housekepping: add fixme for start_bootstrap's operator_id

Adds DeclareCommittee and ContributePassphrase variants to bootstrap.proto,
ContributePassphrase to unseal.proto, and AwaitingContributions result codes
to both. Implements corresponding inbound converters and outbound reply
mappings. VaultGate handlers delegate to VaultCoordinator.

AGENTS.md

@@ -1,16 +1,13 @@
 # AGENTS.md
 
-Guidance for coding agents (Claude Code, Codex, …) working in this repository.
+This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
 
 ## Project Overview
 
-Arbiter is a **permissioned signing service** for cryptocurrency wallets:
-
+Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
 - **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
-- **`useragent/`** — Flutter app (desktop + mobile + web targets) with a Rust core via `flutter_rust_bridge`
-- **`protobufs/`** — Protocol Buffer definitions shared between server and clients
-- **`docs/`** — `ARCHITECTURE.md` (peer types, flows, threat model) and `IMPLEMENTATION.md`; treat them as the design source of truth and update them when behaviour changes
-- **`scripts/`** — helper scripts, e.g. `gen_erc20_registry.py`
+- **`operator/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
+- **`protobufs/`** — Protocol Buffer definitions shared between server and client
 
 The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
 
@@ -21,7 +18,7 @@ Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
 mise install
 ```
 
-Key versions live in `mise.toml` (currently Rust 1.95.0 with clippy, Flutter 3.41.7-stable, protoc 29.6, diesel_cli 2.3.7 with `sqlite-bundled`, Python 3.14). Also provided there: `cargo-nextest`, `cargo-audit`, `cargo-vet`, `cargo-shear`, `cargo-mutants`, `cargo-features-manager`, `cargo-edit`, `ast-grep`, `flutter_rust_bridge_codegen`.
+Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
 
 ## Server (Rust workspace at `server/`)
 
@@ -29,14 +26,10 @@ Key versions live in `mise.toml` (currently Rust 1.95.0 with clippy, Flutter 3.4
 
 | Crate | Purpose |
 |---|---|
-| `arbiter-proto` | Generated gRPC stubs + protobuf types (`tonic-prost-build`); also `ArbiterUrl`, `home_path()`, `BOOTSTRAP_PATH` |
-| `arbiter-crypto` | Shared crypto primitives: `authn` (ML-DSA), `safecell` (hardened memory), `hashing::Hashable`, re-exported `x-wing` |
-| `arbiter-macros` | `#[derive(Hashable)]` — canonical hashing of structs for the DB integrity layer |
-| `arbiter-server` | Main daemon — actors, peers, DB, EVM policy engine, gRPC service implementation |
-| `arbiter-client` | Rust client library for SDK clients (`ArbiterClient`, EVM wallet, key storage) |
-| `arbiter-tokens-registry` | Generated ERC-20 token registry used by token-transfer policies |
-
-Workspace lints (`server/Cargo.toml`) are strict: most of clippy `pedantic`/`nursery` plus a large restriction set. `as` casts, indexing/slicing, `dbg!`, float arithmetic and undocumented `unsafe` are denied or warned — expect to add an `#[expect(..., reason = "...")]` rather than to silence a lint globally.
+| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
+| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
+| `arbiter-operator` | Rust client library for the operator side of the gRPC protocol |
+| `arbiter-client` | Rust client library for SDK clients |
 
 ### Common Commands
 
@@ -49,78 +42,54 @@ cargo build
 # Run the server daemon
 cargo run -p arbiter-server
 
-# Run all tests (preferred over cargo test; CI uses --all-features)
+# Run all tests (preferred over cargo test)
 cargo nextest run
 
 # Run a single test
 cargo nextest run <test_name>
 
-# Lint (CI runs it with -D warnings)
-cargo clippy --all -- -D warnings
+# Lint
+cargo clippy
 
 # Security audit
 cargo audit
 
-# Supply-chain review (config in server/supply-chain/)
-cargo vet
-
 # Check unused dependencies
 cargo shear
 
-# Mutation testing
-cargo mutants
+# Run snapshot tests and update snapshots
+cargo insta review
 ```
 
-### CI
-
-Woodpecker pipelines in `.woodpecker/` run on `server/**` changes: `server-lint` (clippy), `server-test` (nextest, `--all-features`), `server-audit`, `server-vet`, plus `useragent-analyze` for the Flutter app.
-
 ### Architecture
 
-The server is actor-based using the **kameo** crate. Long-lived state lives in `GlobalActors` (`src/actors/mod.rs`):
+The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
 
-- **`Bootstrapper`** — one-time bootstrap token, written to `~/.arbiter/bootstrap_token` on first run
-- **`Vault`** — encrypted root key and the Sealed/Unsealed state machine; on unseal decrypts the root key into a `memsafe`-backed `SafeCell`
-- **`FlowCoordinator`** — cross-connection flow between operators and SDK clients
-- **`OperatorRegistry`** — tracks currently connected operators
-- **`EvmActor`** — EVM transaction policy enforcement and signing
-- **`events`** — a `kameo_actors::MessageBus` (`DeliveryStrategy::Guaranteed`) for cross-actor notifications
+- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
+- **`Vault`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
+- **`FlowCoordinator`** — Coordinates cross-connection flow between operators and SDK clients.
+- **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
 
-Per-connection state lives under **`src/peers/`**, not `actors/`: `peers/client/` and `peers/operator/`, each with `auth` (challenge-response) and `session` (post-auth) sub-modules; the operator side additionally has `vault_gate/` for the unseal handshake.
+Per-connection actors live under `actors/operator/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
 
-The gRPC surface lives in **`src/grpc/`**, split per peer (`client/`, `operator/`, `common/`) and per direction (`inbound.rs` — requests to the daemon, `outbound.rs` — server-initiated streams), with `request_tracker.rs` correlating the two.
-
-EVM logic is in `src/evm/`: `policies/ether_transfer/`, `policies/token_transfers/`, `abi.rs`, `safe_signer.rs`.
-
-**Database:** SQLite via `diesel-async` + `bb8`. Schema in `src/db/schema.rs`, models in `src/db/models.rs`, embedded migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`; tests use a temp-file DB via `db::create_test_pool()`.
-
-Entity ids are newtypes generated by the `declare_id!` macro in `db::models` (`OperatorId`, `ChainId`, …), each a `#[repr(transparent)]` wrapper over `i32` with `to_raw`/`from_raw`. Pass these around instead of bare `i32`.
-
-**Row integrity:** sensitive rows are covered by an HMAC-SHA256 envelope (`src/crypto/integrity/`, table `integrity_envelope`), keyed from the vault root key. A struct becomes coverable by deriving `arbiter_macros::Hashable` and implementing `Integrable` (`KIND` + `VERSION`). When adding or changing a covered entity, keep the derive and the payload version in sync — a mismatch surfaces as `PayloadVersionMismatch` or `MacMismatch` at runtime.
+**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
 
 **Cryptography:**
-- Authentication: **ML-DSA-87** (post-quantum, `arbiter-crypto::authn::v1`), challenge-response with per-peer nonce tracking
-- Encryption at rest: XChaCha20-Poly1305, versioned modules (`crypto/encryption/v1.rs`) with a `schema_version` column for transparent migration on unseal
+- Authentication: ed25519 (challenge-response, nonce-tracked per peer)
+- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
 - Password KDF: Argon2
-- Unseal transport: X25519 ephemeral key exchange (`peers/operator/vault_gate/`); `x-wing` (hybrid PQ KEM) is available via `arbiter-crypto`
-- TLS: self-signed certificate (rustls + aws-lc-rs, `prefer-post-quantum`), fingerprint distributed via `ArbiterUrl`
+- Unseal transport: X25519 ephemeral key exchange
+- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
 
-Crypto modules are versioned by convention: `mod.rs` re-exports the current `vN`. Add a `v(N+1)` rather than editing an existing version in place.
-
-**Protocol:** gRPC with Protocol Buffers. `ArbiterUrl` encodes host, port, CA cert and bootstrap token into a single shareable string (printed to console on first run).
+**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
 
 ### Proto Regeneration
 
-`arbiter-proto/build.rs` compiles `arbiter.proto`, `operator.proto`, `client.proto` and `evm.proto` (with their `shared/`, `operator/`, `client/` includes) on build:
+When `.proto` files in `protobufs/` change, rebuild to regenerate:
 ```sh
 cd server && cargo build -p arbiter-proto
 ```
 
-Dart protobuf stubs are generated separately, from the repo root:
-```sh
-mise run codegen   # protoc --dart_out=grpc:useragent/lib/proto
-```
-
 ### Database Migrations
 
 ```sh
@@ -131,8 +100,6 @@ diesel migration generate <name> --migration-dir crates/arbiter-server/migration
 diesel migration run --migration-dir crates/arbiter-server/migrations
 ```
 
-Pre-release policy: there is a single `init` migration and no deployed databases yet, so schema changes are made by editing that migration directly instead of stacking new ones. Regenerate `src/db/schema.rs` after changing it.
-
 ### Code Conventions
 
 **`#[must_use]` Attribute:**
@@ -154,23 +121,29 @@ pub fn verify(&self, nonce: i32, context: &[u8], signature: &Signature) -> bool
 
 This forces callers to either use the return value or explicitly ignore it with `let _ = ...;`, preventing silent failures.
 
-## User Agent (Flutter + flutter_rust_bridge at `useragent/`)
+## Operator (Flutter + Rinf at `operator/`)
 
-The Flutter app calls Rust through [flutter_rust_bridge](https://cjycode.com/flutter_rust_bridge/) 2.12.0. The Rust side is the `rust_lib_arbiter` crate at `useragent/rust/`; everything exposed to Dart is declared in `useragent/rust/src/api/` and lands in `useragent/lib/src/rust/` (see `useragent/flutter_rust_bridge.yaml`). Dart UI code is organised as `lib/features/`, `lib/screens/`, `lib/widgets/`, `lib/providers/`, `lib/theme/`, with routing in `lib/router.dart` (`router.gr.dart` is generated).
+The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `operator/native/hub/` as a separate crate that uses `arbiter-operator` for the gRPC client.
+
+Communication between Dart and Rust uses typed **signals** defined in `operator/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
+
+```sh
+cd operator && rinf gen
+```
 
 ### Common Commands
 
 ```sh
-cd useragent
+cd operator
 
-# Run the app
+# Run the app (macOS or Windows)
 flutter run
 
-# Regenerate Rust↔Dart bindings after editing rust/src/api/
-mise run codegen        # flutter_rust_bridge_codegen generate
+# Regenerate Rust↔Dart signal bindings
+rinf gen
 
-# Analyze Dart code (also run in CI)
+# Analyze Dart code
 flutter analyze
 ```
 
-Note: `app/` contains only stale generated Flutter artifacts and is not the application source.
+The Rinf Rust entry point is `operator/native/hub/src/lib.rs`. It spawns actors defined in `operator/native/hub/src/actors/` which handle Dart↔server communication via signals.

app/.dart_tool/extension_discovery/README.md

@@ -0,0 +1,31 @@
+Extension Discovery Cache
+=========================
+
+This folder is used by `package:extension_discovery` to cache lists of
+packages that contains extensions for other packages.
+
+DO NOT USE THIS FOLDER
+----------------------
+
+ * Do not read (or rely) the contents of this folder.
+ * Do write to this folder.
+
+If you're interested in the lists of extensions stored in this folder use the
+API offered by package `extension_discovery` to get this information.
+
+If this package doesn't work for your use-case, then don't try to read the
+contents of this folder. It may change, and will not remain stable.
+
+Use package `extension_discovery`
+---------------------------------
+
+If you want to access information from this folder.
+
+Feel free to delete this folder
+-------------------------------
+
+Files in this folder act as a cache, and the cache is discarded if the files
+are older than the modification time of `.dart_tool/package_config.json`.
+
+Hence, it should never be necessary to clear this cache manually, if you find a
+need to do please file a bug.

app/.dart_tool/extension_discovery/vs_code.json

@@ -0,0 +1 @@
+{"version":2,"entries":[{"package":"app","rootUri":"../","packageUri":"lib/"}]}

app/.dart_tool/package_config.json

@@ -0,0 +1,178 @@
+{
+  "configVersion": 2,
+  "packages": [
+    {
+      "name": "async",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "boolean_selector",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "characters",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "clock",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "collection",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "cupertino_icons",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/cupertino_icons-1.0.8",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "fake_async",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3",
+      "packageUri": "lib/",
+      "languageVersion": "3.3"
+    },
+    {
+      "name": "flutter",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "flutter_lints",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "flutter_test",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "leak_tracker",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "leak_tracker_flutter_testing",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "leak_tracker_testing",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "lints",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "matcher",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "material_color_utilities",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1",
+      "packageUri": "lib/",
+      "languageVersion": "2.17"
+    },
+    {
+      "name": "meta",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "path",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "sky_engine",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "source_span",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "stack_trace",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "stream_channel",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4",
+      "packageUri": "lib/",
+      "languageVersion": "3.3"
+    },
+    {
+      "name": "string_scanner",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "term_glyph",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "test_api",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "vector_math",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "vm_service",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "app",
+      "rootUri": "../",
+      "packageUri": "lib/",
+      "languageVersion": "3.10"
+    }
+  ],
+  "generator": "pub",
+  "generatorVersion": "3.10.8",
+  "flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable",
+  "flutterVersion": "3.38.9",
+  "pubCache": "file:///Users/kaska/.pub-cache"
+}

app/.dart_tool/package_graph.json

@@ -0,0 +1,230 @@
+{
+  "roots": [
+    "app"
+  ],
+  "packages": [
+    {
+      "name": "app",
+      "version": "1.0.0+1",
+      "dependencies": [
+        "cupertino_icons",
+        "flutter"
+      ],
+      "devDependencies": [
+        "flutter_lints",
+        "flutter_test"
+      ]
+    },
+    {
+      "name": "flutter_lints",
+      "version": "6.0.0",
+      "dependencies": [
+        "lints"
+      ]
+    },
+    {
+      "name": "flutter_test",
+      "version": "0.0.0",
+      "dependencies": [
+        "clock",
+        "collection",
+        "fake_async",
+        "flutter",
+        "leak_tracker_flutter_testing",
+        "matcher",
+        "meta",
+        "path",
+        "stack_trace",
+        "stream_channel",
+        "test_api",
+        "vector_math"
+      ]
+    },
+    {
+      "name": "cupertino_icons",
+      "version": "1.0.8",
+      "dependencies": []
+    },
+    {
+      "name": "flutter",
+      "version": "0.0.0",
+      "dependencies": [
+        "characters",
+        "collection",
+        "material_color_utilities",
+        "meta",
+        "sky_engine",
+        "vector_math"
+      ]
+    },
+    {
+      "name": "lints",
+      "version": "6.1.0",
+      "dependencies": []
+    },
+    {
+      "name": "stream_channel",
+      "version": "2.1.4",
+      "dependencies": [
+        "async"
+      ]
+    },
+    {
+      "name": "meta",
+      "version": "1.17.0",
+      "dependencies": []
+    },
+    {
+      "name": "collection",
+      "version": "1.19.1",
+      "dependencies": []
+    },
+    {
+      "name": "leak_tracker_flutter_testing",
+      "version": "3.0.10",
+      "dependencies": [
+        "flutter",
+        "leak_tracker",
+        "leak_tracker_testing",
+        "matcher",
+        "meta"
+      ]
+    },
+    {
+      "name": "vector_math",
+      "version": "2.2.0",
+      "dependencies": []
+    },
+    {
+      "name": "stack_trace",
+      "version": "1.12.1",
+      "dependencies": [
+        "path"
+      ]
+    },
+    {
+      "name": "clock",
+      "version": "1.1.2",
+      "dependencies": []
+    },
+    {
+      "name": "fake_async",
+      "version": "1.3.3",
+      "dependencies": [
+        "clock",
+        "collection"
+      ]
+    },
+    {
+      "name": "path",
+      "version": "1.9.1",
+      "dependencies": []
+    },
+    {
+      "name": "matcher",
+      "version": "0.12.17",
+      "dependencies": [
+        "async",
+        "meta",
+        "stack_trace",
+        "term_glyph",
+        "test_api"
+      ]
+    },
+    {
+      "name": "test_api",
+      "version": "0.7.7",
+      "dependencies": [
+        "async",
+        "boolean_selector",
+        "collection",
+        "meta",
+        "source_span",
+        "stack_trace",
+        "stream_channel",
+        "string_scanner",
+        "term_glyph"
+      ]
+    },
+    {
+      "name": "sky_engine",
+      "version": "0.0.0",
+      "dependencies": []
+    },
+    {
+      "name": "material_color_utilities",
+      "version": "0.11.1",
+      "dependencies": [
+        "collection"
+      ]
+    },
+    {
+      "name": "characters",
+      "version": "1.4.0",
+      "dependencies": []
+    },
+    {
+      "name": "async",
+      "version": "2.13.0",
+      "dependencies": [
+        "collection",
+        "meta"
+      ]
+    },
+    {
+      "name": "leak_tracker_testing",
+      "version": "3.0.2",
+      "dependencies": [
+        "leak_tracker",
+        "matcher",
+        "meta"
+      ]
+    },
+    {
+      "name": "leak_tracker",
+      "version": "11.0.2",
+      "dependencies": [
+        "clock",
+        "collection",
+        "meta",
+        "path",
+        "vm_service"
+      ]
+    },
+    {
+      "name": "term_glyph",
+      "version": "1.2.2",
+      "dependencies": []
+    },
+    {
+      "name": "string_scanner",
+      "version": "1.4.1",
+      "dependencies": [
+        "source_span"
+      ]
+    },
+    {
+      "name": "source_span",
+      "version": "1.10.2",
+      "dependencies": [
+        "collection",
+        "path",
+        "term_glyph"
+      ]
+    },
+    {
+      "name": "boolean_selector",
+      "version": "2.1.2",
+      "dependencies": [
+        "source_span",
+        "string_scanner"
+      ]
+    },
+    {
+      "name": "vm_service",
+      "version": "15.0.2",
+      "dependencies": []
+    }
+  ],
+  "configVersion": 1
+}

