)}...${hex.substring(hex.length - 4)}';
-}
-
-String _formatError(Object error) {
-  final message = error.toString();
-  if (message.startsWith('Exception: ')) {
-    return message.substring('Exception: '.length);
-  }
-  return message;
-}
-
-class GrantCard extends ConsumerWidget {
-  const GrantCard({super.key, required this.grant});
-
-  final GrantEntry grant;
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    // Enrichment lookups — each watch scopes rebuilds to this card only
-    final walletAccesses =
-        ref.watch(walletAccessListProvider).asData?.value ?? const [];
-    final wallets = ref.watch(evmProvider).asData?.value ?? const [];
-    final clients = ref.watch(sdkClientsProvider).asData?.value ?? const [];
-    final revoking = ref.watch(revokeEvmGrantMutation) is MutationPending;
-
-    final isEther =
-        grant.specific.whichGrant() == SpecificGrant_Grant.etherTransfer;
-    final accent = isEther ? Palette.coral : Palette.token;
-    final typeLabel = isEther ? 'Ether' : 'Token';
-    final theme = Theme.of(context);
-    final muted = Palette.ink.withValues(alpha: 0.62);
-
-    // Resolve wallet_access_id → wallet address + client name
-    final accessById = <int, SdkClientWalletAccess>{
-      for (final a in walletAccesses) a.id: a,
-    };
-    final walletById = <int, WalletEntry>{
-      for (final w in wallets) w.id: w,
-    };
-    final clientNameById = <int, String>{
-      for (final c in clients) c.id: c.info.name,
-    };
-
-    final accessId = grant.shared.walletAccessId;
-    final access = accessById[accessId];
-    final wallet = access != null ? walletById[access.access.walletId] : null;
-
-    final walletLabel = wallet != null
-        ? _shortAddress(wallet.address)
-        : 'Access #$accessId';
-
-    final clientLabel = () {
-      if (access == null) return '';
-      final name = clientNameById[access.access.sdkClientId] ?? '';
-      return name.isEmpty ? 'Client #${access.access.sdkClientId}' : name;
-    }();
-
-    void showError(String message) {
-      if (!context.mounted) return;
-      ScaffoldMessenger.of(context).showSnackBar(
-        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
-      );
-    }
-
-    Future<void> revoke() async {
-      try {
-        await executeRevokeEvmGrant(ref, grantId: grant.id);
-      } catch (e) {
-        showError(_formatError(e));
-      }
-    }
-
-    return Container(
-      decoration: BoxDecoration(
-        borderRadius: BorderRadius.circular(24),
-        color: Palette.cream.withValues(alpha: 0.92),
-        border: Border.all(color: Palette.line),
-      ),
-      child: IntrinsicHeight(
-        child: Row(
-          crossAxisAlignment: CrossAxisAlignment.stretch,
-          children: [
-            // Accent strip
-            Container(
-              width: 0.8.w,
-              decoration: BoxDecoration(
-                color: accent,
-                borderRadius: const BorderRadius.horizontal(
-                  left: Radius.circular(24),
-                ),
-              ),
-            ),
-            // Card body
-            Expanded(
-              child: Padding(
-                padding: EdgeInsets.symmetric(
-                  horizontal: 1.6.w,
-                  vertical: 1.4.h,
-                ),
-                child: Column(
-                  crossAxisAlignment: CrossAxisAlignment.start,
-                  children: [
-                    // Row 1: type badge · chain · spacer · revoke button
-                    Row(
-                      children: [
-                        Container(
-                          padding: EdgeInsets.symmetric(
-                            horizontal: 1.w,
-                            vertical: 0.4.h,
-                          ),
-                          decoration: BoxDecoration(
-                            color: accent.withValues(alpha: 0.15),
-                            borderRadius: BorderRadius.circular(8),
-                          ),
-                          child: Text(
-                            typeLabel,
-                            style: theme.textTheme.labelSmall?.copyWith(
-                              color: accent,
-                              fontWeight: FontWeight.w800,
-                            ),
-                          ),
-                        ),
