deps(server): version bump

2026-08-28 17:44:11 +02:00
55 changed files with 1922 additions and 2105 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,16 +1,13 @@
 # AGENTS.md

-Guidance for coding agents (Claude Code, Codex, …) working in this repository.
+This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.

 ## Project Overview

-Arbiter is a **permissioned signing service** for cryptocurrency wallets:
-
+Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
 - **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
- **`useragent/`** — Flutter app (desktop + mobile + web targets) with a Rust core via `flutter_rust_bridge`
- **`protobufs/`** — Protocol Buffer definitions shared between server and clients
- **`docs/`** — `ARCHITECTURE.md` (peer types, flows, threat model) and `IMPLEMENTATION.md`; treat them as the design source of truth and update them when behaviour changes
- **`scripts/`** — helper scripts, e.g. `gen_erc20_registry.py`
+- **`operator/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
+- **`protobufs/`** — Protocol Buffer definitions shared between server and client

 The vault never exposes key material; it only produces signatures when requests satisfy configured policies.

@@ -21,7 +18,7 @@ Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
 mise install
 ```

-Key versions live in `mise.toml` (currently Rust 1.95.0 with clippy, Flutter 3.41.7-stable, protoc 29.6, diesel_cli 2.3.7 with `sqlite-bundled`, Python 3.14). Also provided there: `cargo-nextest`, `cargo-audit`, `cargo-vet`, `cargo-shear`, `cargo-mutants`, `cargo-features-manager`, `cargo-edit`, `ast-grep`, `flutter_rust_bridge_codegen`.
+Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).

 ## Server (Rust workspace at `server/`)

@@ -29,14 +26,10 @@ Key versions live in `mise.toml` (currently Rust 1.95.0 with clippy, Flutter 3.4

 | Crate | Purpose |
 |---|---|
-| `arbiter-proto` | Generated gRPC stubs + protobuf types (`tonic-prost-build`); also `ArbiterUrl`, `home_path()`, `BOOTSTRAP_PATH` |
-| `arbiter-crypto` | Shared crypto primitives: `authn` (ML-DSA), `safecell` (hardened memory), `hashing::Hashable`, re-exported `x-wing` |
-| `arbiter-macros` | `#[derive(Hashable)]` — canonical hashing of structs for the DB integrity layer |
-| `arbiter-server` | Main daemon — actors, peers, DB, EVM policy engine, gRPC service implementation |
-| `arbiter-client` | Rust client library for SDK clients (`ArbiterClient`, EVM wallet, key storage) |
-| `arbiter-tokens-registry` | Generated ERC-20 token registry used by token-transfer policies |
-
-Workspace lints (`server/Cargo.toml`) are strict: most of clippy `pedantic`/`nursery` plus a large restriction set. `as` casts, indexing/slicing, `dbg!`, float arithmetic and undocumented `unsafe` are denied or warned — expect to add an `#[expect(..., reason = "...")]` rather than to silence a lint globally.
+| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
+| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
+| `arbiter-operator` | Rust client library for the operator side of the gRPC protocol |
+| `arbiter-client` | Rust client library for SDK clients |

 ### Common Commands

@@ -49,78 +42,54 @@ cargo build
 # Run the server daemon
 cargo run -p arbiter-server

-# Run all tests (preferred over cargo test; CI uses --all-features)
+# Run all tests (preferred over cargo test)
 cargo nextest run

 # Run a single test
 cargo nextest run <test_name>

-# Lint (CI runs it with -D warnings)
-cargo clippy --all -- -D warnings
+# Lint
+cargo clippy

 # Security audit
 cargo audit

-# Supply-chain review (config in server/supply-chain/)
-cargo vet
-
 # Check unused dependencies
 cargo shear

-# Mutation testing
-cargo mutants
+# Run snapshot tests and update snapshots
+cargo insta review
 ```

-### CI
-
-Woodpecker pipelines in `.woodpecker/` run on `server/**` changes: `server-lint` (clippy), `server-test` (nextest, `--all-features`), `server-audit`, `server-vet`, plus `useragent-analyze` for the Flutter app.
-
 ### Architecture

-The server is actor-based using the **kameo** crate. Long-lived state lives in `GlobalActors` (`src/actors/mod.rs`):
+The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:

- **`Bootstrapper`** — one-time bootstrap token, written to `~/.arbiter/bootstrap_token` on first run
- **`Vault`** — encrypted root key and the Sealed/Unsealed state machine; on unseal decrypts the root key into a `memsafe`-backed `SafeCell`
- **`FlowCoordinator`** — cross-connection flow between operators and SDK clients
- **`OperatorRegistry`** — tracks currently connected operators
- **`EvmActor`** — EVM transaction policy enforcement and signing
- **`events`** — a `kameo_actors::MessageBus` (`DeliveryStrategy::Guaranteed`) for cross-actor notifications
+- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
+- **`Vault`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
+- **`FlowCoordinator`** — Coordinates cross-connection flow between operators and SDK clients.
+- **`EvmActor`** — Handles EVM transaction policy enforcement and signing.

-Per-connection state lives under **`src/peers/`**, not `actors/`: `peers/client/` and `peers/operator/`, each with `auth` (challenge-response) and `session` (post-auth) sub-modules; the operator side additionally has `vault_gate/` for the unseal handshake.
+Per-connection actors live under `actors/operator/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.

-The gRPC surface lives in **`src/grpc/`**, split per peer (`client/`, `operator/`, `common/`) and per direction (`inbound.rs` — requests to the daemon, `outbound.rs` — server-initiated streams), with `request_tracker.rs` correlating the two.
-
-EVM logic is in `src/evm/`: `policies/ether_transfer/`, `policies/token_transfers/`, `abi.rs`, `safe_signer.rs`.
-
-**Database:** SQLite via `diesel-async` + `bb8`. Schema in `src/db/schema.rs`, models in `src/db/models.rs`, embedded migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`; tests use a temp-file DB via `db::create_test_pool()`.
-
-Entity ids are newtypes generated by the `declare_id!` macro in `db::models` (`OperatorId`, `ChainId`, …), each a `#[repr(transparent)]` wrapper over `i32` with `to_raw`/`from_raw`. Pass these around instead of bare `i32`.
-
-**Row integrity:** sensitive rows are covered by an HMAC-SHA256 envelope (`src/crypto/integrity/`, table `integrity_envelope`), keyed from the vault root key. A struct becomes coverable by deriving `arbiter_macros::Hashable` and implementing `Integrable` (`KIND` + `VERSION`). When adding or changing a covered entity, keep the derive and the payload version in sync — a mismatch surfaces as `PayloadVersionMismatch` or `MacMismatch` at runtime.
+**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.

 **Cryptography:**
- Authentication: **ML-DSA-87** (post-quantum, `arbiter-crypto::authn::v1`), challenge-response with per-peer nonce tracking
- Encryption at rest: XChaCha20-Poly1305, versioned modules (`crypto/encryption/v1.rs`) with a `schema_version` column for transparent migration on unseal
+- Authentication: ed25519 (challenge-response, nonce-tracked per peer)
+- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
 - Password KDF: Argon2
- Unseal transport: X25519 ephemeral key exchange (`peers/operator/vault_gate/`); `x-wing` (hybrid PQ KEM) is available via `arbiter-crypto`
- TLS: self-signed certificate (rustls + aws-lc-rs, `prefer-post-quantum`), fingerprint distributed via `ArbiterUrl`
+- Unseal transport: X25519 ephemeral key exchange
+- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`

-Crypto modules are versioned by convention: `mod.rs` re-exports the current `vN`. Add a `v(N+1)` rather than editing an existing version in place.
-
-**Protocol:** gRPC with Protocol Buffers. `ArbiterUrl` encodes host, port, CA cert and bootstrap token into a single shareable string (printed to console on first run).
+**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).

 ### Proto Regeneration

-`arbiter-proto/build.rs` compiles `arbiter.proto`, `operator.proto`, `client.proto` and `evm.proto` (with their `shared/`, `operator/`, `client/` includes) on build:
+When `.proto` files in `protobufs/` change, rebuild to regenerate:
 ```sh
 cd server && cargo build -p arbiter-proto
 ```

-Dart protobuf stubs are generated separately, from the repo root:
-```sh
-mise run codegen   # protoc --dart_out=grpc:useragent/lib/proto
-```
-
 ### Database Migrations

 ```sh
@@ -131,8 +100,6 @@ diesel migration generate <name> --migration-dir crates/arbiter-server/migration
 diesel migration run --migration-dir crates/arbiter-server/migrations
 ```

-Pre-release policy: there is a single `init` migration and no deployed databases yet, so schema changes are made by editing that migration directly instead of stacking new ones. Regenerate `src/db/schema.rs` after changing it.
-
 ### Code Conventions

 **`#[must_use]` Attribute:**
@@ -154,23 +121,29 @@ pub fn verify(&self, nonce: i32, context: &[u8], signature: &Signature) -> bool

 This forces callers to either use the return value or explicitly ignore it with `let _ = ...;`, preventing silent failures.

-## User Agent (Flutter + flutter_rust_bridge at `useragent/`)
+## Operator (Flutter + Rinf at `operator/`)

-The Flutter app calls Rust through [flutter_rust_bridge](https://cjycode.com/flutter_rust_bridge/) 2.12.0. The Rust side is the `rust_lib_arbiter` crate at `useragent/rust/`; everything exposed to Dart is declared in `useragent/rust/src/api/` and lands in `useragent/lib/src/rust/` (see `useragent/flutter_rust_bridge.yaml`). Dart UI code is organised as `lib/features/`, `lib/screens/`, `lib/widgets/`, `lib/providers/`, `lib/theme/`, with routing in `lib/router.dart` (`router.gr.dart` is generated).
+The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `operator/native/hub/` as a separate crate that uses `arbiter-operator` for the gRPC client.
+
+Communication between Dart and Rust uses typed **signals** defined in `operator/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
+
+```sh
+cd operator && rinf gen
+```

 ### Common Commands

 ```sh
-cd useragent
+cd operator

-# Run the app
+# Run the app (macOS or Windows)
 flutter run

-# Regenerate Rust↔Dart bindings after editing rust/src/api/
-mise run codegen        # flutter_rust_bridge_codegen generate
+# Regenerate Rust↔Dart signal bindings
+rinf gen

-# Analyze Dart code (also run in CI)
+# Analyze Dart code
 flutter analyze
 ```

-Note: `app/` contains only stale generated Flutter artifacts and is not the application source.
+The Rinf Rust entry point is `operator/native/hub/src/lib.rs`. It spawns actors defined in `operator/native/hub/src/actors/` which handle Dart↔server communication via signals.
--- a/app/.dart_tool/extension_discovery/README.md
+++ b/app/.dart_tool/extension_discovery/README.md
@@ -0,0 +1,31 @@
+Extension Discovery Cache
+=========================
+
+This folder is used by `package:extension_discovery` to cache lists of
+packages that contains extensions for other packages.
+
+DO NOT USE THIS FOLDER
+----------------------
+
+ * Do not read (or rely) the contents of this folder.
+ * Do write to this folder.
+
+If you're interested in the lists of extensions stored in this folder use the
+API offered by package `extension_discovery` to get this information.
+
+If this package doesn't work for your use-case, then don't try to read the
+contents of this folder. It may change, and will not remain stable.
+
+Use package `extension_discovery`
+---------------------------------
+
+If you want to access information from this folder.
+
+Feel free to delete this folder
+-------------------------------
+
+Files in this folder act as a cache, and the cache is discarded if the files
+are older than the modification time of `.dart_tool/package_config.json`.
+
+Hence, it should never be necessary to clear this cache manually, if you find a
+need to do please file a bug.
--- a/app/.dart_tool/extension_discovery/vs_code.json
+++ b/app/.dart_tool/extension_discovery/vs_code.json
@@ -0,0 +1 @@
+{"version":2,"entries":[{"package":"app","rootUri":"../","packageUri":"lib/"}]}
--- a/app/.dart_tool/package_config.json
+++ b/app/.dart_tool/package_config.json
@@ -0,0 +1,178 @@
+{
+  "configVersion": 2,
+  "packages": [
+    {
+      "name": "async",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "boolean_selector",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "characters",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "clock",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "collection",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "cupertino_icons",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/cupertino_icons-1.0.8",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "fake_async",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3",
+      "packageUri": "lib/",
+      "languageVersion": "3.3"
+    },
+    {
+      "name": "flutter",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "flutter_lints",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "flutter_test",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "leak_tracker",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "leak_tracker_flutter_testing",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "leak_tracker_testing",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "lints",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "matcher",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "material_color_utilities",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1",
+      "packageUri": "lib/",
+      "languageVersion": "2.17"
+    },
+    {
+      "name": "meta",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "path",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "sky_engine",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "source_span",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "stack_trace",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "stream_channel",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4",
+      "packageUri": "lib/",
+      "languageVersion": "3.3"
+    },
+    {
+      "name": "string_scanner",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "term_glyph",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "test_api",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "vector_math",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "vm_service",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "app",
+      "rootUri": "../",
+      "packageUri": "lib/",
+      "languageVersion": "3.10"
+    }
+  ],
+  "generator": "pub",
+  "generatorVersion": "3.10.8",
+  "flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable",
+  "flutterVersion": "3.38.9",
+  "pubCache": "file:///Users/kaska/.pub-cache"
+}
--- a/app/.dart_tool/package_graph.json
+++ b/app/.dart_tool/package_graph.json
@@ -0,0 +1,230 @@
+{
+  "roots": [
+    "app"
+  ],
+  "packages": [
+    {
+      "name": "app",
+      "version": "1.0.0+1",
+      "dependencies": [
+        "cupertino_icons",
+        "flutter"
+      ],
+      "devDependencies": [
+        "flutter_lints",
+        "flutter_test"
+      ]
+    },
+    {
+      "name": "flutter_lints",
+      "version": "6.0.0",
+      "dependencies": [
+        "lints"
+      ]
+    },
+    {
+      "name": "flutter_test",
+      "version": "0.0.0",
+      "dependencies": [
+        "clock",
+        "collection",
+        "fake_async",
+        "flutter",
+        "leak_tracker_flutter_testing",
+        "matcher",
+        "meta",
+        "path",
+        "stack_trace",
+        "stream_channel",
+        "test_api",
+        "vector_math"
+      ]
+    },
+    {
+      "name": "cupertino_icons",
+      "version": "1.0.8",
+      "dependencies": []
+    },
+    {
+      "name": "flutter",
+      "version": "0.0.0",
+      "dependencies": [
+        "characters",
+        "collection",
+        "material_color_utilities",
+        "meta",
+        "sky_engine",
+        "vector_math"
+      ]
+    },
+    {
+      "name": "lints",
+      "version": "6.1.0",
+      "dependencies": []
+    },
+    {
+      "name": "stream_channel",
+      "version": "2.1.4",
+      "dependencies": [
+        "async"
+      ]
+    },
+    {
+      "name": "meta",
+      "version": "1.17.0",
+      "dependencies": []
+    },
+    {
+      "name": "collection",
+      "version": "1.19.1",
+      "dependencies": []
+    },
+    {
+      "name": "leak_tracker_flutter_testing",
+      "version": "3.0.10",
+      "dependencies": [
+        "flutter",
+        "leak_tracker",
+        "leak_tracker_testing",
+        "matcher",
+        "meta"
+      ]
+    },
+    {
+      "name": "vector_math",
+      "version": "2.2.0",
+      "dependencies": []
+    },
+    {
+      "name": "stack_trace",
+      "version": "1.12.1",
+      "dependencies": [
+        "path"
+      ]
+    },
+    {
+      "name": "clock",
+      "version": "1.1.2",
+      "dependencies": []
+    },
+    {
+      "name": "fake_async",
+      "version": "1.3.3",
+      "dependencies": [
+        "clock",
+        "collection"
+      ]
+    },
+    {
+      "name": "path",
+      "version": "1.9.1",
+      "dependencies": []
+    },
+    {
+      "name": "matcher",
+      "version": "0.12.17",
+      "dependencies": [
+        "async",
+        "meta",
+        "stack_trace",
+        "term_glyph",
+        "test_api"
+      ]
+    },
+    {
+      "name": "test_api",
+      "version": "0.7.7",
+      "dependencies": [
+        "async",
+        "boolean_selector",
+        "collection",
+        "meta",
+        "source_span",
+        "stack_trace",
+        "stream_channel",
+        "string_scanner",
+        "term_glyph"
+      ]
+    },
+    {
+      "name": "sky_engine",
+      "version": "0.0.0",
+      "dependencies": []
+    },
+    {
+      "name": "material_color_utilities",
+      "version": "0.11.1",
+      "dependencies": [
+        "collection"
+      ]
+    },
+    {
+      "name": "characters",
+      "version": "1.4.0",
+      "dependencies": []
+    },
+    {
+      "name": "async",
+      "version": "2.13.0",
+      "dependencies": [
+        "collection",
+        "meta"
+      ]
+    },
+    {
+      "name": "leak_tracker_testing",
+      "version": "3.0.2",
+      "dependencies": [
+        "leak_tracker",
+        "matcher",
+        "meta"
+      ]
+    },
+    {
+      "name": "leak_tracker",
+      "version": "11.0.2",
+      "dependencies": [
+        "clock",
+        "collection",
+        "meta",
+        "path",
+        "vm_service"
+      ]
+    },
+    {
+      "name": "term_glyph",
+      "version": "1.2.2",
+      "dependencies": []
+    },
+    {
+      "name": "string_scanner",
+      "version": "1.4.1",
+      "dependencies": [
+        "source_span"
+      ]
+    },
+    {
+      "name": "source_span",
+      "version": "1.10.2",
+      "dependencies": [
+        "collection",
+        "path",
+        "term_glyph"
+      ]
+    },
+    {
+      "name": "boolean_selector",
+      "version": "2.1.2",
+      "dependencies": [
+        "source_span",
+        "string_scanner"
+      ]
+    },
+    {
+      "name": "vm_service",
+      "version": "15.0.2",
+      "dependencies": []
+    }
+  ],
+  "configVersion": 1
+}
--- a/app/.dart_tool/version
+++ b/app/.dart_tool/version
@@ -0,0 +1 @@
+3.38.9
--- a/mise.toml
+++ b/mise.toml
@@ -22,5 +22,3 @@ run = '''
 dart pub global activate protoc_plugin && \
 protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
 '''
-
-[tasks.generate_schema]
--- a/protobufs/operator.proto
+++ b/protobufs/operator.proto
@@ -4,28 +4,25 @@ package arbiter.operator;