app/.dart_tool/version

@@ -0,0 +1 @@
+3.38.9

docs/superpowers/plans/2026-03-28-grant-grid-view.md

@@ -0,0 +1,821 @@
+# Grant Grid View Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add an "EVM Grants" dashboard tab that displays all grants as enriched cards (type, chain, wallet address, client name) with per-card revoke support.
+
+**Architecture:** A new `walletAccessListProvider` fetches wallet accesses with their DB row IDs. The screen (`grants.dart`) watches only `evmGrantsProvider` for top-level state. Each `GrantCard` widget (its own file) watches enrichment providers (`walletAccessListProvider`, `evmProvider`, `sdkClientsProvider`) and the revoke mutation directly — keeping rebuilds scoped to the card. The screen is registered as a dashboard tab in `AdaptiveScaffold`.
+
+**Tech Stack:** Flutter, Riverpod (`riverpod_annotation` + `build_runner` codegen), `sizer` (adaptive sizing), `auto_route`, Protocol Buffers (Dart), `Palette` design tokens.
+
+---
+
+## File Map
+
+| File | Action | Responsibility |
+|---|---|---|
+| `operator/lib/theme/palette.dart` | Modify | Add `Palette.token` (indigo accent for token-transfer cards) |
+| `operator/lib/features/connection/evm/wallet_access.dart` | Modify | Add `listAllWalletAccesses()` function |
+| `operator/lib/providers/sdk_clients/wallet_access_list.dart` | Create | `WalletAccessListProvider` — fetches full wallet access list with IDs |
+| `operator/lib/screens/dashboard/evm/grants/widgets/grant_card.dart` | Create | `GrantCard` widget — watches enrichment providers + revoke mutation; one card per grant |
+| `operator/lib/screens/dashboard/evm/grants/grants.dart` | Create | `EvmGrantsScreen` — watches `evmGrantsProvider`; handles loading/error/empty/data states; renders `GrantCard` list |
+| `operator/lib/router.dart` | Modify | Register `EvmGrantsRoute` in dashboard children |
+| `operator/lib/screens/dashboard.dart` | Modify | Add Grants entry to `routes` list and `NavigationDestination` list |
+
+---
+
+## Task 1: Add `Palette.token`
+
+**Files:**
+- Modify: `operator/lib/theme/palette.dart`
+
+- [ ] **Step 1: Add the color**
+
+Replace the contents of `operator/lib/theme/palette.dart` with:
+
+```dart
+import 'package:flutter/material.dart';
+
+class Palette {
+  static const ink = Color(0xFF15263C);
+  static const coral = Color(0xFFE26254);
+  static const cream = Color(0xFFFFFAF4);
+  static const line = Color(0x1A15263C);
+  static const token = Color(0xFF5C6BC0);
+}
+```
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd operator && flutter analyze lib/theme/palette.dart
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(theme): add Palette.token for token-transfer grant cards"
+jj new
+```
+
+---
+
+## Task 2: Add `listAllWalletAccesses` feature function
+
+**Files:**
+- Modify: `operator/lib/features/connection/evm/wallet_access.dart`
+
+`readClientWalletAccess` (existing) filters the list to one client's wallet IDs and returns `Set<int>`. This new function returns the complete unfiltered list with row IDs so the grant cards can resolve wallet_access_id → wallet + client.
+
+- [ ] **Step 1: Append function**
+
+Add at the bottom of `operator/lib/features/connection/evm/wallet_access.dart`:
+
+```dart
+Future<List<SdkClientWalletAccess>> listAllWalletAccesses(
+  Connection connection,
+) async {
+  final response = await connection.ask(
+    OperatorRequest(listWalletAccess: Empty()),
+  );
+  if (!response.hasListWalletAccessResponse()) {
+    throw Exception(
+      'Expected list wallet access response, got ${response.whichPayload()}',
+    );
+  }
+  return response.listWalletAccessResponse.accesses.toList(growable: false);
+}
+```
+
+Each returned `SdkClientWalletAccess` has:
+- `.id` — the `evm_wallet_access` row ID (same value as `wallet_access_id` in a `GrantEntry`)
+- `.access.walletId` — the EVM wallet DB ID
+- `.access.sdkClientId` — the SDK client DB ID
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd operator && flutter analyze lib/features/connection/evm/wallet_access.dart
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(evm): add listAllWalletAccesses feature function"
+jj new
+```
+
+---
+
+## Task 3: Create `WalletAccessListProvider`
+
+**Files:**
+- Create: `operator/lib/providers/sdk_clients/wallet_access_list.dart`
+- Generated: `operator/lib/providers/sdk_clients/wallet_access_list.g.dart`
+
+Mirrors the structure of `EvmGrants` in `providers/evm/evm_grants.dart` — class-based `@riverpod` with a `refresh()` method.
+
+- [ ] **Step 1: Write the provider**
+
+Create `operator/lib/providers/sdk_clients/wallet_access_list.dart`:
+
+```dart
+import 'package:arbiter/features/connection/evm/wallet_access.dart';
+import 'package:arbiter/proto/operator.pb.dart';
+import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:mtcore/markettakers.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'wallet_access_list.g.dart';
+
+@riverpod
+class WalletAccessList extends _$WalletAccessList {
+  @override
+  Future<List<SdkClientWalletAccess>?> build() async {
+    final connection = await ref.watch(connectionManagerProvider.future);
+    if (connection == null) {
+      return null;
+    }
+
+    try {
+      return await listAllWalletAccesses(connection);
+    } catch (e, st) {
+      talker.handle(e, st);
+      rethrow;
+    }
+  }
+
+  Future<void> refresh() async {
+    final connection = await ref.read(connectionManagerProvider.future);
+    if (connection == null) {
+      state = const AsyncData(null);
+      return;
+    }
+
+    state = const AsyncLoading();
+    state = await AsyncValue.guard(() => listAllWalletAccesses(connection));
+  }
+}
+```
+
+- [ ] **Step 2: Run code generation**
+
+```sh
+cd operator && dart run build_runner build --delete-conflicting-outputs
+```
+
+Expected: `operator/lib/providers/sdk_clients/wallet_access_list.g.dart` created. No errors.
+
+- [ ] **Step 3: Verify**
+
+```sh
+cd operator && flutter analyze lib/providers/sdk_clients/
+```
+
+Expected: no issues.
+
+- [ ] **Step 4: Commit**
+
+```sh
+jj describe -m "feat(providers): add WalletAccessListProvider"
+jj new
+```
+
+---
+
+## Task 4: Create `GrantCard` widget
+
+**Files:**
+- Create: `operator/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`
+
+This widget owns all per-card logic: enrichment lookups, revoke action, and rebuild scope. The screen only passes it a `GrantEntry` — the card fetches everything else itself.
+
+**Key types:**
+- `GrantEntry` (from `proto/evm.pb.dart`): `.id`, `.shared.walletAccessId`, `.shared.chainId`, `.specific.whichGrant()`
+- `SpecificGrant_Grant.etherTransfer` / `.tokenTransfer` — enum values for the oneof
+- `SdkClientWalletAccess` (from `proto/operator.pb.dart`): `.id`, `.access.walletId`, `.access.sdkClientId`
+- `WalletEntry` (from `proto/evm.pb.dart`): `.id`, `.address` (List<int>)
+- `SdkClientEntry` (from `proto/operator.pb.dart`): `.id`, `.info.name`
+- `revokeEvmGrantMutation` — `Mutation<void>` (global; all revoke buttons disable together while any revoke is in flight)
+- `executeRevokeEvmGrant(ref, grantId: int)` — `Future<void>`
+
+- [ ] **Step 1: Write the widget**
+
+Create `operator/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`:
+
+```dart
+import 'package:arbiter/proto/evm.pb.dart';
+import 'package:arbiter/proto/operator.pb.dart';
+import 'package:arbiter/providers/evm/evm.dart';
+import 'package:arbiter/providers/evm/evm_grants.dart';
+import 'package:arbiter/providers/sdk_clients/list.dart';
+import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:sizer/sizer.dart';
+
+String _shortAddress(List<int> bytes) {
+  final hex = bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();
+  return '0x${hex.substring(0, 6)}...${hex.substring(hex.length - 4)}';
+}
+
+String _formatError(Object error) {
+  final message = error.toString();
+  if (message.startsWith('Exception: ')) {
+    return message.substring('Exception: '.length);
+  }
+  return message;
+}
+
+class GrantCard extends ConsumerWidget {
+  const GrantCard({super.key, required this.grant});
+
+  final GrantEntry grant;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    // Enrichment lookups — each watch scopes rebuilds to this card only
+    final walletAccesses =
+        ref.watch(walletAccessListProvider).asData?.value ?? const [];
+    final wallets = ref.watch(evmProvider).asData?.value ?? const [];
+    final clients = ref.watch(sdkClientsProvider).asData?.value ?? const [];
+    final revoking = ref.watch(revokeEvmGrantMutation) is MutationPending;
+
+    final isEther =
+        grant.specific.whichGrant() == SpecificGrant_Grant.etherTransfer;
+    final accent = isEther ? Palette.coral : Palette.token;
+    final typeLabel = isEther ? 'Ether' : 'Token';
+    final theme = Theme.of(context);
+    final muted = Palette.ink.withValues(alpha: 0.62);
+
+    // Resolve wallet_access_id → wallet address + client name
+    final accessById = <int, SdkClientWalletAccess>{
+      for (final a in walletAccesses) a.id: a,
+    };
+    final walletById = <int, WalletEntry>{
+      for (final w in wallets) w.id: w,
+    };
+    final clientNameById = <int, String>{
+      for (final c in clients) c.id: c.info.name,
+    };
+
+    final accessId = grant.shared.walletAccessId;
+    final access = accessById[accessId];
+    final wallet = access != null ? walletById[access.access.walletId] : null;
+
+    final walletLabel = wallet != null
+        ? _shortAddress(wallet.address)
+        : 'Access #$accessId';
+
+    final clientLabel = () {
+      if (access == null) return '';
+      final name = clientNameById[access.access.sdkClientId] ?? '';
+      return name.isEmpty ? 'Client #${access.access.sdkClientId}' : name;
+    }();
+
+    void showError(String message) {
+      if (!context.mounted) return;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
+      );
+    }
+
+    Future<void> revoke() async {
+      try {
+        await executeRevokeEvmGrant(ref, grantId: grant.id);
+      } catch (e) {
+        showError(_formatError(e));
+      }
+    }
+
+    return Container(
+      decoration: BoxDecoration(
+        borderRadius: BorderRadius.circular(24),
+        color: Palette.cream.withValues(alpha: 0.92),
+        border: Border.all(color: Palette.line),
+      ),
+      child: IntrinsicHeight(
+        child: Row(
+          crossAxisAlignment: CrossAxisAlignment.stretch,
+          children: [
+            // Accent strip
+            Container(
+              width: 0.8.w,
+              decoration: BoxDecoration(
+                color: accent,
+                borderRadius: const BorderRadius.horizontal(
+                  left: Radius.circular(24),
+                ),
+              ),
+            ),
+            // Card body
+            Expanded(
+              child: Padding(
+                padding: EdgeInsets.symmetric(
+                  horizontal: 1.6.w,
+                  vertical: 1.4.h,
+                ),
+                child: Column(
+                  crossAxisAlignment: CrossAxisAlignment.start,
+                  children: [
+                    // Row 1: type badge · chain · spacer · revoke button
+                    Row(
+                      children: [
+                        Container(
+                          padding: EdgeInsets.symmetric(
+                            horizontal: 1.w,
+                            vertical: 0.4.h,
+                          ),
+                          decoration: BoxDecoration(
+                            color: accent.withValues(alpha: 0.15),
+                            borderRadius: BorderRadius.circular(8),
+                          ),
+                          child: Text(
+                            typeLabel,
+                            style: theme.textTheme.labelSmall?.copyWith(
+                              color: accent,
+                              fontWeight: FontWeight.w800,
+                            ),
+                          ),
+                        ),
+                        SizedBox(width: 1.w),
+                        Container(
+                          padding: EdgeInsets.symmetric(
+                            horizontal: 1.w,
+                            vertical: 0.4.h,
+                          ),
+                          decoration: BoxDecoration(
+                            color: Palette.ink.withValues(alpha: 0.06),
+                            borderRadius: BorderRadius.circular(8),
+                          ),
+                          child: Text(
+                            'Chain ${grant.shared.chainId}',
+                            style: theme.textTheme.labelSmall?.copyWith(
+                              color: muted,
+                              fontWeight: FontWeight.w700,
+                            ),
+                          ),
+                        ),
+                        const Spacer(),
+                        if (revoking)
+                          SizedBox(
+                            width: 1.8.h,
+                            height: 1.8.h,
+                            child: CircularProgressIndicator(
+                              strokeWidth: 2,
+                              color: Palette.coral,
+                            ),
+                          )
+                        else
+                          OutlinedButton.icon(
+                            onPressed: revoke,
+                            style: OutlinedButton.styleFrom(
+                              foregroundColor: Palette.coral,
+                              side: BorderSide(
+                                color: Palette.coral.withValues(alpha: 0.4),
+                              ),
+                              padding: EdgeInsets.symmetric(
+                                horizontal: 1.w,
+                                vertical: 0.6.h,
+                              ),
+                              shape: RoundedRectangleBorder(
+                                borderRadius: BorderRadius.circular(10),
+                              ),
+                            ),
+                            icon: const Icon(Icons.block_rounded, size: 16),
+                            label: const Text('Revoke'),
+                          ),
+                      ],
+                    ),
+                    SizedBox(height: 0.8.h),
+                    // Row 2: wallet address · client name
+                    Row(
+                      children: [
+                        Text(
+                          walletLabel,
+                          style: theme.textTheme.bodySmall?.copyWith(
+                            color: Palette.ink,
+                            fontFamily: 'monospace',
+                          ),
+                        ),
+                        Padding(
+                          padding: EdgeInsets.symmetric(horizontal: 0.8.w),
+                          child: Text(
+                            '·',
+                            style: theme.textTheme.bodySmall
+                                ?.copyWith(color: muted),
+                          ),
+                        ),
+                        Expanded(
+                          child: Text(
+                            clientLabel,
+                            maxLines: 1,
+                            overflow: TextOverflow.ellipsis,
+                            style: theme.textTheme.bodySmall
+                                ?.copyWith(color: muted),
+                          ),
+                        ),
+                      ],
+                    ),
+                  ],
+                ),
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
+```
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd operator && flutter analyze lib/screens/dashboard/evm/grants/widgets/grant_card.dart
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(grants): add GrantCard widget with self-contained enrichment"
+jj new
+```
+
+---
+
+## Task 5: Create `EvmGrantsScreen`
+
+**Files:**
+- Create: `operator/lib/screens/dashboard/evm/grants/grants.dart`
+
+The screen watches only `evmGrantsProvider` for top-level state (loading / error / no connection / empty / data). When there is data it renders a list of `GrantCard` widgets — each card manages its own enrichment subscriptions.
+
+- [ ] **Step 1: Write the screen**
+
+Create `operator/lib/screens/dashboard/evm/grants/grants.dart`:
+
+```dart
+import 'package:arbiter/proto/evm.pb.dart';
+import 'package:arbiter/providers/evm/evm_grants.dart';
+import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
+import 'package:arbiter/router.gr.dart';
+import 'package:arbiter/screens/dashboard/evm/grants/widgets/grant_card.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:arbiter/widgets/page_header.dart';
+import 'package:auto_route/auto_route.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:sizer/sizer.dart';
+
+String _formatError(Object error) {
+  final message = error.toString();
+  if (message.startsWith('Exception: ')) {
+    return message.substring('Exception: '.length);
+  }
+  return message;
+}
+
+// ─── State panel ──────────────────────────────────────────────────────────────
+
+class _StatePanel extends StatelessWidget {
+  const _StatePanel({
+    required this.icon,
+    required this.title,
+    required this.body,
+    this.actionLabel,
+    this.onAction,
+    this.busy = false,
+  });
+
+  final IconData icon;
+  final String title;
+  final String body;
+  final String? actionLabel;
+  final Future<void> Function()? onAction;
+  final bool busy;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+
+    return Container(
+      decoration: BoxDecoration(
+        borderRadius: BorderRadius.circular(24),
+        color: Palette.cream.withValues(alpha: 0.92),
+        border: Border.all(color: Palette.line),
+      ),
+      child: Padding(
+        padding: EdgeInsets.all(2.8.h),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            if (busy)
+              SizedBox(
+                width: 2.8.h,
+                height: 2.8.h,
+                child: const CircularProgressIndicator(strokeWidth: 2.5),
+              )
+            else
+              Icon(icon, size: 34, color: Palette.coral),
+            SizedBox(height: 1.8.h),
+            Text(
+              title,
+              style: theme.textTheme.headlineSmall?.copyWith(
+                color: Palette.ink,
+                fontWeight: FontWeight.w800,
+              ),
+            ),
+            SizedBox(height: 1.h),
+            Text(
+              body,
+              style: theme.textTheme.bodyLarge?.copyWith(
+                color: Palette.ink.withValues(alpha: 0.72),
+                height: 1.5,
+              ),
+            ),
+            if (actionLabel != null && onAction != null) ...[
+              SizedBox(height: 2.h),
+              OutlinedButton.icon(
+                onPressed: () => onAction!(),
+                icon: const Icon(Icons.refresh),
+                label: Text(actionLabel!),
+              ),
+            ],
+          ],
+        ),
+      ),
+    );
+  }
+}
+
+// ─── Grant list ───────────────────────────────────────────────────────────────
+
+class _GrantList extends StatelessWidget {
+  const _GrantList({required this.grants});
+
+  final List<GrantEntry> grants;
+
+  @override
+  Widget build(BuildContext context) {
+    return Column(
+      children: [
+        for (var i = 0; i < grants.length; i++)
+          Padding(
+            padding: EdgeInsets.only(
+              bottom: i == grants.length - 1 ? 0 : 1.8.h,
+            ),
+            child: GrantCard(grant: grants[i]),
+          ),
+      ],
+    );
+  }
+}
+
+// ─── Screen ───────────────────────────────────────────────────────────────────
+
+@RoutePage()
+class EvmGrantsScreen extends ConsumerWidget {
+  const EvmGrantsScreen({super.key});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    // Screen watches only the grant list for top-level state decisions
+    final grantsAsync = ref.watch(evmGrantsProvider);
+
+    Future<void> refresh() async {
+      await Future.wait([
+        ref.read(evmGrantsProvider.notifier).refresh(),
+        ref.read(walletAccessListProvider.notifier).refresh(),
+      ]);
+    }
+
+    void showMessage(String message) {
+      if (!context.mounted) return;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
+      );
+    }
+
+    Future<void> safeRefresh() async {
+      try {
+        await refresh();
+      } catch (e) {
+        showMessage(_formatError(e));
+      }
+    }
+
+    final grantsState = grantsAsync.asData?.value;
+    final grants = grantsState?.grants;
+
+    final content = switch (grantsAsync) {
+      AsyncLoading() when grantsState == null => const _StatePanel(
+        icon: Icons.hourglass_top,
+        title: 'Loading grants',
+        body: 'Pulling grant registry from Arbiter.',
+        busy: true,
+      ),
+      AsyncError(:final error) => _StatePanel(
+        icon: Icons.sync_problem,
+        title: 'Grant registry unavailable',
+        body: _formatError(error),
+        actionLabel: 'Retry',
+        onAction: safeRefresh,
+      ),
+      AsyncData(:final value) when value == null => _StatePanel(
+        icon: Icons.portable_wifi_off,
+        title: 'No active server connection',
+        body: 'Reconnect to Arbiter to list EVM grants.',
+        actionLabel: 'Refresh',
+        onAction: safeRefresh,
+      ),
+      _ when grants != null && grants.isEmpty => _StatePanel(
+        icon: Icons.policy_outlined,
+        title: 'No grants yet',
+        body: 'Create a grant to allow SDK clients to sign transactions.',
+        actionLabel: 'Create grant',
+        onAction: () => context.router.push(const CreateEvmGrantRoute()),
+      ),
+      _ => _GrantList(grants: grants ?? const []),
+    };
+
+    return Scaffold(
+      body: SafeArea(
+        child: RefreshIndicator.adaptive(
+          color: Palette.ink,
+          backgroundColor: Colors.white,
+          onRefresh: safeRefresh,
+          child: ListView(
+            physics: const BouncingScrollPhysics(
+              parent: AlwaysScrollableScrollPhysics(),
+            ),
+            padding: EdgeInsets.fromLTRB(2.4.w, 2.4.h, 2.4.w, 3.2.h),
+            children: [
+              PageHeader(
+                title: 'EVM Grants',
+                isBusy: grantsAsync.isLoading,
+                actions: [
+                  FilledButton.icon(
+                    onPressed: () =>
+                        context.router.push(const CreateEvmGrantRoute()),
+                    icon: const Icon(Icons.add_rounded),
+                    label: const Text('Create grant'),
+                  ),
+                  SizedBox(width: 1.w),
+                  OutlinedButton.icon(
+                    onPressed: safeRefresh,
+                    style: OutlinedButton.styleFrom(
+                      foregroundColor: Palette.ink,
+                      side: BorderSide(color: Palette.line),
+                      padding: EdgeInsets.symmetric(
+                        horizontal: 1.4.w,
+                        vertical: 1.2.h,
+                      ),
+                      shape: RoundedRectangleBorder(
+                        borderRadius: BorderRadius.circular(14),
+                      ),
+                    ),
+                    icon: const Icon(Icons.refresh, size: 18),
+                    label: const Text('Refresh'),
+                  ),
+                ],
+              ),
+              SizedBox(height: 1.8.h),
+              content,
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}
+```
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd operator && flutter analyze lib/screens/dashboard/evm/grants/
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(grants): add EvmGrantsScreen"
+jj new
+```
+
+---
+
+## Task 6: Wire router and dashboard tab
+
+**Files:**
+- Modify: `operator/lib/router.dart`
+- Modify: `operator/lib/screens/dashboard.dart`
+- Regenerated: `operator/lib/router.gr.dart`
+
+- [ ] **Step 1: Add route to `router.dart`**
+
+Replace the contents of `operator/lib/router.dart` with:
+
+```dart
+import 'package:auto_route/auto_route.dart';
+
+import 'router.gr.dart';
+
+@AutoRouterConfig(generateForDir: ['lib/screens'])
+class Router extends RootStackRouter {
+  @override
+  List<AutoRoute> get routes => [
+    AutoRoute(page: Bootstrap.page, path: '/bootstrap', initial: true),
+    AutoRoute(page: ServerInfoSetupRoute.page, path: '/server-info'),
+    AutoRoute(page: ServerConnectionRoute.page, path: '/server-connection'),
+    AutoRoute(page: VaultSetupRoute.page, path: '/vault'),
+    AutoRoute(page: ClientDetailsRoute.page, path: '/clients/:clientId'),
+    AutoRoute(page: CreateEvmGrantRoute.page, path: '/evm-grants/create'),
+
+    AutoRoute(
+      page: DashboardRouter.page,
+      path: '/dashboard',
+      children: [
+        AutoRoute(page: EvmRoute.page, path: 'evm'),
+        AutoRoute(page: ClientsRoute.page, path: 'clients'),
+        AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
+        AutoRoute(page: AboutRoute.page, path: 'about'),
+      ],
+    ),
+  ];
+}
+```
+
+- [ ] **Step 2: Update `dashboard.dart`**
+
+In `operator/lib/screens/dashboard.dart`, replace the `routes` constant:
+
+```dart
+final routes = [
+  const EvmRoute(),
+  const ClientsRoute(),
+  const EvmGrantsRoute(),
+  const AboutRoute(),
+];
+```
+
+And replace the `destinations` list inside `AdaptiveScaffold`:
+
+```dart
+destinations: const [
+  NavigationDestination(
+    icon: Icon(Icons.account_balance_wallet_outlined),
+    selectedIcon: Icon(Icons.account_balance_wallet),
+    label: 'Wallets',
+  ),
+  NavigationDestination(
+    icon: Icon(Icons.devices_other_outlined),
+    selectedIcon: Icon(Icons.devices_other),
+    label: 'Clients',
+  ),
+  NavigationDestination(
+    icon: Icon(Icons.policy_outlined),
+    selectedIcon: Icon(Icons.policy),
+    label: 'Grants',
+  ),
+  NavigationDestination(
+    icon: Icon(Icons.info_outline),
+    selectedIcon: Icon(Icons.info),
+    label: 'About',
+  ),
+],
+```
+
+- [ ] **Step 3: Regenerate router**
+
+```sh
+cd operator && dart run build_runner build --delete-conflicting-outputs
+```
+
+Expected: `lib/router.gr.dart` updated, `EvmGrantsRoute` now available, no errors.
+
+- [ ] **Step 4: Full project verify**
+
+```sh
+cd operator && flutter analyze
+```
+
+Expected: no issues.
+
+- [ ] **Step 5: Commit**
+
+```sh
+jj describe -m "feat(nav): add Grants dashboard tab"
+jj new
+```

docs/superpowers/specs/2026-03-28-grant-grid-view-design.md

@@ -0,0 +1,170 @@
+# Grant Grid View — Design Spec
+
+**Date:** 2026-03-28
+
+## Overview
+
+Add a "Grants" dashboard tab to the Flutter operator app that displays all EVM grants as a card-based grid. Each card shows a compact summary (type, chain, wallet address, client name) with a revoke action. The tab integrates into the existing `AdaptiveScaffold` navigation alongside Wallets, Clients, and About.
+
+## Scope
+
+- New `walletAccessListProvider` for fetching wallet access entries with their DB row IDs
+- New `EvmGrantsScreen` as a dashboard tab
+- Grant card widget with enriched display (type, chain, wallet, client)
+- Revoke action wired to existing `executeRevokeEvmGrant` mutation
+- Dashboard tab bar and router updated
+- New token-transfer accent color added to `Palette`
+
+**Out of scope:** Fixing grant creation (separate task).
+
+---
+
+## Data Layer
+
+### `walletAccessListProvider`
+
+**File:** `operator/lib/providers/sdk_clients/wallet_access_list.dart`
+
+- `@riverpod` class, watches `connectionManagerProvider.future`
+- Returns `List<SdkClientWalletAccess>?` (null when not connected)
+- Each entry: `.id` (wallet_access_id), `.access.walletId`, `.access.sdkClientId`
+- Exposes a `refresh()` method following the same pattern as `EvmGrants.refresh()`
+
+### Enrichment at render time (Approach A)
+
+The `EvmGrantsScreen` watches four providers:
+1. `evmGrantsProvider` — the grant list
+2. `walletAccessListProvider` — to resolve wallet_access_id → (wallet_id, sdk_client_id)
+3. `evmProvider` — to resolve wallet_id → wallet address
+4. `sdkClientsProvider` — to resolve sdk_client_id → client name
+
+All lookups are in-memory Maps built inside the build method; no extra model class needed.
+
+Fallbacks:
+- Wallet address not found → `"Access #N"` where N is the wallet_access_id
+- Client name not found → `"Client #N"` where N is the sdk_client_id
+
+---
+
+## Route Structure
+
+```
+/dashboard
+  /evm          ← existing (Wallets tab)
+  /clients      ← existing (Clients tab)
+  /grants       ← NEW (Grants tab)
+  /about        ← existing
+
+/evm-grants/create  ← existing push route (unchanged)
+```
+
+### Changes to `router.dart`
+
+Add inside dashboard children:
+```dart
+AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
+```
+
+### Changes to `dashboard.dart`
+
+Add to `routes` list:
+```dart
+const EvmGrantsRoute()
+```
+
+Add `NavigationDestination`:
+```dart
+NavigationDestination(
+  icon: Icon(Icons.policy_outlined),
+  selectedIcon: Icon(Icons.policy),
+  label: 'Grants',
+),
+```
+
+---
+
+## Screen: `EvmGrantsScreen`
+
+**File:** `operator/lib/screens/dashboard/evm/grants/grants.dart`
+
+```
+Scaffold
+└─ SafeArea
+   └─ RefreshIndicator.adaptive (refreshes evmGrantsProvider + walletAccessListProvider)
+      └─ ListView (BouncingScrollPhysics + AlwaysScrollableScrollPhysics)
+         ├─ PageHeader
+         │    title: 'EVM Grants'
+         │    isBusy: evmGrantsProvider.isLoading
+         │    actions: [CreateGrantButton, RefreshButton]
+         ├─ SizedBox(height: 1.8.h)
+         └─ <content>
+```
+
+### State handling
+
+Matches the pattern from `EvmScreen` and `ClientsScreen`:
+
+| State | Display |
+|---|---|
+| Loading (no data yet) | `_StatePanel` with spinner, "Loading grants" |
+| Error | `_StatePanel` with coral icon, error message, Retry button |
+| No connection | `_StatePanel`, "No active server connection" |
+| Empty list | `_StatePanel`, "No grants yet", with Create Grant shortcut |
+| Data | Column of `_GrantCard` widgets |
+
+### Header actions
+
+**CreateGrantButton:** `FilledButton.icon` with `Icons.add_rounded`, pushes `CreateEvmGrantRoute()` via `context.router.push(...)`.
+
+**RefreshButton:** `OutlinedButton.icon` with `Icons.refresh`, calls `ref.read(evmGrantsProvider.notifier).refresh()`.
+
+---
+
+## Grant Card: `_GrantCard`
+
+**Layout:**
+
+```
+Container (rounded 24, Palette.cream bg, Palette.line border)
+└─ IntrinsicHeight > Row
+   ├─ Accent strip (0.8.w wide, full height, rounded left)
+   └─ Padding > Column
+        ├─ Row 1: TypeBadge + ChainChip + Spacer + RevokeButton
+        └─ Row 2: WalletText + "·" + ClientText
+```
+
+**Accent color by grant type:**
+- Ether transfer → `Palette.coral`
+- Token transfer → `Palette.token` (new entry in `Palette` — indigo, e.g. `Color(0xFF5C6BC0)`)
+
+**TypeBadge:** Small pill container with accent color background at 15% opacity, accent-colored text. Label: `'Ether'` or `'Token'`.
+
+**ChainChip:** Small container: `'Chain ${grant.shared.chainId}'`, muted ink color.
+
+**WalletText:** Short hex address (`0xabc...def`) from wallet lookup, `bodySmall`, monospace font family.
+
+**ClientText:** Client name from `sdkClientsProvider` lookup, or fallback string. `bodySmall`, muted ink.
+
+**RevokeButton:**
+- `OutlinedButton` with `Icons.block_rounded` icon, label `'Revoke'`
+- `foregroundColor: Palette.coral`, `side: BorderSide(color: Palette.coral.withValues(alpha: 0.4))`
+- Disabled (replaced with `CircularProgressIndicator`) while `revokeEvmGrantMutation` is pending — note: this is a single global mutation, so all revoke buttons disable while any revoke is in flight
+- On press: calls `executeRevokeEvmGrant(ref, grantId: grant.id)`; shows `SnackBar` on error
+
+---
+
+## Adaptive Sizing
+
+All sizing uses `sizer` units (`1.h`, `1.w`, etc.). No hardcoded pixel values.
+
+---
+
+## Files to Create / Modify
+
+| File | Action |
+|---|---|
+| `lib/theme/palette.dart` | Modify — add `Palette.token` color |
+| `lib/providers/sdk_clients/wallet_access_list.dart` | Create |
+| `lib/screens/dashboard/evm/grants/grants.dart` | Create |
+| `lib/router.dart` | Modify — add grants route to dashboard children |
+| `lib/screens/dashboard.dart` | Modify — add tab to routes list and NavigationDestinations |

mise.lock

@@ -152,8 +152,5 @@ url = "https://github.com/astral-sh/python-build-standalone/releases/download/20
 provenance = "github-attestations"
 
 [[tools.rust]]
-version = "1.98.1"
+version = "1.95.0"
 backend = "core:rust"
-
-[tools.rust.options]
-components = "clippy,rust-analyzer"

mise.toml

@@ -4,7 +4,7 @@
 "cargo:cargo-vet" = "0.10.2"
 flutter = "3.41.7-stable"
 protoc = "29.6"
-rust = { version = "latest", components = "clippy,rust-analyzer" }
+rust = { version = "1.95.0", components = "clippy,rust-analyzer" }
 "cargo:cargo-features-manager" = "0.12.0"
 "cargo:cargo-nextest" = "0.9.133"
 "cargo:cargo-shear" = "latest"

protobufs/operator.proto

@@ -4,28 +4,25 @@ package arbiter.operator;
 
 import "operator/auth.proto";
 import "operator/evm.proto";
-import "operator/governance.proto";
 import "operator/sdk_client.proto";
 import "operator/vault/vault.proto";
 
 message OperatorRequest {
   int32 id = 16;
   oneof payload {
-    auth.Request            auth        = 1;
-    vault.Request           vault       = 2;
-    evm.Request             evm         = 3;
-    sdk_client.Request      sdk_client  = 4;
-    governance.Request      governance  = 5;
+    auth.Request auth = 1;
+    vault.Request vault = 2;
+    evm.Request evm = 3;
+    sdk_client.Request sdk_client = 4;
   }
 }
 
 message OperatorResponse {
   optional int32 id = 16;
   oneof payload {
-    auth.Response           auth        = 1;
-    vault.Response          vault       = 2;
-    evm.Response            evm         = 3;
-    sdk_client.Response     sdk_client  = 4;
-    governance.Response     governance  = 5;
+    auth.Response auth = 1;
+    vault.Response vault = 2;
+    evm.Response evm = 3;
+    sdk_client.Response sdk_client = 4;
   }
 }

protobufs/operator/governance.proto

@@ -1,136 +0,0 @@
-syntax = "proto3";
-
-package arbiter.operator.governance;
-
-message Request {
-  oneof payload {
-    CreateProposalRequest create = 1;
-    CastVoteRequest       vote   = 2;
-    QueryPendingRequest   query  = 3;
-  }
-}
-
-message CreateProposalRequest {
-  oneof kind {
-    ApproveSdkClientPayload         approve_sdk_client          = 1;
-    GrantWalletAccessPayload        grant_wallet_access         = 3;
-    ApproveServerUpdatePayload      approve_server_update       = 4;
-    ReplaceOperatorPayload          replace_operator            = 5;
-    UpdateShamirParametersPayload   update_shamir_parameters    = 6;
-    ApprovePersistentGrantPayload   approve_persistent_grant    = 7;
-    ApproveOneOffTransactionPayload approve_one_off_transaction = 8;
-  }
-  optional uint32 ttl_secs = 2;
-}
-
-message ReplaceOperatorPayload {
-  int32 old_operator_id = 1;
-  bytes new_pubkey      = 2;
-}
-
-message UpdateShamirParametersPayload {
-  uint32 new_n = 1;
-}
-
-message ApproveServerUpdatePayload {}
-
-message ApproveSdkClientPayload {
-  int32 client_id = 1;
-}
-
-message GrantWalletAccessPayload {
-  int32 wallet_id = 1;
-  int32 client_id = 2;
-}
-
-message CastVoteRequest {
-  int32 proposal_id = 1;
-  bool  approve     = 2;
-  bytes signature   = 3;
-}
-
-message QueryPendingRequest {}
-
-message Response {
-  oneof payload {
-    CreateProposalResponse created = 1;
-    VoteResponse           voted   = 2;
-    QueryPendingResponse   pending = 3;
-  }
-}
-
-message CreateProposalResponse {
-  int32 proposal_id = 1;
-}
-
-message VoteResponse {
-  VoteOutcome outcome = 1;
-}
-
-enum VoteOutcome {
-  VOTE_OUTCOME_UNSPECIFIED = 0;
-  VOTE_OUTCOME_PENDING     = 1;
-  VOTE_OUTCOME_APPROVED    = 2;
-  VOTE_OUTCOME_REJECTED    = 3;
-}
-
-message ProposalSummary {
-  int32  id            = 1;
-  string kind          = 2;
-  int32  initiator_id  = 3;
-  int64  expires_at    = 4;
-  int64  approve_count = 5;
-  int64  reject_count  = 6;
-}
-
-message QueryPendingResponse {
-  repeated ProposalSummary proposals = 1;
-}
-
-message TransactionRateLimitProto {
-  uint32 count       = 1;
-  int64  window_secs = 2;
-}
-
-message VolumeLimitProto {
-  bytes max_volume  = 1;
-  int64 window_secs = 2;
-}
-
-message EtherTransferSpecProto {
-  repeated bytes   targets = 1;
-  VolumeLimitProto limit   = 2;
-}
-
-message TokenTransferSpecProto {
-  bytes                     token_contract = 1;
-  optional bytes            target         = 2;
-  repeated VolumeLimitProto volume_limits  = 3;
-}
-
-message ApproveOneOffTransactionPayload {
-  int32  client_id                = 1;
-  bytes  wallet_address           = 2;
-  uint64 chain_id                 = 3;
-  uint64 nonce                    = 4;
-  uint64 gas_limit                = 5;
-  bytes  max_fee_per_gas          = 6;
-  bytes  max_priority_fee_per_gas = 7;
-  bytes  to                       = 8;
-  bytes  value                    = 9;
-  bytes  input                    = 10;
-}
-
-message ApprovePersistentGrantPayload {
-  int32                              wallet_access_id         = 1;
-  uint64                             chain_id                 = 2;
-  optional int64                     valid_from_secs          = 3;
-  optional int64                     valid_until_secs         = 4;
-  optional bytes                     max_gas_fee_per_gas      = 5;
-  optional bytes                     max_priority_fee_per_gas = 6;
-  optional TransactionRateLimitProto rate_limit               = 7;
-  oneof specific {
-    EtherTransferSpecProto ether_transfer = 8;
-    TokenTransferSpecProto token_transfer = 9;
-  }
-}

protobufs/operator/vault/bootstrap.proto

@@ -9,19 +9,13 @@ message BootstrapEncryptedKey {
 }
 
 message DeclareCommittee {
-  uint32 count          = 1;
-  uint32 recovery_count = 2;
+  uint32 count = 1;
 }
 
 message ContributePassphrase {
   bytes passphrase = 1;
 }
 
-message ContributeRecoveryPassphrase {
-  int32 recovery_operator_id = 1;
-  bytes passphrase            = 2;
-}
-
 enum BootstrapResult {
   BOOTSTRAP_RESULT_UNSPECIFIED = 0;
   BOOTSTRAP_RESULT_SUCCESS = 1;
@@ -32,10 +26,9 @@ enum BootstrapResult {
 
 message Request {
   oneof payload {
-    BootstrapEncryptedKey        encrypted_key                    = 2;
-    DeclareCommittee             declare_committee                = 3;
-    ContributePassphrase         contribute_passphrase            = 4;
-    ContributeRecoveryPassphrase contribute_recovery_passphrase   = 5;
+    BootstrapEncryptedKey encrypted_key = 2;
+    DeclareCommittee declare_committee = 3;
+    ContributePassphrase contribute_passphrase = 4;
   }
 }
 

protobufs/operator/vault/rekey.proto

@@ -1,30 +0,0 @@
-syntax = "proto3";
-
-package arbiter.operator.vault.rekey;
-
-message ContributePassphrase {
-  bytes passphrase = 1;
-}
-
-message ContributeRecoveryPassphrase {
-  int32 recovery_operator_id = 1;
-  bytes passphrase           = 2;
-}
-
-enum RekeyResult {
-  REKEY_RESULT_UNSPECIFIED            = 0;
-  REKEY_RESULT_SUCCESS                = 1;
-  REKEY_RESULT_AWAITING_CONTRIBUTIONS = 2;
-  REKEY_RESULT_NOT_IN_PROGRESS        = 3;
-}
-
-message Request {
-  oneof payload {
-    ContributePassphrase         contribute_passphrase          = 1;
-    ContributeRecoveryPassphrase contribute_recovery_passphrase = 2;
-  }
-}
-
-message Response {
-  RekeyResult result = 1;
-}

protobufs/operator/vault/unseal.proto

@@ -19,11 +19,6 @@ message ContributePassphrase {
   bytes passphrase = 1;
 }
 
-message ContributeRecoveryPassphrase {
-  int32 recovery_operator_id = 1;
-  bytes passphrase            = 2;
-}
-
 enum UnsealResult {
   UNSEAL_RESULT_UNSPECIFIED = 0;
   UNSEAL_RESULT_SUCCESS = 1;
@@ -34,10 +29,9 @@ enum UnsealResult {
 
 message Request {
   oneof payload {
-    UnsealStart                  start                          = 1;
-    UnsealEncryptedKey           encrypted_key                  = 2;
-    ContributePassphrase         contribute_passphrase          = 3;
-    ContributeRecoveryPassphrase contribute_recovery_passphrase = 4;
+    UnsealStart start = 1;
+    UnsealEncryptedKey encrypted_key = 2;
+    ContributePassphrase contribute_passphrase = 3;
   }
 }
 

protobufs/operator/vault/vault.proto

@@ -5,23 +5,20 @@ package arbiter.operator.vault;
 import "google/protobuf/empty.proto";
 import "shared/vault.proto";
 import "operator/vault/bootstrap.proto";
-import "operator/vault/rekey.proto";
 import "operator/vault/unseal.proto";
 
 message Request {
   oneof payload {
     google.protobuf.Empty query_state = 1;
-    unseal.Request        unseal      = 2;
-    bootstrap.Request     bootstrap   = 3;
-    rekey.Request         rekey       = 4;
+    unseal.Request unseal = 2;
+    bootstrap.Request bootstrap = 3;
   }
 }
 
 message Response {
   oneof payload {
-    arbiter.shared.VaultState state     = 1;
-    unseal.Response           unseal    = 2;
-    bootstrap.Response        bootstrap = 3;
-    rekey.Response            rekey     = 4;
+    arbiter.shared.VaultState state = 1;
+    unseal.Response unseal = 2;
+    bootstrap.Response bootstrap = 3;
   }
 }

server/Cargo.lock

@@ -504,7 +504,7 @@ dependencies = [
  "async-trait",
  "auto_impl",
  "either",
- "elliptic-curve 0.13.8",
+ "elliptic-curve",
  "k256",
  "thiserror",
 ]
@@ -771,7 +771,7 @@ dependencies = [
  "proptest",
  "prost-types",
  "rand 0.10.1",
- "rand_core 0.10.1",
+ "rand_core 0.6.4",
  "rcgen",
  "restructed",
  "rstest",
@@ -822,7 +822,7 @@ dependencies = [
  "ark-serialize 0.3.0",
  "ark-std 0.3.0",
  "derivative",
- "num-bigint 0.4.6",
+ "num-bigint",
  "num-traits",
  "paste",
  "rustc_version 0.3.3",
@@ -842,7 +842,7 @@ dependencies = [
  "derivative",
  "digest 0.10.7",
  "itertools 0.10.5",
- "num-bigint 0.4.6",
+ "num-bigint",
  "num-traits",
  "paste",
  "rustc_version 0.4.1",
@@ -863,7 +863,7 @@ dependencies = [
  "digest 0.10.7",
  "educe",
  "itertools 0.13.0",
- "num-bigint 0.4.6",
+ "num-bigint",
  "num-traits",
  "paste",
  "zeroize",
@@ -905,7 +905,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db2fd794a08ccb318058009eefdf15bcaaaaf6f8161eb3345f907222bac38b20"
 dependencies = [
- "num-bigint 0.4.6",
+ "num-bigint",
  "num-traits",
  "quote",
  "syn 1.0.109",
@@ -917,7 +917,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7abe79b0e4288889c4574159ab790824d0033b9fdcb2a112a3182fac2e514565"
 dependencies = [
- "num-bigint 0.4.6",
+ "num-bigint",
  "num-traits",
  "proc-macro2",
  "quote",
@@ -930,7 +930,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09be120733ee33f7693ceaa202ca41accd5653b779563608f1234f78ae07c4b3"
 dependencies = [
- "num-bigint 0.4.6",
+ "num-bigint",
  "num-traits",
  "proc-macro2",
  "quote",
@@ -955,7 +955,7 @@ checksum = "adb7b85a02b83d2f22f89bd5cac66c9c89474240cb6207cb1efc16d098e822a5"
 dependencies = [
  "ark-std 0.4.0",
  "digest 0.10.7",
- "num-bigint 0.4.6",
+ "num-bigint",
 ]
 
