lints(clippy)

.claude/memory/feedback_widget_decomposition.md

@@ -1,11 +0,0 @@
----
-name: Widget decomposition and provider subscriptions
-description: Prefer splitting screens into multiple focused files/widgets; each widget subscribes to its own relevant providers
-type: feedback
----
-
-Split screens into multiple smaller widgets across multiple files. Each widget should subscribe only to the providers it needs (`ref.watch` at lowest possible level), rather than having one large screen widget that watches everything and passes data down as parameters.
-
-**Why:** Reduces unnecessary rebuilds; improves readability; each file has one clear responsibility.
-
-**How to apply:** When building a new screen, identify which sub-widgets need their own provider subscriptions and extract them into separate files (e.g., `widgets/grant_card.dart` watches enrichment providers itself, rather than the screen doing it and passing resolved strings down).

.gitignore

@@ -1,6 +1 @@
-target/
-scripts/__pycache__/
-.DS_Store
-.cargo/config.toml
-.vscode/
-docs/
+target/

.woodpecker/server-audit.yaml

@@ -8,7 +8,7 @@ when:
       include: ['.woodpecker/server-*.yaml', 'server/**']
 
 steps:
-  - name: audit
+  - name: test
     image: jdxcode/mise:latest
     directory: server
     environment:

.woodpecker/server-lint.yaml

@@ -1,25 +0,0 @@
-when:
-  - event: pull_request
-    path:
-      include: ['.woodpecker/server-*.yaml', 'server/**']
-  - event: push
-    branch: main
-    path:
-      include: ['.woodpecker/server-*.yaml', 'server/**']
-
-steps:
-  - name: lint
-    image: jdxcode/mise:latest
-    directory: server
-    environment:
-      CARGO_TERM_COLOR: always
-      CARGO_TARGET_DIR: /usr/local/cargo/target
-      CARGO_HOME: /usr/local/cargo/registry
-    volumes:
-      - cargo-target:/usr/local/cargo/target
-      - cargo-registry:/usr/local/cargo/registry
-    commands:
-      - apt-get update && apt-get install -y pkg-config
-      - mise install rust 
-      - mise install protoc
-      - mise exec rust -- cargo clippy --all -- -D warnings

.woodpecker/server-test.yaml

@@ -24,4 +24,4 @@ steps:
       - mise install rust 
       - mise install protoc
       - mise install cargo:cargo-nextest
-      - mise exec cargo:cargo-nextest -- cargo nextest run --no-fail-fast --all-features
+      - mise exec cargo:cargo-nextest -- cargo nextest run --no-fail-fast

.woodpecker/server-vet.yaml

@@ -8,7 +8,7 @@ when:
       include: ['.woodpecker/server-*.yaml', 'server/**']
 
 steps:
-  - name: vet
+  - name: test
     image: jdxcode/mise:latest
     directory: server
     environment:

.woodpecker/useragent-analyze.yaml

@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-    path:
-      include: ['.woodpecker/useragent-*.yaml', 'useragent/**']
-  - event: push
-    branch: main
-    path:
-      include: ['.woodpecker/useragent-*.yaml', 'useragent/**']
-
-steps:
-  - name: analyze
-    image: jdxcode/mise:latest
-    commands:
-      - mise install flutter 
-      - mise install protoc
-      # Reruns codegen to catch protocol drift
-      - mise codegen 
-      - cd useragent/ && flutter analyze

AGENTS.md

@@ -1,128 +0,0 @@
-# AGENTS.md
-
-This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
-- **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
-- **`useragent/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
-- **`protobufs/`** — Protocol Buffer definitions shared between server and client
-
-The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
-
-## Toolchain Setup
-
-Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
-```sh
-mise install
-```
-
-Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
-
-## Server (Rust workspace at `server/`)
-
-### Crates
-
-| Crate | Purpose |
-|---|---|
-| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
-| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
-| `arbiter-useragent` | Rust client library for the user agent side of the gRPC protocol |
-| `arbiter-client` | Rust client library for SDK clients |
-
-### Common Commands
-
-```sh
-cd server
-
-# Build
-cargo build
-
-# Run the server daemon
-cargo run -p arbiter-server
-
-# Run all tests (preferred over cargo test)
-cargo nextest run
-
-# Run a single test
-cargo nextest run <test_name>
-
-# Lint
-cargo clippy
-
-# Security audit
-cargo audit
-
-# Check unused dependencies
-cargo shear
-
-# Run snapshot tests and update snapshots
-cargo insta review
-```
-
-### Architecture
-
-The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
-
-- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
-- **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
-- **`FlowCoordinator`** — Coordinates cross-connection flow between user agents and SDK clients.
-- **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
-
-Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
-
-**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
-
-**Cryptography:**
-- Authentication: ed25519 (challenge-response, nonce-tracked per peer)
-- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
-- Password KDF: Argon2
-- Unseal transport: X25519 ephemeral key exchange
-- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
-
-**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
-
-### Proto Regeneration
-
-When `.proto` files in `protobufs/` change, rebuild to regenerate:
-```sh
-cd server && cargo build -p arbiter-proto
-```
-
-### Database Migrations
-
-```sh
-# Create a new migration
-diesel migration generate <name> --migration-dir crates/arbiter-server/migrations
-
-# Run migrations manually (server also runs them on startup)
-diesel migration run --migration-dir crates/arbiter-server/migrations
-```
-
-## User Agent (Flutter + Rinf at `useragent/`)
-
-The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `useragent/native/hub/` as a separate crate that uses `arbiter-useragent` for the gRPC client.
-
-Communication between Dart and Rust uses typed **signals** defined in `useragent/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
-
-```sh
-cd useragent && rinf gen
-```
-
-### Common Commands
-
-```sh
-cd useragent
-
-# Run the app (macOS or Windows)
-flutter run
-
-# Regenerate Rust↔Dart signal bindings
-rinf gen
-
-# Analyze Dart code
-flutter analyze
-```
-
-The Rinf Rust entry point is `useragent/native/hub/src/lib.rs`. It spawns actors defined in `useragent/native/hub/src/actors/` which handle Dart↔server communication via signals.

ARCHITECTURE.md

@@ -3,6 +3,7 @@
 Arbiter is a permissioned signing service for cryptocurrency wallets. It runs as a background service on the user's machine with an optional client application for vault management.
 
 **Core principle:** The vault NEVER exposes key material. It only produces signatures when a request satisfies the configured policies.
+
 ---
 
 ## 1. Peer Types
@@ -11,7 +12,6 @@ Arbiter distinguishes two kinds of peers:
 
 - **User Agent** — A client application used by the owner to manage the vault (create wallets, approve SDK clients, configure policies).
 - **SDK Client** — A consumer of signing capabilities, typically an automation tool. In the future, this could include a browser-based wallet.
-- **Recovery Operator** — A dormant recovery participant with narrowly scoped authority used only for custody recovery and operator replacement.
 
 ---
 
@@ -43,149 +43,7 @@ There is no bootstrap mechanism for SDK clients. They must be explicitly approve
 
 ---
 
-## 3. Multi-Operator Governance
-
-When more than one User Agent is registered, the vault is treated as having multiple operators. In that mode, sensitive actions are governed by voting rather than by a single operator decision.
-
-### 3.1 Voting Rules
-
-Voting is based on the total number of registered operators:
-
-- **1 operator:** no vote is needed; the single operator decides directly.
-- **2 operators:** full consensus is required; both operators must approve.
-- **3 or more operators:** quorum is `floor(N / 2) + 1`.
-
-For a decision to count, the operator's approval or rejection must be signed by that operator's associated key. Unsigned votes, or votes that fail signature verification, are ignored.
-
-Examples:
-
-- **3 operators:** 2 approvals required
-- **4 operators:** 3 approvals required
-
-### 3.2 Actions Requiring a Vote
-
-In multi-operator mode, a successful vote is required for:
-
-- approving new SDK clients
-- granting an SDK client visibility to a wallet
-- approving a one-off transaction
-- approving creation of a persistent grant
-- approving operator replacement
-- approving server updates
-- updating Shamir secret-sharing parameters
-
-### 3.3 Special Rule for Key Rotation
-
-Key rotation always requires full quorum, regardless of the normal voting threshold.
-
-This is stricter than ordinary governance actions because rotating the root key requires every operator to participate in coordinated share refresh/update steps. The root key itself is not redistributed directly, but each operator's share material must be changed consistently.
-
-### 3.4 Root Key Custody
-
-When the vault has multiple operators, the vault root key is protected using Shamir secret sharing.
-
-The vault root key is encrypted in a way that requires reconstruction from user-held shares rather than from a single shared password.
-
-For ordinary operators, the Shamir threshold matches the ordinary governance quorum. For example:
-
-- **2 operators:** `2-of-2`
-- **3 operators:** `2-of-3`
-- **4 operators:** `3-of-4`
-
-In practice, the Shamir share set also includes Recovery Operator shares. This means the effective Shamir parameters are computed over the combined share pool while keeping the same threshold. For example:
-
-- **3 ordinary operators + 2 recovery shares:** `2-of-5`
-
-This ensures that the normal custody threshold follows the ordinary operator quorum, while still allowing dormant recovery shares to exist for break-glass recovery flows.
-
-### 3.5 Recovery Operators
-
-Recovery Operators are a separate peer type from ordinary vault operators.
-
-Their role is intentionally narrow. They can only:
-
-- participate in unsealing the vault
-- vote for operator replacement
-
-Recovery Operators do not participate in routine governance such as approving SDK clients, granting wallet visibility, approving transactions, creating grants, approving server updates, or changing Shamir parameters.
-
-### 3.6 Sleeping and Waking Recovery Operators
-
-By default, Recovery Operators are **sleeping** and do not participate in any active flow.
-
-Any ordinary operator may request that Recovery Operators **wake up**.
-
-Any ordinary operator may also cancel a pending wake-up request.
-
-This creates a dispute window before recovery powers become active. The default wake-up delay is **14 days**.
-
-Recovery Operators are therefore part of the break-glass recovery path rather than the normal operating quorum.
-
-The high-level recovery flow is:
-
-```mermaid
-sequenceDiagram
-    autonumber
-    actor Op as Ordinary Operator
-    participant Server
-    actor Other as Other Operator
-    actor Rec as Recovery Operator
-
-    Op->>Server: Request recovery wake-up
-    Server-->>Op: Wake-up pending
-    Note over Server: Default dispute window: 14 days
-
-    alt Wake-up cancelled during dispute window
-        Other->>Server: Cancel wake-up
-        Server-->>Op: Recovery cancelled
-        Server-->>Rec: Stay sleeping
-    else No cancellation for 14 days
-        Server-->>Rec: Wake up
-        Rec->>Server: Join recovery flow
-        critical Recovery authority
-            Rec->>Server: Participate in unseal
-            Rec->>Server: Vote on operator replacement
-        end
-        Server-->>Op: Recovery mode active
-    end
-```
-
-### 3.7 Committee Formation
-
-There are two ways to form a multi-operator committee:
-
-- convert an existing single-operator vault by adding new operators
-- bootstrap an unbootstrapped vault directly into multi-operator mode
-
-In both cases, committee formation is a coordinated process. Arbiter does not allow multi-operator custody to emerge implicitly from unrelated registrations.
-
-### 3.8 Bootstrapping an Unbootstrapped Vault into Multi-Operator Mode
-
-When an unbootstrapped vault is initialized as a multi-operator vault, the setup proceeds as follows:
-
-1. An operator connects to the unbootstrapped vault using a User Agent and the bootstrap token.
-2. During bootstrap setup, that operator declares:
-   - the total number of ordinary operators
-   - the total number of Recovery Operators
-3. The vault enters **multi-bootstrap mode**.
-4. While in multi-bootstrap mode:
-   - every ordinary operator must connect with a User Agent using the bootstrap token
-   - every Recovery Operator must also connect using the bootstrap token
-   - each participant is registered individually
-   - each participant's share is created and protected with that participant's credentials
-5. The vault is considered fully bootstrapped only after all declared operator and recovery-share registrations have completed successfully.
-
-This means the operator and recovery set is fixed at bootstrap completion time, based on the counts declared when multi-bootstrap mode was entered.
-
-### 3.9 Special Bootstrap Constraint for Two-Operator Vaults
-
-If a vault is declared with exactly **2 ordinary operators**, Arbiter requires at least **1 Recovery Operator** to be configured during bootstrap.
-
-This prevents the worst-case custody failure in which a `2-of-2` operator set becomes permanently unrecoverable after loss of a single operator.
-
----
-
-## 4. Server Identity
+## 3. Server Identity
 
 The server proves its identity using TLS with a self-signed certificate. The TLS private key is generated on first run and is long-term; no rotation mechanism exists yet due to the complexity of multi-peer coordination.
 
@@ -198,9 +56,9 @@ Peers verify the server by its **public key fingerprint**:
 
 ---
 
-## 5. Key Management
+## 4. Key Management
 
-### 5.1 Key Hierarchy
+### 4.1 Key Hierarchy
 
 There are three layers of keys:
 
@@ -215,19 +73,19 @@ This layered design enables:
 - **Password rotation** without re-encrypting every wallet key (only the root key is re-encrypted).
 - **Root key rotation** without requiring the user to change their password.
 
-### 5.2 Encryption at Rest
+### 4.2 Encryption at Rest
 
 The database stores everything in encrypted form using symmetric AEAD. The encryption scheme is versioned to support transparent migration — when the vault unseals, Arbiter automatically re-encrypts any entries that are behind the current scheme version. See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the specific scheme and versioning mechanism.
 
 ---
 
-## 6. Vault Lifecycle
+## 5. Vault Lifecycle
 
-### 6.1 Sealed State
+### 5.1 Sealed State
 
 On boot, the root key is encrypted and the server cannot perform any signing operations. This state is called **Sealed**.
 
-### 6.2 Unseal Flow
+### 5.2 Unseal Flow
 
 To transition to the **Unsealed** state, a User Agent must provide the password:
 
@@ -238,7 +96,7 @@ To transition to the **Unsealed** state, a User Agent must provide the password:
    - **Success:** The root key is decrypted and placed into a hardened memory cell. The server transitions to `Unsealed`. Any entries pending encryption scheme migration are re-encrypted.
    - **Failure:** The server returns an error indicating the password is incorrect.
 
-### 6.3 Memory Protection
+### 5.3 Memory Protection
 
 Once unsealed, the root key must be protected in memory against:
 
@@ -250,9 +108,9 @@ See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the current and planned memory pr
 
 ---
 
-## 7. Permission Engine
+## 6. Permission Engine
 
-### 7.1 Fundamental Rules
+### 6.1 Fundamental Rules
 
 - SDK clients have **no access by default**.
 - Access is granted **explicitly** by a User Agent.
@@ -262,45 +120,11 @@ Each blockchain requires its own policy system due to differences in static tran
 
 Arbiter is also responsible for ensuring that **transaction nonces are never reused**.
 
-### 7.2 EVM Policies
+### 6.2 EVM Policies
 
 Every EVM grant is scoped to a specific **wallet** and **chain ID**.
 
-#### 7.2.0 Transaction Signing Sequence
-
-The high-level interaction order is:
-
-```mermaid
-sequenceDiagram
-    autonumber
-    actor SDK as SDK Client
-    participant Server
-    participant UA as User Agent
-
-    SDK->>Server: SignTransactionRequest
-    Server->>Server: Resolve wallet and wallet visibility
-    alt Visibility approval required
-        Server->>UA: Ask for wallet visibility approval
-        UA-->>Server: Vote result
-    end
-    Server->>Server: Evaluate transaction
-    Server->>Server: Load grant and limits context
-    alt Grant approval required
-        Server->>UA: Ask for execution / grant approval
-        UA-->>Server: Vote result
-        opt Create persistent grant
-            Server->>Server: Create and store grant
-        end
-        Server->>Server: Retry evaluation
-    end
-    critical Final authorization path
-        Server->>Server: Check limits and record execution
-        Server-->>Server: Signature or evaluation error
-    end
-    Server-->>SDK: Signature or error
-```
-
-#### 7.2.1 Transaction Sub-Grants
+#### 6.2.1 Transaction Sub-Grants
 
 Arbiter maintains an ever-expanding database of known contracts and their ABIs. Based on contract knowledge, transaction requests fall into three categories:
 
@@ -324,9 +148,9 @@ Available restrictions:
 
 These transactions have no `calldata` and therefore cannot interact with contracts. They can be subject to the same volume and rate restrictions as above.
 
-#### 7.2.2 Global Limits
+#### 6.2.2 Global Limits
 
 In addition to sub-grant-specific restrictions, the following limits can be applied across all grant types:
 
 - **Gas limit** — Maximum gas per transaction.
-- **Time-window restrictions** — e.g., signing allowed only 08:00–20:00 on Mondays and Thursdays.
+- **Time-window restrictions** — e.g., signing allowed only 08:00–20:00 on Mondays and Thursdays.

CLAUDE.md

@@ -1,128 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
-- **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
-- **`useragent/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
-- **`protobufs/`** — Protocol Buffer definitions shared between server and client
-
-The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
-
-## Toolchain Setup
-
-Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
-```sh
-mise install
-```
-
-Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
-
-## Server (Rust workspace at `server/`)
-
-### Crates
-
-| Crate | Purpose |
-|---|---|
-| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
-| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
-| `arbiter-useragent` | Rust client library for the user agent side of the gRPC protocol |
-| `arbiter-client` | Rust client library for SDK clients |
-
-### Common Commands
-
-```sh
-cd server
-
-# Build
-cargo build
-
-# Run the server daemon
-cargo run -p arbiter-server
-
-# Run all tests (preferred over cargo test)
-cargo nextest run
-
-# Run a single test
-cargo nextest run <test_name>
-
-# Lint
-cargo clippy
-
-# Security audit
-cargo audit
-
-# Check unused dependencies
-cargo shear
-
-# Run snapshot tests and update snapshots
-cargo insta review
-```
-
-### Architecture
-
-The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
-
-- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
-- **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
-- **`FlowCoordinator`** — Coordinates cross-connection flow between user agents and SDK clients.
-- **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
-
-Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
-
-**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
-
-**Cryptography:**
-- Authentication: ed25519 (challenge-response, nonce-tracked per peer)
-- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
-- Password KDF: Argon2
-- Unseal transport: X25519 ephemeral key exchange
-- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
-
-**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
-
-### Proto Regeneration
-
-When `.proto` files in `protobufs/` change, rebuild to regenerate:
-```sh
-cd server && cargo build -p arbiter-proto
-```
-
-### Database Migrations
-
-```sh
-# Create a new migration
-diesel migration generate <name> --migration-dir crates/arbiter-server/migrations
-
-# Run migrations manually (server also runs them on startup)
-diesel migration run --migration-dir crates/arbiter-server/migrations
-```
-
-## User Agent (Flutter + Rinf at `useragent/`)
-
-The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `useragent/native/hub/` as a separate crate that uses `arbiter-useragent` for the gRPC client.
-
-Communication between Dart and Rust uses typed **signals** defined in `useragent/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
-
-```sh
-cd useragent && rinf gen
-```
-
-### Common Commands
-
-```sh
-cd useragent
-
-# Run the app (macOS or Windows)
-flutter run
-
-# Regenerate Rust↔Dart signal bindings
-rinf gen
-
-# Analyze Dart code
-flutter analyze
-```
-
-The Rinf Rust entry point is `useragent/native/hub/src/lib.rs`. It spawns actors defined in `useragent/native/hub/src/actors/` which handle Dart↔server communication via signals.

