lints(clippy)

feat(server): integrate X25519 unseal handler in UserAgentActor
feat(server): add X25519 ECDH for secure unseal protocol
2026-03-11 14:05:03 +01:00 · 2026-03-11 14:05:03 +01:00 · 2026-03-11 14:05:03 +01:00 · 2026-03-11 14:04:46 +01:00 · 2026-03-11 14:04:46 +01:00
143 changed files with 3088 additions and 6197 deletions
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,3 +0,0 @@
-{
-    "git.enabled": false
-}
--- a/.woodpecker/server-audit.yaml
+++ b/.woodpecker/server-audit.yaml
@@ -8,7 +8,7 @@ when:
      include: ['.woodpecker/server-*.yaml', 'server/**']

 steps:
-  - name: audit
+  - name: test
    image: jdxcode/mise:latest
    directory: server
    environment:
--- a/.woodpecker/server-lint.yaml
+++ b/.woodpecker/server-lint.yaml
@@ -1,25 +0,0 @@
-when:
-  - event: pull_request
-    path:
-      include: ['.woodpecker/server-*.yaml', 'server/**']
-  - event: push
-    branch: main
-    path:
-      include: ['.woodpecker/server-*.yaml', 'server/**']
-
-steps:
-  - name: lint
-    image: jdxcode/mise:latest
-    directory: server
-    environment:
-      CARGO_TERM_COLOR: always
-      CARGO_TARGET_DIR: /usr/local/cargo/target
-      CARGO_HOME: /usr/local/cargo/registry
-    volumes:
-      - cargo-target:/usr/local/cargo/target
-      - cargo-registry:/usr/local/cargo/registry
-    commands:
-      - apt-get update && apt-get install -y pkg-config
-      - mise install rust 
-      - mise install protoc
-      - mise exec rust -- cargo clippy --all-targets --all-features -- -D warnings
--- a/.woodpecker/server-vet.yaml
+++ b/.woodpecker/server-vet.yaml
@@ -8,7 +8,7 @@ when:
      include: ['.woodpecker/server-*.yaml', 'server/**']

 steps:
-  - name: vet
+  - name: test
    image: jdxcode/mise:latest
    directory: server
    environment:
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -3,6 +3,7 @@
 Arbiter is a permissioned signing service for cryptocurrency wallets. It runs as a background service on the user's machine with an optional client application for vault management.

 **Core principle:** The vault NEVER exposes key material. It only produces signatures when a request satisfies the configured policies.
+
 ---

 ## 1. Peer Types
--- a/190
+++ b/190
@@ -1,190 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright 2026 MarketTakers
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--- a/README.md
+++ b/README.md
@@ -1,13 +0,0 @@
-# Arbiter
-> Policy-first multi-client wallet daemon, allowing permissioned transactions across blockchains
-
-## Security warning
-Arbiter can't meaningfully protect against host compromise. Potential attack flow:
- Attacker steals TLS keys from database
- Pretends to be server; just accepts user agent challenge solutions
- Pretend to be in sealed state and performing DH with client
- Steals user password and derives seal key
-
-While this attack is highly targetive, it's still possible. 
-
-> This software is experimental. Do not use with funds you cannot afford to lose.
--- a/app/.dart_tool/extension_discovery/README.md
+++ b/app/.dart_tool/extension_discovery/README.md
@@ -1,31 +0,0 @@
-Extension Discovery Cache
-=========================
-
-This folder is used by `package:extension_discovery` to cache lists of
-packages that contains extensions for other packages.
-
-DO NOT USE THIS FOLDER
----------------------
-
- * Do not read (or rely) the contents of this folder.
- * Do write to this folder.
-
-If you're interested in the lists of extensions stored in this folder use the
-API offered by package `extension_discovery` to get this information.
-
-If this package doesn't work for your use-case, then don't try to read the
-contents of this folder. It may change, and will not remain stable.
-
-Use package `extension_discovery`
---------------------------------
-
-If you want to access information from this folder.
-
-Feel free to delete this folder
-------------------------------
-
-Files in this folder act as a cache, and the cache is discarded if the files
-are older than the modification time of `.dart_tool/package_config.json`.
-
-Hence, it should never be necessary to clear this cache manually, if you find a
-need to do please file a bug.
--- a/app/.dart_tool/extension_discovery/vs_code.json
+++ b/app/.dart_tool/extension_discovery/vs_code.json
@@ -1 +0,0 @@
-{"version":2,"entries":[{"package":"app","rootUri":"../","packageUri":"lib/"}]}
--- a/app/.dart_tool/package_config.json
+++ b/app/.dart_tool/package_config.json
@@ -1,178 +0,0 @@
-{
-  "configVersion": 2,
-  "packages": [
-    {
-      "name": "async",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "boolean_selector",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "characters",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "clock",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "collection",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "cupertino_icons",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/cupertino_icons-1.0.8",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "fake_async",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3",
-      "packageUri": "lib/",
-      "languageVersion": "3.3"
-    },
-    {
-      "name": "flutter",
-      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "flutter_lints",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "flutter_test",
-      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "leak_tracker",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.2"
-    },
-    {
-      "name": "leak_tracker_flutter_testing",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10",
-      "packageUri": "lib/",
-      "languageVersion": "3.2"
-    },
-    {
-      "name": "leak_tracker_testing",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.2"
-    },
-    {
-      "name": "lints",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "matcher",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "material_color_utilities",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1",
-      "packageUri": "lib/",
-      "languageVersion": "2.17"
-    },
-    {
-      "name": "meta",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.5"
-    },
-    {
-      "name": "path",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "sky_engine",
-      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "source_span",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "stack_trace",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "stream_channel",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4",
-      "packageUri": "lib/",
-      "languageVersion": "3.3"
-    },
-    {
-      "name": "string_scanner",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "term_glyph",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "test_api",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7",
-      "packageUri": "lib/",
-      "languageVersion": "3.5"
-    },
-    {
-      "name": "vector_math",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "vm_service",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.5"
-    },
-    {
-      "name": "app",
-      "rootUri": "../",
-      "packageUri": "lib/",
-      "languageVersion": "3.10"
-    }
-  ],
-  "generator": "pub",
-  "generatorVersion": "3.10.8",
-  "flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable",
-  "flutterVersion": "3.38.9",
-  "pubCache": "file:///Users/kaska/.pub-cache"
-}
--- a/app/.dart_tool/package_graph.json
+++ b/app/.dart_tool/package_graph.json
@@ -1,230 +0,0 @@
-{
-  "roots": [
-    "app"
-  ],
-  "packages": [
-    {
-      "name": "app",
-      "version": "1.0.0+1",
-      "dependencies": [
-        "cupertino_icons",
-        "flutter"
-      ],
-      "devDependencies": [
-        "flutter_lints",
-        "flutter_test"
-      ]
-    },
-    {
-      "name": "flutter_lints",
-      "version": "6.0.0",
-      "dependencies": [
-        "lints"
-      ]
-    },
-    {
-      "name": "flutter_test",
-      "version": "0.0.0",
-      "dependencies": [
-        "clock",
-        "collection",
-        "fake_async",
-        "flutter",
-        "leak_tracker_flutter_testing",
-        "matcher",
-        "meta",
-        "path",
-        "stack_trace",
-        "stream_channel",
-        "test_api",
-        "vector_math"
-      ]
-    },
-    {
-      "name": "cupertino_icons",
-      "version": "1.0.8",
-      "dependencies": []
-    },
-    {
-      "name": "flutter",
-      "version": "0.0.0",
-      "dependencies": [
-        "characters",
-        "collection",
-        "material_color_utilities",
-        "meta",
-        "sky_engine",
-        "vector_math"
-      ]
-    },
-    {
-      "name": "lints",
-      "version": "6.1.0",
-      "dependencies": []
-    },
-    {
-      "name": "stream_channel",
-      "version": "2.1.4",
-      "dependencies": [
-        "async"
-      ]
-    },
-    {
-      "name": "meta",
-      "version": "1.17.0",
-      "dependencies": []
-    },
-    {
-      "name": "collection",
-      "version": "1.19.1",
-      "dependencies": []
-    },
-    {
-      "name": "leak_tracker_flutter_testing",
-      "version": "3.0.10",
-      "dependencies": [
-        "flutter",
-        "leak_tracker",
-        "leak_tracker_testing",
-        "matcher",
-        "meta"
-      ]
-    },
-    {
-      "name": "vector_math",
-      "version": "2.2.0",
-      "dependencies": []
-    },
-    {
-      "name": "stack_trace",
-      "version": "1.12.1",
-      "dependencies": [
-        "path"
-      ]
-    },
-    {
-      "name": "clock",
-      "version": "1.1.2",
-      "dependencies": []
-    },
-    {
-      "name": "fake_async",
-      "version": "1.3.3",
-      "dependencies": [
-        "clock",
-        "collection"
-      ]
-    },
-    {
-      "name": "path",
-      "version": "1.9.1",
-      "dependencies": []
-    },
-    {
-      "name": "matcher",
-      "version": "0.12.17",
-      "dependencies": [
-        "async",
-        "meta",
-        "stack_trace",
-        "term_glyph",
-        "test_api"
-      ]
-    },
-    {
-      "name": "test_api",
-      "version": "0.7.7",
-      "dependencies": [
-        "async",
-        "boolean_selector",
-        "collection",
-        "meta",
-        "source_span",
-        "stack_trace",
-        "stream_channel",
-        "string_scanner",
-        "term_glyph"
-      ]
-    },
-    {
-      "name": "sky_engine",
-      "version": "0.0.0",
-      "dependencies": []
-    },
-    {
-      "name": "material_color_utilities",
-      "version": "0.11.1",
-      "dependencies": [
-        "collection"
-      ]
-    },
-    {
-      "name": "characters",
-      "version": "1.4.0",
-      "dependencies": []
-    },
-    {
-      "name": "async",
-      "version": "2.13.0",
-      "dependencies": [
-        "collection",
-        "meta"
-      ]
-    },
-    {
-      "name": "leak_tracker_testing",
-      "version": "3.0.2",
-      "dependencies": [
-        "leak_tracker",
-        "matcher",
-        "meta"
-      ]
-    },
-    {
-      "name": "leak_tracker",
-      "version": "11.0.2",
-      "dependencies": [
-        "clock",
-        "collection",
-        "meta",
-        "path",
-        "vm_service"
-      ]
-    },
-    {
-      "name": "term_glyph",
-      "version": "1.2.2",
-      "dependencies": []
-    },
-    {
-      "name": "string_scanner",
-      "version": "1.4.1",
-      "dependencies": [
-        "source_span"
-      ]
-    },
-    {
-      "name": "source_span",
-      "version": "1.10.2",
-      "dependencies": [
-        "collection",
-        "path",
-        "term_glyph"
-      ]
-    },
-    {
-      "name": "boolean_selector",
-      "version": "2.1.2",
-      "dependencies": [
-        "source_span",
-        "string_scanner"
-      ]
-    },
-    {
-      "name": "vm_service",
-      "version": "15.0.2",
-      "dependencies": []
-    }
-  ],
-  "configVersion": 1
-}
--- a/app/.dart_tool/version
+++ b/app/.dart_tool/version
@@ -1 +0,0 @@
-3.38.9
--- a/useragent/.gitignore
+++ b/useragent/.gitignore
--- a/useragent/.metadata
+++ b/useragent/.metadata
--- a/useragent/README.md
+++ b/useragent/README.md
--- a/useragent/analysis_options.yaml
+++ b/useragent/analysis_options.yaml
--- a/useragent/lib/main.dart
+++ b/useragent/lib/main.dart
--- a/useragent/macos/.gitignore
+++ b/useragent/macos/.gitignore
--- a/useragent/macos/Flutter/Flutter-Debug.xcconfig
+++ b/useragent/macos/Flutter/Flutter-Debug.xcconfig
--- a/useragent/macos/Flutter/Flutter-Release.xcconfig
+++ b/useragent/macos/Flutter/Flutter-Release.xcconfig
--- a/useragent/macos/Flutter/GeneratedPluginRegistrant.swift
+++ b/useragent/macos/Flutter/GeneratedPluginRegistrant.swift
--- a/app/macos/Flutter/ephemeral/Flutter-Generated.xcconfig
+++ b/app/macos/Flutter/ephemeral/Flutter-Generated.xcconfig
@@ -1,11 +0,0 @@
-// This is a generated file; do not edit or check into version control.
-FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable
-FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/app
-COCOAPODS_PARALLEL_CODE_SIGN=true
-FLUTTER_BUILD_DIR=build
-FLUTTER_BUILD_NAME=1.0.0
-FLUTTER_BUILD_NUMBER=1
-DART_OBFUSCATION=false
-TRACK_WIDGET_CREATION=true
-TREE_SHAKE_ICONS=false
-PACKAGE_CONFIG=.dart_tool/package_config.json
--- a/app/macos/Flutter/ephemeral/flutter_export_environment.sh
+++ b/app/macos/Flutter/ephemeral/flutter_export_environment.sh
@@ -1,12 +0,0 @@
-#!/bin/sh
-# This is a generated file; do not edit or check into version control.
-export "FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable"
-export "FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/app"
-export "COCOAPODS_PARALLEL_CODE_SIGN=true"
-export "FLUTTER_BUILD_DIR=build"
-export "FLUTTER_BUILD_NAME=1.0.0"
-export "FLUTTER_BUILD_NUMBER=1"
-export "DART_OBFUSCATION=false"
-export "TRACK_WIDGET_CREATION=true"
-export "TREE_SHAKE_ICONS=false"
-export "PACKAGE_CONFIG=.dart_tool/package_config.json"
--- a/useragent/macos/Runner.xcodeproj/project.pbxproj
+++ b/useragent/macos/Runner.xcodeproj/project.pbxproj
--- a/useragent/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist
+++ b/useragent/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist
--- a/useragent/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme
+++ b/useragent/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme
--- a/useragent/macos/Runner.xcworkspace/contents.xcworkspacedata
+++ b/useragent/macos/Runner.xcworkspace/contents.xcworkspacedata
--- a/useragent/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist
+++ b/useragent/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist
--- a/useragent/macos/Runner/AppDelegate.swift
+++ b/useragent/macos/Runner/AppDelegate.swift
--- a/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json
+++ b/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json
--- a/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_1024.png
+++ b/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_1024.png
--- a/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_128.png
+++ b/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_128.png
--- a/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_16.png
+++ b/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_16.png
--- a/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_256.png
+++ b/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_256.png
--- a/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_32.png
+++ b/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_32.png
--- a/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_512.png
+++ b/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_512.png
--- a/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_64.png
+++ b/useragent/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_64.png
--- a/useragent/macos/Runner/Base.lproj/MainMenu.xib
+++ b/useragent/macos/Runner/Base.lproj/MainMenu.xib
--- a/useragent/macos/Runner/Configs/AppInfo.xcconfig
+++ b/useragent/macos/Runner/Configs/AppInfo.xcconfig
--- a/useragent/macos/Runner/Configs/Debug.xcconfig
+++ b/useragent/macos/Runner/Configs/Debug.xcconfig
--- a/useragent/macos/Runner/Configs/Release.xcconfig
+++ b/useragent/macos/Runner/Configs/Release.xcconfig
--- a/useragent/macos/Runner/Configs/Warnings.xcconfig
+++ b/useragent/macos/Runner/Configs/Warnings.xcconfig
--- a/useragent/macos/Runner/DebugProfile.entitlements
+++ b/useragent/macos/Runner/DebugProfile.entitlements
--- a/useragent/macos/Runner/Info.plist
+++ b/useragent/macos/Runner/Info.plist
--- a/useragent/macos/Runner/MainFlutterWindow.swift
+++ b/useragent/macos/Runner/MainFlutterWindow.swift
--- a/useragent/macos/Runner/Release.entitlements
+++ b/useragent/macos/Runner/Release.entitlements
--- a/useragent/macos/RunnerTests/RunnerTests.swift
+++ b/useragent/macos/RunnerTests/RunnerTests.swift
--- a/useragent/pubspec.lock
+++ b/useragent/pubspec.lock
@@ -41,6 +41,14 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "1.19.1"
+  cupertino_icons:
+    dependency: "direct main"
+    description:
+      name: cupertino_icons
+      sha256: ba631d1c7f7bef6b729a622b7b752645a2d076dba9976925b8f25725a30e1ee6
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.8"
  fake_async:
    dependency: transitive
    description:
--- a/app/pubspec.yaml
+++ b/app/pubspec.yaml
@@ -0,0 +1,89 @@
+name: app
+description: "A new Flutter project."
+# The following line prevents the package from being accidentally published to
+# pub.dev using `flutter pub publish`. This is preferred for private packages.
+publish_to: 'none' # Remove this line if you wish to publish to pub.dev
+
+# The following defines the version and build number for your application.
+# A version number is three numbers separated by dots, like 1.2.43
+# followed by an optional build number separated by a +.
+# Both the version and the builder number may be overridden in flutter
+# build by specifying --build-name and --build-number, respectively.
+# In Android, build-name is used as versionName while build-number used as versionCode.
+# Read more about Android versioning at https://developer.android.com/studio/publish/versioning
+# In iOS, build-name is used as CFBundleShortVersionString while build-number is used as CFBundleVersion.
+# Read more about iOS versioning at
+# https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
+# In Windows, build-name is used as the major, minor, and patch parts
+# of the product and file versions while build-number is used as the build suffix.
+version: 1.0.0+1
+
+environment:
+  sdk: ^3.10.8
+
+# Dependencies specify other packages that your package needs in order to work.
+# To automatically upgrade your package dependencies to the latest versions
+# consider running `flutter pub upgrade --major-versions`. Alternatively,
+# dependencies can be manually updated by changing the version numbers below to
+# the latest version available on pub.dev. To see which dependencies have newer
+# versions available, run `flutter pub outdated`.
+dependencies:
+  flutter:
+    sdk: flutter
+
+  # The following adds the Cupertino Icons font to your application.
+  # Use with the CupertinoIcons class for iOS style icons.
+  cupertino_icons: ^1.0.8
+
+dev_dependencies:
+  flutter_test:
+    sdk: flutter
+
+  # The "flutter_lints" package below contains a set of recommended lints to
+  # encourage good coding practices. The lint set provided by the package is
+  # activated in the `analysis_options.yaml` file located at the root of your
+  # package. See that file for information about deactivating specific lint
+  # rules and activating additional ones.
+  flutter_lints: ^6.0.0
+
+# For information on the generic Dart part of this file, see the
+# following page: https://dart.dev/tools/pub/pubspec
+
+# The following section is specific to Flutter packages.
+flutter:
+
+  # The following line ensures that the Material Icons font is
+  # included with your application, so that you can use the icons in
+  # the material Icons class.
+  uses-material-design: true
+
+  # To add assets to your application, add an assets section, like this:
+  # assets:
+  #   - images/a_dot_burr.jpeg
+  #   - images/a_dot_ham.jpeg
+
+  # An image asset can refer to one or more resolution-specific "variants", see
+  # https://flutter.dev/to/resolution-aware-images
+
+  # For details regarding adding assets from package dependencies, see
+  # https://flutter.dev/to/asset-from-package
+
+  # To add custom fonts to your application, add a fonts section here,
+  # in this "flutter" section. Each entry in this list should have a
+  # "family" key with the font family name, and a "fonts" key with a
+  # list giving the asset and other descriptors for the font. For
+  # example:
+  # fonts:
+  #   - family: Schyler
+  #     fonts:
+  #       - asset: fonts/Schyler-Regular.ttf
+  #       - asset: fonts/Schyler-Italic.ttf
+  #         style: italic
+  #   - family: Trajan Pro
+  #     fonts:
+  #       - asset: fonts/TrajanPro.ttf
+  #       - asset: fonts/TrajanPro_Bold.ttf
+  #         weight: 700
+  #
+  # For details regarding fonts from package dependencies,
+  # see https://flutter.dev/to/font-from-package
--- a/useragent/windows/.gitignore
+++ b/useragent/windows/.gitignore
--- a/useragent/windows/CMakeLists.txt
+++ b/useragent/windows/CMakeLists.txt
--- a/useragent/windows/flutter/CMakeLists.txt
+++ b/useragent/windows/flutter/CMakeLists.txt
--- a/useragent/windows/flutter/generated_plugin_registrant.cc
+++ b/useragent/windows/flutter/generated_plugin_registrant.cc
--- a/useragent/windows/flutter/generated_plugin_registrant.h
+++ b/useragent/windows/flutter/generated_plugin_registrant.h
--- a/useragent/windows/flutter/generated_plugins.cmake
+++ b/useragent/windows/flutter/generated_plugins.cmake
--- a/useragent/windows/runner/CMakeLists.txt
+++ b/useragent/windows/runner/CMakeLists.txt
--- a/useragent/windows/runner/Runner.rc
+++ b/useragent/windows/runner/Runner.rc
--- a/useragent/windows/runner/flutter_window.cpp
+++ b/useragent/windows/runner/flutter_window.cpp
--- a/useragent/windows/runner/flutter_window.h
+++ b/useragent/windows/runner/flutter_window.h
--- a/useragent/windows/runner/main.cpp
+++ b/useragent/windows/runner/main.cpp
--- a/useragent/windows/runner/resource.h
+++ b/useragent/windows/runner/resource.h
--- a/useragent/windows/runner/resources/app_icon.ico
+++ b/useragent/windows/runner/resources/app_icon.ico
--- a/useragent/windows/runner/runner.exe.manifest
+++ b/useragent/windows/runner/runner.exe.manifest
--- a/useragent/windows/runner/utils.cpp
+++ b/useragent/windows/runner/utils.cpp
--- a/useragent/windows/runner/utils.h
+++ b/useragent/windows/runner/utils.h
--- a/useragent/windows/runner/win32_window.cpp
+++ b/useragent/windows/runner/win32_window.cpp
--- a/useragent/windows/runner/win32_window.h
+++ b/useragent/windows/runner/win32_window.h
--- a/mise.lock
+++ b/mise.lock
@@ -10,10 +10,6 @@ backend = "cargo:cargo-features"
 version = "0.11.1"
 backend = "cargo:cargo-features-manager"