 [[package]]
@@ -967,7 +967,7 @@ dependencies = [
  "ark-std 0.5.0",
  "arrayvec",
  "digest 0.10.7",
- "num-bigint 0.4.6",
+ "num-bigint",
 ]
 
 [[package]]
@@ -1197,12 +1197,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
-[[package]]
-name = "base16ct"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -1560,12 +1554,6 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
-[[package]]
-name = "cpubits"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
-
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1628,22 +1616,20 @@ checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array 0.14.7",
  "rand_core 0.6.4",
+ "serdect 0.2.0",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "crypto-bigint"
-version = "0.7.5"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
+checksum = "96272c2ff28b807e09250b180ad1fb7889a3258f7455759b5c3c58b719467130"
 dependencies = [
- "cpubits",
- "ctutils",
- "hybrid-array",
  "num-traits",
- "rand_core 0.10.1",
- "serdect 0.4.3",
+ "rand_core 0.6.4",
+ "serdect 0.3.0",
  "subtle",
  "zeroize",
 ]
@@ -1676,7 +1662,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
 dependencies = [
  "cmov",
- "subtle",
 ]
 
 [[package]]
@@ -1839,7 +1824,7 @@ dependencies = [
  "asn1-rs",
  "displaydoc",
  "nom",
- "num-bigint 0.4.6",
+ "num-bigint",
  "num-traits",
  "rusticata-macros",
 ]
@@ -2036,7 +2021,7 @@ checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
  "der 0.7.10",
  "digest 0.10.7",
- "elliptic-curve 0.13.8",
+ "elliptic-curve",
  "rfc6979",
  "serdect 0.2.0",
  "signature 2.2.0",
@@ -2070,50 +2055,34 @@ version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct 0.2.0",
+ "base16ct",
  "crypto-bigint 0.5.5",
  "digest 0.10.7",
- "ff 0.13.1",
+ "ff",
  "generic-array 0.14.7",
- "group 0.13.0",
+ "group",
+ "hkdf",
  "pkcs8 0.10.2",
  "rand_core 0.6.4",
- "sec1 0.7.3",
+ "sec1",
  "serdect 0.2.0",
  "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "elliptic-curve"
-version = "0.14.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
-dependencies = [
- "base16ct 1.0.0",
- "crypto-bigint 0.7.5",
- "crypto-common 0.2.1",
- "ff 0.14.0",
- "group 0.14.0",
- "hybrid-array",
- "pkcs8 0.11.0",
- "rand_core 0.10.1",
- "sec1 0.8.1",
- "serdect 0.4.3",
- "subtle",
+ "tap",
  "zeroize",
 ]
 
 [[package]]
 name = "elliptic-curve-tools"
-version = "0.3.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a0d5e534f103b079a71ef1d66c6e62c89413f1b62709ca11f744429b4afe5b4"
+checksum = "1de2b6fae800f08032a6ea32995b52925b1d451bff9d445c8ab2932323277faf"
 dependencies = [
- "elliptic-curve 0.14.1",
+ "elliptic-curve",
  "heapless",
+ "hex",
+ "multiexp",
  "serde",
- "serdect 0.4.3",
+ "zeroize",
 ]
 
 [[package]]
@@ -2186,20 +2155,11 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
+ "bitvec",
  "rand_core 0.6.4",
  "subtle",
 ]
 
-[[package]]
-name = "ff"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
-dependencies = [
- "rand_core 0.10.1",
- "subtle",
-]
-
 [[package]]
 name = "fiat-crypto"
 version = "0.2.9"
@@ -2398,9 +2358,9 @@ dependencies = [
 
 [[package]]
 name = "generic-array"
-version = "1.4.2"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb130435a959a8d525e6bca66ff6c40981a300ee96d70e3ef56f046556d614a3"
+checksum = "dab9e9188e97a93276e1fe7b56401b851e2b45a46d045ca658100c1303ada649"
 dependencies = [
  "rustversion",
  "serde_core",
@@ -2466,22 +2426,11 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
- "ff 0.13.1",
+ "ff",
  "rand_core 0.6.4",
  "subtle",
 ]
 
-[[package]]
-name = "group"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
-dependencies = [
- "ff 0.14.0",
- "rand_core 0.10.1",
- "subtle",
-]
-
 [[package]]
 name = "h2"
 version = "0.4.13"
@@ -2552,9 +2501,9 @@ checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
 
 [[package]]
 name = "heapless"
-version = "0.9.3"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25ba4bd83f9415b58b4ed8dc5714c76e626a105be4646c02630ad730ad3b5aa4"
+checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
 dependencies = [
  "hash32",
  "stable_deref_trait",
@@ -2587,6 +2536,15 @@ dependencies = [
  "arrayvec",
 ]
 
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac 0.12.1",
+]
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -2652,13 +2610,12 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hybrid-array"
-version = "0.4.15"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+checksum = "08d46837a0ed51fe95bd3b05de33cd64a1ee88fc797477ca48446872504507c5"
 dependencies = [
  "ctutils",
  "serde",
- "subtle",
  "typenum",
  "zeroize",
 ]
@@ -3061,7 +3018,7 @@ checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
 dependencies = [
  "cfg-if",
  "ecdsa",
- "elliptic-curve 0.13.8",
+ "elliptic-curve",
  "once_cell",
  "serdect 0.2.0",
  "sha2 0.10.9",
@@ -3070,8 +3027,8 @@ dependencies = [
 
 [[package]]
 name = "kameo"
-version = "0.22.2"
-source = "git+https://github.com/hdbg/kameo.git?rev=3bbebac#3bbebac9f2a943be75588d80826e6bea45079d5f"
+version = "0.20.0"
+source = "git+https://github.com/hdbg/kameo.git?rev=3e18ba2#3e18ba24023d0422034e60ff2ea1ecd49e8c3c93"
 dependencies = [
  "downcast-rs",
  "dyn-clone",
@@ -3084,8 +3041,8 @@ dependencies = [
 
 [[package]]
 name = "kameo_actors"
-version = "0.8.1"
-source = "git+https://github.com/hdbg/kameo.git?rev=3bbebac#3bbebac9f2a943be75588d80826e6bea45079d5f"
+version = "0.5.0"
+source = "git+https://github.com/hdbg/kameo.git?rev=3e18ba2#3e18ba24023d0422034e60ff2ea1ecd49e8c3c93"
 dependencies = [
  "futures",
  "glob",
@@ -3096,13 +3053,13 @@ dependencies = [
 
 [[package]]
 name = "kameo_macros"
-version = "0.21.1"
-source = "git+https://github.com/hdbg/kameo.git?rev=3bbebac#3bbebac9f2a943be75588d80826e6bea45079d5f"
+version = "0.20.0"
+source = "git+https://github.com/hdbg/kameo.git?rev=3e18ba2#3e18ba24023d0422034e60ff2ea1ecd49e8c3c93"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 3.0.5",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -3405,6 +3362,20 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "multiexp"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ec2ce93a6f06ac6cae04c1da3f2a6a24fcfc1f0eb0b4e0f3d302f0df45326cb"
+dependencies = [
+ "ff",
+ "group",
+ "rand_core 0.6.4",
+ "rustversion",
+ "std-shims",
+ "zeroize",
+]
+
 [[package]]
 name = "multimap"
 version = "0.10.1"
@@ -3436,6 +3407,20 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -3444,16 +3429,18 @@ checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
 dependencies = [
  "num-integer",
  "num-traits",
+ "rand 0.8.6",
+ "serde",
 ]
 
 [[package]]
-name = "num-bigint"
-version = "0.5.1"
+name = "num-complex"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
 dependencies = [
- "num-integer",
  "num-traits",
+ "rand 0.8.6",
  "serde",
 ]
 
@@ -3472,6 +3459,29 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+ "serde",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -4351,7 +4361,7 @@ dependencies = [
  "bytes",
  "fastrlp 0.3.1",
  "fastrlp 0.4.0",
- "num-bigint 0.4.6",
+ "num-bigint",
  "num-integer",
  "num-traits",
  "parity-scale-codec",
@@ -4578,7 +4588,7 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct 0.2.0",
+ "base16ct",
  "der 0.7.10",
  "generic-array 0.14.7",
  "pkcs8 0.10.2",
@@ -4587,21 +4597,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "sec1"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
-dependencies = [
- "base16ct 1.0.0",
- "ctutils",
- "der 0.8.0",
- "hybrid-array",
- "serdect 0.4.3",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "secp256k1"
 version = "0.30.0"
@@ -4759,17 +4754,17 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
 dependencies = [
- "base16ct 0.2.0",
+ "base16ct",
  "serde",
 ]
 
 [[package]]
 name = "serdect"
-version = "0.4.3"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
+checksum = "f42f67da2385b51a5f9652db9c93d78aeaf7610bf5ec366080b6de810604af53"
 dependencies = [
- "base16ct 1.0.0",
+ "base16ct",
  "serde",
 ]
 
@@ -4815,17 +4810,6 @@ dependencies = [
  "keccak 0.2.0",
 ]
 
-[[package]]
-name = "sha3"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc9bad02c26382724b2d2692c6f179285e4b54eeecd7968f52a50059c3c11759"
-dependencies = [
- "digest 0.11.2",
- "keccak 0.2.0",
- "sponge-cursor",
-]
-
 [[package]]
 name = "sha3-asm"
 version = "0.1.6"
@@ -4836,17 +4820,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "shake"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a"
-dependencies = [
- "digest 0.11.2",
- "keccak 0.2.0",
- "sponge-cursor",
-]
-
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -4960,6 +4933,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "spin"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -4980,12 +4959,6 @@ dependencies = [
  "der 0.8.0",
 ]
 
-[[package]]
-name = "sponge-cursor"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
-
 [[package]]
 name = "sqlite-wasm-rs"
 version = "0.5.3"
@@ -5010,6 +4983,17 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
+[[package]]
+name = "std-shims"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "227c4f8561598188d0df96dbe749824576174bba278b5b6bb2eacff1066067d0"
+dependencies = [
+ "hashbrown 0.16.1",
+ "rustversion",
+ "spin",
+]
+
 [[package]]
 name = "string_morph"
 version = "0.1.0"
@@ -5113,17 +5097,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "syn"
-version = "3.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
 [[package]]
 name = "syn-solidity"
 version = "1.5.7"
@@ -5766,23 +5739,21 @@ checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "vsss-rs"
-version = "6.0.1"
+version = "5.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bfc736cfd88115aedb95ba84bc2d428fe351e92a56f69fce090af301402d91"
+checksum = "6ec751bdcc8bda099e269b24cc6b4ad14f9ce8b0490c1599174070e792ecd70c"
 dependencies = [
- "crypto-bigint 0.7.5",
- "elliptic-curve 0.14.1",
+ "crypto-bigint 0.5.5",
+ "crypto-bigint 0.6.1",
+ "elliptic-curve",
  "elliptic-curve-tools",
- "ff 0.14.0",
- "generic-array 1.4.2",
+ "generic-array 1.4.1",
  "hex",
  "hybrid-array",
- "num-bigint 0.5.1",
- "num-traits",
- "rand_core 0.10.1",
+ "num",
+ "rand_core 0.6.4",
  "serde",
- "sha3 0.12.0",
- "shake",
+ "sha3 0.10.9",
  "subtle",
  "zeroize",
 ]
@@ -6474,18 +6445,18 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.9.0"
+version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
 dependencies = [
  "zeroize_derive",
 ]
 
 [[package]]
 name = "zeroize_derive"
-version = "1.5.0"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
 dependencies = [
  "proc-macro2",
  "quote",

server/Cargo.toml

@@ -12,8 +12,8 @@ base64 = "0.22.1"
 chrono = { version = "0.4.44", features = ["serde"] }
 futures = "0.3.32"
 k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
-kameo = {git = "https://github.com/hdbg/kameo.git", rev = "3bbebac"}
-kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "3bbebac"}
+kameo = {git = "https://github.com/hdbg/kameo.git", rev = "3e18ba2"}
+kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "3e18ba2"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
 ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
@@ -21,7 +21,6 @@ mutants = "0.0.4"
 prost = "0.14.3"
 prost-types = { version = "0.14.3", features = ["chrono"] }
 rand = "0.10.1"
-rand_core = "0.10.1"
 rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
 rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
@@ -77,8 +76,6 @@ needless_pass_by_ref_mut = "allow"
 pub_underscore_fields = "allow"
 redundant_pub_crate = "allow" 
 uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {})
-too-many-lines = "allow" # this is a very common pattern in server code, and it's not always possible to break it down into smaller modules without hurting readability
-unused_async_trait_impl = "allow" # too pedantic
 
 # restriction lints
 alloc_instead_of_core = "warn"
@@ -109,7 +106,6 @@ indexing_slicing = "warn"
 infinite_loop = "warn"
 inline_asm_x86_att_syntax = "warn"
 inline_asm_x86_intel_syntax = "warn"
-integer_division = "warn"
 large_include_file = "warn"
 lossy_float_literal = "warn"
 map_with_unused_argument_over_ranges = "warn"

server/crates/arbiter-client/src/auth.rs

@@ -100,7 +100,7 @@ async fn send_auth_challenge_solution(
     key: &SigningKey,
     challenge: AuthChallenge,
 ) -> Result<(), AuthError> {
-    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos.cast_signed());
+    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos as i64);
     let challenge = authn::AuthChallenge {
         nonce: *challenge
             .random

server/crates/arbiter-client/src/client.rs

@@ -94,6 +94,7 @@ impl ArbiterClient {
     }
 
     #[cfg(feature = "evm")]
+    #[expect(clippy::unused_async, reason = "false positive")]
     pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, ArbiterClientError> {
         todo!("fetch EVM wallet list from server")
     }

server/crates/arbiter-crypto/src/safecell.rs

@@ -22,7 +22,7 @@ pub trait SafeCellHandle<T> {
     fn read(&mut self) -> Self::CellRead<'_>;
     fn write(&mut self) -> Self::CellWrite<'_>;
 
-    fn new_inline<F>(f: F) -> Self
+    fn new_inline_default<F>(f: F) -> Self
     where
         Self: Sized,
         T: Default,
@@ -36,6 +36,14 @@ pub trait SafeCellHandle<T> {
         cell
     }
 
+    fn new_inline<F>(f: Box<F>) -> Self
+    where
+        Self: Sized,
+        F: for<'a> FnOnce() -> T,
+    {
+        Self::new(f())
+    }
+
     #[inline(always)]
     fn read_inline<F, R>(&mut self, f: F) -> R
     where

server/crates/arbiter-proto/src/lib.rs

@@ -23,10 +23,6 @@ pub mod proto {
             tonic::include_proto!("arbiter.operator.evm");
         }
 
-        pub mod governance {
-            tonic::include_proto!("arbiter.operator.governance");
-        }
-
         pub mod sdk_client {
             tonic::include_proto!("arbiter.operator.sdk_client");
         }
@@ -38,10 +34,6 @@ pub mod proto {
                 tonic::include_proto!("arbiter.operator.vault.bootstrap");
             }
 
-            pub mod rekey {
-                tonic::include_proto!("arbiter.operator.vault.rekey");
-            }
-
             pub mod unseal {
                 tonic::include_proto!("arbiter.operator.vault.unseal");
             }

server/crates/arbiter-server/Cargo.toml

@@ -31,7 +31,6 @@ diesel_migrations = { version = "2.3.2", features = ["sqlite"] }
 async-trait.workspace = true
 tokio-stream.workspace = true
 rand.workspace = true
-rand_core.workspace = true
 rcgen.workspace = true
 chrono.workspace = true
 kameo.workspace = true
@@ -51,7 +50,8 @@ subtle = "2.6.1"
 x25519-dalek.workspace = true
 k256.workspace = true
 kameo_actors.workspace = true
-vsss-rs = "6.0.1"
+vsss-rs = "5.4.0"
+rand_core = "0.6"
 
 [dev-dependencies]
 proptest = "1.11.0"

server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql

@@ -37,8 +37,7 @@ create table if not exists tls_history (
 create table if not exists arbiter_settings (
     id INTEGER not null PRIMARY KEY CHECK (id = 1), -- singleton row, id must be 1
     root_key_id integer references root_key_history (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet
-    tls_id integer references tls_history (id) on delete RESTRICT,
-    shamir_threshold integer
+    tls_id integer references tls_history (id) on delete RESTRICT
 ) STRICT;
 
 insert into arbiter_settings (id) values (1) on conflict do nothing;
@@ -57,7 +56,7 @@ create table if not exists operator (
 
     share blob not null,
     share_nonce blob not null,
-    share_salt blob not null,
+    share_salt blob not null default (randomblob(32)),
 
     created_at integer not null default(unixepoch ('now')),
     updated_at integer not null default(unixepoch ('now'))

server/crates/arbiter-server/src/actors/bootstrap.rs

@@ -1,164 +1,98 @@
-use crate::{
-    actors::vault::events,
-    db::{self, schema},
-};
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+use crate::db::{self, DatabasePool, schema};
 use arbiter_proto::{BOOTSTRAP_PATH, home_path};
 
 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
-use kameo::{
-    Actor,
-    actor::ActorRef,
-    messages,
-    prelude::{Context, Message},
-};
-use kameo_actors::message_bus::{MessageBus, Register};
-use rand::{RngExt, distr::Alphanumeric, rngs::SysRng};
-use rand_core::UnwrapErr;
-use std::path::{Path, PathBuf};
+use kameo::{Actor, messages};
+use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
 use subtle::ConstantTimeEq as _;
-use tracing::warn;
+use thiserror::Error;
 
 const TOKEN_LENGTH: usize = 64;
 
-async fn write_token_file(path: &Path, content: &str) -> Result<(), std::io::Error> {
-    if let Some(parent) = path.parent() {
-        tokio::fs::create_dir_all(parent).await?;
-    }
-    tokio::fs::write(path, content.as_bytes()).await?;
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt as _;
-        tokio::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600)).await?;
-    }
-    Ok(())
+pub async fn generate_token() -> Result<String, std::io::Error> {
+    let rng: StdRng = make_rng();
+
+    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
+        String::default(),
+        |mut accum, char| {
+            accum += char.to_string().as_str();
+            accum
+        },
+    );
+
+    tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;
+
+    Ok(token)
 }
 
-async fn remove_token_file(path: &Path) {
-    match tokio::fs::remove_file(path).await {
-        Ok(()) => {}
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
-        Err(error) => warn!(?error, ?path, "Failed to remove bootstrap token file"),
-    }
-}
-
-async fn generate_token(path: &Path) -> Result<SafeCell<[u8; TOKEN_LENGTH]>, std::io::Error> {
-    let mut cell = SafeCell::new([0u8; TOKEN_LENGTH]);
-    {
-        let mut buf = cell.write();
-        for (slot, byte) in buf
-            .iter_mut()
-            .zip(UnwrapErr(SysRng).sample_iter(Alphanumeric))
-        {
-            *slot = byte;
-        }
-    }
-    let token = cell.read_inline(|buf| String::from_utf8_lossy(buf.as_ref()).into_owned());
-    write_token_file(path, &token).await?;
-    Ok(cell)
-}
-
-#[derive(Debug, thiserror::Error)]
+#[derive(Error, Debug)]
 pub enum Error {
     #[error("Database error: {0}")]
     Database(#[from] db::PoolError),
+
     #[error("I/O error: {0}")]
     Io(#[from] std::io::Error),
+
     #[error("Database query error: {0}")]
     Query(#[from] diesel::result::Error),
 }
 
-/// Custodian of the one-time bootstrap token.
-///
-/// The token authorises registering operator identities before the vault
-/// exists. A Shamir committee needs every member registered before it can be
-/// declared, so the token stays valid across several registrations and is
-/// retired by the `Bootstrapped` event rather than by first use, whichever
-/// bootstrap path fired it.
-///
-/// Every daemon start mints a fresh token and overwrites the file: a token
-/// handed out by an earlier run is dead.
+#[derive(Actor)]
 pub struct Bootstrapper {
-    token: Option<SafeCell<[u8; TOKEN_LENGTH]>>,
-    token_path: Option<PathBuf>,
-    events: ActorRef<MessageBus>,
-}
-
-impl Actor for Bootstrapper {
-    type Args = Self;
-    type Error = std::convert::Infallible;
-
-    async fn on_start(args: Self::Args, actor_ref: ActorRef<Self>) -> Result<Self, Self::Error> {
-        let _ = args
-            .events
-            .tell(Register(actor_ref.recipient::<events::Bootstrapped>()))
-            .await;
-        Ok(args)
-    }
+    token: Option<String>,
 }
 
 impl Bootstrapper {
-    pub async fn new(db: &db::DatabasePool, events: ActorRef<MessageBus>) -> Result<Self, Error> {
-        let path = home_path()?.join(BOOTSTRAP_PATH);
-        let mut conn = db.get().await?;
+    pub async fn new(db: &DatabasePool) -> Result<Self, Error> {
+        let row_count: i64 = {
+            let mut conn = db.get().await?;
 
-        let bootstrapped = schema::arbiter_settings::table
-            .select(schema::arbiter_settings::root_key_id)
-            .first::<Option<i32>>(&mut conn)
-            .await?
-            .is_some();
-        if bootstrapped {
-            // A token file can outlive the bootstrap that made it obsolete:
-            // the daemon may have been killed before the event was handled.
-            remove_token_file(&path).await;
-            return Ok(Self {
-                token: None,
-                token_path: None,
-                events,
-            });
-        }
+            schema::operator::table
+                .count()
+                .get_result(&mut conn)
+                .await?
+        };
 
-        Ok(Self {
-            token: Some(generate_token(&path).await?),
-            token_path: Some(path),
-            events,
-        })
-    }
+        let token = if row_count == 0 {
+            let token = generate_token().await?;
+            Some(token)
+        } else {
+            None
+        };
 
-    async fn forget(&mut self) {
-        self.token = None;
-        if let Some(path) = self.token_path.take() {
-            remove_token_file(&path).await;
-        }
+        Ok(Self { token })
     }
 }
 
-impl Message<events::Bootstrapped> for Bootstrapper {
-    type Reply = ();
-
-    async fn handle(
-        &mut self,
-        _: events::Bootstrapped,
-        _ctx: &mut Context<Self, Self::Reply>,
-    ) -> Self::Reply {
-        self.forget().await;
-    }
-}
-    
 #[messages]
 impl Bootstrapper {
     #[message]
-    pub fn verify_token(&mut self, token: Vec<u8>) -> bool {
-        self.token.as_mut().is_some_and(|expected| {
-            expected.read_inline(|bytes| bool::from(bytes.as_ref().ct_eq(token.as_slice())))
+    pub fn is_correct_token(&self, token: String) -> bool {
+        self.token.as_ref().is_some_and(|expected| {
+            let expected_bytes = expected.as_bytes();
+            let token_bytes = token.as_bytes();
+
+            let choice = expected_bytes.ct_eq(token_bytes);
+            bool::from(choice)
         })
     }
 
     #[message]
-    pub fn get_token(&mut self) -> Option<String> {
-        self.token
-            .as_mut()
-            .map(|cell| cell.read_inline(|buf| String::from_utf8_lossy(buf.as_ref()).into_owned()))
+    pub fn consume_token(&mut self, token: String) -> bool {
+        if self.is_correct_token(token) {
+            self.token = None;
+            true
+        } else {
+            false
+        }
+    }
+}
+
+#[messages]
+impl Bootstrapper {
+    #[message]
+    pub fn get_token(&self) -> Option<String> {
+        self.token.clone()
     }
 }

server/crates/arbiter-server/src/actors/evm/mod.rs

@@ -1,6 +1,6 @@
 use crate::{
     actors::vault::{CreateNew, Decrypt, Vault},
-    crypto::integrity::{self, Integrable},
+    crypto::integrity,
     db::{
         DatabaseError, DatabasePool,
         models::{self, EvmWalletId},
@@ -25,35 +25,14 @@ use diesel::{
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, actor::ActorRef, messages};
 use rand::{SeedableRng, rng, rngs::StdRng};
-use tracing::error;
 
 pub use crate::evm::safe_signer;
 
-/// Integrity guard that binds a wallet's encrypted key ID to its Ethereum address.
-/// Both fields are included in the HMAC — swapping `aead_encrypted_id` in the DB
-/// invalidates the envelope MAC, and the AEAD ciphertext is also bound to `address`
-/// as AAD, so decryption fails too.
-#[derive(arbiter_macros::Hashable)]
-struct EvmWalletIntegrity {
-    aead_encrypted_id: i32,
-    address: Address,
-}
-
-impl Integrable for EvmWalletIntegrity {
-    const KIND: &'static str = "evm_wallet";
-}
-
 #[derive(Debug, thiserror::Error)]
 pub enum SignTransactionError {
     #[error("Wallet not found")]
     WalletNotFound,
 
-    #[error("Decrypted key does not match requested wallet address")]
-    KeyAddressMismatch,
-
-    #[error("Internal signing error")]
-    Internal,
-
     #[error("Database error: {0}")]
     Database(#[from] DatabaseError),
 
@@ -85,12 +64,6 @@ pub enum Error {
     Integrity(#[from] integrity::Error),
 }
 
-impl From<diesel::result::Error> for Error {
-    fn from(e: diesel::result::Error) -> Self {
-        Self::Database(DatabaseError::from(e))
-    }
-}
-
 #[derive(Actor)]
 pub struct EvmActor {
     pub vault: ActorRef<Vault>,
@@ -124,39 +97,20 @@ impl EvmActor {
 
         let aead_id: i32 = self
             .vault
-            .ask(CreateNew {
-                plaintext,
-                aad: address.as_slice().to_vec(),
-            })
+            .ask(CreateNew { plaintext })
             .await
             .map_err(|_| Error::VaultSend)?;
 
         let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let wallet_id = conn
-            .exclusive_transaction(async |conn| {
-                let wallet_id: i32 = insert_into(schema::evm_wallet::table)
-                    .values(&models::NewEvmWallet {
-                        address: address.as_slice().to_vec(),
-                        aead_encrypted_id: aead_id,
-                    })
-                    .returning(schema::evm_wallet::id)
-                    .get_result(conn)
-                    .await
-                    .map_err(DatabaseError::from)
-                    .map_err(Error::Database)?;
-
-                integrity::sign_entity(
-                    conn,
-                    &self.vault,
-                    &EvmWalletIntegrity { address, aead_encrypted_id: aead_id },
-                    wallet_id,
-                )
-                .await
-                .map_err(Error::Integrity)?;
-
-                Ok::<i32, Error>(wallet_id)
+        let wallet_id = insert_into(schema::evm_wallet::table)
+            .values(&models::NewEvmWallet {
+                address: address.as_slice().to_vec(),
+                aead_encrypted_id: aead_id,
             })
-            .await?;
+            .returning(schema::evm_wallet::id)
+            .get_result(&mut conn)
+            .await
+            .map_err(DatabaseError::from)?;
 
         Ok((wallet_id, address))
     }
@@ -206,14 +160,23 @@ impl EvmActor {
     }
 
     #[message]
-    pub async fn useragent_delete_grant(
-        &mut self,
-        grant_id: i32,
-    ) -> Result<(), Error> {
-        self.engine
-            .revoke_grant(grant_id)
+    pub async fn operator_delete_grant(&mut self, grant_id: i32) -> Result<(), Error> {
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+
+        let affected = diesel::update(schema::evm_basic_grant::table)
+            .filter(schema::evm_basic_grant::id.eq(grant_id))
+            .set(schema::evm_basic_grant::revoked_at.eq(models::SqliteTimestamp::now()))
+            .execute(&mut conn)
             .await
-            .map_err(Error::from)
+            .map_err(DatabaseError::from)?;
+
+        if affected == 0 {
+            return Err(Error::Database(DatabaseError::from(
+                diesel::result::Error::NotFound,
+            )));
+        }
+
+        Ok(())
     }
 
     #[message]
@@ -287,51 +250,16 @@ impl EvmActor {
             .ok_or(SignTransactionError::WalletNotFound)?;
         drop(conn);
 
-        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let attestation = integrity::verify_entity(
-            &mut conn,
-            &self.vault,
-            &EvmWalletIntegrity {
-                address: wallet_address,
-                aead_encrypted_id: wallet.aead_encrypted_id,
-            },
-            wallet.id.to_raw(),
-        )
-        .await
-        .map_err(|e| {
-            error!(?e, ?wallet.id, "EVM wallet integrity check failed");
-            SignTransactionError::Internal
-        })?;
-        drop(conn);
-
-        if attestation != integrity::AttestationStatus::Attested {
-            error!(
-                ?wallet.id,
-                "EVM wallet integrity unavailable; refusing to sign"
-            );
-            return Err(SignTransactionError::Internal);
-        }
-
         let raw_key: SafeCell<Vec<u8>> = self
             .vault
             .ask(Decrypt {
                 aead_id: wallet.aead_encrypted_id,
-                aad: wallet.address.clone(),
             })
             .await
             .map_err(|_| SignTransactionError::VaultSend)?;
 
         let signer = safe_signer::SafeSigner::from_cell(raw_key)?;
 