 import "operator/auth.proto";
 import "operator/evm.proto";
-import "operator/governance.proto";
 import "operator/sdk_client.proto";
 import "operator/vault/vault.proto";

 message OperatorRequest {
  int32 id = 16;
  oneof payload {
-    auth.Request            auth        = 1;
-    vault.Request           vault       = 2;
-    evm.Request             evm         = 3;
-    sdk_client.Request      sdk_client  = 4;
-    governance.Request      governance  = 5;
+    auth.Request auth = 1;
+    vault.Request vault = 2;
+    evm.Request evm = 3;
+    sdk_client.Request sdk_client = 4;
  }
 }

 message OperatorResponse {
  optional int32 id = 16;
  oneof payload {
-    auth.Response           auth        = 1;
-    vault.Response          vault       = 2;
-    evm.Response            evm         = 3;
-    sdk_client.Response     sdk_client  = 4;
-    governance.Response     governance  = 5;
+    auth.Response auth = 1;
+    vault.Response vault = 2;
+    evm.Response evm = 3;
+    sdk_client.Response sdk_client = 4;
  }
 }
--- a/protobufs/operator/governance.proto
+++ b/protobufs/operator/governance.proto
@@ -1,136 +0,0 @@
-syntax = "proto3";
-
-package arbiter.operator.governance;
-
-message Request {
-  oneof payload {
-    CreateProposalRequest create = 1;
-    CastVoteRequest       vote   = 2;
-    QueryPendingRequest   query  = 3;
-  }
-}
-
-message CreateProposalRequest {
-  oneof kind {
-    ApproveSdkClientPayload         approve_sdk_client          = 1;
-    GrantWalletAccessPayload        grant_wallet_access         = 3;
-    ApproveServerUpdatePayload      approve_server_update       = 4;
-    ReplaceOperatorPayload          replace_operator            = 5;
-    UpdateShamirParametersPayload   update_shamir_parameters    = 6;
-    ApprovePersistentGrantPayload   approve_persistent_grant    = 7;
-    ApproveOneOffTransactionPayload approve_one_off_transaction = 8;
-  }
-  optional uint32 ttl_secs = 2;
-}
-
-message ReplaceOperatorPayload {
-  int32 old_operator_id = 1;
-  bytes new_pubkey      = 2;
-}
-
-message UpdateShamirParametersPayload {
-  uint32 new_n = 1;
-}
-
-message ApproveServerUpdatePayload {}
-
-message ApproveSdkClientPayload {
-  int32 client_id = 1;
-}
-
-message GrantWalletAccessPayload {
-  int32 wallet_id = 1;
-  int32 client_id = 2;
-}
-
-message CastVoteRequest {
-  int32 proposal_id = 1;
-  bool  approve     = 2;
-  bytes signature   = 3;
-}
-
-message QueryPendingRequest {}
-
-message Response {
-  oneof payload {
-    CreateProposalResponse created = 1;
-    VoteResponse           voted   = 2;
-    QueryPendingResponse   pending = 3;
-  }
-}
-
-message CreateProposalResponse {
-  int32 proposal_id = 1;
-}
-
-message VoteResponse {
-  VoteOutcome outcome = 1;
-}
-
-enum VoteOutcome {
-  VOTE_OUTCOME_UNSPECIFIED = 0;
-  VOTE_OUTCOME_PENDING     = 1;
-  VOTE_OUTCOME_APPROVED    = 2;
-  VOTE_OUTCOME_REJECTED    = 3;
-}
-
-message ProposalSummary {
-  int32  id            = 1;
-  string kind          = 2;
-  int32  initiator_id  = 3;
-  int64  expires_at    = 4;
-  int64  approve_count = 5;
-  int64  reject_count  = 6;
-}
-
-message QueryPendingResponse {
-  repeated ProposalSummary proposals = 1;
-}
-
-message TransactionRateLimitProto {
-  uint32 count       = 1;
-  int64  window_secs = 2;
-}
-
-message VolumeLimitProto {
-  bytes max_volume  = 1;
-  int64 window_secs = 2;
-}
-
-message EtherTransferSpecProto {
-  repeated bytes   targets = 1;
-  VolumeLimitProto limit   = 2;
-}
-
-message TokenTransferSpecProto {
-  bytes                     token_contract = 1;
-  optional bytes            target         = 2;
-  repeated VolumeLimitProto volume_limits  = 3;
-}
-
-message ApproveOneOffTransactionPayload {
-  int32  client_id                = 1;
-  bytes  wallet_address           = 2;
-  uint64 chain_id                 = 3;
-  uint64 nonce                    = 4;
-  uint64 gas_limit                = 5;
-  bytes  max_fee_per_gas          = 6;
-  bytes  max_priority_fee_per_gas = 7;
-  bytes  to                       = 8;
-  bytes  value                    = 9;
-  bytes  input                    = 10;
-}
-
-message ApprovePersistentGrantPayload {
-  int32                              wallet_access_id         = 1;
-  uint64                             chain_id                 = 2;
-  optional int64                     valid_from_secs          = 3;
-  optional int64                     valid_until_secs         = 4;
-  optional bytes                     max_gas_fee_per_gas      = 5;
-  optional bytes                     max_priority_fee_per_gas = 6;
-  optional TransactionRateLimitProto rate_limit               = 7;
-  oneof specific {
-    EtherTransferSpecProto ether_transfer = 8;
-    TokenTransferSpecProto token_transfer = 9;
-  }
-}
--- a/protobufs/operator/vault/bootstrap.proto
+++ b/protobufs/operator/vault/bootstrap.proto
@@ -8,35 +8,15 @@ message BootstrapEncryptedKey {
  bytes associated_data = 3;
 }

-message DeclareCommittee {
-  uint32 count          = 1;
-  uint32 recovery_count = 2;
-}
-
-message ContributePassphrase {
-  bytes passphrase = 1;
-}
-
-message ContributeRecoveryPassphrase {
-  int32 recovery_operator_id = 1;
-  bytes passphrase            = 2;
-}
-
 enum BootstrapResult {
  BOOTSTRAP_RESULT_UNSPECIFIED = 0;
  BOOTSTRAP_RESULT_SUCCESS = 1;
  BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
  BOOTSTRAP_RESULT_INVALID_KEY = 3;
-  BOOTSTRAP_RESULT_AWAITING_CONTRIBUTIONS = 4;
 }

 message Request {
-  oneof payload {
-    BootstrapEncryptedKey        encrypted_key                    = 2;
-    DeclareCommittee             declare_committee                = 3;
-    ContributePassphrase         contribute_passphrase            = 4;
-    ContributeRecoveryPassphrase contribute_recovery_passphrase   = 5;
-  }
+  BootstrapEncryptedKey encrypted_key = 2;
 }

 message Response {
--- a/protobufs/operator/vault/rekey.proto
+++ b/protobufs/operator/vault/rekey.proto
@@ -1,30 +0,0 @@
-syntax = "proto3";
-
-package arbiter.operator.vault.rekey;
-
-message ContributePassphrase {
-  bytes passphrase = 1;
-}
-
-message ContributeRecoveryPassphrase {
-  int32 recovery_operator_id = 1;
-  bytes passphrase           = 2;
-}
-
-enum RekeyResult {
-  REKEY_RESULT_UNSPECIFIED            = 0;
-  REKEY_RESULT_SUCCESS                = 1;
-  REKEY_RESULT_AWAITING_CONTRIBUTIONS = 2;
-  REKEY_RESULT_NOT_IN_PROGRESS        = 3;
-}
-
-message Request {
-  oneof payload {
-    ContributePassphrase         contribute_passphrase          = 1;
-    ContributeRecoveryPassphrase contribute_recovery_passphrase = 2;
-  }
-}
-
-message Response {
-  RekeyResult result = 1;
-}
--- a/protobufs/operator/vault/unseal.proto
+++ b/protobufs/operator/vault/unseal.proto
@@ -15,29 +15,17 @@ message UnsealEncryptedKey {
  bytes associated_data = 3;
 }

-message ContributePassphrase {
-  bytes passphrase = 1;
-}
-
-message ContributeRecoveryPassphrase {
-  int32 recovery_operator_id = 1;
-  bytes passphrase            = 2;
-}
-
 enum UnsealResult {
  UNSEAL_RESULT_UNSPECIFIED = 0;
  UNSEAL_RESULT_SUCCESS = 1;
  UNSEAL_RESULT_INVALID_KEY = 2;
  UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
-  UNSEAL_RESULT_AWAITING_CONTRIBUTIONS = 4;
 }

 message Request {
  oneof payload {
-    UnsealStart                  start                          = 1;
-    UnsealEncryptedKey           encrypted_key                  = 2;
-    ContributePassphrase         contribute_passphrase          = 3;
-    ContributeRecoveryPassphrase contribute_recovery_passphrase = 4;
+    UnsealStart start = 1;
+    UnsealEncryptedKey encrypted_key = 2;
  }
 }

--- a/protobufs/operator/vault/vault.proto
+++ b/protobufs/operator/vault/vault.proto
@@ -5,23 +5,20 @@ package arbiter.operator.vault;
 import "google/protobuf/empty.proto";
 import "shared/vault.proto";
 import "operator/vault/bootstrap.proto";
-import "operator/vault/rekey.proto";
 import "operator/vault/unseal.proto";

 message Request {
  oneof payload {
    google.protobuf.Empty query_state = 1;
-    unseal.Request        unseal      = 2;
-    bootstrap.Request     bootstrap   = 3;
-    rekey.Request         rekey       = 4;
+    unseal.Request unseal = 2;
+    bootstrap.Request bootstrap = 3;
  }
 }

 message Response {
  oneof payload {
-    arbiter.shared.VaultState state     = 1;
-    unseal.Response           unseal    = 2;
-    bootstrap.Response        bootstrap = 3;
-    rekey.Response            rekey     = 4;
+    arbiter.shared.VaultState state = 1;
+    unseal.Response unseal = 2;
+    bootstrap.Response bootstrap = 3;
  }
 }
--- a/protobufs/shared/vault.proto
+++ b/protobufs/shared/vault.proto
@@ -5,8 +5,7 @@ package arbiter.shared;
 enum VaultState {
  VAULT_STATE_UNSPECIFIED = 0;
  VAULT_STATE_UNBOOTSTRAPPED = 1;
-  VAULT_STATE_BOOSTRAPPING = 2;
-  VAULT_STATE_SEALED = 3;
-  VAULT_STATE_UNSEALED = 4;
-  VAULT_STATE_ERROR = 5;
+  VAULT_STATE_SEALED = 2;
+  VAULT_STATE_UNSEALED = 3;
+  VAULT_STATE_ERROR = 4;
 }
--- a/scripts/pycache/gen_erc20_registry.cpython-314.pyc
+++ b/scripts/pycache/gen_erc20_registry.cpython-314.pyc
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -6,34 +6,33 @@ resolver = "3"


