refactor(server): typed pubkey len via u32::try_from in ReplaceOperator

Adds DeclareCommittee and ContributePassphrase variants to bootstrap.proto,
ContributePassphrase to unseal.proto, and AwaitingContributions result codes
to both. Implements corresponding inbound converters and outbound reply
mappings. VaultGate handlers delegate to VaultCoordinator.

mise.toml

@@ -22,3 +22,5 @@ run = '''
 dart pub global activate protoc_plugin && \
 protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
 '''
+
+[tasks.generate_schema]

protobufs/operator.proto

@@ -4,25 +4,28 @@ package arbiter.operator;
 
 import "operator/auth.proto";
 import "operator/evm.proto";
+import "operator/governance.proto";
 import "operator/sdk_client.proto";
 import "operator/vault/vault.proto";
 
 message OperatorRequest {
   int32 id = 16;
   oneof payload {
-    auth.Request auth = 1;
-    vault.Request vault = 2;
-    evm.Request evm = 3;
-    sdk_client.Request sdk_client = 4;
+    auth.Request            auth        = 1;
+    vault.Request           vault       = 2;
+    evm.Request             evm         = 3;
+    sdk_client.Request      sdk_client  = 4;
+    governance.Request      governance  = 5;
   }
 }
 
 message OperatorResponse {
   optional int32 id = 16;
   oneof payload {
-    auth.Response auth = 1;
-    vault.Response vault = 2;
-    evm.Response evm = 3;
-    sdk_client.Response sdk_client = 4;
+    auth.Response           auth        = 1;
+    vault.Response          vault       = 2;
+    evm.Response            evm         = 3;
+    sdk_client.Response     sdk_client  = 4;
+    governance.Response     governance  = 5;
   }
 }

protobufs/operator/governance.proto

@@ -0,0 +1,135 @@
+syntax = "proto3";
+
+package arbiter.operator.governance;
+
+message Request {
+  oneof payload {
+    CreateProposalRequest create = 1;
+    CastVoteRequest       vote   = 2;
+    QueryPendingRequest   query  = 3;
+  }
+}
+
+message CreateProposalRequest {
+  oneof kind {
+    ApproveSdkClientPayload    approve_sdk_client    = 1;
+    GrantWalletAccessPayload   grant_wallet_access   = 3;
+    ApproveServerUpdatePayload approve_server_update = 4;
+    ReplaceOperatorPayload          replace_operator          = 5;
+    UpdateShamirParametersPayload   update_shamir_parameters  = 6;
+    ApprovePersistentGrantPayload   approve_persistent_grant  = 7;
+    ApproveOneOffTransactionPayload approve_one_off_transaction = 8;
+  }
+  optional uint32 ttl_secs = 2;
+}
+
+message ReplaceOperatorPayload {
+  bytes new_pubkey = 1;
+}
+
+message UpdateShamirParametersPayload {
+  uint32 new_n = 1;
+}
+
+message ApproveServerUpdatePayload {}
+
+message ApproveSdkClientPayload {
+  int32 client_id = 1;
+}
+
+message GrantWalletAccessPayload {
+  int32 wallet_id = 1;
+  int32 client_id = 2;
+}
+
+message CastVoteRequest {
+  int32 proposal_id = 1;
+  bool  approve     = 2;
+  bytes signature   = 3;
+}
+
+message QueryPendingRequest {}
+
+message Response {
+  oneof payload {
+    CreateProposalResponse created  = 1;
+    VoteResponse           voted    = 2;
+    QueryPendingResponse   pending  = 3;
+  }
+}
+
+message CreateProposalResponse {
+  int32 proposal_id = 1;
+}
+
+message VoteResponse {
+  VoteOutcome outcome = 1;
+}
+
+enum VoteOutcome {
+  VOTE_OUTCOME_UNSPECIFIED  = 0;
+  VOTE_OUTCOME_PENDING      = 1;
+  VOTE_OUTCOME_APPROVED     = 2;
+  VOTE_OUTCOME_REJECTED     = 3;
+}
+
+message ProposalSummary {
+  int32  id            = 1;
+  string kind          = 2;
+  int32  initiator_id  = 3;
+  int64  expires_at    = 4;
+  int64  approve_count = 5;
+  int64  reject_count  = 6;
+}
+
+message QueryPendingResponse {
+  repeated ProposalSummary proposals = 1;
+}
+
+message TransactionRateLimitProto {
+  uint32 count       = 1;
+  int64  window_secs = 2;
+}
+
+message VolumeLimitProto {
+  bytes max_volume  = 1;
+  int64 window_secs = 2;
+}
+
+message EtherTransferSpecProto {
+  repeated bytes  targets = 1;
+  VolumeLimitProto limit  = 2;
+}
+
+message TokenTransferSpecProto {
+  bytes            token_contract = 1;
+  optional bytes   target         = 2;
+  repeated VolumeLimitProto volume_limits = 3;
+}
+
+message ApproveOneOffTransactionPayload {
+  int32  client_id              = 1;
+  bytes  wallet_address         = 2;
+  uint64 chain_id               = 3;
+  uint64 nonce                  = 4;
+  uint64 gas_limit              = 5;
+  bytes  max_fee_per_gas        = 6;
+  bytes  max_priority_fee_per_gas = 7;
+  bytes  to                     = 8;
+  bytes  value                  = 9;
+  bytes  input                  = 10;
+}
+
+message ApprovePersistentGrantPayload {
+  int32  wallet_access_id           = 1;
+  uint64 chain_id                   = 2;
+  optional int64 valid_from_secs    = 3;
+  optional int64 valid_until_secs   = 4;
+  optional bytes max_gas_fee_per_gas         = 5;
+  optional bytes max_priority_fee_per_gas    = 6;
+  optional TransactionRateLimitProto rate_limit = 7;
+  oneof specific {
+    EtherTransferSpecProto  ether_transfer = 8;
+    TokenTransferSpecProto  token_transfer = 9;
+  }
+}

protobufs/operator/vault/bootstrap.proto

@@ -8,15 +8,28 @@ message BootstrapEncryptedKey {
   bytes associated_data = 3;
 }
 
+message DeclareCommittee {
+  uint32 count = 1;
+}
+
+message ContributePassphrase {
+  bytes passphrase = 1;
+}
+
 enum BootstrapResult {
   BOOTSTRAP_RESULT_UNSPECIFIED = 0;
   BOOTSTRAP_RESULT_SUCCESS = 1;
   BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
   BOOTSTRAP_RESULT_INVALID_KEY = 3;
+  BOOTSTRAP_RESULT_AWAITING_CONTRIBUTIONS = 4;
 }
 
 message Request {
-  BootstrapEncryptedKey encrypted_key = 2;
+  oneof payload {
+    BootstrapEncryptedKey encrypted_key = 2;
+    DeclareCommittee declare_committee = 3;
+    ContributePassphrase contribute_passphrase = 4;
+  }
 }
 
 message Response {

protobufs/operator/vault/unseal.proto

@@ -15,17 +15,23 @@ message UnsealEncryptedKey {
   bytes associated_data = 3;
 }
 
+message ContributePassphrase {
+  bytes passphrase = 1;
+}
+
 enum UnsealResult {
   UNSEAL_RESULT_UNSPECIFIED = 0;
   UNSEAL_RESULT_SUCCESS = 1;
   UNSEAL_RESULT_INVALID_KEY = 2;
   UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
+  UNSEAL_RESULT_AWAITING_CONTRIBUTIONS = 4;
 }
 
 message Request {
   oneof payload {
     UnsealStart start = 1;
     UnsealEncryptedKey encrypted_key = 2;
+    ContributePassphrase contribute_passphrase = 3;
   }
 }
 

protobufs/shared/vault.proto

@@ -5,7 +5,8 @@ package arbiter.shared;
 enum VaultState {
   VAULT_STATE_UNSPECIFIED = 0;
   VAULT_STATE_UNBOOTSTRAPPED = 1;
-  VAULT_STATE_SEALED = 2;
-  VAULT_STATE_UNSEALED = 3;
-  VAULT_STATE_ERROR = 4;
+  VAULT_STATE_BOOSTRAPPING = 2;
+  VAULT_STATE_SEALED = 3;
+  VAULT_STATE_UNSEALED = 4;
+  VAULT_STATE_ERROR = 5;
 }

server/Cargo.toml

@@ -6,31 +6,31 @@ resolver = "3"
 
 
 [workspace.dependencies]
-alloy = "2.1.0"
+alloy = "2.0.4"
 async-trait = "0.1.89"
 base64 = "0.22.1"
-chrono = { version = "0.4.45", features = ["serde"] }
+chrono = { version = "0.4.44", features = ["serde"] }
 futures = "0.3.32"
 k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
-kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
-kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
+kameo = {git = "https://github.com/hdbg/kameo.git", rev = "3e18ba2"}
+kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "3e18ba2"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
-ml-dsa = { version = "0.1.1", features = ["zeroize"] }
+ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
 mutants = "0.0.4"
-prost = "0.14.4"
-prost-types = { version = "0.14.4", features = ["chrono"] }
+prost = "0.14.3"
+prost-types = { version = "0.14.3", features = ["chrono"] }
 rand = "0.10.1"
-rcgen = { version = "0.14.8", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
+rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
-rustls = { version = "0.23.41", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
+rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
 rustls-pki-types = "1.14.1"
 sha2 = "0.11"
 smlang = "0.8.0"
 thiserror = "2.0.18"
-tokio = { version = "1.52.3", features = ["full"] }
+tokio = { version = "1.52.1", features = ["full"] }
 tokio-stream = { version = "0.1.18", features = ["full"] }
-tonic = { version = "0.14.6", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
+tonic = { version = "0.14.5", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
 tracing = "0.1.44"
 x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
 
@@ -76,7 +76,6 @@ needless_pass_by_ref_mut = "allow"
 pub_underscore_fields = "allow"
 redundant_pub_crate = "allow" 
 uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {})
-too-many-lines = "allow" # this is a very common pattern in server code, and it's not always possible to break it down into smaller modules without hurting readability
 
 # restriction lints
 alloc_instead_of_core = "warn"
@@ -107,7 +106,6 @@ indexing_slicing = "warn"
 infinite_loop = "warn"
 inline_asm_x86_att_syntax = "warn"
 inline_asm_x86_intel_syntax = "warn"
-integer_division = "warn"
 large_include_file = "warn"
 lossy_float_literal = "warn"
 map_with_unused_argument_over_ranges = "warn"

server/crates/arbiter-client/Cargo.toml

@@ -20,7 +20,7 @@ tonic.features = ["tls-aws-lc"]
 tokio.workspace = true
 tokio-stream.workspace = true
 thiserror.workspace = true
-http = "1.4.2"
+http = "1.4.0"
 rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] }
 async-trait.workspace = true
 chrono.workspace = true

server/crates/arbiter-client/src/auth.rs

@@ -100,7 +100,7 @@ async fn send_auth_challenge_solution(
     key: &SigningKey,
     challenge: AuthChallenge,
 ) -> Result<(), AuthError> {
-    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos.cast_signed());
+    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos as i64);
     let challenge = authn::AuthChallenge {
         nonce: *challenge
             .random

server/crates/arbiter-crypto/src/authn/v1.rs

@@ -1,13 +1,14 @@
 use chrono::{DateTime, Utc};
 use hmac::digest::Digest;
 use ml_dsa::{
-    EncodedVerifyingKey, Error, ExpandedSigningKey, Generate, MlDsa87, Seed,
-    Signature as MlDsaSignature, SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey,
+    EncodedVerifyingKey, Error, KeyGen, MlDsa87, Seed, Signature as MlDsaSignature,
+    SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _,
 };
 use rand::RngExt;
 
 pub static CLIENT_CONTEXT: &[u8] = b"arbiter_client";
 pub static OPERATOR_CONTEXT: &[u8] = b"arbiter_operator";
+pub static GOVERNANCE_CONTEXT: &[u8] = b"arbiter_governance_vote";
 
 const NONCE_SIZE: usize = 32;
 