-[[tools."cargo:cargo-insta"]]
-version = "1.46.3"
-backend = "cargo:cargo-insta"
-
 [[tools."cargo:cargo-nextest"]]
 version = "0.9.126"
 backend = "cargo:cargo-nextest"
--- a/mise.toml
+++ b/mise.toml
@@ -2,10 +2,10 @@
 "cargo:diesel_cli" = { version = "2.3.6", features = "sqlite,sqlite-bundled", default-features = false }
 "cargo:cargo-audit" = "0.22.1"
 "cargo:cargo-vet" = "0.10.2"
+
 flutter = "3.38.9-stable"
 protoc = "29.6"
-"rust" = {version = "1.93.0", components = "clippy"}
+rust = "1.93.1"
 "cargo:cargo-features-manager" = "0.11.1"
 "cargo:cargo-nextest" = "0.9.126"
 "cargo:cargo-shear" = "latest"
-"cargo:cargo-insta" = "1.46.3"
--- a/protobufs/arbiter.proto
+++ b/protobufs/arbiter.proto
@@ -2,15 +2,113 @@ syntax = "proto3";

 package arbiter;

-import "client.proto";
-import "user_agent.proto";
+import "auth.proto";
+
+message ClientRequest {
+  oneof payload {
+    arbiter.auth.ClientMessage auth_message = 1;
+    CertRotationAck cert_rotation_ack = 2;
+  }
+}
+
+message ClientResponse {
+  oneof payload {
+    arbiter.auth.ServerMessage auth_message = 1;
+    CertRotationNotification cert_rotation_notification = 2;
+  }
+}
+
+message UserAgentRequest {
+  oneof payload {
+    arbiter.auth.ClientMessage auth_message = 1;
+    CertRotationAck cert_rotation_ack = 2;
+    UnsealRequest unseal_request = 3;
+  }
+}
+message UserAgentResponse {
+  oneof payload {
+    arbiter.auth.ServerMessage auth_message = 1;
+    CertRotationNotification cert_rotation_notification = 2;
+    UnsealResponse unseal_response = 3;
+  }
+}

 message ServerInfo {
  string version = 1;
  bytes cert_public_key = 2;
 }

-service ArbiterService {
-  rpc Client(stream arbiter.client.ClientRequest) returns (stream arbiter.client.ClientResponse);
-  rpc UserAgent(stream arbiter.user_agent.UserAgentRequest) returns (stream arbiter.user_agent.UserAgentResponse);
+// TLS Certificate Rotation Protocol
+message CertRotationNotification {
+  // New public certificate (DER-encoded)
+  bytes new_cert = 1;
+
+  // Unix timestamp when rotation will be executed (if all ACKs received)
+  int64 rotation_scheduled_at = 2;
+
+  // Unix timestamp deadline for ACK (7 days from now)
+  int64 ack_deadline = 3;
+
+  // Rotation ID for tracking
+  int32 rotation_id = 4;
+}
+
+message CertRotationAck {
+  // Rotation ID (from CertRotationNotification)
+  int32 rotation_id = 1;
+
+  // Client public key for identification
+  bytes client_public_key = 2;
+
+  // Confirmation that client saved the new certificate
+  bool cert_saved = 3;
+}
+
+// Vault Unseal Protocol (X25519 ECDH + ChaCha20Poly1305)
+message UnsealRequest {
+  oneof payload {
+    EphemeralKeyRequest ephemeral_key_request = 1;
+    SealedPassword sealed_password = 2;
+  }
+}
+
+message UnsealResponse {
+  oneof payload {
+    EphemeralKeyResponse ephemeral_key_response = 1;
+    UnsealResult unseal_result = 2;
+  }
+}
+
+message EphemeralKeyRequest {}
+
+message EphemeralKeyResponse {
+  // Server's X25519 ephemeral public key (32 bytes)
+  bytes server_pubkey = 1;
+
+  // Unix timestamp when this key expires (60 seconds from generation)
+  int64 expires_at = 2;
+}
+
+message SealedPassword {
+  // Client's X25519 ephemeral public key (32 bytes)
+  bytes client_pubkey = 1;
+
+  // ChaCha20Poly1305 encrypted password (ciphertext + tag)
+  bytes encrypted_password = 2;
+
+  // 12-byte nonce for ChaCha20Poly1305
+  bytes nonce = 3;
+}
+
+message UnsealResult {
+  // Whether unseal was successful
+  bool success = 1;
+
+  // Error message if unseal failed
+  optional string error_message = 2;
+}
+
+service ArbiterService {
+  rpc Client(stream ClientRequest) returns (stream ClientResponse);
+  rpc UserAgent(stream UserAgentRequest) returns (stream UserAgentResponse);
 }
--- a/protobufs/client.proto
+++ b/protobufs/client.proto
@@ -1,9 +1,12 @@
 syntax = "proto3";

-package arbiter.client;
+package arbiter.auth;
+
+import "google/protobuf/timestamp.proto";

 message AuthChallengeRequest {
  bytes pubkey = 1;
+  optional string bootstrap_token = 2;
 }

 message AuthChallenge {
@@ -17,14 +20,14 @@ message AuthChallengeSolution {

 message AuthOk {}

-message ClientRequest {
+message ClientMessage {
  oneof payload {
    AuthChallengeRequest auth_challenge_request = 1;
    AuthChallengeSolution auth_challenge_solution = 2;
  }
 }