-        if signer.address() != wallet_address {
-            error!(
-                expected = %wallet_address,
-                actual = %signer.address(),
-                "Decrypted private key address does not match requested wallet"
-            );
-            return Err(SignTransactionError::KeyAddressMismatch);
-        }
-
         self.engine
             .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
             .await?;

server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs

@@ -11,9 +11,7 @@ use kameo::{
     prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
     reply::ReplySender,
 };
-use std::{ops::ControlFlow, time::Duration};
-
-const APPROVAL_TIMEOUT: Duration = Duration::from_secs(30);
+use std::ops::ControlFlow;
 
 pub struct Args {
     pub client: ClientProfile,
@@ -66,14 +64,6 @@ impl Actor for ClientApprovalController {
                 .await;
         }
 
-        let weak = actor_ref.downgrade();
-        tokio::spawn(async move {
-            tokio::time::sleep(APPROVAL_TIMEOUT).await;
-            if let Some(r) = weak.upgrade() {
-                let _ = r.tell(OnApprovalTimeout {}).await;
-            }
-        });
-
         Ok(this)
     }
 
@@ -114,14 +104,4 @@ impl ClientApprovalController {
             ctx.stop();
         }
     }
-
-    /// Fired after `APPROVAL_TIMEOUT` elapses. Any operator that hasn't responded
-    /// by then is treated as a denial to prevent zombie sessions from blocking the flow.
-    #[message(ctx)]
-    pub fn on_approval_timeout(&mut self, ctx: &mut Context<Self, ()>) {
-        if self.pending > 0 {
-            self.send_reply(Ok(false));
-            ctx.stop();
-        }
-    }
 }

server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs

@@ -20,8 +20,6 @@ pub mod client_connect_approval;
 
 pub struct FlowCoordinator {
     pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
-    /// Maps DB `client_id` → `ActorId` for fast connected-client lookup.
-    client_ids: HashMap<i32, ActorId>,
     operator_registry: ActorRef<OperatorRegistry>,
 }
 
@@ -29,7 +27,6 @@ impl FlowCoordinator {
     pub fn new(operator_registry: ActorRef<OperatorRegistry>) -> Self {
         Self {
             clients: HashMap::default(),
-            client_ids: HashMap::default(),
             operator_registry,
         }
     }
@@ -51,7 +48,6 @@ impl Actor for FlowCoordinator {
         _: ActorStopReason,
     ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
         if self.clients.remove(&id).is_some() {
-            self.client_ids.retain(|_, actor_id| *actor_id != id);
             info!(
                 ?id,
                 actor = "FlowCoordinator",
@@ -79,28 +75,14 @@ impl FlowCoordinator {
     #[message(ctx)]
     pub async fn register_client(
         &mut self,
-        client_id: i32,
         actor: ActorRef<ClientSession>,
         ctx: &mut Context<Self, ()>,
     ) {
-        info!(id = %actor.id(), client_id, actor = "FlowCoordinator", event = "client.connected");
+        info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected");
         ctx.actor_ref().link(&actor).await;
-        self.client_ids.insert(client_id, actor.id());
         self.clients.insert(actor.id(), actor);
     }
 
-    #[message]
-    pub fn is_client_connected(&self, client_id: i32) -> bool {
-        self.client_ids.contains_key(&client_id)
-    }
-
-    /// Returns the DB `client_ids` of all currently connected SDK clients.
-    /// Used by operator sessions on startup to seed their approved-client set.
-    #[message]
-    pub fn get_connected_client_ids(&self) -> Vec<i32> {
-        self.client_ids.keys().copied().collect()
-    }
-
     #[message(ctx)]
     pub async fn request_client_approval(
         &mut self,

server/crates/arbiter-server/src/actors/mod.rs

@@ -1,7 +1,8 @@
 use crate::{
     actors::{
         bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
-        operator_registry::OperatorRegistry, vault::Vault, vault_coordinator::VaultCoordinator,
+        operator_registry::OperatorRegistry, vault::Vault,
+        vault_coordinator::VaultCoordinator,
     },
     db,
 };
@@ -21,17 +22,17 @@ pub mod vault_coordinator;
 pub enum SpawnError {
     #[error("Failed to spawn Bootstrapper actor")]
     Bootstrapper(#[from] bootstrap::Error),
+
     #[error("Failed to spawn Vault actor")]
     Vault(#[from] vault::Error),
-    #[error("Failed to spawn VaultCoordinator actor")]
-    VaultCoordinator(#[from] vault_coordinator::Error),
 }
 
+/// Long-lived actors that are shared across all connections and handle global state and operations
 #[derive(Clone)]
 pub struct GlobalActors {
     pub vault: ActorRef<Vault>,
-    pub vault_coordinator: ActorRef<VaultCoordinator>,
     pub bootstrapper: ActorRef<Bootstrapper>,
+    pub vault_coordinator: ActorRef<VaultCoordinator>,
     pub flow_coordinator: ActorRef<FlowCoordinator>,
     pub operator_registry: ActorRef<OperatorRegistry>,
     pub evm: ActorRef<EvmActor>,
@@ -44,22 +45,22 @@ impl GlobalActors {
     }
 
     pub async fn spawn(db: db::DatabasePool) -> Result<Self, SpawnError> {
-        let events = Self::spawn_message_bus();
-        let vault = Vault::spawn(Vault::new(db.clone(), events.clone()).await?);
-        let bootstrapper = Bootstrapper::spawn(Bootstrapper::new(&db, events.clone()).await?);
-        let vault_coordinator =
-            VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault.clone()));
+        let message_bus = Self::spawn_message_bus();
+        let key_holder = Vault::spawn(Vault::new(db.clone(), message_bus.clone()).await?);
         let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default());
         Ok(Self {
-            bootstrapper,
-            evm: EvmActor::spawn(EvmActor::new(vault.clone(), db.clone())),
-            vault,
-            vault_coordinator,
+            bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
+            evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db.clone())),
+            vault_coordinator: VaultCoordinator::spawn(VaultCoordinator::new(
+                db,
+                key_holder.clone(),
+            )),
+            vault: key_holder,
             flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::new(
                 operator_registry.clone(),
             )),
             operator_registry,
-            events,
+            events: message_bus,
         })
     }
 }

server/crates/arbiter-server/src/actors/operator_registry.rs

@@ -20,8 +20,8 @@ impl Actor for OperatorRegistry {
 
     type Error = Infallible;
 
-    fn on_start(args: Self::Args, _: ActorRef<Self>) -> impl Future<Output = Result<Self, Self::Error>> {
-        std::future::ready(Ok(args))
+    async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> {
+        Ok(args)
     }
 
     async fn on_link_died(

server/crates/arbiter-server/src/actors/vault/mod.rs

@@ -6,12 +6,10 @@ use crate::{
     },
     db::{
         self,
-        custody::CustodyRecord,
         models::{self, RootKeyHistory, RootKeyHistoryId},
-        schema::{self},
+        schema,
     },
 };
-
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 
 use chrono::Utc;
@@ -24,7 +22,7 @@ use hmac::{KeyInit as _, Mac as _};
 use kameo::{Actor, Reply, actor::ActorRef, messages};
 use kameo_actors::message_bus::{MessageBus, Publish};
 use strum::{EnumDiscriminants, IntoDiscriminant};
-use tracing::{error, info, warn};
+use tracing::{error, info};
 
 pub mod events {
     #[derive(Clone, Copy)]
@@ -47,8 +45,6 @@ pub enum Error {
     Sealed,
     #[error("Invalid key provided")]
     InvalidKey,
-    #[error("Vault locked: too many failed unseal attempts")]
-    LockedOut,
 
     #[error("Requested aead entry not found")]
     NotFound,
@@ -62,14 +58,8 @@ pub enum Error {
     #[error("Database transaction error: {0}")]
     DatabaseTransaction(#[from] diesel::result::Error),
 
-    #[error("Custody storage error: {0}")]
-    Custody(#[from] db::custody::Error),
-
     #[error("Broken database")]
     BrokenDatabase,
-
-    #[error("Integrity key version mismatch: envelope uses key {envelope:?}, current key is {current:?}")]
-    KeyVersionMismatch { envelope: RootKeyHistoryId, current: RootKeyHistoryId },
 }
 
 struct Unsealed {
@@ -89,8 +79,6 @@ enum State {
     Unsealed(Unsealed),
 }
 
-const MAX_UNSEAL_ATTEMPTS: u32 = 5;
-
 /// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed).
 ///
 /// Provides API for encrypting and decrypting data using the vault root key.
@@ -100,10 +88,8 @@ pub struct Vault {
     db: db::DatabasePool,
     state: State,
     events: ActorRef<MessageBus>,
-    unseal_failures: u32,
 }
 
-#[messages]
 impl Vault {
     pub async fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Result<Self, Error> {
         let state = {
@@ -123,15 +109,10 @@ impl Vault {
             }
         };
 
-        Ok(Self {
-            db,
-            state,
-            events,
-            unseal_failures: 0,
-        })
+        Ok(Self { db, state, events })
     }
 
-    // Exclusive transaction to avoid race condtions if multiple vaults write
+    // Exclusive transaction to avoid race conditions if multiple vaults write
     // additional layer of protection against nonce-reuse
     async fn get_new_nonce(
         pool: &db::DatabasePool,
@@ -176,36 +157,37 @@ impl Vault {
             State::Sealed { .. } => Err(Error::Sealed),
         }
     }
+}
 
-    /// Create the root key and take the vault into the unsealed state.
+#[messages]
+impl Vault {
     #[message]
-    pub async fn bootstrap(
-        &mut self,
-        mut seal_key: KeyCell,
-        custody: Option<CustodyRecord>,
-    ) -> Result<(), Error> {
-        if !matches!(self.state, State::Unbootstrapped) {
+    pub async fn bootstrap(&mut self, mut seal_key: KeyCell) -> Result<(), Error> {
+        if !matches!(&self.state, State::Unbootstrapped) {
             return Err(Error::AlreadyBootstrapped);
         }
+
         let mut root_key = KeyCell::new_secure_random();
 
         // Zero nonces are fine because they are one-time
         let root_key_nonce = Nonce::default();
         let data_encryption_nonce = Nonce::default();
 
-        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|reader| {
-            let root_key_reader = reader.as_slice();
+        // Generate salt (kept for schema compat)
+        let root_key_salt = v1::generate_salt();
+
+        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|rk| {
             seal_key
-                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader)
+                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, rk.as_slice())
                 .map_err(|err| {
                     error!(?err, "Fatal bootstrap error");
                     Error::Encryption(err)
                 })
         })?;
 
+        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
         let mut conn = self.db.get().await?;
 
-        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
         let root_key_history_id = conn
             .transaction(async |conn| {
                 let root_key_history_id = insert_into(schema::root_key_history::table)
@@ -215,7 +197,7 @@ impl Vault {
                         root_key_encryption_nonce: root_key_nonce.to_vec(),
                         data_encryption_nonce: data_encryption_nonce_bytes.clone(),
                         schema_version: 1,
-                        salt: v1::generate_salt().to_vec(),
+                        salt: root_key_salt.to_vec(),
                     })
                     .returning(schema::root_key_history::id)
                     .get_result(&mut *conn)
@@ -226,11 +208,9 @@ impl Vault {
                     .execute(&mut *conn)
                     .await?;
 
-                if let Some(record) = custody.as_ref() {
-                    db::custody::write_record(&mut *conn, record).await?;
-                }
-
-                Result::<_, Error>::Ok(RootKeyHistoryId::from_raw(root_key_history_id))
+                Result::<_, diesel::result::Error>::Ok(RootKeyHistoryId::from_raw(
+                    root_key_history_id,
+                ))
             })
             .await?;
 
@@ -247,62 +227,46 @@ impl Vault {
 
     #[message]
     pub async fn try_unseal(&mut self, mut seal_key: KeyCell) -> Result<(), Error> {
-        if self.unseal_failures >= MAX_UNSEAL_ATTEMPTS {
-            return Err(Error::LockedOut);
-        }
-
         let State::Sealed {
             root_key_history_id,
         } = &self.state
         else {
             return Err(Error::NotBootstrapped);
         };
+        let root_key_history_id = *root_key_history_id;
 
-        // We don't want to hold connection while doing expensive KDF work
+        // We don't want to hold connection while doing expensive work
         let current_key = {
             let mut conn = self.db.get().await?;
             schema::root_key_history::table
-                .filter(schema::root_key_history::id.eq(*root_key_history_id))
+                .filter(schema::root_key_history::id.eq(root_key_history_id))
                 .select(RootKeyHistory::as_select())
                 .first(&mut conn)
                 .await?
         };
 
-        let mut root_key = SafeCell::new(current_key.ciphertext.clone());
-
         let nonce =
             Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(|()| {
                 error!("Broken database: invalid nonce for root key");
                 Error::BrokenDatabase
             })?;
 
-        if seal_key
-            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
-            .is_err()
-        {
-            self.unseal_failures += 1;
-            if self.unseal_failures >= MAX_UNSEAL_ATTEMPTS {
-                error!(
-                    attempts = self.unseal_failures,
-                    "Vault locked: maximum failed unseal attempts reached"
-                );
-            } else {
-                warn!(
-                    attempts = self.unseal_failures,
-                    remaining = MAX_UNSEAL_ATTEMPTS - self.unseal_failures,
-                    "Failed unseal attempt"
-                );
-            }
-            return Err(Error::InvalidKey);
-        }
+        let mut root_key_bytes = SafeCell::new(current_key.ciphertext.clone());
+        seal_key
+            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key_bytes)
+            .map_err(|err| {
+                error!(?err, "Failed to unseal root key: invalid seal key");
+                Error::InvalidKey
+            })?;
+
+        let root_key = KeyCell::try_from(root_key_bytes).map_err(|()| {
+            error!("Broken database: invalid encryption key size");
+            Error::BrokenDatabase
+        })?;
 
-        self.unseal_failures = 0;
         self.state = State::Unsealed(Unsealed {
             root_key_history_id: current_key.id,
-            root_key: KeyCell::try_from(root_key).map_err(|err| {
-                error!(?err, "Broken database: invalid encryption key size");
-                Error::BrokenDatabase
-            })?,
+            root_key,
         });
 
         info!("Vault unsealed successfully");
@@ -311,10 +275,26 @@ impl Vault {
         Ok(())
     }
 
-    /// Decrypts an AEAD entry. The `aad` must match the value used at encryption time;
-    /// a mismatch causes authentication failure, preventing cross-wallet key swaps.
     #[message]
-    pub async fn decrypt(&mut self, aead_id: i32, aad: Vec<u8>) -> Result<SafeCell<Vec<u8>>, Error> {
+    pub async fn seal(&mut self) -> Result<(), Error> {
+        let Unsealed {
+            root_key_history_id,
+            ..
+        } = Self::expect_unsealed(&mut self.state)?;
+
+        self.state = State::Sealed {
+            root_key_history_id: *root_key_history_id,
+        };
+        let _ = self.events.tell(Publish(events::VaultResealed)).await;
+        Ok(())
+    }
+}
+
+// Server-side cryptographic operations
+#[messages]
+impl Vault {
+    #[message]
+    pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
         let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?;
 
         let row: models::AeadEncrypted = {
@@ -336,15 +316,13 @@ impl Vault {
             Error::BrokenDatabase
         })?;
         let mut output = SafeCell::new(row.ciphertext);
-        root_key.decrypt_in_place(&nonce, &aad, &mut output)?;
+        root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?;
         Ok(output)
     }
 
-    /// Creates a new `aead_encrypted` entry and returns its ID.
-    /// The `aad` is bound into the ciphertext and must be reproduced exactly at decryption time.
     // Creates new `aead_encrypted` entry in the database and returns it's ID
     #[message]
-    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>, aad: Vec<u8>) -> Result<i32, Error> {
+    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>) -> Result<i32, Error> {
         let Unsealed {
             root_key,
             root_key_history_id,
@@ -356,7 +334,7 @@ impl Vault {
 
         let mut ciphertext_buffer = plaintext.write();
         let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut();
-        root_key.encrypt_in_place(&nonce, &aad, &mut *ciphertext_buffer)?;
+        root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?;
 
         let ciphertext = std::mem::take(ciphertext_buffer);
 
@@ -416,10 +394,7 @@ impl Vault {
         } = Self::expect_unsealed(&mut self.state)?;
 
         if *root_key_history_id != key_version {
-            return Err(Error::KeyVersionMismatch {
-                envelope: key_version,
-                current: *root_key_history_id,
-            });
+            return Ok(false);
         }
 
         let mut hmac = root_key.0.read_inline(|k| {
@@ -431,25 +406,12 @@ impl Vault {
 
         Ok(hmac.verify_slice(&expected_mac).is_ok())
     }
-
-    #[message]
-    pub async fn seal(&mut self) -> Result<(), Error> {
-        let Unsealed {
-            root_key_history_id,
-            ..
-        } = Self::expect_unsealed(&mut self.state)?;
-
-        self.state = State::Sealed {
-            root_key_history_id: *root_key_history_id,
-        };
-        let _ = self.events.tell(Publish(events::VaultResealed)).await;
-        Ok(())
-    }
 }
 
 #[cfg(test)]
 mod tests {
     use crate::actors::GlobalActors;
+    use arbiter_crypto::safecell::SafeCellHandle as _;
 
     use super::*;
 
@@ -457,8 +419,7 @@ mod tests {
         let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
             .await
             .unwrap();
-        let seal_key = KeyCell::from([0u8; 32]);
-        actor.bootstrap(seal_key, None).await.unwrap();
+        actor.bootstrap(KeyCell::from([0u8; 32])).await.unwrap();
         actor
     }
 
@@ -467,13 +428,12 @@ mod tests {
     async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
         let db = db::create_test_pool().await;
         let mut actor = bootstrapped_actor(&db).await;
-
         let State::Unsealed(Unsealed {
             root_key_history_id,
             ..
         }) = actor.state
         else {
-            panic!("expected unsealed state")
+            panic!("expected unsealed state");
         };
 
         let n1 = Vault::get_new_nonce(&db, root_key_history_id)
@@ -493,7 +453,7 @@ mod tests {
         assert_eq!(root_row.data_encryption_nonce, n2.to_vec());
 
         let id = actor
-            .create_new(SafeCell::new(b"post-interleave".to_vec()), b"test-aad".to_vec())
+            .create_new(SafeCell::new(b"post-interleave".to_vec()))
             .await
             .unwrap();
         let row: models::AeadEncrypted = schema::aead_encrypted::table

server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs

@@ -1,107 +1,59 @@
-//! Coordinates the multi-operator ceremonies that create and open the vault.
-//!
-//! The coordinator collects one passphrase per committee member, then hands the
-//! assembled material to [`Vault`] in a single message. It owns no Diesel code:
-//! everything it reads or writes goes through the [`db::custody`] functions.
+use std::collections::HashMap;
 
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-use argon2::RECOMMENDED_SALT_LEN;
-use kameo::{Actor, actor::ActorRef, error::SendError, messages};
-use rand::rngs::SysRng;
-use rand_core::{Rng as _, UnwrapErr};
+use diesel::{ExpressionMethods as _, QueryDsl};
+use diesel_async::RunQueryDsl;
+use kameo::{Actor, actor::ActorRef, messages};
+use rand_core::{OsRng, RngCore as _};
+use tracing::error;
 
 use crate::{
-    actors::vault::{self, Bootstrap, TryUnseal, Vault},
+    actors::vault::{Bootstrap, TryUnseal, Vault},
     crypto::{KeyCell, derive_key, encryption::v1::Nonce, shamir},
-    db::{
-        self,
-        custody::{CustodyRecord, EncryptedShare},
-        models::OperatorId,
-    },
+    db::{self, models, schema},
 };
 
-const SHARE_AAD: &[u8] = b"arbiter/shamir-share/v1";
-
 #[derive(Debug, thiserror::Error)]
 pub enum Error {
-    #[error("An ordinary committee is already being coordinated")]
+    #[error("Already coordinating a bootstrap")]
     AlreadyBootstrapping,
-    #[error("An unseal is already being coordinated")]
+    #[error("Already coordinating an unseal")]
     AlreadyUnsealing,
-    #[error("Bootstrap is not in progress")]
+    #[error("Bootstrap not in progress")]
     NotBootstrapping,
-    #[error("The operator already contributed")]
+    #[error("Unseal not in progress")]
+    NotUnsealing,
+    #[error("Operator already contributed")]
     DuplicateContribution,
-    #[error("The ordinary committee cannot be empty")]
-    EmptyCommittee,
-    #[error("Two-operator committees are unsupported")]
-    UnsupportedCommittee,
-    #[error(
-        "The ordinary committee cannot exceed {} members",
-        shamir::MAX_COMMITTEE_SIZE
-    )]
-    CommitteeTooLarge,
-    #[error("Invalid passphrase")]
+    #[error("Operator not found in database")]
+    OperatorNotFound,
+    #[error("Invalid passphrase (decryption failed)")]
     InvalidPassphrase,
-    #[error("Broken database")]
-    BrokenDatabase,
     #[error("Shamir error: {0}")]
     Shamir(String),
     #[error("Database connection error: {0}")]
     DatabaseConnection(#[from] db::PoolError),
-    #[error("Custody storage error: {0}")]
-    Custody(#[from] db::custody::Error),
+    #[error("Database query error: {0}")]
+    DatabaseQuery(#[from] diesel::result::Error),
     #[error("Encryption error")]
     Encryption,
-    #[error("The vault is already bootstrapped")]
-    AlreadyBootstrapped,
     #[error("Vault error")]
-    Vault,
-}
-
-/// Passphrases gathered so far, in contribution order.
-///
-/// A `Vec` rather than a map because [`SafeCell`] values are neither cloneable
-/// nor hashable, and a committee holds at most
-/// [`shamir::MAX_COMMITTEE_SIZE`] of them.
-#[derive(Default)]
-struct Contributions(Vec<(OperatorId, SafeCell<Vec<u8>>)>);
-
-impl Contributions {
-    fn contains(&self, operator_id: OperatorId) -> bool {
-        self.0.iter().any(|(id, _)| *id == operator_id)
-    }
-
-    fn put(&mut self, operator_id: OperatorId, passphrase: SafeCell<Vec<u8>>) {
-        match self.0.iter_mut().find(|(id, _)| *id == operator_id) {
-            Some(slot) => slot.1 = passphrase,
-            None => self.0.push((operator_id, passphrase)),
-        }
-    }
-
-    const fn len(&self) -> usize {
-        self.0.len()
-    }
-
-    fn operators(&self) -> Vec<OperatorId> {
-        self.0.iter().map(|(id, _)| *id).collect()
-    }
+    VaultError,
+    #[error("Broken database")]
+    BrokenDatabase,
 }
 
+// Passphrases stored as plain Vec<u8> (not SafeCell) so CoordinatorState is Sync.
+// They are ephemeral and dropped immediately after use.
 enum CoordinatorState {
     Idle,
     Bootstrapping {
-        /// The operator that declared the committee. Only they may re-declare
-        /// it, which is the way out of a ceremony the others never finish.
-        declarer: OperatorId,
         declared_count: usize,
-        contributions: Contributions,
-        retryable: bool,
+        passphrases: HashMap<i32, Vec<u8>>,
     },
     Unsealing {
         threshold: usize,
-        contributions: Contributions,
-        retryable: bool,
+        passphrases: HashMap<i32, Vec<u8>>,
     },
 }
 
@@ -122,257 +74,239 @@ impl VaultCoordinator {
     }
 }
 
-/// Explain why a committee size was rejected.
-const fn committee_error(declared_count: usize) -> Error {
-    match declared_count {
-        0 => Error::EmptyCommittee,
-        2 => Error::UnsupportedCommittee,
-        _ => Error::CommitteeTooLarge,
+const SHARE_AAD: &[u8] = b"arbiter/shamir-share/v1";
+
+const fn shamir_threshold(n: usize) -> usize {
+    match n {
+        0 => panic!("No operators"),
+        1 => 1,
+        2 => 2,
+        n => n / 2 + 1,
     }
 }
 
-fn encrypt_share(
-    passphrase: &mut SafeCell<Vec<u8>>,
-    share: &[u8],
-) -> Result<EncryptedShare, Error> {
-    let mut salt = [0u8; RECOMMENDED_SALT_LEN];
-    UnwrapErr(SysRng).fill_bytes(&mut salt);
-
-    let nonce = Nonce::default();
-    let ciphertext = derive_key(passphrase, &salt)
-        .encrypt(&nonce, SHARE_AAD, share)
-        .map_err(|_| Error::Encryption)?;
-
-    Ok(EncryptedShare {
-        ciphertext,
-        nonce: nonce.to_vec(),
-        salt: salt.to_vec(),
-    })
-}
-
-fn decrypt_share(
-    passphrase: &mut SafeCell<Vec<u8>>,
-    share: EncryptedShare,
-) -> Result<SafeCell<Vec<u8>>, Error> {
-    let nonce = Nonce::try_from(share.nonce.as_slice()).map_err(|()| Error::BrokenDatabase)?;
-
-    let mut buffer = SafeCell::new(share.ciphertext);
-    derive_key(passphrase, &share.salt)
-        .decrypt_in_place(&nonce, SHARE_AAD, &mut buffer)
-        .map_err(|_| Error::InvalidPassphrase)?;
-
-    Ok(buffer)
-}
-
-const fn bootstrap_error(error: &SendError<Bootstrap, vault::Error>) -> Error {
-    match error {
-        SendError::HandlerError(vault::Error::AlreadyBootstrapped) => Error::AlreadyBootstrapped,
-        _ => Error::Vault,
-    }
-}
-
-/// Build the custody record and hand it to the vault, which stores it in the
-/// same transaction as the root key.
 async fn finalize_bootstrap(
-    vault: &ActorRef<Vault>,
-    contributions: &mut Contributions,
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    passphrases: HashMap<i32, Vec<u8>>,
 ) -> Result<(), Error> {
-    let total = contributions.len();
-    let threshold = shamir::shamir_threshold(total).ok_or_else(|| committee_error(total))?;
+    let total = passphrases.len();
+    let threshold = shamir_threshold(total);
 
-    let mut seal_key = KeyCell::new_secure_random();
-    let mut shares = shamir::split_key(threshold, total, &mut seal_key, UnwrapErr(SysRng))
-        .map_err(|error| Error::Shamir(error.to_string()))?;
+    // Generate random 32-byte seal key
+    let mut seal_key_bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut seal_key_bytes);
 
-    if shares.len() < total {
-        return Err(Error::Shamir("missing share for operator".to_owned()));
-    }
+    // Split seal key into shares using Shamir (OsRng from rand_core 0.6, compatible with vsss-rs)
+    let shares = shamir::split_key(threshold, total, &seal_key_bytes, OsRng)
+        .map_err(|e| Error::Shamir(e.to_string()))?;
 
-    let mut encrypted = Vec::with_capacity(total);
-    for ((operator_id, passphrase), share) in contributions.0.iter_mut().zip(shares.iter_mut()) {
-        let share = share.read_inline(|share| encrypt_share(passphrase, share))?;
-        encrypted.push((*operator_id, share));
+    let seal_key = KeyCell::from(seal_key_bytes);
+
+    let mut conn = db.get().await?;
+
+    for ((operator_id_raw, passphrase_bytes), share) in passphrases.into_iter().zip(shares) {
+        // Generate a fresh share_salt for this operator
+        let mut share_salt = vec![0u8; 32];
+        OsRng.fill_bytes(&mut share_salt);
+
+        // Derive share encryption key from passphrase + salt
+        let mut passphrase_cell = SafeCell::new(passphrase_bytes);
+        let mut share_seal_key = derive_key(&mut passphrase_cell, &share_salt);
+
+        // Encrypt this operator's share
+        let nonce = Nonce::default();
+        let encrypted_share = share_seal_key
+            .encrypt(&nonce, SHARE_AAD, &share)
+            .map_err(|_| Error::Encryption)?;
+
+        let nonce_bytes = nonce.to_vec();
+
+        diesel::replace_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(Some(operator_id_raw)),
+                schema::operator::share.eq(&encrypted_share),
+                schema::operator::share_nonce.eq(&nonce_bytes),
+                schema::operator::share_salt.eq(&share_salt),
+                schema::operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
     }
 
     vault
-        .ask(Bootstrap {
-            seal_key,
-            custody: Some(CustodyRecord {
-                threshold,
-                shares: encrypted,
-            }),
-        })
+        .ask(Bootstrap { seal_key })
         .await
-        .map_err(|error| bootstrap_error(&error))
+        .map_err(|err| {
+            error!(?err, "Vault bootstrap failed");
+            Error::VaultError
+        })?;
+
+    Ok(())
 }
 
-/// Reconstruct the seal key from the contributed passphrases and unseal.
 async fn finalize_unseal(
-    db: &db::DatabasePool,
-    vault: &ActorRef<Vault>,
-    threshold: usize,
-    contributions: &mut Contributions,
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    passphrases: HashMap<i32, Vec<u8>>,
 ) -> Result<(), Error> {
-    let stored = {
-        let mut conn = db.get().await?;
-        db::custody::shares(&mut conn, &contributions.operators()).await?
-    };
+    let mut conn = db.get().await?;
+    let mut shares: Vec<Vec<u8>> = Vec::new();
 
-    let mut plaintext = Vec::with_capacity(stored.len());
-    for ((_, passphrase), share) in contributions.0.iter_mut().zip(stored) {
-        plaintext.push(decrypt_share(passphrase, share)?);
+    for (operator_id_raw, passphrase_bytes) in passphrases {
+        let (encrypted_share, share_nonce_bytes, share_salt): (Vec<u8>, Vec<u8>, Vec<u8>) =
+            schema::operator::table
+                .filter(schema::operator::id.eq(Some(operator_id_raw)))
+                .select((
+                    schema::operator::share,
+                    schema::operator::share_nonce,
+                    schema::operator::share_salt,
+                ))
+                .first(&mut conn)
+                .await
+                .map_err(|_| Error::OperatorNotFound)?;
+
+        let nonce = Nonce::try_from(share_nonce_bytes.as_slice()).map_err(|()| {
+            error!(operator_id = operator_id_raw, "Invalid nonce in DB");
+            Error::BrokenDatabase
+        })?;
+
+        let mut passphrase_cell = SafeCell::new(passphrase_bytes);
+        let mut share_seal_key = derive_key(&mut passphrase_cell, &share_salt);
+
+        let mut share_buffer = SafeCell::new(encrypted_share);
+        share_seal_key
+            .decrypt_in_place(&nonce, SHARE_AAD, &mut share_buffer)
+            .map_err(|_| Error::InvalidPassphrase)?;
+
+        let decrypted_share = share_buffer.read().clone();
+        shares.push(decrypted_share);
     }
 