@@ -77,10 +78,7 @@ impl crate::hashing::Hashable for PublicKey {
 pub struct Signature(Box<MlDsaSignature<KeyParams>>);
 
 #[derive(Debug)]
-pub struct SigningKey {
-    key: Box<ExpandedSigningKey<KeyParams>>,
-    seed: Seed,
-}
+pub struct SigningKey(Box<MlDsaSigningKey<KeyParams>>);
 
 impl PublicKey {
     pub fn to_bytes(&self) -> Vec<u8> {
@@ -93,6 +91,11 @@ impl PublicKey {
         self.0
             .verify_with_context(&challenge, context, &signature.0)
     }
+
+    #[must_use]
+    pub fn verify_message(&self, message: &[u8], context: &[u8], signature: &Signature) -> bool {
+        self.0.verify_with_context(message, context, &signature.0)
+    }
 }
 
 impl Signature {
@@ -103,31 +106,24 @@ impl Signature {
 
 impl SigningKey {
     pub fn generate() -> Self {
-        let seed = MlDsaSigningKey::<KeyParams>::generate_from_rng(&mut rand::rng()).to_seed();
-        Self {
-            key: Box::new(ExpandedSigningKey::from_seed(&seed)),
-            seed,
-        }
+        Self(Box::new(KeyParams::key_gen(&mut rand::rng())))
     }
 
     pub fn from_seed(seed: [u8; 32]) -> Self {
-        let seed = Seed::from(seed);
-        Self {
-            key: Box::new(ExpandedSigningKey::from_seed(&seed)),
-            seed,
-        }
+        Self(Box::new(KeyParams::from_seed(&Seed::from(seed))))
     }
 
     pub fn to_seed(&self) -> [u8; 32] {
-        self.seed.into()
+        self.0.to_seed().into()
     }
 
     pub fn public_key(&self) -> PublicKey {
-        self.key.verifying_key().into()
+        self.0.verifying_key().into()
     }
 
     pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> {
-        self.key
+        self.0
+            .signing_key()
             .sign_deterministic(message, context)
             .map(Into::into)
     }
@@ -155,6 +151,12 @@ impl From<MlDsaSignature<KeyParams>> for Signature {
     }
 }
 
+impl From<MlDsaSigningKey<KeyParams>> for SigningKey {
+    fn from(value: MlDsaSigningKey<KeyParams>) -> Self {
+        Self(Box::new(value))
+    }
+}
+
 impl TryFrom<Vec<u8>> for PublicKey {
     type Error = ();
 
@@ -192,15 +194,15 @@ impl TryFrom<&'_ [u8]> for Signature {
 
 #[cfg(test)]
 mod tests {
-    use ml_dsa::{Generate as _, MlDsa87, SigningKey as RealSigningKey, signature::Keypair as _};
+    use ml_dsa::{KeyGen, MlDsa87, signature::Keypair as _};
 
     use crate::authn::AuthChallenge;
 
-    use super::{CLIENT_CONTEXT, OPERATOR_CONTEXT, PublicKey, Signature, SigningKey};
+    use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT};
 
     #[test]
     fn public_key_round_trip_decodes() {
-        let key = RealSigningKey::<MlDsa87>::generate();
+        let key = MlDsa87::key_gen(&mut rand::rng());
         let encoded = PublicKey::from(key.verifying_key()).to_bytes();
 
         let decoded = PublicKey::try_from(encoded.as_slice()).expect("public key should decode");

server/crates/arbiter-crypto/src/safecell.rs

@@ -22,7 +22,7 @@ pub trait SafeCellHandle<T> {
     fn read(&mut self) -> Self::CellRead<'_>;
     fn write(&mut self) -> Self::CellWrite<'_>;
 
-    fn new_inline<F>(f: F) -> Self
+    fn new_inline_default<F>(f: F) -> Self
     where
         Self: Sized,
         T: Default,
@@ -36,6 +36,14 @@ pub trait SafeCellHandle<T> {
         cell
     }
 
+    fn new_inline<F>(f: Box<F>) -> Self
+    where
+        Self: Sized,
+        F: for<'a> FnOnce() -> T,
+    {
+        Self::new(f())
+    }
+
     #[inline(always)]
     fn read_inline<F, R>(&mut self, f: F) -> R
     where

server/crates/arbiter-proto/Cargo.toml

@@ -9,7 +9,7 @@ license = "Apache-2.0"
 tonic.workspace = true
 tokio.workspace = true
 futures.workspace = true
-tonic-prost = "0.14.6"
+tonic-prost = "0.14.5"
 prost.workspace = true
 kameo.workspace = true
 url = "2.5.8"
@@ -22,7 +22,7 @@ async-trait.workspace = true
 tokio-stream.workspace = true
 
 [build-dependencies]
-tonic-prost-build = "0.14.6"
+tonic-prost-build = "0.14.5"
 
 [dev-dependencies]
 rstest.workspace = true

server/crates/arbiter-proto/src/lib.rs

@@ -23,6 +23,10 @@ pub mod proto {
             tonic::include_proto!("arbiter.operator.evm");
         }
 
+        pub mod governance {
+            tonic::include_proto!("arbiter.operator.governance");
+        }
+
         pub mod sdk_client {
             tonic::include_proto!("arbiter.operator.sdk_client");
         }

server/crates/arbiter-server/Cargo.toml

@@ -9,8 +9,8 @@ license = "Apache-2.0"
 workspace = true
 
 [dependencies]
-diesel = { version = "2.3.10", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
-diesel-async = { version = "0.9.2", features = [
+diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
+diesel-async = { version = "0.9.0", features = [
     "bb8",
     "migrations",
     "sqlite",
@@ -42,14 +42,17 @@ pem = "3.0.6"
 sha2.workspace = true
 hmac.workspace = true
 alloy.workspace = true
+prost.workspace = true
 prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
-anyhow = "1.0.103"
+anyhow = "1.0.102"
 mutants.workspace = true
 subtle = "2.6.1"
 x25519-dalek.workspace = true
 k256.workspace = true
 kameo_actors.workspace = true
+vsss-rs = "5.4.0"
+rand_core = "0.6"
 
 [dev-dependencies]
 proptest = "1.11.0"

server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql

@@ -43,13 +43,25 @@ create table if not exists arbiter_settings (
 insert into arbiter_settings (id) values (1) on conflict do nothing;
 -- ensure singleton row exists
 
-create table if not exists operator_client (
+create table if not exists operator_identity (
     id integer not null primary key,
     public_key blob not null,
     created_at integer not null default(unixepoch ('now')),
     updated_at integer not null default(unixepoch ('now'))
 ) STRICT;
-create unique index if not exists uniq_operator_client_public_key on operator_client (public_key);
+create unique index if not exists uniq_operator_identity_public_key on operator_identity (public_key);
+
+create table if not exists operator (
+    id integer primary key references operator_identity(id) on delete restrict, -- same id as operator_identity
+
+    share blob not null,
+    share_nonce blob not null,
+    share_salt blob not null default (randomblob(32)),
+
+    created_at integer not null default(unixepoch ('now')),
+    updated_at integer not null default(unixepoch ('now'))
+
+) STRICT;
 
 create table if not exists client_metadata (
     id integer not null primary key,
@@ -204,3 +216,31 @@ create table if not exists integrity_envelope (
 ) STRICT;
 
 create unique index if not exists uniq_integrity_envelope_entity on integrity_envelope (entity_kind, entity_id);
+
+create table if not exists proposal (
+    id           integer not null primary key,
+    kind         text    not null,
+    payload      blob    not null,
+    initiator_id integer not null references operator_identity(id) on delete restrict,
+    created_at   integer not null default(unixepoch('now')),
+    expires_at   integer not null,
+    status       text    not null default 'pending'
+        check (status in ('pending', 'approved', 'rejected', 'expired'))
+) STRICT;
+
+create table if not exists proposal_vote (
+    id          integer not null primary key,
+    proposal_id integer not null references proposal(id) on delete cascade,
+    operator_id integer not null references operator_identity(id) on delete restrict,
+    approve     integer not null check (approve in (0, 1)),
+    signature   blob    not null,
+    voted_at    integer not null default(unixepoch('now')),
+    unique (proposal_id, operator_id)
+) STRICT;
+
+
+create table if not exists proposal_result (
+    proposal_id integer not null primary key references proposal(id) on delete cascade,
+    data        blob    not null,
+    created_at  integer not null default(unixepoch('now'))
+) STRICT;

server/crates/arbiter-server/src/actors/bootstrap.rs

@@ -48,7 +48,7 @@ impl Bootstrapper {
         let row_count: i64 = {
             let mut conn = db.get().await?;
 
-            schema::operator_client::table
+            schema::operator::table
                 .count()
                 .get_result(&mut conn)
                 .await?

server/crates/arbiter-server/src/actors/evm/mod.rs

@@ -3,7 +3,7 @@ use crate::{
     crypto::integrity,
     db::{
         DatabaseError, DatabasePool,
-        models::{self},
+        models::{self, EvmWalletId},
         schema,
     },
     evm::{
@@ -116,7 +116,7 @@ impl EvmActor {
     }
 
     #[message]
-    pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> {
+    pub async fn list_wallets(&self) -> Result<Vec<(EvmWalletId, Address)>, Error> {
         let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
         let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
             .select(models::EvmWallet::as_select())
@@ -160,14 +160,23 @@ impl EvmActor {
     }
 
     #[message]
-    pub async fn useragent_delete_grant(
-        &mut self,
-        grant_id: i32,
-    ) -> Result<(), Error> {
-        self.engine
-            .revoke_grant(grant_id)
+    pub async fn operator_delete_grant(&mut self, grant_id: i32) -> Result<(), Error> {
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+
+        let affected = diesel::update(schema::evm_basic_grant::table)
+            .filter(schema::evm_basic_grant::id.eq(grant_id))
+            .set(schema::evm_basic_grant::revoked_at.eq(models::SqliteTimestamp::now()))
+            .execute(&mut conn)
             .await
-            .map_err(Error::from)
+            .map_err(DatabaseError::from)?;
+
+        if affected == 0 {
+            return Err(Error::Database(DatabaseError::from(
+                diesel::result::Error::NotFound,
+            )));
+        }
+
+        Ok(())
     }
 
     #[message]

server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs

@@ -11,9 +11,7 @@ use kameo::{
     prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
     reply::ReplySender,
 };
-use std::{ops::ControlFlow, time::Duration};
-
-const APPROVAL_TIMEOUT: Duration = Duration::from_secs(30);
+use std::ops::ControlFlow;
 
 pub struct Args {
     pub client: ClientProfile,
@@ -66,14 +64,6 @@ impl Actor for ClientApprovalController {
                 .await;
         }
 
-        let weak = actor_ref.downgrade();
-        tokio::spawn(async move {
-            tokio::time::sleep(APPROVAL_TIMEOUT).await;
-            if let Some(r) = weak.upgrade() {
-                let _ = r.tell(OnApprovalTimeout {}).await;
-            }
-        });
-
         Ok(this)
     }
 
@@ -114,14 +104,4 @@ impl ClientApprovalController {
             ctx.stop();
         }
     }
-
-    /// Fired after `APPROVAL_TIMEOUT` elapses. Any operator that hasn't responded
-    /// by then is treated as a denial to prevent zombie sessions from blocking the flow.
-    #[message(ctx)]
-    pub fn on_approval_timeout(&mut self, ctx: &mut Context<Self, ()>) {
-        if self.pending > 0 {
-            self.send_reply(Ok(false));
-            ctx.stop();
-        }
-    }
 }

server/crates/arbiter-server/src/actors/mod.rs

@@ -1,7 +1,8 @@
 use crate::{
     actors::{
         bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
-        operator_registry::OperatorRegistry, vault::Vault,
+        operator_registry::OperatorRegistry, proposal_manager::ProposalManager, vault::Vault,
+        vault_coordinator::VaultCoordinator,
     },
     db,
 };
@@ -14,7 +15,9 @@ pub mod bootstrap;
 pub mod evm;
 pub mod flow_coordinator;
 pub mod operator_registry;
+pub mod proposal_manager;
 pub mod vault;
+pub mod vault_coordinator;
 