 [workspace.dependencies]
-alloy = "2.0.4"
-async-trait = "0.1.89"
-base64 = "0.22.1"
-chrono = { version = "0.4.44", features = ["serde"] }
-futures = "0.3.32"
+alloy = "2.4.1"
+async-trait = "0.1.92"
+base64 = "0.23.1"
+chrono = { version = "0.4.45", features = ["serde"] }
+futures = "0.3.34"
 k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
 kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
-ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
+ml-dsa = { version = "0.1.1", features = ["zeroize"] }
 mutants = "0.0.4"
-prost = "0.14.3"
-prost-types = { version = "0.14.3", features = ["chrono"] }
-rand = "0.10.1"
-rand_core = "0.10.1"
-rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
+prost = "0.14.4"
+prost-types = { version = "0.14.4", features = ["chrono"] }
+rand = "0.10.2"
+rcgen = { version = "0.14.9", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
-rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
-rustls-pki-types = "1.14.1"
+rustls = { version = "0.23.43", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
+rustls-pki-types = "1.15.1"
 sha2 = "0.11"
 smlang = "0.8.0"
-thiserror = "2.0.18"
-tokio = { version = "1.52.1", features = ["full"] }
-tokio-stream = { version = "0.1.18", features = ["full"] }
-tonic = { version = "0.14.5", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
+thiserror = "2.0.20"
+tokio = { version = "1.53.1", features = ["full"] }
+tokio-stream = { version = "0.1.19", features = ["full"] }
+tonic = { version = "0.14.6", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
 tracing = "0.1.44"
-x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
+x25519-dalek = { version = "3.0.0", features = ["getrandom"] }

 [workspace.lints.rust]
 missing_unsafe_on_extern = "deny"
--- a/server/crates/arbiter-client/Cargo.toml
+++ b/server/crates/arbiter-client/Cargo.toml
@@ -20,8 +20,8 @@ tonic.features = ["tls-aws-lc"]
 tokio.workspace = true
 tokio-stream.workspace = true
 thiserror.workspace = true
-http = "1.4.0"
-rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] }
+http = "1.5.0"
+rustls-webpki = { version = "0.103.15", features = ["aws-lc-rs"] }
 async-trait.workspace = true
 chrono.workspace = true

--- a/server/crates/arbiter-crypto/Cargo.toml
+++ b/server/crates/arbiter-crypto/Cargo.toml
@@ -6,10 +6,10 @@ edition = "2024"
 [dependencies]
 ml-dsa = {workspace = true, optional = true }
 rand = {workspace = true, optional = true}
-memsafe = {version = "0.4.0", optional = true}
+memsafe = {version = "1.0.2", optional = true}
 hmac.workspace = true
 alloy.workspace = true
-x-wing = { version = "0.1.0-rc.0", features = ["zeroize"] }
+x-wing = { version = "0.1.0", features = ["zeroize"] }
 chrono.workspace = true
 thiserror.workspace = true

--- a/server/crates/arbiter-crypto/src/authn/v1.rs
+++ b/server/crates/arbiter-crypto/src/authn/v1.rs
@@ -1,8 +1,8 @@
 use chrono::{DateTime, Utc};
 use hmac::digest::Digest;
 use ml_dsa::{
-    EncodedVerifyingKey, Error, KeyGen, MlDsa87, Seed, Signature as MlDsaSignature,
-    SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _,
+    EncodedVerifyingKey, Error, ExpandedSigningKey, Generate, MlDsa87, Seed,
+    Signature as MlDsaSignature, SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey,
 };
 use rand::RngExt;

@@ -77,7 +77,10 @@ impl crate::hashing::Hashable for PublicKey {
 pub struct Signature(Box<MlDsaSignature<KeyParams>>);

 #[derive(Debug)]
-pub struct SigningKey(Box<MlDsaSigningKey<KeyParams>>);
+pub struct SigningKey {
+    key: Box<ExpandedSigningKey<KeyParams>>,
+    seed: Seed,
+}

 impl PublicKey {
    pub fn to_bytes(&self) -> Vec<u8> {
@@ -100,24 +103,31 @@ impl Signature {

 impl SigningKey {
    pub fn generate() -> Self {
-        Self(Box::new(KeyParams::key_gen(&mut rand::rng())))
+        let seed = MlDsaSigningKey::<KeyParams>::generate_from_rng(&mut rand::rng()).to_seed();
+        Self {
+            key: Box::new(ExpandedSigningKey::from_seed(&seed)),
+            seed,
+        }
    }

    pub fn from_seed(seed: [u8; 32]) -> Self {
-        Self(Box::new(KeyParams::from_seed(&Seed::from(seed))))
+        let seed = Seed::from(seed);
+        Self {
+            key: Box::new(ExpandedSigningKey::from_seed(&seed)),
+            seed,
+        }
    }

    pub fn to_seed(&self) -> [u8; 32] {
-        self.0.to_seed().into()
+        self.seed.into()
    }

    pub fn public_key(&self) -> PublicKey {
-        self.0.verifying_key().into()
+        self.key.verifying_key().into()
    }

    pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> {
-        self.0
-            .signing_key()
+        self.key
            .sign_deterministic(message, context)
            .map(Into::into)
    }
@@ -145,12 +155,6 @@ impl From<MlDsaSignature<KeyParams>> for Signature {
    }
 }

-impl From<MlDsaSigningKey<KeyParams>> for SigningKey {
-    fn from(value: MlDsaSigningKey<KeyParams>) -> Self {
-        Self(Box::new(value))
-    }
-}
-
 impl TryFrom<Vec<u8>> for PublicKey {
    type Error = ();

@@ -188,15 +192,15 @@ impl TryFrom<&'_ [u8]> for Signature {

 #[cfg(test)]
 mod tests {
-    use ml_dsa::{KeyGen, MlDsa87, signature::Keypair as _};
+    use ml_dsa::{Generate as _, MlDsa87, SigningKey as RealSigningKey, signature::Keypair as _};

    use crate::authn::AuthChallenge;

-    use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT};
+    use super::{CLIENT_CONTEXT, OPERATOR_CONTEXT, PublicKey, Signature, SigningKey};

    #[test]
    fn public_key_round_trip_decodes() {
-        let key = MlDsa87::key_gen(&mut rand::rng());
+        let key = RealSigningKey::<MlDsa87>::generate();
        let encoded = PublicKey::from(key.verifying_key()).to_bytes();

        let decoded = PublicKey::try_from(encoded.as_slice()).expect("public key should decode");
--- a/server/crates/arbiter-macros/Cargo.toml
+++ b/server/crates/arbiter-macros/Cargo.toml
@@ -10,7 +10,7 @@ doctest = false
 [dependencies]
 proc-macro2 = "1.0"
 quote = "1.0"
-syn = { version = "2.0", features = ["derive", "fold", "full", "visit-mut"] }
+syn = { version = "3.0", features = ["derive", "fold", "full", "visit-mut"] }

 [dev-dependencies]
 arbiter-crypto = { path = "../arbiter-crypto" }
--- a/server/crates/arbiter-proto/Cargo.toml
+++ b/server/crates/arbiter-proto/Cargo.toml
@@ -9,7 +9,7 @@ license = "Apache-2.0"
 tonic.workspace = true
 tokio.workspace = true
 futures.workspace = true
-tonic-prost = "0.14.5"
+tonic-prost = "0.14.6"
 prost.workspace = true
 kameo.workspace = true
 url = "2.5.8"
@@ -22,7 +22,7 @@ async-trait.workspace = true
 tokio-stream.workspace = true

 [build-dependencies]
-tonic-prost-build = "0.14.5"
+tonic-prost-build = "0.14.6"

 [dev-dependencies]
 rstest.workspace = true
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -9,8 +9,14 @@ license = "Apache-2.0"
 workspace = true

 [dependencies]
-diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
-diesel-async = { version = "0.9.0", features = [
+diesel = { version = "2.3.12", features = [
+    "chrono",
+    "returning_clauses_for_sqlite_3_35",
+    "serde_json",
+    "time",
+    "uuid",
+] }
+diesel-async = { version = "0.9.2", features = [
    "bb8",
    "migrations",
    "sqlite",
@@ -31,21 +37,20 @@ diesel_migrations = { version = "2.3.2", features = ["sqlite"] }
 async-trait.workspace = true
 tokio-stream.workspace = true
 rand.workspace = true
-rand_core.workspace = true
 rcgen.workspace = true
 chrono.workspace = true
 kameo.workspace = true
-chacha20poly1305 = { version = "0.10.1", features = ["std"] }
-argon2 = { version = "0.5.3", features = ["zeroize"] }
+chacha20poly1305 = { version = "0.11.0" }
+argon2 = { version = "0.6.0", features = ["zeroize"] }
 restructed = "0.2.2"
 strum = { version = "0.28.0", features = ["derive"] }
-pem = "3.0.6"
+pem = "4.0.0"
 sha2.workspace = true
 hmac.workspace = true
 alloy.workspace = true
 prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
-anyhow = "1.0.102"
+anyhow = "1.0.104"
 mutants.workspace = true
 subtle = "2.6.1"
 x25519-dalek.workspace = true
--- a/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
@@ -43,24 +43,13 @@ create table if not exists arbiter_settings (
 insert into arbiter_settings (id) values (1) on conflict do nothing;
 -- ensure singleton row exists

-create table if not exists operator_identity (
+create table if not exists operator_client (
    id integer not null primary key,
    public_key blob not null,
    created_at integer not null default(unixepoch ('now')),
    updated_at integer not null default(unixepoch ('now'))
 ) STRICT;
-create unique index if not exists uniq_operator_identity_public_key on operator_identity (public_key);
-
-create table if not exists operator (
-    id integer primary key references operator_identity(id) on delete restrict, -- same id as operator_identity
-
-    share blob not null,
-    share_nonce blob not null,
-
-    created_at integer not null default(unixepoch ('now')),
-    updated_at integer not null default(unixepoch ('now'))
-
-) STRICT;
+create unique index if not exists uniq_operator_client_public_key on operator_client (public_key);

 create table if not exists client_metadata (
    id integer not null primary key,
--- a/server/crates/arbiter-server/src/actors/bootstrap.rs
+++ b/server/crates/arbiter-server/src/actors/bootstrap.rs
@@ -1,48 +1,29 @@
 use crate::db::{self, DatabasePool, schema};
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use arbiter_proto::{BOOTSTRAP_PATH, home_path};

 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
-use rand::{RngExt, distr::Alphanumeric, rngs::SysRng};
-use rand_core::UnwrapErr;
-use std::path::{Path, PathBuf};
+use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
 use subtle::ConstantTimeEq as _;
 use thiserror::Error;
-use tracing::warn;

 const TOKEN_LENGTH: usize = 64;

-async fn write_token_file(path: &Path, content: &str) -> Result<(), std::io::Error> {
-    tokio::fs::write(path, content.as_bytes()).await?;
+pub async fn generate_token() -> Result<String, std::io::Error> {
+    let rng: StdRng = make_rng();

-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt as _;
-        tokio::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600)).await?;
-    }
+    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
+        String::default(),
+        |mut accum, char| {
+            accum += char.to_string().as_str();
+            accum
+        },
+    );

-    Ok(())
-}
+    tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;

-async fn generate_token(path: &Path) -> Result<SafeCell<[u8; TOKEN_LENGTH]>, std::io::Error> {
-    let mut cell = SafeCell::new([0u8; TOKEN_LENGTH]);
-    {
-        let mut buf = cell.write();
-        for (slot, b) in buf
-            .iter_mut()
-            .zip(UnwrapErr(SysRng).sample_iter(Alphanumeric))
-        {
-            *slot = b;
-        }
-    }
-
-    let token_str = cell.read_inline(|buf| String::from_utf8_lossy(buf.as_ref()).into_owned());
-
-    write_token_file(path, &token_str).await?;
-
-    Ok(cell)
+    Ok(token)
 }

 #[derive(Error, Debug)]
@@ -59,8 +40,7 @@ pub enum Error {

 #[derive(Actor)]
 pub struct Bootstrapper {
-    token: Option<SafeCell<[u8; TOKEN_LENGTH]>>,
-    token_path: Option<PathBuf>,
+    token: Option<String>,
 }

 impl Bootstrapper {
@@ -68,43 +48,40 @@ impl Bootstrapper {
        let row_count: i64 = {
            let mut conn = db.get().await?;

-            schema::operator::table
+            schema::operator_client::table
                .count()
                .get_result(&mut conn)
                .await?
        };

-        let (token, token_path) = if row_count == 0 {
-            let path = home_path()?.join(BOOTSTRAP_PATH);
-            let token = generate_token(&path).await?;
-            (Some(token), Some(path))
+        let token = if row_count == 0 {
+            let token = generate_token().await?;
+            Some(token)
        } else {
-            (None, None)
+            None
        };

-        Ok(Self { token, token_path })
-    }
-}
-
-impl Bootstrapper {
-    fn is_correct_token(&mut self, token: &[u8]) -> bool {
-        self.token.as_mut().is_some_and(|expected| {
-            expected.read_inline(|exp| bool::from(exp.as_ref().ct_eq(token)))
-        })
+        Ok(Self { token })
    }
 }

 #[messages]
 impl Bootstrapper {
    #[message]
-    pub async fn consume_token(&mut self, token: Vec<u8>) -> bool {
-        if self.is_correct_token(&token) {
+    pub fn is_correct_token(&self, token: String) -> bool {
+        self.token.as_ref().is_some_and(|expected| {
+            let expected_bytes = expected.as_bytes();
+            let token_bytes = token.as_bytes();
+
+            let choice = expected_bytes.ct_eq(token_bytes);
+            bool::from(choice)
+        })
+    }
+
+    #[message]
+    pub fn consume_token(&mut self, token: String) -> bool {
+        if self.is_correct_token(token) {
            self.token = None;
-            if let Some(path) = self.token_path.take()
-                && let Err(e) = tokio::fs::remove_file(&path).await
-            {
-                warn!(error = ?e, path = ?path, "Failed to delete bootstrap token file after consumption");
-            }
            true
        } else {
            false
@@ -115,9 +92,7 @@ impl Bootstrapper {
 #[messages]
 impl Bootstrapper {
    #[message]
-    pub fn get_token(&mut self) -> Option<String> {
-        self.token
-            .as_mut()
-            .map(|cell| cell.read_inline(|buf| String::from_utf8_lossy(buf.as_ref()).into_owned()))
+    pub fn get_token(&self) -> Option<String> {
+        self.token.clone()
    }
 }
--- a/server/crates/arbiter-server/src/actors/evm/mod.rs
+++ b/server/crates/arbiter-server/src/actors/evm/mod.rs
@@ -1,9 +1,9 @@
 use crate::{
    actors::vault::{CreateNew, Decrypt, Vault},
-    crypto::integrity::{self, Integrable},
+    crypto::integrity,
    db::{
        DatabaseError, DatabasePool,
-        models::{self, EvmWalletId},
+        models::{self},
        schema,
    },
    evm::{
@@ -25,35 +25,14 @@ use diesel::{
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, actor::ActorRef, messages};
 use rand::{SeedableRng, rng, rngs::StdRng};
-use tracing::error;

 pub use crate::evm::safe_signer;