-message ClientResponse {
+message ServerMessage {
  oneof payload {
    AuthChallenge auth_challenge = 1;
    AuthOk auth_ok = 2;
--- a/protobufs/google/protobuf/timestamp.proto
+++ b/protobufs/google/protobuf/timestamp.proto
@@ -0,0 +1,46 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+
+syntax = "proto3";
+
+package google.protobuf;
+
+option csharp_namespace = "Google.Protobuf.WellKnownTypes";
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/protobuf/types/known/timestamppb";
+option java_package = "com.google.protobuf";
+option java_outer_classname = "TimestampProto";
+option java_multiple_files = true;
+option objc_class_prefix = "GPB";
+
+// A Timestamp represents a point in time independent of any time zone or local
+// calendar, encoded as a count of seconds and fractions of seconds at
+// nanosecond resolution. The count is relative to an epoch at UTC midnight on
+// January 1, 1970, in the proleptic Gregorian calendar which extends the
+// Gregorian calendar backwards to year one.
+message Timestamp {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive.
+  int32 nanos = 2;
+}
--- a/protobufs/unseal.proto
+++ b/protobufs/unseal.proto
@@ -0,0 +1,14 @@
+syntax = "proto3";
+
+package arbiter.unseal;
+
+message UserAgentKeyRequest {}
+
+message ServerKeyResponse {
+  bytes pubkey = 1;
+}
+message UserAgentSealedKey {
+  bytes sealed_key = 1;
+  bytes pubkey = 2;
+  bytes nonce = 3;
+}
--- a/protobufs/user_agent.proto
+++ b/protobufs/user_agent.proto
@@ -1,68 +0,0 @@
-syntax = "proto3";
-
-package arbiter.user_agent;
-
-import "google/protobuf/empty.proto";
-
-message AuthChallengeRequest {
-  bytes pubkey = 1;
-  optional string bootstrap_token = 2;
-}
-
-message AuthChallenge {
-  bytes pubkey = 1;
-  int32 nonce = 2;
-}
-
-message AuthChallengeSolution {
-  bytes signature = 1;
-}
-
-message AuthOk {}
-
-message UnsealStart {
-  bytes client_pubkey = 1;
-}
-
-message UnsealStartResponse {
-  bytes server_pubkey = 1;
-}
-message UnsealEncryptedKey {
-  bytes nonce = 1;
-  bytes ciphertext = 2;
-  bytes associated_data = 3;
-}
-
-enum UnsealResult {
-  UNSEAL_RESULT_UNSPECIFIED = 0;
-  UNSEAL_RESULT_SUCCESS = 1;
-  UNSEAL_RESULT_INVALID_KEY = 2;
-  UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
-}
-
-enum VaultState {
-  VAULT_STATE_UNSPECIFIED = 0;
-  VAULT_STATE_UNBOOTSTRAPPED = 1;
-  VAULT_STATE_SEALED = 2;
-  VAULT_STATE_UNSEALED = 3;
-  VAULT_STATE_ERROR = 4;
-}
-
-message UserAgentRequest {
-  oneof payload {
-    AuthChallengeRequest auth_challenge_request = 1;
-    AuthChallengeSolution auth_challenge_solution = 2;
-    UnsealStart unseal_start = 3;
-    UnsealEncryptedKey unseal_encrypted_key = 4;
-    google.protobuf.Empty query_vault_state = 5;
-  }
-}
-message UserAgentResponse {
-  oneof payload {
-    AuthChallenge auth_challenge = 1;
-    AuthOk auth_ok = 2;
-    UnsealStartResponse unseal_start_response = 3;
-    UnsealResult unseal_result = 4;
-    VaultState vault_state = 5;
-  }
-}
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -59,25 +59,17 @@ version = "0.1.0"
 name = "arbiter-proto"
 version = "0.1.0"
 dependencies = [
- "async-trait",
- "base64",
 "futures",
 "hex",
 "kameo",
- "miette",
 "prost",
+ "prost-build",
 "prost-types",
- "rand",
- "rcgen",
- "rstest",
- "rustls-pki-types",
- "thiserror",
+ "serde_json",
 "tokio",
 "tonic",
 "tonic-prost",
 "tonic-prost-build",
- "tracing",
- "url",
 ]

 [[package]]
@@ -95,25 +87,21 @@ dependencies = [
 "diesel_migrations",
 "ed25519-dalek",
 "futures",
- "insta",
+ "hex",
 "kameo",
 "memsafe",
 "miette",
- "pem",
 "rand",
 "rcgen",
- "restructed",
 "rustls",
 "secrecy",
 "smlang",
- "strum",
 "test-log",
 "thiserror",
 "tokio",
 "tokio-stream",
 "tonic",
 "tracing",
- "tracing-subscriber",
 "x25519-dalek",
 "zeroize",
 ]
@@ -121,21 +109,6 @@ dependencies = [
 [[package]]
 name = "arbiter-useragent"
 version = "0.1.0"
-dependencies = [
- "arbiter-proto",
- "async-trait",
- "ed25519-dalek",
- "http",
- "kameo",
- "rustls-webpki",
- "smlang",
- "thiserror",
- "tokio",
- "tokio-stream",
- "tonic",
- "tracing",
- "x25519-dalek",
-]

 [[package]]
 name = "argon2"
@@ -147,7 +120,6 @@ dependencies = [
 "blake2",
 "cpufeatures 0.2.17",
 "password-hash",
- "zeroize",
 ]

 [[package]]
@@ -458,18 +430,6 @@ dependencies = [
 "cc",
 ]

-[[package]]
-name = "console"
-version = "0.15.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
-dependencies = [
- "encode_unicode",
- "libc",
- "once_cell",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -806,12 +766,6 @@ version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"

-[[package]]
-name = "encode_unicode"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
-
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -886,15 +840,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"

-[[package]]
-name = "form_urlencoded"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
-dependencies = [
- "percent-encoding",
-]
-
 [[package]]
 name = "fs_extra"
 version = "1.3.0"
@@ -972,12 +917,6 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"

-[[package]]
-name = "futures-timer"
-version = "3.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
-
 [[package]]
 name = "futures-util"
 version = "0.3.32"
@@ -1048,12 +987,6 @@ version = "0.32.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"

-[[package]]
-name = "glob"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
-
 [[package]]
 name = "h2"
 version = "0.4.13"
@@ -1243,87 +1176,6 @@ dependencies = [
 "cc",
 ]

-[[package]]
-name = "icu_collections"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
-dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
-dependencies = [
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
-
-[[package]]
-name = "icu_properties"
-version = "2.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
-dependencies = [
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
-
-[[package]]
-name = "icu_provider"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
 [[package]]
 name = "id-arena"
 version = "2.3.0"
@@ -1336,27 +1188,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"

-[[package]]
-name = "idna"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
-dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
-
 [[package]]
 name = "indexmap"
 version = "2.13.0"
@@ -1378,18 +1209,6 @@ dependencies = [
 "generic-array",
 ]

-[[package]]
-name = "insta"
-version = "1.46.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e82db8c87c7f1ccecb34ce0c24399b8a73081427f3c7c50a5d597925356115e4"
-dependencies = [
- "console",
- "once_cell",
- "similar",
- "tempfile",
-]
-
 [[package]]
 name = "is_ci"
 version = "1.2.0"
@@ -1492,12 +1311,6 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"

-[[package]]
-name = "litemap"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
-
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -1645,15 +1458,6 @@ dependencies = [
 "minimal-lexical",
 ]

-[[package]]
-name = "nu-ansi-term"
-version = "0.50.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -1840,15 +1644,6 @@ version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"

-[[package]]
-name = "potential_utf"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
-dependencies = [
- "zerovec",
-]
-
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -1865,39 +1660,6 @@ dependencies = [
 "syn 2.0.117",
 ]

-[[package]]
-name = "proc-macro-crate"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
-dependencies = [
- "toml_edit",
-]
-
-[[package]]
-name = "proc-macro-error"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
-]
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -2081,24 +1843,6 @@ version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"

-[[package]]
-name = "relative-path"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
-
-[[package]]
-name = "restructed"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f6f6e863d7d9d318699737c043d560dce1ea3cb6f5c78e0a3f0d1f257c73dfc"
-dependencies = [
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -2123,35 +1867,6 @@ dependencies = [
 "thiserror",
 ]

-[[package]]
-name = "rstest"
-version = "0.26.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5a3193c063baaa2a95a33f03035c8a72b83d97a54916055ba22d35ed3839d49"
-dependencies = [
- "futures-timer",
- "futures-util",
- "rstest_macros",
-]
-
-[[package]]
-name = "rstest_macros"
-version = "0.26.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c845311f0ff7951c5506121a9ad75aec44d083c31583b2ea5a30bcb0b0abba0"
-dependencies = [
- "cfg-if",
- "glob",
- "proc-macro-crate",
- "proc-macro2",
- "quote",
- "regex",
- "relative-path",
- "rustc_version",
- "syn 2.0.117",
- "unicode-ident",
-]
-
 [[package]]
 name = "rustc-demangle"
 version = "0.1.27"
@@ -2361,12 +2076,6 @@ version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"

-[[package]]
-name = "similar"
-version = "2.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
-
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -2422,12 +2131,6 @@ dependencies = [
 "wasm-bindgen",
 ]

-[[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-
 [[package]]
 name = "string_morph"
 version = "0.1.0"
@@ -2440,27 +2143,6 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

-[[package]]
-name = "strum"
-version = "0.27.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
-dependencies = [
- "strum_macros",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.27.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -2641,16 +2323,6 @@ dependencies = [
 "time-core",
 ]

-[[package]]
-name = "tinystr"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
-dependencies = [
- "displaydoc",
- "zerovec",
-]
-
 [[package]]
 name = "tokio"
 version = "1.50.0"
@@ -2723,7 +2395,7 @@ checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
 dependencies = [
 "serde_core",
 "serde_spanned",
- "toml_datetime 0.7.5+spec-1.1.0",
+ "toml_datetime",
 "toml_parser",
 "winnow",
 ]
@@ -2737,27 +2409,6 @@ dependencies = [
 "serde_core",
 ]

-[[package]]
-name = "toml_datetime"
-version = "1.0.0+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32c2555c699578a4f59f0cc68e5116c8d7cabbd45e1409b989d4be085b53f13e"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.25.4+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7193cbd0ce53dc966037f54351dbbcf0d5a642c7f0038c382ef9e677ce8c13f2"
-dependencies = [
- "indexmap",
- "toml_datetime 1.0.0+spec-1.1.0",
- "toml_parser",
- "winnow",
-]
-
 [[package]]
 name = "toml_parser"
 version = "1.0.9+spec-1.1.0"
@@ -2898,18 +2549,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
 "once_cell",
- "valuable",
-]
-
-[[package]]
-name = "tracing-log"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
-dependencies = [
- "log",
- "once_cell",
- "tracing-core",
 ]

 [[package]]
@@ -2919,15 +2558,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f30143827ddab0d256fd843b7a66d164e9f271cfa0dde49142c5ca0ca291f1e"
 dependencies = [
 "matchers",
- "nu-ansi-term",
 "once_cell",
 "regex-automata",
 "sharded-slab",
- "smallvec",
 "thread_local",
 "tracing",
 "tracing-core",
- "tracing-log",
 ]

 [[package]]
@@ -3000,24 +2636,6 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"

-[[package]]
-name = "url"
-version = "2.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
- "serde",
-]
-
-[[package]]
-name = "utf8_iter"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
-
 [[package]]
 name = "uuid"
 version = "1.22.0"
@@ -3028,12 +2646,6 @@ dependencies = [
 "wasm-bindgen",
 ]

-[[package]]
-name = "valuable"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
-
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -3248,15 +2860,6 @@ dependencies = [
 "windows-targets 0.52.6",
 ]

-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.60.2"
@@ -3409,9 +3012,6 @@ name = "winnow"
 version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
-dependencies = [
- "memchr",
-]

 [[package]]
 name = "wit-bindgen"
@@ -3501,12 +3101,6 @@ dependencies = [
 "wasmparser",
 ]

-[[package]]
-name = "writeable"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
-
 [[package]]
 name = "x25519-dalek"
 version = "2.0.1"
@@ -3546,50 +3140,6 @@ dependencies = [
 "time",
 ]

-[[package]]
-name = "yoke"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
-dependencies = [
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
- "synstructure",
-]
-
-[[package]]
-name = "zerofrom"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
- "synstructure",
-]
-
 [[package]]
 name = "zeroize"
 version = "1.8.2"
@@ -3610,39 +3160,6 @@ dependencies = [
 "syn 2.0.117",
 ]

-[[package]]
-name = "zerotrie"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "zmij"
 version = "1.0.21"
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -24,12 +24,3 @@ futures = "0.3.31"
 tokio-stream = { version = "0.1.18", features = ["full"] }
 kameo = "0.19.2"
 prost-types = { version = "0.14.3", features = ["chrono"] }
-x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
-rstest = "0.26.1"
-rustls-pki-types = "1.14.0"
-rcgen = { version = "0.14.7", features = [
-    "aws_lc_rs",
-    "pem",
-    "x509-parser",
-    "zeroize",
-], default-features = false }
--- a/server/crates/arbiter-client/Cargo.toml
+++ b/server/crates/arbiter-client/Cargo.toml
@@ -3,6 +3,5 @@ name = "arbiter-client"
 version = "0.1.0"
 edition = "2024"
 repository = "https://git.markettakers.org/MarketTakers/arbiter"
-license = "Apache-2.0"