-                        SizedBox(width: 1.w),
-                        Container(
-                          padding: EdgeInsets.symmetric(
-                            horizontal: 1.w,
-                            vertical: 0.4.h,
-                          ),
-                          decoration: BoxDecoration(
-                            color: Palette.ink.withValues(alpha: 0.06),
-                            borderRadius: BorderRadius.circular(8),
-                          ),
-                          child: Text(
-                            'Chain ${grant.shared.chainId}',
-                            style: theme.textTheme.labelSmall?.copyWith(
-                              color: muted,
-                              fontWeight: FontWeight.w700,
-                            ),
-                          ),
-                        ),
-                        const Spacer(),
-                        if (revoking)
-                          SizedBox(
-                            width: 1.8.h,
-                            height: 1.8.h,
-                            child: CircularProgressIndicator(
-                              strokeWidth: 2,
-                              color: Palette.coral,
-                            ),
-                          )
-                        else
-                          OutlinedButton.icon(
-                            onPressed: revoke,
-                            style: OutlinedButton.styleFrom(
-                              foregroundColor: Palette.coral,
-                              side: BorderSide(
-                                color: Palette.coral.withValues(alpha: 0.4),
-                              ),
-                              padding: EdgeInsets.symmetric(
-                                horizontal: 1.w,
-                                vertical: 0.6.h,
-                              ),
-                              shape: RoundedRectangleBorder(
-                                borderRadius: BorderRadius.circular(10),
-                              ),
-                            ),
-                            icon: const Icon(Icons.block_rounded, size: 16),
-                            label: const Text('Revoke'),
-                          ),
-                      ],
-                    ),
-                    SizedBox(height: 0.8.h),
-                    // Row 2: wallet address · client name
-                    Row(
-                      children: [
-                        Text(
-                          walletLabel,
-                          style: theme.textTheme.bodySmall?.copyWith(
-                            color: Palette.ink,
-                            fontFamily: 'monospace',
-                          ),
-                        ),
-                        Padding(
-                          padding: EdgeInsets.symmetric(horizontal: 0.8.w),
-                          child: Text(
-                            '·',
-                            style: theme.textTheme.bodySmall
-                                ?.copyWith(color: muted),
-                          ),
-                        ),
-                        Expanded(
-                          child: Text(
-                            clientLabel,
-                            maxLines: 1,
-                            overflow: TextOverflow.ellipsis,
-                            style: theme.textTheme.bodySmall
-                                ?.copyWith(color: muted),
-                          ),
-                        ),
-                      ],
-                    ),
-                  ],
-                ),
-              ),
-            ),
-          ],
-        ),
-      ),
-    );
-  }
-}
-```
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd useragent && flutter analyze lib/screens/dashboard/evm/grants/widgets/grant_card.dart
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(grants): add GrantCard widget with self-contained enrichment"
-jj new
-```
-
----
-
-## Task 5: Create `EvmGrantsScreen`
-
-**Files:**
-- Create: `useragent/lib/screens/dashboard/evm/grants/grants.dart`
-
-The screen watches only `evmGrantsProvider` for top-level state (loading / error / no connection / empty / data). When there is data it renders a list of `GrantCard` widgets — each card manages its own enrichment subscriptions.