-/// Integrity guard that binds a wallet's encrypted key ID to its Ethereum address.
-/// Both fields are included in the HMAC — swapping `aead_encrypted_id` in the DB
-/// invalidates the envelope MAC, and the AEAD ciphertext is also bound to `address`
-/// as AAD, so decryption fails too.
-#[derive(arbiter_macros::Hashable)]
-struct EvmWalletIntegrity {
-    aead_encrypted_id: i32,
-    address: Address,
-}
-
-impl Integrable for EvmWalletIntegrity {
-    const KIND: &'static str = "evm_wallet";
-}
-
 #[derive(Debug, thiserror::Error)]
 pub enum SignTransactionError {
    #[error("Wallet not found")]
    WalletNotFound,

-    #[error("Decrypted key does not match requested wallet address")]
-    KeyAddressMismatch,
-
-    #[error("Internal signing error")]
-    Internal,
-
    #[error("Database error: {0}")]
    Database(#[from] DatabaseError),

@@ -85,12 +64,6 @@ pub enum Error {
    Integrity(#[from] integrity::Error),
 }

-impl From<diesel::result::Error> for Error {
-    fn from(e: diesel::result::Error) -> Self {
-        Self::Database(DatabaseError::from(e))
-    }
-}
-
 #[derive(Actor)]
 pub struct EvmActor {
    pub vault: ActorRef<Vault>,
@@ -124,45 +97,26 @@ impl EvmActor {

        let aead_id: i32 = self
            .vault
-            .ask(CreateNew {
-                plaintext,
-                aad: address.as_slice().to_vec(),
-            })
+            .ask(CreateNew { plaintext })
            .await
            .map_err(|_| Error::VaultSend)?;

        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let wallet_id = conn
-            .exclusive_transaction(async |conn| {
-                let wallet_id: i32 = insert_into(schema::evm_wallet::table)
-                    .values(&models::NewEvmWallet {
-                        address: address.as_slice().to_vec(),
-                        aead_encrypted_id: aead_id,
-                    })
-                    .returning(schema::evm_wallet::id)
-                    .get_result(conn)
-                    .await
-                    .map_err(DatabaseError::from)
-                    .map_err(Error::Database)?;
-
-                integrity::sign_entity(
-                    conn,
-                    &self.vault,
-                    &EvmWalletIntegrity { address, aead_encrypted_id: aead_id },
-                    wallet_id,
-                )
-                .await
-                .map_err(Error::Integrity)?;
-
-                Ok::<i32, Error>(wallet_id)
+        let wallet_id = insert_into(schema::evm_wallet::table)
+            .values(&models::NewEvmWallet {
+                address: address.as_slice().to_vec(),
+                aead_encrypted_id: aead_id,
            })
-            .await?;
+            .returning(schema::evm_wallet::id)
+            .get_result(&mut conn)
+            .await
+            .map_err(DatabaseError::from)?;

        Ok((wallet_id, address))
    }

    #[message]
-    pub async fn list_wallets(&self) -> Result<Vec<(EvmWalletId, Address)>, Error> {
+    pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> {
        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
        let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
            .select(models::EvmWallet::as_select())
@@ -287,51 +241,16 @@ impl EvmActor {
            .ok_or(SignTransactionError::WalletNotFound)?;
        drop(conn);

-        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let attestation = integrity::verify_entity(
-            &mut conn,
-            &self.vault,
-            &EvmWalletIntegrity {
-                address: wallet_address,
-                aead_encrypted_id: wallet.aead_encrypted_id,
-            },
-            wallet.id.to_raw(),
-        )
-        .await
-        .map_err(|e| {
-            error!(?e, ?wallet.id, "EVM wallet integrity check failed");
-            SignTransactionError::Internal
-        })?;
-        drop(conn);
-
-        if attestation != integrity::AttestationStatus::Attested {
-            error!(
-                ?wallet.id,
-                "EVM wallet integrity unavailable; refusing to sign"
-            );
-            return Err(SignTransactionError::Internal);
-        }
-
        let raw_key: SafeCell<Vec<u8>> = self
            .vault
            .ask(Decrypt {
                aead_id: wallet.aead_encrypted_id,
-                aad: wallet.address.clone(),
            })
            .await
            .map_err(|_| SignTransactionError::VaultSend)?;

        let signer = safe_signer::SafeSigner::from_cell(raw_key)?;

-        if signer.address() != wallet_address {
-            error!(
-                expected = %wallet_address,
-                actual = %signer.address(),
-                "Decrypted private key address does not match requested wallet"
-            );
-            return Err(SignTransactionError::KeyAddressMismatch);
-        }
-
        self.engine
            .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
            .await?;
--- a/server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
+++ b/server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
@@ -20,8 +20,6 @@ pub mod client_connect_approval;

 pub struct FlowCoordinator {
    pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
-    /// Maps DB `client_id` → `ActorId` for fast connected-client lookup.
-    client_ids: HashMap<i32, ActorId>,
    operator_registry: ActorRef<OperatorRegistry>,
 }

@@ -29,7 +27,6 @@ impl FlowCoordinator {
    pub fn new(operator_registry: ActorRef<OperatorRegistry>) -> Self {
        Self {
            clients: HashMap::default(),
-            client_ids: HashMap::default(),
            operator_registry,
        }
    }
@@ -51,7 +48,6 @@ impl Actor for FlowCoordinator {
        _: ActorStopReason,
    ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
        if self.clients.remove(&id).is_some() {
-            self.client_ids.retain(|_, actor_id| *actor_id != id);
            info!(
                ?id,
                actor = "FlowCoordinator",
@@ -79,28 +75,14 @@ impl FlowCoordinator {
    #[message(ctx)]
    pub async fn register_client(
        &mut self,
-        client_id: i32,
        actor: ActorRef<ClientSession>,
        ctx: &mut Context<Self, ()>,
    ) {
-        info!(id = %actor.id(), client_id, actor = "FlowCoordinator", event = "client.connected");
+        info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected");
        ctx.actor_ref().link(&actor).await;
-        self.client_ids.insert(client_id, actor.id());
        self.clients.insert(actor.id(), actor);
    }

-    #[message]
-    pub fn is_client_connected(&self, client_id: i32) -> bool {
-        self.client_ids.contains_key(&client_id)
-    }
-
-    /// Returns the DB `client_ids` of all currently connected SDK clients.
-    /// Used by operator sessions on startup to seed their approved-client set.
-    #[message]
-    pub fn get_connected_client_ids(&self) -> Vec<i32> {
-        self.client_ids.keys().copied().collect()
-    }
-
    #[message(ctx)]
    pub async fn request_client_approval(
        &mut self,
--- a/server/crates/arbiter-server/src/actors/vault/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault/mod.rs
@@ -6,7 +6,7 @@ use crate::{
    },
    db::{
        self,
-        models::{self, RootKeyHistory, RootKeyHistoryId},
+        models::{self, RootKeyHistory},
        schema::{self},
    },
 };
@@ -22,9 +22,10 @@ use hmac::{KeyInit as _, Mac as _};
 use kameo::{Actor, Reply, actor::ActorRef, messages};
 use kameo_actors::message_bus::{MessageBus, Publish};
 use strum::{EnumDiscriminants, IntoDiscriminant};
-use tracing::{error, info, warn};
+use tracing::{error, info};

 pub mod events {
+
    #[derive(Clone, Copy)]
    pub struct Bootstrapped;

@@ -45,8 +46,6 @@ pub enum Error {
    Sealed,
    #[error("Invalid key provided")]
    InvalidKey,
-    #[error("Vault locked: too many failed unseal attempts")]
-    LockedOut,

    #[error("Requested aead entry not found")]
    NotFound,
@@ -62,13 +61,10 @@ pub enum Error {

    #[error("Broken database")]
    BrokenDatabase,
-
-    #[error("Integrity key version mismatch: envelope uses key {envelope:?}, current key is {current:?}")]
-    KeyVersionMismatch { envelope: RootKeyHistoryId, current: RootKeyHistoryId },
 }

 struct Unsealed {
-    root_key_history_id: RootKeyHistoryId,
+    root_key_history_id: i32,
    root_key: KeyCell,
 }

@@ -77,15 +73,12 @@ struct Unsealed {
 enum State {
    #[default]
    Unbootstrapped,
-
    Sealed {
-        root_key_history_id: RootKeyHistoryId,
+        root_key_history_id: i32,
    },
    Unsealed(Unsealed),
 }

-const MAX_UNSEAL_ATTEMPTS: u32 = 5;
-
 /// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed).
 ///
 /// Provides API for encrypting and decrypting data using the vault root key.
@@ -95,7 +88,6 @@ pub struct Vault {
    db: db::DatabasePool,
    state: State,
    events: ActorRef<MessageBus>,
-    unseal_failures: u32,
 }

 #[messages]
@@ -118,15 +110,12 @@ impl Vault {
            }
        };

-        Ok(Self { db, state, events, unseal_failures: 0 })
+        Ok(Self { db, state, events })
    }

    // Exclusive transaction to avoid race condtions if multiple vaults write
    // additional layer of protection against nonce-reuse
-    async fn get_new_nonce(
-        pool: &db::DatabasePool,
-        root_key_id: RootKeyHistoryId,
-    ) -> Result<Nonce, Error> {
+    async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> {
        let mut conn = pool.get().await?;

        let nonce = conn
@@ -139,7 +128,7 @@ impl Vault {

                let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
                    error!(
-                        "Broken database: invalid nonce for root key history id={:#?}",
+                        "Broken database: invalid nonce for root key history id={}",
                        root_key_id
                    );
                    Error::BrokenDatabase
@@ -195,7 +184,7 @@ impl Vault {
        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
        let root_key_history_id = conn
            .transaction(async |conn| {
-                let root_key_history_id = insert_into(schema::root_key_history::table)
+                let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
                    .values(&models::NewRootKeyHistory {
                        ciphertext: root_key_ciphertext.clone(),
                        tag: v1::ROOT_KEY_TAG.to_vec(),
@@ -213,9 +202,7 @@ impl Vault {
                    .execute(&mut *conn)
                    .await?;

-                Result::<_, diesel::result::Error>::Ok(RootKeyHistoryId::from_raw(
-                    root_key_history_id,
-                ))
+                Result::<_, diesel::result::Error>::Ok(root_key_history_id)
            })
            .await?;

@@ -232,10 +219,6 @@ impl Vault {

    #[message]
    pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
-        if self.unseal_failures >= MAX_UNSEAL_ATTEMPTS {
-            return Err(Error::LockedOut);
-        }
-
        let State::Sealed {
            root_key_history_id,
        } = &self.state
@@ -268,27 +251,13 @@ impl Vault {
                Error::BrokenDatabase
            })?;

-        if seal_key
+        seal_key
            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
-            .is_err()
-        {
-            self.unseal_failures += 1;
-            if self.unseal_failures >= MAX_UNSEAL_ATTEMPTS {
-                error!(
-                    attempts = self.unseal_failures,
-                    "Vault locked: maximum failed unseal attempts reached"
-                );
-            } else {
-                warn!(
-                    attempts = self.unseal_failures,
-                    remaining = MAX_UNSEAL_ATTEMPTS - self.unseal_failures,
-                    "Failed unseal attempt"
-                );
-            }
-            return Err(Error::InvalidKey);
-        }
+            .map_err(|err| {
+                error!(?err, "Failed to unseal root key: invalid seal key");
+                Error::InvalidKey
+            })?;

-        self.unseal_failures = 0;
        self.state = State::Unsealed(Unsealed {
            root_key_history_id: current_key.id,
            root_key: KeyCell::try_from(root_key).map_err(|err| {
@@ -303,10 +272,8 @@ impl Vault {
        Ok(())
    }

-    /// Decrypts an AEAD entry. The `aad` must match the value used at encryption time;
-    /// a mismatch causes authentication failure, preventing cross-wallet key swaps.
    #[message]
-    pub async fn decrypt(&mut self, aead_id: i32, aad: Vec<u8>) -> Result<SafeCell<Vec<u8>>, Error> {
+    pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
        let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?;

        let row: models::AeadEncrypted = {
@@ -328,15 +295,13 @@ impl Vault {
            Error::BrokenDatabase
        })?;
        let mut output = SafeCell::new(row.ciphertext);
-        root_key.decrypt_in_place(&nonce, &aad, &mut output)?;
+        root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?;
        Ok(output)
    }

-    /// Creates a new `aead_encrypted` entry and returns its ID.
-    /// The `aad` is bound into the ciphertext and must be reproduced exactly at decryption time.
    // Creates new `aead_encrypted` entry in the database and returns it's ID
    #[message]
-    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>, aad: Vec<u8>) -> Result<i32, Error> {
+    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>) -> Result<i32, Error> {
        let Unsealed {
            root_key,
            root_key_history_id,
@@ -348,7 +313,7 @@ impl Vault {

        let mut ciphertext_buffer = plaintext.write();
        let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut();
-        root_key.encrypt_in_place(&nonce, &aad, &mut *ciphertext_buffer)?;
+        root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?;

        let ciphertext = std::mem::take(ciphertext_buffer);