 [dependencies]
--- a/server/crates/arbiter-proto/Cargo.toml
+++ b/server/crates/arbiter-proto/Cargo.toml
@@ -3,7 +3,6 @@ name = "arbiter-proto"
 version = "0.1.0"
 edition = "2024"
 repository = "https://git.markettakers.org/MarketTakers/arbiter"
-license = "Apache-2.0"

 [dependencies]
 tonic.workspace = true
@@ -13,24 +12,11 @@ hex = "0.4.3"
 tonic-prost = "0.14.3"
 prost = "0.14.3"
 kameo.workspace = true
-url = "2.5.8"
-miette.workspace = true
-thiserror.workspace = true
-rustls-pki-types.workspace = true
-base64 = "0.22.1"
 prost-types.workspace = true
-tracing.workspace = true
-async-trait.workspace = true

 [build-dependencies]
+prost-build = "0.14.3"
+serde_json = "1"
 tonic-prost-build = "0.14.3"

-[dev-dependencies]
-rstest.workspace = true
-rand.workspace = true
-rcgen.workspace = true
-
-[package.metadata.cargo-shear]
-ignored = ["tonic-prost", "prost", "kameo"]
-

--- a/server/crates/arbiter-proto/build.rs
+++ b/server/crates/arbiter-proto/build.rs
@@ -1,22 +1,15 @@
-use tonic_prost_build::configure;
-
 static PROTOBUF_DIR: &str = "../../../protobufs";

 fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let proto_files = vec![
+        format!("{}/arbiter.proto", PROTOBUF_DIR),
+        format!("{}/auth.proto", PROTOBUF_DIR),
+    ];

-    println!("cargo::rerun-if-changed={PROTOBUF_DIR}");
-
-    configure()
+    // Компилируем protobuf (tonic-prost-build автоматически использует prost_types для google.protobuf)
+    tonic_prost_build::configure()
        .message_attribute(".", "#[derive(::kameo::Reply)]")
-        .compile_protos(
-            &[
-                format!("{}/arbiter.proto", PROTOBUF_DIR),
-                format!("{}/user_agent.proto", PROTOBUF_DIR),
-                format!("{}/client.proto", PROTOBUF_DIR),
-            ],
-            &[PROTOBUF_DIR.to_string()],
-        )
+        .compile_protos(&proto_files, &[PROTOBUF_DIR.to_string()])?;

-        .unwrap();
    Ok(())
 }
--- a/server/crates/arbiter-proto/src/lib.rs
+++ b/server/crates/arbiter-proto/src/lib.rs
@@ -1,21 +1,16 @@
-pub mod transport;
-pub mod url;
-
-use base64::{Engine, prelude::BASE64_STANDARD};
+use crate::proto::auth::AuthChallenge;

 pub mod proto {
    tonic::include_proto!("arbiter");

-    pub mod user_agent {
-        tonic::include_proto!("arbiter.user_agent");
-    }
-
-    pub mod client {
-        tonic::include_proto!("arbiter.client");
+    pub mod auth {
+        tonic::include_proto!("arbiter.auth");
    }
 }

-pub static BOOTSTRAP_PATH: &str = "bootstrap_token";
+pub mod transport;
+
+pub static BOOTSTRAP_TOKEN_PATH: &str = "bootstrap_token";

 pub fn home_path() -> Result<std::path::PathBuf, std::io::Error> {
    static ARBITER_HOME: &str = ".arbiter";
@@ -30,7 +25,7 @@ pub fn home_path() -> Result<std::path::PathBuf, std::io::Error> {
    Ok(arbiter_home)
 }

-pub fn format_challenge(nonce: i32, pubkey: &[u8]) -> Vec<u8> {
-    let concat_form = format!("{}:{}", nonce, BASE64_STANDARD.encode(pubkey));
-    concat_form.into_bytes()
+pub fn format_challenge(challenge: &AuthChallenge) -> Vec<u8> {
+    let concat_form = format!("{}:{}", challenge.nonce, hex::encode(&challenge.pubkey));
+    concat_form.into_bytes().to_vec()
 }
--- a/server/crates/arbiter-proto/src/transport.rs
+++ b/server/crates/arbiter-proto/src/transport.rs
@@ -1,293 +1,46 @@
-//! Transport-facing abstractions for protocol/session code.
-//!
-//! This module separates three concerns:
-//!
-//! - protocol/session logic wants a small duplex interface ([`Bi`])
-//! - transport adapters push concrete stream items to an underlying IO layer
-//! - transport boundaries translate between protocol-facing and transport-facing
-//!   item types via direction-specific converters
-//!
-//! [`Bi`] is intentionally minimal and transport-agnostic:
-//! - [`Bi::recv`] yields inbound protocol messages
-//! - [`Bi::send`] accepts outbound protocol/domain items
-//!
-//! # Generic Ordering Rule
-//!
-//! This module uses a single convention consistently: when a type or trait is
-//! parameterized by protocol message directions, the generic parameters are
-//! declared as `Inbound` first, then `Outbound`.
-//!
-//! For [`Bi`], that means `Bi<Inbound, Outbound>`:
-//! - `recv() -> Option<Inbound>`
-//! - `send(Outbound)`
-//!
-//! For adapter types that are parameterized by direction-specific converters,
-//! inbound-related converter parameters are declared before outbound-related
-//! converter parameters.
-//!
-//! [`RecvConverter`] and [`SendConverter`] are infallible conversion traits used
-//! by adapters to map between protocol-facing and transport-facing item types.
-//! The traits themselves are not result-aware; adapters decide how transport
-//! errors are handled before (or instead of) conversion.
-//!
-//! [`grpc::GrpcAdapter`] combines:
-//! - a tonic inbound stream
-//! - a Tokio sender for outbound transport items
-//! - a [`RecvConverter`] for the receive path
-//! - a [`SendConverter`] for the send path
-//!
-//! [`DummyTransport`] is a no-op implementation useful for tests and local actor
-//! execution where no real network stream exists.
-//!
-//! # Component Interaction
-//!
-//! ```text
-//! inbound (network -> protocol)
-//! ============================
-//!
-//! tonic::Streaming<RecvTransport>
-//!     -> grpc::GrpcAdapter::recv()
-//!          |
-//!          +--> on `Ok(item)`: RecvConverter::convert(RecvTransport) -> Inbound
-//!          +--> on `Err(status)`: log error and close stream (`None`)
-//!     -> Bi::recv()
-//!     -> protocol/session actor
-//!
-//! outbound (protocol -> network)
-//! ==============================
-//!
-//! protocol/session actor
-//!     -> Bi::send(Outbound)
-//!     -> grpc::GrpcAdapter::send()
-//!          |
-//!          +--> SendConverter::convert(Outbound) -> SendTransport
-//!     -> Tokio mpsc::Sender<SendTransport>
-//!     -> tonic response stream
-//! ```
-//!
-//! # Design Notes
-//!
-//! - `send()` returns [`Error`] only for transport delivery failures (for
-//!   example, when the outbound channel is closed).
-//! - [`grpc::GrpcAdapter`] logs tonic receive errors and treats them as stream
-//!   closure (`None`).
-//! - When protocol-facing and transport-facing types are identical, use
-//!   [`IdentityRecvConverter`] / [`IdentitySendConverter`].
+use futures::{Stream, StreamExt};
+use tokio::sync::mpsc::{self, error::SendError};
+use tonic::{Status, Streaming};

-use std::marker::PhantomData;

-use async_trait::async_trait;
-
-/// Errors returned by transport adapters implementing [`Bi`].
-#[derive(thiserror::Error, Debug)]
-pub enum Error {
-    #[error("Transport channel is closed")]
-    ChannelClosed,
+// Abstraction for stream for sans-io capabilities
+pub trait Bi<T, U>: Stream<Item = Result<T, Status>> + Send + Sync + 'static {
+    type Error;
+    fn send(
+        &mut self,
+        item: Result<U, Status>,
+    ) -> impl std::future::Future<Output = Result<(), Self::Error>> + Send;
 }

-/// Minimal bidirectional transport abstraction used by protocol code.
-///
-/// `Bi<Inbound, Outbound>` models a duplex channel with:
-/// - inbound items of type `Inbound` read via [`Bi::recv`]
-/// - outbound items of type `Outbound` written via [`Bi::send`]
-#[async_trait]
-pub trait Bi<Inbound, Outbound>: Send + Sync + 'static {
-    async fn send(&mut self, item: Outbound) -> Result<(), Error>;
-
-    async fn recv(&mut self) -> Option<Inbound>;
+// Bi-directional stream abstraction for handling gRPC streaming requests and responses
+pub struct BiStream<T, U> {
+    pub request_stream: Streaming<T>,
+    pub response_sender: mpsc::Sender<Result<U, Status>>,
 }

-/// Converts transport-facing inbound items into protocol-facing inbound items.
-pub trait RecvConverter: Send + Sync + 'static {
-    type Input;
-    type Output;
-
-    fn convert(&self, item: Self::Input) -> Self::Output;
-}
-
-/// Converts protocol/domain outbound items into transport-facing outbound items.
-pub trait SendConverter: Send + Sync + 'static {
-    type Input;
-    type Output;
-
-    fn convert(&self, item: Self::Input) -> Self::Output;
-}
-
-/// A [`RecvConverter`] that forwards values unchanged.
-pub struct IdentityRecvConverter<T> {
-    _marker: PhantomData<T>,
-}
-
-impl<T> IdentityRecvConverter<T> {
-    pub fn new() -> Self {
-        Self {
-            _marker: PhantomData,
-        }
-    }
-}
-
-impl<T> Default for IdentityRecvConverter<T> {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl<T> RecvConverter for IdentityRecvConverter<T>
+impl<T, U> Stream for BiStream<T, U>
 where
-    T: Send + Sync + 'static,
+    T: Send + 'static,
+    U: Send + 'static,
 {
-    type Input = T;
-    type Output = T;
+    type Item = Result<T, Status>;

-    fn convert(&self, item: Self::Input) -> Self::Output {
-        item
+    fn poll_next(
+        mut self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<Option<Self::Item>> {
+        self.request_stream.poll_next_unpin(cx)
    }
 }

-/// A [`SendConverter`] that forwards values unchanged.
-pub struct IdentitySendConverter<T> {
-    _marker: PhantomData<T>,
-}
-
-impl<T> IdentitySendConverter<T> {
-    pub fn new() -> Self {
-        Self {
-            _marker: PhantomData,
-        }
-    }
-}
-
-impl<T> Default for IdentitySendConverter<T> {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl<T> SendConverter for IdentitySendConverter<T>
+impl<T, U> Bi<T, U> for BiStream<T, U>
 where
-    T: Send + Sync + 'static,
+    T: Send + 'static,
+    U: Send + 'static,
 {
-    type Input = T;
-    type Output = T;
+    type Error = SendError<Result<U, Status>>;