 #[derive(Error, Debug)]
 pub enum SpawnError {
@@ -30,9 +33,11 @@ pub enum SpawnError {
 pub struct GlobalActors {
     pub vault: ActorRef<Vault>,
     pub bootstrapper: ActorRef<Bootstrapper>,
+    pub vault_coordinator: ActorRef<VaultCoordinator>,
     pub flow_coordinator: ActorRef<FlowCoordinator>,
     pub operator_registry: ActorRef<OperatorRegistry>,
     pub evm: ActorRef<EvmActor>,
+    pub proposal_manager: ActorRef<ProposalManager>,
     pub events: ActorRef<MessageBus>,
 }
 
@@ -45,15 +50,25 @@ impl GlobalActors {
         let message_bus = Self::spawn_message_bus();
         let key_holder = Vault::spawn(Vault::new(db.clone(), message_bus.clone()).await?);
         let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default());
+        let evm = EvmActor::spawn(EvmActor::new(key_holder.clone(), db.clone()));
         Ok(Self {
             bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
-            evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db)),
+            vault_coordinator: VaultCoordinator::spawn(VaultCoordinator::new(
+                db.clone(),
+                key_holder.clone(),
+            )),
+            proposal_manager: ProposalManager::spawn(ProposalManager::new(
+                db,
+                key_holder.clone(),
+                evm.clone(),
+            )),
             vault: key_holder,
             flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::new(
                 operator_registry.clone(),
             )),
             operator_registry,
             events: message_bus,
+            evm,
         })
     }
 }