@@ -375,10 +340,7 @@ impl Vault {
    }

    #[message]
-    pub fn sign_integrity(
-        &mut self,
-        mac_input: Vec<u8>,
-    ) -> Result<(RootKeyHistoryId, Vec<u8>), Error> {
+    pub fn sign_integrity(&mut self, mac_input: Vec<u8>) -> Result<(i32, Vec<u8>), Error> {
        let Unsealed {
            root_key,
            root_key_history_id,
@@ -388,7 +350,7 @@ impl Vault {
            HmacSha256::new_from_slice(k)
                .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
        });
-        hmac.update(&root_key_history_id.to_raw().to_be_bytes());
+        hmac.update(&root_key_history_id.to_be_bytes());
        hmac.update(&mac_input);

        let mac = hmac.finalize().into_bytes().to_vec();
@@ -400,7 +362,7 @@ impl Vault {
        &mut self,
        mac_input: Vec<u8>,
        expected_mac: Vec<u8>,
-        key_version: RootKeyHistoryId,
+        key_version: i32,
    ) -> Result<bool, Error> {
        let Unsealed {
            root_key,
@@ -408,17 +370,14 @@ impl Vault {
        } = Self::expect_unsealed(&mut self.state)?;

        if *root_key_history_id != key_version {
-            return Err(Error::KeyVersionMismatch {
-                envelope: key_version,
-                current: *root_key_history_id,
-            });
+            return Ok(false);
        }

        let mut hmac = root_key.0.read_inline(|k| {
            HmacSha256::new_from_slice(k)
                .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
        });
-        hmac.update(&key_version.to_raw().to_be_bytes());
+        hmac.update(&key_version.to_be_bytes());
        hmac.update(&mac_input);

        Ok(hmac.verify_slice(&expected_mac).is_ok())
@@ -442,7 +401,6 @@ impl Vault {
 #[cfg(test)]
 mod tests {
    use crate::actors::GlobalActors;
-    use crate::db::models::RootKeyHistory;
    use arbiter_crypto::safecell::SafeCellHandle as _;

    use super::*;
@@ -487,7 +445,7 @@ mod tests {
        assert_eq!(root_row.data_encryption_nonce, n2.to_vec());

        let id = actor
-            .create_new(SafeCell::new(b"post-interleave".to_vec()), b"test-aad".to_vec())
+            .create_new(SafeCell::new(b"post-interleave".to_vec()))
            .await
            .unwrap();
        let row: models::AeadEncrypted = schema::aead_encrypted::table
--- a/server/crates/arbiter-server/src/crypto/encryption/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/encryption/v1.rs
@@ -1,4 +1,3 @@
-use argon2::password_hash::Salt as ArgonSalt;
 use rand::{
    Rng as _, SeedableRng,
    rngs::{StdRng, SysRng},
@@ -42,7 +41,7 @@ impl<'a> TryFrom<&'a [u8]> for Nonce {
    }
 }

-pub type Salt = [u8; ArgonSalt::RECOMMENDED_LENGTH];
+pub type Salt = [u8; argon2::RECOMMENDED_SALT_LEN];

 pub fn generate_salt() -> Salt {
    let mut salt = Salt::default();
--- a/server/crates/arbiter-server/src/crypto/integrity/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/integrity/v1.rs
@@ -192,9 +192,7 @@ pub async fn verify_entity<E: Integrable>(
        Ok(false) => Err(Error::MacMismatch {
            entity_kind: E::KIND,
        }),
-        Err(SendError::HandlerError(
-            vault::Error::Sealed | vault::Error::KeyVersionMismatch { .. },
-        )) => Ok(AttestationStatus::Unavailable),
+        Err(SendError::HandlerError(vault::Error::Sealed)) => Ok(AttestationStatus::Unavailable),
        Err(_) => Err(Error::VaultSend),
    }
 }
@@ -333,47 +331,4 @@ mod tests {
            .unwrap_err();
        assert!(matches!(err, Error::MacMismatch { .. }));
    }
-
-    #[tokio::test]
-    async fn key_version_mismatch_returns_unavailable_not_mac_mismatch() {
-        use crate::db::schema::integrity_envelope;
-        use super::AttestationStatus;
-
-        const ENTITY_ID: &[u8] = b"entity-id-rotation-test";
-
-        let db = db::create_test_pool().await;
-        let vault = bootstrapped_vault(&db).await;
-        let mut conn = db.get().await.unwrap();
-
-        let entity = DummyEntity {
-            payload_version: 1,
-            payload: b"payload-v1".to_vec(),
-        };
-
-        sign_entity(&mut conn, &vault, &entity, ENTITY_ID)
-            .await
-            .unwrap();
-
-        // Simulate key rotation: update the stored key_version to a stale value.
-        // After real rotation the vault's root_key_history_id would advance, but
-        // here we achieve the same mismatch by back-dating the envelope's key_version.
-        diesel::update(integrity_envelope::table)
-            .filter(integrity_envelope::entity_kind.eq("dummy_entity"))
-            .filter(integrity_envelope::entity_id.eq(ENTITY_ID))
-            .set(integrity_envelope::key_version.eq(0))
-            .execute(&mut conn)
-            .await
-            .unwrap();
-
-        // Must NOT error — version mismatch is Unavailable, not tampered.
-        let status = verify_entity(&mut conn, &vault, &entity, ENTITY_ID)
-            .await
-            .expect("key version mismatch must not be treated as an error");
-
-        assert_eq!(
-            status,
-            AttestationStatus::Unavailable,
-            "stale key_version must yield Unavailable, not MacMismatch"
-        );
-    }
 }
--- a/server/crates/arbiter-server/src/crypto/mod.rs
+++ b/server/crates/arbiter-server/src/crypto/mod.rs
@@ -3,8 +3,8 @@ use encryption::v1::{Nonce, Salt};

 use argon2::{Algorithm, Argon2};
 use chacha20poly1305::{
-    AeadInPlace, Key, KeyInit as _, XChaCha20Poly1305, XNonce,
-    aead::{AeadMut, Error, Payload},
+    AeadInOut, Key, KeyInit as _, XChaCha20Poly1305, XNonce,
+    aead::{Aead, Error, Payload},
 };
 use rand::{
    Rng as _, SeedableRng as _,
@@ -54,9 +54,9 @@ impl KeyCell {
    ) -> Result<(), Error> {
        let key_reader = self.0.read();
        let cipher = XChaCha20Poly1305::new(&key_reader);
-        let nonce = XNonce::from_slice(nonce.0.as_ref());
+        let nonce = XNonce::from(nonce.0);
        let buffer = buffer.as_mut();
-        cipher.encrypt_in_place(nonce, associated_data, buffer)
+        cipher.encrypt_in_place(&nonce, associated_data, buffer)
    }
    pub fn decrypt_in_place(
        &mut self,
@@ -66,10 +66,10 @@ impl KeyCell {
    ) -> Result<(), Error> {
        let key_reader = self.0.read();
        let cipher = XChaCha20Poly1305::new(&key_reader);
-        let nonce = XNonce::from_slice(nonce.0.as_ref());
+        let nonce = XNonce::from(nonce.0);
        let mut buffer = buffer.write();
        let buffer: &mut Vec<u8> = buffer.as_mut();
-        cipher.decrypt_in_place(nonce, associated_data, buffer)
+        cipher.decrypt_in_place(&nonce, associated_data, buffer)
    }

    pub fn encrypt(
@@ -79,11 +79,11 @@ impl KeyCell {
        plaintext: impl AsRef<[u8]>,
    ) -> Result<Vec<u8>, Error> {
        let key_reader = self.0.read();
-        let mut cipher = XChaCha20Poly1305::new(&key_reader);
-        let nonce = XNonce::from_slice(nonce.0.as_ref());
+        let cipher = XChaCha20Poly1305::new(&key_reader);
+        let nonce = XNonce::from(nonce.0);

        let ciphertext = cipher.encrypt(
-            nonce,
+            &nonce,
            Payload {
                msg: plaintext.as_ref(),
                aad: associated_data,
--- a/server/crates/arbiter-server/src/db/models.rs
+++ b/server/crates/arbiter-server/src/db/models.rs
@@ -79,41 +79,10 @@ pub mod types {
        }
    }

-    macro_rules! declare_id {
-        ($name:ident) => {
-            #[derive(Debug, FromSqlRow, AsExpression, Clone, Hash, Copy, PartialEq, Eq)]
-            #[diesel(sql_type = Integer)]
-            #[repr(transparent)] // hint compiler to optimize the wrapper struct away
-            pub struct $name(i32);
-
-            impl $name {
-                pub const fn to_raw(self) -> i32 {
-                    self.0
-                }
-                pub const fn from_raw(raw: i32) -> Self {
-                    Self(raw)
-                }
-            }
-
-            impl FromSql<Integer, Sqlite> for $name {
-                fn from_sql(
-                    bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
-                ) -> diesel::deserialize::Result<Self> {
-                    FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
-                }
-            }
-            impl ToSql<Integer, Sqlite> for $name {
-                fn to_sql<'b>(
-                    &'b self,
-                    out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
-                ) -> diesel::serialize::Result {
-                    ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
-                }
-            }
-        };
-    }
-
-    declare_id!(ChainId);
+    #[derive(Debug, FromSqlRow, AsExpression, Clone)]
+    #[diesel(sql_type = Integer)]
+    #[repr(transparent)] // hint compiler to optimize the wrapper struct away
+    pub struct ChainId(pub i32);

    #[expect(
        clippy::cast_sign_loss,
@@ -134,13 +103,21 @@ pub mod types {
        }
    };

-    declare_id!(OperatorId);
-    declare_id!(OperatorIdentityId);
-    declare_id!(AeadEncryptedId);
-    declare_id!(RootKeyHistoryId);
-    declare_id!(TlsHistoryId);
-    declare_id!(EvmWalletId);
-    declare_id!(ClientId);
+    impl FromSql<Integer, Sqlite> for ChainId {
+        fn from_sql(
+            bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
+        ) -> diesel::deserialize::Result<Self> {
+            FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
+        }
+    }
+    impl ToSql<Integer, Sqlite> for ChainId {
+        fn to_sql<'b>(
+            &'b self,
+            out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
+        ) -> diesel::serialize::Result {
+            ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
+        }
+    }
 }
 pub use types::*;

@@ -153,12 +130,12 @@ pub use types::*;
 )]
 #[diesel(table_name = aead_encrypted, check_for_backend(Sqlite))]
 pub struct AeadEncrypted {
-    pub id: AeadEncryptedId,
+    pub id: i32,
    pub ciphertext: Vec<u8>,
    pub tag: Vec<u8>,
    pub current_nonce: Vec<u8>,
    pub schema_version: i32,
-    pub associated_root_key_id: RootKeyHistoryId,
+    pub associated_root_key_id: i32, // references root_key_history.id
    pub created_at: SqliteTimestamp,
 }

@@ -171,7 +148,7 @@ pub struct AeadEncrypted {
    attributes_with = "deriveless"
 )]
 pub struct RootKeyHistory {
-    pub id: RootKeyHistoryId,
+    pub id: i32,
    pub ciphertext: Vec<u8>,
    pub tag: Vec<u8>,
    pub root_key_encryption_nonce: Vec<u8>,
@@ -189,7 +166,7 @@ pub struct RootKeyHistory {
    attributes_with = "deriveless"
 )]
 pub struct TlsHistory {
-    pub id: TlsHistoryId,
+    pub id: i32,
    pub cert: String,
    pub cert_key: String, // PEM Encoded private key
    pub ca_cert: String,  // PEM Encoded certificate for cert signing
@@ -214,7 +191,7 @@ pub struct ArbiterSettings {
    attributes_with = "deriveless"
 )]
 pub struct EvmWallet {
-    pub id: EvmWalletId,
+    pub id: i32,
    pub address: Vec<u8>,
    pub aead_encrypted_id: i32,
    pub created_at: SqliteTimestamp,
@@ -236,7 +213,7 @@ pub struct EvmWallet {
 )]
 pub struct EvmWalletAccess {
    pub id: i32,
-    pub wallet_id: EvmWalletId,
+    pub wallet_id: i32,
    pub client_id: i32,
    pub created_at: SqliteTimestamp,
 }
@@ -263,7 +240,7 @@ pub struct ProgramClientMetadataHistory {
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = schema::program_client, check_for_backend(Sqlite))]
 pub struct ProgramClient {
-    pub id: ClientId,
+    pub id: i32,
    pub public_key: Vec<u8>,
    pub metadata_id: i32,
    pub created_at: SqliteTimestamp,
@@ -273,22 +250,12 @@ pub struct ProgramClient {
 #[derive(Queryable, Debug)]
 #[diesel(table_name = schema::operator_client, check_for_backend(Sqlite))]
 pub struct OperatorClient {
-    pub id: OperatorIdentityId,
+    pub id: i32,
    pub public_key: Vec<u8>,
    pub created_at: SqliteTimestamp,
    pub updated_at: SqliteTimestamp,
 }

-#[derive(Queryable, Debug)]
-#[diesel(table_name = schema::operator, check_for_backend(Sqlite))]
-pub struct Operator {
-    pub id: OperatorId,
-    pub share: Vec<u8>,
-    pub share_nonce: Vec<u8>,
-    pub created_at: SqliteTimestamp,
-    pub updated_at: SqliteTimestamp,
-}
-
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = evm_ether_transfer_limit, check_for_backend(Sqlite))]
 #[view(
@@ -432,7 +399,7 @@ pub struct IntegrityEnvelope {
    pub entity_kind: String,
    pub entity_id: Vec<u8>,
    pub payload_version: i32,
-    pub key_version: RootKeyHistoryId,
+    pub key_version: i32,
    pub mac: Vec<u8>,
    pub signed_at: SqliteTimestamp,
    pub created_at: SqliteTimestamp,
--- a/server/crates/arbiter-server/src/db/schema.rs
+++ b/server/crates/arbiter-server/src/db/schema.rs
@@ -152,25 +152,6 @@ diesel::table! {
    }
 }

-diesel::table! {
-    operator (id) {
-        id -> Nullable<Integer>,
-        share -> Binary,
-        share_nonce -> Binary,
-        created_at -> Integer,
-        updated_at -> Integer,
-    }
-}
-
-diesel::table! {
-    operator_identity (id) {
-        id -> Integer,
-        public_key -> Binary,
-        created_at -> Integer,
-        updated_at -> Integer,
-    }
-}
-
 diesel::table! {
    program_client (id) {
        id -> Integer,
@@ -204,6 +185,15 @@ diesel::table! {
    }
 }