-    fn convert(&self, item: Self::Input) -> Self::Output {
-        item
-    }
-}
-
-/// gRPC-specific transport adapters and helpers.
-pub mod grpc {
-    use async_trait::async_trait;
-    use futures::StreamExt;
-    use tokio::sync::mpsc;
-    use tonic::Streaming;
-
-    use super::{Bi, Error, RecvConverter, SendConverter};
-
-    /// [`Bi`] adapter backed by a tonic gRPC bidirectional stream.
-    ///
-
-    /// Tonic receive errors are logged and treated as stream closure (`None`).
-    /// The receive converter is only invoked for successful inbound transport
-    /// items.
-    pub struct GrpcAdapter<InboundConverter, OutboundConverter>
-    where
-        InboundConverter: RecvConverter,
-        OutboundConverter: SendConverter,
-    {
-        sender: mpsc::Sender<OutboundConverter::Output>,
-        receiver: Streaming<InboundConverter::Input>,
-        inbound_converter: InboundConverter,
-        outbound_converter: OutboundConverter,
-    }
-
-    impl<InboundTransport, Inbound, InboundConverter, OutboundConverter>
-        GrpcAdapter<InboundConverter, OutboundConverter>
-    where
-        InboundConverter: RecvConverter<Input = InboundTransport, Output = Inbound>,
-        OutboundConverter: SendConverter,
-    {
-        pub fn new(
-            sender: mpsc::Sender<OutboundConverter::Output>,
-            receiver: Streaming<InboundTransport>,
-            inbound_converter: InboundConverter,
-            outbound_converter: OutboundConverter,
-        ) -> Self {
-            Self {
-                sender,
-                receiver,
-                inbound_converter,
-                outbound_converter,
-            }
-        }
-    }
-
-    #[async_trait]
-    impl<InboundConverter, OutboundConverter> Bi<InboundConverter::Output, OutboundConverter::Input>
-        for GrpcAdapter<InboundConverter, OutboundConverter>
-    where
-        InboundConverter: RecvConverter,
-        OutboundConverter: SendConverter,
-        OutboundConverter::Input: Send + 'static,
-        OutboundConverter::Output: Send + 'static,
-    {
-        #[tracing::instrument(level = "trace", skip(self, item))]
-        async fn send(&mut self, item: OutboundConverter::Input) -> Result<(), Error> {
-            let outbound = self.outbound_converter.convert(item);
-            self.sender
-                .send(outbound)
-                .await
-                .map_err(|_| Error::ChannelClosed)
-        }
-
-        #[tracing::instrument(level = "trace", skip(self))]
-        async fn recv(&mut self) -> Option<InboundConverter::Output> {
-            match self.receiver.next().await {
-                Some(Ok(item)) => Some(self.inbound_converter.convert(item)),
-                Some(Err(error)) => {
-                    tracing::error!(error = ?error, "grpc transport recv failed; closing stream");
-                    None
-                }
-                None => None,
-            }
-        }
-    }
-}
-
-/// No-op [`Bi`] transport for tests and manual actor usage.
-///
-/// `send` drops all items and succeeds. [`Bi::recv`] never resolves and therefore
-/// does not busy-wait or spuriously close the stream.
-pub struct DummyTransport<Inbound, Outbound> {
-    _marker: PhantomData<(Inbound, Outbound)>,
-}
-
-impl<Inbound, Outbound> DummyTransport<Inbound, Outbound> {
-    pub fn new() -> Self {
-        Self {
-            _marker: PhantomData,
-        }
-    }
-}
-
-impl<Inbound, Outbound> Default for DummyTransport<Inbound, Outbound> {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[async_trait]
-impl<Inbound, Outbound> Bi<Inbound, Outbound> for DummyTransport<Inbound, Outbound>
-where
-    Inbound: Send + Sync + 'static,
-    Outbound: Send + Sync + 'static,
-{
-    async fn send(&mut self, _item: Outbound) -> Result<(), Error> {
-        Ok(())
-    }
-
-    async fn recv(&mut self) -> Option<Inbound> {
-        std::future::pending::<()>().await;
-        None
+    async fn send(&mut self, item: Result<U, Status>) -> Result<(), Self::Error> {
+        self.response_sender.send(item).await
    }
 }
--- a/server/crates/arbiter-proto/src/url.rs
+++ b/server/crates/arbiter-proto/src/url.rs
@@ -1,128 +0,0 @@
-use std::fmt::Display;
-
-use base64::{Engine as _, prelude::BASE64_URL_SAFE};
-use rustls_pki_types::CertificateDer;
-
-const ARBITER_URL_SCHEME: &str = "arbiter";
-const CERT_QUERY_KEY: &str = "cert";
-const BOOTSTRAP_TOKEN_QUERY_KEY: &str = "bootstrap_token";
-
-pub struct ArbiterUrl {
-    pub host: String,
-    pub port: u16,
-    pub ca_cert: CertificateDer<'static>,
-    pub bootstrap_token: Option<String>,
-}
-
-impl Display for ArbiterUrl {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        let mut base = format!(
-            "{ARBITER_URL_SCHEME}://{}:{}?{CERT_QUERY_KEY}={}",
-            self.host,
-            self.port,
-            BASE64_URL_SAFE.encode(self.ca_cert.to_vec())
-        );
-        if let Some(token) = &self.bootstrap_token {
-            base.push_str(&format!("&{BOOTSTRAP_TOKEN_QUERY_KEY}={}", token));
-        }
-        f.write_str(&base)
-    }
-}
-
-#[derive(Debug, thiserror::Error, miette::Diagnostic)]
-pub enum Error {
-    #[error("Invalid URL scheme, expected '{ARBITER_URL_SCHEME}://'")]
-    #[diagnostic(
-        code(arbiter::url::invalid_scheme),
-        help("The URL must start with '{ARBITER_URL_SCHEME}://'")
-    )]
-    InvalidScheme,
-    #[error("Missing host in URL")]
-    #[diagnostic(
-        code(arbiter::url::missing_host),
-        help("The URL must include a host, e.g., '{ARBITER_URL_SCHEME}://127.0.0.1:<port>'")
-    )]
-    MissingHost,
-    #[error("Missing port in URL")]
-    #[diagnostic(
-        code(arbiter::url::missing_port),
-        help("The URL must include a port, e.g., '{ARBITER_URL_SCHEME}://127.0.0.1:1234'")
-    )]
-    MissingPort,
-    #[error("Missing 'cert' query parameter in URL")]
-    #[diagnostic(
-        code(arbiter::url::missing_cert),
-        help("The URL must include a 'cert' query parameter")
-    )]
-    MissingCert,
-    #[error("Invalid base64 in 'cert' query parameter: {0}")]
-    #[diagnostic(code(arbiter::url::invalid_cert_base64))]
-    InvalidCertBase64(#[from] base64::DecodeError),
-}
-
-impl<'a> TryFrom<&'a str> for ArbiterUrl {
-    type Error = Error;
-
-    fn try_from(value: &'a str) -> Result<Self, Self::Error> {
-        let url = url::Url::parse(value).map_err(|_| Error::InvalidScheme)?;
-
-        if url.scheme() != ARBITER_URL_SCHEME {
-            return Err(Error::InvalidScheme);
-        }
-
-        let host = url.host_str().ok_or(Error::MissingHost)?.to_string();
-        let port = url.port().ok_or(Error::MissingPort)?;
-        let cert_str = url
-            .query_pairs()
-            .find(|(k, _)| k == CERT_QUERY_KEY)
-            .ok_or(Error::MissingCert)?
-            .1;
-
-        let cert = BASE64_URL_SAFE.decode(cert_str.as_ref())?;
-        let cert = CertificateDer::from_slice(&cert).into_owned();
-
-        let bootstrap_token = url
-            .query_pairs()
-            .find(|(k, _)| k == BOOTSTRAP_TOKEN_QUERY_KEY)
-            .map(|(_, v)| v.to_string());
-
-        Ok(ArbiterUrl {
-            host,
-            port,
-            ca_cert: cert,
-            bootstrap_token,
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use rcgen::generate_simple_self_signed;
-    use rstest::rstest;
-
-    use super::*;
-
-    #[rstest]
-
-    fn test_parsing_correctness(
-        #[values("127.0.0.1", "localhost", "192.168.1.1", "some.domain.com")] host: &str,
-
-        #[values(None, Some("token123".to_string()))] bootstrap_token: Option<String>,
-    ) {
-        let cert = generate_simple_self_signed(&["Arbiter CA".into()]).unwrap();
-        let cert = cert.cert.der();
-
-        let url = ArbiterUrl {
-            host: host.to_string(),
-            port: 1234,
-            ca_cert: cert.clone().into_owned(),
-            bootstrap_token,
-        };
-        let url_str = url.to_string();
-        let parsed_url = ArbiterUrl::try_from(url_str.as_str()).unwrap();
-        assert_eq!(url.host, parsed_url.host);
-        assert_eq!(url.port, parsed_url.port);
-        assert_eq!(url.ca_cert.to_vec(), parsed_url.ca_cert.to_vec());
-        assert_eq!(url.bootstrap_token, parsed_url.bootstrap_token);
-    }
-}
--- a/server/crates/arbiter-server/.DS_Store
+++ b/server/crates/arbiter-server/.DS_Store
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -3,10 +3,15 @@ name = "arbiter-server"
 version = "0.1.0"
 edition = "2024"
 repository = "https://git.markettakers.org/MarketTakers/arbiter"
-license = "Apache-2.0"

 [dependencies]
-diesel = { version = "2.3.6", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
+diesel = { version = "2.3.6", features = [
+    "sqlite",
+    "uuid",
+    "time",
+    "chrono",
+    "serde_json",
+] }
 diesel-async = { version = "0.7.4", features = [
    "bb8",
    "migrations",
@@ -16,9 +21,7 @@ diesel-async = { version = "0.7.4", features = [
 ed25519-dalek.workspace = true
 arbiter-proto.path = "../arbiter-proto"
 tracing.workspace = true
-tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 tonic.workspace = true
-tonic.features = ["tls-aws-lc"]
 tokio.workspace = true
 rustls.workspace = true
 smlang.workspace = true
@@ -31,18 +34,20 @@ futures.workspace = true
 tokio-stream.workspace = true
 dashmap = "6.1.0"
 rand.workspace = true
-rcgen.workspace = true
+rcgen = { version = "0.14.7", features = [
+    "aws_lc_rs",
+    "pem",
+    "x509-parser",
+    "zeroize",
+], default-features = false }
 chrono.workspace = true
 memsafe = "0.4.0"
 zeroize = { version = "1.8.2", features = ["std", "simd"] }
+argon2 = { version = "0.5", features = ["std"] }
 kameo.workspace = true
-x25519-dalek.workspace = true
-chacha20poly1305 = { version = "0.10.1", features = ["std"] }
-argon2 = { version = "0.5.3", features = ["zeroize"] }
-restructed = "0.2.2"
-strum = { version = "0.27.2", features = ["derive"] }
-pem = "3.0.6"
+hex = "0.4.3"
+chacha20poly1305 = "0.10.1"
+x25519-dalek = { version = "2.0", features = ["static_secrets"] }

 [dev-dependencies]
-insta = "1.46.3"
 test-log = { version = "0.2", default-features = false, features = ["trace"] }
--- a/server/crates/arbiter-server/migrations/2026-02-13-155546-0000_add_tls_rotation/down.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-13-155546-0000_add_tls_rotation/down.sql
@@ -0,0 +1,11 @@
+-- Rollback TLS rotation tables
+
+-- Удалить добавленную колонку из arbiter_settings
+ALTER TABLE arbiter_settings DROP COLUMN current_cert_id;
+
+-- Удалить таблицы в обратном порядке
+DROP TABLE IF EXISTS tls_rotation_history;
+DROP TABLE IF EXISTS rotation_client_acks;
+DROP TABLE IF EXISTS tls_rotation_state;
+DROP INDEX IF EXISTS idx_tls_certificates_active;
+DROP TABLE IF EXISTS tls_certificates;
--- a/server/crates/arbiter-server/migrations/2026-02-13-155546-0000_add_tls_rotation/up.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-13-155546-0000_add_tls_rotation/up.sql
@@ -0,0 +1,57 @@
+-- История всех сертификатов
+CREATE TABLE IF NOT EXISTS tls_certificates (
+    id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    cert BLOB NOT NULL,              -- DER-encoded
+    cert_key BLOB NOT NULL,          -- PEM-encoded
+    not_before INTEGER NOT NULL,     -- Unix timestamp
+    not_after INTEGER NOT NULL,      -- Unix timestamp
+    created_at INTEGER NOT NULL DEFAULT(unixepoch('now')),
+    is_active BOOLEAN NOT NULL DEFAULT 0  -- Только один active=1
+) STRICT;
+
+CREATE INDEX idx_tls_certificates_active ON tls_certificates(is_active, not_after);
+
+-- Tracking процесса ротации
+CREATE TABLE IF NOT EXISTS tls_rotation_state (
+    id INTEGER NOT NULL PRIMARY KEY CHECK(id = 1),  -- Singleton
+    state TEXT NOT NULL DEFAULT('normal') CHECK(state IN ('normal', 'initiated', 'waiting_acks', 'ready')),
+    new_cert_id INTEGER REFERENCES tls_certificates(id),
+    initiated_at INTEGER,
+    timeout_at INTEGER  -- Таймаут для ожидания ACKs (initiated_at + 7 дней)
+) STRICT;
+
+-- Tracking ACKs от клиентов
+CREATE TABLE IF NOT EXISTS rotation_client_acks (
+    rotation_id INTEGER NOT NULL,    -- Ссылка на new_cert_id
+    client_key TEXT NOT NULL,        -- Публичный ключ клиента (hex)
+    ack_received_at INTEGER NOT NULL DEFAULT(unixepoch('now')),
+    PRIMARY KEY (rotation_id, client_key)
+) STRICT;
+
+-- Audit trail событий ротации
+CREATE TABLE IF NOT EXISTS tls_rotation_history (
+    id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    cert_id INTEGER NOT NULL REFERENCES tls_certificates(id),
+    event_type TEXT NOT NULL CHECK(event_type IN ('created', 'rotation_initiated', 'acks_complete', 'activated', 'timeout')),
+    timestamp INTEGER NOT NULL DEFAULT(unixepoch('now')),
+    details TEXT  -- JSON с доп. информацией
+) STRICT;
+
+-- Миграция существующего сертификата
+INSERT INTO tls_certificates (id, cert, cert_key, not_before, not_after, is_active, created_at)
+SELECT
+    1,
+    cert,
+    cert_key,
+    unixepoch('now') as not_before,
+    unixepoch('now') + (90 * 24 * 60 * 60) as not_after,  -- 90 дней
+    1 as is_active,
+    unixepoch('now')
+FROM arbiter_settings WHERE id = 1;
+
+-- Инициализация rotation_state
+INSERT INTO tls_rotation_state (id, state) VALUES (1, 'normal');
+
+-- Добавить ссылку на текущий сертификат
+ALTER TABLE arbiter_settings ADD COLUMN current_cert_id INTEGER REFERENCES tls_certificates(id);
+UPDATE arbiter_settings SET current_cert_id = 1 WHERE id = 1;
--- a/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
@@ -1,50 +1,22 @@
-create table if not exists root_key_history (
-    id INTEGER not null PRIMARY KEY,
-    -- root key stored as aead encrypted artifact, with only difference that it's decrypted by unseal key (derived from user password)
-    root_key_encryption_nonce blob not null default(1), -- if re-encrypted, this should be incremented. Used for encrypting root key
-    data_encryption_nonce blob not null default(1), -- nonce used for encrypting with key itself
-    ciphertext blob not null,
-    tag blob not null,
-    schema_version integer not null default(1), -- server would need to reencrypt, because this means that we have changed algorithm
-    salt blob not null -- for key deriviation 
-) STRICT;
-
 create table if not exists aead_encrypted (
    id INTEGER not null PRIMARY KEY,
-    current_nonce blob not null default(1), -- if re-encrypted, this should be incremented
+    current_nonce integer not null default(1), -- if re-encrypted, this should be incremented
    ciphertext blob not null,
    tag blob not null,
-    schema_version integer not null default(1), -- server would need to reencrypt, because this means that we have changed algorithm
-    associated_root_key_id integer not null references root_key_history (id) on delete RESTRICT,
-    created_at integer not null default(unixepoch ('now'))
-) STRICT;
-
-create unique index if not exists uniq_nonce_per_root_key on aead_encrypted (
-    current_nonce,
-    associated_root_key_id
-);
-
-create table if not exists tls_history (
-    id INTEGER not null PRIMARY KEY,
-    cert text not null,
-    cert_key text not null, -- PEM Encoded private key
-    ca_cert text not null, 
-    ca_key text not null, -- PEM Encoded private key
-    created_at integer not null default(unixepoch ('now'))
+    schema_version integer not null default(1) -- server would need to reencrypt, because this means that we have changed algorithm
 ) STRICT;