-
-- [ ] **Step 1: Write the screen**
-
-Create `useragent/lib/screens/dashboard/evm/grants/grants.dart`:
-
-```dart
-import 'package:arbiter/proto/evm.pb.dart';
-import 'package:arbiter/providers/evm/evm_grants.dart';
-import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
-import 'package:arbiter/router.gr.dart';
-import 'package:arbiter/screens/dashboard/evm/grants/widgets/grant_card.dart';
-import 'package:arbiter/theme/palette.dart';
-import 'package:arbiter/widgets/page_header.dart';
-import 'package:auto_route/auto_route.dart';
-import 'package:flutter/material.dart';
-import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:sizer/sizer.dart';
-
-String _formatError(Object error) {
-  final message = error.toString();
-  if (message.startsWith('Exception: ')) {
-    return message.substring('Exception: '.length);
-  }
-  return message;
-}
-
-// ─── State panel ──────────────────────────────────────────────────────────────
-
-class _StatePanel extends StatelessWidget {
-  const _StatePanel({
-    required this.icon,
-    required this.title,
-    required this.body,
-    this.actionLabel,
-    this.onAction,
-    this.busy = false,
-  });
-
-  final IconData icon;
-  final String title;
-  final String body;
-  final String? actionLabel;
-  final Future<void> Function()? onAction;
-  final bool busy;
-
-  @override
-  Widget build(BuildContext context) {
-    final theme = Theme.of(context);
-
-    return Container(
-      decoration: BoxDecoration(
-        borderRadius: BorderRadius.circular(24),
-        color: Palette.cream.withValues(alpha: 0.92),
-        border: Border.all(color: Palette.line),
-      ),
-      child: Padding(
-        padding: EdgeInsets.all(2.8.h),
-        child: Column(
-          crossAxisAlignment: CrossAxisAlignment.start,
-          children: [
-            if (busy)
-              SizedBox(
-                width: 2.8.h,
-                height: 2.8.h,
-                child: const CircularProgressIndicator(strokeWidth: 2.5),
-              )
-            else
-              Icon(icon, size: 34, color: Palette.coral),
-            SizedBox(height: 1.8.h),
-            Text(
-              title,
-              style: theme.textTheme.headlineSmall?.copyWith(
-                color: Palette.ink,
-                fontWeight: FontWeight.w800,
-              ),
-            ),
-            SizedBox(height: 1.h),
-            Text(
-              body,
-              style: theme.textTheme.bodyLarge?.copyWith(
-                color: Palette.ink.withValues(alpha: 0.72),
-                height: 1.5,
-              ),
-            ),
-            if (actionLabel != null && onAction != null) ...[
-              SizedBox(height: 2.h),
-              OutlinedButton.icon(
-                onPressed: () => onAction!(),
-                icon: const Icon(Icons.refresh),
-                label: Text(actionLabel!),
-              ),
-            ],
-          ],
-        ),
-      ),
-    );
-  }
-}
-
-// ─── Grant list ───────────────────────────────────────────────────────────────
-
-class _GrantList extends StatelessWidget {
-  const _GrantList({required this.grants});
-
-  final List<GrantEntry> grants;
-
-  @override
-  Widget build(BuildContext context) {
-    return Column(
-      children: [
-        for (var i = 0; i < grants.length; i++)
-          Padding(
-            padding: EdgeInsets.only(
-              bottom: i == grants.length - 1 ? 0 : 1.8.h,
-            ),
-            child: GrantCard(grant: grants[i]),
-          ),
-      ],
-    );
-  }
-}
-
-// ─── Screen ───────────────────────────────────────────────────────────────────
-
-@RoutePage()
-class EvmGrantsScreen extends ConsumerWidget {
-  const EvmGrantsScreen({super.key});
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    // Screen watches only the grant list for top-level state decisions
-    final grantsAsync = ref.watch(evmGrantsProvider);
-
-    Future<void> refresh() async {
-      await Future.wait([
-        ref.read(evmGrantsProvider.notifier).refresh(),
-        ref.read(walletAccessListProvider.notifier).refresh(),
-      ]);
-    }
-
-    void showMessage(String message) {
-      if (!context.mounted) return;
-      ScaffoldMessenger.of(context).showSnackBar(
-        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
-      );
-    }
-
-    Future<void> safeRefresh() async {
-      try {
-        await refresh();
-      } catch (e) {
-        showMessage(_formatError(e));
-      }
-    }
-
-    final grantsState = grantsAsync.asData?.value;
-    final grants = grantsState?.grants;
-
-    final content = switch (grantsAsync) {
-      AsyncLoading() when grantsState == null => const _StatePanel(
-        icon: Icons.hourglass_top,
-        title: 'Loading grants',
-        body: 'Pulling grant registry from Arbiter.',
-        busy: true,
-      ),
-      AsyncError(:final error) => _StatePanel(
-        icon: Icons.sync_problem,
-        title: 'Grant registry unavailable',
-        body: _formatError(error),
-        actionLabel: 'Retry',
-        onAction: safeRefresh,
-      ),
-      AsyncData(:final value) when value == null => _StatePanel(