+diesel::table! {
+    operator_client (id) {
+        id -> Integer,
+        public_key -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
 diesel::joinable!(aead_encrypted -> root_key_history (associated_root_key_id));
 diesel::joinable!(arbiter_settings -> root_key_history (root_key_id));
 diesel::joinable!(arbiter_settings -> tls_history (tls_id));
@@ -222,7 +212,6 @@ diesel::joinable!(evm_transaction_log -> evm_wallet_access (wallet_access_id));
 diesel::joinable!(evm_wallet -> aead_encrypted (aead_encrypted_id));
 diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
 diesel::joinable!(evm_wallet_access -> program_client (client_id));
-diesel::joinable!(operator -> operator_identity (id));
 diesel::joinable!(program_client -> client_metadata (metadata_id));

 diesel::allow_tables_to_appear_in_same_query!(
@@ -241,9 +230,8 @@ diesel::allow_tables_to_appear_in_same_query!(
    evm_wallet,
    evm_wallet_access,
    integrity_envelope,
-    operator,
-    operator_identity,
    program_client,
    root_key_history,
    tls_history,
+    operator_client,
 );
--- a/server/crates/arbiter-server/src/evm/mod.rs
+++ b/server/crates/arbiter-server/src/evm/mod.rs
@@ -514,8 +514,7 @@ mod tests {
    use crate::db::{
        self, DatabaseConnection,
        models::{
-            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
-            SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
        },
        schema::{evm_basic_grant, evm_transaction_log},
    };
@@ -535,7 +534,7 @@ mod tests {
        EvalContext {
            target: EvmWalletAccess {
                id: WALLET_ACCESS_ID,
-                wallet_id: EvmWalletId::from_raw(5),
+                wallet_id: 10,
                client_id: 20,
                created_at: SqliteTimestamp(Utc::now()),
            },
@@ -825,7 +824,7 @@ mod tests {

        let wallet_access = EvmWalletAccess {
            id: WALLET_ACCESS_ID,
-            wallet_id: EvmWalletId::from_raw(10),
+            wallet_id: 10,
            client_id: 20,
            created_at: SqliteTimestamp(Utc::now()),
        };
--- a/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
@@ -3,8 +3,7 @@ use crate::{
    db::{
        self, DatabaseConnection,
        models::{
-            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
-            SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
        },
        schema::{evm_basic_grant, evm_transaction_log},
    },
@@ -32,7 +31,7 @@ fn ctx(to: Address, value: U256) -> EvalContext {
    EvalContext {
        target: EvmWalletAccess {
            id: WALLET_ACCESS_ID,
-            wallet_id: EvmWalletId::from_raw(10),
+            wallet_id: 10,
            client_id: 20,
            created_at: SqliteTimestamp(Utc::now()),
        },
--- a/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
@@ -2,7 +2,7 @@ use super::{Settings, TokenTransfer};
 use crate::{
    db::{
        self, DatabaseConnection,
-        models::{EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, SqliteTimestamp},
+        models::{EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, SqliteTimestamp},
        schema::evm_basic_grant,
    },
    evm::{
@@ -45,7 +45,7 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
    EvalContext {
        target: EvmWalletAccess {
            id: WALLET_ACCESS_ID,
-            wallet_id: EvmWalletId::from_raw(10),
+            wallet_id: 10,
            client_id: 20,
            created_at: SqliteTimestamp(Utc::now()),
        },
--- a/server/crates/arbiter-server/src/grpc/operator/auth.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/auth.rs
@@ -171,7 +171,7 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {

                Some(auth::Inbound::AuthChallengeRequest {
                    pubkey,
-                    bootstrap_token: bootstrap_token.map(String::into_bytes),
+                    bootstrap_token,
                })
            }
            AuthRequestPayload::ChallengeSolution(ProtoAuthChallengeSolution { signature }) => {
--- a/server/crates/arbiter-server/src/grpc/operator/evm.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/evm.rs
@@ -90,7 +90,7 @@ async fn handle_wallet_list(
                .into_iter()
                .map(|(id, address)| WalletEntry {
                    address: address.to_vec(),
-                    id: id.to_raw(),
+                    id,
                })
                .collect(),
        }),
@@ -217,11 +217,6 @@ async fn handle_sign_transaction(
                result: Some(vet_error.convert()),
            }
        }
-        Err(kameo::error::SendError::HandlerError(
-            SessionSignTransactionError::ClientNotConnected,
-        )) => {
-            return Err(Status::permission_denied("client not connected"));
-        }
        Err(kameo::error::SendError::HandlerError(SessionSignTransactionError::Internal)) => {
            EvmSignTransactionResponse {
                result: Some(EvmSignTransactionResult::Error(
--- a/server/crates/arbiter-server/src/grpc/operator/inbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/inbound.rs
@@ -1,10 +1,11 @@
 use crate::{
-    db::models::{CoreEvmWalletAccess, EvmWalletId, NewEvmWalletAccess},
+    db::models::{CoreEvmWalletAccess, NewEvmWalletAccess},
    evm::policies::{
        SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit, ether_transfer,
        token_transfers,
    },
-    grpc::{Convert, TryConvert},
+    grpc::Convert,
+    grpc::TryConvert,
 };
 use arbiter_proto::{
    proto::evm::{
@@ -150,7 +151,7 @@ impl Convert for WalletAccess {

    fn convert(self) -> Self::Output {
        NewEvmWalletAccess {
-            wallet_id: EvmWalletId::from_raw(self.wallet_id),
+            wallet_id: self.wallet_id,
            client_id: self.sdk_client_id,
        }
    }
@@ -165,7 +166,7 @@ impl TryConvert for SdkClientWalletAccess {
            return Err(Status::invalid_argument("Missing wallet access entry"));
        };
        Ok(CoreEvmWalletAccess {
-            wallet_id: EvmWalletId::from_raw(access.wallet_id),
+            wallet_id: access.wallet_id,
            client_id: access.sdk_client_id,
            id: self.id,
        })
--- a/server/crates/arbiter-server/src/grpc/operator/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/outbound.rs
@@ -103,7 +103,7 @@ impl Convert for EvmWalletAccess {
        Self::Output {
            id: self.id,
            access: Some(WalletAccess {
-                wallet_id: self.wallet_id.to_raw(),
+                wallet_id: self.wallet_id,
                sdk_client_id: self.client_id,
            }),
        }
--- a/server/crates/arbiter-server/src/grpc/operator/sdk_client.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/sdk_client.rs
@@ -2,7 +2,7 @@ use crate::{
    db::models::NewEvmWalletAccess,
    grpc::Convert,
    peers::operator::{
-        OperatorSession, OutOfBand,
+        OutOfBand, OperatorSession,
        session::handlers::{
            HandleGrantEvmWalletAccess, HandleListWalletAccess, HandleNewClientApprove,
            HandleRevokeEvmWalletAccess, HandleSdkClientList,
@@ -11,8 +11,8 @@ use crate::{
 };
 use arbiter_crypto::authn;
 use arbiter_proto::proto::{
+    shared::ClientInfo as ProtoClientMetadata,
    operator::{
-        operator_response::Payload as OperatorResponsePayload,
        sdk_client::{
            self as proto_sdk_client, ConnectionCancel as ProtoSdkClientConnectionCancel,
            ConnectionRequest as ProtoSdkClientConnectionRequest,
@@ -24,8 +24,8 @@ use arbiter_proto::proto::{
            request::Payload as SdkClientRequestPayload,
            response::Payload as SdkClientResponsePayload,
        },
+        operator_response::Payload as OperatorResponsePayload,
    },
-    shared::ClientInfo as ProtoClientMetadata,
 };

 use kameo::actor::ActorRef;
@@ -115,7 +115,7 @@ async fn handle_list(
            clients: clients
                .into_iter()
                .map(|(client, metadata)| ProtoSdkClientEntry {
-                    id: client.id.to_raw(),
+                    id: client.id,
                    pubkey: client.public_key.clone(),
                    info: Some(ProtoClientMetadata {
                        name: metadata.name,
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
@@ -87,7 +87,6 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(()) => ProtoUnsealResult::Success,
                    Err(vault_gate::Error::InvalidKey) => ProtoUnsealResult::InvalidKey,
-                    Err(vault_gate::Error::LockedOut) => ProtoUnsealResult::LockedOut,
                    Err(err) => {
                        warn!(?err, "unseal failed");
                        return Err(Status::internal("Failed to unseal vault"));
--- a/server/crates/arbiter-server/src/peers/client/auth.rs
+++ b/server/crates/arbiter-server/src/peers/client/auth.rs
@@ -8,7 +8,7 @@ use crate::{
    crypto::integrity::{self, AttestationStatus},
    db::{
        self,
-        models::ProgramClientMetadata,
+        models::{ProgramClientMetadata, SqliteTimestamp},
        schema::program_client,
    },
 };
@@ -18,13 +18,14 @@ use arbiter_proto::{
    transport::{Bi, expect_message},
 };

+use chrono::Utc;
 use diesel::{
    ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, SelectableHelper as _,
-    dsl::insert_into,
+    dsl::insert_into, update,
 };
 use diesel_async::RunQueryDsl as _;
 use kameo::{actor::ActorRef, error::SendError};
-use tracing::{error, warn};
+use tracing::error;

 #[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
 pub enum Error {
@@ -210,47 +211,71 @@ async fn insert_client(
    .await
 }

-/// Compares stored metadata against what a reconnecting client presents.
-/// Metadata is frozen after initial operator approval and must not be silently
-/// overwritten. Doing so would let an approved client forge its displayed
-/// identity in later approval prompts. Drift is logged and ignored.
-async fn check_metadata_drift(
+async fn sync_client_metadata(
    db: &db::DatabasePool,
    client_id: i32,
-    presented: &ClientMetadata,
+    metadata: &ClientMetadata,
 ) -> Result<(), Error> {
-    use crate::db::schema::client_metadata;
+    use crate::db::schema::{client_metadata, client_metadata_history};
+
+    let now = SqliteTimestamp(Utc::now());

    let mut conn = db.get().await.map_err(|e| {
        error!(error = ?e, "Database pool error");
        Error::DatabasePoolUnavailable
    })?;

-    let current: ProgramClientMetadata = program_client::table
-        .find(client_id)
-        .inner_join(client_metadata::table)
-        .select(ProgramClientMetadata::as_select())
-        .first(&mut conn)
-        .await
-        .map_err(|e| {
-            error!(error = ?e, "Database error");
-            Error::DatabaseOperationFailed
-        })?;
+    conn.exclusive_transaction(async |conn| {
+        let (current_metadata_id, current): (i32, ProgramClientMetadata) = program_client::table
+            .find(client_id)
+            .inner_join(client_metadata::table)
+            .select((
+                program_client::metadata_id,
+                ProgramClientMetadata::as_select(),
+            ))
+            .first(&mut *conn)
+            .await?;

-    let changed = current.name != presented.name
-        || current.description != presented.description
-        || current.version != presented.version;
+        let unchanged = current.name == metadata.name
+            && current.description == metadata.description
+            && current.version == metadata.version;
+        if unchanged {
+            return Ok(());
+        }

-    if changed {
-        warn!(
-            client_id,
-            stored_name = %current.name,
-            presented_name = %presented.name,
-            "reconnecting client presented different metadata; ignoring - metadata is frozen after operator approval"
-        );
-    }
+        insert_into(client_metadata_history::table)
+            .values((
+                client_metadata_history::metadata_id.eq(current_metadata_id),
+                client_metadata_history::client_id.eq(client_id),
+            ))
+            .execute(&mut *conn)
+            .await?;

-    Ok(())
+        let metadata_id = insert_into(client_metadata::table)
+            .values((
+                client_metadata::name.eq(&metadata.name),
+                client_metadata::description.eq(&metadata.description),
+                client_metadata::version.eq(&metadata.version),
+            ))
+            .returning(client_metadata::id)
+            .get_result::<i32>(&mut *conn)
+            .await?;
+
+        update(program_client::table.find(client_id))
+            .set((
+                program_client::metadata_id.eq(metadata_id),
+                program_client::updated_at.eq(now),
+            ))
+            .execute(&mut *conn)
+            .await?;
+
+        Ok::<(), diesel::result::Error>(())
+    })
+    .await
+    .map_err(|e| {
+        error!(error = ?e, "Database error");
+        Error::DatabaseOperationFailed
+    })
 }

 async fn challenge_client<T>(
@@ -299,7 +324,6 @@ where

    let client_id = if let Some(id) = get_client_id(&props.db, &pubkey).await? {
        verify_integrity(&props.db, &props.actors.vault, &pubkey).await?;
-        check_metadata_drift(&props.db, id, &metadata).await?;
        id
    } else {
        approve_new_client(
@@ -313,6 +337,8 @@ where
        insert_client(&props.db, &props.actors.vault, &pubkey, &metadata).await?
    };

+    sync_client_metadata(&props.db, client_id, &metadata).await?;
+
    let challenge = AuthChallenge::generate(&mut rand::rng());
    challenge_client(transport, pubkey, challenge).await?;

--- a/server/crates/arbiter-server/src/peers/client/session.rs
+++ b/server/crates/arbiter-server/src/peers/client/session.rs
@@ -83,7 +83,7 @@ impl Actor for ClientSession {
        args.props
            .actors
            .flow_coordinator
-            .ask(RegisterClient { client_id: args.client_id, actor: this })
+            .ask(RegisterClient { actor: this })
            .await
            .map_err(|_| Error::ConnectionRegistrationFailed)?;
        Ok(args)
--- a/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
@@ -14,7 +14,7 @@ mod state;
 pub enum Inbound {
    AuthChallengeRequest {
        pubkey: authn::PublicKey,
-        bootstrap_token: Option<Vec<u8>>,
+        bootstrap_token: Option<String>,
    },
    AuthChallengeSolution {
        signature: Vec<u8>,
--- a/server/crates/arbiter-server/src/peers/operator/auth/state.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/state.rs
@@ -4,7 +4,7 @@ use super::{
 };
 use crate::{
    actors::bootstrap::ConsumeToken,
-    db::{DatabasePool, schema::operator_identity},
+    db::{DatabasePool, schema::operator_client},
    peers::operator::auth::Outbound,
 };
 use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
@@ -16,12 +16,13 @@ use tracing::error;

 pub(super) struct ChallengeRequest {
    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<Vec<u8>>,
+    pub(super) bootstrap_token: Option<String>,
 }

 pub struct ChallengeContext {
    pub(super) challenge: AuthChallenge,
    pub(super) pubkey: authn::PublicKey,
+    pub(super) bootstrap_token: Option<String>,
 }

 pub(super) struct ChallengeSolution {
@@ -43,9 +44,9 @@ async fn get_client_id(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<O
        Error::internal("Database unavailable")
    })?;

-    operator_identity::table
-        .filter(operator_identity::public_key.eq(pubkey.to_bytes()))
-        .select(operator_identity::id)
+    operator_client::table
+        .filter(operator_client::public_key.eq(pubkey.to_bytes()))
+        .select(operator_client::id)
        .first::<i32>(&mut conn)
        .await
        .optional()
@@ -62,9 +63,9 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
        Error::internal("Database unavailable")
    })?;