server/crates/arbiter-server/src/actors/proposal_manager.rs

@@ -0,0 +1,678 @@
+use crate::{
+    actors::{evm::EvmActor, vault::Vault},
+    db::{
+        self,
+        models::{NewProposal, NewProposalVote, Proposal, ProposalStatus, SqliteTimestamp},
+        schema,
+    },
+};
+use chrono::Utc;
+use diesel::{ExpressionMethods as _, QueryDsl};
+use diesel_async::RunQueryDsl;
+use kameo::{actor::ActorRef, messages};
+use tracing::{error, warn};
+
+pub const DEFAULT_TTL_SECS: i64 = 7 * 24 * 60 * 60; // 7 days
+
+#[derive(Debug, Clone)]
+pub enum ProposalKind {
+    ApproveSdkClient { client_id: i32 },
+    GrantWalletAccess { wallet_id: i32, client_id: i32 },
+    ApproveServerUpdate,
+    ReplaceOperator { new_pubkey: Vec<u8> },
+    UpdateShamirParameters { new_n: u8 },
+    ApprovePersistentGrant { payload_bytes: Vec<u8> },
+    ApproveOneOffTransaction { payload_bytes: Vec<u8> },
+}
+
+impl ProposalKind {
+    pub const fn kind_str(&self) -> &'static str {
+        match self {
+            Self::ApproveSdkClient { .. } => "approve_sdk_client",
+            Self::GrantWalletAccess { .. } => "grant_wallet_access",
+            Self::ApproveServerUpdate => "approve_server_update",
+            Self::ReplaceOperator { .. } => "replace_operator",
+            Self::UpdateShamirParameters { .. } => "update_shamir_parameters",
+            Self::ApprovePersistentGrant { .. } => "approve_persistent_grant",
+            Self::ApproveOneOffTransaction { .. } => "approve_one_off_transaction",
+        }
+    }
+
+    pub fn encode_payload(&self) -> Vec<u8> {
+        match self {
+            Self::ApproveSdkClient { client_id } => client_id.to_be_bytes().to_vec(),
+            Self::GrantWalletAccess {
+                wallet_id,
+                client_id,
+            } => {
+                let mut buf = Vec::with_capacity(8);
+                buf.extend_from_slice(&wallet_id.to_be_bytes());
+                buf.extend_from_slice(&client_id.to_be_bytes());
+                buf
+            }
+            Self::ApproveServerUpdate => vec![],
+            Self::ReplaceOperator { new_pubkey } => {
+                let len = u32::try_from(new_pubkey.len()).expect("pubkey len fits in u32");
+                let mut buf = Vec::with_capacity(4 + new_pubkey.len());
+                buf.extend_from_slice(&len.to_be_bytes());
+                buf.extend_from_slice(new_pubkey);
+                buf
+            }
+            Self::UpdateShamirParameters { new_n } => vec![*new_n],
+            Self::ApprovePersistentGrant { payload_bytes } => payload_bytes.clone(),
+            Self::ApproveOneOffTransaction { payload_bytes } => payload_bytes.clone(),
+        }
+    }
+
+    pub fn decode(kind: &str, payload: &[u8]) -> Result<Self, String> {
+        match kind {
+            "approve_sdk_client" => {
+                let bytes = <[u8; 4]>::try_from(payload)
+                    .map_err(|_| "invalid payload for approve_sdk_client".to_owned())?;
+                Ok(Self::ApproveSdkClient {
+                    client_id: i32::from_be_bytes(bytes),
+                })
+            }
+            "grant_wallet_access" => {
+                let bytes = <[u8; 8]>::try_from(payload)
+                    .map_err(|_| "invalid payload for grant_wallet_access".to_owned())?;
+                Ok(Self::GrantWalletAccess {
+                    wallet_id: i32::from_be_bytes(bytes[..4].try_into().unwrap()),
+                    client_id: i32::from_be_bytes(bytes[4..].try_into().unwrap()),
+                })
+            }
+            "approve_server_update" => Ok(Self::ApproveServerUpdate),
+            "replace_operator" => {
+                let (len_bytes, rest) = payload
+                    .split_first_chunk::<4>()
+                    .ok_or_else(|| "replace_operator payload too short".to_owned())?;
+                let len = u32::from_be_bytes(*len_bytes);
+                let len = usize::try_from(len).unwrap_or(usize::MAX);
+                let new_pubkey = rest
+                    .get(..len)
+                    .ok_or_else(|| "replace_operator payload truncated".to_owned())?
+                    .to_vec();
+                Ok(Self::ReplaceOperator { new_pubkey })
+            }
+            "update_shamir_parameters" => {
+                let &[new_n] = payload else {
+                    return Err("invalid payload for update_shamir_parameters".to_owned());
+                };
+                Ok(Self::UpdateShamirParameters { new_n })
+            }
+            "approve_persistent_grant" => Ok(Self::ApprovePersistentGrant {
+                payload_bytes: payload.to_vec(),
+            }),
+            "approve_one_off_transaction" => Ok(Self::ApproveOneOffTransaction {
+                payload_bytes: payload.to_vec(),
+            }),
+            other => Err(format!("unknown proposal kind: {other}")),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum VoteOutcome {
+    Pending,
+    QuorumApproved,
+    QuorumRejected,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("Proposal not found")]
+    ProposalNotFound,
+    #[error("Proposal is not pending")]
+    ProposalNotPending,
+    #[error("Operator already voted on this proposal")]
+    AlreadyVoted,
+    #[error("Invalid vote signature")]
+    InvalidSignature,
+    #[error("Operator not found")]
+    OperatorNotFound,
+    #[error("Database connection error: {0}")]
+    DatabaseConnection(#[from] db::PoolError),
+    #[error("Database query error: {0}")]
+    DatabaseQuery(#[from] diesel::result::Error),
+    #[error("Execution failed: {0}")]
+    ExecutionFailed(String),
+}
+
+#[derive(Debug)]
+pub struct ProposalSummary {
+    pub id: i32,
+    pub kind: String,
+    pub initiator_id: i32,
+    pub expires_at: SqliteTimestamp,
+    pub approve_count: i64,
+    pub reject_count: i64,
+}
+
+pub struct ProposalManager {
+    pub(crate) db: db::DatabasePool,
+    pub(crate) vault: ActorRef<Vault>,
+    pub(crate) evm: ActorRef<EvmActor>,
+}
+
+impl ProposalManager {
+    pub const fn new(
+        db: db::DatabasePool,
+        vault: ActorRef<Vault>,
+        evm: ActorRef<EvmActor>,
+    ) -> Self {
+        Self { db, vault, evm }
+    }
+}
+
+impl kameo::Actor for ProposalManager {
+    type Args = Self;
+    type Error = ();
+
+    async fn on_start(args: Self::Args, actor_ref: ActorRef<Self>) -> Result<Self, Self::Error> {
+        let weak = actor_ref.downgrade();
+        tokio::spawn(async move {
+            loop {
+                tokio::time::sleep(tokio::time::Duration::from_hours(1)).await;
+                match weak.upgrade() {
+                    Some(r) => {
+                        let _ = r.ask(ExpireStale).await;
+                    }
+                    None => break,
+                }
+            }
+        });
+        Ok(args)
+    }
+}
+
+#[messages]
+impl ProposalManager {
+    #[message]
+    pub async fn create_proposal(
+        &mut self,
+        kind: ProposalKind,
+        initiator_id: i32,
+        ttl_secs: Option<i64>,
+    ) -> Result<i32, Error> {
+        let ttl = ttl_secs.unwrap_or(DEFAULT_TTL_SECS);
+        let expires_at = SqliteTimestamp::from(Utc::now() + chrono::Duration::seconds(ttl));
+
+        let new_proposal = NewProposal {
+            kind: kind.kind_str().to_owned(),
+            payload: kind.encode_payload(),
+            initiator_id,
+            expires_at,
+        };
+
+        let mut conn = self.db.get().await?;
+        let id: i32 = diesel::insert_into(schema::proposal::table)
+            .values(&new_proposal)
+            .returning(schema::proposal::id)
+            .get_result(&mut conn)
+            .await?;
+
+        Ok(id)
+    }
+
+    #[message]
+    pub async fn query_pending(&mut self, operator_id: i32) -> Vec<ProposalSummary> {
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::as_conversions,
+            reason = "fixme! #84; this will break in 2038"
+        )]
+        let now_ts = Utc::now().timestamp() as i32;
+
+        let Ok(mut conn) = self.db.get().await else {
+            warn!("query_pending: failed to acquire DB connection");
+            return vec![];
+        };
+
+        let voted_ids: Vec<i32> = schema::proposal_vote::table
+            .filter(schema::proposal_vote::operator_id.eq(operator_id))
+            .select(schema::proposal_vote::proposal_id)
+            .load(&mut conn)
+            .await
+            .unwrap_or_default();
+
+        let proposals: Vec<Proposal> = schema::proposal::table
+            .filter(schema::proposal::status.eq(ProposalStatus::Pending))
+            .filter(schema::proposal::expires_at.gt(now_ts))
+            .filter(diesel::dsl::not(schema::proposal::id.eq_any(&voted_ids)))
+            .load(&mut conn)
+            .await
+            .unwrap_or_default();
+
+        let mut summaries = Vec::with_capacity(proposals.len());
+        for p in proposals {
+            let approve_count: i64 = schema::proposal_vote::table
+                .filter(schema::proposal_vote::proposal_id.eq(p.id))
+                .filter(schema::proposal_vote::approve.eq(true))
+                .count()
+                .get_result(&mut conn)
+                .await
+                .unwrap_or(0);
+            let reject_count: i64 = schema::proposal_vote::table
+                .filter(schema::proposal_vote::proposal_id.eq(p.id))
+                .filter(schema::proposal_vote::approve.eq(false))
+                .count()
+                .get_result(&mut conn)
+                .await
+                .unwrap_or(0);
+            summaries.push(ProposalSummary {
+                id: p.id,
+                kind: p.kind,
+                initiator_id: p.initiator_id,
+                expires_at: p.expires_at,
+                approve_count,
+                reject_count,
+            });
+        }
+        summaries
+    }
+
+    #[message]
+    pub async fn expire_stale(&mut self) -> usize {
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::as_conversions,
+            reason = "fixme! #84; this will break in 2038"
+        )]
+        let now_ts = Utc::now().timestamp() as i32;
+
+        let Ok(mut conn) = self.db.get().await else {
+            warn!("expire_stale: failed to acquire DB connection");
+            return 0;
+        };
+
+        diesel::update(schema::proposal::table)
+            .filter(schema::proposal::status.eq(ProposalStatus::Pending))
+            .filter(schema::proposal::expires_at.lt(now_ts))
+            .set(schema::proposal::status.eq(ProposalStatus::Expired))
+            .execute(&mut conn)
+            .await
+            .unwrap_or(0)
+    }
+
+    #[message]
+    pub async fn cast_vote(
+        &mut self,
+        proposal_id: i32,
+        operator_id: i32,
+        approve: bool,
+        signature: Vec<u8>,
+    ) -> Result<VoteOutcome, Error> {
+        use arbiter_crypto::authn::{self, GOVERNANCE_CONTEXT};
+
+        let mut conn = self.db.get().await?;
+
+        // Load proposal — must exist
+        let proposal: Proposal = schema::proposal::table
+            .find(proposal_id)
+            .first(&mut conn)
+            .await
+            .map_err(|e| match e {
+                diesel::result::Error::NotFound => Error::ProposalNotFound,
+                other => Error::DatabaseQuery(other),
+            })?;
+
+        // Check for duplicate vote before status check so AlreadyVoted takes priority
+        let existing: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::proposal_vote::operator_id.eq(operator_id))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        if existing > 0 {
+            return Err(Error::AlreadyVoted);
+        }
+
+        if proposal.status != ProposalStatus::Pending {
+            return Err(Error::ProposalNotPending);
+        }
+
+        // Load operator public key from operator_identity
+        let pubkey_bytes: Vec<u8> = schema::operator_identity::table
+            .find(operator_id)
+            .select(schema::operator_identity::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(|e| match e {
+                diesel::result::Error::NotFound => Error::OperatorNotFound,
+                other => Error::DatabaseQuery(other),
+            })?;
+
+        let pubkey = authn::PublicKey::try_from(pubkey_bytes.as_slice())
+            .map_err(|()| Error::InvalidSignature)?;
+
+        // Canonical vote message: proposal_id (i64 big-endian) || approve (u8)
+        let mut vote_msg = Vec::with_capacity(9);
+        vote_msg.extend_from_slice(&i64::from(proposal_id).to_be_bytes());
+        vote_msg.push(u8::from(approve));
+
+        let auth_sig = authn::Signature::try_from(signature.as_slice())
+            .map_err(|()| Error::InvalidSignature)?;
+
+        if !pubkey.verify_message(&vote_msg, GOVERNANCE_CONTEXT, &auth_sig) {
+            return Err(Error::InvalidSignature);
+        }
+
+        // Insert vote
+        diesel::insert_into(schema::proposal_vote::table)
+            .values(&NewProposalVote {
+                proposal_id,
+                operator_id,
+                approve,
+                signature,
+            })
+            .execute(&mut conn)
+            .await?;
+
+        // Quorum check
+        let total_operators: i64 = schema::operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::cast_sign_loss,
+            clippy::as_conversions,
+            reason = "operator count is always a small positive integer"
+        )]
+        let threshold = crate::crypto::shamir::shamir_threshold(total_operators as usize);
+
+        let approve_count: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::proposal_vote::approve.eq(true))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+
+        let reject_count: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::proposal_vote::approve.eq(false))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+
+        #[expect(
+            clippy::cast_possible_wrap,
+            clippy::as_conversions,
+            reason = "threshold is derived from operator count, always fits i64"
+        )]
+        let threshold_i64 = threshold as i64;
+
+        if approve_count >= threshold_i64 {
+            diesel::update(schema::proposal::table.find(proposal_id))
+                .set(schema::proposal::status.eq(ProposalStatus::Approved))
+                .execute(&mut conn)
+                .await?;
+            drop(conn); // release connection before async execution
+            self.execute_proposal(&proposal).await?;
+            return Ok(VoteOutcome::QuorumApproved);
+        }
+
+        if reject_count > total_operators - threshold_i64 {
+            diesel::update(schema::proposal::table.find(proposal_id))
+                .set(schema::proposal::status.eq(ProposalStatus::Rejected))
+                .execute(&mut conn)
+                .await?;
+            return Ok(VoteOutcome::QuorumRejected);
+        }
+
+        Ok(VoteOutcome::Pending)
+    }
+}
+
+impl ProposalManager {
+    async fn execute_proposal(&self, proposal: &Proposal) -> Result<(), Error> {
+        let kind = ProposalKind::decode(&proposal.kind, &proposal.payload)
+            .map_err(Error::ExecutionFailed)?;
+        match kind {
+            ProposalKind::ApproveSdkClient { client_id } => {
+                self.execute_approve_sdk_client(client_id).await
+            }
+            ProposalKind::GrantWalletAccess {
+                wallet_id,
+                client_id,
+            } => self.execute_grant_wallet_access(wallet_id, client_id).await,
+            ProposalKind::ApproveServerUpdate => Ok(()),
+            ProposalKind::ReplaceOperator { new_pubkey } => {
+                self.execute_replace_operator(new_pubkey).await
+            }
+            ProposalKind::UpdateShamirParameters { new_n } => {
+                self.execute_update_shamir_parameters(new_n)
+            }
+            ProposalKind::ApprovePersistentGrant { payload_bytes } => {
+                self.execute_approve_persistent_grant(payload_bytes).await
+            }
+            ProposalKind::ApproveOneOffTransaction { payload_bytes } => {
+                self.execute_approve_one_off_transaction(proposal.id, payload_bytes)
+                    .await
+            }
+        }
+    }
+
+    async fn execute_grant_wallet_access(
+        &self,
+        wallet_id: i32,
+        client_id: i32,
+    ) -> Result<(), Error> {
+        use crate::db::models::EvmWalletId;
+
+        let mut conn = self.db.get().await.map_err(Error::DatabaseConnection)?;
+
+        diesel::insert_into(schema::evm_wallet_access::table)
+            .values((
+                schema::evm_wallet_access::wallet_id.eq(EvmWalletId::from_raw(wallet_id)),
+                schema::evm_wallet_access::client_id.eq(client_id),
+            ))
+            .execute(&mut conn)
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("grant wallet access: {e}")))?;
+
+        Ok(())
+    }
+
+    async fn execute_replace_operator(&self, new_pubkey: Vec<u8>) -> Result<(), Error> {
+        let mut conn = self.db.get().await.map_err(Error::DatabaseConnection)?;
+        diesel::insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(&new_pubkey))
+            .execute(&mut conn)
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("replace operator: {e}")))?;
+        Ok(())
+    }
+
+    #[expect(
+        clippy::unused_self,
+        clippy::unnecessary_wraps,
+        reason = "signature must match other execute_* methods"
+    )]
+    fn execute_update_shamir_parameters(&self, new_n: u8) -> Result<(), Error> {
+        warn!(
+            new_n,
+            "UpdateShamirParameters approved; Shamir re-keying must be performed out-of-band"
+        );
+        Ok(())
+    }
+
+    async fn execute_approve_one_off_transaction(
+        &self,
+        proposal_id: i32,
+        payload_bytes: Vec<u8>,
+    ) -> Result<(), Error> {
+        use crate::actors::evm::ClientSignTransaction;
+        use crate::db::models::NewProposalResult;
+        use alloy::{
+            consensus::TxEip1559,
+            eips::eip2930::AccessList,
+            primitives::{Address, Bytes, TxKind, U256},
+        };
+        use arbiter_proto::proto::operator::governance::ApproveOneOffTransactionPayload;
+        use prost::Message as _;
+
+        let p = ApproveOneOffTransactionPayload::decode(payload_bytes.as_slice())
+            .map_err(|e| Error::ExecutionFailed(format!("decode one-off tx payload: {e}")))?;
+
+        let wallet_address = Address::from_slice(p.wallet_address.as_slice());
+        let to = Address::from_slice(p.to.as_slice());
+
+        let transaction = TxEip1559 {
+            chain_id: p.chain_id,
+            nonce: p.nonce,
+            gas_limit: p.gas_limit,
+            max_fee_per_gas: u128::from_be_bytes(
+                p.max_fee_per_gas
+                    .as_slice()
+                    .try_into()
+                    .map_err(|_| Error::ExecutionFailed("invalid max_fee_per_gas".to_owned()))?,
+            ),
+            max_priority_fee_per_gas: u128::from_be_bytes(
+                p.max_priority_fee_per_gas
+                    .as_slice()
+                    .try_into()
+                    .map_err(|_| {
+                        Error::ExecutionFailed("invalid max_priority_fee_per_gas".to_owned())
+                    })?,
+            ),
+            to: TxKind::Call(to),
+            value: U256::from_be_slice(p.value.as_slice()),
+            input: Bytes::from(p.input),
+            access_list: AccessList::default(),
+        };
+
+        let sig = self
+            .evm
+            .ask(ClientSignTransaction {
+                client_id: p.client_id,
+                wallet_address,
+                transaction,
+            })
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("sign one-off tx: {e}")))?;
+
+        let mut conn = self.db.get().await.map_err(Error::DatabaseConnection)?;
+        diesel::insert_into(schema::proposal_result::table)
+            .values(NewProposalResult {
+                proposal_id,
+                data: sig.as_bytes().to_vec(),
+            })
+            .execute(&mut conn)
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("store proposal result: {e}")))?;
+
+        Ok(())
+    }
+
+    async fn execute_approve_persistent_grant(&self, payload_bytes: Vec<u8>) -> Result<(), Error> {
+        use crate::{
+            actors::evm::OperatorCreateGrant,
+            evm::policies::{
+                SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit,
+                ether_transfer, token_transfers,
+            },
+        };
+        use alloy::primitives::{Address, U256};
+        use arbiter_proto::proto::operator::governance::{
+            ApprovePersistentGrantPayload, approve_persistent_grant_payload::Specific,
+        };
+        use chrono::Duration;
+        use prost::Message as _;
+
+        let payload = ApprovePersistentGrantPayload::decode(payload_bytes.as_slice())
+            .map_err(|e| Error::ExecutionFailed(format!("decode grant payload: {e}")))?;
+
+        let basic = SharedGrantSettings {
+            wallet_access_id: payload.wallet_access_id,
+            chain: payload.chain_id,
+            valid_from: payload
+                .valid_from_secs
+                .and_then(|s| chrono::DateTime::from_timestamp(s, 0)),
+            valid_until: payload
+                .valid_until_secs
+                .and_then(|s| chrono::DateTime::from_timestamp(s, 0)),
+            max_gas_fee_per_gas: payload
+                .max_gas_fee_per_gas
+                .map(|b| U256::from_be_slice(b.as_slice())),
+            max_priority_fee_per_gas: payload
+                .max_priority_fee_per_gas
+                .map(|b| U256::from_be_slice(b.as_slice())),
+            rate_limit: payload.rate_limit.map(|r| TransactionRateLimit {
+                count: r.count,
+                window: Duration::seconds(r.window_secs),
+            }),
+        };
+
+        let grant = match payload.specific {
+            Some(Specific::EtherTransfer(spec)) => {
+                let target: Vec<Address> = spec
+                    .targets
+                    .iter()
+                    .map(|b| Address::from_slice(b.as_slice()))
+                    .collect();
+                let limit = spec
+                    .limit
+                    .map(|l| VolumeRateLimit {
+                        max_volume: U256::from_be_slice(l.max_volume.as_slice()),
+                        window: Duration::seconds(l.window_secs),
+                    })
+                    .ok_or_else(|| {
+                        Error::ExecutionFailed("missing ether transfer limit".to_owned())
+                    })?;
+                SpecificGrant::EtherTransfer(ether_transfer::Settings { target, limit })
+            }
+            Some(Specific::TokenTransfer(spec)) => {
+                let token_contract = Address::from_slice(spec.token_contract.as_slice());
+                let target = spec.target.map(|b| Address::from_slice(b.as_slice()));
+                let volume_limits: Vec<VolumeRateLimit> = spec
+                    .volume_limits
+                    .iter()
+                    .map(|l| VolumeRateLimit {
+                        max_volume: U256::from_be_slice(l.max_volume.as_slice()),
+                        window: Duration::seconds(l.window_secs),
+                    })
+                    .collect();
+                SpecificGrant::TokenTransfer(token_transfers::Settings {
+                    token_contract,
+                    target,
+                    volume_limits,
+                })
+            }
+            None => return Err(Error::ExecutionFailed("missing grant specific".to_owned())),
+        };
+
+        self.evm
+            .ask(OperatorCreateGrant { basic, grant })
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("create grant: {e}")))?;
+
+        Ok(())
+    }
+
+    async fn execute_approve_sdk_client(&self, client_id: i32) -> Result<(), Error> {
+        use crate::{crypto::integrity, peers::client::ClientCredentials};
+        use arbiter_crypto::authn;
+
+        let mut conn = self.db.get().await.map_err(Error::DatabaseConnection)?;
+
+        let pubkey_bytes: Vec<u8> = schema::program_client::table
+            .find(client_id)
+            .select(schema::program_client::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("client not found: {e}")))?;
+
+        let pubkey = authn::PublicKey::try_from(pubkey_bytes.as_slice())
+            .map_err(|()| Error::ExecutionFailed("invalid client public key".to_owned()))?;
+
+        let creds = ClientCredentials { pubkey };
+
+        integrity::sign_entity(&mut conn, &self.vault, &creds, client_id)
+            .await
+            .map_err(|e| {
+                error!(?e, "Failed to sign integrity envelope for client");
+                Error::ExecutionFailed(e.to_string())
+            })
+    }
+}