-        icon: Icons.portable_wifi_off,
-        title: 'No active server connection',
-        body: 'Reconnect to Arbiter to list EVM grants.',
-        actionLabel: 'Refresh',
-        onAction: safeRefresh,
-      ),
-      _ when grants != null && grants.isEmpty => _StatePanel(
-        icon: Icons.policy_outlined,
-        title: 'No grants yet',
-        body: 'Create a grant to allow SDK clients to sign transactions.',
-        actionLabel: 'Create grant',
-        onAction: () => context.router.push(const CreateEvmGrantRoute()),
-      ),
-      _ => _GrantList(grants: grants ?? const []),
-    };
-
-    return Scaffold(
-      body: SafeArea(
-        child: RefreshIndicator.adaptive(
-          color: Palette.ink,
-          backgroundColor: Colors.white,
-          onRefresh: safeRefresh,
-          child: ListView(
-            physics: const BouncingScrollPhysics(
-              parent: AlwaysScrollableScrollPhysics(),
-            ),
-            padding: EdgeInsets.fromLTRB(2.4.w, 2.4.h, 2.4.w, 3.2.h),
-            children: [
-              PageHeader(
-                title: 'EVM Grants',
-                isBusy: grantsAsync.isLoading,
-                actions: [
-                  FilledButton.icon(
-                    onPressed: () =>
-                        context.router.push(const CreateEvmGrantRoute()),
-                    icon: const Icon(Icons.add_rounded),
-                    label: const Text('Create grant'),
-                  ),
-                  SizedBox(width: 1.w),
-                  OutlinedButton.icon(
-                    onPressed: safeRefresh,
-                    style: OutlinedButton.styleFrom(
-                      foregroundColor: Palette.ink,
-                      side: BorderSide(color: Palette.line),
-                      padding: EdgeInsets.symmetric(
-                        horizontal: 1.4.w,
-                        vertical: 1.2.h,
-                      ),
-                      shape: RoundedRectangleBorder(
-                        borderRadius: BorderRadius.circular(14),
-                      ),
-                    ),
-                    icon: const Icon(Icons.refresh, size: 18),
-                    label: const Text('Refresh'),
-                  ),
-                ],
-              ),
-              SizedBox(height: 1.8.h),
-              content,
-            ],
-          ),
-        ),
-      ),
-    );
-  }
-}
-```
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd useragent && flutter analyze lib/screens/dashboard/evm/grants/
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(grants): add EvmGrantsScreen"
-jj new
-```
-
----
-
-## Task 6: Wire router and dashboard tab
-
-**Files:**
-- Modify: `useragent/lib/router.dart`
-- Modify: `useragent/lib/screens/dashboard.dart`
-- Regenerated: `useragent/lib/router.gr.dart`
-
-- [ ] **Step 1: Add route to `router.dart`**
-
-Replace the contents of `useragent/lib/router.dart` with:
-
-```dart
-import 'package:auto_route/auto_route.dart';
-
-import 'router.gr.dart';
-
-@AutoRouterConfig(generateForDir: ['lib/screens'])
-class Router extends RootStackRouter {
-  @override
-  List<AutoRoute> get routes => [
-    AutoRoute(page: Bootstrap.page, path: '/bootstrap', initial: true),
-    AutoRoute(page: ServerInfoSetupRoute.page, path: '/server-info'),
-    AutoRoute(page: ServerConnectionRoute.page, path: '/server-connection'),
-    AutoRoute(page: VaultSetupRoute.page, path: '/vault'),
-    AutoRoute(page: ClientDetailsRoute.page, path: '/clients/:clientId'),
-    AutoRoute(page: CreateEvmGrantRoute.page, path: '/evm-grants/create'),
-
-    AutoRoute(
-      page: DashboardRouter.page,
-      path: '/dashboard',
-      children: [
-        AutoRoute(page: EvmRoute.page, path: 'evm'),
-        AutoRoute(page: ClientsRoute.page, path: 'clients'),
-        AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
-        AutoRoute(page: AboutRoute.page, path: 'about'),
-      ],
-    ),
-  ];
-}
-```
-
-- [ ] **Step 2: Update `dashboard.dart`**
-
-In `useragent/lib/screens/dashboard.dart`, replace the `routes` constant:
-
-```dart
-final routes = [
-  const EvmRoute(),
-  const ClientsRoute(),
-  const EvmGrantsRoute(),
-  const AboutRoute(),
-];
-```
-
-And replace the `destinations` list inside `AdaptiveScaffold`:
-
-```dart
-destinations: const [
-  NavigationDestination(
-    icon: Icon(Icons.account_balance_wallet_outlined),
-    selectedIcon: Icon(Icons.account_balance_wallet),
-    label: 'Wallets',
-  ),
-  NavigationDestination(
-    icon: Icon(Icons.devices_other_outlined),
-    selectedIcon: Icon(Icons.devices_other),
-    label: 'Clients',
-  ),
-  NavigationDestination(
-    icon: Icon(Icons.policy_outlined),
-    selectedIcon: Icon(Icons.policy),
-    label: 'Grants',
-  ),
-  NavigationDestination(
-    icon: Icon(Icons.info_outline),
-    selectedIcon: Icon(Icons.info),
-    label: 'About',
-  ),
-],
-```
-
-- [ ] **Step 3: Regenerate router**
-
-```sh
-cd useragent && dart run build_runner build --delete-conflicting-outputs
-```
-
-Expected: `lib/router.gr.dart` updated, `EvmGrantsRoute` now available, no errors.