 -- This is a singleton
 create table if not exists arbiter_settings (
    id INTEGER not null PRIMARY KEY CHECK (id = 1), -- singleton row, id must be 1
-    root_key_id integer references root_key_history (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet
-    tls_id integer references tls_history (id) on delete RESTRICT
+    root_key_id integer references aead_encrypted (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet
+    cert_key blob not null,
+    cert blob not null
 ) STRICT;

-insert into arbiter_settings (id) values (1) on conflict do nothing; -- ensure singleton row exists
-
 create table if not exists useragent_client (
    id integer not null primary key,
-    nonce integer not null default(1), -- used for auth challenge
+    nonce integer not null default (1), -- used for auth challenge
    public_key blob not null,
    created_at integer not null default(unixepoch ('now')),
    updated_at integer not null default(unixepoch ('now'))
@@ -52,7 +24,7 @@ create table if not exists useragent_client (

 create table if not exists program_client (
    id integer not null primary key,
-    nonce integer not null default(1), -- used for auth challenge
+    nonce integer not null default (1), -- used for auth challenge
    public_key blob not null,
    created_at integer not null default(unixepoch ('now')),
    updated_at integer not null default(unixepoch ('now'))
--- a/server/crates/arbiter-server/migrations/2026-02-16-160000-0000_add_argon2_salt/down.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-16-160000-0000_add_argon2_salt/down.sql
@@ -0,0 +1,2 @@
+-- Remove argon2_salt column
+ALTER TABLE aead_encrypted DROP COLUMN argon2_salt;
--- a/server/crates/arbiter-server/migrations/2026-02-16-160000-0000_add_argon2_salt/up.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-16-160000-0000_add_argon2_salt/up.sql
@@ -0,0 +1,2 @@
+-- Add argon2_salt column to store password derivation salt
+ALTER TABLE aead_encrypted ADD COLUMN argon2_salt TEXT;
--- a/server/crates/arbiter-server/src/.DS_Store
+++ b/server/crates/arbiter-server/src/.DS_Store
--- a/server/crates/arbiter-server/src/actors.rs
+++ b/server/crates/arbiter-server/src/actors.rs
@@ -0,0 +1,2 @@
+pub mod user_agent;
+pub mod client;
--- a/server/crates/arbiter-server/src/actors/client.rs
+++ b/server/crates/arbiter-server/src/actors/client.rs
@@ -0,0 +1,12 @@
+use arbiter_proto::{
+    proto::{ClientRequest, ClientResponse},
+    transport::Bi,
+};
+
+use crate::ServerContext;
+
+pub(crate) async fn handle_client(
+    _context: ServerContext,
+    _bistream: impl Bi<ClientRequest, ClientResponse>,
+) {
+}
--- a/server/crates/arbiter-server/src/actors/client/auth/mod.rs
+++ b/server/crates/arbiter-server/src/actors/client/auth/mod.rs
@@ -1,101 +0,0 @@
-use arbiter_proto::proto::client::{
-    AuthChallengeRequest, AuthChallengeSolution, ClientRequest,
-    client_request::Payload as ClientRequestPayload,
-};
-use ed25519_dalek::VerifyingKey;
-use tracing::error;
-
-use crate::actors::client::{
-    ClientConnection,
-    auth::state::{AuthContext, AuthStateMachine},
-    session::ClientSession,
-};
-
-#[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
-pub enum Error {
-    #[error("Unexpected message payload")]
-    UnexpectedMessagePayload,
-    #[error("Invalid client public key length")]
-    InvalidClientPubkeyLength,
-    #[error("Invalid client public key encoding")]
-    InvalidAuthPubkeyEncoding,
-    #[error("Database pool unavailable")]
-    DatabasePoolUnavailable,
-    #[error("Database operation failed")]
-    DatabaseOperationFailed,
-    #[error("Public key not registered")]
-    PublicKeyNotRegistered,
-    #[error("Invalid signature length")]
-    InvalidSignatureLength,
-    #[error("Invalid challenge solution")]
-    InvalidChallengeSolution,
-    #[error("Transport error")]
-    Transport,
-}
-
-mod state;
-use state::*;
-
-fn parse_auth_event(payload: ClientRequestPayload) -> Result<AuthEvents, Error> {
-    match payload {
-        ClientRequestPayload::AuthChallengeRequest(AuthChallengeRequest { pubkey }) => {
-            let pubkey_bytes = pubkey.as_array().ok_or(Error::InvalidClientPubkeyLength)?;
-            let pubkey = VerifyingKey::from_bytes(pubkey_bytes)
-                .map_err(|_| Error::InvalidAuthPubkeyEncoding)?;
-            Ok(AuthEvents::AuthRequest(ChallengeRequest {
-                pubkey: pubkey.into(),
-            }))
-        }
-        ClientRequestPayload::AuthChallengeSolution(AuthChallengeSolution { signature }) => {
-            Ok(AuthEvents::ReceivedSolution(ChallengeSolution {
-                solution: signature,
-            }))
-        }
-    }
-}
-
-pub async fn authenticate(props: &mut ClientConnection) -> Result<VerifyingKey, Error> {
-    let mut state = AuthStateMachine::new(AuthContext::new(props));
-
-    loop {
-        let transport = state.context_mut().conn.transport.as_mut();
-        let Some(ClientRequest {
-            payload: Some(payload),
-        }) = transport.recv().await
-        else {
-            return Err(Error::Transport);
-        };
-
-        let event = parse_auth_event(payload)?;
-
-        match state.process_event(event).await {
-            Ok(AuthStates::AuthOk(key)) => return Ok(key.clone()),
-            Err(AuthError::ActionFailed(err)) => {
-                error!(?err, "State machine action failed");
-                return Err(err);
-            }
-            Err(AuthError::GuardFailed(err)) => {
-                error!(?err, "State machine guard failed");
-                return Err(err);
-            }
-            Err(AuthError::InvalidEvent) => {
-                error!("Invalid event for current state");
-                return Err(Error::InvalidChallengeSolution);
-            }
-            Err(AuthError::TransitionsFailed) => {
-                error!("Invalid state transition");
-                return Err(Error::InvalidChallengeSolution);
-            }
-
-            _ => (),
-        }
-    }
-}
-
-pub async fn authenticate_and_create(
-    mut props: ClientConnection,
-) -> Result<ClientSession, Error> {
-    let key = authenticate(&mut props).await?;
-    let session = ClientSession::new(props, key);
-    Ok(session)
-}
--- a/server/crates/arbiter-server/src/actors/client/auth/state.rs
+++ b/server/crates/arbiter-server/src/actors/client/auth/state.rs
@@ -1,136 +0,0 @@
-use arbiter_proto::proto::client::{
-    AuthChallenge, ClientResponse,
-    client_response::Payload as ClientResponsePayload,
-};
-use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl, update};
-use diesel_async::RunQueryDsl;
-use ed25519_dalek::VerifyingKey;
-use tracing::error;
-
-use super::Error;
-use crate::{actors::client::ClientConnection, db::schema};
-
-pub struct ChallengeRequest {
-    pub pubkey: VerifyingKey,
-}
-
-pub struct ChallengeContext {
-    pub challenge: AuthChallenge,
-    pub key: VerifyingKey,
-}
-
-pub struct ChallengeSolution {
-    pub solution: Vec<u8>,
-}
-
-smlang::statemachine!(
-    name: Auth,
-    custom_error: true,
-    transitions: {
-        *Init + AuthRequest(ChallengeRequest) / async prepare_challenge = SentChallenge(ChallengeContext),
-        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) [async verify_solution] / provide_key = AuthOk(VerifyingKey),
-    }
-);
-
-async fn create_nonce(db: &crate::db::DatabasePool, pubkey_bytes: &[u8]) -> Result<i32, Error> {
-    let mut db_conn = db.get().await.map_err(|e| {
-        error!(error = ?e, "Database pool error");
-        Error::DatabasePoolUnavailable
-    })?;
-    db_conn
-        .exclusive_transaction(|conn| {
-            Box::pin(async move {
-                let current_nonce = schema::program_client::table
-                    .filter(schema::program_client::public_key.eq(pubkey_bytes.to_vec()))
-                    .select(schema::program_client::nonce)
-                    .first::<i32>(conn)
-                    .await?;
-
-                update(schema::program_client::table)
-                    .filter(schema::program_client::public_key.eq(pubkey_bytes.to_vec()))
-                    .set(schema::program_client::nonce.eq(current_nonce + 1))
-                    .execute(conn)
-                    .await?;
-
-                Result::<_, diesel::result::Error>::Ok(current_nonce)
-            })
-        })
-        .await
-        .optional()
-        .map_err(|e| {
-            error!(error = ?e, "Database error");
-            Error::DatabaseOperationFailed
-        })?
-        .ok_or_else(|| {
-            error!(?pubkey_bytes, "Public key not found in database");
-            Error::PublicKeyNotRegistered
-        })
-}
-
-pub struct AuthContext<'a> {
-    pub(super) conn: &'a mut ClientConnection,
-}
-
-impl<'a> AuthContext<'a> {
-    pub fn new(conn: &'a mut ClientConnection) -> Self {
-        Self { conn }
-    }
-}
-
-impl AuthStateMachineContext for AuthContext<'_> {
-    type Error = Error;
-
-    async fn verify_solution(
-        &self,
-        ChallengeContext { challenge, key }: &ChallengeContext,
-        ChallengeSolution { solution }: &ChallengeSolution,
-    ) -> Result<bool, Self::Error> {
-        let formatted_challenge =
-            arbiter_proto::format_challenge(challenge.nonce, &challenge.pubkey);
-
-        let signature = solution.as_slice().try_into().map_err(|_| {
-            error!(?solution, "Invalid signature length");
-            Error::InvalidChallengeSolution
-        })?;
-
-        let valid = key.verify_strict(&formatted_challenge, &signature).is_ok();
-
-        Ok(valid)
-    }
-
-    async fn prepare_challenge(
-        &mut self,
-        ChallengeRequest { pubkey }: ChallengeRequest,
-    ) -> Result<ChallengeContext, Self::Error> {
-        let nonce = create_nonce(&self.conn.db, pubkey.as_bytes()).await?;
-
-        let challenge = AuthChallenge {
-            pubkey: pubkey.as_bytes().to_vec(),
-            nonce,
-        };
-
-        self.conn
-            .transport
-            .send(Ok(ClientResponse {
-                payload: Some(ClientResponsePayload::AuthChallenge(challenge.clone())),
-            }))
-            .await
-            .map_err(|e| {
-                error!(?e, "Failed to send auth challenge");
-                Error::Transport
-            })?;
-
-        Ok(ChallengeContext {
-            challenge,
-            key: pubkey,
-        })
-    }
-
-    fn provide_key(
-        &mut self,
-        state_data: &ChallengeContext,
-        _: ChallengeSolution,
-    ) -> Result<VerifyingKey, Self::Error> {
-        Ok(state_data.key)
-    }
-}
--- a/server/crates/arbiter-server/src/actors/client/mod.rs
+++ b/server/crates/arbiter-server/src/actors/client/mod.rs
@@ -1,58 +0,0 @@
-use arbiter_proto::{
-    proto::client::{ClientRequest, ClientResponse},
-    transport::Bi,
-};
-use kameo::actor::Spawn;
-use tracing::{error, info};
-
-use crate::{
-    actors::{GlobalActors, client::session::ClientSession},
-    db,
-};
-
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
-pub enum ClientError {
-    #[error("Expected message with payload")]
-    MissingRequestPayload,
-    #[error("Unexpected request payload")]
-    UnexpectedRequestPayload,
-    #[error("State machine error")]
-    StateTransitionFailed,
-    #[error("Connection registration failed")]
-    ConnectionRegistrationFailed,
-    #[error(transparent)]
-    Auth(#[from] auth::Error),
-}
-
-pub type Transport = Box<dyn Bi<ClientRequest, Result<ClientResponse, ClientError>> + Send>;
-
-pub struct ClientConnection {
-    pub(crate) db: db::DatabasePool,
-    pub(crate) transport: Transport,
-    pub(crate) actors: GlobalActors,
-}
-
-impl ClientConnection {
-    pub fn new(db: db::DatabasePool, transport: Transport, actors: GlobalActors) -> Self {
-        Self {
-            db,
-            transport,
-            actors,
-        }
-    }
-}
-
-pub mod auth;
-pub mod session;
-
-pub async fn connect_client(props: ClientConnection) {
-    match auth::authenticate_and_create(props).await {
-        Ok(session) => {
-            ClientSession::spawn(session);
-            info!("Client authenticated, session started");
-        }
-        Err(err) => {
-            error!(?err, "Authentication failed, closing connection");
-        }
-    }
-}
--- a/server/crates/arbiter-server/src/actors/client/session.rs
+++ b/server/crates/arbiter-server/src/actors/client/session.rs
@@ -1,98 +0,0 @@
-use arbiter_proto::proto::client::{ClientRequest, ClientResponse};
-use ed25519_dalek::VerifyingKey;
-use kameo::Actor;
-use tokio::select;
-use tracing::{error, info};
-
-use crate::{actors::{
-    GlobalActors, client::{ClientError, ClientConnection}, router::RegisterClient
-}, db};
-
-pub struct ClientSession {
-    props: ClientConnection,
-    key: VerifyingKey,
-}
-
-impl ClientSession {
-    pub(crate) fn new(props: ClientConnection, key: VerifyingKey) -> Self {
-        Self { props, key }
-    }
-
-    pub async fn process_transport_inbound(&mut self, req: ClientRequest) -> Output {
-        let msg = req.payload.ok_or_else(|| {
-            error!(actor = "client", "Received message with no payload");
-            ClientError::MissingRequestPayload
-        })?;
-
-        match msg {
-            _ => Err(ClientError::UnexpectedRequestPayload),
-        }
-    }
-}
-
-type Output = Result<ClientResponse, ClientError>;