-    let seal_key = shamir::combine_shares(threshold, &mut plaintext)
-        .map_err(|error| Error::Shamir(error.to_string()))?;
+    let seal_key_bytes =
+        shamir::combine_shares(&shares).map_err(|e| Error::Shamir(e.to_string()))?;
+
+    let seal_key = KeyCell::from(seal_key_bytes);
 
     vault
         .ask(TryUnseal { seal_key })
         .await
-        .map_err(|_| Error::Vault)
+        .map_err(|err| {
+            error!(?err, "Vault unseal failed");
+            Error::VaultError
+        })?;
+
+    Ok(())
 }
 
 #[messages]
 impl VaultCoordinator {
-    /// Announce how many operators will contribute to the bootstrap.
-    ///
-    /// The declaring operator may re-declare to restart the ceremony; that is
-    /// the only way to release a committee whose members never all show up.
+    /// Phase 1 of multi-operator bootstrap: declare the committee size.
     #[message]
-    pub fn start_bootstrap(
+    #[expect(clippy::unused_async, reason = "kameo requires messages to be async")]
+    pub async fn start_bootstrap(
         &mut self,
-        operator_id: OperatorId,
+        operator_id: i32,
         declared_count: usize,
     ) -> Result<(), Error> {
-        if shamir::shamir_threshold(declared_count).is_none() {
-            return Err(committee_error(declared_count));
+        let _ = operator_id; // fixme!: any authenticated operator may announce the committee size. the first call wins
+        if !matches!(self.state, CoordinatorState::Idle) {
+            return Err(Error::AlreadyBootstrapping);
         }
-
-        match &self.state {
-            CoordinatorState::Unsealing { .. } => return Err(Error::AlreadyUnsealing),
-            CoordinatorState::Bootstrapping { declarer, .. } if *declarer != operator_id => {
-                return Err(Error::AlreadyBootstrapping);
-            }
-            CoordinatorState::Bootstrapping { .. } | CoordinatorState::Idle => {}
-        }
-
         self.state = CoordinatorState::Bootstrapping {
-            declarer: operator_id,
             declared_count,
-            contributions: Contributions::default(),
-            retryable: false,
+            passphrases: HashMap::new(),
         };
         Ok(())
     }
 
+    /// Phase 2 of multi-operator bootstrap: contribute a passphrase.
+    /// Returns Ok(true) when all operators contributed and bootstrap finalized.
     #[message]
     pub async fn contribute_bootstrap(
         &mut self,
-        operator_id: OperatorId,
-        passphrase: SafeCell<Vec<u8>>,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
     ) -> Result<bool, Error> {
         let CoordinatorState::Bootstrapping {
             declared_count,
-            contributions,
-            retryable,
-            ..
+            passphrases,
         } = &mut self.state
         else {
             return Err(Error::NotBootstrapping);
         };
 
-        if contributions.contains(operator_id) && !*retryable {
+        if passphrases.contains_key(&operator_id) {
             return Err(Error::DuplicateContribution);
         }
-        contributions.put(operator_id, passphrase);
-        *retryable = false;
 
-        if contributions.len() < *declared_count {
+        // Extract bytes immediately so state stays Sync
+        let passphrase_bytes = passphrase.read().to_vec();
+        passphrases.insert(operator_id, passphrase_bytes);
+
+        if passphrases.len() < *declared_count {
             return Ok(false);
         }
 
-        let state = std::mem::replace(&mut self.state, CoordinatorState::Idle);
-        let CoordinatorState::Bootstrapping {
-            declarer,
-            declared_count,
-            mut contributions,
-            ..
-        } = state
+        let CoordinatorState::Bootstrapping { passphrases, .. } =
+            std::mem::replace(&mut self.state, CoordinatorState::Idle)
         else {
-            unreachable!("state was matched as Bootstrapping above")
+            unreachable!()
         };
 
-        match finalize_bootstrap(&self.vault, &mut contributions).await {
-            Ok(()) => Ok(true),
-            Err(error) => {
-                self.state = CoordinatorState::Bootstrapping {
-                    declarer,
-                    declared_count,
-                    contributions,
-                    retryable: true,
-                };
-                Err(error)
-            }
-        }
+        finalize_bootstrap(self.db.clone(), self.vault.clone(), passphrases).await?;
+        Ok(true)
     }
 
+    /// Contribute a passphrase for vault unseal.
+    /// Returns Ok(true) when threshold reached and vault is unsealed.
     #[message]
     pub async fn contribute_unseal(
         &mut self,
-        operator_id: OperatorId,
-        passphrase: SafeCell<Vec<u8>>,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
     ) -> Result<bool, Error> {
         if matches!(self.state, CoordinatorState::Idle) {
-            let threshold = {
-                let mut conn = self.db.get().await?;
-                db::custody::threshold(&mut conn).await?
-            };
+            let mut conn = self.db.get().await?;
+            let count: i64 = schema::operator::table
+                .count()
+                .get_result(&mut conn)
+                .await?;
+            let threshold = shamir_threshold(usize::try_from(count).unwrap_or_default());
+
             self.state = CoordinatorState::Unsealing {
                 threshold,
-                contributions: Contributions::default(),
-                retryable: false,
+                passphrases: HashMap::new(),
             };
         }
 
         let CoordinatorState::Unsealing {
             threshold,
-            contributions,
-            retryable,
+            passphrases,
         } = &mut self.state
         else {
-            return Err(Error::AlreadyBootstrapping);
+            return Err(Error::NotUnsealing);
         };
 
-        if contributions.contains(operator_id) && !*retryable {
+        if passphrases.contains_key(&operator_id) {
             return Err(Error::DuplicateContribution);
         }
-        contributions.put(operator_id, passphrase);
-        *retryable = false;
 
-        if contributions.len() < *threshold {
+        let passphrase_bytes = passphrase.read().to_vec();
+        passphrases.insert(operator_id, passphrase_bytes);
+
+        if passphrases.len() < *threshold {
             return Ok(false);
         }
 
-        let state = std::mem::replace(&mut self.state, CoordinatorState::Idle);
-        let CoordinatorState::Unsealing {
-            threshold,
-            mut contributions,
-            ..
-        } = state
+        let CoordinatorState::Unsealing { passphrases, .. } =
+            std::mem::replace(&mut self.state, CoordinatorState::Idle)
         else {
-            unreachable!("state was matched as Unsealing above")
+            unreachable!()
         };
 
-        match finalize_unseal(&self.db, &self.vault, threshold, &mut contributions).await {
-            Ok(()) => Ok(true),
-            Err(error) => {
-                self.state = CoordinatorState::Unsealing {
-                    threshold,
-                    contributions,
-                    retryable: true,
-                };
-                Err(error)
-            }
-        }
+        finalize_unseal(self.db.clone(), self.vault.clone(), passphrases).await?;
+        Ok(true)
     }
 }

server/crates/arbiter-server/src/crypto/encryption/v1.rs

@@ -62,10 +62,11 @@ mod tests {
     fn derive_seal_key_deterministic() {
         static PASSWORD: &[u8] = b"password";
         let mut password = SafeCell::new(PASSWORD.to_vec());
+        let mut password2 = SafeCell::new(PASSWORD.to_vec());
         let salt = generate_salt();
 
         let mut key1 = derive_key(&mut password, &salt);
-        let mut key2 = derive_key(&mut password, &salt);
+        let mut key2 = derive_key(&mut password2, &salt);
 
         let key1_reader = key1.0.read();
         let key2_reader = key2.0.read();

server/crates/arbiter-server/src/crypto/integrity/v1.rs

@@ -192,9 +192,7 @@ pub async fn verify_entity<E: Integrable>(
         Ok(false) => Err(Error::MacMismatch {
             entity_kind: E::KIND,
         }),
-        Err(SendError::HandlerError(
-            vault::Error::Sealed | vault::Error::KeyVersionMismatch { .. },
-        )) => Ok(AttestationStatus::Unavailable),
+        Err(SendError::HandlerError(vault::Error::Sealed)) => Ok(AttestationStatus::Unavailable),
         Err(_) => Err(Error::VaultSend),
     }
 }
@@ -215,10 +213,8 @@ mod tests {
             GlobalActors,
             vault::{Bootstrap, Vault},
         },
-        crypto::KeyCell,
         db::{self, schema},
     };
-
     use super::{Error, Integrable, sign_entity, verify_entity};
     #[derive(Clone, arbiter_macros::Hashable)]
     struct DummyEntity {
@@ -237,8 +233,7 @@ mod tests {
         );
         actor
             .ask(Bootstrap {
-                seal_key: KeyCell::from([0u8; 32]),
-                custody: None,
+                seal_key: crate::crypto::KeyCell::from([0u8; 32]),
             })
             .await
             .unwrap();
@@ -334,47 +329,4 @@ mod tests {
             .unwrap_err();
         assert!(matches!(err, Error::MacMismatch { .. }));
     }
-
-    #[tokio::test]
-    async fn key_version_mismatch_returns_unavailable_not_mac_mismatch() {
-        use crate::db::schema::integrity_envelope;
-        use super::AttestationStatus;
-
-        const ENTITY_ID: &[u8] = b"entity-id-rotation-test";
-
-        let db = db::create_test_pool().await;
-        let vault = bootstrapped_vault(&db).await;
-        let mut conn = db.get().await.unwrap();
-
-        let entity = DummyEntity {
-            payload_version: 1,
-            payload: b"payload-v1".to_vec(),
-        };
-
-        sign_entity(&mut conn, &vault, &entity, ENTITY_ID)
-            .await
-            .unwrap();
-
-        // Simulate key rotation: update the stored key_version to a stale value.
-        // After real rotation the vault's root_key_history_id would advance, but
-        // here we achieve the same mismatch by back-dating the envelope's key_version.
-        diesel::update(integrity_envelope::table)
-            .filter(integrity_envelope::entity_kind.eq("dummy_entity"))
-            .filter(integrity_envelope::entity_id.eq(ENTITY_ID))
-            .set(integrity_envelope::key_version.eq(0))
-            .execute(&mut conn)
-            .await
-            .unwrap();
-
-        // Must NOT error — version mismatch is Unavailable, not tampered.
-        let status = verify_entity(&mut conn, &vault, &entity, ENTITY_ID)
-            .await
-            .expect("key version mismatch must not be treated as an error");
-
-        assert_eq!(
-            status,
-            AttestationStatus::Unavailable,
-            "stale key_version must yield Unavailable, not MacMismatch"
-        );
-    }
 }

server/crates/arbiter-server/src/crypto/mod.rs

@@ -21,10 +21,9 @@ impl From<SafeCell<Key>> for KeyCell {
         Self(value)
     }
 }
-
 impl From<[u8; 32]> for KeyCell {
     fn from(bytes: [u8; 32]) -> Self {
-        let cell = SafeCell::new_inline(|key: &mut Key| {
+        let cell = SafeCell::new_inline_default(|key: &mut Key| {
             key.copy_from_slice(&bytes);
         });
         Self(cell)
@@ -39,7 +38,7 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
         if value.len() != size_of::<Key>() {
             return Err(());
         }
-        let cell = SafeCell::new_inline(|cell_write: &mut Key| {
+        let cell = SafeCell::new_inline_default(|cell_write: &mut Key| {
             cell_write.copy_from_slice(&value);
         });
         Ok(Self(cell))
@@ -48,7 +47,7 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
 
 impl KeyCell {
     pub fn new_secure_random() -> Self {
-        let key = SafeCell::new_inline(|key_buffer: &mut Key| {
+        let key = SafeCell::new_inline_default(|key_buffer: &mut Key| {
             let mut rng = StdRng::try_from_rng(&mut SysRng)
                 .expect("Rng failure is unrecoverable and should panic");
             rng.fill_bytes(key_buffer);
@@ -69,7 +68,6 @@ impl KeyCell {
         let buffer = buffer.as_mut();
         cipher.encrypt_in_place(nonce, associated_data, buffer)
     }
-
     pub fn decrypt_in_place(
         &mut self,
         nonce: &Nonce,
@@ -105,10 +103,7 @@ impl KeyCell {
     }
 }
 
-/// Derive a fixed-length key from a passphrase using Argon2id.
-///
-/// The passphrase is borrowed so that callers can keep it in protected memory
-/// and reuse it across retries instead of handing over a copy.
+/// Derive a fixed-length key from the password using Argon2id, which is designed for password hashing and key derivation.
 pub fn derive_key(password: &mut SafeCell<Vec<u8>>, salt: &[u8]) -> KeyCell {
     let params = {
         #[cfg(debug_assertions)]
@@ -151,7 +146,7 @@ mod tests {
         let salt = generate_salt();
 
         let mut key = derive_key(&mut password, &salt);
-        let nonce = Nonce(*b"unique nonce 123 1231233");
+        let nonce = Nonce(*b"unique nonce 123 1231233"); // 24 bytes for XChaCha20Poly1305
         let associated_data = b"associated data";
         let mut buffer = b"secret data".to_vec();
 

server/crates/arbiter-server/src/crypto/shamir.rs

@@ -1,221 +1,29 @@
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-use rand_core::CryptoRng;
 use vsss_rs::Gf256;
 
-use crate::crypto::KeyCell;
-
-/// GF(256) addresses shares by a non-zero byte, so no committee can exceed 255.
-pub const MAX_COMMITTEE_SIZE: usize = 255;
-
-/// Errors returned by Shamir split/combine operations.
 #[derive(Debug, thiserror::Error)]
 pub enum ShamirError {
-    #[error("failed to split key: {0}")]
+    #[error("Failed to split key: {0}")]
     Split(String),
-    #[error("failed to combine shares: {0}")]
+    #[error("Failed to combine shares: {0}")]
     Combine(String),
 }
 
-/// Return the required threshold for a Shamir share pool of `committee_size`.
-///
-/// A pool of two is rejected: a majority of two is two, which gives each holder
-/// a veto over every unseal without giving either one recovery. That rejects no
-/// supported committee, because a two-operator vault must carry at least one
-/// recovery share and so never splits into a pool of two -- see
-/// `docs/ARCHITECTURE.md` 3.9.
-#[expect(
-    clippy::integer_division,
-    reason = "majority thresholds use integer arithmetic"
-)]
-#[must_use]
-pub const fn shamir_threshold(committee_size: usize) -> Option<usize> {
-    match committee_size {
-        0 | 2 => None,
-        size if size > MAX_COMMITTEE_SIZE => None,
-        1 => Some(1),
-        size => Some(size / 2 + 1),
-    }
-}
-
-/// Split a seal key into `total` shares, `threshold` of which reconstruct it.
+/// Split `key` into `total` shares where any `threshold` shares can reconstruct it.
+/// Each returned Vec<u8> is a share with format [`identifier_byte`, `value_bytes`...].
 pub fn split_key(
     threshold: usize,
     total: usize,
-    key: &mut KeyCell,
-    rng: impl CryptoRng,
-) -> Result<Vec<SafeCell<Vec<u8>>>, ShamirError> {
-    if total == 0 || threshold == 0 || threshold > total || total == 2 || total > MAX_COMMITTEE_SIZE
-    {
-        return Err(ShamirError::Split(
-            "unsupported committee parameters".to_owned(),
-        ));
-    }
-
-    // Nothing to interpolate when one share suffices.
-    if threshold == 1 {
-        return Ok(key.0.read_inline(|key| {
-            std::iter::repeat_with(|| SafeCell::new(key.as_slice().to_vec()))
-                .take(total)
-                .collect()
-        }));
-    }
-
-    key.0.read_inline(|key| {
-        let key: &[u8; 32] = key
-            .as_slice()
-            .try_into()
-            .map_err(|_| ShamirError::Split("unexpected seal key length".to_owned()))?;
-
-        Gf256::split_array(threshold, total, key, rng)
-            .map(|shares| shares.into_iter().map(SafeCell::new).collect())
-            .map_err(|error| ShamirError::Split(format!("{error:?}")))
-    })
+    key: &[u8; 32],
+    rng: impl rand_core::RngCore + rand_core::CryptoRng,
+) -> Result<Vec<Vec<u8>>, ShamirError> {
+    Gf256::split_array(threshold, total, key.as_slice(), rng)
+        .map_err(|e| ShamirError::Split(format!("{e:?}")))
 }
 
-/// Combine shares back into the seal key.
-///
-/// `threshold` comes from storage rather than from the shapes of the shares:
-/// a one-of-one committee stores the key verbatim, and telling that apart by
-/// share length alone would misread any Shamir share that happened to be key
-/// sized.
-pub fn combine_shares(
-    threshold: usize,
-    shares: &mut [SafeCell<Vec<u8>>],
-) -> Result<KeyCell, ShamirError> {
-    if threshold == 0 {
-        return Err(ShamirError::Combine("threshold is zero".to_owned()));
-    }
-    if shares.len() < threshold {
-        return Err(ShamirError::Combine(
-            "not enough shares supplied".to_owned(),
-        ));
-    }
-
-    // Mirror of the one-of-one case in [`split_key`]: the share is the key.
-    if threshold == 1 {
-        let share = shares
-            .first_mut()
-            .ok_or_else(|| ShamirError::Combine("no shares supplied".to_owned()))?;
-        return reconstructed_key(share.read_inline(|share| SafeCell::new(share.clone())));
-    }
-
-    let mut gathered = SafeCell::new(Vec::with_capacity(shares.len()));
-    for share in shares.iter_mut() {
-        share.read_inline(|share| {
-            gathered.write_inline(|gathered| gathered.push(share.clone()));
-        });
-    }
-
-    let combined = gathered.read_inline(|gathered| {
-        Gf256::combine_array(gathered.as_slice())
-            .map(SafeCell::new)
-            .map_err(|error| ShamirError::Combine(format!("{error:?}")))
-    })?;
-
-    reconstructed_key(combined)
-}
-
-fn reconstructed_key(bytes: SafeCell<Vec<u8>>) -> Result<KeyCell, ShamirError> {
-    KeyCell::try_from(bytes)
-        .map_err(|()| ShamirError::Combine("unexpected reconstructed key length".to_owned()))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{MAX_COMMITTEE_SIZE, combine_shares, shamir_threshold, split_key};
-    use crate::crypto::KeyCell;
-    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-    use rand::rngs::SysRng;
-    use rand_core::UnwrapErr;
-    use rstest::rstest;
-
-    fn key_bytes(mut key: KeyCell) -> [u8; 32] {
-        key.0.read_inline(|key| {
-            let mut bytes = [0u8; 32];
-            bytes.copy_from_slice(key.as_slice());
-            bytes
-        })
-    }
-
-    fn select(shares: &mut [SafeCell<Vec<u8>>], indexes: &[usize]) -> Vec<SafeCell<Vec<u8>>> {
-        indexes
-            .iter()
-            .filter_map(|index| {
-                shares
-                    .get_mut(*index)
-                    .map(|share| share.read_inline(|share| SafeCell::new(share.clone())))
-            })
-            .collect()
-    }
-
-    #[rstest]
-    #[case(&[0, 1])]
-    #[case(&[0, 2])]
-    #[case(&[1, 2])]
-    fn threshold_shares_reconstruct_fixed_key(#[case] indexes: &[usize]) {
-        let expected = [9_u8; 32];
-        let mut key = KeyCell::from(expected);
-        let rng = UnwrapErr(SysRng);
-        let mut shares = split_key(2, 3, &mut key, rng).expect("split should succeed");
-        let mut selected = select(&mut shares, indexes);
-        let combined = combine_shares(2, &mut selected).expect("combine should succeed");
-        assert_eq!(key_bytes(combined), expected);
-    }
-
-    #[test]
-    fn one_of_one_round_trips_a_fixed_size_key() {
-        let expected = [7_u8; 32];
-        let mut key = KeyCell::from(expected);
-        let rng = UnwrapErr(SysRng);
-        let mut shares = split_key(1, 1, &mut key, rng).expect("split should succeed");
-        let combined = combine_shares(1, &mut shares).expect("combine should succeed");
-        assert_eq!(key_bytes(combined), expected);
-    }
-
-    #[test]
-    fn fewer_shares_than_threshold_is_rejected() {
-        let mut key = KeyCell::from([3_u8; 32]);
-        let rng = UnwrapErr(SysRng);
-        let mut shares = split_key(3, 5, &mut key, rng).expect("split should succeed");
-        let mut selected = select(&mut shares, &[0, 1]);
-        assert!(
-            combine_shares(3, &mut selected).is_err(),
-            "two of three shares must not reconstruct the key"
-        );
-    }
-
-    #[rstest]
-    #[case(0, None)]
-    #[case(1, Some(1))]
-    #[case(2, None)]
-    #[case(3, Some(2))]
-    #[case(4, Some(3))]
-    #[case(MAX_COMMITTEE_SIZE, Some(128))]
-    #[case(MAX_COMMITTEE_SIZE + 1, None)]
-    fn committee_threshold_is_a_majority(
-        #[case] committee_size: usize,
-        #[case] expected: Option<usize>,
-    ) {
-        assert_eq!(shamir_threshold(committee_size), expected);
-    }
-
-    #[test]
-    fn oversized_committee_is_rejected_by_split() {
-        let mut key = KeyCell::from([1_u8; 32]);
-        let rng = UnwrapErr(SysRng);
-        assert!(
-            split_key(129, MAX_COMMITTEE_SIZE + 1, &mut key, rng).is_err(),
-            "committees above the GF(256) share limit must be rejected"
-        );
-    }
-
-    #[test]
-    fn two_operator_committee_is_explicitly_unsupported() {
-        let mut key = KeyCell::from([7_u8; 32]);
-        let rng = UnwrapErr(SysRng);
-        assert!(
-            split_key(2, 2, &mut key, rng).is_err(),
-            "two-operator committees must be rejected"
-        );
-    }
+/// Reconstruct the secret from `threshold` or more shares.
+pub fn combine_shares(shares: &[Vec<u8>]) -> Result<[u8; 32], ShamirError> {
+    let bytes = Gf256::combine_array(shares)
+        .map_err(|e| ShamirError::Combine(format!("{e:?}")))?;
+    <[u8; 32]>::try_from(bytes.as_slice())
+        .map_err(|_| ShamirError::Combine("unexpected reconstructed key length".to_owned()))
 }

server/crates/arbiter-server/src/db/custody.rs

@@ -1,134 +0,0 @@
-//! Storage for Shamir custody material: the reconstruction threshold and the
-//! per-operator encrypted shares of the vault seal key.
-//!
-//! Every query lives here so that the actors above hold no Diesel code of their
-//! own. The functions borrow the caller's connection instead of taking one from
-//! the pool, which lets the vault write custody material inside the same
-//! transaction that stores the root key.
-
-use std::collections::HashMap;
-
-use diesel::{ExpressionMethods as _, QueryDsl, sqlite::Sqlite};
-use diesel_async::{AsyncConnection, RunQueryDsl};
-
-use crate::db::{
-    models::{OperatorId, SqliteTimestamp},
-    schema,
-};
-
-/// One Shamir share, encrypted under a key derived from its operator's passphrase.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct EncryptedShare {
-    pub ciphertext: Vec<u8>,
-    pub nonce: Vec<u8>,
-    pub salt: Vec<u8>,
-}
-
-/// Everything a bootstrap persists about custody, written as a single unit.
-#[derive(Debug)]
-pub struct CustodyRecord {
-    pub threshold: usize,
-    pub shares: Vec<(OperatorId, EncryptedShare)>,
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum Error {
-    #[error("Database query error: {0}")]
-    Query(#[from] diesel::result::Error),
-    #[error("Stored committee threshold is missing or out of range")]
-    BrokenThreshold,
-    #[error("Custody settings row is missing")]
-    MissingSettings,
-    #[error("No share stored for operator {0:?}")]
-    MissingShare(OperatorId),
-}
-
-/// Persist threshold and shares on the caller's connection, joining any
-/// transaction the caller has already opened.
-pub async fn write_record(
-    conn: &mut impl AsyncConnection<Backend = Sqlite>,
-    record: &CustodyRecord,
-) -> Result<(), Error> {
-    let threshold = i32::try_from(record.threshold).map_err(|_| Error::BrokenThreshold)?;
-
-    let now = SqliteTimestamp::now();
-    for (operator_id, share) in &record.shares {
-        diesel::replace_into(schema::operator::table)
-            .values((
-                schema::operator::id.eq(Some(*operator_id)),
-                schema::operator::share.eq(&share.ciphertext),
-                schema::operator::share_nonce.eq(&share.nonce),
-                schema::operator::share_salt.eq(&share.salt),
-                schema::operator::created_at.eq(now.clone()),
-                schema::operator::updated_at.eq(now.clone()),
-            ))
-            .execute(&mut *conn)
-            .await?;
-    }
-
-    let updated = diesel::update(schema::arbiter_settings::table)
-        .set(schema::arbiter_settings::shamir_threshold.eq(Some(threshold)))
-        .execute(&mut *conn)
-        .await?;
-    if updated != 1 {
-        return Err(Error::MissingSettings);
-    }
-
-    Ok(())
-}
-
-/// Number of shares required to reconstruct the seal key.
-pub async fn threshold(conn: &mut impl AsyncConnection<Backend = Sqlite>) -> Result<usize, Error> {
-    let stored: Option<i32> = schema::arbiter_settings::table
-        .select(schema::arbiter_settings::shamir_threshold)
-        .first(conn)
-        .await?;
-
-    stored
-        .and_then(|value| usize::try_from(value).ok())
-        .filter(|threshold| *threshold > 0)
-        .ok_or(Error::BrokenThreshold)
-}
-
-/// One row of the share query: operator id, ciphertext, nonce, salt.
-type ShareRow = (Option<OperatorId>, Vec<u8>, Vec<u8>, Vec<u8>);
-
-/// Load the shares of `operators` in one query, in the order requested.
-pub async fn shares(
-    conn: &mut impl AsyncConnection<Backend = Sqlite>,
-    operators: &[OperatorId],
-) -> Result<Vec<EncryptedShare>, Error> {
-    let wanted: Vec<Option<OperatorId>> = operators.iter().copied().map(Some).collect();
-
-    let rows: Vec<ShareRow> = schema::operator::table
-        .filter(schema::operator::id.eq_any(wanted))
-        .select((
-            schema::operator::id,
-            schema::operator::share,
-            schema::operator::share_nonce,
-            schema::operator::share_salt,
-        ))
-        .load(conn)
-        .await?;
-
-    let mut found: HashMap<OperatorId, EncryptedShare> = rows
-        .into_iter()
-        .filter_map(|(id, ciphertext, nonce, salt)| {
-            id.map(|id| {
-                (
-                    id,
-                    EncryptedShare {
-                        ciphertext,
-                        nonce,
-                        salt,
-                    },
-                )
-            })
-        })
-        .collect();
-
-    operators
-        .iter()
-        .map(|id| found.remove(id).ok_or(Error::MissingShare(*id)))
-        .collect()
-}

server/crates/arbiter-server/src/db/mod.rs

@@ -8,7 +8,6 @@ use diesel_migrations::{EmbeddedMigrations, MigrationHarness, embed_migrations};
 use thiserror::Error;
 use tracing::info;
 
-pub mod custody;
 pub mod models;
 pub mod schema;
 
@@ -155,39 +154,3 @@ pub async fn create_test_pool() -> DatabasePool {
         .await
         .expect("Failed to create test database pool")
 }
-
-#[cfg(test)]
-mod tests {
-    use diesel::{ExpressionMethods as _, result::DatabaseErrorKind};
-    use diesel_async::RunQueryDsl as _;
-
-    use super::*;
-
-    #[tokio::test]
-    async fn operator_share_salt_must_be_supplied_by_application() {
-        let pool = create_test_pool().await;
-        let mut conn = pool.get().await.expect("pool connection");
-
-        let operator_id = diesel::insert_into(schema::operator_identity::table)
-            .values(schema::operator_identity::public_key.eq(vec![1]))
-            .returning(schema::operator_identity::id)
-            .get_result::<i32>(&mut conn)
-            .await
-            .expect("insert operator identity");
-
-        let error = diesel::insert_into(schema::operator::table)
-            .values((
-                schema::operator::id.eq(operator_id),
-                schema::operator::share.eq(vec![2]),
-                schema::operator::share_nonce.eq(vec![3]),
-            ))
-            .execute(&mut conn)
-            .await
-            .expect_err("operator insert without an application-generated salt must fail");
-
-        assert!(matches!(
-            error,
-            diesel::result::Error::DatabaseError(DatabaseErrorKind::NotNullViolation, _)
-        ));
-    }
-}

server/crates/arbiter-server/src/db/models.rs

@@ -110,18 +110,6 @@ pub mod types {
                     ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
                 }
             }
-
-            impl arbiter_crypto::hashing::Hashable for $name {
-                fn hash<H: arbiter_crypto::hashing::Digest>(&self, hasher: &mut H) {
-                    arbiter_crypto::hashing::Hashable::hash(&self.0, hasher);
-                }
-            }
-
-            impl crate::crypto::integrity::v1::IntoId for $name {
-                fn into_id(self) -> Vec<u8> {
-                    crate::crypto::integrity::v1::IntoId::into_id(self.0)
-                }
-            }
         };
     }
 
@@ -215,7 +203,6 @@ pub struct ArbiterSettings {
     pub id: i32,
     pub root_key_id: Option<i32>, // references root_key_history.id
     pub tls_id: Option<i32>,      // references tls_history.id
-    pub shamir_threshold: Option<i32>,
 }
 