IMPLEMENTATION.md

@@ -4,77 +4,10 @@ This document covers concrete technology choices and dependencies. For the archi
 
 ---
 
-## Client Connection Flow
-
-### Authentication Result Semantics
-
-Authentication no longer uses an implicit success-only response shape. Both `client` and `user-agent` return explicit auth status enums over the wire.
-
-- **Client:** `AuthResult` may return `SUCCESS`, `INVALID_KEY`, `INVALID_SIGNATURE`, `APPROVAL_DENIED`, `NO_USER_AGENTS_ONLINE`, or `INTERNAL`
-- **User-agent:** `AuthResult` may return `SUCCESS`, `INVALID_KEY`, `INVALID_SIGNATURE`, `BOOTSTRAP_REQUIRED`, `TOKEN_INVALID`, or `INTERNAL`
-
-This makes transport-level failures and actor/domain-level auth failures distinct:
-
-- **Transport/protocol failures** are surfaced as stream/status errors
-- **Authentication failures** are surfaced as successful protocol responses carrying an explicit auth status
-
-Clients are expected to handle these status codes directly and present the concrete failure reason to the user.
-
-### New Client Approval
-
-When a client whose public key is not yet in the database connects, all connected user agents are asked to approve the connection. The first agent to respond determines the outcome; remaining requests are cancelled via a watch channel.
-
-```mermaid
-flowchart TD
-    A([Client connects]) --> B[Receive AuthChallengeRequest]
-    B --> C{pubkey in DB?}
-
-    C -- yes --> D[Read nonce\nIncrement nonce in DB]
-    D --> G
-
-    C -- no --> E[Ask all UserAgents:\nClientConnectionRequest]
-    E --> F{First response}
-    F -- denied --> Z([Reject connection])
-    F -- approved --> F2[Cancel remaining\nUserAgent requests]
-    F2 --> F3[INSERT client\nnonce = 1]
-    F3 --> G[Send AuthChallenge\nwith nonce]
-
-    G --> H[Receive AuthChallengeSolution]
-    H --> I{Signature valid?}
-    I -- no --> Z
-    I -- yes --> J([Session started])
-```
-
-### Known Issue: Concurrent Registration Race (TOCTOU)
-
-Two connections presenting the same previously-unknown public key can race through the approval flow simultaneously:
-
-1. Both check the DB → neither is registered.
-2. Both request approval from user agents → both receive approval.
-3. Both `INSERT` the client record → the second insert silently overwrites the first, resetting the nonce.
-
-This means the first connection's nonce is invalidated by the second, causing its challenge verification to fail. A fix requires either serialising new-client registration (e.g. an in-memory lock keyed on pubkey) or replacing the separate check + insert with an `INSERT OR IGNORE` / upsert guarded by a unique constraint on `public_key`.
-
-### Nonce Semantics
-
-The `program_client.nonce` column stores the **next usable nonce** — i.e. it is always one ahead of the nonce last issued in a challenge.
-
-- **New client:** inserted with `nonce = 1`; the first challenge is issued with `nonce = 0`.
-- **Existing client:** the current DB value is read and used as the challenge nonce, then immediately incremented within the same exclusive transaction, preventing replay.
-
----
-
 ## Cryptography
 
 ### Authentication
-- **Client protocol:** ML-DSA
-
-### User-Agent Authentication
-
-User-agent authentication supports multiple signature schemes because platform-provided "hardware-bound" keys do not expose a uniform algorithm across operating systems and hardware.
-
-- **Supported schemes:** ML-DSA
-- **Why:** Secure Enclave (MacOS) support them natively, on other platforms we could emulate while they roll-out
+- **Signature scheme:** ed25519
 
 ### Encryption at Rest
 - **Scheme:** Symmetric AEAD — currently **XChaCha20-Poly1305**
@@ -89,147 +22,14 @@ User-agent authentication supports multiple signature schemes because platform-p
 ## Communication
 
 - **Protocol:** gRPC with Protocol Buffers
-- **Request/response matching:** multiplexed over a single bidirectional stream using per-connection request IDs
 - **Server identity distribution:** `ServerInfo` protobuf struct containing the TLS public key fingerprint
 - **Future consideration:** grpc-web lacks bidirectional stream support, so a browser-based wallet may require protojson over WebSocket
 
-### Request Multiplexing
-
-Both `client` and `user-agent` connections support multiple in-flight requests over one gRPC bidi stream.
-
-- Every request carries a monotonically increasing request ID
-- Every normal response echoes the request ID it corresponds to
-- Out-of-band server messages omit the response ID entirely
-- The server rejects already-seen request IDs at the transport adapter boundary before business logic sees the message
-
-This keeps request correlation entirely in transport/client connection code while leaving actor and domain handlers unaware of request IDs.
-
----
-
-## EVM Policy Engine
-
-### Overview
-
-The EVM engine classifies incoming transactions, enforces grant constraints, and records executions. It is the sole path through which a wallet key is used for signing.
-
-The central abstraction is the `Policy` trait. Each implementation handles one semantic transaction category and owns its own database tables for grant storage and transaction logging.
-
-### Transaction Evaluation Flow
-
-`Engine::evaluate_transaction` runs the following steps in order:
-
-1. **Classify** — Each registered policy's `analyze(context)` inspects the transaction fields (`chain`, `to`, `value`, `calldata`). The first one returning `Some(meaning)` wins. If none match, the transaction is rejected as `UnsupportedTransactionType`.
-2. **Find grant** — `Policy::try_find_grant` queries for a non-revoked grant covering this wallet, client, chain, and target address.
-3. **Check shared constraints** — `check_shared_constraints` runs in the engine before any policy-specific logic. It enforces the validity window, gas fee caps, and transaction count rate limit (see below).
-4. **Evaluate** — `Policy::evaluate` checks the decoded meaning against the grant's policy-specific constraints and returns any violations.
-5. **Record** — If `RunKind::Execution` and there are no violations, the engine writes to `evm_transaction_log` and calls `Policy::record_transaction` for any policy-specific logging (e.g., token transfer volume).
-
-The detailed branch structure is shown below:
-
-```mermaid
-flowchart TD
-    A[SDK Client sends sign transaction request] --> B[Server resolves wallet]
-    B --> C{Wallet exists?}
-
-    C -- No --> Z1[Return wallet not found error]
-    C -- Yes --> D[Check SDK client wallet visibility]
-
-    D --> E{Wallet visible to SDK client?}
-    E -- No --> F[Start wallet visibility voting flow]
-    F --> G{Vote approved?}
-    G -- No --> Z2[Return wallet access denied error]
-    G -- Yes --> H[Persist wallet visibility]
-    E -- Yes --> I[Classify transaction meaning]
-    H --> I
-
-    I --> J{Meaning supported?}
-    J -- No --> Z3[Return unsupported transaction error]
-    J -- Yes --> K[Find matching grant]
-
-    K --> L{Grant exists?}
-    L -- Yes --> M[Check grant limits]
-    L -- No --> N[Start execution or grant voting flow]
-
-    N --> O{User-agent decision}
-    O -- Reject --> Z4[Return no matching grant error]
-    O -- Allow once --> M
-    O -- Create grant --> P[Create grant with user-selected limits]
-    P --> Q[Persist grant]
-    Q --> M
-
-    M --> R{Limits exceeded?}
-    R -- Yes --> Z5[Return evaluation error]
-    R -- No --> S[Record transaction in logs]
-    S --> T[Produce signature]
-    T --> U[Return signature to SDK client]
-
-    note1[Limit checks include volume, count, and gas constraints.]
-    note2[Grant lookup depends on classified meaning, such as ether transfer or token transfer.]
-
-    K -. uses .-> note2
-    M -. checks .-> note1
-```
-
-### Policy Trait
-
-| Method | Purpose |
-|---|---|
-| `analyze` | Pure — classifies a transaction into a typed `Meaning`, or `None` if this policy doesn't apply |
-| `evaluate` | Checks the `Meaning` against a `Grant`; returns a list of `EvalViolation`s |
-| `create_grant` | Inserts policy-specific rows; returns the specific grant ID |
-| `try_find_grant` | Finds a matching non-revoked grant for the given `EvalContext` |
-| `find_all_grants` | Returns all non-revoked grants (used for listing) |
-| `record_transaction` | Persists policy-specific data after execution |
-
-`analyze` and `evaluate` are intentionally separate: classification is pure and cheap, while evaluation may involve DB queries (e.g., fetching past transfer volume).
-
-### Registered Policies
-
-**EtherTransfer** — plain ETH transfers (empty calldata)
-
-- Grant requires: allowlist of recipient addresses + one volumetric rate limit (max ETH over a time window)
-- Violations: recipient not in allowlist, cumulative ETH volume exceeded
-
-**TokenTransfer** — ERC-20 `transfer(address,uint256)` calls
-
-- Recognised by ABI-decoding the `transfer(address,uint256)` selector against a static registry of known token contracts (`arbiter_tokens_registry`)
-- Grant requires: token contract address, optional recipient restriction, zero or more volumetric rate limits
-- Violations: recipient mismatch, any volumetric limit exceeded
-
-### Grant Model
-
-Every grant has two layers:
-
-- **Shared (`evm_basic_grant`)** — wallet, chain, validity period, gas fee caps, transaction count rate limit. One row per grant regardless of type.
-- **Specific** — policy-owned tables (`evm_ether_transfer_grant`, `evm_token_transfer_grant`) holding type-specific configuration.
-
-`find_all_grants` uses a `#[diesel::auto_type]` base join between the specific and shared tables, then batch-loads related rows (targets, volume limits) in two additional queries to avoid N+1.
-
-The engine exposes `list_all_grants` which collects across all policy types into `Vec<Grant<SpecificGrant>>` via a blanket `From<Grant<S>> for Grant<SpecificGrant>` conversion.
-
-### Shared Constraints (enforced by the engine)
-
-These are checked centrally in `check_shared_constraints` before policy evaluation:
-
-| Constraint | Fields | Behaviour |
-|---|---|---|
-| Validity window | `valid_from`, `valid_until` | Emits `InvalidTime` if current time is outside the range |
-| Gas fee cap | `max_gas_fee_per_gas`, `max_priority_fee_per_gas` | Emits `GasLimitExceeded` if either cap is breached |
-| Tx count rate limit | `rate_limit` (`count` + `window`) | Counts rows in `evm_transaction_log` within the window; emits `RateLimitExceeded` if at or above the limit |
-
----
-
-### Known Limitations
-
-- **Only EIP-1559 transactions are supported.** Legacy and EIP-2930 types are rejected outright.
-- **No opaque-calldata (unknown contract) grant type.** The architecture describes a category for unrecognised contracts, but no policy implements it yet. Any transaction that is not a plain ETH transfer or a known ERC-20 transfer is unconditionally rejected.
-- **Token registry is static.** Tokens are recognised only if they appear in the hard-coded `arbiter_tokens_registry` crate. There is no mechanism to register additional contracts at runtime.
-
 ---
 
 ## Memory Protection
 
 The unsealed root key must be held in a hardened memory cell resistant to dumps, page swaps, and hibernation.
 
-- **Current:** A dedicated memory-protection abstraction is in place, with `memsafe` used behind that abstraction today
-- **Planned:** Additional backends can be introduced behind the same abstraction, including a custom implementation based on `mlock` (Unix) and `VirtualProtect` (Windows)
+- **Current:** Using the `memsafe` crate as an interim solution
+- **Planned:** Custom implementation based on `mlock` (Unix) and `VirtualProtect` (Windows)

LICENSE

@@ -1,190 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright 2026 MarketTakers
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

README.md

@@ -1,13 +0,0 @@
-# Arbiter
-> Policy-first multi-client wallet daemon, allowing permissioned transactions across blockchains
-
-## Security warning
-Arbiter can't meaningfully protect against host compromise. Potential attack flow:
-- Attacker steals TLS keys from database
-- Pretends to be server; just accepts user agent challenge solutions
-- Pretend to be in sealed state and performing DH with client
-- Steals user password and derives seal key
-
-While this attack is highly targetive, it's still possible. 
-
-> This software is experimental. Do not use with funds you cannot afford to lose.

app/.dart_tool/extension_discovery/vs_code.json

@@ -1 +0,0 @@
-{"version":2,"entries":[{"package":"app","rootUri":"../","packageUri":"lib/"}]}

app/README.md

@@ -1,4 +1,4 @@
-# useragent
+# app
 
 A new Flutter project.
 

app/lib/main.dart

@@ -0,0 +1,122 @@
+import 'package:flutter/material.dart';
+
+void main() {
+  runApp(const MyApp());
+}
+
+class MyApp extends StatelessWidget {
+  const MyApp({super.key});
+
+  // This widget is the root of your application.
+  @override
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      title: 'Flutter Demo',
+      theme: ThemeData(
+        // This is the theme of your application.
+        //
+        // TRY THIS: Try running your application with "flutter run". You'll see
+        // the application has a purple toolbar. Then, without quitting the app,
+        // try changing the seedColor in the colorScheme below to Colors.green
+        // and then invoke "hot reload" (save your changes or press the "hot
+        // reload" button in a Flutter-supported IDE, or press "r" if you used
+        // the command line to start the app).
+        //
+        // Notice that the counter didn't reset back to zero; the application
+        // state is not lost during the reload. To reset the state, use hot
+        // restart instead.
+        //
+        // This works for code too, not just values: Most code changes can be
+        // tested with just a hot reload.
+        colorScheme: .fromSeed(seedColor: Colors.deepPurple),
+      ),
+      home: const MyHomePage(title: 'Flutter Demo Home Page'),
+    );
+  }
+}
+
+class MyHomePage extends StatefulWidget {
+  const MyHomePage({super.key, required this.title});
+
+  // This widget is the home page of your application. It is stateful, meaning
+  // that it has a State object (defined below) that contains fields that affect
+  // how it looks.
+
+  // This class is the configuration for the state. It holds the values (in this
+  // case the title) provided by the parent (in this case the App widget) and
+  // used by the build method of the State. Fields in a Widget subclass are
+  // always marked "final".
+
+  final String title;
+
+  @override
+  State<MyHomePage> createState() => _MyHomePageState();
+}
+
+class _MyHomePageState extends State<MyHomePage> {
+  int _counter = 0;
+
+  void _incrementCounter() {
+    setState(() {
+      // This call to setState tells the Flutter framework that something has
+      // changed in this State, which causes it to rerun the build method below
+      // so that the display can reflect the updated values. If we changed
+      // _counter without calling setState(), then the build method would not be
+      // called again, and so nothing would appear to happen.
+      _counter++;
+    });
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    // This method is rerun every time setState is called, for instance as done
+    // by the _incrementCounter method above.
+    //
+    // The Flutter framework has been optimized to make rerunning build methods
+    // fast, so that you can just rebuild anything that needs updating rather
+    // than having to individually change instances of widgets.
+    return Scaffold(
+      appBar: AppBar(
+        // TRY THIS: Try changing the color here to a specific color (to
+        // Colors.amber, perhaps?) and trigger a hot reload to see the AppBar
+        // change color while the other colors stay the same.
+        backgroundColor: Theme.of(context).colorScheme.inversePrimary,
+        // Here we take the value from the MyHomePage object that was created by
+        // the App.build method, and use it to set our appbar title.
+        title: Text(widget.title),
+      ),
+      body: Center(
+        // Center is a layout widget. It takes a single child and positions it
+        // in the middle of the parent.
+        child: Column(
+          // Column is also a layout widget. It takes a list of children and
+          // arranges them vertically. By default, it sizes itself to fit its
+          // children horizontally, and tries to be as tall as its parent.
+          //
+          // Column has various properties to control how it sizes itself and
+          // how it positions its children. Here we use mainAxisAlignment to
+          // center the children vertically; the main axis here is the vertical
+          // axis because Columns are vertical (the cross axis would be
+          // horizontal).
+          //
+          // TRY THIS: Invoke "debug painting" (choose the "Toggle Debug Paint"
+          // action in the IDE, or press "p" in the console), to see the
+          // wireframe for each widget.
+          mainAxisAlignment: .center,
+          children: [
+            const Text('You have pushed the button this many times:'),
+            Text(
+              '$_counter',
+              style: Theme.of(context).textTheme.headlineMedium,
+            ),
+          ],
+        ),
+      ),
+      floatingActionButton: FloatingActionButton(
+        onPressed: _incrementCounter,
+        tooltip: 'Increment',
+        child: const Icon(Icons.add),
+      ),
+    );
+  }
+}

app/macos/Flutter/Flutter-Debug.xcconfig

@@ -0,0 +1 @@
+#include "ephemeral/Flutter-Generated.xcconfig"

app/macos/Flutter/Flutter-Release.xcconfig

@@ -0,0 +1 @@
+#include "ephemeral/Flutter-Generated.xcconfig"

app/macos/Flutter/GeneratedPluginRegistrant.swift

@@ -0,0 +1,10 @@
+//
+//  Generated file. Do not edit.
+//
+
+import FlutterMacOS
+import Foundation
+
+
+func RegisterGeneratedPlugins(registry: FlutterPluginRegistry) {
+}