server/crates/arbiter-server/src/actors/vault/mod.rs

@@ -1,13 +1,13 @@
 use crate::{
     crypto::{
-        KeyCell, derive_key,
+        KeyCell,
         encryption::v1::{self, Nonce},
         integrity::v1::HmacSha256,
     },
     db::{
         self,
-        models::{self, RootKeyHistory},
-        schema::{self},
+        models::{self, RootKeyHistory, RootKeyHistoryId},
+        schema,
     },
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
@@ -25,7 +25,6 @@ use strum::{EnumDiscriminants, IntoDiscriminant};
 use tracing::{error, info};
 
 pub mod events {
-
     #[derive(Clone, Copy)]
     pub struct Bootstrapped;
 
@@ -64,7 +63,7 @@ pub enum Error {
 }
 
 struct Unsealed {
-    root_key_history_id: i32,
+    root_key_history_id: RootKeyHistoryId,
     root_key: KeyCell,
 }
 
@@ -73,8 +72,9 @@ struct Unsealed {
 enum State {
     #[default]
     Unbootstrapped,
+
     Sealed {
-        root_key_history_id: i32,
+        root_key_history_id: RootKeyHistoryId,
     },
     Unsealed(Unsealed),
 }
@@ -90,7 +90,6 @@ pub struct Vault {
     events: ActorRef<MessageBus>,
 }
 
-#[messages]
 impl Vault {
     pub async fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Result<Self, Error> {
         let state = {
@@ -113,9 +112,12 @@ impl Vault {
         Ok(Self { db, state, events })
     }
 
-    // Exclusive transaction to avoid race condtions if multiple vaults write
+    // Exclusive transaction to avoid race conditions if multiple vaults write
     // additional layer of protection against nonce-reuse
-    async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> {
+    async fn get_new_nonce(
+        pool: &db::DatabasePool,
+        root_key_id: RootKeyHistoryId,
+    ) -> Result<Nonce, Error> {
         let mut conn = pool.get().await?;
 
         let nonce = conn
@@ -128,7 +130,7 @@ impl Vault {
 
                 let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
                     error!(
-                        "Broken database: invalid nonce for root key history id={}",
+                        "Broken database: invalid nonce for root key history id={:#?}",
                         root_key_id
                     );
                     Error::BrokenDatabase
@@ -155,43 +157,47 @@ impl Vault {
             State::Sealed { .. } => Err(Error::Sealed),
         }
     }
+}
 
+#[messages]
+impl Vault {
     #[message]
-    pub async fn bootstrap(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
-        if !matches!(self.state, State::Unbootstrapped) {
+    pub async fn bootstrap(&mut self, mut seal_key: KeyCell) -> Result<(), Error> {
+        if !matches!(&self.state, State::Unbootstrapped) {
             return Err(Error::AlreadyBootstrapped);
         }
-        let salt = v1::generate_salt();
-        let mut seal_key = derive_key(seal_key_raw, &salt);
+
         let mut root_key = KeyCell::new_secure_random();
 
         // Zero nonces are fine because they are one-time
         let root_key_nonce = Nonce::default();
         let data_encryption_nonce = Nonce::default();
 
-        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|reader| {
-            let root_key_reader = reader.as_slice();
+        // Generate salt (kept for schema compat)
+        let root_key_salt = v1::generate_salt();
+
+        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|rk| {
             seal_key
-                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader)
+                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, rk.as_slice())
                 .map_err(|err| {
                     error!(?err, "Fatal bootstrap error");
                     Error::Encryption(err)
                 })
         })?;
 
+        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
         let mut conn = self.db.get().await?;
 
-        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
         let root_key_history_id = conn
             .transaction(async |conn| {
-                let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
+                let root_key_history_id = insert_into(schema::root_key_history::table)
                     .values(&models::NewRootKeyHistory {
                         ciphertext: root_key_ciphertext.clone(),
                         tag: v1::ROOT_KEY_TAG.to_vec(),
                         root_key_encryption_nonce: root_key_nonce.to_vec(),
                         data_encryption_nonce: data_encryption_nonce_bytes.clone(),
                         schema_version: 1,
-                        salt: salt.to_vec(),
+                        salt: root_key_salt.to_vec(),
                     })
                     .returning(schema::root_key_history::id)
                     .get_result(&mut *conn)
@@ -202,7 +208,9 @@ impl Vault {
                     .execute(&mut *conn)
                     .await?;
 
-                Result::<_, diesel::result::Error>::Ok(root_key_history_id)
+                Result::<_, diesel::result::Error>::Ok(RootKeyHistoryId::from_raw(
+                    root_key_history_id,
+                ))
             })
             .await?;
 
@@ -218,52 +226,47 @@ impl Vault {
     }
 
     #[message]
-    pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
+    pub async fn try_unseal(&mut self, mut seal_key: KeyCell) -> Result<(), Error> {
         let State::Sealed {
             root_key_history_id,
         } = &self.state
         else {
             return Err(Error::NotBootstrapped);
         };
+        let root_key_history_id = *root_key_history_id;
 
-        // We don't want to hold connection while doing expensive KDF work
+        // We don't want to hold connection while doing expensive work
         let current_key = {
             let mut conn = self.db.get().await?;
             schema::root_key_history::table
-                .filter(schema::root_key_history::id.eq(*root_key_history_id))
+                .filter(schema::root_key_history::id.eq(root_key_history_id))
                 .select(RootKeyHistory::as_select())
                 .first(&mut conn)
                 .await?
         };
 
-        let salt = &current_key.salt;
-        let salt = v1::Salt::try_from(salt.as_slice()).map_err(|_| {
-            error!("Broken database: invalid salt for root key");
-            Error::BrokenDatabase
-        })?;
-        let mut seal_key = derive_key(seal_key_raw, &salt);
-
-        let mut root_key = SafeCell::new(current_key.ciphertext.clone());
-
         let nonce =
             Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(|()| {
                 error!("Broken database: invalid nonce for root key");
                 Error::BrokenDatabase
             })?;
 
+        let mut root_key_bytes = SafeCell::new(current_key.ciphertext.clone());
         seal_key
-            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
+            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key_bytes)
             .map_err(|err| {
                 error!(?err, "Failed to unseal root key: invalid seal key");
                 Error::InvalidKey
             })?;
 
+        let root_key = KeyCell::try_from(root_key_bytes).map_err(|()| {
+            error!("Broken database: invalid encryption key size");
+            Error::BrokenDatabase
+        })?;
+
         self.state = State::Unsealed(Unsealed {
             root_key_history_id: current_key.id,
-            root_key: KeyCell::try_from(root_key).map_err(|err| {
-                error!(?err, "Broken database: invalid encryption key size");
-                Error::BrokenDatabase
-            })?,
+            root_key,
         });
 
         info!("Vault unsealed successfully");
@@ -272,6 +275,24 @@ impl Vault {
         Ok(())
     }
 
+    #[message]
+    pub async fn seal(&mut self) -> Result<(), Error> {
+        let Unsealed {
+            root_key_history_id,
+            ..
+        } = Self::expect_unsealed(&mut self.state)?;
+
+        self.state = State::Sealed {
+            root_key_history_id: *root_key_history_id,
+        };
+        let _ = self.events.tell(Publish(events::VaultResealed)).await;
+        Ok(())
+    }
+}
+
+// Server-side cryptographic operations
+#[messages]
+impl Vault {
     #[message]
     pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
         let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?;
@@ -340,7 +361,10 @@ impl Vault {
     }
 
     #[message]
-    pub fn sign_integrity(&mut self, mac_input: Vec<u8>) -> Result<(i32, Vec<u8>), Error> {
+    pub fn sign_integrity(
+        &mut self,
+        mac_input: Vec<u8>,
+    ) -> Result<(RootKeyHistoryId, Vec<u8>), Error> {
         let Unsealed {
             root_key,
             root_key_history_id,
@@ -350,7 +374,7 @@ impl Vault {
             HmacSha256::new_from_slice(k)
                 .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
         });
-        hmac.update(&root_key_history_id.to_be_bytes());
+        hmac.update(&root_key_history_id.to_raw().to_be_bytes());
         hmac.update(&mac_input);
 
         let mac = hmac.finalize().into_bytes().to_vec();
@@ -362,7 +386,7 @@ impl Vault {
         &mut self,
         mac_input: Vec<u8>,
         expected_mac: Vec<u8>,
-        key_version: i32,
+        key_version: RootKeyHistoryId,
     ) -> Result<bool, Error> {
         let Unsealed {
             root_key,
@@ -377,25 +401,11 @@ impl Vault {
             HmacSha256::new_from_slice(k)
                 .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
         });
-        hmac.update(&key_version.to_be_bytes());
+        hmac.update(&key_version.to_raw().to_be_bytes());
         hmac.update(&mac_input);
 
         Ok(hmac.verify_slice(&expected_mac).is_ok())
     }
-
-    #[message]
-    pub async fn seal(&mut self) -> Result<(), Error> {
-        let Unsealed {
-            root_key_history_id,
-            ..
-        } = Self::expect_unsealed(&mut self.state)?;
-
-        self.state = State::Sealed {
-            root_key_history_id: *root_key_history_id,
-        };
-        let _ = self.events.tell(Publish(events::VaultResealed)).await;
-        Ok(())
-    }
 }
 
 #[cfg(test)]
@@ -409,8 +419,7 @@ mod tests {
         let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
             .await
             .unwrap();
-        let seal_key = SafeCell::new(b"test-seal-key".to_vec());
-        actor.bootstrap(seal_key).await.unwrap();
+        actor.bootstrap(KeyCell::from([0u8; 32])).await.unwrap();
         actor
     }
 