-    let id: i32 = diesel::insert_into(operator_identity::table)
-        .values((operator_identity::public_key.eq(pubkey_bytes),))
-        .returning(operator_identity::id)
+    let id: i32 = diesel::insert_into(operator_client::table)
+        .values((operator_client::public_key.eq(pubkey_bytes),))
+        .returning(operator_client::id)
        .get_result(&mut conn)
        .await
        .map_err(|e| {
@@ -78,16 +79,11 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
 pub(super) struct AuthContext<'a, T: ?Sized> {
    pub(super) conn: &'a mut OperatorConnection,
    pub(super) transport: &'a mut T,
-    bootstrap_token: Option<Vec<u8>>,
 }

 impl<'a, T: ?Sized> AuthContext<'a, T> {
    pub(super) const fn new(conn: &'a mut OperatorConnection, transport: &'a mut T) -> Self {
-        Self {
-            conn,
-            transport,
-            bootstrap_token: None,
-        }
+        Self { conn, transport }
    }
 }

@@ -112,8 +108,6 @@ where
            }
        }

-        self.bootstrap_token = bootstrap_token;
-
        let challenge = AuthChallenge::generate(&mut rand::rng());

        self.transport
@@ -126,12 +120,20 @@ where
                Error::Transport
            })?;

-        Ok(ChallengeContext { challenge, pubkey })
+        Ok(ChallengeContext {
+            challenge,
+            pubkey,
+            bootstrap_token,
+        })
    }

    async fn verify_solution(
        &mut self,
-        ChallengeContext { challenge, pubkey }: &ChallengeContext,
+        ChallengeContext {
+            challenge,
+            pubkey,
+            bootstrap_token,
+        }: &ChallengeContext,
        ChallengeSolution { solution }: ChallengeSolution,
    ) -> Result<Credentials, Self::Error> {
        let signature = authn::Signature::try_from(solution.as_slice()).map_err(|()| {
@@ -150,13 +152,15 @@ where
        }

        // Resolve client id: bootstrap (consume token + register) or lookup
-        let id = match self.bootstrap_token.take() {
+        let id = match bootstrap_token {
            Some(token) => {
                let token_ok: bool = self
                    .conn
                    .actors
                    .bootstrapper
-                    .ask(ConsumeToken { token })
+                    .ask(ConsumeToken {
+                        token: token.clone(),
+                    })
                    .await
                    .map_err(|e| {
                        error!(?e, "Failed to consume bootstrap token");
--- a/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
@@ -1,19 +1,12 @@
 use super::{Error, OperatorSession};
 use crate::{
-    actors::{
-        evm::{
-            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
-            SignTransactionError as EvmSignError,
-        },
-        flow_coordinator::{IsClientConnected, client_connect_approval::ClientApprovalAnswer},
-        vault::VaultState,
-    },
-    db::{
-        models::{
-            EvmWalletAccess, EvmWalletId, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata,
-        },
-        schema::program_client,
+    actors::evm::{
+        ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
+        SignTransactionError as EvmSignError,
    },
+    actors::flow_coordinator::client_connect_approval::ClientApprovalAnswer,
+    actors::vault::VaultState,
+    db::models::{EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata},
    evm::policies::{Grant, SpecificGrant},
 };
 use arbiter_crypto::authn;
@@ -22,16 +15,13 @@ use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
 use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
 use diesel_async::{AsyncConnection, RunQueryDsl};
 use kameo::{error::SendError, messages, prelude::Context};
-use tracing::{error, info, warn};
+use tracing::error;

 #[derive(Debug, Error)]
 pub enum SignTransactionError {
    #[error("Policy evaluation failed")]
    Vet(#[from] crate::evm::VetError),

-    #[error("Client not connected")]
-    ClientNotConnected,
-
    #[error("Internal signing error")]
    Internal,
 }
@@ -80,9 +70,7 @@ impl OperatorSession {
    }

    #[message]
-    pub(crate) async fn handle_evm_wallet_list(
-        &mut self,
-    ) -> Result<Vec<(EvmWalletId, Address)>, Error> {
+    pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<(i32, Address)>, Error> {
        match self.props.actors.evm.ask(ListWallets {}).await {
            Ok(wallets) => Ok(wallets),
            Err(err) => {
@@ -153,30 +141,6 @@ impl OperatorSession {
        wallet_address: Address,
        transaction: TxEip1559,
    ) -> Result<Signature, SignTransactionError> {
-        if !self.approved_client_ids.contains(&client_id) {
-            warn!(
-                client_id,
-                "operator attempted to sign for client not in its approved set"
-            );
-            return Err(SignTransactionError::ClientNotConnected);
-        }
-
-        let connected = self
-            .props
-            .actors
-            .flow_coordinator
-            .ask(IsClientConnected { client_id })
-            .await
-            .unwrap_or(false);
-
-        if !connected {
-            self.approved_client_ids.remove(&client_id);
-            warn!(client_id, "operator attempted to sign for disconnected client");
-            return Err(SignTransactionError::ClientNotConnected);
-        }
-
-        info!(client_id, event = "sign_transaction", "operator.sign_transaction");
-
        match self
            .props
            .actors
@@ -232,7 +196,7 @@ impl OperatorSession {
            use crate::db::schema::evm_wallet_access;
            for entry in entries {
                diesel::delete(evm_wallet_access::table)
-                    .filter(evm_wallet_access::id.eq(entry))
+                    .filter(evm_wallet_access::wallet_id.eq(entry))
                    .execute(&mut *conn)
                    .await?;
            }
@@ -285,30 +249,6 @@ impl OperatorSession {

        ctx.actor_ref().unlink(&pending_approval.controller).await;

-        if approved {
-            let pubkey_bytes = pending_approval.pubkey.to_bytes();
-            match self.props.db.get().await {
-                Ok(mut conn) => {
-                    match program_client::table
-                        .filter(program_client::public_key.eq(pubkey_bytes.as_slice()))
-                        .select(program_client::id)
-                        .first::<i32>(&mut conn)
-                        .await
-                    {
-                        Ok(client_id) => {
-                            self.approved_client_ids.insert(client_id);
-                        }
-                        Err(err) => {
-                            error!(?err, "Failed to look up client_id for approved pubkey");
-                        }
-                    }
-                }
-                Err(err) => {
-                    error!(?err, "DB pool error after client approval");
-                }
-            }
-        }
-
        Ok(())
    }

@@ -331,142 +271,3 @@ impl OperatorSession {
        Ok(clients)
    }
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::db::{self, models::{EvmWalletId, NewEvmWalletAccess}, schema::evm_wallet_access};
-    use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
-    use diesel_async::{AsyncConnection, RunQueryDsl};
-
-    /// Regression test: revocation must delete by access-entry `id`, not by `wallet_id`.
-    ///
-    /// Before the fix, revoking `entry_id=1` would delete all rows where `wallet_id=1`,
-    /// wiping out every client's access to wallet #1.
-    #[tokio::test]
-    async fn revoke_deletes_by_entry_id_not_wallet_id() {
-        use crate::db::models::EvmWalletAccess;
-
-        let pool = db::create_test_pool().await;
-        let mut conn = pool.get().await.expect("pool connection");
-
-        // Insert two access entries for the same wallet but different clients.
-        // entry A: id will be 1, wallet_id=1, client_id=10
-        // entry B: id will be 2, wallet_id=1, client_id=20
-        let entry_a = diesel::insert_into(evm_wallet_access::table)
-            .values(NewEvmWalletAccess {
-                wallet_id: EvmWalletId::from_raw(1),
-                client_id: 10,
-            })
-            .returning(EvmWalletAccess::as_select())
-            .get_result(&mut *conn)
-            .await
-            .expect("insert entry A");
-
-        let entry_b = diesel::insert_into(evm_wallet_access::table)
-            .values(NewEvmWalletAccess {
-                wallet_id: EvmWalletId::from_raw(1),
-                client_id: 20,
-            })
-            .returning(EvmWalletAccess::as_select())
-            .get_result(&mut *conn)
-            .await
-            .expect("insert entry B");
-
-        // Revoke only entry A by its primary key id.
-        conn.transaction(async |conn| {
-            diesel::delete(evm_wallet_access::table)
-                .filter(evm_wallet_access::id.eq(entry_a.id))
-                .execute(&mut *conn)
-                .await
-        })
-        .await
-        .expect("revoke entry A");
-
-        // Entry A must be gone.
-        let gone = evm_wallet_access::table
-            .filter(evm_wallet_access::id.eq(entry_a.id))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count entry A");
-        assert_eq!(gone, 0, "revoked entry must be deleted");
-
-        // Entry B (same wallet, different client) must still exist.
-        let still_there = evm_wallet_access::table
-            .filter(evm_wallet_access::id.eq(entry_b.id))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count entry B");
-        assert_eq!(still_there, 1, "unrelated entry must not be deleted");
-    }
-
-    /// Regression test: when `entry_id` and `wallet_id` differ, only the correct row is removed.
-    ///
-    /// This specifically catches the case where `entry.id=5` and `wallet_id=1` are different values;
-    /// the old bug would delete by `wallet_id`, potentially matching a completely different entry.
-    #[tokio::test]
-    async fn revoke_with_mismatched_wallet_and_entry_ids() {
-        use crate::db::models::EvmWalletAccess;
-
-        let pool = db::create_test_pool().await;
-        let mut conn = pool.get().await.expect("pool connection");
-
-        // Insert entries to force auto-increment IDs to diverge from wallet_ids.
-        // We'll insert 5 placeholder entries first so that the real entry gets id=6.
-        for i in 1_i32..=5 {
-            diesel::insert_into(evm_wallet_access::table)
-                .values(NewEvmWalletAccess {
-                    wallet_id: EvmWalletId::from_raw(99),
-                    client_id: i,
-                })
-                .execute(&mut *conn)
-                .await
-                .expect("insert placeholder");
-        }
-
-        // Real target: wallet_id=1, will get id=6.
-        let target = diesel::insert_into(evm_wallet_access::table)
-            .values(NewEvmWalletAccess {
-                wallet_id: EvmWalletId::from_raw(1),
-                client_id: 1,
-            })
-            .returning(EvmWalletAccess::as_select())
-            .get_result(&mut *conn)
-            .await
-            .expect("insert target");
-
-        // Sanity: target.id != target.wallet_id
-        assert_ne!(
-            target.id, target.wallet_id.to_raw(),
-            "test prerequisite: id and wallet_id must differ"
-        );
-
-        // Revoke by entry id.
-        conn.transaction(async |conn| {
-            diesel::delete(evm_wallet_access::table)
-                .filter(evm_wallet_access::id.eq(target.id))
-                .execute(&mut *conn)
-                .await
-        })
-        .await
-        .expect("revoke target");
-
-        let remaining = evm_wallet_access::table
-            .filter(evm_wallet_access::id.eq(target.id))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count target");
-        assert_eq!(remaining, 0, "target must be deleted by its entry id");
-
-        // Placeholders for wallet_id=99 must be untouched.
-        let placeholders = evm_wallet_access::table
-            .filter(evm_wallet_access::wallet_id.eq(99))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count placeholders");
-        assert_eq!(placeholders, 5, "unrelated entries must survive");
-    }
-}
--- a/server/crates/arbiter-server/src/peers/operator/session/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/mod.rs
@@ -1,14 +1,16 @@
 use super::{OutOfBand, OperatorConnection};
 use crate::{
    actors::{
-        flow_coordinator::{GetConnectedClientIds, client_connect_approval::{ClientApprovalAnswer, ClientApprovalController}}, operator_registry::ConnectOperator,
-    }, peers::client::ClientProfile,
+        flow_coordinator::client_connect_approval::{ClientApprovalAnswer, ClientApprovalController},
+        operator_registry::ConnectOperator,
+    },
+    peers::client::ClientProfile,
 };
 use arbiter_crypto::authn;
 use arbiter_proto::transport::Sender;

 use kameo::{Actor, actor::ActorRef, messages};
-use std::{borrow::Cow, collections::{HashMap, HashSet}};
+use std::{borrow::Cow, collections::HashMap};
 use thiserror::Error;
 use tracing::error;

@@ -52,10 +54,6 @@ pub struct OperatorSession {
    sender: Box<dyn Sender<OutOfBand>>,

    pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>,
-    /// DB `client_ids` this operator session is allowed to sign for.
-    /// Seeded from currently-connected clients on start, then updated as
-    /// approvals are granted or denied during the session lifetime.
-    approved_client_ids: HashSet<i32>,
 }

 pub mod handlers;
@@ -66,7 +64,6 @@ impl OperatorSession {
            props,
            sender,
            pending_client_approvals: HashMap::default(),
-            approved_client_ids: HashSet::default(),
        }
    }
 }
@@ -110,7 +107,7 @@ impl Actor for OperatorSession {

    type Error = Error;

-    async fn on_start(mut args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
+    async fn on_start(args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
        args.props
            .actors
            .operator_registry
@@ -125,16 +122,6 @@ impl Actor for OperatorSession {
                );
                Error::internal("Failed to register operator connection with operator registry")
            })?;
-
-        // Seed approved set with clients already connected when this session starts.
-        // New clients will be added via handle_new_client_approve as they are approved.
-        match args.props.actors.flow_coordinator.ask(GetConnectedClientIds {}).await {
-            Ok(ids) => args.approved_client_ids.extend(ids),
-            Err(err) => {
-                error!(?err, "Failed to fetch connected client IDs on operator session start");
-            }
-        }
-
        Ok(args)
    }

--- a/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
@@ -10,7 +10,7 @@ use crate::{
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use state::State;

-use chacha20poly1305::{AeadInPlace, KeyInit as _, XChaCha20Poly1305, XNonce};
+use chacha20poly1305::{AeadInOut, KeyInit as _, XChaCha20Poly1305, XNonce};
 use kameo::{Actor, error::SendError, messages, prelude::Message};
 use kameo_actors::message_bus::Register;
 use tokio::sync::oneshot;
@@ -25,8 +25,6 @@ pub enum Error {
    AlreadyBootstrapped,
    #[error("Invalid key provided")]
    InvalidKey,
-    #[error("Vault locked: too many failed unseal attempts")]
-    LockedOut,