app/macos/Runner.xcodeproj/project.pbxproj

@@ -27,8 +27,6 @@
 		33CC10F32044A3C60003C045 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 33CC10F22044A3C60003C045 /* Assets.xcassets */; };
 		33CC10F62044A3C60003C045 /* MainMenu.xib in Resources */ = {isa = PBXBuildFile; fileRef = 33CC10F42044A3C60003C045 /* MainMenu.xib */; };
 		33CC11132044BFA00003C045 /* MainFlutterWindow.swift in Sources */ = {isa = PBXBuildFile; fileRef = 33CC11122044BFA00003C045 /* MainFlutterWindow.swift */; };
-		89374438F7FC24C1E409AC55 /* Pods_RunnerTests.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 84BA779FA182F4B90ADDD656 /* Pods_RunnerTests.framework */; };
-		9812E904D4443BD8157BA2CD /* Pods_Runner.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = FFE2551831D6F491FC95F4C0 /* Pods_Runner.framework */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -66,7 +64,7 @@
 		331C80D7294CF71000263BE5 /* RunnerTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = RunnerTests.swift; sourceTree = "<group>"; };
 		333000ED22D3DE5D00554162 /* Warnings.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Warnings.xcconfig; sourceTree = "<group>"; };
 		335BBD1A22A9A15E00E9071D /* GeneratedPluginRegistrant.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = GeneratedPluginRegistrant.swift; sourceTree = "<group>"; };
-		33CC10ED2044A3C60003C045 /* useragent.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = useragent.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		33CC10ED2044A3C60003C045 /* app.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = "app.app"; sourceTree = BUILT_PRODUCTS_DIR; };
 		33CC10F02044A3C60003C045 /* AppDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
 		33CC10F22044A3C60003C045 /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; name = Assets.xcassets; path = Runner/Assets.xcassets; sourceTree = "<group>"; };
 		33CC10F52044A3C60003C045 /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/MainMenu.xib; sourceTree = "<group>"; };
@@ -78,16 +76,8 @@
 		33E51913231747F40026EE4D /* DebugProfile.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = DebugProfile.entitlements; sourceTree = "<group>"; };
 		33E51914231749380026EE4D /* Release.entitlements */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.entitlements; path = Release.entitlements; sourceTree = "<group>"; };
 		33E5194F232828860026EE4D /* AppInfo.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = AppInfo.xcconfig; sourceTree = "<group>"; };
-		5385F9987FF8E7FD3BA4E87E /* Pods-RunnerTests.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-RunnerTests.release.xcconfig"; path = "Target Support Files/Pods-RunnerTests/Pods-RunnerTests.release.xcconfig"; sourceTree = "<group>"; };
 		7AFA3C8E1D35360C0083082E /* Release.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Release.xcconfig; sourceTree = "<group>"; };
-		84BA779FA182F4B90ADDD656 /* Pods_RunnerTests.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_RunnerTests.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		9740EEB21CF90195004384FC /* Debug.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Debug.xcconfig; sourceTree = "<group>"; };
-		989E0AE288EA0AECFF244CAB /* Pods-Runner.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.debug.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.debug.xcconfig"; sourceTree = "<group>"; };
-		ADF8B0EB51CA38AE67931C44 /* Pods-RunnerTests.profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-RunnerTests.profile.xcconfig"; path = "Target Support Files/Pods-RunnerTests/Pods-RunnerTests.profile.xcconfig"; sourceTree = "<group>"; };
-		DC537F8D4AE9B12FB802E110 /* Pods-RunnerTests.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-RunnerTests.debug.xcconfig"; path = "Target Support Files/Pods-RunnerTests/Pods-RunnerTests.debug.xcconfig"; sourceTree = "<group>"; };
-		F06E58390BD453D6E42AD67C /* Pods-Runner.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.release.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"; sourceTree = "<group>"; };
-		F9C83BBEBB84A7F9ACC93B93 /* Pods-Runner.profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.profile.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.profile.xcconfig"; sourceTree = "<group>"; };
-		FFE2551831D6F491FC95F4C0 /* Pods_Runner.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_Runner.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -95,7 +85,6 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				89374438F7FC24C1E409AC55 /* Pods_RunnerTests.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -103,7 +92,6 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				9812E904D4443BD8157BA2CD /* Pods_Runner.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -137,14 +125,13 @@
 				331C80D6294CF71000263BE5 /* RunnerTests */,
 				33CC10EE2044A3C60003C045 /* Products */,
 				D73912EC22F37F3D000D13A0 /* Frameworks */,
-				C5764DB16A5CAE65539863D1 /* Pods */,
 			);
 			sourceTree = "<group>";
 		};
 		33CC10EE2044A3C60003C045 /* Products */ = {
 			isa = PBXGroup;
 			children = (
-				33CC10ED2044A3C60003C045 /* useragent.app */,
+				33CC10ED2044A3C60003C045 /* app.app */,
 				331C80D5294CF71000263BE5 /* RunnerTests.xctest */,
 			);
 			name = Products;
@@ -185,24 +172,9 @@
 			path = Runner;
 			sourceTree = "<group>";
 		};
-		C5764DB16A5CAE65539863D1 /* Pods */ = {
-			isa = PBXGroup;
-			children = (
-				989E0AE288EA0AECFF244CAB /* Pods-Runner.debug.xcconfig */,
-				F06E58390BD453D6E42AD67C /* Pods-Runner.release.xcconfig */,
-				F9C83BBEBB84A7F9ACC93B93 /* Pods-Runner.profile.xcconfig */,
-				DC537F8D4AE9B12FB802E110 /* Pods-RunnerTests.debug.xcconfig */,
-				5385F9987FF8E7FD3BA4E87E /* Pods-RunnerTests.release.xcconfig */,
-				ADF8B0EB51CA38AE67931C44 /* Pods-RunnerTests.profile.xcconfig */,
-			);
-			path = Pods;
-			sourceTree = "<group>";
-		};
 		D73912EC22F37F3D000D13A0 /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
-				FFE2551831D6F491FC95F4C0 /* Pods_Runner.framework */,
-				84BA779FA182F4B90ADDD656 /* Pods_RunnerTests.framework */,
 			);
 			name = Frameworks;
 			sourceTree = "<group>";
@@ -214,7 +186,6 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 331C80DE294CF71000263BE5 /* Build configuration list for PBXNativeTarget "RunnerTests" */;
 			buildPhases = (
-				72217D999FDDB4A0040A839E /* [CP] Check Pods Manifest.lock */,
 				331C80D1294CF70F00263BE5 /* Sources */,
 				331C80D2294CF70F00263BE5 /* Frameworks */,
 				331C80D3294CF70F00263BE5 /* Resources */,
@@ -233,13 +204,11 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 33CC10FB2044A3C60003C045 /* Build configuration list for PBXNativeTarget "Runner" */;
 			buildPhases = (
-				4909404BD2C11CE7688B3B73 /* [CP] Check Pods Manifest.lock */,
 				33CC10E92044A3C60003C045 /* Sources */,
 				33CC10EA2044A3C60003C045 /* Frameworks */,
 				33CC10EB2044A3C60003C045 /* Resources */,
 				33CC110E2044A8840003C045 /* Bundle Framework */,
 				3399D490228B24CF009A79C7 /* ShellScript */,
-				2AF2BC4AB258588AFC797EA4 /* [CP] Embed Pods Frameworks */,
 			);
 			buildRules = (
 			);
@@ -248,7 +217,7 @@
 			);
 			name = Runner;
 			productName = Runner;
-			productReference = 33CC10ED2044A3C60003C045 /* useragent.app */;
+			productReference = 33CC10ED2044A3C60003C045 /* app.app */;
 			productType = "com.apple.product-type.application";
 		};
 /* End PBXNativeTarget section */
@@ -322,23 +291,6 @@
 /* End PBXResourcesBuildPhase section */
 
 /* Begin PBXShellScriptBuildPhase section */
-		2AF2BC4AB258588AFC797EA4 /* [CP] Embed Pods Frameworks */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-				"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-frameworks-${CONFIGURATION}-input-files.xcfilelist",
-			);
-			name = "[CP] Embed Pods Frameworks";
-			outputFileListPaths = (
-				"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-frameworks-${CONFIGURATION}-output-files.xcfilelist",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "\"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-frameworks.sh\"\n";
-			showEnvVarsInLog = 0;
-		};
 		3399D490228B24CF009A79C7 /* ShellScript */ = {
 			isa = PBXShellScriptBuildPhase;
 			alwaysOutOfDate = 1;
@@ -377,50 +329,6 @@
 			shellPath = /bin/sh;
 			shellScript = "\"$FLUTTER_ROOT\"/packages/flutter_tools/bin/macos_assemble.sh && touch Flutter/ephemeral/tripwire";
 		};
-		4909404BD2C11CE7688B3B73 /* [CP] Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-			);
-			inputPaths = (
-				"${PODS_PODFILE_DIR_PATH}/Podfile.lock",
-				"${PODS_ROOT}/Manifest.lock",
-			);
-			name = "[CP] Check Pods Manifest.lock";
-			outputFileListPaths = (
-			);
-			outputPaths = (
-				"$(DERIVED_FILE_DIR)/Pods-Runner-checkManifestLockResult.txt",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n# This output is used by Xcode 'outputs' to avoid re-running this script phase.\necho \"SUCCESS\" > \"${SCRIPT_OUTPUT_FILE_0}\"\n";
-			showEnvVarsInLog = 0;
-		};
-		72217D999FDDB4A0040A839E /* [CP] Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-			);
-			inputPaths = (
-				"${PODS_PODFILE_DIR_PATH}/Podfile.lock",
-				"${PODS_ROOT}/Manifest.lock",
-			);
-			name = "[CP] Check Pods Manifest.lock";
-			outputFileListPaths = (
-			);
-			outputPaths = (
-				"$(DERIVED_FILE_DIR)/Pods-RunnerTests-checkManifestLockResult.txt",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n# This output is used by Xcode 'outputs' to avoid re-running this script phase.\necho \"SUCCESS\" > \"${SCRIPT_OUTPUT_FILE_0}\"\n";
-			showEnvVarsInLog = 0;
-		};
 /* End PBXShellScriptBuildPhase section */
 
 /* Begin PBXSourcesBuildPhase section */
@@ -472,49 +380,43 @@
 /* Begin XCBuildConfiguration section */
 		331C80DB294CF71000263BE5 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = DC537F8D4AE9B12FB802E110 /* Pods-RunnerTests.debug.xcconfig */;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				CURRENT_PROJECT_VERSION = 1;
 				GENERATE_INFOPLIST_FILE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = com.example.useragent.RunnerTests;
+				PRODUCT_BUNDLE_IDENTIFIER = com.example.app.RunnerTests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_VERSION = 5.0;
-				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/useragent.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/useragent";
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/app.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/app";
 			};
 			name = Debug;
 		};
 		331C80DC294CF71000263BE5 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5385F9987FF8E7FD3BA4E87E /* Pods-RunnerTests.release.xcconfig */;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				CURRENT_PROJECT_VERSION = 1;
 				GENERATE_INFOPLIST_FILE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = com.example.useragent.RunnerTests;
+				PRODUCT_BUNDLE_IDENTIFIER = com.example.app.RunnerTests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_VERSION = 5.0;
-				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/useragent.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/useragent";
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/app.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/app";
 			};
 			name = Release;
 		};
 		331C80DD294CF71000263BE5 /* Profile */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = ADF8B0EB51CA38AE67931C44 /* Pods-RunnerTests.profile.xcconfig */;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				CURRENT_PROJECT_VERSION = 1;
 				GENERATE_INFOPLIST_FILE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = com.example.useragent.RunnerTests;
+				PRODUCT_BUNDLE_IDENTIFIER = com.example.app.RunnerTests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_VERSION = 5.0;
-				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/useragent.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/useragent";
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/app.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/app";
 			};
 			name = Profile;
 		};
@@ -562,7 +464,6 @@
 				MACOSX_DEPLOYMENT_TARGET = 10.15;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				SDKROOT = macosx;
-				STRING_CATALOG_GENERATE_SYMBOLS = YES;
 				SWIFT_COMPILATION_MODE = wholemodule;
 				SWIFT_OPTIMIZATION_LEVEL = "-O";
 			};
@@ -575,23 +476,14 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = Runner/DebugProfile.entitlements;
-				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				DEVELOPMENT_TEAM = 8L884L537J;
-				ENABLE_APP_SANDBOX = YES;
-				ENABLE_INCOMING_NETWORK_CONNECTIONS = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				INFOPLIST_FILE = Runner/Info.plist;
-				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.productivity";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 26.0;
-				PRODUCT_BUNDLE_IDENTIFIER = org.markettakers.arbiter;
 				PROVISIONING_PROFILE_SPECIFIER = "";
-				RUNTIME_EXCEPTION_ALLOW_JIT = YES;
 				SWIFT_VERSION = 5.0;
 			};
 			name = Profile;
@@ -600,7 +492,6 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_STYLE = Manual;
-				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 			};
 			name = Profile;
@@ -656,7 +547,6 @@
 				MTL_ENABLE_DEBUG_INFO = YES;
 				ONLY_ACTIVE_ARCH = YES;
 				SDKROOT = macosx;
-				STRING_CATALOG_GENERATE_SYMBOLS = YES;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
 			};
@@ -706,7 +596,6 @@
 				MACOSX_DEPLOYMENT_TARGET = 10.15;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				SDKROOT = macosx;
-				STRING_CATALOG_GENERATE_SYMBOLS = YES;
 				SWIFT_COMPILATION_MODE = wholemodule;
 				SWIFT_OPTIMIZATION_LEVEL = "-O";
 			};
@@ -719,23 +608,14 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = Runner/DebugProfile.entitlements;
-				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				DEVELOPMENT_TEAM = 8L884L537J;
-				ENABLE_APP_SANDBOX = YES;
-				ENABLE_INCOMING_NETWORK_CONNECTIONS = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				INFOPLIST_FILE = Runner/Info.plist;
-				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.productivity";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 26.0;
-				PRODUCT_BUNDLE_IDENTIFIER = org.markettakers.arbiter;
 				PROVISIONING_PROFILE_SPECIFIER = "";
-				RUNTIME_EXCEPTION_ALLOW_JIT = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
 				SWIFT_VERSION = 5.0;
 			};
@@ -748,23 +628,14 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = Runner/Release.entitlements;
-				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				DEVELOPMENT_TEAM = 8L884L537J;
-				ENABLE_APP_SANDBOX = YES;
-				ENABLE_INCOMING_NETWORK_CONNECTIONS = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				INFOPLIST_FILE = Runner/Info.plist;
-				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.productivity";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 26.0;
-				PRODUCT_BUNDLE_IDENTIFIER = org.markettakers.arbiter;
 				PROVISIONING_PROFILE_SPECIFIER = "";
-				RUNTIME_EXCEPTION_ALLOW_JIT = YES;
 				SWIFT_VERSION = 5.0;
 			};
 			name = Release;
@@ -773,7 +644,6 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_STYLE = Manual;
-				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 			};
 			name = Debug;
@@ -782,7 +652,6 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_STYLE = Automatic;
-				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 			};
 			name = Release;

app/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme

@@ -15,7 +15,7 @@
             <BuildableReference
                BuildableIdentifier = "primary"
                BlueprintIdentifier = "33CC10EC2044A3C60003C045"
-               BuildableName = "useragent.app"
+               BuildableName = "app.app"
                BlueprintName = "Runner"
                ReferencedContainer = "container:Runner.xcodeproj">
             </BuildableReference>
@@ -31,7 +31,7 @@
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "33CC10EC2044A3C60003C045"
-            BuildableName = "useragent.app"
+            BuildableName = "app.app"
             BlueprintName = "Runner"
             ReferencedContainer = "container:Runner.xcodeproj">
          </BuildableReference>
@@ -66,7 +66,7 @@
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "33CC10EC2044A3C60003C045"
-            BuildableName = "useragent.app"
+            BuildableName = "app.app"
             BlueprintName = "Runner"
             ReferencedContainer = "container:Runner.xcodeproj">
          </BuildableReference>
@@ -83,7 +83,7 @@
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "33CC10EC2044A3C60003C045"
-            BuildableName = "useragent.app"
+            BuildableName = "app.app"
             BlueprintName = "Runner"
             ReferencedContainer = "container:Runner.xcodeproj">
          </BuildableReference>

app/macos/Runner.xcworkspace/contents.xcworkspacedata

@@ -4,7 +4,4 @@
    <FileRef
       location = "group:Runner.xcodeproj">
    </FileRef>
-   <FileRef
-      location = "group:Pods/Pods.xcodeproj">
-   </FileRef>
 </Workspace>

app/macos/Runner/Configs/AppInfo.xcconfig

@@ -5,10 +5,10 @@
 // 'flutter create' template.
 