@@ -419,13 +428,12 @@ mod tests {
     async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
         let db = db::create_test_pool().await;
         let mut actor = bootstrapped_actor(&db).await;
-
         let State::Unsealed(Unsealed {
             root_key_history_id,
             ..
         }) = actor.state
         else {
-            panic!("expected unsealed state")
+            panic!("expected unsealed state");
         };
 
         let n1 = Vault::get_new_nonce(&db, root_key_history_id)

server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs

@@ -0,0 +1,303 @@
+use std::collections::HashMap;
+
+use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+use diesel::{ExpressionMethods as _, QueryDsl};
+use diesel_async::RunQueryDsl;
+use kameo::{Actor, actor::ActorRef, messages};
+use rand_core::{OsRng, RngCore as _};
+use tracing::error;
+
+use crate::{
+    actors::vault::{Bootstrap, TryUnseal, Vault},
+    crypto::{KeyCell, derive_key, encryption::v1::Nonce, shamir, shamir::shamir_threshold},
+    db::{self, models, schema},
+};
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("Already coordinating a bootstrap")]
+    AlreadyBootstrapping,
+    #[error("Already coordinating an unseal")]
+    AlreadyUnsealing,
+    #[error("Bootstrap not in progress")]
+    NotBootstrapping,
+    #[error("Unseal not in progress")]
+    NotUnsealing,
+    #[error("Operator already contributed")]
+    DuplicateContribution,
+    #[error("Operator not found in database")]
+    OperatorNotFound,
+    #[error("Invalid passphrase (decryption failed)")]
+    InvalidPassphrase,
+    #[error("Shamir error: {0}")]
+    Shamir(String),
+    #[error("Database connection error: {0}")]
+    DatabaseConnection(#[from] db::PoolError),
+    #[error("Database query error: {0}")]
+    DatabaseQuery(#[from] diesel::result::Error),
+    #[error("Encryption error")]
+    Encryption,
+    #[error("Vault error")]
+    VaultError,
+    #[error("Broken database")]
+    BrokenDatabase,
+}
+
+// Passphrases stored as plain Vec<u8> (not SafeCell) so CoordinatorState is Sync.
+// They are ephemeral and dropped immediately after use.
+enum CoordinatorState {
+    Idle,
+    Bootstrapping {
+        declared_count: usize,
+        passphrases: HashMap<i32, Vec<u8>>,
+    },
+    Unsealing {
+        threshold: usize,
+        passphrases: HashMap<i32, Vec<u8>>,
+    },
+}
+
+#[derive(Actor)]
+pub struct VaultCoordinator {
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    state: CoordinatorState,
+}
+
+impl VaultCoordinator {
+    pub const fn new(db: db::DatabasePool, vault: ActorRef<Vault>) -> Self {
+        Self {
+            db,
+            vault,
+            state: CoordinatorState::Idle,
+        }
+    }
+}
+
+const SHARE_AAD: &[u8] = b"arbiter/shamir-share/v1";
+
+async fn finalize_bootstrap(
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    passphrases: HashMap<i32, Vec<u8>>,
+) -> Result<(), Error> {
+    let total = passphrases.len();
+    let threshold = shamir_threshold(total);
+
+    // Generate random 32-byte seal key
+    let mut seal_key_bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut seal_key_bytes);
+
+    // Split seal key into shares using Shamir (OsRng from rand_core 0.6, compatible with vsss-rs)
+    let shares = shamir::split_key(threshold, total, &seal_key_bytes, OsRng)
+        .map_err(|e| Error::Shamir(e.to_string()))?;
+
+    let seal_key = KeyCell::from(seal_key_bytes);
+
+    let mut conn = db.get().await?;
+
+    for ((operator_id_raw, passphrase_bytes), share) in passphrases.into_iter().zip(shares) {
+        // Generate a fresh share_salt for this operator
+        let mut share_salt = vec![0u8; 32];
+        OsRng.fill_bytes(&mut share_salt);
+
+        // Derive share encryption key from passphrase + salt
+        let mut passphrase_cell = SafeCell::new(passphrase_bytes);
+        let mut share_seal_key = derive_key(&mut passphrase_cell, &share_salt);
+
+        // Encrypt this operator's share
+        let nonce = Nonce::default();
+        let encrypted_share = share_seal_key
+            .encrypt(&nonce, SHARE_AAD, &share)
+            .map_err(|_| Error::Encryption)?;
+
+        let nonce_bytes = nonce.to_vec();
+
+        diesel::replace_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(Some(operator_id_raw)),
+                schema::operator::share.eq(&encrypted_share),
+                schema::operator::share_nonce.eq(&nonce_bytes),
+                schema::operator::share_salt.eq(&share_salt),
+                schema::operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
+    }
+
+    vault
+        .ask(Bootstrap { seal_key })
+        .await
+        .map_err(|err| {
+            error!(?err, "Vault bootstrap failed");
+            Error::VaultError
+        })?;
+
+    Ok(())
+}
+
+async fn finalize_unseal(
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    passphrases: HashMap<i32, Vec<u8>>,
+) -> Result<(), Error> {
+    let mut conn = db.get().await?;
+    let mut shares: Vec<Vec<u8>> = Vec::new();
+
+    for (operator_id_raw, passphrase_bytes) in passphrases {
+        let (encrypted_share, share_nonce_bytes, share_salt): (Vec<u8>, Vec<u8>, Vec<u8>) =
+            schema::operator::table
+                .filter(schema::operator::id.eq(Some(operator_id_raw)))
+                .select((
+                    schema::operator::share,
+                    schema::operator::share_nonce,
+                    schema::operator::share_salt,
+                ))
+                .first(&mut conn)
+                .await
+                .map_err(|_| Error::OperatorNotFound)?;
+
+        let nonce = Nonce::try_from(share_nonce_bytes.as_slice()).map_err(|()| {
+            error!(operator_id = operator_id_raw, "Invalid nonce in DB");
+            Error::BrokenDatabase
+        })?;
+
+        let mut passphrase_cell = SafeCell::new(passphrase_bytes);
+        let mut share_seal_key = derive_key(&mut passphrase_cell, &share_salt);
+
+        let mut share_buffer = SafeCell::new(encrypted_share);
+        share_seal_key
+            .decrypt_in_place(&nonce, SHARE_AAD, &mut share_buffer)
+            .map_err(|_| Error::InvalidPassphrase)?;
+
+        let decrypted_share = share_buffer.read().clone();
+        shares.push(decrypted_share);
+    }
+
+    let seal_key_bytes =
+        shamir::combine_shares(&shares).map_err(|e| Error::Shamir(e.to_string()))?;
+
+    let seal_key = KeyCell::from(seal_key_bytes);
+
+    vault
+        .ask(TryUnseal { seal_key })
+        .await
+        .map_err(|err| {
+            error!(?err, "Vault unseal failed");
+            Error::VaultError
+        })?;
+
+    Ok(())
+}
+
+#[messages]
+impl VaultCoordinator {
+    /// Phase 1 of multi-operator bootstrap: declare the committee size.
+    #[message]
+    #[expect(clippy::unused_async, reason = "kameo requires messages to be async")]
+    pub async fn start_bootstrap(
+        &mut self,
+        operator_id: i32,
+        declared_count: usize,
+    ) -> Result<(), Error> {
+        let _ = operator_id; // fixme!: any authenticated operator may announce the committee size. the first call wins
+        if !matches!(self.state, CoordinatorState::Idle) {
+            return Err(Error::AlreadyBootstrapping);
+        }
+        self.state = CoordinatorState::Bootstrapping {
+            declared_count,
+            passphrases: HashMap::new(),
+        };
+        Ok(())
+    }
+
+    /// Phase 2 of multi-operator bootstrap: contribute a passphrase.
+    /// Returns Ok(true) when all operators contributed and bootstrap finalized.
+    #[message]
+    pub async fn contribute_bootstrap(
+        &mut self,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        let CoordinatorState::Bootstrapping {
+            declared_count,
+            passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotBootstrapping);
+        };
+
+        if passphrases.contains_key(&operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        // Extract bytes immediately so state stays Sync
+        let passphrase_bytes = passphrase.read().to_vec();
+        passphrases.insert(operator_id, passphrase_bytes);
+
+        if passphrases.len() < *declared_count {
+            return Ok(false);
+        }
+
+        let CoordinatorState::Bootstrapping { passphrases, .. } =
+            std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_bootstrap(self.db.clone(), self.vault.clone(), passphrases).await?;
+        Ok(true)
+    }
+
+    /// Contribute a passphrase for vault unseal.
+    /// Returns Ok(true) when threshold reached and vault is unsealed.
+    #[message]
+    pub async fn contribute_unseal(
+        &mut self,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        if matches!(self.state, CoordinatorState::Idle) {
+            let mut conn = self.db.get().await?;
+            let count: i64 = schema::operator::table
+                .count()
+                .get_result(&mut conn)
+                .await?;
+            let threshold = shamir_threshold(usize::try_from(count).unwrap_or_default());
+
+            self.state = CoordinatorState::Unsealing {
+                threshold,
+                passphrases: HashMap::new(),
+            };
+        }
+
+        let CoordinatorState::Unsealing {
+            threshold,
+            passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotUnsealing);
+        };
+
+        if passphrases.contains_key(&operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        let passphrase_bytes = passphrase.read().to_vec();
+        passphrases.insert(operator_id, passphrase_bytes);
+
+        if passphrases.len() < *threshold {
+            return Ok(false);
+        }
+
+        let CoordinatorState::Unsealing { passphrases, .. } =
+            std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_unseal(self.db.clone(), self.vault.clone(), passphrases).await?;
+        Ok(true)
+    }
+}

server/crates/arbiter-server/src/crypto/encryption/v1.rs

@@ -61,12 +61,12 @@ mod tests {
     #[test]
     fn derive_seal_key_deterministic() {
         static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
-        let password2 = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
+        let mut password2 = SafeCell::new(PASSWORD.to_vec());
         let salt = generate_salt();
 
-        let mut key1 = derive_key(password, &salt);
-        let mut key2 = derive_key(password2, &salt);
+        let mut key1 = derive_key(&mut password, &salt);
+        let mut key2 = derive_key(&mut password2, &salt);
 
         let key1_reader = key1.0.read();
         let key2_reader = key2.0.read();
@@ -77,10 +77,10 @@ mod tests {
     #[test]
     fn successful_derive() {
         static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
         let salt = generate_salt();
 
-        let mut key = derive_key(password, &salt);
+        let mut key = derive_key(&mut password, &salt);
         let key_reader = key.0.read();
 
         assert_ne!(key_reader.as_slice(), &[0u8; 32][..]);

server/crates/arbiter-server/src/crypto/integrity/v1.rs

@@ -215,8 +215,6 @@ mod tests {
         },
         db::{self, schema},
     };
-    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-
     use super::{Error, Integrable, sign_entity, verify_entity};
     #[derive(Clone, arbiter_macros::Hashable)]
     struct DummyEntity {
@@ -235,7 +233,7 @@ mod tests {
         );
         actor
             .ask(Bootstrap {
-                seal_key_raw: SafeCell::new(b"integrity-test-seal-key".to_vec()),
+                seal_key: crate::crypto::KeyCell::from([0u8; 32]),
             })
             .await
             .unwrap();

server/crates/arbiter-server/src/crypto/mod.rs

@@ -1,5 +1,5 @@
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-use encryption::v1::{Nonce, Salt};
+use encryption::v1::Nonce;
 
 use argon2::{Algorithm, Argon2};
 use chacha20poly1305::{
@@ -13,6 +13,7 @@ use rand::{
 
 pub mod encryption;
 pub mod integrity;
+pub mod shamir;
 
 pub struct KeyCell(pub SafeCell<Key>);
 impl From<SafeCell<Key>> for KeyCell {
@@ -20,6 +21,15 @@ impl From<SafeCell<Key>> for KeyCell {
         Self(value)
     }
 }
+impl From<[u8; 32]> for KeyCell {
+    fn from(bytes: [u8; 32]) -> Self {
+        let cell = SafeCell::new_inline_default(|key: &mut Key| {
+            key.copy_from_slice(&bytes);
+        });
+        Self(cell)
+    }
+}
+
 impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
     type Error = ();
 
@@ -28,7 +38,7 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
         if value.len() != size_of::<Key>() {
             return Err(());
         }
-        let cell = SafeCell::new_inline(|cell_write: &mut Key| {
+        let cell = SafeCell::new_inline_default(|cell_write: &mut Key| {
             cell_write.copy_from_slice(&value);
         });
         Ok(Self(cell))
@@ -37,7 +47,7 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
 
 impl KeyCell {
     pub fn new_secure_random() -> Self {
-        let key = SafeCell::new_inline(|key_buffer: &mut Key| {
+        let key = SafeCell::new_inline_default(|key_buffer: &mut Key| {
             let mut rng = StdRng::try_from_rng(&mut SysRng)
                 .expect("Rng failure is unrecoverable and should panic");
             rng.fill_bytes(key_buffer);
@@ -94,7 +104,7 @@ impl KeyCell {
 }
 