    #[error("State transition failed")]
    State,
@@ -101,14 +99,17 @@ impl VaultGate {
        ciphertext: &[u8],
        associated_data: &[u8],
    ) -> Result<SafeCell<Vec<u8>>, ()> {
-        let nonce = XNonce::from_slice(nonce);
+        let Ok(nonce) = XNonce::try_from(nonce) else {
+            error!("Encrypted key material carries a nonce of the wrong length");
+            return Err(());
+        };

        let cipher = XChaCha20Poly1305::new(secret.as_bytes().into());

        let mut key_buffer = SafeCell::new(ciphertext.to_vec());

        let decryption_result = key_buffer.write_inline(|write_handle| {
-            cipher.decrypt_in_place(nonce, associated_data, write_handle)
+            cipher.decrypt_in_place(&nonce, associated_data, write_handle)
        });

        match decryption_result {
@@ -172,7 +173,6 @@ impl VaultGate {
                Ok(())
            }
            Err(SendError::HandlerError(vault::Error::InvalidKey)) => Err(Error::InvalidKey),
-            Err(SendError::HandlerError(vault::Error::LockedOut)) => Err(Error::LockedOut),
            Err(SendError::HandlerError(err)) => {
                error!(?err, "Vault failed to unseal key");
                Err(Error::InvalidKey)
--- a/server/crates/arbiter-server/tests/client/auth.rs
+++ b/server/crates/arbiter-server/tests/client/auth.rs
@@ -16,7 +16,7 @@ use arbiter_server::{

 use diesel::{ExpressionMethods as _, NullableExpressionMethods as _, QueryDsl as _, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};

 fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> ClientMetadata {
    ClientMetadata {
@@ -73,7 +73,7 @@ async fn insert_registered_client(

 fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -> authn::Signature {
    let challenge = challenge.format();
-    key.signing_key()
+    key.expanded_key()
        .sign_deterministic(&challenge, CLIENT_CONTEXT)
        .unwrap()
        .into()
@@ -81,13 +81,13 @@ fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -

 async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
    let mut conn = db.get().await.unwrap();
-    let sentinel_key = verifying_key(&MlDsa87::key_gen(&mut rand::rng()))
+    let sentinel_key = verifying_key(&SigningKey::<MlDsa87>::generate())
        .encode()
        .0
        .to_vec();

-    insert_into(schema::operator_identity::table)
-        .values((schema::operator_identity::public_key.eq(sentinel_key),))
+    insert_into(schema::operator_client::table)
+        .values((schema::operator_client::public_key.eq(sentinel_key),))
        .execute(&mut conn)
        .await
        .unwrap();
@@ -120,7 +120,7 @@ pub async fn unregistered_pubkey_rejected() {
        connect_client(props, &mut server_transport).await;
    });

-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();

    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
@@ -140,7 +140,7 @@ pub async fn challenge_auth() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;

-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();

    Box::pin(insert_registered_client(
        &db,
@@ -206,7 +206,7 @@ pub async fn challenge_auth() {
 pub async fn metadata_unchanged_does_not_append_history() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
    let requested = metadata("client", Some("desc"), Some("1.0.0"));

    Box::pin(insert_registered_client(
@@ -266,10 +266,10 @@ pub async fn metadata_unchanged_does_not_append_history() {

 #[tokio::test]
 #[test_log::test]
-pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
+pub async fn metadata_change_appends_history_and_repoints_binding() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();

    Box::pin(insert_registered_client(
        &db,
@@ -287,7 +287,6 @@ pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
        connect_client(props, &mut server_transport).await;
    });

-    // Reconnect presenting different metadata — must be silently ignored.
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
@@ -314,7 +313,6 @@ pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
            client_metadata, client_metadata_history, program_client,
        };
        let mut conn = db.get().await.unwrap();
-        // Metadata is frozen: no new row, no history entry.
        let metadata_count: i64 = client_metadata::table
            .count()
            .get_result(&mut conn)
@@ -340,16 +338,15 @@ pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
            .first::<(String, Option<String>, Option<String>)>(&mut conn)
            .await
            .unwrap();
-        assert_eq!(metadata_count, 1, "frozen: no new metadata row on reconnect");
-        assert_eq!(history_count, 0, "frozen: no history entry on reconnect");
+        assert_eq!(metadata_count, 2);
+        assert_eq!(history_count, 1);
        assert_eq!(
            current,
            (
                "client".to_owned(),
-                Some("old".to_owned()),
-                Some("1.0.0".to_owned())
-            ),
-            "frozen: original metadata must be preserved"
+                Some("new".to_owned()),
+                Some("2.0.0".to_owned())
+            )
        );
    }
 }
@@ -360,7 +357,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;

-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
    let requested = metadata("client", Some("desc"), Some("1.0.0"));

    {
--- a/server/crates/arbiter-server/tests/operator/auth.rs
+++ b/server/crates/arbiter-server/tests/operator/auth.rs
@@ -14,7 +14,7 @@ use arbiter_server::{
 use async_trait::async_trait;
 use diesel::{ExpressionMethods as _, QueryDsl, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 use tokio::sync::mpsc;

 fn verifying_key(key: &SigningKey<MlDsa87>) -> VerifyingKey<MlDsa87> {
@@ -26,7 +26,7 @@ fn sign_operator_challenge(
    challenge: &AuthChallenge,
 ) -> authn::Signature {
    let challenge = challenge.format();
-    key.signing_key()
+    key.expanded_key()
        .sign_deterministic(&challenge, OPERATOR_CONTEXT)
        .unwrap()
        .into()
@@ -170,11 +170,11 @@ pub async fn bootstrap_token_auth() {
        auth::authenticate(&mut props, &mut server_transport).await
    });

-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some(token.into_bytes()),
+            bootstrap_token: Some(token),
        })
        .await
        .unwrap();
@@ -206,8 +206,8 @@ pub async fn bootstrap_token_auth() {
    task.await.unwrap().unwrap();

    let mut conn = db.get().await.unwrap();
-    let stored_pubkey: Vec<u8> = schema::operator_identity::table
-        .select(schema::operator_identity::public_key)
+    let stored_pubkey: Vec<u8> = schema::operator_client::table
+        .select(schema::operator_client::public_key)
        .first::<Vec<u8>>(&mut conn)
        .await
        .unwrap();
@@ -227,11 +227,11 @@ pub async fn bootstrap_invalid_token_auth() {
        auth::authenticate(&mut props, &mut server_transport).await
    });

-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some(b"invalid_token".to_vec()),
+            bootstrap_token: Some("invalid_token".to_owned()),
        })
        .await
        .unwrap();
@@ -259,7 +259,7 @@ pub async fn bootstrap_invalid_token_auth() {
    ));

    let mut conn = db.get().await.unwrap();
-    let count: i64 = schema::operator_identity::table
+    let count: i64 = schema::operator_client::table
        .count()
        .get_result::<i64>(&mut conn)
        .await
@@ -280,14 +280,14 @@ pub async fn challenge_auth() {
        .await
        .unwrap();

-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
    let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();

    {
        let mut conn = db.get().await.unwrap();
-        let id: i32 = insert_into(schema::operator_identity::table)
-            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
-            .returning(schema::operator_identity::id)
+        let id: i32 = insert_into(schema::operator_client::table)
+            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
+            .returning(schema::operator_client::id)
            .get_result(&mut conn)
            .await
            .unwrap();
@@ -366,13 +366,13 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
        .await
        .unwrap();

-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
    let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();

    {
        let mut conn = db.get().await.unwrap();
-        insert_into(schema::operator_identity::table)
-            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
+        insert_into(schema::operator_client::table)
+            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
            .execute(&mut conn)
            .await
            .unwrap();
@@ -439,14 +439,14 @@ pub async fn challenge_auth_rejects_invalid_signature() {
        .await
        .unwrap();

-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
    let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();

    {
        let mut conn = db.get().await.unwrap();
-        let id: i32 = insert_into(schema::operator_identity::table)
-            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
-            .returning(schema::operator_identity::id)
+        let id: i32 = insert_into(schema::operator_client::table)
+            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
+            .returning(schema::operator_client::id)
            .get_result(&mut conn)
            .await
            .unwrap();
--- a/server/crates/arbiter-server/tests/operator/unseal.rs
+++ b/server/crates/arbiter-server/tests/operator/unseal.rs
@@ -16,7 +16,7 @@ use arbiter_server::{
    },
 };

-use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use chacha20poly1305::{AeadInOut, XChaCha20Poly1305, XNonce, aead::KeyInit};
 use kameo::actor::Spawn as _;
 use tokio::sync::oneshot;
 use x25519_dalek::{EphemeralSecret, PublicKey};
--- a/server/crates/arbiter-server/tests/vault/concurrency.rs
+++ b/server/crates/arbiter-server/tests/vault/concurrency.rs
@@ -14,8 +14,6 @@ use kameo::actor::{ActorRef, Spawn as _};
 use std::collections::{HashMap, HashSet};
 use tokio::task::JoinSet;

-const TEST_AAD: &[u8] = b"test-aad";
-
 async fn write_concurrently(
    actor: ActorRef<Vault>,
    prefix: &'static str,
@@ -29,7 +27,6 @@ async fn write_concurrently(
            let id = actor
                .ask(CreateNew {
                    plaintext: SafeCell::new(plaintext.clone()),
-                    aad: TEST_AAD.to_vec(),
                })
                .await
                .unwrap();
@@ -123,7 +120,7 @@ async fn insert_failure_does_not_create_partial_row() {
    drop(conn);

    let err = actor
-        .create_new(SafeCell::new(b"should fail".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"should fail".to_vec()))
        .await
        .unwrap_err();
    assert!(matches!(err, Error::DatabaseTransaction(_)));
@@ -174,7 +171,7 @@ async fn decrypt_roundtrip_after_high_concurrency() {
        .unwrap();

    for (id, plaintext) in expected {
-        let mut decrypted = decryptor.decrypt(id, TEST_AAD.to_vec()).await.unwrap();
+        let mut decrypted = decryptor.decrypt(id).await.unwrap();
        assert_eq!(*decrypted.read(), plaintext);
    }
 }
--- a/server/crates/arbiter-server/tests/vault/lifecycle.rs
+++ b/server/crates/arbiter-server/tests/vault/lifecycle.rs
@@ -12,8 +12,6 @@ use arbiter_server::{
 use diesel::{QueryDsl, SelectableHelper};
 use diesel_async::RunQueryDsl;

-const TEST_AAD: &[u8] = b"test-aad";
-
 #[tokio::test]
 #[test_log::test]
 async fn bootstrap() {
@@ -59,7 +57,7 @@ async fn create_new_before_bootstrap_fails() {
        .unwrap();

    let err = actor
-        .create_new(SafeCell::new(b"data".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"data".to_vec()))
        .await
        .unwrap_err();
    assert!(matches!(err, Error::NotBootstrapped));
@@ -73,7 +71,7 @@ async fn decrypt_before_bootstrap_fails() {
        .await
        .unwrap();

-    let err = actor.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor.decrypt(1).await.unwrap_err();
    assert!(matches!(err, Error::NotBootstrapped));
 }

@@ -87,7 +85,7 @@ async fn new_restores_sealed_state() {
    let mut actor2 = Vault::new(db, GlobalActors::spawn_message_bus())
        .await
        .unwrap();
-    let err = actor2.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor2.decrypt(1).await.unwrap_err();
    assert!(matches!(err, Error::Sealed));
 }

@@ -99,7 +97,7 @@ async fn unseal_correct_password() {

    let plaintext = b"survive a restart";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
        .await
        .unwrap();
    drop(actor);
@@ -110,7 +108,7 @@ async fn unseal_correct_password() {
    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
    actor.try_unseal(seal_key).await.unwrap();

-    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }

@@ -122,7 +120,7 @@ async fn unseal_wrong_then_correct_password() {

    let plaintext = b"important data";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
        .await
        .unwrap();
    drop(actor);
@@ -138,6 +136,6 @@ async fn unseal_wrong_then_correct_password() {
    let good_key = SafeCell::new(b"test-seal-key".to_vec());
    actor.try_unseal(good_key).await.unwrap();

-    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }
--- a/server/crates/arbiter-server/tests/vault/storage.rs
+++ b/server/crates/arbiter-server/tests/vault/storage.rs
@@ -10,8 +10,6 @@ use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper, dsl::update};
 use diesel_async::RunQueryDsl;
 use std::collections::HashSet;

-const TEST_AAD: &[u8] = b"test-aad";
-
 #[tokio::test]
 #[test_log::test]
 async fn create_decrypt_roundtrip() {
@@ -20,11 +18,11 @@ async fn create_decrypt_roundtrip() {

    let plaintext = b"hello arbiter";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
        .await
        .unwrap();

-    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }

@@ -34,7 +32,7 @@ async fn decrypt_nonexistent_returns_not_found() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

-    let err = actor.decrypt(9999, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor.decrypt(9999).await.unwrap_err();
    assert!(matches!(err, Error::NotFound));
 }

@@ -46,11 +44,11 @@ async fn ciphertext_differs_across_entries() {

    let plaintext = b"same content";
    let id1 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
        .await
        .unwrap();
    let id2 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
        .await
        .unwrap();

@@ -70,8 +68,8 @@ async fn ciphertext_differs_across_entries() {

    assert_ne!(row1.ciphertext, row2.ciphertext);

-    let mut d1 = actor.decrypt(id1, TEST_AAD.to_vec()).await.unwrap();
-    let mut d2 = actor.decrypt(id2, TEST_AAD.to_vec()).await.unwrap();
+    let mut d1 = actor.decrypt(id1).await.unwrap();
+    let mut d2 = actor.decrypt(id2).await.unwrap();
    assert_eq!(*d1.read(), plaintext);
    assert_eq!(*d2.read(), plaintext);
 }
@@ -85,7 +83,7 @@ async fn nonce_never_reused() {
    let n = 5;
    for i in 0..n {
        actor
-            .create_new(SafeCell::new(format!("secret {i}").into_bytes()), TEST_AAD.to_vec())
+            .create_new(SafeCell::new(format!("secret {i}").into_bytes()))
            .await
            .unwrap();
    }
@@ -139,7 +137,7 @@ async fn broken_db_nonce_format_fails_closed() {
    drop(conn);

    let err = actor
-        .create_new(SafeCell::new(b"must fail".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"must fail".to_vec()))
        .await
        .unwrap_err();
    assert!(matches!(err, Error::BrokenDatabase));
@@ -147,7 +145,7 @@ async fn broken_db_nonce_format_fails_closed() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;
    let id = actor
-        .create_new(SafeCell::new(b"decrypt target".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"decrypt target".to_vec()))
        .await
        .unwrap();
    let mut conn = db.get().await.unwrap();
@@ -158,6 +156,6 @@ async fn broken_db_nonce_format_fails_closed() {
        .unwrap();
    drop(conn);

-    let err = actor.decrypt(id, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor.decrypt(id).await.unwrap_err();
    assert!(matches!(err, Error::BrokenDatabase));
 }
				`@@ -0,0 +1 @@`
				`{"version":2,"entries":[{"package":"app","rootUri":"../","packageUri":"lib/"}]}`