 // The application's name. By default this is also the title of the Flutter window.
-PRODUCT_NAME = useragent
+PRODUCT_NAME = app
 
 // The application's bundle identifier
-PRODUCT_BUNDLE_IDENTIFIER = com.example.useragent
+PRODUCT_BUNDLE_IDENTIFIER = com.example.app
 
 // The copyright displayed in application information
 PRODUCT_COPYRIGHT = Copyright © 2026 com.example. All rights reserved.

app/macos/Runner/DebugProfile.entitlements

@@ -2,7 +2,11 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>keychain-access-groups</key>
-	<array/>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+	<key>com.apple.security.network.server</key>
+	<true/>
 </dict>
 </plist>

app/macos/Runner/Release.entitlements

@@ -2,7 +2,7 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>keychain-access-groups</key>
-	<array/>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
 </dict>
 </plist>

app/pubspec.lock

@@ -0,0 +1,213 @@
+# Generated by pub
+# See https://dart.dev/tools/pub/glossary#lockfile
+packages:
+  async:
+    dependency: transitive
+    description:
+      name: async
+      sha256: "758e6d74e971c3e5aceb4110bfd6698efc7f501675bcfe0c775459a8140750eb"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.13.0"
+  boolean_selector:
+    dependency: transitive
+    description:
+      name: boolean_selector
+      sha256: "8aab1771e1243a5063b8b0ff68042d67334e3feab9e95b9490f9a6ebf73b42ea"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.2"
+  characters:
+    dependency: transitive
+    description:
+      name: characters
+      sha256: f71061c654a3380576a52b451dd5532377954cf9dbd272a78fc8479606670803
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.4.0"
+  clock:
+    dependency: transitive
+    description:
+      name: clock
+      sha256: fddb70d9b5277016c77a80201021d40a2247104d9f4aa7bab7157b7e3f05b84b
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.2"
+  collection:
+    dependency: transitive
+    description:
+      name: collection
+      sha256: "2f5709ae4d3d59dd8f7cd309b4e023046b57d8a6c82130785d2b0e5868084e76"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.19.1"
+  cupertino_icons:
+    dependency: "direct main"
+    description:
+      name: cupertino_icons
+      sha256: ba631d1c7f7bef6b729a622b7b752645a2d076dba9976925b8f25725a30e1ee6
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.8"
+  fake_async:
+    dependency: transitive
+    description:
+      name: fake_async
+      sha256: "5368f224a74523e8d2e7399ea1638b37aecfca824a3cc4dfdf77bf1fa905ac44"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.3"
+  flutter:
+    dependency: "direct main"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_lints:
+    dependency: "direct dev"
+    description:
+      name: flutter_lints
+      sha256: "3105dc8492f6183fb076ccf1f351ac3d60564bff92e20bfc4af9cc1651f4e7e1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.0.0"
+  flutter_test:
+    dependency: "direct dev"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  leak_tracker:
+    dependency: transitive
+    description:
+      name: leak_tracker
+      sha256: "33e2e26bdd85a0112ec15400c8cbffea70d0f9c3407491f672a2fad47915e2de"
+      url: "https://pub.dev"
+    source: hosted
+    version: "11.0.2"
+  leak_tracker_flutter_testing:
+    dependency: transitive
+    description:
+      name: leak_tracker_flutter_testing
+      sha256: "1dbc140bb5a23c75ea9c4811222756104fbcd1a27173f0c34ca01e16bea473c1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.10"
+  leak_tracker_testing:
+    dependency: transitive
+    description:
+      name: leak_tracker_testing
+      sha256: "8d5a2d49f4a66b49744b23b018848400d23e54caf9463f4eb20df3eb8acb2eb1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.2"
+  lints:
+    dependency: transitive
+    description:
+      name: lints
+      sha256: "12f842a479589fea194fe5c5a3095abc7be0c1f2ddfa9a0e76aed1dbd26a87df"
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.1.0"
+  matcher:
+    dependency: transitive
+    description:
+      name: matcher
+      sha256: dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.12.17"
+  material_color_utilities:
+    dependency: transitive
+    description:
+      name: material_color_utilities
+      sha256: f7142bb1154231d7ea5f96bc7bde4bda2a0945d2806bb11670e30b850d56bdec
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.11.1"
+  meta:
+    dependency: transitive
+    description:
+      name: meta
+      sha256: "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.17.0"
+  path:
+    dependency: transitive
+    description:
+      name: path
+      sha256: "75cca69d1490965be98c73ceaea117e8a04dd21217b37b292c9ddbec0d955bc5"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.9.1"
+  sky_engine:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  source_span:
+    dependency: transitive
+    description:
+      name: source_span
+      sha256: "56a02f1f4cd1a2d96303c0144c93bd6d909eea6bee6bf5a0e0b685edbd4c47ab"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.10.2"
+  stack_trace:
+    dependency: transitive
+    description:
+      name: stack_trace
+      sha256: "8b27215b45d22309b5cddda1aa2b19bdfec9df0e765f2de506401c071d38d1b1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.12.1"
+  stream_channel:
+    dependency: transitive
+    description:
+      name: stream_channel
+      sha256: "969e04c80b8bcdf826f8f16579c7b14d780458bd97f56d107d3950fdbeef059d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.4"
+  string_scanner:
+    dependency: transitive
+    description:
+      name: string_scanner
+      sha256: "921cd31725b72fe181906c6a94d987c78e3b98c2e205b397ea399d4054872b43"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.4.1"
+  term_glyph:
+    dependency: transitive
+    description:
+      name: term_glyph
+      sha256: "7f554798625ea768a7518313e58f83891c7f5024f88e46e7182a4558850a4b8e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.2"
+  test_api:
+    dependency: transitive
+    description:
+      name: test_api
+      sha256: ab2726c1a94d3176a45960b6234466ec367179b87dd74f1611adb1f3b5fb9d55
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.7.7"
+  vector_math:
+    dependency: transitive
+    description:
+      name: vector_math
+      sha256: d530bd74fea330e6e364cda7a85019c434070188383e1cd8d9777ee586914c5b
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.2.0"
+  vm_service:
+    dependency: transitive
+    description:
+      name: vm_service
+      sha256: "45caa6c5917fa127b5dbcfbd1fa60b14e583afdc08bfc96dda38886ca252eb60"
+      url: "https://pub.dev"
+    source: hosted
+    version: "15.0.2"
+sdks:
+  dart: ">=3.10.8 <4.0.0"
+  flutter: ">=3.18.0-18.0.pre.54"

app/pubspec.yaml

@@ -0,0 +1,89 @@
+name: app
+description: "A new Flutter project."
+# The following line prevents the package from being accidentally published to
+# pub.dev using `flutter pub publish`. This is preferred for private packages.
+publish_to: 'none' # Remove this line if you wish to publish to pub.dev
+
+# The following defines the version and build number for your application.
+# A version number is three numbers separated by dots, like 1.2.43
+# followed by an optional build number separated by a +.
+# Both the version and the builder number may be overridden in flutter
+# build by specifying --build-name and --build-number, respectively.
+# In Android, build-name is used as versionName while build-number used as versionCode.
+# Read more about Android versioning at https://developer.android.com/studio/publish/versioning
+# In iOS, build-name is used as CFBundleShortVersionString while build-number is used as CFBundleVersion.
+# Read more about iOS versioning at
+# https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
+# In Windows, build-name is used as the major, minor, and patch parts
+# of the product and file versions while build-number is used as the build suffix.
+version: 1.0.0+1
+
+environment:
+  sdk: ^3.10.8
+
+# Dependencies specify other packages that your package needs in order to work.
+# To automatically upgrade your package dependencies to the latest versions
+# consider running `flutter pub upgrade --major-versions`. Alternatively,
+# dependencies can be manually updated by changing the version numbers below to
+# the latest version available on pub.dev. To see which dependencies have newer
+# versions available, run `flutter pub outdated`.
+dependencies:
+  flutter:
+    sdk: flutter
+
+  # The following adds the Cupertino Icons font to your application.
+  # Use with the CupertinoIcons class for iOS style icons.
+  cupertino_icons: ^1.0.8
+
+dev_dependencies:
+  flutter_test:
+    sdk: flutter
+
+  # The "flutter_lints" package below contains a set of recommended lints to
+  # encourage good coding practices. The lint set provided by the package is
+  # activated in the `analysis_options.yaml` file located at the root of your
+  # package. See that file for information about deactivating specific lint
+  # rules and activating additional ones.
+  flutter_lints: ^6.0.0
+
+# For information on the generic Dart part of this file, see the
+# following page: https://dart.dev/tools/pub/pubspec
+
+# The following section is specific to Flutter packages.
+flutter:
+
+  # The following line ensures that the Material Icons font is
+  # included with your application, so that you can use the icons in
+  # the material Icons class.
+  uses-material-design: true
+
+  # To add assets to your application, add an assets section, like this:
+  # assets:
+  #   - images/a_dot_burr.jpeg
+  #   - images/a_dot_ham.jpeg
+
+  # An image asset can refer to one or more resolution-specific "variants", see
+  # https://flutter.dev/to/resolution-aware-images
+
+  # For details regarding adding assets from package dependencies, see
+  # https://flutter.dev/to/asset-from-package
+
+  # To add custom fonts to your application, add a fonts section here,
+  # in this "flutter" section. Each entry in this list should have a
+  # "family" key with the font family name, and a "fonts" key with a
+  # list giving the asset and other descriptors for the font. For
+  # example:
+  # fonts:
+  #   - family: Schyler
+  #     fonts:
+  #       - asset: fonts/Schyler-Regular.ttf
+  #       - asset: fonts/Schyler-Italic.ttf
+  #         style: italic
+  #   - family: Trajan Pro
+  #     fonts:
+  #       - asset: fonts/TrajanPro.ttf
+  #       - asset: fonts/TrajanPro_Bold.ttf
+  #         weight: 700
+  #
+  # For details regarding fonts from package dependencies,
+  # see https://flutter.dev/to/font-from-package

app/windows/CMakeLists.txt

@@ -1,10 +1,10 @@
 # Project-level configuration.
 cmake_minimum_required(VERSION 3.14)
-project(useragent LANGUAGES CXX)
+project(app LANGUAGES CXX)
 
 # The name of the executable created for the application. Change this to change
 # the on-disk name of your application.
-set(BINARY_NAME "useragent")
+set(BINARY_NAME "app")
 
 # Explicitly opt in to modern CMake behaviors to avoid warnings with recent
 # versions of CMake.

app/windows/flutter/generated_plugin_registrant.cc

@@ -0,0 +1,11 @@
+//
+//  Generated file. Do not edit.
+//
+
+// clang-format off
+
+#include "generated_plugin_registrant.h"
+
+
+void RegisterPlugins(flutter::PluginRegistry* registry) {
+}

app/windows/flutter/generated_plugins.cmake

@@ -3,11 +3,6 @@
 #
 
 list(APPEND FLUTTER_PLUGIN_LIST
-  biometric_signature
-  flutter_secure_storage_windows
-  rive_native
-  share_plus
-  url_launcher_windows
 )
 
 list(APPEND FLUTTER_FFI_PLUGIN_LIST

app/windows/runner/Runner.rc

@@ -90,12 +90,12 @@ BEGIN
         BLOCK "040904e4"
         BEGIN
             VALUE "CompanyName", "com.example" "\0"
-            VALUE "FileDescription", "useragent" "\0"
+            VALUE "FileDescription", "app" "\0"
             VALUE "FileVersion", VERSION_AS_STRING "\0"
-            VALUE "InternalName", "useragent" "\0"
+            VALUE "InternalName", "app" "\0"
             VALUE "LegalCopyright", "Copyright (C) 2026 com.example. All rights reserved." "\0"
-            VALUE "OriginalFilename", "useragent.exe" "\0"
-            VALUE "ProductName", "useragent" "\0"
+            VALUE "OriginalFilename", "app.exe" "\0"
+            VALUE "ProductName", "app" "\0"
             VALUE "ProductVersion", VERSION_AS_STRING "\0"
         END
     END

app/windows/runner/main.cpp

@@ -27,7 +27,7 @@ int APIENTRY wWinMain(_In_ HINSTANCE instance, _In_opt_ HINSTANCE prev,
   FlutterWindow window(project);
   Win32Window::Point origin(10, 10);
   Win32Window::Size size(1280, 720);
-  if (!window.Create(L"useragent", origin, size)) {
+  if (!window.Create(L"app", origin, size)) {
     return EXIT_FAILURE;
   }
   window.SetQuitOnClose(true);