 /// Derive a fixed-length key from the password using Argon2id, which is designed for password hashing and key derivation.
-pub fn derive_key(mut password: SafeCell<Vec<u8>>, salt: &Salt) -> KeyCell {
+pub fn derive_key(password: &mut SafeCell<Vec<u8>>, salt: &[u8]) -> KeyCell {
     let params = {
         #[cfg(debug_assertions)]
         {
@@ -132,10 +142,10 @@ mod tests {
     #[test]
     fn encrypt_decrypt() {
         static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
         let salt = generate_salt();
 
-        let mut key = derive_key(password, &salt);
+        let mut key = derive_key(&mut password, &salt);
         let nonce = Nonce(*b"unique nonce 123 1231233"); // 24 bytes for XChaCha20Poly1305
         let associated_data = b"associated data";
         let mut buffer = b"secret data".to_vec();

server/crates/arbiter-server/src/crypto/shamir.rs

@@ -0,0 +1,41 @@
+use vsss_rs::Gf256;
+
+#[derive(Debug, thiserror::Error)]
+pub enum ShamirError {
+    #[error("Failed to split key: {0}")]
+    Split(String),
+    #[error("Failed to combine shares: {0}")]
+    Combine(String),
+}
+
+/// Split `key` into `total` shares where any `threshold` shares can reconstruct it.
+/// Each returned Vec<u8> is a share with format [`identifier_byte`, `value_bytes`...].
+pub fn split_key(
+    threshold: usize,
+    total: usize,
+    key: &[u8; 32],
+    rng: impl rand_core::RngCore + rand_core::CryptoRng,
+) -> Result<Vec<Vec<u8>>, ShamirError> {
+    Gf256::split_array(threshold, total, key.as_slice(), rng)
+        .map_err(|e| ShamirError::Split(format!("{e:?}")))
+}
+
+/// Returns the minimum number of shares required to reconstruct the secret
+/// for a committee of `n` operators.
+#[must_use]
+pub const fn shamir_threshold(n: usize) -> usize {
+    match n {
+        0 => panic!("No operators"),
+        1 => 1,
+        2 => 2,
+        n => n / 2 + 1,
+    }
+}
+
+/// Reconstruct the secret from `threshold` or more shares.
+pub fn combine_shares(shares: &[Vec<u8>]) -> Result<[u8; 32], ShamirError> {
+    let bytes = Gf256::combine_array(shares)
+        .map_err(|e| ShamirError::Combine(format!("{e:?}")))?;
+    <[u8; 32]>::try_from(bytes.as_slice())
+        .map_err(|_| ShamirError::Combine("unexpected reconstructed key length".to_owned()))
+}

server/crates/arbiter-server/src/db/models.rs

@@ -15,10 +15,11 @@ use restructed::Models;
 pub mod types {
     use chrono::{DateTime, Utc};
     use diesel::{
+        backend::Backend,
         deserialize::{FromSql, FromSqlRow},
         expression::AsExpression,
         serialize::{IsNull, ToSql},
-        sql_types::Integer,
+        sql_types::{Integer, Text},
         sqlite::{Sqlite, SqliteType},
     };
 
@@ -61,7 +62,7 @@ pub mod types {
 
     impl FromSql<Integer, Sqlite> for SqliteTimestamp {
         fn from_sql(
-            mut bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
+            mut bytes: <Sqlite as Backend>::RawValue<'_>,
         ) -> diesel::deserialize::Result<Self> {
             let Some(SqliteType::Long) = bytes.value_type() else {
                 return Err(format!(
@@ -79,10 +80,41 @@ pub mod types {
         }
     }
 
-    #[derive(Debug, FromSqlRow, AsExpression, Clone)]
-    #[diesel(sql_type = Integer)]
-    #[repr(transparent)] // hint compiler to optimize the wrapper struct away
-    pub struct ChainId(pub i32);
+    macro_rules! declare_id {
+        ($name:ident) => {
+            #[derive(Debug, FromSqlRow, AsExpression, Clone, Hash, Copy, PartialEq, Eq)]
+            #[diesel(sql_type = Integer)]
+            #[repr(transparent)] // hint compiler to optimize the wrapper struct away
+            pub struct $name(i32);
+
+            impl $name {
+                pub const fn to_raw(self) -> i32 {
+                    self.0
+                }
+                pub const fn from_raw(raw: i32) -> Self {
+                    Self(raw)
+                }
+            }
+
+            impl FromSql<Integer, Sqlite> for $name {
+                fn from_sql(
+                    bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
+                ) -> diesel::deserialize::Result<Self> {
+                    FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
+                }
+            }
+            impl ToSql<Integer, Sqlite> for $name {
+                fn to_sql<'b>(
+                    &'b self,
+                    out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
+                ) -> diesel::serialize::Result {
+                    ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
+                }
+            }
+        };
+    }
+
+    declare_id!(ChainId);
 
     #[expect(
         clippy::cast_sign_loss,
@@ -103,19 +135,50 @@ pub mod types {
         }
     };
 
-    impl FromSql<Integer, Sqlite> for ChainId {
-        fn from_sql(
-            bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
-        ) -> diesel::deserialize::Result<Self> {
-            FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
-        }
+    declare_id!(OperatorId);
+    declare_id!(OperatorIdentityId);
+    declare_id!(AeadEncryptedId);
+    declare_id!(RootKeyHistoryId);
+    declare_id!(TlsHistoryId);
+    declare_id!(EvmWalletId);
+    declare_id!(ClientId);
+
+    #[derive(Debug, Clone, PartialEq, Eq, AsExpression, FromSqlRow)]
+    #[diesel(sql_type = Text)]
+    pub enum ProposalStatus {
+        Pending,
+        Approved,
+        Rejected,
+        Expired,
     }
-    impl ToSql<Integer, Sqlite> for ChainId {
+
+    impl ToSql<Text, Sqlite> for ProposalStatus {
         fn to_sql<'b>(
             &'b self,
             out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
         ) -> diesel::serialize::Result {
-            ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
+            let s: &str = match self {
+                Self::Pending => "pending",
+                Self::Approved => "approved",
+                Self::Rejected => "rejected",
+                Self::Expired => "expired",
+            };
+            <str as ToSql<Text, Sqlite>>::to_sql(s, out)
+        }
+    }
+
+    impl FromSql<Text, Sqlite> for ProposalStatus {
+        fn from_sql(
+            bytes: <Sqlite as Backend>::RawValue<'_>,
+        ) -> diesel::deserialize::Result<Self> {
+            let s = <String as FromSql<Text, Sqlite>>::from_sql(bytes)?;
+            match s.as_str() {
+                "pending" => Ok(Self::Pending),
+                "approved" => Ok(Self::Approved),
+                "rejected" => Ok(Self::Rejected),
+                "expired" => Ok(Self::Expired),
+                other => Err(format!("Unknown proposal status: {other}").into()),
+            }
         }
     }
 }
@@ -130,12 +193,12 @@ pub use types::*;
 )]
 #[diesel(table_name = aead_encrypted, check_for_backend(Sqlite))]
 pub struct AeadEncrypted {
-    pub id: i32,
+    pub id: AeadEncryptedId,
     pub ciphertext: Vec<u8>,
     pub tag: Vec<u8>,
     pub current_nonce: Vec<u8>,
     pub schema_version: i32,
-    pub associated_root_key_id: i32, // references root_key_history.id
+    pub associated_root_key_id: RootKeyHistoryId,
     pub created_at: SqliteTimestamp,
 }
 
@@ -148,7 +211,7 @@ pub struct AeadEncrypted {
     attributes_with = "deriveless"
 )]
 pub struct RootKeyHistory {
-    pub id: i32,
+    pub id: RootKeyHistoryId,
     pub ciphertext: Vec<u8>,
     pub tag: Vec<u8>,
     pub root_key_encryption_nonce: Vec<u8>,
@@ -166,7 +229,7 @@ pub struct RootKeyHistory {
     attributes_with = "deriveless"
 )]
 pub struct TlsHistory {
-    pub id: i32,
+    pub id: TlsHistoryId,
     pub cert: String,
     pub cert_key: String, // PEM Encoded private key
     pub ca_cert: String,  // PEM Encoded certificate for cert signing
@@ -191,7 +254,7 @@ pub struct ArbiterSettings {
     attributes_with = "deriveless"
 )]
 pub struct EvmWallet {
-    pub id: i32,
+    pub id: EvmWalletId,
     pub address: Vec<u8>,
     pub aead_encrypted_id: i32,
     pub created_at: SqliteTimestamp,
@@ -213,7 +276,7 @@ pub struct EvmWallet {
 )]
 pub struct EvmWalletAccess {
     pub id: i32,
-    pub wallet_id: i32,
+    pub wallet_id: EvmWalletId,
     pub client_id: i32,
     pub created_at: SqliteTimestamp,
 }
@@ -240,7 +303,7 @@ pub struct ProgramClientMetadataHistory {
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = schema::program_client, check_for_backend(Sqlite))]
 pub struct ProgramClient {
-    pub id: i32,
+    pub id: ClientId,
     pub public_key: Vec<u8>,
     pub metadata_id: i32,
     pub created_at: SqliteTimestamp,
@@ -250,12 +313,23 @@ pub struct ProgramClient {
 #[derive(Queryable, Debug)]
 #[diesel(table_name = schema::operator_client, check_for_backend(Sqlite))]
 pub struct OperatorClient {
-    pub id: i32,
+    pub id: OperatorIdentityId,
     pub public_key: Vec<u8>,
     pub created_at: SqliteTimestamp,
     pub updated_at: SqliteTimestamp,
 }
 
+#[derive(Queryable, Debug)]
+#[diesel(table_name = schema::operator, check_for_backend(Sqlite))]
+pub struct Operator {
+    pub id: OperatorId,
+    pub share: Vec<u8>,
+    pub share_nonce: Vec<u8>,
+    pub share_salt: Vec<u8>,
+    pub created_at: SqliteTimestamp,
+    pub updated_at: SqliteTimestamp,
+}
+
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = evm_ether_transfer_limit, check_for_backend(Sqlite))]
 #[view(
@@ -399,8 +473,58 @@ pub struct IntegrityEnvelope {
     pub entity_kind: String,
     pub entity_id: Vec<u8>,
     pub payload_version: i32,
-    pub key_version: i32,
+    pub key_version: RootKeyHistoryId,
     pub mac: Vec<u8>,
     pub signed_at: SqliteTimestamp,
     pub created_at: SqliteTimestamp,
 }
+
+#[derive(Debug, Queryable, Selectable, Identifiable)]
+#[diesel(table_name = schema::proposal, check_for_backend(Sqlite))]
+pub struct Proposal {
+    pub id: i32,
+    pub kind: String,
+    pub payload: Vec<u8>,
+    pub initiator_id: i32,
+    pub created_at: SqliteTimestamp,
+    pub expires_at: SqliteTimestamp,
+    pub status: ProposalStatus,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::proposal, check_for_backend(Sqlite))]
+pub struct NewProposal {
+    pub kind: String,
+    pub payload: Vec<u8>,
+    pub initiator_id: i32,
+    // status defaults to 'pending' at the DB layer
+    pub expires_at: SqliteTimestamp,
+}
+
+#[derive(Debug, Queryable, Selectable, Identifiable)]
+#[diesel(table_name = schema::proposal_vote, check_for_backend(Sqlite))]
+pub struct ProposalVote {
+    pub id: i32,
+    pub proposal_id: i32,
+    pub operator_id: i32,
+    pub approve: bool,
+    pub signature: Vec<u8>,
+    pub voted_at: SqliteTimestamp,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::proposal_vote, check_for_backend(Sqlite))]
+pub struct NewProposalVote {
+    pub proposal_id: i32,
+    pub operator_id: i32,
+    pub approve: bool,
+    pub signature: Vec<u8>,
+}
+
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::proposal_result, check_for_backend(Sqlite))]
+pub struct NewProposalResult {
+    pub proposal_id: i32,
+    pub data: Vec<u8>,
+}

server/crates/arbiter-server/src/db/schema.rs

@@ -152,6 +152,57 @@ diesel::table! {
     }
 }
 
+diesel::table! {
+    operator (id) {
+        id -> Nullable<Integer>,
+        share -> Binary,
+        share_nonce -> Binary,
+        share_salt -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
+diesel::table! {
+    operator_identity (id) {
+        id -> Integer,
+        public_key -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
+diesel::table! {
+    proposal (id) {
+        id -> Integer,
+        kind -> Text,
+        payload -> Binary,
+        initiator_id -> Integer,
+        created_at -> Integer,
+        expires_at -> Integer,
+        status -> Text,
+    }
+}
+
+diesel::table! {
+    proposal_result (proposal_id) {
+        proposal_id -> Integer,
+        data -> Binary,
+        created_at -> Integer,
+    }
+}
+
+diesel::table! {
+    proposal_vote (id) {
+        id -> Integer,
+        proposal_id -> Integer,
+        operator_id -> Integer,
+        approve -> Bool,
+        signature -> Binary,
+        voted_at -> Integer,
+    }
+}
+
 diesel::table! {
     program_client (id) {
         id -> Integer,
@@ -185,15 +236,6 @@ diesel::table! {
     }
 }
 