-
-- [ ] **Step 4: Full project verify**
-
-```sh
-cd useragent && flutter analyze
-```
-
-Expected: no issues.
-
-- [ ] **Step 5: Commit**
-
-```sh
-jj describe -m "feat(nav): add Grants dashboard tab"
-jj new
-```

docs/superpowers/specs/2026-03-28-grant-grid-view-design.md

@@ -1,170 +0,0 @@
-# Grant Grid View — Design Spec
-
-**Date:** 2026-03-28
-
-## Overview
-
-Add a "Grants" dashboard tab to the Flutter user-agent app that displays all EVM grants as a card-based grid. Each card shows a compact summary (type, chain, wallet address, client name) with a revoke action. The tab integrates into the existing `AdaptiveScaffold` navigation alongside Wallets, Clients, and About.
-
-## Scope
-
-- New `walletAccessListProvider` for fetching wallet access entries with their DB row IDs
-- New `EvmGrantsScreen` as a dashboard tab
-- Grant card widget with enriched display (type, chain, wallet, client)
-- Revoke action wired to existing `executeRevokeEvmGrant` mutation
-- Dashboard tab bar and router updated
-- New token-transfer accent color added to `Palette`
-
-**Out of scope:** Fixing grant creation (separate task).
-
----
-
-## Data Layer
-
-### `walletAccessListProvider`
-
-**File:** `useragent/lib/providers/sdk_clients/wallet_access_list.dart`
-
-- `@riverpod` class, watches `connectionManagerProvider.future`
-- Returns `List<SdkClientWalletAccess>?` (null when not connected)
-- Each entry: `.id` (wallet_access_id), `.access.walletId`, `.access.sdkClientId`
-- Exposes a `refresh()` method following the same pattern as `EvmGrants.refresh()`
-
-### Enrichment at render time (Approach A)
-
-The `EvmGrantsScreen` watches four providers:
-1. `evmGrantsProvider` — the grant list
-2. `walletAccessListProvider` — to resolve wallet_access_id → (wallet_id, sdk_client_id)
-3. `evmProvider` — to resolve wallet_id → wallet address
-4. `sdkClientsProvider` — to resolve sdk_client_id → client name
-
-All lookups are in-memory Maps built inside the build method; no extra model class needed.