docs/superpowers/plans/2026-03-28-grant-grid-view.md

@@ -1,821 +0,0 @@
-# Grant Grid View Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Add an "EVM Grants" dashboard tab that displays all grants as enriched cards (type, chain, wallet address, client name) with per-card revoke support.
-
-**Architecture:** A new `walletAccessListProvider` fetches wallet accesses with their DB row IDs. The screen (`grants.dart`) watches only `evmGrantsProvider` for top-level state. Each `GrantCard` widget (its own file) watches enrichment providers (`walletAccessListProvider`, `evmProvider`, `sdkClientsProvider`) and the revoke mutation directly — keeping rebuilds scoped to the card. The screen is registered as a dashboard tab in `AdaptiveScaffold`.
-
-**Tech Stack:** Flutter, Riverpod (`riverpod_annotation` + `build_runner` codegen), `sizer` (adaptive sizing), `auto_route`, Protocol Buffers (Dart), `Palette` design tokens.
-
----
-
-## File Map
-
-| File | Action | Responsibility |
-|---|---|---|
-| `useragent/lib/theme/palette.dart` | Modify | Add `Palette.token` (indigo accent for token-transfer cards) |
-| `useragent/lib/features/connection/evm/wallet_access.dart` | Modify | Add `listAllWalletAccesses()` function |
-| `useragent/lib/providers/sdk_clients/wallet_access_list.dart` | Create | `WalletAccessListProvider` — fetches full wallet access list with IDs |
-| `useragent/lib/screens/dashboard/evm/grants/widgets/grant_card.dart` | Create | `GrantCard` widget — watches enrichment providers + revoke mutation; one card per grant |
-| `useragent/lib/screens/dashboard/evm/grants/grants.dart` | Create | `EvmGrantsScreen` — watches `evmGrantsProvider`; handles loading/error/empty/data states; renders `GrantCard` list |
-| `useragent/lib/router.dart` | Modify | Register `EvmGrantsRoute` in dashboard children |
-| `useragent/lib/screens/dashboard.dart` | Modify | Add Grants entry to `routes` list and `NavigationDestination` list |
-
----
-
-## Task 1: Add `Palette.token`
-
-**Files:**
-- Modify: `useragent/lib/theme/palette.dart`
-
-- [ ] **Step 1: Add the color**
-
-Replace the contents of `useragent/lib/theme/palette.dart` with:
-
-```dart
-import 'package:flutter/material.dart';
-
-class Palette {
-  static const ink = Color(0xFF15263C);
-  static const coral = Color(0xFFE26254);
-  static const cream = Color(0xFFFFFAF4);
-  static const line = Color(0x1A15263C);
-  static const token = Color(0xFF5C6BC0);
-}
-```
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd useragent && flutter analyze lib/theme/palette.dart
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(theme): add Palette.token for token-transfer grant cards"
-jj new
-```
-
----
-
-## Task 2: Add `listAllWalletAccesses` feature function
-
-**Files:**
-- Modify: `useragent/lib/features/connection/evm/wallet_access.dart`
-
-`readClientWalletAccess` (existing) filters the list to one client's wallet IDs and returns `Set<int>`. This new function returns the complete unfiltered list with row IDs so the grant cards can resolve wallet_access_id → wallet + client.
-
-- [ ] **Step 1: Append function**
-
-Add at the bottom of `useragent/lib/features/connection/evm/wallet_access.dart`:
-
-```dart
-Future<List<SdkClientWalletAccess>> listAllWalletAccesses(
-  Connection connection,
-) async {
-  final response = await connection.ask(
-    UserAgentRequest(listWalletAccess: Empty()),
-  );
-  if (!response.hasListWalletAccessResponse()) {
-    throw Exception(
-      'Expected list wallet access response, got ${response.whichPayload()}',
-    );
-  }
-  return response.listWalletAccessResponse.accesses.toList(growable: false);
-}
-```
-
-Each returned `SdkClientWalletAccess` has:
-- `.id` — the `evm_wallet_access` row ID (same value as `wallet_access_id` in a `GrantEntry`)
-- `.access.walletId` — the EVM wallet DB ID
-- `.access.sdkClientId` — the SDK client DB ID
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd useragent && flutter analyze lib/features/connection/evm/wallet_access.dart
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(evm): add listAllWalletAccesses feature function"
-jj new
-```
-
----
-
-## Task 3: Create `WalletAccessListProvider`
-
-**Files:**
-- Create: `useragent/lib/providers/sdk_clients/wallet_access_list.dart`
-- Generated: `useragent/lib/providers/sdk_clients/wallet_access_list.g.dart`
-
-Mirrors the structure of `EvmGrants` in `providers/evm/evm_grants.dart` — class-based `@riverpod` with a `refresh()` method.
-
-- [ ] **Step 1: Write the provider**
-
-Create `useragent/lib/providers/sdk_clients/wallet_access_list.dart`:
-
-```dart
-import 'package:arbiter/features/connection/evm/wallet_access.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:arbiter/providers/connection/connection_manager.dart';
-import 'package:mtcore/markettakers.dart';
-import 'package:riverpod_annotation/riverpod_annotation.dart';
-
-part 'wallet_access_list.g.dart';
-
-@riverpod
-class WalletAccessList extends _$WalletAccessList {
-  @override
-  Future<List<SdkClientWalletAccess>?> build() async {
-    final connection = await ref.watch(connectionManagerProvider.future);
-    if (connection == null) {
-      return null;
-    }
-
-    try {
-      return await listAllWalletAccesses(connection);
-    } catch (e, st) {
-      talker.handle(e, st);
-      rethrow;
-    }
-  }
-
-  Future<void> refresh() async {
-    final connection = await ref.read(connectionManagerProvider.future);
-    if (connection == null) {
-      state = const AsyncData(null);
-      return;
-    }
-
-    state = const AsyncLoading();
-    state = await AsyncValue.guard(() => listAllWalletAccesses(connection));
-  }
-}
-```
-
-- [ ] **Step 2: Run code generation**
-
-```sh
-cd useragent && dart run build_runner build --delete-conflicting-outputs
-```
-
-Expected: `useragent/lib/providers/sdk_clients/wallet_access_list.g.dart` created. No errors.
-
-- [ ] **Step 3: Verify**
-
-```sh
-cd useragent && flutter analyze lib/providers/sdk_clients/
-```
-
-Expected: no issues.
-
-- [ ] **Step 4: Commit**
-
-```sh
-jj describe -m "feat(providers): add WalletAccessListProvider"
-jj new
-```
-
----
-
-## Task 4: Create `GrantCard` widget
-
-**Files:**
-- Create: `useragent/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`
-
-This widget owns all per-card logic: enrichment lookups, revoke action, and rebuild scope. The screen only passes it a `GrantEntry` — the card fetches everything else itself.
-
-**Key types:**
-- `GrantEntry` (from `proto/evm.pb.dart`): `.id`, `.shared.walletAccessId`, `.shared.chainId`, `.specific.whichGrant()`
-- `SpecificGrant_Grant.etherTransfer` / `.tokenTransfer` — enum values for the oneof
-- `SdkClientWalletAccess` (from `proto/user_agent.pb.dart`): `.id`, `.access.walletId`, `.access.sdkClientId`
-- `WalletEntry` (from `proto/evm.pb.dart`): `.id`, `.address` (List<int>)
-- `SdkClientEntry` (from `proto/user_agent.pb.dart`): `.id`, `.info.name`
-- `revokeEvmGrantMutation` — `Mutation<void>` (global; all revoke buttons disable together while any revoke is in flight)
-- `executeRevokeEvmGrant(ref, grantId: int)` — `Future<void>`
-
-- [ ] **Step 1: Write the widget**
-
-Create `useragent/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`:
-
-```dart
-import 'package:arbiter/proto/evm.pb.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:arbiter/providers/evm/evm.dart';
-import 'package:arbiter/providers/evm/evm_grants.dart';
-import 'package:arbiter/providers/sdk_clients/list.dart';
-import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
-import 'package:arbiter/theme/palette.dart';
-import 'package:flutter/material.dart';
-import 'package:hooks_riverpod/experimental/mutation.dart';
-import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:sizer/sizer.dart';
-
-String _shortAddress(List<int> bytes) {
-  final hex = bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();
-  return '0x${hex.substring(0, 6)}...${hex.substring(hex.length - 4)}';
-}
-
-String _formatError(Object error) {
-  final message = error.toString();
-  if (message.startsWith('Exception: ')) {
-    return message.substring('Exception: '.length);
-  }
-  return message;
-}
-
-class GrantCard extends ConsumerWidget {
-  const GrantCard({super.key, required this.grant});
-
-  final GrantEntry grant;
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    // Enrichment lookups — each watch scopes rebuilds to this card only
-    final walletAccesses =
-        ref.watch(walletAccessListProvider).asData?.value ?? const [];
-    final wallets = ref.watch(evmProvider).asData?.value ?? const [];
-    final clients = ref.watch(sdkClientsProvider).asData?.value ?? const [];
-    final revoking = ref.watch(revokeEvmGrantMutation) is MutationPending;
-
-    final isEther =
-        grant.specific.whichGrant() == SpecificGrant_Grant.etherTransfer;
-    final accent = isEther ? Palette.coral : Palette.token;
-    final typeLabel = isEther ? 'Ether' : 'Token';
-    final theme = Theme.of(context);
-    final muted = Palette.ink.withValues(alpha: 0.62);
-
-    // Resolve wallet_access_id → wallet address + client name
-    final accessById = <int, SdkClientWalletAccess>{
-      for (final a in walletAccesses) a.id: a,
-    };
-    final walletById = <int, WalletEntry>{
-      for (final w in wallets) w.id: w,
-    };
-    final clientNameById = <int, String>{
-      for (final c in clients) c.id: c.info.name,
-    };
-
-    final accessId = grant.shared.walletAccessId;
-    final access = accessById[accessId];
-    final wallet = access != null ? walletById[access.access.walletId] : null;
-
-    final walletLabel = wallet != null
-        ? _shortAddress(wallet.address)
-        : 'Access #$accessId';
-
-    final clientLabel = () {
-      if (access == null) return '';
-      final name = clientNameById[access.access.sdkClientId] ?? '';
-      return name.isEmpty ? 'Client #${access.access.sdkClientId}' : name;
-    }();
-
-    void showError(String message) {
-      if (!context.mounted) return;
-      ScaffoldMessenger.of(context).showSnackBar(
-        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
-      );
-    }
-
-    Future<void> revoke() async {
-      try {
-        await executeRevokeEvmGrant(ref, grantId: grant.id);
-      } catch (e) {
-        showError(_formatError(e));
-      }
-    }
-
-    return Container(
-      decoration: BoxDecoration(
-        borderRadius: BorderRadius.circular(24),
-        color: Palette.cream.withValues(alpha: 0.92),
-        border: Border.all(color: Palette.line),
-      ),
-      child: IntrinsicHeight(
-        child: Row(
-          crossAxisAlignment: CrossAxisAlignment.stretch,
-          children: [
-            // Accent strip
-            Container(
-              width: 0.8.w,
-              decoration: BoxDecoration(
-                color: accent,
-                borderRadius: const BorderRadius.horizontal(
-                  left: Radius.circular(24),
-                ),
-              ),
-            ),
-            // Card body
-            Expanded(
-              child: Padding(
-                padding: EdgeInsets.symmetric(
-                  horizontal: 1.6.w,
-                  vertical: 1.4.h,
-                ),
-                child: Column(
-                  crossAxisAlignment: CrossAxisAlignment.start,
-                  children: [
-                    // Row 1: type badge · chain · spacer · revoke button
-                    Row(
-                      children: [
-                        Container(
-                          padding: EdgeInsets.symmetric(
-                            horizontal: 1.w,
-                            vertical: 0.4.h,
-                          ),
-                          decoration: BoxDecoration(
-                            color: accent.withValues(alpha: 0.15),
-                            borderRadius: BorderRadius.circular(8),
-                          ),
-                          child: Text(
-                            typeLabel,
-                            style: theme.textTheme.labelSmall?.copyWith(
-                              color: accent,
-                              fontWeight: FontWeight.w800,
-                            ),
-                          ),
-                        ),
-                        SizedBox(width: 1.w),
-                        Container(
-                          padding: EdgeInsets.symmetric(
-                            horizontal: 1.w,
-                            vertical: 0.4.h,
-                          ),
-                          decoration: BoxDecoration(
-                            color: Palette.ink.withValues(alpha: 0.06),
-                            borderRadius: BorderRadius.circular(8),
-                          ),
-                          child: Text(
-                            'Chain ${grant.shared.chainId}',
-                            style: theme.textTheme.labelSmall?.copyWith(
-                              color: muted,
-                              fontWeight: FontWeight.w700,
-                            ),
-                          ),
-                        ),
-                        const Spacer(),
-                        if (revoking)
-                          SizedBox(
-                            width: 1.8.h,
-                            height: 1.8.h,
-                            child: CircularProgressIndicator(
-                              strokeWidth: 2,
-                              color: Palette.coral,
-                            ),
-                          )
-                        else
-                          OutlinedButton.icon(
-                            onPressed: revoke,
-                            style: OutlinedButton.styleFrom(
-                              foregroundColor: Palette.coral,
-                              side: BorderSide(
-                                color: Palette.coral.withValues(alpha: 0.4),
-                              ),
-                              padding: EdgeInsets.symmetric(
-                                horizontal: 1.w,
-                                vertical: 0.6.h,
-                              ),
-                              shape: RoundedRectangleBorder(
-                                borderRadius: BorderRadius.circular(10),
-                              ),
-                            ),
-                            icon: const Icon(Icons.block_rounded, size: 16),
-                            label: const Text('Revoke'),
-                          ),
-                      ],
-                    ),
-                    SizedBox(height: 0.8.h),
-                    // Row 2: wallet address · client name
-                    Row(
-                      children: [
-                        Text(
-                          walletLabel,
-                          style: theme.textTheme.bodySmall?.copyWith(
-                            color: Palette.ink,
-                            fontFamily: 'monospace',
-                          ),
-                        ),
-                        Padding(
-                          padding: EdgeInsets.symmetric(horizontal: 0.8.w),
-                          child: Text(
-                            '·',
-                            style: theme.textTheme.bodySmall
-                                ?.copyWith(color: muted),
-                          ),
-                        ),
-                        Expanded(
-                          child: Text(
-                            clientLabel,
-                            maxLines: 1,
-                            overflow: TextOverflow.ellipsis,
-                            style: theme.textTheme.bodySmall
-                                ?.copyWith(color: muted),
-                          ),
-                        ),
-                      ],
-                    ),
-                  ],
-                ),
-              ),
-            ),
-          ],
-        ),
-      ),
-    );
-  }
-}
-```
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd useragent && flutter analyze lib/screens/dashboard/evm/grants/widgets/grant_card.dart
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(grants): add GrantCard widget with self-contained enrichment"
-jj new
-```
-
----
-
-## Task 5: Create `EvmGrantsScreen`
-
-**Files:**
-- Create: `useragent/lib/screens/dashboard/evm/grants/grants.dart`
-
-The screen watches only `evmGrantsProvider` for top-level state (loading / error / no connection / empty / data). When there is data it renders a list of `GrantCard` widgets — each card manages its own enrichment subscriptions.
-
-- [ ] **Step 1: Write the screen**
-
-Create `useragent/lib/screens/dashboard/evm/grants/grants.dart`:
-
-```dart
-import 'package:arbiter/proto/evm.pb.dart';
-import 'package:arbiter/providers/evm/evm_grants.dart';
-import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
-import 'package:arbiter/router.gr.dart';
-import 'package:arbiter/screens/dashboard/evm/grants/widgets/grant_card.dart';
-import 'package:arbiter/theme/palette.dart';
-import 'package:arbiter/widgets/page_header.dart';
-import 'package:auto_route/auto_route.dart';
-import 'package:flutter/material.dart';
-import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:sizer/sizer.dart';
-
-String _formatError(Object error) {
-  final message = error.toString();
-  if (message.startsWith('Exception: ')) {
-    return message.substring('Exception: '.length);
-  }
-  return message;
-}
-
-// ─── State panel ──────────────────────────────────────────────────────────────
-
-class _StatePanel extends StatelessWidget {
-  const _StatePanel({
-    required this.icon,
-    required this.title,
-    required this.body,
-    this.actionLabel,
-    this.onAction,
-    this.busy = false,
-  });
-
-  final IconData icon;
-  final String title;
-  final String body;
-  final String? actionLabel;
-  final Future<void> Function()? onAction;
-  final bool busy;
-
-  @override
-  Widget build(BuildContext context) {
-    final theme = Theme.of(context);
-
-    return Container(
-      decoration: BoxDecoration(
-        borderRadius: BorderRadius.circular(24),
-        color: Palette.cream.withValues(alpha: 0.92),
-        border: Border.all(color: Palette.line),
-      ),
-      child: Padding(
-        padding: EdgeInsets.all(2.8.h),
-        child: Column(
-          crossAxisAlignment: CrossAxisAlignment.start,
-          children: [
-            if (busy)
-              SizedBox(
-                width: 2.8.h,
-                height: 2.8.h,
-                child: const CircularProgressIndicator(strokeWidth: 2.5),
-              )
-            else
-              Icon(icon, size: 34, color: Palette.coral),
-            SizedBox(height: 1.8.h),
-            Text(
-              title,
-              style: theme.textTheme.headlineSmall?.copyWith(
-                color: Palette.ink,
-                fontWeight: FontWeight.w800,
-              ),
-            ),
-            SizedBox(height: 1.h),
-            Text(
-              body,
-              style: theme.textTheme.bodyLarge?.copyWith(
-                color: Palette.ink.withValues(alpha: 0.72),
-                height: 1.5,
-              ),
-            ),
-            if (actionLabel != null && onAction != null) ...[
-              SizedBox(height: 2.h),
-              OutlinedButton.icon(
-                onPressed: () => onAction!(),
-                icon: const Icon(Icons.refresh),
-                label: Text(actionLabel!),
-              ),
-            ],
-          ],
-        ),
-      ),
-    );
-  }
-}
-
-// ─── Grant list ───────────────────────────────────────────────────────────────
-
-class _GrantList extends StatelessWidget {
-  const _GrantList({required this.grants});
-
-  final List<GrantEntry> grants;
-
-  @override
-  Widget build(BuildContext context) {
-    return Column(
-      children: [
-        for (var i = 0; i < grants.length; i++)
-          Padding(
-            padding: EdgeInsets.only(
-              bottom: i == grants.length - 1 ? 0 : 1.8.h,
-            ),
-            child: GrantCard(grant: grants[i]),
-          ),
-      ],
-    );
-  }
-}
-
-// ─── Screen ───────────────────────────────────────────────────────────────────
-
-@RoutePage()
-class EvmGrantsScreen extends ConsumerWidget {
-  const EvmGrantsScreen({super.key});
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    // Screen watches only the grant list for top-level state decisions
-    final grantsAsync = ref.watch(evmGrantsProvider);
-
-    Future<void> refresh() async {
-      await Future.wait([
-        ref.read(evmGrantsProvider.notifier).refresh(),
-        ref.read(walletAccessListProvider.notifier).refresh(),
-      ]);
-    }
-
-    void showMessage(String message) {
-      if (!context.mounted) return;
-      ScaffoldMessenger.of(context).showSnackBar(
-        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
-      );
-    }
-
-    Future<void> safeRefresh() async {
-      try {
-        await refresh();
-      } catch (e) {
-        showMessage(_formatError(e));
-      }
-    }
-
-    final grantsState = grantsAsync.asData?.value;
-    final grants = grantsState?.grants;
-
-    final content = switch (grantsAsync) {
-      AsyncLoading() when grantsState == null => const _StatePanel(
-        icon: Icons.hourglass_top,
-        title: 'Loading grants',
-        body: 'Pulling grant registry from Arbiter.',
-        busy: true,
-      ),
-      AsyncError(:final error) => _StatePanel(
-        icon: Icons.sync_problem,
-        title: 'Grant registry unavailable',
-        body: _formatError(error),
-        actionLabel: 'Retry',
-        onAction: safeRefresh,
-      ),
-      AsyncData(:final value) when value == null => _StatePanel(
-        icon: Icons.portable_wifi_off,
-        title: 'No active server connection',
-        body: 'Reconnect to Arbiter to list EVM grants.',
-        actionLabel: 'Refresh',
-        onAction: safeRefresh,
-      ),
-      _ when grants != null && grants.isEmpty => _StatePanel(
-        icon: Icons.policy_outlined,
-        title: 'No grants yet',
-        body: 'Create a grant to allow SDK clients to sign transactions.',
-        actionLabel: 'Create grant',
-        onAction: () => context.router.push(const CreateEvmGrantRoute()),
-      ),
-      _ => _GrantList(grants: grants ?? const []),
-    };
-
-    return Scaffold(
-      body: SafeArea(
-        child: RefreshIndicator.adaptive(
-          color: Palette.ink,
-          backgroundColor: Colors.white,
-          onRefresh: safeRefresh,
-          child: ListView(
-            physics: const BouncingScrollPhysics(
-              parent: AlwaysScrollableScrollPhysics(),
-            ),
-            padding: EdgeInsets.fromLTRB(2.4.w, 2.4.h, 2.4.w, 3.2.h),
-            children: [
-              PageHeader(
-                title: 'EVM Grants',
-                isBusy: grantsAsync.isLoading,
-                actions: [
-                  FilledButton.icon(
-                    onPressed: () =>
-                        context.router.push(const CreateEvmGrantRoute()),
-                    icon: const Icon(Icons.add_rounded),
-                    label: const Text('Create grant'),
-                  ),
-                  SizedBox(width: 1.w),
-                  OutlinedButton.icon(
-                    onPressed: safeRefresh,
-                    style: OutlinedButton.styleFrom(
-                      foregroundColor: Palette.ink,
-                      side: BorderSide(color: Palette.line),
-                      padding: EdgeInsets.symmetric(
-                        horizontal: 1.4.w,
-                        vertical: 1.2.h,
-                      ),
-                      shape: RoundedRectangleBorder(
-                        borderRadius: BorderRadius.circular(14),
-                      ),
-                    ),
-                    icon: const Icon(Icons.refresh, size: 18),
-                    label: const Text('Refresh'),
-                  ),
-                ],
-              ),
-              SizedBox(height: 1.8.h),
-              content,
-            ],
-          ),
-        ),
-      ),
-    );
-  }
-}
-```
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd useragent && flutter analyze lib/screens/dashboard/evm/grants/
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(grants): add EvmGrantsScreen"
-jj new
-```
-
----
-
-## Task 6: Wire router and dashboard tab
-
-**Files:**
-- Modify: `useragent/lib/router.dart`
-- Modify: `useragent/lib/screens/dashboard.dart`
-- Regenerated: `useragent/lib/router.gr.dart`
-
-- [ ] **Step 1: Add route to `router.dart`**
-
-Replace the contents of `useragent/lib/router.dart` with:
-
-```dart
-import 'package:auto_route/auto_route.dart';
-
-import 'router.gr.dart';
-
-@AutoRouterConfig(generateForDir: ['lib/screens'])
-class Router extends RootStackRouter {
-  @override
-  List<AutoRoute> get routes => [
-    AutoRoute(page: Bootstrap.page, path: '/bootstrap', initial: true),
-    AutoRoute(page: ServerInfoSetupRoute.page, path: '/server-info'),
-    AutoRoute(page: ServerConnectionRoute.page, path: '/server-connection'),
-    AutoRoute(page: VaultSetupRoute.page, path: '/vault'),
-    AutoRoute(page: ClientDetailsRoute.page, path: '/clients/:clientId'),
-    AutoRoute(page: CreateEvmGrantRoute.page, path: '/evm-grants/create'),
-
-    AutoRoute(
-      page: DashboardRouter.page,
-      path: '/dashboard',
-      children: [
-        AutoRoute(page: EvmRoute.page, path: 'evm'),
-        AutoRoute(page: ClientsRoute.page, path: 'clients'),
-        AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
-        AutoRoute(page: AboutRoute.page, path: 'about'),
-      ],
-    ),
-  ];
-}
-```
-
-- [ ] **Step 2: Update `dashboard.dart`**
-
-In `useragent/lib/screens/dashboard.dart`, replace the `routes` constant:
-
-```dart
-final routes = [
-  const EvmRoute(),
-  const ClientsRoute(),
-  const EvmGrantsRoute(),
-  const AboutRoute(),
-];
-```
-
-And replace the `destinations` list inside `AdaptiveScaffold`:
-
-```dart
-destinations: const [
-  NavigationDestination(
-    icon: Icon(Icons.account_balance_wallet_outlined),
-    selectedIcon: Icon(Icons.account_balance_wallet),
-    label: 'Wallets',
-  ),
-  NavigationDestination(
-    icon: Icon(Icons.devices_other_outlined),
-    selectedIcon: Icon(Icons.devices_other),
-    label: 'Clients',
-  ),
-  NavigationDestination(
-    icon: Icon(Icons.policy_outlined),
-    selectedIcon: Icon(Icons.policy),
-    label: 'Grants',
-  ),
-  NavigationDestination(
-    icon: Icon(Icons.info_outline),
-    selectedIcon: Icon(Icons.info),
-    label: 'About',
-  ),
-],
-```
-
-- [ ] **Step 3: Regenerate router**
-
-```sh
-cd useragent && dart run build_runner build --delete-conflicting-outputs
-```
-
-Expected: `lib/router.gr.dart` updated, `EvmGrantsRoute` now available, no errors.
-
-- [ ] **Step 4: Full project verify**
-
-```sh
-cd useragent && flutter analyze
-```
-
-Expected: no issues.
-
-- [ ] **Step 5: Commit**
-
-```sh
-jj describe -m "feat(nav): add Grants dashboard tab"
-jj new
-```