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]

server/crates/arbiter-server/src/db/schema.rs

@@ -17,7 +17,6 @@ diesel::table! {
         id -> Integer,
         root_key_id -> Nullable<Integer>,
         tls_id -> Nullable<Integer>,
-        shamir_threshold -> Nullable<Integer>,
     }
 }
 

server/crates/arbiter-server/src/evm/mod.rs

@@ -1,34 +1,28 @@
-use diesel_async::{AsyncConnection, RunQueryDsl};
-use kameo::actor::ActorRef;
-
 use crate::{
     actors::vault::Vault,
     crypto::integrity,
     db::{
         self, DatabaseError,
         models::{
-            EvmBasicGrant, EvmEtherTransferGrant, EvmEtherTransferGrantTarget,
-            EvmEtherTransferLimit, EvmTokenTransferGrant, EvmTokenTransferVolumeLimit,
-            EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
         },
         schema::{self, evm_transaction_log},
     },
     evm::policies::{
         CombinedSettings, DatabaseID, EvalContext, EvalViolation, Grant, Policy,
-        SharedGrantSettings, SpecificGrant, SpecificMeaning, VolumeRateLimit,
-        ether_transfer::EtherTransfer, token_transfers::TokenTransfer,
+        SharedGrantSettings, SpecificGrant, SpecificMeaning, ether_transfer::EtherTransfer,
+        token_transfers::TokenTransfer,
     },
 };
 
 use alloy::{
     consensus::TxEip1559,
-    primitives::{Address, TxKind, U256},
+    primitives::{TxKind, U256},
 };
 use chrono::Utc;
-use diesel::{
-    ExpressionMethods as _, OptionalExtension, QueryDsl as _, QueryResult, SelectableHelper,
-    insert_into, sqlite::Sqlite, update,
-};
+use diesel::{ExpressionMethods as _, QueryDsl as _, QueryResult, insert_into, sqlite::Sqlite};
+use diesel_async::{AsyncConnection, RunQueryDsl};
+use kameo::actor::ActorRef;
 
 pub mod abi;
 pub mod safe_signer;
@@ -278,151 +272,6 @@ impl Engine {
         Ok(id)
     }
 
-    pub async fn revoke_grant(
-        &self,
-        basic_grant_id: i32,
-    ) -> Result<(), DatabaseError> {
-        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let vault = self.vault.clone();
-
-        conn.transaction(async move |conn| {
-            use crate::db::schema::{
-                evm_basic_grant, evm_ether_transfer_grant, evm_ether_transfer_grant_target,
-                evm_ether_transfer_limit, evm_token_transfer_grant,
-                evm_token_transfer_volume_limit,
-            };
-
-            update(evm_basic_grant::table)
-                .filter(evm_basic_grant::id.eq(basic_grant_id))
-                .set(evm_basic_grant::revoked_at.eq(SqliteTimestamp(Utc::now())))
-                .execute(&mut *conn)
-                .await?;
-
-            let basic_grant: EvmBasicGrant = evm_basic_grant::table
-                .filter(evm_basic_grant::id.eq(basic_grant_id))
-                .select(EvmBasicGrant::as_select())
-                .first(&mut *conn)
-                .await?;
-
-            let shared = SharedGrantSettings::try_from_model(basic_grant)?;
-
-            if let Some(ether_grant) = evm_ether_transfer_grant::table
-                .filter(evm_ether_transfer_grant::basic_grant_id.eq(basic_grant_id))
-                .select(EvmEtherTransferGrant::as_select())
-                .first(&mut *conn)
-                .await
-                .optional()?
-            {
-                let target_rows: Vec<EvmEtherTransferGrantTarget> =
-                    evm_ether_transfer_grant_target::table
-                        .filter(evm_ether_transfer_grant_target::grant_id.eq(ether_grant.id))
-                        .select(EvmEtherTransferGrantTarget::as_select())
-                        .load(&mut *conn)
-                        .await?;
-                let targets: Vec<Address> = target_rows
-                    .into_iter()
-                    .filter_map(|target| {
-                        let arr: [u8; 20] = target.address.try_into().ok()?;
-                        Some(Address::from(arr))
-                    })
-                    .collect();
-
-                let limit: EvmEtherTransferLimit = evm_ether_transfer_limit::table
-                    .filter(evm_ether_transfer_limit::id.eq(ether_grant.limit_id))
-                    .select(EvmEtherTransferLimit::as_select())
-                    .first(&mut *conn)
-                    .await?;
-
-                let settings = CombinedSettings {
-                    shared: shared.clone(),
-                    specific: policies::ether_transfer::Settings {
-                        target: targets,
-                        limit: VolumeRateLimit {
-                            max_volume: utils::try_bytes_to_u256(&limit.max_volume).map_err(
-                                |err| {
-                                    diesel::result::Error::DeserializationError(Box::new(err))
-                                },
-                            )?,
-                            window: chrono::Duration::seconds(limit.window_secs.into()),
-                        },
-                    },
-                };
-
-                integrity::sign_entity(&mut *conn, &vault, &settings, basic_grant_id)
-                    .await
-                    .map_err(|_| diesel::result::Error::RollbackTransaction)?;
-
-                return QueryResult::Ok(());
-            }
-
-            if let Some(token_grant) = evm_token_transfer_grant::table
-                .filter(evm_token_transfer_grant::basic_grant_id.eq(basic_grant_id))
-                .select(EvmTokenTransferGrant::as_select())
-                .first(&mut *conn)
-                .await
-                .optional()?
-            {
-                let volume_limit_rows: Vec<EvmTokenTransferVolumeLimit> =
-                    evm_token_transfer_volume_limit::table
-                        .filter(evm_token_transfer_volume_limit::grant_id.eq(token_grant.id))
-                        .select(EvmTokenTransferVolumeLimit::as_select())
-                        .load(&mut *conn)
-                        .await?;
-                let volume_limits: Vec<VolumeRateLimit> = volume_limit_rows
-                    .into_iter()
-                    .map(|row| {
-                        Ok(VolumeRateLimit {
-                            max_volume: utils::try_bytes_to_u256(&row.max_volume).map_err(
-                                |err| {
-                                    diesel::result::Error::DeserializationError(Box::new(err))
-                                },
-                            )?,
-                            window: chrono::Duration::seconds(row.window_secs.into()),
-                        })
-                    })
-                    .collect::<QueryResult<Vec<_>>>()?;
-
-                let target: Option<Address> = match token_grant.receiver {
-                    None => None,
-                    Some(bytes) => {
-                        let arr: [u8; 20] = bytes.try_into().map_err(|_| {
-                            diesel::result::Error::DeserializationError(
-                                "Invalid receiver address length".into(),
-                            )
-                        })?;
-                        Some(Address::from(arr))
-                    }
-                };
-
-                let token_contract: [u8; 20] =
-                    token_grant.token_contract.clone().try_into().map_err(|_| {
-                        diesel::result::Error::DeserializationError(
-                            "Invalid token contract address length".into(),
-                        )
-                    })?;
-
-                let settings = CombinedSettings {
-                    shared,
-                    specific: policies::token_transfers::Settings {
-                        token_contract: Address::from(token_contract),
-                        target,
-                        volume_limits,
-                    },
-                };
-
-                integrity::sign_entity(&mut *conn, &vault, &settings, basic_grant_id)
-                    .await
-                    .map_err(|_| diesel::result::Error::RollbackTransaction)?;
-
-                return QueryResult::Ok(());
-            }
-
-            Err(diesel::result::Error::NotFound)
-        })
-        .await
-        .map_err(DatabaseError::from)
-    }
-
     async fn list_one_kind<Kind: Policy, Y>(
         &self,
         conn: &mut impl AsyncConnection<Backend = Sqlite>,
@@ -505,12 +354,8 @@ mod tests {
     use chrono::{Duration, Utc};
     use diesel::{SelectableHelper, insert_into};
     use diesel_async::RunQueryDsl;
-    use kameo::{actor::ActorRef, prelude::Spawn};
     use rstest::rstest;
 
-    use crate::actors::{GlobalActors, vault::{Bootstrap, Vault}};
-    use crate::crypto::KeyCell;
-    use crate::crypto::integrity;
     use crate::db::{
         self, DatabaseConnection,
         models::{
@@ -519,10 +364,8 @@ mod tests {
         },
         schema::{evm_basic_grant, evm_transaction_log},
     };
-    use crate::evm::policies::ether_transfer::EtherTransfer;
     use crate::evm::policies::{
-        CombinedSettings, EvalContext, EvalViolation, Policy, SharedGrantSettings,
-        TransactionRateLimit, VolumeRateLimit,
+        EvalContext, EvalViolation, SharedGrantSettings, TransactionRateLimit,
     };
 
     use super::check_shared_constraints;
@@ -554,7 +397,6 @@ mod tests {
             chain: CHAIN_ID,
             valid_from: None,
             valid_until: None,
-            revoked_at: None,
             max_gas_fee_per_gas: None,
             max_priority_fee_per_gas: None,
             rate_limit: None,
@@ -763,116 +605,4 @@ mod tests {
             assert!(violations.is_empty());
         }
     }
-
-    async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> {
-        let actor = Vault::spawn(
-            Vault::new(db.clone(), GlobalActors::spawn_message_bus())
-                .await
-                .unwrap(),
-        );
-        actor
-            .ask(Bootstrap {
-                seal_key: KeyCell::from([0u8; 32]),
-                custody: None,
-            })
-            .await
-            .unwrap();
-        actor
-    }
-
-    #[tokio::test]
-    async fn revoke_grant_preserves_revoked_integrity() {
-        use crate::db::schema::evm_basic_grant;
-        use diesel::ExpressionMethods as _;
-
-        let db = db::create_test_pool().await;
-        let vault = bootstrapped_vault(&db).await;
-        let engine = super::Engine::new(db.clone(), vault.clone());
-
-        let full_grant = CombinedSettings {
-            shared: SharedGrantSettings {
-                wallet_access_id: WALLET_ACCESS_ID,
-                chain: CHAIN_ID,
-                valid_from: None,
-                valid_until: None,
-                revoked_at: None,
-                max_gas_fee_per_gas: None,
-                max_priority_fee_per_gas: None,
-                rate_limit: None,
-            },
-            specific: super::policies::ether_transfer::Settings {
-                target: vec![RECIPIENT],
-                limit: VolumeRateLimit {
-                    max_volume: U256::from(100u64),
-                    window: Duration::hours(1),
-                },
-            },
-        };
-
-        let grant_id = engine
-            .create_grant::<EtherTransfer>(full_grant)
-            .await
-            .unwrap();
-
-        engine.revoke_grant(grant_id).await.unwrap();
-
-        let mut conn = db.get().await.unwrap();
-        diesel::update(evm_basic_grant::table)
-            .filter(evm_basic_grant::id.eq(grant_id))
-            .set(evm_basic_grant::revoked_at.eq::<Option<SqliteTimestamp>>(None))
-            .execute(&mut conn)
-            .await
-            .unwrap();
-
-        let wallet_access = EvmWalletAccess {
-            id: WALLET_ACCESS_ID,
-            wallet_id: EvmWalletId::from_raw(10),
-            client_id: 20,
-            created_at: SqliteTimestamp(Utc::now()),
-        };
-        let context = EvalContext {
-            target: wallet_access,
-            chain: CHAIN_ID,
-            to: RECIPIENT,
-            value: U256::ONE,
-            calldata: Bytes::new(),
-            max_fee_per_gas: 1,
-            max_priority_fee_per_gas: 1,
-        };
-
-        let grant = EtherTransfer::try_find_grant(
-            &context, &mut conn,
-        )
-        .await
-        .unwrap()
-        .unwrap();
-
-        let result =
-            integrity::verify_entity(&mut conn, &vault, &grant.settings, grant.id).await;
-
-        assert!(matches!(
-            result,
-            Err(integrity::Error::MacMismatch { .. })
-        ));
-    }
-
-    #[test]
-    fn shared_settings_hash_changes_when_revoked_at_changes() {
-        use arbiter_crypto::hashing::Hashable;
-        use sha2::Digest;
-
-        let active = shared_settings();
-        let revoked = SharedGrantSettings {
-            revoked_at: Some(Utc::now()),
-            ..shared_settings()
-        };
-
-        let mut active_hash = sha2::Sha256::new();
-        active.hash(&mut active_hash);
-
-        let mut revoked_hash = sha2::Sha256::new();
-        revoked.hash(&mut revoked_hash);
-
-        assert_ne!(active_hash.finalize(), revoked_hash.finalize());
-    }
 }

server/crates/arbiter-server/src/evm/policies.rs

@@ -144,7 +144,6 @@ pub struct SharedGrantSettings {
 
     pub valid_from: Option<DateTime<Utc>>,
     pub valid_until: Option<DateTime<Utc>>,
-    pub revoked_at: Option<DateTime<Utc>>,
 
     pub max_gas_fee_per_gas: Option<U256>,
     pub max_priority_fee_per_gas: Option<U256>,
@@ -159,7 +158,6 @@ impl SharedGrantSettings {
             chain: model.chain_id.into(),
             valid_from: model.valid_from.map(Into::into),
             valid_until: model.valid_until.map(Into::into),
-            revoked_at: model.revoked_at.map(Into::into),
             max_gas_fee_per_gas: model
                 .max_gas_fee_per_gas
                 .map(|b| utils::try_bytes_to_u256(&b))

server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs

@@ -80,7 +80,6 @@ fn shared() -> SharedGrantSettings {
         chain: CHAIN_ID,
         valid_from: None,
         valid_until: None,
-        revoked_at: None,
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,

server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs

@@ -98,7 +98,6 @@ fn shared() -> SharedGrantSettings {
         chain: CHAIN_ID,
         valid_from: None,
         valid_until: None,
-        revoked_at: None,
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,

server/crates/arbiter-server/src/evm/safe_signer.rs

@@ -44,7 +44,7 @@ impl std::fmt::Debug for SafeSigner {
 /// Returns the protected key bytes and the derived Ethereum address.
 pub fn generate(rng: &mut impl rand::Rng) -> (SafeCell<[u8; 32]>, Address) {
     loop {
-        let mut cell = SafeCell::new_inline(|w: &mut [u8; 32]| {
+        let mut cell = SafeCell::new_inline_default(|w: &mut [u8; 32]| {
             rng.fill_bytes(w);
         });
 

server/crates/arbiter-server/src/grpc/client/auth.rs

@@ -200,7 +200,7 @@ impl Convert for auth::Outbound {
                         .timestamp
                         .timestamp_nanos_opt()
                         .expect("timestamp within range")
-                        .cast_unsigned(),
+                        as u64,
                     random: challenge.nonce.to_vec(),
                 })
             }

server/crates/arbiter-server/src/grpc/operator.rs

@@ -1,10 +1,11 @@
 use crate::{
     grpc::request_tracker::RequestTracker,
-    peers::operator::{OperatorConnection, OperatorSession, OutOfBand},
+    peers::operator::{OutOfBand, OperatorConnection, OperatorSession},
 };
 use arbiter_proto::{
     proto::operator::{
-        OperatorRequest, OperatorResponse, operator_request::Payload as OperatorRequestPayload,
+        OperatorRequest, OperatorResponse,
+        operator_request::Payload as OperatorRequestPayload,
         operator_response::Payload as OperatorResponsePayload,
     },
     transport::{Error as TransportError, Receiver, Sender, grpc::GrpcBi},
@@ -110,9 +111,6 @@ async fn dispatch_inner(
         OperatorRequestPayload::Vault(req) => vault::dispatch(actor, req).await,
         OperatorRequestPayload::Evm(req) => evm::dispatch(actor, req).await,
         OperatorRequestPayload::SdkClient(req) => sdk_client::dispatch(actor, req).await,
-        OperatorRequestPayload::Governance(_) => {
-            Err(Status::permission_denied(stringify!(Governance)))
-        }
         OperatorRequestPayload::Auth(..) => {
             warn!("Unsupported post-auth operator auth request");
             Err(Status::invalid_argument("Unsupported operator request"))

server/crates/arbiter-server/src/grpc/operator/auth.rs

@@ -80,7 +80,7 @@ impl Sender<Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {
                         .timestamp
                         .timestamp_nanos_opt()
                         .expect("timestamp within range")
-                        .cast_unsigned(),
+                        as u64,
                     random: challenge.nonce.to_vec(),
                 })
             }
@@ -171,7 +171,7 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
 
                 Some(auth::Inbound::AuthChallengeRequest {
                     pubkey,
-                    bootstrap_token: bootstrap_token.map(String::into_bytes),
+                    bootstrap_token,
                 })
             }
             AuthRequestPayload::ChallengeSolution(ProtoAuthChallengeSolution { signature }) => {

server/crates/arbiter-server/src/grpc/operator/evm.rs

@@ -217,11 +217,6 @@ async fn handle_sign_transaction(
                 result: Some(vet_error.convert()),
             }
         }
-        Err(kameo::error::SendError::HandlerError(
-            SessionSignTransactionError::ClientNotConnected,
-        )) => {
-            return Err(Status::permission_denied("client not connected"));
-        }
         Err(kameo::error::SendError::HandlerError(SessionSignTransactionError::Internal)) => {
             EvmSignTransactionResponse {
                 result: Some(EvmSignTransactionResult::Error(

server/crates/arbiter-server/src/grpc/operator/inbound.rs

@@ -86,7 +86,6 @@ impl TryConvert for ProtoSharedSettings {
                 .valid_until
                 .map(ProtoTimestamp::try_convert)
                 .transpose()?,
-            revoked_at: None,
             max_gas_fee_per_gas: self
                 .max_gas_fee_per_gas
                 .as_deref()

server/crates/arbiter-server/src/grpc/operator/vault.rs

@@ -33,11 +33,11 @@ pub(super) async fn dispatch(
 
     match payload {
         VaultRequestPayload::QueryState(()) => handle_query_vault_state(actor).await,
-        VaultRequestPayload::Unseal(_)
-        | VaultRequestPayload::Bootstrap(_)
-        | VaultRequestPayload::Rekey(_) => Err(Status::permission_denied(
-            "Vault is already unsealed; unseal/bootstrap not permitted in session",
-        )),
+        VaultRequestPayload::Unseal(_) | VaultRequestPayload::Bootstrap(_) => {
+            Err(Status::permission_denied(
+                "Vault is already unsealed; unseal/bootstrap not permitted in session",
+            ))
+        }
     }
 }
 

server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs

@@ -1,5 +1,4 @@
 use crate::{
-    crypto::shamir,
     grpc::{Convert, TryConvert},
     peers::operator::vault_gate::{
         self as vault_gate, HandleBootstrapEncryptedKey, HandleContributeBootstrapPassphrase,
@@ -53,7 +52,6 @@ impl TryConvert for VaultRequestPayload {
             Self::QueryState(()) => Ok(vault_gate::Inbound::HandleVaultState),
             Self::Unseal(req) => req.try_convert(),
             Self::Bootstrap(req) => req.try_convert(),
-            Self::Rekey(_) => Err(Status::unimplemented("Vault re-key is not available")),
         }
     }
 }
@@ -77,16 +75,13 @@ impl TryConvert for UnsealRequestPayload {
         match self {
             Self::Start(start) => start.try_convert(),
             Self::EncryptedKey(key) => Ok(key.convert()),
-            Self::ContributePassphrase(passphrase) => {
-                Ok(vault_gate::Inbound::HandleContributeUnsealPassphrase(
+            Self::ContributePassphrase(cp) => Ok(
+                vault_gate::Inbound::HandleContributeUnsealPassphrase(
                     HandleContributeUnsealPassphrase {
-                        passphrase: passphrase.passphrase,
+                        passphrase: cp.passphrase,
                     },
-                ))
-            }
-            Self::ContributeRecoveryPassphrase(_) => Err(Status::unimplemented(
-                "Recovery operator contributions are not available",
-            )),
+                ),
+            ),
         }
     }
 }
@@ -134,35 +129,18 @@ impl TryConvert for BootstrapRequestPayload {
     fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
         match self {
             Self::EncryptedKey(key) => key.try_convert(),
-            Self::DeclareCommittee(dc) => {
-                if dc.recovery_count != 0 {
-                    return Err(Status::unimplemented(
-                        "Recovery operator contributions are not available",
-                    ));
-                }
-                let count = usize::try_from(dc.count)
-                    .ok()
-                    .filter(|count| *count <= shamir::MAX_COMMITTEE_SIZE)
-                    .ok_or_else(|| {
-                        Status::invalid_argument(format!(
-                            "Committee count must not exceed {}",
-                            shamir::MAX_COMMITTEE_SIZE
-                        ))
-                    })?;
-                Ok(vault_gate::Inbound::HandleDeclareCommittee(
-                    HandleDeclareCommittee { count },
-                ))
-            }
-            Self::ContributePassphrase(cp) => {
-                Ok(vault_gate::Inbound::HandleContributeBootstrapPassphrase(
+            Self::DeclareCommittee(dc) => Ok(
+                vault_gate::Inbound::HandleDeclareCommittee(HandleDeclareCommittee {
+                    count: dc.count as usize,
+                }),
+            ),
+            Self::ContributePassphrase(cp) => Ok(
+                vault_gate::Inbound::HandleContributeBootstrapPassphrase(
                     HandleContributeBootstrapPassphrase {
                         passphrase: cp.passphrase,
                     },
-                ))
-            }
-            Self::ContributeRecoveryPassphrase(_) => Err(Status::unimplemented(
-                "Recovery operator contributions are not available",
-            )),
+                ),
+            ),
         }
     }
 }

server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs

@@ -1,5 +1,5 @@
 use crate::{
-    actors::{vault::VaultState, vault_coordinator},
+    actors::vault::VaultState,
     grpc::{Convert, TryConvert},
     peers::operator::vault_gate::{self as vault_gate},
 };
@@ -34,26 +34,6 @@ const fn wrap_unseal_response(payload: UnsealResponsePayload) -> OperatorRespons
     }))
 }
 
-/// Ceremony errors are the operator's own doing far more often than ours, so
-/// they travel back as a specific status instead of a blanket internal error.
-fn ceremony_status(error: &vault_coordinator::Error) -> Status {
-    match error {
-        vault_coordinator::Error::AlreadyBootstrapping
-        | vault_coordinator::Error::AlreadyUnsealing
-        | vault_coordinator::Error::NotBootstrapping
-        | vault_coordinator::Error::DuplicateContribution => {
-            Status::failed_precondition(error.to_string())
-        }
-        vault_coordinator::Error::EmptyCommittee
-        | vault_coordinator::Error::UnsupportedCommittee
-        | vault_coordinator::Error::CommitteeTooLarge => {
-            Status::invalid_argument(error.to_string())
-        }
-        vault_coordinator::Error::InvalidPassphrase => Status::unauthenticated(error.to_string()),
-        _ => Status::internal("Vault ceremony failed"),
-    }
-}
-
 fn wrap_bootstrap_response(result: ProtoBootstrapResult) -> OperatorResponsePayload {
     wrap_vault_response(VaultResponsePayload::Bootstrap(proto_bootstrap::Response {
         result: result.into(),
@@ -132,14 +112,7 @@ impl TryConvert for vault_gate::Outbound {
             }
             Self::HandleDeclareCommittee(result) => {
                 let proto_result = match result {
-                    Ok(()) => ProtoBootstrapResult::AwaitingContributions,
-                    Err(vault_gate::Error::Ceremony(
-                        vault_coordinator::Error::AlreadyBootstrapped,
-                    )) => ProtoBootstrapResult::AlreadyBootstrapped,
-                    Err(vault_gate::Error::Ceremony(err)) => {
-                        warn!(?err, "declare committee failed");
-                        return Err(ceremony_status(&err));
-                    }
+                    Ok(()) => ProtoBootstrapResult::Success,
                     Err(err) => {
                         warn!(?err, "declare committee failed");
                         return Err(Status::internal("Failed to declare committee"));
@@ -151,18 +124,9 @@ impl TryConvert for vault_gate::Outbound {
                 let proto_result = match result {
                     Ok(true) => ProtoBootstrapResult::Success,
                     Ok(false) => ProtoBootstrapResult::AwaitingContributions,
-                    Err(vault_gate::Error::Ceremony(
-                        vault_coordinator::Error::AlreadyBootstrapped,
-                    )) => ProtoBootstrapResult::AlreadyBootstrapped,
-                    Err(vault_gate::Error::Ceremony(err)) => {
-                        warn!(?err, "contribute bootstrap passphrase failed");
-                        return Err(ceremony_status(&err));
-                    }
                     Err(err) => {
                         warn!(?err, "contribute bootstrap passphrase failed");
-                        return Err(Status::internal(
-                            "Failed to contribute bootstrap passphrase",
-                        ));
+                        return Err(Status::internal("Failed to contribute bootstrap passphrase"));
                     }
                 };
                 Ok(wrap_bootstrap_response(proto_result))

server/crates/arbiter-server/src/peers/client/auth.rs

@@ -8,7 +8,7 @@ use crate::{
     crypto::integrity::{self, AttestationStatus},
     db::{
         self,
-        models::ProgramClientMetadata,
+        models::{ProgramClientMetadata, SqliteTimestamp},
         schema::program_client,
     },
 };
@@ -18,13 +18,14 @@ use arbiter_proto::{
     transport::{Bi, expect_message},
 };
 
+use chrono::Utc;
 use diesel::{
     ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, SelectableHelper as _,
-    dsl::insert_into,
+    dsl::insert_into, update,
 };
 use diesel_async::RunQueryDsl as _;
 use kameo::{actor::ActorRef, error::SendError};
-use tracing::{error, warn};
+use tracing::error;
 
 #[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
 pub enum Error {
@@ -210,47 +211,71 @@ async fn insert_client(
     .await
 }
 
-/// Compares stored metadata against what a reconnecting client presents.
-/// Metadata is frozen after initial operator approval and must not be silently
-/// overwritten. Doing so would let an approved client forge its displayed
-/// identity in later approval prompts. Drift is logged and ignored.
-async fn check_metadata_drift(
+async fn sync_client_metadata(
     db: &db::DatabasePool,
     client_id: i32,
-    presented: &ClientMetadata,
+    metadata: &ClientMetadata,
 ) -> Result<(), Error> {
-    use crate::db::schema::client_metadata;
+    use crate::db::schema::{client_metadata, client_metadata_history};
+
+    let now = SqliteTimestamp(Utc::now());
 
     let mut conn = db.get().await.map_err(|e| {
         error!(error = ?e, "Database pool error");
         Error::DatabasePoolUnavailable
     })?;
 
-    let current: ProgramClientMetadata = program_client::table
-        .find(client_id)
-        .inner_join(client_metadata::table)
-        .select(ProgramClientMetadata::as_select())
-        .first(&mut conn)
-        .await
-        .map_err(|e| {
-            error!(error = ?e, "Database error");
-            Error::DatabaseOperationFailed
-        })?;
+    conn.exclusive_transaction(async |conn| {
+        let (current_metadata_id, current): (i32, ProgramClientMetadata) = program_client::table
+            .find(client_id)
+            .inner_join(client_metadata::table)
+            .select((
+                program_client::metadata_id,
+                ProgramClientMetadata::as_select(),
+            ))
+            .first(&mut *conn)
+            .await?;
 
-    let changed = current.name != presented.name
-        || current.description != presented.description
-        || current.version != presented.version;
+        let unchanged = current.name == metadata.name
+            && current.description == metadata.description
+            && current.version == metadata.version;
+        if unchanged {
+            return Ok(());
+        }
 
-    if changed {
-        warn!(
-            client_id,
-            stored_name = %current.name,
-            presented_name = %presented.name,
-            "reconnecting client presented different metadata; ignoring - metadata is frozen after operator approval"
-        );
-    }
+        insert_into(client_metadata_history::table)
+            .values((
+                client_metadata_history::metadata_id.eq(current_metadata_id),
+                client_metadata_history::client_id.eq(client_id),
+            ))
+            .execute(&mut *conn)
+            .await?;
 
-    Ok(())
+        let metadata_id = insert_into(client_metadata::table)
+            .values((
+                client_metadata::name.eq(&metadata.name),
+                client_metadata::description.eq(&metadata.description),
+                client_metadata::version.eq(&metadata.version),
+            ))
+            .returning(client_metadata::id)
+            .get_result::<i32>(&mut *conn)
+            .await?;
+
+        update(program_client::table.find(client_id))
+            .set((
+                program_client::metadata_id.eq(metadata_id),
+                program_client::updated_at.eq(now),
+            ))
+            .execute(&mut *conn)
+            .await?;
+
+        Ok::<(), diesel::result::Error>(())
+    })
+    .await
+    .map_err(|e| {
+        error!(error = ?e, "Database error");
+        Error::DatabaseOperationFailed
+    })
 }
 
 async fn challenge_client<T>(
@@ -299,7 +324,6 @@ where
 
     let client_id = if let Some(id) = get_client_id(&props.db, &pubkey).await? {
         verify_integrity(&props.db, &props.actors.vault, &pubkey).await?;
-        check_metadata_drift(&props.db, id, &metadata).await?;
         id
     } else {
         approve_new_client(
@@ -313,6 +337,8 @@ where
         insert_client(&props.db, &props.actors.vault, &pubkey, &metadata).await?
     };
 
+    sync_client_metadata(&props.db, client_id, &metadata).await?;
+
     let challenge = AuthChallenge::generate(&mut rand::rng());
     challenge_client(transport, pubkey, challenge).await?;
 

server/crates/arbiter-server/src/peers/client/session.rs

@@ -83,7 +83,7 @@ impl Actor for ClientSession {
         args.props
             .actors
             .flow_coordinator
-            .ask(RegisterClient { client_id: args.client_id, actor: this })
+            .ask(RegisterClient { actor: this })
             .await
             .map_err(|_| Error::ConnectionRegistrationFailed)?;
         Ok(args)

server/crates/arbiter-server/src/peers/operator/auth/mod.rs

@@ -14,7 +14,7 @@ mod state;
 pub enum Inbound {
     AuthChallengeRequest {
         pubkey: authn::PublicKey,
-        bootstrap_token: Option<Vec<u8>>,
+        bootstrap_token: Option<String>,
     },
     AuthChallengeSolution {
         signature: Vec<u8>,

server/crates/arbiter-server/src/peers/operator/auth/state.rs

@@ -3,8 +3,8 @@ use super::{
     Error,
 };
 use crate::{
-    actors::bootstrap::VerifyToken,
-    db::{DatabasePool, models::OperatorId, schema::operator_identity},
+    actors::bootstrap::ConsumeToken,
+    db::{DatabasePool, schema::operator_identity},
     peers::operator::auth::Outbound,
 };
 use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
@@ -14,18 +14,19 @@ use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl};
 use diesel_async::RunQueryDsl;
 use tracing::error;
 