-
-Fallbacks:
-- Wallet address not found → `"Access #N"` where N is the wallet_access_id
-- Client name not found → `"Client #N"` where N is the sdk_client_id
-
----
-
-## Route Structure
-
-```
-/dashboard
-  /evm          ← existing (Wallets tab)
-  /clients      ← existing (Clients tab)
-  /grants       ← NEW (Grants tab)
-  /about        ← existing
-
-/evm-grants/create  ← existing push route (unchanged)
-```
-
-### Changes to `router.dart`
-
-Add inside dashboard children:
-```dart
-AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
-```
-
-### Changes to `dashboard.dart`
-
-Add to `routes` list:
-```dart
-const EvmGrantsRoute()
-```
-
-Add `NavigationDestination`:
-```dart
-NavigationDestination(
-  icon: Icon(Icons.policy_outlined),
-  selectedIcon: Icon(Icons.policy),
-  label: 'Grants',
-),
-```
-
----
-
-## Screen: `EvmGrantsScreen`
-
-**File:** `useragent/lib/screens/dashboard/evm/grants/grants.dart`
-
-```
-Scaffold
-└─ SafeArea
-   └─ RefreshIndicator.adaptive (refreshes evmGrantsProvider + walletAccessListProvider)
-      └─ ListView (BouncingScrollPhysics + AlwaysScrollableScrollPhysics)
-         ├─ PageHeader
-         │    title: 'EVM Grants'
-         │    isBusy: evmGrantsProvider.isLoading
-         │    actions: [CreateGrantButton, RefreshButton]
-         ├─ SizedBox(height: 1.8.h)
-         └─ <content>
-```
-
-### State handling
-
-Matches the pattern from `EvmScreen` and `ClientsScreen`:
-
-| State | Display |
-|---|---|
-| Loading (no data yet) | `_StatePanel` with spinner, "Loading grants" |
-| Error | `_StatePanel` with coral icon, error message, Retry button |
-| No connection | `_StatePanel`, "No active server connection" |
-| Empty list | `_StatePanel`, "No grants yet", with Create Grant shortcut |
-| Data | Column of `_GrantCard` widgets |
-
-### Header actions
-
-**CreateGrantButton:** `FilledButton.icon` with `Icons.add_rounded`, pushes `CreateEvmGrantRoute()` via `context.router.push(...)`.
-
-**RefreshButton:** `OutlinedButton.icon` with `Icons.refresh`, calls `ref.read(evmGrantsProvider.notifier).refresh()`.
-
----
-
-## Grant Card: `_GrantCard`
-
-**Layout:**
-
-```
-Container (rounded 24, Palette.cream bg, Palette.line border)
-└─ IntrinsicHeight > Row
-   ├─ Accent strip (0.8.w wide, full height, rounded left)
-   └─ Padding > Column
-        ├─ Row 1: TypeBadge + ChainChip + Spacer + RevokeButton
-        └─ Row 2: WalletText + "·" + ClientText
-```
-
-**Accent color by grant type:**
-- Ether transfer → `Palette.coral`
-- Token transfer → `Palette.token` (new entry in `Palette` — indigo, e.g. `Color(0xFF5C6BC0)`)
-
-**TypeBadge:** Small pill container with accent color background at 15% opacity, accent-colored text. Label: `'Ether'` or `'Token'`.
-
-**ChainChip:** Small container: `'Chain ${grant.shared.chainId}'`, muted ink color.
-
-**WalletText:** Short hex address (`0xabc...def`) from wallet lookup, `bodySmall`, monospace font family.
-
-**ClientText:** Client name from `sdkClientsProvider` lookup, or fallback string. `bodySmall`, muted ink.
-
-**RevokeButton:**
-- `OutlinedButton` with `Icons.block_rounded` icon, label `'Revoke'`
-- `foregroundColor: Palette.coral`, `side: BorderSide(color: Palette.coral.withValues(alpha: 0.4))`
-- Disabled (replaced with `CircularProgressIndicator`) while `revokeEvmGrantMutation` is pending — note: this is a single global mutation, so all revoke buttons disable while any revoke is in flight
-- On press: calls `executeRevokeEvmGrant(ref, grantId: grant.id)`; shows `SnackBar` on error
-
----
-
-## Adaptive Sizing
-
-All sizing uses `sizer` units (`1.h`, `1.w`, etc.). No hardcoded pixel values.
-
----
-
-## Files to Create / Modify
-
-| File | Action |
-|---|---|
-| `lib/theme/palette.dart` | Modify — add `Palette.token` color |
-| `lib/providers/sdk_clients/wallet_access_list.dart` | Create |
-| `lib/screens/dashboard/evm/grants/grants.dart` | Create |
-| `lib/router.dart` | Modify — add grants route to dashboard children |
-| `lib/screens/dashboard.dart` | Modify — add tab to routes list and NavigationDestinations |