docs/superpowers/specs/2026-03-28-grant-grid-view-design.md

@@ -1,170 +0,0 @@
-# Grant Grid View — Design Spec
-
-**Date:** 2026-03-28
-
-## Overview
-
-Add a "Grants" dashboard tab to the Flutter user-agent app that displays all EVM grants as a card-based grid. Each card shows a compact summary (type, chain, wallet address, client name) with a revoke action. The tab integrates into the existing `AdaptiveScaffold` navigation alongside Wallets, Clients, and About.
-
-## Scope
-
-- New `walletAccessListProvider` for fetching wallet access entries with their DB row IDs
-- New `EvmGrantsScreen` as a dashboard tab
-- Grant card widget with enriched display (type, chain, wallet, client)
-- Revoke action wired to existing `executeRevokeEvmGrant` mutation
-- Dashboard tab bar and router updated
-- New token-transfer accent color added to `Palette`
-
-**Out of scope:** Fixing grant creation (separate task).
-
----
-
-## Data Layer
-
-### `walletAccessListProvider`
-
-**File:** `useragent/lib/providers/sdk_clients/wallet_access_list.dart`
-
-- `@riverpod` class, watches `connectionManagerProvider.future`
-- Returns `List<SdkClientWalletAccess>?` (null when not connected)
-- Each entry: `.id` (wallet_access_id), `.access.walletId`, `.access.sdkClientId`
-- Exposes a `refresh()` method following the same pattern as `EvmGrants.refresh()`
-
-### Enrichment at render time (Approach A)
-
-The `EvmGrantsScreen` watches four providers:
-1. `evmGrantsProvider` — the grant list
-2. `walletAccessListProvider` — to resolve wallet_access_id → (wallet_id, sdk_client_id)
-3. `evmProvider` — to resolve wallet_id → wallet address
-4. `sdkClientsProvider` — to resolve sdk_client_id → client name
-
-All lookups are in-memory Maps built inside the build method; no extra model class needed.
-
-Fallbacks:
-- Wallet address not found → `"Access #N"` where N is the wallet_access_id
-- Client name not found → `"Client #N"` where N is the sdk_client_id
-
----
-
-## Route Structure
-
-```
-/dashboard
-  /evm          ← existing (Wallets tab)
-  /clients      ← existing (Clients tab)
-  /grants       ← NEW (Grants tab)
-  /about        ← existing
-
-/evm-grants/create  ← existing push route (unchanged)
-```
-
-### Changes to `router.dart`
-
-Add inside dashboard children:
-```dart
-AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
-```
-
-### Changes to `dashboard.dart`
-
-Add to `routes` list:
-```dart
-const EvmGrantsRoute()
-```
-
-Add `NavigationDestination`:
-```dart
-NavigationDestination(
-  icon: Icon(Icons.policy_outlined),
-  selectedIcon: Icon(Icons.policy),
-  label: 'Grants',
-),
-```
-
----
-
-## Screen: `EvmGrantsScreen`
-
-**File:** `useragent/lib/screens/dashboard/evm/grants/grants.dart`
-
-```
-Scaffold
-└─ SafeArea
-   └─ RefreshIndicator.adaptive (refreshes evmGrantsProvider + walletAccessListProvider)
-      └─ ListView (BouncingScrollPhysics + AlwaysScrollableScrollPhysics)
-         ├─ PageHeader
-         │    title: 'EVM Grants'
-         │    isBusy: evmGrantsProvider.isLoading
-         │    actions: [CreateGrantButton, RefreshButton]
-         ├─ SizedBox(height: 1.8.h)
-         └─ <content>
-```
-
-### State handling
-
-Matches the pattern from `EvmScreen` and `ClientsScreen`:
-
-| State | Display |
-|---|---|
-| Loading (no data yet) | `_StatePanel` with spinner, "Loading grants" |
-| Error | `_StatePanel` with coral icon, error message, Retry button |
-| No connection | `_StatePanel`, "No active server connection" |
-| Empty list | `_StatePanel`, "No grants yet", with Create Grant shortcut |
-| Data | Column of `_GrantCard` widgets |
-
-### Header actions
-
-**CreateGrantButton:** `FilledButton.icon` with `Icons.add_rounded`, pushes `CreateEvmGrantRoute()` via `context.router.push(...)`.
-
-**RefreshButton:** `OutlinedButton.icon` with `Icons.refresh`, calls `ref.read(evmGrantsProvider.notifier).refresh()`.
-
----
-
-## Grant Card: `_GrantCard`
-
-**Layout:**
-
-```
-Container (rounded 24, Palette.cream bg, Palette.line border)
-└─ IntrinsicHeight > Row
-   ├─ Accent strip (0.8.w wide, full height, rounded left)
-   └─ Padding > Column
-        ├─ Row 1: TypeBadge + ChainChip + Spacer + RevokeButton
-        └─ Row 2: WalletText + "·" + ClientText
-```
-
-**Accent color by grant type:**
-- Ether transfer → `Palette.coral`
-- Token transfer → `Palette.token` (new entry in `Palette` — indigo, e.g. `Color(0xFF5C6BC0)`)
-
-**TypeBadge:** Small pill container with accent color background at 15% opacity, accent-colored text. Label: `'Ether'` or `'Token'`.
-
-**ChainChip:** Small container: `'Chain ${grant.shared.chainId}'`, muted ink color.
-
-**WalletText:** Short hex address (`0xabc...def`) from wallet lookup, `bodySmall`, monospace font family.
-
-**ClientText:** Client name from `sdkClientsProvider` lookup, or fallback string. `bodySmall`, muted ink.
-
-**RevokeButton:**
-- `OutlinedButton` with `Icons.block_rounded` icon, label `'Revoke'`
-- `foregroundColor: Palette.coral`, `side: BorderSide(color: Palette.coral.withValues(alpha: 0.4))`
-- Disabled (replaced with `CircularProgressIndicator`) while `revokeEvmGrantMutation` is pending — note: this is a single global mutation, so all revoke buttons disable while any revoke is in flight
-- On press: calls `executeRevokeEvmGrant(ref, grantId: grant.id)`; shows `SnackBar` on error
-
----
-
-## Adaptive Sizing
-
-All sizing uses `sizer` units (`1.h`, `1.w`, etc.). No hardcoded pixel values.
-
----
-
-## Files to Create / Modify
-
-| File | Action |
-|---|---|
-| `lib/theme/palette.dart` | Modify — add `Palette.token` color |
-| `lib/providers/sdk_clients/wallet_access_list.dart` | Create |
-| `lib/screens/dashboard/evm/grants/grants.dart` | Create |
-| `lib/router.dart` | Modify — add grants route to dashboard children |
-| `lib/screens/dashboard.dart` | Modify — add tab to routes list and NavigationDestinations |

mise.lock

@@ -1,69 +1,35 @@
-# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
-
-[[tools.ast-grep]]
-version = "0.42.0"
-backend = "aqua:ast-grep/ast-grep"
-
-[tools.ast-grep."platforms.linux-arm64"]
-checksum = "sha256:5c830eae8456569e2f7212434ed9c238f58dca412d76045418ed6d394a755836"
-url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-unknown-linux-gnu.zip"
-
-[tools.ast-grep."platforms.linux-arm64-musl"]
-checksum = "sha256:5c830eae8456569e2f7212434ed9c238f58dca412d76045418ed6d394a755836"
-url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-unknown-linux-gnu.zip"
-
-[tools.ast-grep."platforms.linux-x64"]
-checksum = "sha256:e825a05603f0bcc4cd9076c4cc8c9abd6d008b7cd07d9aa3cc323ba4b8606651"
-url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-unknown-linux-gnu.zip"
-
-[tools.ast-grep."platforms.linux-x64-musl"]
-checksum = "sha256:e825a05603f0bcc4cd9076c4cc8c9abd6d008b7cd07d9aa3cc323ba4b8606651"
-url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-unknown-linux-gnu.zip"
-
-[tools.ast-grep."platforms.macos-arm64"]
-checksum = "sha256:fc300d5293b1c770a5aece03a8a193b92e71e87cec726c28096990691a582620"
-url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-apple-darwin.zip"
-
-[tools.ast-grep."platforms.macos-x64"]
-checksum = "sha256:979ffe611327056f4730a1ae71b0209b3b830f58b22c6ed194cda34f55400db2"
-url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-apple-darwin.zip"
-
-[tools.ast-grep."platforms.windows-x64"]
-checksum = "sha256:55836fa1b2c65dc7d61615a4d9368622a0d2371a76d28b9a165e5a3ab6ae32a4"
-url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-pc-windows-msvc.zip"
-
 [[tools."cargo:cargo-audit"]]
 version = "0.22.1"
 backend = "cargo:cargo-audit"
 
-[[tools."cargo:cargo-edit"]]
-version = "0.13.9"
-backend = "cargo:cargo-edit"
+[[tools."cargo:cargo-features"]]
+version = "1.0.0"
+backend = "cargo:cargo-features"
 
 [[tools."cargo:cargo-features-manager"]]
 version = "0.11.1"
 backend = "cargo:cargo-features-manager"
 
-[[tools."cargo:cargo-insta"]]
-version = "1.46.3"
-backend = "cargo:cargo-insta"
-
-[[tools."cargo:cargo-mutants"]]
-version = "27.0.0"
-backend = "cargo:cargo-mutants"
-
 [[tools."cargo:cargo-nextest"]]
 version = "0.9.126"
 backend = "cargo:cargo-nextest"
 
 [[tools."cargo:cargo-shear"]]
-version = "1.11.2"
+version = "1.9.1"
 backend = "cargo:cargo-shear"
 
 [[tools."cargo:cargo-vet"]]
 version = "0.10.2"
 backend = "cargo:cargo-vet"
 
+[[tools."cargo:diesel-cli"]]
+version = "2.3.6"
+backend = "cargo:diesel-cli"
+
+[tools."cargo:diesel-cli".options]
+default-features = "false"
+features = "sqlite,sqlite-bundled"
+
 [[tools."cargo:diesel_cli"]]
 version = "2.3.6"
 backend = "cargo:diesel_cli"
@@ -79,73 +45,11 @@ backend = "asdf:flutter"
 [[tools.protoc]]
 version = "29.6"
 backend = "aqua:protocolbuffers/protobuf/protoc"
-
-[tools.protoc."platforms.linux-arm64"]
-checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79"
-url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"
-
-[tools.protoc."platforms.linux-arm64-musl"]
-checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79"
-url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"
-
-[tools.protoc."platforms.linux-x64"]
-checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323"
-url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"
-
-[tools.protoc."platforms.linux-x64-musl"]
-checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323"
-url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"
-
-[tools.protoc."platforms.macos-arm64"]
-checksum = "sha256:b9576b5fa1a1ef3fe13a8c91d9d8204b46545759bea5ae155cd6ba2ea4cdaeed"
-url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-aarch_64.zip"
-
-[tools.protoc."platforms.macos-x64"]
-checksum = "sha256:312f04713946921cc0187ef34df80241ddca1bab6f564c636885fd2cc90d3f88"
-url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-x86_64.zip"
-
-[tools.protoc."platforms.windows-x64"]
-checksum = "sha256:1ebd7c87baffb9f1c47169b640872bf5fb1e4408079c691af527be9561d8f6f7"
-url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-win64.zip"
-
-[[tools.python]]
-version = "3.14.3"
-backend = "core:python"
-
-[tools.python."platforms.linux-arm64"]
-checksum = "sha256:53700338695e402a1a1fe22be4a41fbdacc70e22bb308a48eca8ed67cb7992be"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
-provenance = "github-attestations"
-
-[tools.python."platforms.linux-arm64-musl"]
-checksum = "sha256:53700338695e402a1a1fe22be4a41fbdacc70e22bb308a48eca8ed67cb7992be"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
-provenance = "github-attestations"
-
-[tools.python."platforms.linux-x64"]
-checksum = "sha256:d7a9f970914bb4c88756fe3bdcc186d4feb90e9500e54f1db47dae4dc9687e39"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
-provenance = "github-attestations"
-
-[tools.python."platforms.linux-x64-musl"]
-checksum = "sha256:d7a9f970914bb4c88756fe3bdcc186d4feb90e9500e54f1db47dae4dc9687e39"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
-provenance = "github-attestations"
-
-[tools.python."platforms.macos-arm64"]
-checksum = "sha256:c43aecde4a663aebff99b9b83da0efec506479f1c3f98331442f33d2c43501f9"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-aarch64-apple-darwin-install_only_stripped.tar.gz"
-provenance = "github-attestations"
-
-[tools.python."platforms.macos-x64"]
-checksum = "sha256:9ab41dbc2f100a2a45d1833b9c11165f51051c558b5213eda9a9731d5948a0c0"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-apple-darwin-install_only_stripped.tar.gz"
-provenance = "github-attestations"
-
-[tools.python."platforms.windows-x64"]
-checksum = "sha256:bbe19034b35b0267176a7442575ae7dc6343480fd4d35598cb7700173d431e09"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-pc-windows-msvc-install_only_stripped.tar.gz"
-provenance = "github-attestations"
+"platforms.linux-arm64" = { checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79", url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"}
+"platforms.linux-x64" = { checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323", url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"}
+"platforms.macos-arm64" = { checksum = "sha256:b9576b5fa1a1ef3fe13a8c91d9d8204b46545759bea5ae155cd6ba2ea4cdaeed", url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-aarch_64.zip"}
+"platforms.macos-x64" = { checksum = "sha256:312f04713946921cc0187ef34df80241ddca1bab6f564c636885fd2cc90d3f88", url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-x86_64.zip"}
+"platforms.windows-x64" = { checksum = "sha256:1ebd7c87baffb9f1c47169b640872bf5fb1e4408079c691af527be9561d8f6f7", url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-win64.zip"}
 
 [[tools.rust]]
 version = "1.93.0"

mise.toml

@@ -2,22 +2,10 @@
 "cargo:diesel_cli" = { version = "2.3.6", features = "sqlite,sqlite-bundled", default-features = false }
 "cargo:cargo-audit" = "0.22.1"
 "cargo:cargo-vet" = "0.10.2"
+
 flutter = "3.38.9-stable"
 protoc = "29.6"
-"rust" = {version = "1.93.0", components = "clippy"}
+rust = "1.93.1"
 "cargo:cargo-features-manager" = "0.11.1"
 "cargo:cargo-nextest" = "0.9.126"
 "cargo:cargo-shear" = "latest"
-"cargo:cargo-insta" = "1.46.3"
-python = "3.14.3"
-ast-grep = "0.42.0"
-"cargo:cargo-edit" = "0.13.9"
-"cargo:cargo-mutants" = "27.0.0"
-
-[tasks.codegen]
-sources = ['protobufs/*.proto', 'protobufs/**/*.proto']
-outputs = ['useragent/lib/proto/**']
-run = '''
-dart pub global activate protoc_plugin && \
-protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
-'''

protobufs/arbiter.proto

@@ -2,15 +2,113 @@ syntax = "proto3";
 
 package arbiter;
 
-import "client.proto";
-import "user_agent.proto";
+import "auth.proto";
+
+message ClientRequest {
+  oneof payload {
+    arbiter.auth.ClientMessage auth_message = 1;
+    CertRotationAck cert_rotation_ack = 2;
+  }
+}
+
+message ClientResponse {
+  oneof payload {
+    arbiter.auth.ServerMessage auth_message = 1;
+    CertRotationNotification cert_rotation_notification = 2;
+  }
+}
+
+message UserAgentRequest {
+  oneof payload {
+    arbiter.auth.ClientMessage auth_message = 1;
+    CertRotationAck cert_rotation_ack = 2;
+    UnsealRequest unseal_request = 3;
+  }
+}
+message UserAgentResponse {
+  oneof payload {
+    arbiter.auth.ServerMessage auth_message = 1;
+    CertRotationNotification cert_rotation_notification = 2;
+    UnsealResponse unseal_response = 3;
+  }
+}
 
 message ServerInfo {
   string version = 1;
   bytes cert_public_key = 2;
 }
 
-service ArbiterService {
-  rpc Client(stream arbiter.client.ClientRequest) returns (stream arbiter.client.ClientResponse);
-  rpc UserAgent(stream arbiter.user_agent.UserAgentRequest) returns (stream arbiter.user_agent.UserAgentResponse);
+// TLS Certificate Rotation Protocol
+message CertRotationNotification {
+  // New public certificate (DER-encoded)
+  bytes new_cert = 1;
+
+  // Unix timestamp when rotation will be executed (if all ACKs received)
+  int64 rotation_scheduled_at = 2;
+
+  // Unix timestamp deadline for ACK (7 days from now)
+  int64 ack_deadline = 3;
+
+  // Rotation ID for tracking
+  int32 rotation_id = 4;
+}
+
+message CertRotationAck {
+  // Rotation ID (from CertRotationNotification)
+  int32 rotation_id = 1;
+
+  // Client public key for identification
+  bytes client_public_key = 2;
+
+  // Confirmation that client saved the new certificate
+  bool cert_saved = 3;
+}
+
+// Vault Unseal Protocol (X25519 ECDH + ChaCha20Poly1305)
+message UnsealRequest {
+  oneof payload {
+    EphemeralKeyRequest ephemeral_key_request = 1;
+    SealedPassword sealed_password = 2;
+  }
+}
+
+message UnsealResponse {
+  oneof payload {
+    EphemeralKeyResponse ephemeral_key_response = 1;
+    UnsealResult unseal_result = 2;
+  }
+}
+
+message EphemeralKeyRequest {}
+
+message EphemeralKeyResponse {
+  // Server's X25519 ephemeral public key (32 bytes)
+  bytes server_pubkey = 1;
+
+  // Unix timestamp when this key expires (60 seconds from generation)
+  int64 expires_at = 2;
+}
+
+message SealedPassword {
+  // Client's X25519 ephemeral public key (32 bytes)
+  bytes client_pubkey = 1;
+
+  // ChaCha20Poly1305 encrypted password (ciphertext + tag)
+  bytes encrypted_password = 2;
+
+  // 12-byte nonce for ChaCha20Poly1305
+  bytes nonce = 3;
+}
+
+message UnsealResult {
+  // Whether unseal was successful
+  bool success = 1;
+
+  // Error message if unseal failed
+  optional string error_message = 2;
+}
+
+service ArbiterService {
+  rpc Client(stream ClientRequest) returns (stream ClientResponse);
+  rpc UserAgent(stream UserAgentRequest) returns (stream UserAgentResponse);
 }