-pub(super) struct ChallengeRequest {
-    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<Vec<u8>>,
+pub(crate) struct ChallengeRequest {
+    pub(crate) pubkey: authn::PublicKey,
+    pub(crate) bootstrap_token: Option<String>,
 }
 
 pub struct ChallengeContext {
-    pub(super) challenge: AuthChallenge,
-    pub(super) pubkey: authn::PublicKey,
+    pub challenge: AuthChallenge,
+    pub pubkey: authn::PublicKey,
+    pub bootstrap_token: Option<String>,
 }
 
-pub(super) struct ChallengeSolution {
-    pub(super) solution: Vec<u8>,
+pub(crate) struct ChallengeSolution {
+    pub(crate) solution: Vec<u8>,
 }
 
 smlang::statemachine!(
@@ -37,10 +38,7 @@ smlang::statemachine!(
     }
 );
 
-async fn get_client_id(
-    db: &DatabasePool,
-    pubkey: &authn::PublicKey,
-) -> Result<Option<OperatorId>, Error> {
+async fn get_client_id(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<Option<i32>, Error> {
     let mut conn = db.get().await.map_err(|e| {
         error!(error = ?e, "Database pool error");
         Error::internal("Database unavailable")
@@ -49,7 +47,7 @@ async fn get_client_id(
     operator_identity::table
         .filter(operator_identity::public_key.eq(pubkey.to_bytes()))
         .select(operator_identity::id)
-        .first::<OperatorId>(&mut conn)
+        .first::<i32>(&mut conn)
         .await
         .optional()
         .map_err(|e| {
@@ -58,14 +56,14 @@ async fn get_client_id(
         })
 }
 
-async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<OperatorId, Error> {
+async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i32, Error> {
     let pubkey_bytes = pubkey.to_bytes();
     let mut conn = db.get().await.map_err(|e| {
         error!(error = ?e, "Database pool error");
         Error::internal("Database unavailable")
     })?;
 
-    let id: OperatorId = diesel::insert_into(operator_identity::table)
+    let id: i32 = diesel::insert_into(operator_identity::table)
         .values((operator_identity::public_key.eq(pubkey_bytes),))
         .returning(operator_identity::id)
         .get_result(&mut conn)
@@ -81,16 +79,11 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<Op
 pub(super) struct AuthContext<'a, T: ?Sized> {
     pub(super) conn: &'a mut OperatorConnection,
     pub(super) transport: &'a mut T,
-    bootstrap_token: Option<Vec<u8>>,
 }
 
 impl<'a, T: ?Sized> AuthContext<'a, T> {
     pub(super) const fn new(conn: &'a mut OperatorConnection, transport: &'a mut T) -> Self {
-        Self {
-            conn,
-            transport,
-            bootstrap_token: None,
-        }
+        Self { conn, transport }
     }
 }
 
@@ -115,8 +108,6 @@ where
             }
         }
 
-        self.bootstrap_token = bootstrap_token;
-
         let challenge = AuthChallenge::generate(&mut rand::rng());
 
         self.transport
@@ -129,12 +120,20 @@ where
                 Error::Transport
             })?;
 
-        Ok(ChallengeContext { challenge, pubkey })
+        Ok(ChallengeContext {
+            challenge,
+            pubkey,
+            bootstrap_token,
+        })
     }
 
     async fn verify_solution(
         &mut self,
-        ChallengeContext { challenge, pubkey }: &ChallengeContext,
+        ChallengeContext {
+            challenge,
+            pubkey,
+            bootstrap_token,
+        }: &ChallengeContext,
         ChallengeSolution { solution }: ChallengeSolution,
     ) -> Result<Credentials, Self::Error> {
         let signature = authn::Signature::try_from(solution.as_slice()).map_err(|()| {
@@ -153,13 +152,15 @@ where
         }
 
         // Resolve client id: bootstrap (consume token + register) or lookup
-        let id = match self.bootstrap_token.take() {
+        let id = match bootstrap_token {
             Some(token) => {
                 let token_ok: bool = self
                     .conn
                     .actors
                     .bootstrapper
-                    .ask(VerifyToken { token })
+                    .ask(ConsumeToken {
+                        token: token.clone(),
+                    })
                     .await
                     .map_err(|e| {
                         error!(?e, "Failed to consume bootstrap token");

server/crates/arbiter-server/src/peers/operator/mod.rs

@@ -4,7 +4,7 @@ use crate::{
         vault::{GetState, Vault},
     },
     crypto::integrity::{self, AttestationStatus, Integrable},
-    db::{DatabaseError, DatabasePool, models::OperatorId},
+    db::{DatabaseError, DatabasePool},
     peers::client::ClientProfile,
 };
 use arbiter_crypto::authn;
@@ -25,7 +25,7 @@ pub mod vault_gate;
 
 #[derive(Debug, Clone, Hashable)]
 pub struct Credentials {
-    pub id: OperatorId,
+    pub id: i32,
     pub pubkey: authn::PublicKey,
 }
 

server/crates/arbiter-server/src/peers/operator/session/handlers.rs

@@ -2,17 +2,14 @@ use super::{Error, OperatorSession};
 use crate::{
     actors::{
         evm::{
-            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
-            SignTransactionError as EvmSignError,
+            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorDeleteGrant,
+            OperatorListGrants, SignTransactionError as EvmSignError,
         },
-        flow_coordinator::{IsClientConnected, client_connect_approval::ClientApprovalAnswer},
+        flow_coordinator::client_connect_approval::ClientApprovalAnswer,
         vault::VaultState,
     },
-    db::{
-        models::{
-            EvmWalletAccess, EvmWalletId, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata,
-        },
-        schema::program_client,
+    db::models::{
+        EvmWalletAccess, EvmWalletId, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata,
     },
     evm::policies::{Grant, SpecificGrant},
 };
@@ -22,16 +19,13 @@ use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
 use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
 use diesel_async::{AsyncConnection, RunQueryDsl};
 use kameo::{error::SendError, messages, prelude::Context};
-use tracing::{error, info, warn};
+use tracing::error;
 
 #[derive(Debug, Error)]
 pub enum SignTransactionError {
     #[error("Policy evaluation failed")]
     Vet(#[from] crate::evm::VetError),
 
-    #[error("Client not connected")]
-    ClientNotConnected,
-
     #[error("Internal signing error")]
     Internal,
 }
@@ -128,22 +122,23 @@ impl OperatorSession {
     }
 
     #[message]
-    pub(crate) fn handle_grant_delete(&mut self, grant_id: i32) -> Result<(), GrantMutationError> {
-        // match self
-        //     .props
-        //     .actors
-        //     .evm
-        //     .ask(OperatorDeleteGrant { grant_id })
-        //     .await
-        // {
-        //     Ok(()) => Ok(()),
-        //     Err(err) => {
-        //         error!(?err, "EVM grant delete failed");
-        //         Err(GrantMutationError::Internal)
-        //     }
-        // }
-        let _ = grant_id;
-        todo!()
+    pub(crate) async fn handle_grant_delete(
+        &mut self,
+        grant_id: i32,
+    ) -> Result<(), GrantMutationError> {
+        match self
+            .props
+            .actors
+            .evm
+            .ask(OperatorDeleteGrant { grant_id })
+            .await
+        {
+            Ok(()) => Ok(()),
+            Err(err) => {
+                error!(?err, "EVM grant delete failed");
+                Err(GrantMutationError::Internal)
+            }
+        }
     }
 
     #[message]
@@ -153,30 +148,6 @@ impl OperatorSession {
         wallet_address: Address,
         transaction: TxEip1559,
     ) -> Result<Signature, SignTransactionError> {
-        if !self.approved_client_ids.contains(&client_id) {
-            warn!(
-                client_id,
-                "operator attempted to sign for client not in its approved set"
-            );
-            return Err(SignTransactionError::ClientNotConnected);
-        }
-
-        let connected = self
-            .props
-            .actors
-            .flow_coordinator
-            .ask(IsClientConnected { client_id })
-            .await
-            .unwrap_or(false);
-
-        if !connected {
-            self.approved_client_ids.remove(&client_id);
-            warn!(client_id, "operator attempted to sign for disconnected client");
-            return Err(SignTransactionError::ClientNotConnected);
-        }
-
-        info!(client_id, event = "sign_transaction", "operator.sign_transaction");
-
         match self
             .props
             .actors
@@ -232,7 +203,7 @@ impl OperatorSession {
             use crate::db::schema::evm_wallet_access;
             for entry in entries {
                 diesel::delete(evm_wallet_access::table)
-                    .filter(evm_wallet_access::id.eq(entry))
+                    .filter(evm_wallet_access::wallet_id.eq(entry))
                     .execute(&mut *conn)
                     .await?;
             }
@@ -247,8 +218,9 @@ impl OperatorSession {
     pub(crate) async fn handle_list_wallet_access(
         &mut self,
     ) -> Result<Vec<EvmWalletAccess>, Error> {
+        use crate::db::schema::evm_wallet_access;
         let mut conn = self.props.db.get().await?;
-        let access_entries = crate::db::schema::evm_wallet_access::table
+        let access_entries = evm_wallet_access::table
             .select(EvmWalletAccess::as_select())
             .load::<_>(&mut conn)
             .await?;
@@ -285,30 +257,6 @@ impl OperatorSession {
 
         ctx.actor_ref().unlink(&pending_approval.controller).await;
 
-        if approved {
-            let pubkey_bytes = pending_approval.pubkey.to_bytes();
-            match self.props.db.get().await {
-                Ok(mut conn) => {
-                    match program_client::table
-                        .filter(program_client::public_key.eq(pubkey_bytes.as_slice()))
-                        .select(program_client::id)
-                        .first::<i32>(&mut conn)
-                        .await
-                    {
-                        Ok(client_id) => {
-                            self.approved_client_ids.insert(client_id);
-                        }
-                        Err(err) => {
-                            error!(?err, "Failed to look up client_id for approved pubkey");
-                        }
-                    }
-                }
-                Err(err) => {
-                    error!(?err, "DB pool error after client approval");
-                }
-            }
-        }
-
         Ok(())
     }
 
@@ -331,142 +279,3 @@ impl OperatorSession {
         Ok(clients)
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::db::{self, models::{EvmWalletId, NewEvmWalletAccess}, schema::evm_wallet_access};
-    use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
-    use diesel_async::{AsyncConnection, RunQueryDsl};
-
-    /// Regression test: revocation must delete by access-entry `id`, not by `wallet_id`.
-    ///
-    /// Before the fix, revoking `entry_id=1` would delete all rows where `wallet_id=1`,
-    /// wiping out every client's access to wallet #1.
-    #[tokio::test]
-    async fn revoke_deletes_by_entry_id_not_wallet_id() {
-        use crate::db::models::EvmWalletAccess;
-
-        let pool = db::create_test_pool().await;
-        let mut conn = pool.get().await.expect("pool connection");
-
-        // Insert two access entries for the same wallet but different clients.
-        // entry A: id will be 1, wallet_id=1, client_id=10
-        // entry B: id will be 2, wallet_id=1, client_id=20
-        let entry_a = diesel::insert_into(evm_wallet_access::table)
-            .values(NewEvmWalletAccess {
-                wallet_id: EvmWalletId::from_raw(1),
-                client_id: 10,
-            })
-            .returning(EvmWalletAccess::as_select())
-            .get_result(&mut *conn)
-            .await
-            .expect("insert entry A");
-
-        let entry_b = diesel::insert_into(evm_wallet_access::table)
-            .values(NewEvmWalletAccess {
-                wallet_id: EvmWalletId::from_raw(1),
-                client_id: 20,
-            })
-            .returning(EvmWalletAccess::as_select())
-            .get_result(&mut *conn)
-            .await
-            .expect("insert entry B");
-
-        // Revoke only entry A by its primary key id.
-        conn.transaction(async |conn| {
-            diesel::delete(evm_wallet_access::table)
-                .filter(evm_wallet_access::id.eq(entry_a.id))
-                .execute(&mut *conn)
-                .await
-        })
-        .await
-        .expect("revoke entry A");
-
-        // Entry A must be gone.
-        let gone = evm_wallet_access::table
-            .filter(evm_wallet_access::id.eq(entry_a.id))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count entry A");
-        assert_eq!(gone, 0, "revoked entry must be deleted");
-
-        // Entry B (same wallet, different client) must still exist.
-        let still_there = evm_wallet_access::table
-            .filter(evm_wallet_access::id.eq(entry_b.id))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count entry B");
-        assert_eq!(still_there, 1, "unrelated entry must not be deleted");
-    }
-
-    /// Regression test: when `entry_id` and `wallet_id` differ, only the correct row is removed.
-    ///
-    /// This specifically catches the case where `entry.id=5` and `wallet_id=1` are different values;
-    /// the old bug would delete by `wallet_id`, potentially matching a completely different entry.
-    #[tokio::test]
-    async fn revoke_with_mismatched_wallet_and_entry_ids() {
-        use crate::db::models::EvmWalletAccess;
-
-        let pool = db::create_test_pool().await;
-        let mut conn = pool.get().await.expect("pool connection");
-
-        // Insert entries to force auto-increment IDs to diverge from wallet_ids.
-        // We'll insert 5 placeholder entries first so that the real entry gets id=6.
-        for i in 1_i32..=5 {
-            diesel::insert_into(evm_wallet_access::table)
-                .values(NewEvmWalletAccess {
-                    wallet_id: EvmWalletId::from_raw(99),
-                    client_id: i,
-                })
-                .execute(&mut *conn)
-                .await
-                .expect("insert placeholder");
-        }
-
-        // Real target: wallet_id=1, will get id=6.
-        let target = diesel::insert_into(evm_wallet_access::table)
-            .values(NewEvmWalletAccess {
-                wallet_id: EvmWalletId::from_raw(1),
-                client_id: 1,
-            })
-            .returning(EvmWalletAccess::as_select())
-            .get_result(&mut *conn)
-            .await
-            .expect("insert target");
-
-        // Sanity: target.id != target.wallet_id
-        assert_ne!(
-            target.id, target.wallet_id.to_raw(),
-            "test prerequisite: id and wallet_id must differ"
-        );
-
-        // Revoke by entry id.
-        conn.transaction(async |conn| {
-            diesel::delete(evm_wallet_access::table)
-                .filter(evm_wallet_access::id.eq(target.id))
-                .execute(&mut *conn)
-                .await
-        })
-        .await
-        .expect("revoke target");
-
-        let remaining = evm_wallet_access::table
-            .filter(evm_wallet_access::id.eq(target.id))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count target");
-        assert_eq!(remaining, 0, "target must be deleted by its entry id");
-
-        // Placeholders for wallet_id=99 must be untouched.
-        let placeholders = evm_wallet_access::table
-            .filter(evm_wallet_access::wallet_id.eq(99))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count placeholders");
-        assert_eq!(placeholders, 5, "unrelated entries must survive");
-    }
-}

server/crates/arbiter-server/src/peers/operator/session/mod.rs

@@ -1,14 +1,16 @@
 use super::{OutOfBand, OperatorConnection};
 use crate::{
     actors::{
-        flow_coordinator::{GetConnectedClientIds, client_connect_approval::{ClientApprovalAnswer, ClientApprovalController}}, operator_registry::ConnectOperator,
-    }, peers::client::ClientProfile,
+        flow_coordinator::client_connect_approval::ClientApprovalController,
+        operator_registry::ConnectOperator,
+    },
+    peers::client::ClientProfile,
 };
 use arbiter_crypto::authn;
 use arbiter_proto::transport::Sender;
 
 use kameo::{Actor, actor::ActorRef, messages};
-use std::{borrow::Cow, collections::{HashMap, HashSet}};
+use std::{borrow::Cow, collections::HashMap};
 use thiserror::Error;
 use tracing::error;
 
@@ -52,10 +54,6 @@ pub struct OperatorSession {
     sender: Box<dyn Sender<OutOfBand>>,
 
     pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>,
-    /// DB `client_ids` this operator session is allowed to sign for.
-    /// Seeded from currently-connected clients on start, then updated as
-    /// approvals are granted or denied during the session lifetime.
-    approved_client_ids: HashSet<i32>,
 }
 
 pub mod handlers;
@@ -66,7 +64,6 @@ impl OperatorSession {
             props,
             sender,
             pending_client_approvals: HashMap::default(),
-            approved_client_ids: HashSet::default(),
         }
     }
 }
@@ -91,7 +88,6 @@ impl OperatorSession {
                 actor = "operator",
                 event = "failed to announce new client connection"
             );
-            let _ = controller.tell(ClientApprovalAnswer { approved: false }).await;
             return;
         }
 
@@ -110,7 +106,7 @@ impl Actor for OperatorSession {
 
     type Error = Error;
 
-    async fn on_start(mut args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
+    async fn on_start(args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
         args.props
             .actors
             .operator_registry
@@ -125,16 +121,6 @@ impl Actor for OperatorSession {
                 );
                 Error::internal("Failed to register operator connection with operator registry")
             })?;
-
-        // Seed approved set with clients already connected when this session starts.
-        // New clients will be added via handle_new_client_approve as they are approved.
-        match args.props.actors.flow_coordinator.ask(GetConnectedClientIds {}).await {
-            Ok(ids) => args.approved_client_ids.extend(ids),
-            Err(err) => {
-                error!(?err, "Failed to fetch connected client IDs on operator session start");
-            }
-        }
-
         Ok(args)
     }
 

server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs

@@ -3,9 +3,9 @@ use crate::{
     actors::{
         GlobalActors,
         vault::{self, Bootstrap, GetState, TryUnseal, VaultState, events},
-        vault_coordinator::{self, ContributeBootstrap, ContributeUnseal, StartBootstrap},
+        vault_coordinator::{ContributeBootstrap, ContributeUnseal, StartBootstrap},
     },
-    crypto::{KeyCell, integrity},
+    crypto::{KeyCell, integrity::{self}},
     db::DatabasePool,
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
@@ -18,6 +18,9 @@ use tokio::sync::oneshot;
 use tracing::{error, info};
 use x25519_dalek::{EphemeralSecret, PublicKey, SharedSecret};
 
+pub use VaultGateMessage as Inbound;
+pub use VaultGateMessageReply as Outbound;
+
 pub mod state;
 
 #[derive(Debug, thiserror::Error)]
@@ -26,29 +29,17 @@ pub enum Error {
     AlreadyBootstrapped,
     #[error("Invalid key provided")]
     InvalidKey,
-    #[error("Vault locked: too many failed unseal attempts")]
-    LockedOut,
+
     #[error("State transition failed")]
     State,
-    #[error("Vault ceremony failed: {0}")]
-    Ceremony(#[from] vault_coordinator::Error),
+
     #[error("Internal error: {0}")]
     Internal(String),
 }
-
 impl Error {
     fn internal(message: impl Into<String>) -> Self {
         Self::Internal(message.into())
     }
-
-    /// Preserve the coordinator's own error so the operator learns why a
-    /// ceremony was refused instead of reading "internal error".
-    fn ceremony<M>(error: SendError<M, vault_coordinator::Error>) -> Self {
-        match error {
-            SendError::HandlerError(inner) => Self::Ceremony(inner),
-            _ => Self::internal("VaultCoordinator unavailable"),
-        }
-    }
 }
 
 pub struct HandshakeResponse {
@@ -82,6 +73,7 @@ impl VaultGate {
 
 impl Actor for VaultGate {
     type Args = Self;
+
     type Error = ();
 
     async fn on_start(
@@ -110,29 +102,28 @@ impl VaultGate {
         nonce: &[u8],
         ciphertext: &[u8],
         associated_data: &[u8],
-    ) -> Result<SafeCell<Vec<u8>>, ()> {
+    ) -> Result<KeyCell, ()> {
         let nonce = XNonce::from_slice(nonce);
         let cipher = XChaCha20Poly1305::new(secret.as_bytes().into());
         let mut key_buffer = SafeCell::new(ciphertext.to_vec());
+
         let decryption_result = key_buffer.write_inline(|write_handle| {
             cipher.decrypt_in_place(nonce, associated_data, write_handle)
         });
 
         match decryption_result {
-            Ok(()) => Ok(key_buffer),
+            Ok(()) => KeyCell::try_from(key_buffer).map_err(|()| {
+                error!("Decrypted key material has unexpected length");
+            }),
             Err(err) => {
                 error!(?err, "Failed to decrypt encrypted key material");
                 Err(())
             }
         }
     }
-
-    fn key_cell(buffer: SafeCell<Vec<u8>>) -> Result<KeyCell, Error> {
-        KeyCell::try_from(buffer).map_err(|()| Error::InvalidKey)
-    }
 }
 
-#[messages]
+#[messages(enum)]
 impl VaultGate {
     #[message]
     pub fn handle_handshake(
@@ -141,11 +132,14 @@ impl VaultGate {
     ) -> Result<HandshakeResponse, Error> {
         let ephemeral_secret = EphemeralSecret::random();
         let public_key = PublicKey::from(&ephemeral_secret);
+
         let secret = ephemeral_secret.diffie_hellman(&client_pubkey);
+
         self.state = State::ReadyForExchange {
             server_key: public_key,
             secret,
         };
+
         Ok(HandshakeResponse {
             server_pubkey: public_key,
         })
@@ -161,17 +155,22 @@ impl VaultGate {
         let State::ReadyForExchange { secret, .. } = &self.state else {
             return Err(Error::State);
         };
-        let seal_key = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-            .map_err(|()| Error::InvalidKey)
-            .and_then(Self::key_cell)?;
 
-        match self.actors.vault.ask(TryUnseal { seal_key }).await {
+        let Ok(seal_key) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data) else {
+            return Err(Error::InvalidKey);
+        };
+
+        match self
+            .actors
+            .vault
+            .ask(TryUnseal { seal_key })
+            .await
+        {
             Ok(()) => {
                 info!("Successfully unsealed key with client-provided key");
                 Ok(())
             }
             Err(SendError::HandlerError(vault::Error::InvalidKey)) => Err(Error::InvalidKey),
-            Err(SendError::HandlerError(vault::Error::LockedOut)) => Err(Error::LockedOut),
             Err(SendError::HandlerError(err)) => {
                 error!(?err, "Vault failed to unseal key");
                 Err(Error::InvalidKey)
@@ -193,17 +192,15 @@ impl VaultGate {
         let State::ReadyForExchange { secret, .. } = &self.state else {
             return Err(Error::State);
         };
-        let seal_key = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-            .map_err(|()| Error::InvalidKey)
-            .and_then(Self::key_cell)?;
+
+        let Ok(seal_key) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data) else {
+            return Err(Error::InvalidKey);
+        };
 
         match self
             .actors
             .vault
-            .ask(Bootstrap {
-                seal_key,
-                custody: None,
-            })
+            .ask(Bootstrap { seal_key })
             .await
         {
             Ok(()) => {
@@ -226,11 +223,14 @@ impl VaultGate {
 
     #[message]
     pub async fn handle_vault_state(&mut self) -> Result<VaultState, Error> {
-        self.actors
+        let answer = self
+            .actors
             .vault
             .ask(GetState {})
             .await
-            .map_err(|_| Error::internal("failed to query vault"))
+            .map_err(|_| Error::internal("failed to query vault"))?;
+
+        Ok(answer)
     }
 
     #[message]
@@ -242,7 +242,7 @@ impl VaultGate {
                 declared_count: count,
             })
             .await
-            .map_err(Error::ceremony)
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
     }
 
     #[message]
@@ -250,14 +250,15 @@ impl VaultGate {
         &mut self,
         passphrase: Vec<u8>,
     ) -> Result<bool, Error> {
+        let passphrase_cell = SafeCell::new(passphrase);
         self.actors
             .vault_coordinator
             .ask(ContributeBootstrap {
                 operator_id: self.auth_creds.id,
-                passphrase: SafeCell::new(passphrase),
+                passphrase: passphrase_cell,
             })
             .await
-            .map_err(Error::ceremony)
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
     }
 
     #[message]
@@ -265,14 +266,15 @@ impl VaultGate {
         &mut self,
         passphrase: Vec<u8>,
     ) -> Result<bool, Error> {
+        let passphrase_cell = SafeCell::new(passphrase);
         self.actors
             .vault_coordinator
             .ask(ContributeUnseal {
                 operator_id: self.auth_creds.id,
-                passphrase: SafeCell::new(passphrase),
+                passphrase: passphrase_cell,
             })
             .await
-            .map_err(Error::ceremony)
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
     }
 }
 
@@ -326,75 +328,3 @@ impl Message<events::Unsealed> for VaultGate {
         ctx.stop();
     }
 }
-
-pub enum Inbound {
-    HandleHandshake(HandleHandshake),
-    HandleUnsealEncryptedKey(HandleUnsealEncryptedKey),
-    HandleBootstrapEncryptedKey(HandleBootstrapEncryptedKey),
-    HandleVaultState,
-    HandleDeclareCommittee(HandleDeclareCommittee),
-    HandleContributeBootstrapPassphrase(HandleContributeBootstrapPassphrase),
-    HandleContributeUnsealPassphrase(HandleContributeUnsealPassphrase),
-}
-
-pub enum Outbound {
-    HandleHandshake(Result<HandshakeResponse, Error>),
-    HandleUnsealEncryptedKey(Result<(), Error>),
-    HandleBootstrapEncryptedKey(Result<(), Error>),
-    HandleVaultState(Result<VaultState, Error>),
-    HandleDeclareCommittee(Result<(), Error>),
-    HandleContributeBootstrapPassphrase(Result<bool, Error>),
-    HandleContributeUnsealPassphrase(Result<bool, Error>),
-}
-
-impl Message<Inbound> for VaultGate {
-    type Reply = Result<Outbound, Error>;
-
-    async fn handle(
-        &mut self,
-        msg: Inbound,
-        _ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
-    ) -> Self::Reply {
-        match msg {
-            Inbound::HandleHandshake(message) => Ok(Outbound::HandleHandshake(
-                self.handle_handshake(message.client_pubkey),
-            )),
-            Inbound::HandleUnsealEncryptedKey(message) => Ok(Outbound::HandleUnsealEncryptedKey(
-                self.handle_unseal_encrypted_key(
-                    message.nonce,
-                    message.ciphertext,
-                    message.associated_data,
-                )
-                .await,
-            )),
-            Inbound::HandleBootstrapEncryptedKey(message) => {
-                Ok(Outbound::HandleBootstrapEncryptedKey(
-                    self.handle_bootstrap_encrypted_key(
-                        message.nonce,
-                        message.ciphertext,
-                        message.associated_data,
-                    )
-                    .await,
-                ))
-            }
-            Inbound::HandleVaultState => {
-                Ok(Outbound::HandleVaultState(self.handle_vault_state().await))
-            }
-            Inbound::HandleDeclareCommittee(message) => Ok(Outbound::HandleDeclareCommittee(
-                self.handle_declare_committee(message.count).await,
-            )),
-            Inbound::HandleContributeBootstrapPassphrase(message) => {
-                Ok(Outbound::HandleContributeBootstrapPassphrase(
-                    self.handle_contribute_bootstrap_passphrase(message.passphrase)
-                        .await,
-                ))
-            }
-            Inbound::HandleContributeUnsealPassphrase(message) => {
-                Ok(Outbound::HandleContributeUnsealPassphrase(
-                    self.handle_contribute_unseal_passphrase(message.passphrase)
-                        .await,
-                ))
-            }
-        }
-    }
-}

server/crates/arbiter-server/tests/client/auth.rs

@@ -6,7 +6,7 @@ use arbiter_proto::{
 };
 use arbiter_server::{
     actors::{GlobalActors, vault::Bootstrap},
-    crypto::{KeyCell, integrity},
+    crypto::integrity,
     db::{self, schema},
     peers::client::{ClientConnection, ClientCredentials, auth, connect_client},
 };
@@ -97,8 +97,7 @@ async fn spawn_test_actors(db: &db::DatabasePool) -> GlobalActors {
     actors
         .vault
         .ask(Bootstrap {
-            seal_key: KeyCell::from([0u8; 32]),
-            custody: None,
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
         })
         .await
         .unwrap();
@@ -264,7 +263,7 @@ pub async fn metadata_unchanged_does_not_append_history() {
 
 #[tokio::test]
 #[test_log::test]
-pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
+pub async fn metadata_change_appends_history_and_repoints_binding() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
     let new_key = MlDsa87::key_gen(&mut rand::rng());
@@ -285,7 +284,6 @@ pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
         connect_client(props, &mut server_transport).await;
     });
 
-    // Reconnect presenting different metadata — must be silently ignored.
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
@@ -312,7 +310,6 @@ pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
             client_metadata, client_metadata_history, program_client,
         };
         let mut conn = db.get().await.unwrap();
-        // Metadata is frozen: no new row, no history entry.
         let metadata_count: i64 = client_metadata::table
             .count()
             .get_result(&mut conn)
@@ -338,19 +335,15 @@ pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
             .first::<(String, Option<String>, Option<String>)>(&mut conn)
             .await
             .unwrap();
-        assert_eq!(
-            metadata_count, 1,
-            "frozen: no new metadata row on reconnect"
-        );
-        assert_eq!(history_count, 0, "frozen: no history entry on reconnect");
+        assert_eq!(metadata_count, 2);
+        assert_eq!(history_count, 1);
         assert_eq!(
             current,
             (
                 "client".to_owned(),
-                Some("old".to_owned()),
-                Some("1.0.0".to_owned())
-            ),
-            "frozen: original metadata must be preserved"
+                Some("new".to_owned()),
+                Some("2.0.0".to_owned())
+            )
         );
     }
 }

server/crates/arbiter-server/tests/common/mod.rs

@@ -2,11 +2,9 @@
     dead_code,
     reason = "Common test utilities that may not be used in every test"
 )]
-
 use arbiter_proto::transport::{Bi, Error, Receiver, Sender};
 use arbiter_server::{
     actors::{GlobalActors, vault::Vault},
-    crypto::KeyCell,
     db::{self, schema},
 };
 
@@ -20,7 +18,7 @@ pub(crate) async fn bootstrapped_vault(db: &db::DatabasePool) -> Vault {
         .await
         .unwrap();
     actor
-        .bootstrap(KeyCell::from([0u8; 32]), None)
+        .bootstrap(arbiter_server::crypto::KeyCell::from([0u8; 32]))
         .await
         .unwrap();
     actor

server/crates/arbiter-server/tests/operator/auth.rs

@@ -3,8 +3,8 @@ use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
 use arbiter_proto::transport::{Error as TransportError, Receiver, Sender};
 use arbiter_server::{
     actors::{GlobalActors, bootstrap::GetToken, vault::Bootstrap},
-    crypto::{KeyCell, integrity},
-    db::{self, models::OperatorId, schema},
+    crypto::integrity,
+    db::{self, schema},
     peers::operator::{self, Credentials, OperatorConnection, auth, vault_gate},
 };
 