-
-impl Actor for ClientSession {
-    type Args = Self;
-
-    type Error = ClientError;
-
-    async fn on_start(
-        args: Self::Args,
-        this: kameo::prelude::ActorRef<Self>,
-    ) -> Result<Self, Self::Error> {
-        args.props
-            .actors
-            .router
-            .ask(RegisterClient { actor: this })
-            .await
-            .map_err(|_| ClientError::ConnectionRegistrationFailed)?;
-        Ok(args)
-    }
-
-    async fn next(
-        &mut self,
-        _actor_ref: kameo::prelude::WeakActorRef<Self>,
-        mailbox_rx: &mut kameo::prelude::MailboxReceiver<Self>,
-    ) -> Option<kameo::mailbox::Signal<Self>> {
-        loop {
-            select! {
-                signal = mailbox_rx.recv() => {
-                    return signal;
-                }
-                msg = self.props.transport.recv() => {
-                    match msg {
-                        Some(request) => {
-                            match self.process_transport_inbound(request).await {
-                                Ok(resp) => {
-                                    if self.props.transport.send(Ok(resp)).await.is_err() {
-                                        error!(actor = "client", reason = "channel closed", "send.failed");
-                                        return Some(kameo::mailbox::Signal::Stop);
-                                    }
-                                }
-                                Err(err) => {
-                                    let _ = self.props.transport.send(Err(err)).await;
-                                    return Some(kameo::mailbox::Signal::Stop);
-                                }
-                            }
-                        }
-                        None => {
-                            info!(actor = "client", "transport.closed");
-                            return Some(kameo::mailbox::Signal::Stop);
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
-
-impl ClientSession {
-    pub fn new_test(db: db::DatabasePool, actors: GlobalActors) -> Self {
-        use arbiter_proto::transport::DummyTransport;
-        let transport: super::Transport = Box::new(DummyTransport::new());
-        let props = ClientConnection::new(db, transport, actors);
-        let key = VerifyingKey::from_bytes(&[0u8; 32]).unwrap();
-        Self { props, key }
-    }
-}
--- a/server/crates/arbiter-server/src/actors/keyholder/encryption.rs
+++ b/server/crates/arbiter-server/src/actors/keyholder/encryption.rs
@@ -1 +0,0 @@
-pub mod v1;
--- a/server/crates/arbiter-server/src/actors/keyholder/encryption/v1.rs
+++ b/server/crates/arbiter-server/src/actors/keyholder/encryption/v1.rs
@@ -1,237 +0,0 @@
-use std::ops::Deref as _;
-
-use argon2::{Algorithm, Argon2, password_hash::Salt as ArgonSalt};
-use chacha20poly1305::{
-    AeadInPlace, Key, KeyInit as _, XChaCha20Poly1305, XNonce,
-    aead::{AeadMut, Error, Payload},
-};
-use memsafe::MemSafe;
-use rand::{
-    Rng as _, SeedableRng,
-    rngs::{StdRng, SysRng},
-};
-
-pub const ROOT_KEY_TAG: &[u8] = "arbiter/seal/v1".as_bytes();
-pub const TAG: &[u8] = "arbiter/private-key/v1".as_bytes();
-
-pub const NONCE_LENGTH: usize = 24;
-
-#[derive(Default)]
-pub struct Nonce([u8; NONCE_LENGTH]);
-impl Nonce {
-    pub fn increment(&mut self) {
-        for i in (0..self.0.len()).rev() {
-            if self.0[i] == 0xFF {
-                self.0[i] = 0;
-            } else {
-                self.0[i] += 1;
-                break;
-            }
-        }
-    }
-
-    pub fn to_vec(&self) -> Vec<u8> {
-        self.0.to_vec()
-    }
-}
-impl<'a> TryFrom<&'a [u8]> for Nonce {
-    type Error = ();
-
-    fn try_from(value: &'a [u8]) -> Result<Self, Self::Error> {
-        if value.len() != NONCE_LENGTH {
-            return Err(());
-        }
-        let mut nonce = [0u8; NONCE_LENGTH];
-        nonce.copy_from_slice(value);
-        Ok(Self(nonce))
-    }
-}
-
-pub struct KeyCell(pub MemSafe<Key>);
-impl From<MemSafe<Key>> for KeyCell {
-    fn from(value: MemSafe<Key>) -> Self {
-        Self(value)
-    }
-}
-impl TryFrom<MemSafe<Vec<u8>>> for KeyCell {
-    type Error = ();
-
-    fn try_from(mut value: MemSafe<Vec<u8>>) -> Result<Self, Self::Error> {
-        let value = value.read().unwrap();
-        if value.len() != size_of::<Key>() {
-            return Err(());
-        }
-        let mut cell = MemSafe::new(Key::default()).unwrap();
-        {
-            let mut cell_write = cell.write().unwrap();
-            let cell_slice: &mut [u8] = cell_write.as_mut();
-            cell_slice.copy_from_slice(&value);
-        }
-        Ok(Self(cell))
-    }
-}
-
-impl KeyCell {
-    pub fn new_secure_random() -> Self {
-        let mut key = MemSafe::new(Key::default()).unwrap();
-        {
-            let mut key_buffer = key.write().unwrap();
-            let key_buffer: &mut [u8] = key_buffer.as_mut();
-
-            let mut rng = StdRng::try_from_rng(&mut SysRng).unwrap();
-            rng.fill_bytes(key_buffer);
-        }
-
-        key.into()
-    }
-
-    pub fn encrypt_in_place(
-        &mut self,
-        nonce: &Nonce,
-        associated_data: &[u8],
-        mut buffer: impl AsMut<Vec<u8>>,
-    ) -> Result<(), Error> {
-        let key_reader = self.0.read().unwrap();
-        let key_ref = key_reader.deref();
-        let cipher = XChaCha20Poly1305::new(key_ref);
-        let nonce = XNonce::from_slice(nonce.0.as_ref());
-        let buffer = buffer.as_mut();
-        cipher.encrypt_in_place(nonce, associated_data, buffer)
-    }
-    pub fn decrypt_in_place(
-        &mut self,
-        nonce: &Nonce,
-        associated_data: &[u8],
-        buffer: &mut MemSafe<Vec<u8>>,
-    ) -> Result<(), Error> {
-        let key_reader = self.0.read().unwrap();
-        let key_ref = key_reader.deref();
-        let cipher = XChaCha20Poly1305::new(key_ref);
-        let nonce = XNonce::from_slice(nonce.0.as_ref());
-        let mut buffer = buffer.write().unwrap();
-        let buffer: &mut Vec<u8> = buffer.as_mut();
-        cipher.decrypt_in_place(nonce, associated_data, buffer)
-    }
-
-    pub fn encrypt(
-        &mut self,
-        nonce: &Nonce,
-        associated_data: &[u8],
-        plaintext: impl AsRef<[u8]>,
-    ) -> Result<Vec<u8>, Error> {
-        let key_reader = self.0.read().unwrap();
-        let key_ref = key_reader.deref();
-        let mut cipher = XChaCha20Poly1305::new(key_ref);
-        let nonce = XNonce::from_slice(nonce.0.as_ref());
-
-        let ciphertext = cipher.encrypt(
-            nonce,
-            Payload {
-                msg: plaintext.as_ref(),
-                aad: associated_data,
-            },
-        )?;
-        Ok(ciphertext)
-    }
-}
-
-pub type Salt = [u8; ArgonSalt::RECOMMENDED_LENGTH];
-
-pub fn generate_salt() -> Salt {
-    let mut salt = Salt::default();
-    let mut rng = StdRng::try_from_rng(&mut SysRng).unwrap();
-    rng.fill_bytes(&mut salt);
-    salt
-}
-
-/// User password might be of different length, have not enough entropy, etc...
-/// Derive a fixed-length key from the password using Argon2id, which is designed for password hashing and key derivation.
-pub fn derive_seal_key(mut password: MemSafe<Vec<u8>>, salt: &Salt) -> KeyCell {
-    let params = argon2::Params::new(262_144, 3, 4, None).unwrap();
-    let hasher = Argon2::new(Algorithm::Argon2id, argon2::Version::V0x13, params);
-    let mut key = MemSafe::new(Key::default()).unwrap();
-    {
-        let password_source = password.read().unwrap();
-        let mut key_buffer = key.write().unwrap();
-        let key_buffer: &mut [u8] = key_buffer.as_mut();
-
-        hasher
-            .hash_password_into(password_source.deref(), salt, key_buffer)
-            .unwrap();
-    }
-
-    key.into()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use memsafe::MemSafe;
-
-    #[test]
-    pub fn derive_seal_key_deterministic() {
-        static PASSWORD: &[u8] = b"password";
-        let password = MemSafe::new(PASSWORD.to_vec()).unwrap();
-        let password2 = MemSafe::new(PASSWORD.to_vec()).unwrap();
-        let salt = generate_salt();
-
-        let mut key1 = derive_seal_key(password, &salt);
-        let mut key2 = derive_seal_key(password2, &salt);
-
-        let key1_reader = key1.0.read().unwrap();
-        let key2_reader = key2.0.read().unwrap();
-
-        assert_eq!(key1_reader.deref(), key2_reader.deref());
-    }
-
-    #[test]
-    pub fn successful_derive() {
-        static PASSWORD: &[u8] = b"password";
-        let password = MemSafe::new(PASSWORD.to_vec()).unwrap();
-        let salt = generate_salt();
-
-        let mut key = derive_seal_key(password, &salt);
-        let key_reader = key.0.read().unwrap();
-        let key_ref = key_reader.deref();
-
-        assert_ne!(key_ref.as_slice(), &[0u8; 32][..]);
-    }
-
-    #[test]
-    pub fn encrypt_decrypt() {
-        static PASSWORD: &[u8] = b"password";
-        let password = MemSafe::new(PASSWORD.to_vec()).unwrap();
-        let salt = generate_salt();
-
-        let mut key = derive_seal_key(password, &salt);
-        let nonce = Nonce(*b"unique nonce 123 1231233"); // 24 bytes for XChaCha20Poly1305
-        let associated_data = b"associated data";
-        let mut buffer = b"secret data".to_vec();
-
-        key.encrypt_in_place(&nonce, associated_data, &mut buffer)
-            .unwrap();
-        assert_ne!(buffer, b"secret data");
-
-        let mut buffer = MemSafe::new(buffer).unwrap();
-
-        key.decrypt_in_place(&nonce, associated_data, &mut buffer)
-            .unwrap();
-
-        let buffer = buffer.read().unwrap();
-        assert_eq!(*buffer, b"secret data");
-    }
-
-    #[test]
-    // We should fuzz this
-    pub fn test_nonce_increment() {
-        let mut nonce = Nonce([0u8; NONCE_LENGTH]);
-        nonce.increment();
-
-        assert_eq!(
-            nonce.0,
-            [
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1
-            ]
-        );
-    }
-}
--- a/server/crates/arbiter-server/src/actors/keyholder/mod.rs
+++ b/server/crates/arbiter-server/src/actors/keyholder/mod.rs
@@ -1,407 +0,0 @@
-use diesel::{
-    ExpressionMethods as _, OptionalExtension, QueryDsl, SelectableHelper,
-    dsl::{insert_into, update},
-};
-use diesel_async::{AsyncConnection, RunQueryDsl};
-use kameo::{Actor, Reply, messages};
-use memsafe::MemSafe;
-use strum::{EnumDiscriminants, IntoDiscriminant};
-use tracing::{error, info};
-
-use crate::db::{
-    self,
-    models::{self, RootKeyHistory},
-    schema::{self},
-};
-use encryption::v1::{self, KeyCell, Nonce};
-
-pub mod encryption;
-
-#[derive(Default, EnumDiscriminants)]
-#[strum_discriminants(derive(Reply), vis(pub))]
-enum State {
-    #[default]
-    Unbootstrapped,
-    Sealed {
-        root_key_history_id: i32,
-    },
-    Unsealed {
-        root_key_history_id: i32,
-        root_key: KeyCell,
-    },
-}
-
-#[derive(Debug, thiserror::Error, miette::Diagnostic)]
-pub enum Error {
-    #[error("Keyholder is already bootstrapped")]
-    #[diagnostic(code(arbiter::keyholder::already_bootstrapped))]
-    AlreadyBootstrapped,
-    #[error("Keyholder is not bootstrapped")]
-    #[diagnostic(code(arbiter::keyholder::not_bootstrapped))]
-    NotBootstrapped,
-    #[error("Invalid key provided")]
-    #[diagnostic(code(arbiter::keyholder::invalid_key))]
-    InvalidKey,
-
-    #[error("Requested aead entry not found")]
-    #[diagnostic(code(arbiter::keyholder::aead_not_found))]
-    NotFound,
-
-    #[error("Encryption error: {0}")]
-    #[diagnostic(code(arbiter::keyholder::encryption_error))]
-    Encryption(#[from] chacha20poly1305::aead::Error),
-
-    #[error("Database error: {0}")]
-    #[diagnostic(code(arbiter::keyholder::database_error))]
-    DatabaseConnection(#[from] db::PoolError),
-
-    #[error("Database transaction error: {0}")]
-    #[diagnostic(code(arbiter::keyholder::database_transaction_error))]
-    DatabaseTransaction(#[from] diesel::result::Error),
-
-    #[error("Broken database")]
-    #[diagnostic(code(arbiter::keyholder::broken_database))]
-    BrokenDatabase,
-}
-
-/// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed).
-/// Provides API for encrypting and decrypting data using the vault root key.
-/// Abstraction over database to make sure nonces are never reused and encryption keys are never exposed in plaintext outside of this actor.
-#[derive(Actor)]
-pub struct KeyHolder {
-    db: db::DatabasePool,
-    state: State,
-}
-
-#[messages]
-impl KeyHolder {
-    pub async fn new(db: db::DatabasePool) -> Result<Self, Error> {
-        let state = {
-            let mut conn = db.get().await?;
-
-            let (root_key_history,) = schema::arbiter_settings::table
-                .left_join(schema::root_key_history::table)
-                .select((Option::<RootKeyHistory>::as_select(),))
-                .get_result::<(Option<RootKeyHistory>,)>(&mut conn)
-                .await?;
-
-            match root_key_history {
-                Some(root_key_history) => State::Sealed {
-                    root_key_history_id: root_key_history.id,
-                },
-                None => State::Unbootstrapped,
-            }
-        };
-
-        Ok(Self { db, state })
-    }
-
-    // Exclusive transaction to avoid race condtions if multiple keyholders write