protobufs/auth.proto

@@ -0,0 +1,35 @@
+syntax = "proto3";
+
+package arbiter.auth;
+
+import "google/protobuf/timestamp.proto";
+
+message AuthChallengeRequest {
+  bytes pubkey = 1;
+  optional string bootstrap_token = 2;
+}
+
+message AuthChallenge {
+  bytes pubkey = 1;
+  int32 nonce = 2;
+}
+
+message AuthChallengeSolution {
+  bytes signature = 1;
+}
+
+message AuthOk {}
+
+message ClientMessage {
+  oneof payload {
+    AuthChallengeRequest auth_challenge_request = 1;
+    AuthChallengeSolution auth_challenge_solution = 2;
+  }
+}
+
+message ServerMessage {
+  oneof payload {
+    AuthChallenge auth_challenge = 1;
+    AuthOk auth_ok = 2;
+  }
+}

protobufs/client.proto

@@ -1,25 +0,0 @@
-syntax = "proto3";
-
-package arbiter.client;
-
-import "client/auth.proto";
-import "client/evm.proto";
-import "client/vault.proto";
-
-message ClientRequest {
-  int32 request_id = 4;
-  oneof payload {
-    auth.Request auth = 1;
-    vault.Request vault = 2;
-    evm.Request evm = 3;
-  }
-}
-
-message ClientResponse {
-  optional int32 request_id = 7;
-  oneof payload {
-    auth.Response auth = 1;
-    vault.Response vault = 2;
-    evm.Response evm = 3;
-  }
-}

protobufs/client/auth.proto

@@ -1,43 +0,0 @@
-syntax = "proto3";
-
-package arbiter.client.auth;
-
-import "shared/client.proto";
-
-message AuthChallengeRequest {
-  bytes pubkey = 1;
-  arbiter.shared.ClientInfo client_info = 2;
-}
-
-message AuthChallenge {
-  bytes pubkey = 1;
-  int32 nonce = 2;
-}
-
-message AuthChallengeSolution {
-  bytes signature = 1;
-}
-
-enum AuthResult {
-  AUTH_RESULT_UNSPECIFIED = 0;
-  AUTH_RESULT_SUCCESS = 1;
-  AUTH_RESULT_INVALID_KEY = 2;
-  AUTH_RESULT_INVALID_SIGNATURE = 3;
-  AUTH_RESULT_APPROVAL_DENIED = 4;
-  AUTH_RESULT_NO_USER_AGENTS_ONLINE = 5;
-  AUTH_RESULT_INTERNAL = 6;
-}
-
-message Request {
-  oneof payload {
-    AuthChallengeRequest challenge_request = 1;
-    AuthChallengeSolution challenge_solution = 2;
-  }
-}
-
-message Response {
-  oneof payload {
-    AuthChallenge challenge = 1;
-    AuthResult result = 2;
-  }
-}

protobufs/client/evm.proto

@@ -1,19 +0,0 @@
-syntax = "proto3";
-
-package arbiter.client.evm;
-
-import "evm.proto";
-
-message Request {
-  oneof payload {
-    arbiter.evm.EvmSignTransactionRequest sign_transaction = 1;
-    arbiter.evm.EvmAnalyzeTransactionRequest analyze_transaction = 2;
-  }
-}
-
-message Response {
-  oneof payload {
-    arbiter.evm.EvmSignTransactionResponse sign_transaction = 1;
-    arbiter.evm.EvmAnalyzeTransactionResponse analyze_transaction = 2;
-  }
-}

protobufs/client/vault.proto

@@ -1,18 +0,0 @@
-syntax = "proto3";
-
-package arbiter.client.vault;
-
-import "google/protobuf/empty.proto";
-import "shared/vault.proto";
-
-message Request {
-  oneof payload {
-    google.protobuf.Empty query_state = 1;
-  }
-}
-
-message Response {
-  oneof payload {
-    arbiter.shared.VaultState state = 1;
-  }
-}

protobufs/evm.proto

@@ -1,153 +0,0 @@
-syntax = "proto3";
-
-package arbiter.evm;
-
-import "google/protobuf/empty.proto";
-import "google/protobuf/timestamp.proto";
-import "shared/evm.proto";
-
-enum EvmError {
-  EVM_ERROR_UNSPECIFIED = 0;
-  EVM_ERROR_VAULT_SEALED = 1;
-  EVM_ERROR_INTERNAL = 2;
-}
-
-message WalletEntry {
-  int32 id = 1;
-  bytes address = 2; // 20-byte Ethereum address
-}
-
-message WalletList {
-  repeated WalletEntry wallets = 1;
-}
-
-message WalletCreateResponse {
-  oneof result {
-    WalletEntry wallet = 1;
-    EvmError error = 2;
-  }
-}
-
-message WalletListResponse {
-  oneof result {
-    WalletList wallets = 1;
-    EvmError error = 2;
-  }
-}
-
-// --- Grant types ---
-
-message TransactionRateLimit {
-  uint32 count = 1;
-  int64 window_secs = 2;
-}
-
-message VolumeRateLimit {
-  bytes max_volume = 1; // U256 as big-endian bytes
-  int64 window_secs = 2;
-}
-
-message SharedSettings {
-  int32 wallet_access_id = 1;
-  uint64 chain_id = 2;
-  optional google.protobuf.Timestamp valid_from = 3;
-  optional google.protobuf.Timestamp valid_until = 4;
-  optional bytes max_gas_fee_per_gas = 5; // U256 as big-endian bytes
-  optional bytes max_priority_fee_per_gas = 6; // U256 as big-endian bytes
-  optional TransactionRateLimit rate_limit = 7;
-}
-
-message EtherTransferSettings {
-  repeated bytes targets = 1; // list of 20-byte Ethereum addresses
-  VolumeRateLimit limit = 2;
-}
-
-message TokenTransferSettings {
-  bytes token_contract = 1; // 20-byte Ethereum address
-  optional bytes target = 2; // 20-byte Ethereum address; absent means any recipient allowed
-  repeated VolumeRateLimit volume_limits = 3;
-}
-
-message SpecificGrant {
-  oneof grant {
-    EtherTransferSettings ether_transfer = 1;
-    TokenTransferSettings token_transfer = 2;
-  }
-}
-
-// --- UserAgent grant management ---
-message EvmGrantCreateRequest {
-  SharedSettings shared = 1;
-  SpecificGrant specific = 2;
-}
-
-message EvmGrantCreateResponse {
-  oneof result {
-    int32 grant_id = 1;
-    EvmError error = 2;
-  }
-}
-
-message EvmGrantDeleteRequest {
-  int32 grant_id = 1;
-}
-
-message EvmGrantDeleteResponse {
-  oneof result {
-    google.protobuf.Empty ok = 1;
-    EvmError error = 2;
-  }
-}
-
-// Basic grant info returned in grant listings
-message GrantEntry {
-  int32 id = 1;
-  int32 wallet_access_id = 2;
-  SharedSettings shared = 3;
-  SpecificGrant specific = 4;
-}
-
-message EvmGrantListRequest {
-  optional int32 wallet_access_id = 1;
-}
-
-message EvmGrantListResponse {
-  oneof result {
-    EvmGrantList grants = 1;
-    EvmError error = 2;
-  }
-}
-
-message EvmGrantList {
-  repeated GrantEntry grants = 1;
-}
-
-// --- Client transaction operations ---
-
-message EvmSignTransactionRequest {
-  bytes wallet_address = 1; // 20-byte Ethereum address
-  bytes rlp_transaction = 2; // RLP-encoded EIP-1559 transaction (unsigned)
-}
-
-// oneof because signing and evaluation happen atomically — a signing failure
-// is always either an eval error or an internal error, never a partial success
-message EvmSignTransactionResponse {
-  oneof result {
-    bytes signature = 1; // 65-byte signature: r[32] || s[32] || v[1]
-    arbiter.shared.evm.TransactionEvalError eval_error = 2;
-    EvmError error = 3;
-  }
-}
-
-message EvmAnalyzeTransactionRequest {
-  bytes wallet_address = 1; // 20-byte Ethereum address
-  bytes rlp_transaction = 2; // RLP-encoded EIP-1559 transaction
-}
-
-message EvmAnalyzeTransactionResponse {
-  oneof result {
-    arbiter.shared.evm.SpecificMeaning meaning = 1;
-    arbiter.shared.evm.TransactionEvalError eval_error = 2;
-    EvmError error = 3;
-  }
-}

protobufs/google/protobuf/timestamp.proto

@@ -0,0 +1,46 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+
+syntax = "proto3";
+
+package google.protobuf;
+
+option csharp_namespace = "Google.Protobuf.WellKnownTypes";
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/protobuf/types/known/timestamppb";
+option java_package = "com.google.protobuf";
+option java_outer_classname = "TimestampProto";
+option java_multiple_files = true;
+option objc_class_prefix = "GPB";
+
+// A Timestamp represents a point in time independent of any time zone or local
+// calendar, encoded as a count of seconds and fractions of seconds at
+// nanosecond resolution. The count is relative to an epoch at UTC midnight on
+// January 1, 1970, in the proleptic Gregorian calendar which extends the
+// Gregorian calendar backwards to year one.
+message Timestamp {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive.
+  int32 nanos = 2;
+}

protobufs/shared/client.proto

@@ -1,9 +0,0 @@
-syntax = "proto3";
-
-package arbiter.shared;
-
-message ClientInfo {
-  string name = 1;
-  optional string description = 2;
-  optional string version = 3;
-}

protobufs/shared/evm.proto

@@ -1,74 +0,0 @@
-syntax = "proto3";
-
-package arbiter.shared.evm;
-
-import "google/protobuf/empty.proto";
-
-message EtherTransferMeaning {
-  bytes to = 1; // 20-byte Ethereum address
-  bytes value = 2; // U256 as big-endian bytes
-}
-
-message TokenInfo {
-  string symbol = 1;
-  bytes address = 2; // 20-byte Ethereum address
-  uint64 chain_id = 3;
-}
-
-// Mirror of token_transfers::Meaning
-message TokenTransferMeaning {
-  TokenInfo token = 1;
-  bytes to = 2; // 20-byte Ethereum address
-  bytes value = 3; // U256 as big-endian bytes
-}
-
-// Mirror of policies::SpecificMeaning
-message SpecificMeaning {
-  oneof meaning {
-    EtherTransferMeaning ether_transfer = 1;
-    TokenTransferMeaning token_transfer = 2;
-  }
-}
-
-message GasLimitExceededViolation {
-  optional bytes max_gas_fee_per_gas = 1; // U256 as big-endian bytes
-  optional bytes max_priority_fee_per_gas = 2; // U256 as big-endian bytes
-}
-
-message EvalViolation {
-  message ChainIdMismatch {
-    uint64 expected = 1;
-    uint64 actual = 2;
-  }
-  oneof kind {
-    bytes invalid_target = 1; // 20-byte Ethereum address
-    GasLimitExceededViolation gas_limit_exceeded = 2;
-    google.protobuf.Empty rate_limit_exceeded = 3;
-    google.protobuf.Empty volumetric_limit_exceeded = 4;
-    google.protobuf.Empty invalid_time = 5;
-    google.protobuf.Empty invalid_transaction_type = 6;
-
-    ChainIdMismatch chain_id_mismatch = 7;
-  }
-}
-
-// Transaction was classified but no grant covers it
-message NoMatchingGrantError {
-  SpecificMeaning meaning = 1;
-}
-
-// Transaction was classified and a grant was found, but constraints were violated
-message PolicyViolationsError {
-  SpecificMeaning meaning = 1;
-  repeated EvalViolation violations = 2;
-}
-
-// top-level error returned when transaction evaluation fails
-message TransactionEvalError {
-  oneof kind {
-    google.protobuf.Empty contract_creation_not_supported = 1;
-    google.protobuf.Empty unsupported_transaction_type = 2;
-    NoMatchingGrantError no_matching_grant = 3;
-    PolicyViolationsError policy_violations = 4;
-  }
-}

protobufs/shared/vault.proto

@@ -1,11 +0,0 @@
-syntax = "proto3";
-
-package arbiter.shared;
-
-enum VaultState {
-  VAULT_STATE_UNSPECIFIED = 0;
-  VAULT_STATE_UNBOOTSTRAPPED = 1;
-  VAULT_STATE_SEALED = 2;
-  VAULT_STATE_UNSEALED = 3;
-  VAULT_STATE_ERROR = 4;
-}

protobufs/unseal.proto

@@ -0,0 +1,14 @@
+syntax = "proto3";
+
+package arbiter.unseal;
+
+message UserAgentKeyRequest {}
+
+message ServerKeyResponse {
+  bytes pubkey = 1;
+}
+message UserAgentSealedKey {
+  bytes sealed_key = 1;
+  bytes pubkey = 2;
+  bytes nonce = 3;
+}

protobufs/user_agent.proto

@@ -1,28 +0,0 @@
-syntax = "proto3";
-
-package arbiter.user_agent;
-
-import "user_agent/auth.proto";
-import "user_agent/evm.proto";
-import "user_agent/sdk_client.proto";
-import "user_agent/vault/vault.proto";
-
-message UserAgentRequest {
-  int32 id = 16;
-  oneof payload {
-    auth.Request auth = 1;
-    vault.Request vault = 2;
-    evm.Request evm = 3;
-    sdk_client.Request sdk_client = 4;
-  }
-}
-
-message UserAgentResponse {
-  optional int32 id = 16;
-  oneof payload {
-    auth.Response auth = 1;
-    vault.Response vault = 2;
-    evm.Response evm = 3;
-    sdk_client.Response sdk_client = 4;
-  }
-}

protobufs/user_agent/auth.proto

@@ -1,48 +0,0 @@
-syntax = "proto3";
-
-package arbiter.user_agent.auth;
-
-enum KeyType {
-  KEY_TYPE_UNSPECIFIED = 0;
-  KEY_TYPE_ED25519 = 1;
-  KEY_TYPE_ECDSA_SECP256K1 = 2;
-  KEY_TYPE_RSA = 3;
-}
-
-message AuthChallengeRequest {
-  bytes pubkey = 1;
-  optional string bootstrap_token = 2;
-  KeyType key_type = 3;
-}
-
-message AuthChallenge {
-  int32 nonce = 1;
-}
-
-message AuthChallengeSolution {
-  bytes signature = 1;
-}
-
-enum AuthResult {
-  AUTH_RESULT_UNSPECIFIED = 0;
-  AUTH_RESULT_SUCCESS = 1;
-  AUTH_RESULT_INVALID_KEY = 2;
-  AUTH_RESULT_INVALID_SIGNATURE = 3;
-  AUTH_RESULT_BOOTSTRAP_REQUIRED = 4;
-  AUTH_RESULT_TOKEN_INVALID = 5;
-  AUTH_RESULT_INTERNAL = 6;
-}
-
-message Request {
-  oneof payload {
-    AuthChallengeRequest challenge_request = 1;
-    AuthChallengeSolution challenge_solution = 2;
-  }
-}
-
-message Response {
-  oneof payload {
-    AuthChallenge challenge = 1;
-    AuthResult result = 2;
-  }
-}

protobufs/user_agent/evm.proto

@@ -1,33 +0,0 @@
-syntax = "proto3";
-
-package arbiter.user_agent.evm;
-
-import "evm.proto";
-import "google/protobuf/empty.proto";
-
-message SignTransactionRequest {
-  int32 client_id = 1;
-  arbiter.evm.EvmSignTransactionRequest request = 2;
-}
-
-message Request {
-  oneof payload {
-    google.protobuf.Empty wallet_create = 1;
-    google.protobuf.Empty wallet_list = 2;
-    arbiter.evm.EvmGrantCreateRequest grant_create = 3;
-    arbiter.evm.EvmGrantDeleteRequest grant_delete = 4;
-    arbiter.evm.EvmGrantListRequest grant_list = 5;
-    SignTransactionRequest sign_transaction = 6;
-  }
-}
-
-message Response {
-  oneof payload {
-    arbiter.evm.WalletCreateResponse wallet_create = 1;
-    arbiter.evm.WalletListResponse wallet_list = 2;
-    arbiter.evm.EvmGrantCreateResponse grant_create = 3;
-    arbiter.evm.EvmGrantDeleteResponse grant_delete = 4;
-    arbiter.evm.EvmGrantListResponse grant_list = 5;
-    arbiter.evm.EvmSignTransactionResponse sign_transaction = 6;
-  }
-}

protobufs/user_agent/sdk_client.proto

@@ -1,100 +0,0 @@
-syntax = "proto3";
-
-package arbiter.user_agent.sdk_client;
-
-import "shared/client.proto";
-import "google/protobuf/empty.proto";
-
-enum Error {
-  ERROR_UNSPECIFIED = 0;
-  ERROR_ALREADY_EXISTS = 1;
-  ERROR_NOT_FOUND = 2;
-  ERROR_HAS_RELATED_DATA = 3; // hard-delete blocked by FK (client has grants or transaction logs)
-  ERROR_INTERNAL = 4;
-}
-
-message RevokeRequest {
-  int32 client_id = 1;
-}
-
-message Entry {
-  int32 id = 1;
-  bytes pubkey = 2;
-  arbiter.shared.ClientInfo info = 3;
-  int32 created_at = 4;
-}
-
-message List {
-  repeated Entry clients = 1;
-}
-
-message RevokeResponse {
-  oneof result {
-    google.protobuf.Empty ok = 1;
-    Error error = 2;
-  }
-}
-
-message ListResponse {
-  oneof result {
-    List clients = 1;
-    Error error = 2;
-  }
-}
-
-message ConnectionRequest {
-  bytes pubkey = 1;
-  arbiter.shared.ClientInfo info = 2;
-}
-
-message ConnectionResponse {
-  bool approved = 1;
-  bytes pubkey = 2;
-}
-
-message ConnectionCancel {
-  bytes pubkey = 1;
-}
-
-message WalletAccess {
-  int32 wallet_id = 1;
-  int32 sdk_client_id = 2;
-}
-
-message WalletAccessEntry {
-  int32 id = 1;
-  WalletAccess access = 2;
-}
-
-message GrantWalletAccess {
-  repeated WalletAccess accesses = 1;
-}
-
-message RevokeWalletAccess {
-  repeated int32 accesses = 1;
-}
-
-message ListWalletAccessResponse {
-  repeated WalletAccessEntry accesses = 1;
-}
-
-message Request {
-  oneof payload {
-    ConnectionResponse connection_response = 1;
-    RevokeRequest revoke = 2;
-    google.protobuf.Empty list = 3;
-    GrantWalletAccess grant_wallet_access = 4;
-    RevokeWalletAccess revoke_wallet_access = 5;
-    google.protobuf.Empty list_wallet_access = 6;
-  }
-}
-
-message Response {
-  oneof payload {
-    ConnectionRequest connection_request = 1;
-    ConnectionCancel connection_cancel = 2;
-    RevokeResponse revoke = 3;
-    ListResponse list = 4;
-    ListWalletAccessResponse list_wallet_access = 5;
-  }
-}