@@ -151,6 +151,13 @@ impl Sender<auth::Inbound> for StartTestTransport {
 pub async fn bootstrap_token_auth() {
     let db = db::create_test_pool().await;
     let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap {
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
+        })
+        .await
+        .unwrap();
     let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
 
     let (mut server_transport, mut test_transport) = ChannelTransport::new();
@@ -164,7 +171,7 @@ pub async fn bootstrap_token_auth() {
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some(token.into_bytes()),
+            bootstrap_token: Some(token),
         })
         .await
         .unwrap();
@@ -221,7 +228,7 @@ pub async fn bootstrap_invalid_token_auth() {
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some(b"invalid_token".to_vec()),
+            bootstrap_token: Some("invalid_token".to_owned()),
         })
         .await
         .unwrap();
@@ -265,8 +272,7 @@ pub async fn challenge_auth() {
     actors
         .vault
         .ask(Bootstrap {
-            seal_key: KeyCell::from([0u8; 32]),
-            custody: None,
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
         })
         .await
         .unwrap();
@@ -276,10 +282,10 @@ pub async fn challenge_auth() {
 
     {
         let mut conn = db.get().await.unwrap();
-        let id: OperatorId = insert_into(schema::operator_identity::table)
+        let id: i32 = insert_into(schema::operator_identity::table)
             .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
             .returning(schema::operator_identity::id)
-            .get_result::<OperatorId>(&mut conn)
+            .get_result(&mut conn)
             .await
             .unwrap();
         integrity::sign_entity(
@@ -352,8 +358,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
     actors
         .vault
         .ask(Bootstrap {
-            seal_key: KeyCell::from([0u8; 32]),
-            custody: None,
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
         })
         .await
         .unwrap();
@@ -392,7 +397,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
     let challenge = match response {
         Ok(resp) => match resp {
             auth::Outbound::AuthChallenge { challenge } => challenge,
-            other @ auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got {other:?}"),
+            other => panic!("Expected AuthChallenge, got {other:?}"),
         },
         Err(err) => panic!("Expected Ok response, got Err({err:?})"),
     };
@@ -426,8 +431,7 @@ pub async fn challenge_auth_rejects_invalid_signature() {
     actors
         .vault
         .ask(Bootstrap {
-            seal_key: KeyCell::from([0u8; 32]),
-            custody: None,
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
         })
         .await
         .unwrap();
@@ -437,10 +441,10 @@ pub async fn challenge_auth_rejects_invalid_signature() {
 
     {
         let mut conn = db.get().await.unwrap();
-        let id: OperatorId = insert_into(schema::operator_identity::table)
+        let id: i32 = insert_into(schema::operator_identity::table)
             .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
             .returning(schema::operator_identity::id)
-            .get_result::<OperatorId>(&mut conn)
+            .get_result(&mut conn)
             .await
             .unwrap();
         integrity::sign_entity(
@@ -499,92 +503,3 @@ pub async fn challenge_auth_rejects_invalid_signature() {
         Err(auth::Error::InvalidChallengeSolution)
     ));
 }
-
-/// The bootstrap token authorises registering committee members *before* the
-/// vault exists. Once any bootstrap path succeeds it must stop working, or its
-/// holder could keep minting operator identities until the next restart.
-#[tokio::test]
-#[test_log::test]
-pub async fn bootstrap_token_rejected_after_bootstrap() {
-    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
-    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
-
-    actors
-        .vault
-        .ask(Bootstrap {
-            seal_key: KeyCell::from([0u8; 32]),
-            custody: None,
-        })
-        .await
-        .unwrap();
-
-    // `Bootstrapped` travels through the message bus, so the token disappears
-    // a couple of actor turns after the bootstrap call returns.
-    let mut retired = false;
-    for _ in 0..100 {
-        if actors.bootstrapper.ask(GetToken).await.unwrap().is_none() {
-            retired = true;
-            break;
-        }
-        tokio::task::yield_now().await;
-    }
-    assert!(
-        retired,
-        "the bootstrap token must be retired once the vault is bootstrapped"
-    );
-
-    let (mut server_transport, mut test_transport) = ChannelTransport::new();
-    let db_for_task = db.clone();
-    let task = tokio::spawn(async move {
-        let mut props = OperatorConnection::new(db_for_task, actors);
-        auth::authenticate(&mut props, &mut server_transport).await
-    });
-
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
-    test_transport
-        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some(token.into_bytes()),
-        })
-        .await
-        .unwrap();
-
-    let response = test_transport
-        .recv()
-        .await
-        .expect("should receive challenge");
-    let challenge = match response {
-        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
-        other => panic!("Expected AuthChallenge, got {other:?}"),
-    };
-
-    let signature = sign_operator_challenge(&new_key, &challenge);
-    test_transport
-        .send(auth::Inbound::AuthChallengeSolution {
-            signature: signature.to_bytes(),
-        })
-        .await
-        .unwrap();
-
-    let response = test_transport
-        .recv()
-        .await
-        .expect("should receive auth result");
-    assert!(
-        matches!(response, Err(auth::Error::InvalidBootstrapToken)),
-        "a spent bootstrap token must not authorise a new identity, got {response:?}"
-    );
-    assert!(task.await.unwrap().is_err(), "authentication must fail");
-
-    let mut conn = db.get().await.unwrap();
-    let registered: i64 = schema::operator_identity::table
-        .count()
-        .get_result(&mut conn)
-        .await
-        .unwrap();
-    assert_eq!(
-        registered, 0,
-        "no identity may be registered after the bootstrap"
-    );
-}

server/crates/arbiter-server/tests/operator/unseal.rs

@@ -4,8 +4,7 @@ use arbiter_server::{
         GlobalActors,
         vault::{Bootstrap, Seal},
     },
-    crypto::KeyCell,
-    db::{self, models::OperatorId},
+    db,
     peers::operator::{
         Credentials,
         vault_gate::{
@@ -20,7 +19,7 @@ use tokio::sync::oneshot;
 use x25519_dalek::{EphemeralSecret, PublicKey};
 
 async fn setup_sealed_gate(
-    seal_key: [u8; 32],
+    seal_key: &[u8; 32],
 ) -> (
     db::DatabasePool,
     kameo::actor::ActorRef<VaultGate>,
@@ -32,8 +31,7 @@ async fn setup_sealed_gate(
     actors
         .vault
         .ask(Bootstrap {
-            seal_key: KeyCell::from(seal_key),
-            custody: None,
+            seal_key: arbiter_server::crypto::KeyCell::from(*seal_key),
         })
         .await
         .unwrap();
@@ -41,10 +39,7 @@ async fn setup_sealed_gate(
 
     let (promotion_tx, promotion_rx) = oneshot::channel();
     let pubkey = authn::SigningKey::generate().public_key();
-    let auth_creds = Credentials {
-        id: OperatorId::from_raw(1),
-        pubkey,
-    };
+    let auth_creds = Credentials { id: 1, pubkey };
     let gate = VaultGate::spawn(VaultGate::new(auth_creds, actors, db.clone(), promotion_tx));
 
     (db, gate, promotion_rx)
@@ -52,7 +47,7 @@ async fn setup_sealed_gate(
 
 async fn client_dh_encrypt(
     gate: &kameo::actor::ActorRef<VaultGate>,
-    key_to_send: &[u8],
+    key_to_send: &[u8; 32],
 ) -> HandleUnsealEncryptedKey {
     let client_secret = EphemeralSecret::random();
     let client_public = PublicKey::from(&client_secret);
@@ -85,10 +80,10 @@ async fn client_dh_encrypt(
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_success() {
-    let seal_key = [7u8; 32];
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
     let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;
 
-    let encrypted_key = client_dh_encrypt(&gate, &seal_key).await;
+    let encrypted_key = client_dh_encrypt(&gate, seal_key).await;
 
     let response = gate.ask(encrypted_key).await;
     assert!(matches!(response, Ok(())));
@@ -97,10 +92,10 @@ pub async fn unseal_success() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_wrong_seal_key() {
-    let seal_key = [7u8; 32];
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
     let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;
 
-    let encrypted_key = client_dh_encrypt(&gate, &[8u8; 32]).await;
+    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key-padded-to-32-bytes!!!!").await;
 
     let response = gate.ask(encrypted_key).await;
     assert!(matches!(
@@ -114,7 +109,7 @@ pub async fn unseal_wrong_seal_key() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_corrupted_ciphertext() {
-    let seal_key = [7u8; 32];
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
     let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;
 
     let client_secret = EphemeralSecret::random();
@@ -145,11 +140,11 @@ pub async fn unseal_corrupted_ciphertext() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_retry_after_invalid_key() {
-    let seal_key = [9u8; 32];
+    let seal_key = b"real-seal-key-padded-to-32bytes!";
     let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;
 
     {
-        let encrypted_key = client_dh_encrypt(&gate, &[8u8; 32]).await;
+        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key-padded-to-32-bytes!!!!").await;
 
         let response = gate.ask(encrypted_key).await;
         assert!(matches!(
@@ -161,7 +156,7 @@ pub async fn unseal_retry_after_invalid_key() {
     }
 
     {
-        let encrypted_key = client_dh_encrypt(&gate, &seal_key).await;
+        let encrypted_key = client_dh_encrypt(&gate, seal_key).await;
 
         let response = gate.ask(encrypted_key).await;
         assert!(matches!(response, Ok(())));

server/crates/arbiter-server/tests/vault.rs

@@ -2,8 +2,6 @@ mod common;
 
 #[path = "vault/concurrency.rs"]
 mod concurrency;
-#[path = "vault/custody.rs"]
-mod custody;
 #[path = "vault/lifecycle.rs"]
 mod lifecycle;
 #[path = "vault/storage.rs"]

server/crates/arbiter-server/tests/vault/concurrency.rs

@@ -5,7 +5,6 @@ use arbiter_server::{
         GlobalActors,
         vault::{CreateNew, Error, Vault},
     },
-    crypto::KeyCell,
     db::{self, models, schema},
 };
 
@@ -15,8 +14,6 @@ use kameo::actor::{ActorRef, Spawn as _};
 use std::collections::{HashMap, HashSet};
 use tokio::task::JoinSet;
 
-const TEST_AAD: &[u8] = b"test-aad";
-
 async fn write_concurrently(
     actor: ActorRef<Vault>,
     prefix: &'static str,
@@ -30,7 +27,6 @@ async fn write_concurrently(
             let id = actor
                 .ask(CreateNew {
                     plaintext: SafeCell::new(plaintext.clone()),
-                    aad: TEST_AAD.to_vec(),
                 })
                 .await
                 .unwrap();
@@ -124,7 +120,7 @@ async fn insert_failure_does_not_create_partial_row() {
     drop(conn);
 
     let err = actor
-        .create_new(SafeCell::new(b"should fail".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"should fail".to_vec()))
         .await
         .unwrap_err();
     assert!(matches!(err, Error::DatabaseTransaction(_)));
@@ -170,12 +166,12 @@ async fn decrypt_roundtrip_after_high_concurrency() {
         .await
         .unwrap();
     decryptor
-        .try_unseal(KeyCell::from([0u8; 32]))
+        .try_unseal(arbiter_server::crypto::KeyCell::from([0u8; 32]))
         .await
         .unwrap();
 
     for (id, plaintext) in expected {
-        let mut decrypted = decryptor.decrypt(id, TEST_AAD.to_vec()).await.unwrap();
+        let mut decrypted = decryptor.decrypt(id).await.unwrap();
         assert_eq!(*decrypted.read(), plaintext);
     }
 }

server/crates/arbiter-server/tests/vault/custody.rs

@@ -1,387 +0,0 @@
-//! End-to-end coverage for the Shamir custody ceremonies.
-
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-use arbiter_server::{
-    actors::{
-        GlobalActors,
-        vault::{Bootstrap, Error as VaultError, GetState, Seal, Vault, VaultState},
-        vault_coordinator::{ContributeBootstrap, ContributeUnseal, StartBootstrap},
-    },
-    crypto::{KeyCell, shamir},
-    db::{
-        self,
-        custody::{CustodyRecord, EncryptedShare},
-        models::OperatorId,
-        schema,
-    },
-};
-
-use diesel::{ExpressionMethods as _, QueryDsl};
-use diesel_async::RunQueryDsl;
-
-/// Register `count` operator identities so committee members satisfy the
-/// foreign key from `operator` to `operator_identity`.
-async fn register_operators(db: &db::DatabasePool, count: usize) -> Vec<OperatorId> {
-    let mut conn = db.get().await.unwrap();
-    let mut ids = Vec::with_capacity(count);
-    for index in 0..count {
-        let pubkey = vec![u8::try_from(index).unwrap(); 32];
-        let id: OperatorId = diesel::insert_into(schema::operator_identity::table)
-            .values((schema::operator_identity::public_key.eq(pubkey),))
-            .returning(schema::operator_identity::id)
-            .get_result(&mut conn)
-            .await
-            .unwrap();
-        ids.push(id);
-    }
-    ids
-}
-
-async fn stored_share_count(db: &db::DatabasePool) -> i64 {
-    let mut conn = db.get().await.unwrap();
-    schema::operator::table
-        .count()
-        .get_result(&mut conn)
-        .await
-        .unwrap()
-}
-
-async fn stored_threshold(db: &db::DatabasePool) -> Option<i32> {
-    let mut conn = db.get().await.unwrap();
-    schema::arbiter_settings::table
-        .select(schema::arbiter_settings::shamir_threshold)
-        .first(&mut conn)
-        .await
-        .unwrap()
-}
-
-fn passphrase(seed: u8) -> SafeCell<Vec<u8>> {
-    SafeCell::new(vec![seed; 16])
-}
-
-/// The happy path: three operators bootstrap, and any two of them reopen the
-/// vault after it is sealed.
-#[tokio::test]
-#[test_log::test]
-async fn committee_of_three_unseals_with_two_passphrases() {
-    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
-    let operators = register_operators(&db, 3).await;
-
-    actors
-        .vault_coordinator
-        .ask(StartBootstrap {
-            operator_id: operators[0],
-            declared_count: 3,
-        })
-        .await
-        .unwrap();
-
-    for (index, operator_id) in operators.iter().enumerate() {
-        let finished = actors
-            .vault_coordinator
-            .ask(ContributeBootstrap {
-                operator_id: *operator_id,
-                passphrase: passphrase(u8::try_from(index).unwrap()),
-            })
-            .await
-            .unwrap();
-        assert_eq!(
-            finished,
-            index == 2,
-            "the ceremony finishes only on the last contribution"
-        );
-    }
-
-    assert_eq!(
-        actors.vault.ask(GetState {}).await.unwrap(),
-        VaultState::Unsealed
-    );
-    assert_eq!(stored_share_count(&db).await, 3);
-    assert_eq!(stored_threshold(&db).await, Some(2));
-
-    actors.vault.ask(Seal {}).await.unwrap();
-
-    let first = actors
-        .vault_coordinator
-        .ask(ContributeUnseal {
-            operator_id: operators[0],
-            passphrase: passphrase(0),
-        })
-        .await
-        .unwrap();
-    assert!(!first, "one of two shares must not unseal");
-
-    let second = actors
-        .vault_coordinator
-        .ask(ContributeUnseal {
-            operator_id: operators[2],
-            passphrase: passphrase(2),
-        })
-        .await
-        .unwrap();
-    assert!(second, "the threshold contribution should unseal the vault");
-    assert_eq!(
-        actors.vault.ask(GetState {}).await.unwrap(),
-        VaultState::Unsealed
-    );
-}
-
-/// Shares that describe a seal key the vault never adopted would make the vault
-/// permanently un-unsealable, so a refused bootstrap must leave the table empty.
-#[tokio::test]
-#[test_log::test]
-async fn refused_bootstrap_stores_no_shares() {
-    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
-    let operators = register_operators(&db, 1).await;
-
-    // Another path bootstraps the vault first; the ceremony now has nowhere to go.
-    actors
-        .vault
-        .ask(Bootstrap {
-            seal_key: KeyCell::from([4u8; 32]),
-            custody: None,
-        })
-        .await
-        .unwrap();
-
-    actors
-        .vault_coordinator
-        .ask(StartBootstrap {
-            operator_id: operators[0],
-            declared_count: 1,
-        })
-        .await
-        .unwrap();
-
-    let error = actors
-        .vault_coordinator
-        .ask(ContributeBootstrap {
-            operator_id: operators[0],
-            passphrase: passphrase(1),
-        })
-        .await
-        .expect_err("bootstrapping an already bootstrapped vault must fail");
-    assert!(
-        format!("{error:?}").contains("AlreadyBootstrapped"),
-        "expected AlreadyBootstrapped, got {error:?}"
-    );
-
-    assert_eq!(
-        stored_share_count(&db).await,
-        0,
-        "a refused bootstrap must not leave shares behind"
-    );
-    assert_eq!(
-        stored_threshold(&db).await,
-        None,
-        "a refused bootstrap must not leave a threshold behind"
-    );
-}
-
-/// A failing custody write must take the whole bootstrap down with it: a vault
-/// that kept its root key but lost the shares could never be unsealed again.
-#[tokio::test]
-#[test_log::test]
-async fn custody_write_failure_rolls_back_bootstrap() {
-    let db = db::create_test_pool().await;
-    let operators = register_operators(&db, 1).await;
-    let record = CustodyRecord {
-        threshold: 1,
-        shares: operators
-            .into_iter()
-            .map(|operator_id| {
-                (
-                    operator_id,
-                    EncryptedShare {
-                        ciphertext: vec![1; 32],
-                        nonce: vec![2; 24],
-                        salt: vec![3; 16],
-                    },
-                )
-            })
-            .collect(),
-    };
-    let mut vault = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
-        .await
-        .unwrap();
-
-    // The threshold update is the last statement of the custody write, so the
-    // trigger fails the transaction once the share row is already in place.
-    let mut conn = db.get().await.unwrap();
-    diesel::sql_query(
-        "CREATE TRIGGER fail_custody_threshold BEFORE UPDATE OF shamir_threshold ON arbiter_settings BEGIN SELECT RAISE(ABORT, 'forced custody failure'); END;",
-    )
-    .execute(&mut conn)
-    .await
-    .unwrap();
-    drop(conn);
-
-    let error = vault
-        .bootstrap(KeyCell::from([4u8; 32]), Some(record))
-        .await
-        .expect_err("a failing custody write must fail the bootstrap");
-    assert!(
-        matches!(error, VaultError::Custody(_)),
-        "expected a custody error, got {error:?}"
-    );
-    assert_eq!(vault.get_state(), VaultState::Unbootstrapped);
-    assert_eq!(stored_share_count(&db).await, 0);
-    assert_eq!(stored_threshold(&db).await, None);
-
-    let mut conn = db.get().await.unwrap();
-    let root_count: i64 = schema::root_key_history::table
-        .count()
-        .get_result(&mut conn)
-        .await
-        .unwrap();
-    let root_key_id: Option<i32> = schema::arbiter_settings::table
-        .select(schema::arbiter_settings::root_key_id)
-        .first(&mut conn)
-        .await
-        .unwrap();
-    assert_eq!(root_count, 0, "the root key write must roll back as well");
-    assert_eq!(root_key_id, None);
-}
-
-#[tokio::test]
-#[test_log::test]
-async fn oversized_and_degenerate_committees_are_rejected() {
-    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
-    let operators = register_operators(&db, 1).await;
-
-    for (count, expected) in [
-        (0_usize, "EmptyCommittee"),
-        (2, "UnsupportedCommittee"),
-        (shamir::MAX_COMMITTEE_SIZE + 1, "CommitteeTooLarge"),
-        (usize::MAX, "CommitteeTooLarge"),
-    ] {
-        let error = actors
-            .vault_coordinator
-            .ask(StartBootstrap {
-                operator_id: operators[0],
-                declared_count: count,
-            })
-            .await
-            .expect_err("committee size must be rejected");
-        assert!(
-            format!("{error:?}").contains(expected),
-            "expected {expected} for count {count}, got {error:?}"
-        );
-    }
-}
-
-/// A committee whose members never all show up would otherwise wedge the
-/// coordinator until restart. Only the operator that declared it may reset it.
-#[tokio::test]
-#[test_log::test]
-async fn only_the_declarer_may_restart_a_stalled_committee() {
-    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
-    let operators = register_operators(&db, 3).await;
-
-    actors
-        .vault_coordinator
-        .ask(StartBootstrap {
-            operator_id: operators[0],
-            declared_count: 3,
-        })
-        .await
-        .unwrap();
-    actors
-        .vault_coordinator
-        .ask(ContributeBootstrap {
-            operator_id: operators[0],
-            passphrase: passphrase(0),
-        })
-        .await
-        .unwrap();
-
-    let error = actors
-        .vault_coordinator
-        .ask(StartBootstrap {
-            operator_id: operators[1],
-            declared_count: 3,
-        })
-        .await
-        .expect_err("a bystander must not reset someone else's ceremony");
-    assert!(
-        format!("{error:?}").contains("AlreadyBootstrapping"),
-        "expected AlreadyBootstrapping, got {error:?}"
-    );
-
-    actors
-        .vault_coordinator
-        .ask(StartBootstrap {
-            operator_id: operators[0],
-            declared_count: 1,
-        })
-        .await
-        .expect("the declarer may restart the ceremony");
-
-    let finished = actors
-        .vault_coordinator
-        .ask(ContributeBootstrap {
-            operator_id: operators[0],
-            passphrase: passphrase(0),
-        })
-        .await
-        .unwrap();
-    assert!(
-        finished,
-        "the restarted one-operator ceremony should complete"
-    );
-    assert_eq!(stored_share_count(&db).await, 1);
-}
-
-/// A wrong passphrase must not unseal, and the operator must be able to retry.
-#[tokio::test]
-#[test_log::test]
-async fn wrong_passphrase_is_rejected_and_retryable() {
-    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
-    let operators = register_operators(&db, 1).await;
-
-    actors
-        .vault_coordinator
-        .ask(StartBootstrap {
-            operator_id: operators[0],
-            declared_count: 1,
-        })
-        .await
-        .unwrap();
-    actors
-        .vault_coordinator
-        .ask(ContributeBootstrap {
-            operator_id: operators[0],
-            passphrase: passphrase(7),
-        })
-        .await
-        .unwrap();
-    actors.vault.ask(Seal {}).await.unwrap();
-
-    let error = actors
-        .vault_coordinator
-        .ask(ContributeUnseal {
-            operator_id: operators[0],
-            passphrase: passphrase(8),
-        })
-        .await
-        .expect_err("a wrong passphrase must not unseal");
-    assert!(
-        format!("{error:?}").contains("InvalidPassphrase"),
-        "expected InvalidPassphrase, got {error:?}"
-    );
-
-    let unsealed = actors
-        .vault_coordinator
-        .ask(ContributeUnseal {
-            operator_id: operators[0],
-            passphrase: passphrase(7),
-        })
-        .await
-        .expect("the operator may retry with the correct passphrase");
-    assert!(unsealed, "the retry should unseal the vault");
-}

server/crates/arbiter-server/tests/vault/lifecycle.rs

@@ -5,28 +5,23 @@ use arbiter_server::{
         GlobalActors,
         vault::{Error, Vault},
     },
-    crypto::{
-        KeyCell,
-        encryption::v1::{Nonce, ROOT_KEY_TAG},
-    },
+    crypto::{KeyCell, encryption::v1::{Nonce, ROOT_KEY_TAG}},
     db::{self, models, schema},
 };
 
 use diesel::{QueryDsl, SelectableHelper};
 use diesel_async::RunQueryDsl;
 
-const TEST_AAD: &[u8] = b"test-aad";
-
 #[tokio::test]
 #[test_log::test]
-async fn bootstrap() {
+async fn test_bootstrap() {
     let db = db::create_test_pool().await;
     let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
         .await
         .unwrap();
 
     let seal_key = KeyCell::from([0u8; 32]);
-    actor.bootstrap(seal_key, None).await.unwrap();
+    actor.bootstrap(seal_key).await.unwrap();
 
     let mut conn = db.get().await.unwrap();
     let row: models::RootKeyHistory = schema::root_key_history::table
@@ -44,25 +39,25 @@ async fn bootstrap() {
 
 #[tokio::test]
 #[test_log::test]
-async fn bootstrap_rejects_double() {
+async fn test_bootstrap_rejects_double() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
     let seal_key2 = KeyCell::from([0u8; 32]);
-    let err = actor.bootstrap(seal_key2, None).await.unwrap_err();
+    let err = actor.bootstrap(seal_key2).await.unwrap_err();
     assert!(matches!(err, Error::AlreadyBootstrapped));
 }
 
 #[tokio::test]
 #[test_log::test]
-async fn create_new_before_bootstrap_fails() {
+async fn test_create_new_before_bootstrap_fails() {
     let db = db::create_test_pool().await;
     let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
         .await
         .unwrap();
 
     let err = actor
-        .create_new(SafeCell::new(b"data".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"data".to_vec()))
         .await
         .unwrap_err();
     assert!(matches!(err, Error::NotBootstrapped));
@@ -70,19 +65,19 @@ async fn create_new_before_bootstrap_fails() {
 
 #[tokio::test]
 #[test_log::test]
-async fn decrypt_before_bootstrap_fails() {
+async fn test_decrypt_before_bootstrap_fails() {
     let db = db::create_test_pool().await;
     let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
         .await
         .unwrap();
 
-    let err = actor.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor.decrypt(1).await.unwrap_err();
     assert!(matches!(err, Error::NotBootstrapped));
 }
 
 #[tokio::test]
 #[test_log::test]
-async fn new_restores_sealed_state() {
+async fn test_new_restores_sealed_state() {
     let db = db::create_test_pool().await;
     let actor = common::bootstrapped_vault(&db).await;
     drop(actor);
@@ -90,19 +85,19 @@ async fn new_restores_sealed_state() {
     let mut actor2 = Vault::new(db, GlobalActors::spawn_message_bus())
         .await
         .unwrap();
-    let err = actor2.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor2.decrypt(1).await.unwrap_err();
     assert!(matches!(err, Error::Sealed));
 }
 
 #[tokio::test]
 #[test_log::test]
-async fn unseal_correct_password() {
+async fn test_unseal_correct_password() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
     let plaintext = b"survive a restart";
     let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
         .await
         .unwrap();
     drop(actor);
@@ -113,19 +108,19 @@ async fn unseal_correct_password() {
     let seal_key = KeyCell::from([0u8; 32]);
     actor.try_unseal(seal_key).await.unwrap();
 
-    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
     assert_eq!(*decrypted.read(), plaintext);
 }
 
 #[tokio::test]
 #[test_log::test]
-async fn unseal_wrong_then_correct_password() {
+async fn test_unseal_wrong_then_correct_password() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
     let plaintext = b"important data";
     let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
         .await
         .unwrap();
     drop(actor);
@@ -141,6 +136,6 @@ async fn unseal_wrong_then_correct_password() {
     let good_key = KeyCell::from([0u8; 32]);
     actor.try_unseal(good_key).await.unwrap();
 
-    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
     assert_eq!(*decrypted.read(), plaintext);
 }

server/crates/arbiter-server/tests/vault/storage.rs

@@ -10,47 +10,45 @@ use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper, dsl::update};
 use diesel_async::RunQueryDsl;
 use std::collections::HashSet;
 
-const TEST_AAD: &[u8] = b"test-aad";
-
 #[tokio::test]
 #[test_log::test]
-async fn create_decrypt_roundtrip() {
+async fn test_create_decrypt_roundtrip() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
     let plaintext = b"hello arbiter";
     let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
         .await
         .unwrap();
 
-    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
     assert_eq!(*decrypted.read(), plaintext);
 }
 
 #[tokio::test]
 #[test_log::test]
-async fn decrypt_nonexistent_returns_not_found() {
+async fn test_decrypt_nonexistent_returns_not_found() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
-    let err = actor.decrypt(9999, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor.decrypt(9999).await.unwrap_err();
     assert!(matches!(err, Error::NotFound));
 }
 
 #[tokio::test]
 #[test_log::test]
-async fn ciphertext_differs_across_entries() {
+async fn test_ciphertext_differs_across_entries() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
     let plaintext = b"same content";
     let id1 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
         .await
         .unwrap();
     let id2 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
         .await
         .unwrap();
 
@@ -70,22 +68,22 @@ async fn ciphertext_differs_across_entries() {
 
     assert_ne!(row1.ciphertext, row2.ciphertext);
 
-    let mut d1 = actor.decrypt(id1, TEST_AAD.to_vec()).await.unwrap();
-    let mut d2 = actor.decrypt(id2, TEST_AAD.to_vec()).await.unwrap();
+    let mut d1 = actor.decrypt(id1).await.unwrap();
+    let mut d2 = actor.decrypt(id2).await.unwrap();
     assert_eq!(*d1.read(), plaintext);
     assert_eq!(*d2.read(), plaintext);
 }
 
 #[tokio::test]
 #[test_log::test]
-async fn nonce_never_reused() {
+async fn test_nonce_never_reused() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
     let n = 5;
     for i in 0..n {
         actor
-            .create_new(SafeCell::new(format!("secret {i}").into_bytes()), TEST_AAD.to_vec())
+            .create_new(SafeCell::new(format!("secret {i}").into_bytes()))
             .await
             .unwrap();
     }
@@ -139,7 +137,7 @@ async fn broken_db_nonce_format_fails_closed() {
     drop(conn);
 
     let err = actor
-        .create_new(SafeCell::new(b"must fail".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"must fail".to_vec()))
         .await
         .unwrap_err();
     assert!(matches!(err, Error::BrokenDatabase));
@@ -147,7 +145,7 @@ async fn broken_db_nonce_format_fails_closed() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
     let id = actor
-        .create_new(SafeCell::new(b"decrypt target".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"decrypt target".to_vec()))
         .await
         .unwrap();
     let mut conn = db.get().await.unwrap();
@@ -158,6 +156,6 @@ async fn broken_db_nonce_format_fails_closed() {
         .unwrap();
     drop(conn);
 
-    let err = actor.decrypt(id, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor.decrypt(id).await.unwrap_err();
     assert!(matches!(err, Error::BrokenDatabase));
 }