-    // additional layer of protection against nonce-reuse
-    async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> {
-        let mut conn = pool.get().await?;
-
-        let nonce = conn
-            .exclusive_transaction(|conn| {
-                Box::pin(async move {
-                    let current_nonce: Vec<u8> = schema::root_key_history::table
-                        .filter(schema::root_key_history::id.eq(root_key_id))
-                        .select(schema::root_key_history::data_encryption_nonce)
-                        .first(conn)
-                        .await?;
-
-                    let mut nonce =
-                        v1::Nonce::try_from(current_nonce.as_slice()).map_err(|_| {
-                            error!(
-                                "Broken database: invalid nonce for root key history id={}",
-                                root_key_id
-                            );
-                            Error::BrokenDatabase
-                        })?;
-                    nonce.increment();
-
-                    update(schema::root_key_history::table)
-                        .filter(schema::root_key_history::id.eq(root_key_id))
-                        .set(schema::root_key_history::data_encryption_nonce.eq(nonce.to_vec()))
-                        .execute(conn)
-                        .await?;
-
-                    Result::<_, Error>::Ok(nonce)
-                })
-            })
-            .await?;
-
-        Ok(nonce)
-    }
-
-    #[message]
-    pub async fn bootstrap(&mut self, seal_key_raw: MemSafe<Vec<u8>>) -> Result<(), Error> {
-        if !matches!(self.state, State::Unbootstrapped) {
-            return Err(Error::AlreadyBootstrapped);
-        }
-        let salt = v1::generate_salt();
-        let mut seal_key = v1::derive_seal_key(seal_key_raw, &salt);
-        let mut root_key = KeyCell::new_secure_random();
-
-        // Zero nonces are fine because they are one-time
-        let root_key_nonce = v1::Nonce::default();
-        let data_encryption_nonce = v1::Nonce::default();
-
-        let root_key_ciphertext: Vec<u8> = {
-            let root_key_reader = root_key.0.read().unwrap();
-            let root_key_reader = root_key_reader.as_slice();
-            seal_key
-                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader)
-                .map_err(|err| {
-                    error!(?err, "Fatal bootstrap error");
-                    Error::Encryption(err)
-                })?
-        };
-
-        let mut conn = self.db.get().await?;
-
-        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
-        let root_key_history_id = conn
-            .transaction(|conn| {
-                Box::pin(async move {
-                    let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
-                        .values(&models::NewRootKeyHistory {
-                            ciphertext: root_key_ciphertext,
-                            tag: v1::ROOT_KEY_TAG.to_vec(),
-                            root_key_encryption_nonce: root_key_nonce.to_vec(),
-                            data_encryption_nonce: data_encryption_nonce_bytes,
-                            schema_version: 1,
-                            salt: salt.to_vec(),
-                        })
-                        .returning(schema::root_key_history::id)
-                        .get_result(conn)
-                        .await?;
-
-                    update(schema::arbiter_settings::table)
-                        .set(schema::arbiter_settings::root_key_id.eq(root_key_history_id))
-                        .execute(conn)
-                        .await?;
-
-                    Result::<_, diesel::result::Error>::Ok(root_key_history_id)
-                })
-            })
-            .await?;
-
-        self.state = State::Unsealed {
-            root_key,
-            root_key_history_id,
-        };
-
-        info!("Keyholder bootstrapped successfully");
-
-        Ok(())
-    }
-
-    #[message]
-    pub async fn try_unseal(&mut self, seal_key_raw: MemSafe<Vec<u8>>) -> Result<(), Error> {
-        let State::Sealed {
-            root_key_history_id,
-        } = &self.state
-        else {
-            return Err(Error::NotBootstrapped);
-        };
-
-        // We don't want to hold connection while doing expensive KDF work
-        let current_key = {
-            let mut conn = self.db.get().await?;
-            schema::root_key_history::table
-                .filter(schema::root_key_history::id.eq(*root_key_history_id))
-                .select(schema::root_key_history::data_encryption_nonce)
-                .select(RootKeyHistory::as_select())
-                .first(&mut conn)
-                .await?
-        };
-
-        let salt = &current_key.salt;
-        let salt = v1::Salt::try_from(salt.as_slice()).map_err(|_| {
-            error!("Broken database: invalid salt for root key");
-            Error::BrokenDatabase
-        })?;
-        let mut seal_key = v1::derive_seal_key(seal_key_raw, &salt);
-
-        let mut root_key = MemSafe::new(current_key.ciphertext.clone()).unwrap();
-
-        let nonce = v1::Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(
-            |_| {
-                error!("Broken database: invalid nonce for root key");
-                Error::BrokenDatabase
-            },
-        )?;
-
-        seal_key
-            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
-            .map_err(|err| {
-                error!(?err, "Failed to unseal root key: invalid seal key");
-                Error::InvalidKey
-            })?;
-
-        self.state = State::Unsealed {
-            root_key_history_id: current_key.id,
-            root_key: v1::KeyCell::try_from(root_key).map_err(|err| {
-                error!(?err, "Broken database: invalid encryption key size");
-                Error::BrokenDatabase
-            })?,
-        };
-
-        info!("Keyholder unsealed successfully");
-
-        Ok(())
-    }
-
-    // Decrypts the `aead_encrypted` entry with the given ID and returns the plaintext
-    #[message]
-    pub async fn decrypt(&mut self, aead_id: i32) -> Result<MemSafe<Vec<u8>>, Error> {
-        let State::Unsealed { root_key, .. } = &mut self.state else {
-            return Err(Error::NotBootstrapped);
-        };
-
-        let row: models::AeadEncrypted = {
-            let mut conn = self.db.get().await?;
-            schema::aead_encrypted::table
-                .select(models::AeadEncrypted::as_select())
-                .filter(schema::aead_encrypted::id.eq(aead_id))
-                .first(&mut conn)
-                .await
-                .optional()?
-                .ok_or(Error::NotFound)?
-        };
-
-        let nonce = v1::Nonce::try_from(row.current_nonce.as_slice()).map_err(|_| {
-            error!(
-                "Broken database: invalid nonce for aead_encrypted id={}",
-                aead_id
-            );
-            Error::BrokenDatabase
-        })?;
-        let mut output = MemSafe::new(row.ciphertext).unwrap();
-        root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?;
-        Ok(output)
-    }
-
-    // Creates new `aead_encrypted` entry in the database and returns it's ID
-    #[message]
-    pub async fn create_new(&mut self, mut plaintext: MemSafe<Vec<u8>>) -> Result<i32, Error> {
-        let State::Unsealed {
-            root_key,
-            root_key_history_id,
-        } = &mut self.state
-        else {
-            return Err(Error::NotBootstrapped);
-        };
-
-        // Order matters here - `get_new_nonce` acquires connection, so we need to call it before next acquire
-        // Borrow checker note: &mut borrow a few lines above is disjoint from this field
-        let nonce = Self::get_new_nonce(&self.db, *root_key_history_id).await?;
-
-        let mut ciphertext_buffer = plaintext.write().unwrap();
-        let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut();
-        root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?;
-
-        let ciphertext = std::mem::take(ciphertext_buffer);
-
-        let mut conn = self.db.get().await?;
-        let aead_id: i32 = insert_into(schema::aead_encrypted::table)
-            .values(&models::NewAeadEncrypted {
-                ciphertext,
-                tag: v1::TAG.to_vec(),
-                current_nonce: nonce.to_vec(),
-                schema_version: 1,
-                associated_root_key_id: *root_key_history_id,
-                created_at: chrono::Utc::now().timestamp() as i32,
-            })
-            .returning(schema::aead_encrypted::id)
-            .get_result(&mut conn)
-            .await?;
-
-        Ok(aead_id)
-    }
-
-    #[message]
-    pub fn get_state(&self) -> StateDiscriminants {
-        self.state.discriminant()
-    }
-
-    #[message]
-    pub fn seal(&mut self) -> Result<(), Error> {
-        let State::Unsealed {
-            root_key_history_id,
-            ..
-        } = &self.state
-        else {
-            return Err(Error::NotBootstrapped);
-        };
-        self.state = State::Sealed {
-            root_key_history_id: *root_key_history_id,
-        };
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use diesel::SelectableHelper;
-    
-    use diesel_async::RunQueryDsl;
-    use memsafe::MemSafe;
-
-    use crate::db::{self};
-
-    use super::*;
-
-    async fn bootstrapped_actor(db: &db::DatabasePool) -> KeyHolder {
-        let mut actor = KeyHolder::new(db.clone()).await.unwrap();
-        let seal_key = MemSafe::new(b"test-seal-key".to_vec()).unwrap();
-        actor.bootstrap(seal_key).await.unwrap();
-        actor
-    }
-
-    #[tokio::test]
-    #[test_log::test]
-    async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
-        let db = db::create_test_pool().await;
-        let mut actor = bootstrapped_actor(&db).await;
-        let root_key_history_id = match actor.state {
-            State::Unsealed {
-                root_key_history_id,
-                ..
-            } => root_key_history_id,
-            _ => panic!("expected unsealed state"),
-        };
-
-        let n1 = KeyHolder::get_new_nonce(&db, root_key_history_id)
-            .await
-            .unwrap();
-        let n2 = KeyHolder::get_new_nonce(&db, root_key_history_id)
-            .await
-            .unwrap();
-        assert!(n2.to_vec() > n1.to_vec(), "nonce must increase");
-
-        let mut conn = db.get().await.unwrap();
-        let root_row: models::RootKeyHistory = schema::root_key_history::table
-            .select(models::RootKeyHistory::as_select())
-            .first(&mut conn)
-            .await
-            .unwrap();
-        assert_eq!(root_row.data_encryption_nonce, n2.to_vec());
-
-        let id = actor
-            .create_new(MemSafe::new(b"post-interleave".to_vec()).unwrap())
-            .await
-            .unwrap();
-        let row: models::AeadEncrypted = schema::aead_encrypted::table
-            .filter(schema::aead_encrypted::id.eq(id))
-            .select(models::AeadEncrypted::as_select())
-            .first(&mut conn)
-            .await
-            .unwrap();
-        assert!(
-            row.current_nonce > n2.to_vec(),
-            "next write must advance nonce"
-        );
-    }
-}
--- a/server/crates/arbiter-server/src/actors/mod.rs
+++ b/server/crates/arbiter-server/src/actors/mod.rs
@@ -1,43 +0,0 @@
-use kameo::actor::{ActorRef, Spawn};
-use miette::Diagnostic;
-use thiserror::Error;
-
-use crate::{
-    actors::{bootstrap::Bootstrapper, keyholder::KeyHolder, router::MessageRouter},
-    db,
-};
-
-pub mod bootstrap;
-pub mod router;
-pub mod keyholder;
-pub mod user_agent;
-pub mod client;
-
-#[derive(Error, Debug, Diagnostic)]
-pub enum SpawnError {
-    #[error("Failed to spawn Bootstrapper actor")]
-    #[diagnostic(code(SpawnError::Bootstrapper))]
-    Bootstrapper(#[from] bootstrap::Error),
-
-    #[error("Failed to spawn KeyHolder actor")]
-    #[diagnostic(code(SpawnError::KeyHolder))]
-    KeyHolder(#[from] keyholder::Error),
-}
-
-/// Long-lived actors that are shared across all connections and handle global state and operations
-#[derive(Clone)]
-pub struct GlobalActors {
-    pub key_holder: ActorRef<KeyHolder>,
-    pub bootstrapper: ActorRef<Bootstrapper>,
-    pub router: ActorRef<MessageRouter>,
-}
-
-impl GlobalActors {
-    pub async fn spawn(db: db::DatabasePool) -> Result<Self, SpawnError> {
-        Ok(Self {
-            bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
-            key_holder: KeyHolder::spawn(KeyHolder::new(db.clone()).await?),
-            router: MessageRouter::spawn(MessageRouter::default()),
-        })
-    }
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
CleverWild	d65e9319d9	lints(clippy)	2026-03-11 14:05:03 +01:00
CleverWild	dfc852e815	feat(server): integrate X25519 unseal handler in UserAgentActor	2026-03-11 14:05:03 +01:00
CleverWild	5b711acb15	feat(server): add X25519 ECDH for secure unseal protocol	2026-03-11 14:05:03 +01:00
CleverWild	19f19a56e5	feat(server): implement KeyStorage and state machine lifecycle	2026-03-11 14:04:46 +01:00
CleverWild	f108e64d13	feat(tls): implement TLS certificate management and rotation	2026-03-11 14:04:46 +01:00
				`@@ -1 +0,0 @@`
				`{"version":2,"entries":[{"package":"app","rootUri":"../","packageUri":"lib/"}]}`