protobufs/user_agent/vault/bootstrap.proto

@@ -1,24 +0,0 @@
-syntax = "proto3";
-
-package arbiter.user_agent.vault.bootstrap;
-
-message BootstrapEncryptedKey {
-  bytes nonce = 1;
-  bytes ciphertext = 2;
-  bytes associated_data = 3;
-}
-
-enum BootstrapResult {
-  BOOTSTRAP_RESULT_UNSPECIFIED = 0;
-  BOOTSTRAP_RESULT_SUCCESS = 1;
-  BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
-  BOOTSTRAP_RESULT_INVALID_KEY = 3;
-}
-
-message Request {
-  BootstrapEncryptedKey encrypted_key = 2;
-}
-
-message Response {
-  BootstrapResult result = 1;
-}

protobufs/user_agent/vault/unseal.proto

@@ -1,37 +0,0 @@
-syntax = "proto3";
-
-package arbiter.user_agent.vault.unseal;
-
-message UnsealStart {
-  bytes client_pubkey = 1;
-}
-
-message UnsealStartResponse {
-  bytes server_pubkey = 1;
-}
-message UnsealEncryptedKey {
-  bytes nonce = 1;
-  bytes ciphertext = 2;
-  bytes associated_data = 3;
-}
-
-enum UnsealResult {
-  UNSEAL_RESULT_UNSPECIFIED = 0;
-  UNSEAL_RESULT_SUCCESS = 1;
-  UNSEAL_RESULT_INVALID_KEY = 2;
-  UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
-}
-
-message Request {
-  oneof payload {
-    UnsealStart start = 1;
-    UnsealEncryptedKey encrypted_key = 2;
-  }
-}
-
-message Response {
-  oneof payload {
-    UnsealStartResponse start = 1;
-    UnsealResult result = 2;
-  }
-}

protobufs/user_agent/vault/vault.proto

@@ -1,24 +0,0 @@
-syntax = "proto3";
-
-package arbiter.user_agent.vault;
-
-import "google/protobuf/empty.proto";
-import "shared/vault.proto";
-import "user_agent/vault/bootstrap.proto";
-import "user_agent/vault/unseal.proto";
-
-message Request {
-  oneof payload {
-    google.protobuf.Empty query_state = 1;
-    unseal.Request unseal = 2;
-    bootstrap.Request bootstrap = 3;
-  }
-}
-
-message Response {
-  oneof payload {
-    arbiter.shared.VaultState state = 1;
-    unseal.Response unseal = 2;
-    bootstrap.Response bootstrap = 3;
-  }
-}

scripts/gen_erc20_registry.py

@@ -1,150 +0,0 @@
-#!/usr/bin/env python3
-"""
-Fetch the Uniswap default token list and emit Rust `TokenInfo` statics.
-
-Usage:
-    python3 gen_erc20_registry.py                       # fetch from IPFS
-    python3 gen_erc20_registry.py tokens.json           # local file
-    python3 gen_erc20_registry.py tokens.json out.rs    # custom output file
-"""
-
-import json
-import re
-import sys
-import unicodedata
-import urllib.request
-
-UNISWAP_URL = "https://ipfs.io/ipns/tokens.uniswap.org"
-
-SOLANA_CHAIN_ID = 501000101
-IDENTIFIER_RE = re.compile(r"[^A-Za-z0-9]+")
-
-
-def load_tokens(source=None):
-    if source:
-        with open(source) as f:
-            return json.load(f)
-    req = urllib.request.Request(
-        UNISWAP_URL,
-        headers={"Accept": "application/json", "User-Agent": "gen_tokens/1.0"},
-    )
-    with urllib.request.urlopen(req, timeout=60) as resp:
-        return json.loads(resp.read())
-
-
-def escape(s: str) -> str:
-    return s.replace("\\", "\\\\").replace('"', '\\"')
-
-
-def to_screaming_case(name: str) -> str:
-    normalized = unicodedata.normalize("NFKD", name or "")
-    ascii_name = normalized.encode("ascii", "ignore").decode("ascii")
-    snake = IDENTIFIER_RE.sub("_", ascii_name).strip("_").upper()
-    if not snake:
-        snake = "TOKEN"
-    if snake[0].isdigit():
-        snake = f"TOKEN_{snake}"
-    return snake
-
-
-def static_name_for_token(token: dict, used_names: set[str]) -> str:
-    base = to_screaming_case(token.get("name", ""))
-    if base not in used_names:
-        used_names.add(base)
-        return base
-
-    address = token["address"]
-    suffix = f"{token['chainId']}_{address[2:].upper()[-8:]}"
-    candidate = f"{base}_{suffix}"
-
-    i = 2
-    while candidate in used_names:
-        candidate = f"{base}_{suffix}_{i}"
-        i += 1
-
-    used_names.add(candidate)
-    return candidate
-
-
-def main():
-    source = sys.argv[1] if len(sys.argv) > 1 else None
-    output = sys.argv[2] if len(sys.argv) > 2 else "generated_tokens.rs"
-    data = load_tokens(source)
-    tokens = data["tokens"]
-
-    # Deduplicate by (chainId, address)
-    seen = set()
-    unique = []
-    for t in tokens:
-        key = (t["chainId"], t["address"].lower())
-        if key not in seen:
-            seen.add(key)
-            unique.append(t)
-
-    unique.sort(key=lambda t: (t["chainId"], t.get("symbol", "").upper()))
-    evm_tokens = [t for t in unique if t["chainId"] != SOLANA_CHAIN_ID]
-
-    ver = data["version"]
-    lines = []
-    w = lines.append
-
-    w(
-        f"// Auto-generated from Uniswap token list v{ver['major']}.{ver['minor']}.{ver['patch']}"
-    )
-    w(f"// {len(evm_tokens)} tokens")
-    w("// DO NOT EDIT - regenerate with gen_erc20_registry.py")
-    w("")
-
-    used_static_names = set()
-    token_statics = []
-    for t in evm_tokens:
-        static_name = static_name_for_token(t, used_static_names)
-        token_statics.append((static_name, t))
-
-    for static_name, t in token_statics:
-        addr = t["address"]
-        name = escape(t.get("name", ""))
-        symbol = escape(t.get("symbol", ""))
-        decimals = t.get("decimals", 18)
-        logo = t.get("logoURI")
-        chain = t["chainId"]
-
-        logo_val = f'Some("{escape(logo)}")' if logo else "None"
-
-        w(f"pub static {static_name}: TokenInfo = TokenInfo {{")
-        w(f'    name: "{name}",')
-        w(f'    symbol: "{symbol}",')
-        w(f"    decimals: {decimals},")
-        w(f'    contract: address!("{addr}"),')
-        w(f"    chain: {chain},")
-        w(f"    logo_uri: {logo_val},")
-        w("};")
-        w("")
-
-    w("pub static TOKENS: &[&TokenInfo] = &[")
-    for static_name, _ in token_statics:
-        w(f"    &{static_name},")
-    w("];")
-    w("")
-    w("pub fn get_token(")
-    w("    chain_id: alloy::primitives::ChainId,")
-    w("    address: alloy::primitives::Address,")
-    w(") -> Option<&'static TokenInfo> {")
-    w("    match (chain_id, address) {")
-    for static_name, t in token_statics:
-        w(
-            f'        ({t["chainId"]}, addr) if addr == address!("{t["address"]}") => Some(&{static_name}),'
-        )
-    w("        _ => None,")
-    w("    }")
-    w("}")
-    w("")
-
-    with open(output, "w") as f:
-        f.write("\n".join(lines))
-
-    print(f"Wrote {len(token_statics)} tokens to {output}")
-
-
-if __name__ == "__main__":
-    main()

server/.cargo/audit.toml

@@ -1,13 +0,0 @@
-[advisories]
-# RUSTSEC-2023-0071: Marvin Attack timing side-channel in rsa crate.
-# No fixed version is available upstream.
-# RSA support is required for Windows Hello / KeyCredentialManager
-# (https://learn.microsoft.com/en-us/uwp/api/windows.security.credentials.keycredentialmanager.requestcreateasync),
-# which only issues RSA-2048 keys.
-# Mitigations in place:
-#   - Signing uses BlindedSigningKey (PSS+SHA-256), which applies blinding to
-#     protect the private key from timing recovery during signing.
-#   - RSA decryption is never performed; we only verify public-key signatures.
-#   - The attack requires local, high-resolution timing access against the
-#     signing process, which is not exposed in our threat model.
-ignore = ["RUSTSEC-2023-0071"]

server/.cargo/mutants.toml

@@ -1 +0,0 @@
-test_tool = "nextest"

server/.gitignore

@@ -1,2 +0,0 @@
-mutants.out/
-mutants.out.old/

server/Cargo.toml

@@ -1,50 +1,26 @@
 [workspace]
 members = [
-    "crates/*",
+    "crates/arbiter-client",
+    "crates/arbiter-proto",
+    "crates/arbiter-server",
+    "crates/arbiter-useragent",
 ]
 resolver = "3"
 
-[workspace.lints.clippy]
-disallowed-methods = "deny"
-
 
 [workspace.dependencies]
-tonic = { version = "0.14.5", features = [
-    "deflate",
-    "gzip",
-    "tls-connect-info",
-    "zstd",
-] }
+tonic = { version = "0.14.3", features = ["deflate", "gzip", "tls-connect-info", "zstd"] }
 tracing = "0.1.44"
-tokio = { version = "1.50.0", features = ["full"] }
+tokio = { version = "1.49.0", features = ["full"] }
 ed25519-dalek = { version = "3.0.0-pre.6", features = ["rand_core"] }
-chrono = { version = "0.4.44", features = ["serde"] }
+chrono = { version = "0.4.43", features = ["serde"] }
 rand = "0.10.0"
-rustls = { version = "0.23.37", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
+rustls = "0.23.36"
 smlang = "0.8.0"
+miette = { version = "7.6.0", features = ["fancy", "serde"] }
 thiserror = "2.0.18"
 async-trait = "0.1.89"
-futures = "0.3.32"
+futures = "0.3.31"
 tokio-stream = { version = "0.1.18", features = ["full"] }
 kameo = "0.19.2"
 prost-types = { version = "0.14.3", features = ["chrono"] }
-x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
-rstest = "0.26.1"
-rustls-pki-types = "1.14.0"
-alloy = "1.7.3"
-rcgen = { version = "0.14.7", features = [
-    "aws_lc_rs",
-    "pem",
-    "x509-parser",
-    "zeroize",
-], default-features = false }
-k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
-rsa = { version = "0.9", features = ["sha2"] }
-sha2 = "0.10"
-spki = "0.7"
-prost = "0.14.3"
-miette = { version = "7.6.0", features = ["fancy", "serde"] }
-mutants = "0.0.4"
-ml-dsa = { version = "0.1.0-rc.8", features = ["zeroize"] }
-base64 = "0.22.1"
-hmac = "0.12.1"

server/clippy.toml

@@ -1,9 +0,0 @@
-disallowed-methods = [
-    # RSA decryption is forbidden: the rsa crate has RUSTSEC-2023-0071 (Marvin Attack).
-    # We only use RSA for Windows Hello (KeyCredentialManager) public-key verification — decryption
-    # is never required and must not be introduced.
-    { path = "rsa::RsaPrivateKey::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). Only PSS signing/verification is permitted." },
-    { path = "rsa::RsaPrivateKey::decrypt_blinded", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). Only PSS signing/verification is permitted." },
-    { path = "rsa::traits::Decryptor::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt() on rsa::{pkcs1v15,oaep}::DecryptingKey." },
-    { path = "rsa::traits::RandomizedDecryptor::decrypt_with_rng", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt_with_rng() on rsa::{pkcs1v15,oaep}::DecryptingKey." },
-]

server/crates/arbiter-client/Cargo.toml

@@ -3,24 +3,5 @@ name = "arbiter-client"
 version = "0.1.0"
 edition = "2024"
 repository = "https://git.markettakers.org/MarketTakers/arbiter"
-license = "Apache-2.0"
-
-[lints]
-workspace = true
-
-[features]
-evm = ["dep:alloy"]
 
 [dependencies]
-arbiter-proto.path = "../arbiter-proto"
-arbiter-crypto.path = "../arbiter-crypto"
-alloy = { workspace = true, optional = true }
-tonic.workspace = true
-tonic.features = ["tls-aws-lc"]
-tokio.workspace = true
-tokio-stream.workspace = true
-thiserror.workspace = true
-http = "1.4.0"
-rustls-webpki = { version = "0.103.10", features = ["aws-lc-rs"] }
-async-trait.workspace = true
-rand.workspace = true

server/crates/arbiter-client/src/auth.rs

@@ -1,152 +0,0 @@
-use arbiter_crypto::authn::{CLIENT_CONTEXT, SigningKey, format_challenge};
-use arbiter_proto::{
-    ClientMetadata,
-    proto::{
-        client::{
-            ClientRequest,
-            auth::{
-                self as proto_auth, AuthChallenge, AuthChallengeRequest, AuthChallengeSolution,
-                AuthResult, request::Payload as AuthRequestPayload,
-                response::Payload as AuthResponsePayload,
-            },
-            client_request::Payload as ClientRequestPayload,
-            client_response::Payload as ClientResponsePayload,
-        },
-        shared::ClientInfo as ProtoClientInfo,
-    },
-};
-
-use crate::{
-    storage::StorageError,
-    transport::{ClientTransport, next_request_id},
-};
-
-#[derive(Debug, thiserror::Error)]
-pub enum AuthError {
-    #[error("Auth challenge was not returned by server")]
-    MissingAuthChallenge,
-
-    #[error("Client approval denied by User Agent")]
-    ApprovalDenied,
-
-    #[error("No User Agents online to approve client")]
-    NoUserAgentsOnline,
-
-    #[error("Unexpected auth response payload")]
-    UnexpectedAuthResponse,
-
-    #[error("Signing key storage error")]
-    Storage(#[from] StorageError),
-}
-
-fn map_auth_result(code: i32) -> AuthError {
-    match AuthResult::try_from(code).unwrap_or(AuthResult::Unspecified) {
-        AuthResult::ApprovalDenied => AuthError::ApprovalDenied,
-        AuthResult::NoUserAgentsOnline => AuthError::NoUserAgentsOnline,
-        AuthResult::Unspecified
-        | AuthResult::Success
-        | AuthResult::InvalidKey
-        | AuthResult::InvalidSignature
-        | AuthResult::Internal => AuthError::UnexpectedAuthResponse,
-    }
-}
-
-async fn send_auth_challenge_request(
-    transport: &mut ClientTransport,
-    metadata: ClientMetadata,
-    key: &SigningKey,
-) -> std::result::Result<(), AuthError> {
-    transport
-        .send(ClientRequest {
-            request_id: next_request_id(),
-            payload: Some(ClientRequestPayload::Auth(proto_auth::Request {
-                payload: Some(AuthRequestPayload::ChallengeRequest(AuthChallengeRequest {
-                    pubkey: key.public_key().to_bytes(),
-                    client_info: Some(ProtoClientInfo {
-                        name: metadata.name,
-                        description: metadata.description,
-                        version: metadata.version,
-                    }),
-                })),
-            })),
-        })
-        .await
-        .map_err(|_| AuthError::UnexpectedAuthResponse)
-}
-
-async fn receive_auth_challenge(
-    transport: &mut ClientTransport,
-) -> std::result::Result<AuthChallenge, AuthError> {
-    let response = transport
-        .recv()
-        .await
-        .map_err(|_| AuthError::MissingAuthChallenge)?;
-
-    let payload = response.payload.ok_or(AuthError::MissingAuthChallenge)?;
-    match payload {
-        ClientResponsePayload::Auth(response) => match response.payload {
-            Some(AuthResponsePayload::Challenge(challenge)) => Ok(challenge),
-            Some(AuthResponsePayload::Result(result)) => Err(map_auth_result(result)),
-            None => Err(AuthError::MissingAuthChallenge),
-        },
-        _ => Err(AuthError::UnexpectedAuthResponse),
-    }
-}
-
-async fn send_auth_challenge_solution(
-    transport: &mut ClientTransport,
-    key: &SigningKey,
-    challenge: AuthChallenge,
-) -> std::result::Result<(), AuthError> {
-    let challenge_payload = format_challenge(challenge.nonce, &challenge.pubkey);
-    let signature = key
-        .sign_message(&challenge_payload, CLIENT_CONTEXT)
-        .map_err(|_| AuthError::UnexpectedAuthResponse)?
-        .to_bytes();
-
-    transport
-        .send(ClientRequest {
-            request_id: next_request_id(),
-            payload: Some(ClientRequestPayload::Auth(proto_auth::Request {
-                payload: Some(AuthRequestPayload::ChallengeSolution(
-                    AuthChallengeSolution { signature },
-                )),
-            })),
-        })
-        .await
-        .map_err(|_| AuthError::UnexpectedAuthResponse)
-}
-
-async fn receive_auth_confirmation(
-    transport: &mut ClientTransport,
-) -> std::result::Result<(), AuthError> {
-    let response = transport
-        .recv()
-        .await
-        .map_err(|_| AuthError::UnexpectedAuthResponse)?;
-
-    let payload = response.payload.ok_or(AuthError::UnexpectedAuthResponse)?;
-    match payload {
-        ClientResponsePayload::Auth(response) => match response.payload {
-            Some(AuthResponsePayload::Result(result))
-                if AuthResult::try_from(result).ok() == Some(AuthResult::Success) =>
-            {
-                Ok(())
-            }
-            Some(AuthResponsePayload::Result(result)) => Err(map_auth_result(result)),
-            _ => Err(AuthError::UnexpectedAuthResponse),
-        },
-        _ => Err(AuthError::UnexpectedAuthResponse),
-    }
-}
-
-pub(crate) async fn authenticate(
-    transport: &mut ClientTransport,
-    metadata: ClientMetadata,
-    key: &SigningKey,
-) -> std::result::Result<(), AuthError> {
-    send_auth_challenge_request(transport, metadata, key).await?;
-    let challenge = receive_auth_challenge(transport).await?;
-    send_auth_challenge_solution(transport, key, challenge).await?;
-    receive_auth_confirmation(transport).await
-}