-diesel::table! {
-    operator_client (id) {
-        id -> Integer,
-        public_key -> Binary,
-        created_at -> Integer,
-        updated_at -> Integer,
-    }
-}
-
 diesel::joinable!(aead_encrypted -> root_key_history (associated_root_key_id));
 diesel::joinable!(arbiter_settings -> root_key_history (root_key_id));
 diesel::joinable!(arbiter_settings -> tls_history (tls_id));
@@ -212,10 +254,16 @@ diesel::joinable!(evm_transaction_log -> evm_wallet_access (wallet_access_id));
 diesel::joinable!(evm_wallet -> aead_encrypted (aead_encrypted_id));
 diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
 diesel::joinable!(evm_wallet_access -> program_client (client_id));
+diesel::joinable!(operator -> operator_identity (id));
 diesel::joinable!(program_client -> client_metadata (metadata_id));
+diesel::joinable!(proposal -> operator_identity (initiator_id));
+diesel::joinable!(proposal_result -> proposal (proposal_id));
+diesel::joinable!(proposal_vote -> proposal (proposal_id));
+diesel::joinable!(proposal_vote -> operator_identity (operator_id));
 
 diesel::allow_tables_to_appear_in_same_query!(
     aead_encrypted,
+    proposal_result,
     arbiter_settings,
     client_metadata,
     client_metadata_history,
@@ -230,8 +278,11 @@ diesel::allow_tables_to_appear_in_same_query!(
     evm_wallet,
     evm_wallet_access,
     integrity_envelope,
+    operator,
+    operator_identity,
     program_client,
+    proposal,
+    proposal_vote,
     root_key_history,
     tls_history,
-    operator_client,
 );

server/crates/arbiter-server/src/evm/mod.rs

@@ -1,34 +1,28 @@
-use diesel_async::{AsyncConnection, RunQueryDsl};
-use kameo::actor::ActorRef;
-
 use crate::{
     actors::vault::Vault,
     crypto::integrity,
     db::{
         self, DatabaseError,
         models::{
-            EvmBasicGrant, EvmEtherTransferGrant, EvmEtherTransferGrantTarget,
-            EvmEtherTransferLimit, EvmTokenTransferGrant, EvmTokenTransferVolumeLimit,
-            EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
         },
         schema::{self, evm_transaction_log},
     },
     evm::policies::{
         CombinedSettings, DatabaseID, EvalContext, EvalViolation, Grant, Policy,
-        SharedGrantSettings, SpecificGrant, SpecificMeaning, VolumeRateLimit,
-        ether_transfer::EtherTransfer, token_transfers::TokenTransfer,
+        SharedGrantSettings, SpecificGrant, SpecificMeaning, ether_transfer::EtherTransfer,
+        token_transfers::TokenTransfer,
     },
 };
 
 use alloy::{
     consensus::TxEip1559,
-    primitives::{Address, TxKind, U256},
+    primitives::{TxKind, U256},
 };
 use chrono::Utc;
-use diesel::{
-    ExpressionMethods as _, OptionalExtension, QueryDsl as _, QueryResult, SelectableHelper,
-    insert_into, sqlite::Sqlite, update,
-};
+use diesel::{ExpressionMethods as _, QueryDsl as _, QueryResult, insert_into, sqlite::Sqlite};
+use diesel_async::{AsyncConnection, RunQueryDsl};
+use kameo::actor::ActorRef;
 
 pub mod abi;
 pub mod safe_signer;
@@ -278,151 +272,6 @@ impl Engine {
         Ok(id)
     }
 
-    pub async fn revoke_grant(
-        &self,
-        basic_grant_id: i32,
-    ) -> Result<(), DatabaseError> {
-        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let vault = self.vault.clone();
-
-        conn.transaction(async move |conn| {
-            use crate::db::schema::{
-                evm_basic_grant, evm_ether_transfer_grant, evm_ether_transfer_grant_target,
-                evm_ether_transfer_limit, evm_token_transfer_grant,
-                evm_token_transfer_volume_limit,
-            };
-
-            update(evm_basic_grant::table)
-                .filter(evm_basic_grant::id.eq(basic_grant_id))
-                .set(evm_basic_grant::revoked_at.eq(SqliteTimestamp(Utc::now())))
-                .execute(&mut *conn)
-                .await?;
-
-            let basic_grant: EvmBasicGrant = evm_basic_grant::table
-                .filter(evm_basic_grant::id.eq(basic_grant_id))
-                .select(EvmBasicGrant::as_select())
-                .first(&mut *conn)
-                .await?;
-
-            let shared = SharedGrantSettings::try_from_model(basic_grant)?;
-
-            if let Some(ether_grant) = evm_ether_transfer_grant::table
-                .filter(evm_ether_transfer_grant::basic_grant_id.eq(basic_grant_id))
-                .select(EvmEtherTransferGrant::as_select())
-                .first(&mut *conn)
-                .await
-                .optional()?
-            {
-                let target_rows: Vec<EvmEtherTransferGrantTarget> =
-                    evm_ether_transfer_grant_target::table
-                        .filter(evm_ether_transfer_grant_target::grant_id.eq(ether_grant.id))
-                        .select(EvmEtherTransferGrantTarget::as_select())
-                        .load(&mut *conn)
-                        .await?;
-                let targets: Vec<Address> = target_rows
-                    .into_iter()
-                    .filter_map(|target| {
-                        let arr: [u8; 20] = target.address.try_into().ok()?;
-                        Some(Address::from(arr))
-                    })
-                    .collect();
-
-                let limit: EvmEtherTransferLimit = evm_ether_transfer_limit::table
-                    .filter(evm_ether_transfer_limit::id.eq(ether_grant.limit_id))
-                    .select(EvmEtherTransferLimit::as_select())
-                    .first(&mut *conn)
-                    .await?;
-
-                let settings = CombinedSettings {
-                    shared: shared.clone(),
-                    specific: policies::ether_transfer::Settings {
-                        target: targets,
-                        limit: VolumeRateLimit {
-                            max_volume: utils::try_bytes_to_u256(&limit.max_volume).map_err(
-                                |err| {
-                                    diesel::result::Error::DeserializationError(Box::new(err))
-                                },
-                            )?,
-                            window: chrono::Duration::seconds(limit.window_secs.into()),
-                        },
-                    },
-                };
-
-                integrity::sign_entity(&mut *conn, &vault, &settings, basic_grant_id)
-                    .await
-                    .map_err(|_| diesel::result::Error::RollbackTransaction)?;
-
-                return QueryResult::Ok(());
-            }
-
-            if let Some(token_grant) = evm_token_transfer_grant::table
-                .filter(evm_token_transfer_grant::basic_grant_id.eq(basic_grant_id))
-                .select(EvmTokenTransferGrant::as_select())
-                .first(&mut *conn)
-                .await
-                .optional()?
-            {
-                let volume_limit_rows: Vec<EvmTokenTransferVolumeLimit> =
-                    evm_token_transfer_volume_limit::table
-                        .filter(evm_token_transfer_volume_limit::grant_id.eq(token_grant.id))
-                        .select(EvmTokenTransferVolumeLimit::as_select())
-                        .load(&mut *conn)
-                        .await?;
-                let volume_limits: Vec<VolumeRateLimit> = volume_limit_rows
-                    .into_iter()
-                    .map(|row| {
-                        Ok(VolumeRateLimit {
-                            max_volume: utils::try_bytes_to_u256(&row.max_volume).map_err(
-                                |err| {
-                                    diesel::result::Error::DeserializationError(Box::new(err))
-                                },
-                            )?,
-                            window: chrono::Duration::seconds(row.window_secs.into()),
-                        })
-                    })
-                    .collect::<QueryResult<Vec<_>>>()?;
-
-                let target: Option<Address> = match token_grant.receiver {
-                    None => None,
-                    Some(bytes) => {
-                        let arr: [u8; 20] = bytes.try_into().map_err(|_| {
-                            diesel::result::Error::DeserializationError(
-                                "Invalid receiver address length".into(),
-                            )
-                        })?;
-                        Some(Address::from(arr))
-                    }
-                };
-
-                let token_contract: [u8; 20] =
-                    token_grant.token_contract.clone().try_into().map_err(|_| {
-                        diesel::result::Error::DeserializationError(
-                            "Invalid token contract address length".into(),
-                        )
-                    })?;
-
-                let settings = CombinedSettings {
-                    shared,
-                    specific: policies::token_transfers::Settings {
-                        token_contract: Address::from(token_contract),
-                        target,
-                        volume_limits,
-                    },
-                };
-
-                integrity::sign_entity(&mut *conn, &vault, &settings, basic_grant_id)
-                    .await
-                    .map_err(|_| diesel::result::Error::RollbackTransaction)?;
-
-                return QueryResult::Ok(());
-            }
-
-            Err(diesel::result::Error::NotFound)
-        })
-        .await
-        .map_err(DatabaseError::from)
-    }
-
     async fn list_one_kind<Kind: Policy, Y>(
         &self,
         conn: &mut impl AsyncConnection<Backend = Sqlite>,
@@ -502,26 +351,21 @@ impl Engine {
 #[cfg(test)]
 mod tests {
     use alloy::primitives::{Address, Bytes, U256, address};
-    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
     use chrono::{Duration, Utc};
     use diesel::{SelectableHelper, insert_into};
     use diesel_async::RunQueryDsl;
-    use kameo::{actor::ActorRef, prelude::Spawn};
     use rstest::rstest;
 
-    use crate::actors::{GlobalActors, vault::{Bootstrap, Vault}};
-    use crate::crypto::integrity;
     use crate::db::{
         self, DatabaseConnection,
         models::{
-            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
+            SqliteTimestamp,
         },
         schema::{evm_basic_grant, evm_transaction_log},
     };
-    use crate::evm::policies::ether_transfer::EtherTransfer;
     use crate::evm::policies::{
-        CombinedSettings, EvalContext, EvalViolation, Policy, SharedGrantSettings,
-        TransactionRateLimit, VolumeRateLimit,
+        EvalContext, EvalViolation, SharedGrantSettings, TransactionRateLimit,
     };
 
     use super::check_shared_constraints;
@@ -534,7 +378,7 @@ mod tests {
         EvalContext {
             target: EvmWalletAccess {
                 id: WALLET_ACCESS_ID,
-                wallet_id: 10,
+                wallet_id: EvmWalletId::from_raw(5),
                 client_id: 20,
                 created_at: SqliteTimestamp(Utc::now()),
             },
@@ -553,7 +397,6 @@ mod tests {
             chain: CHAIN_ID,
             valid_from: None,
             valid_until: None,
-            revoked_at: None,
             max_gas_fee_per_gas: None,
             max_priority_fee_per_gas: None,
             rate_limit: None,
@@ -762,115 +605,4 @@ mod tests {
             assert!(violations.is_empty());
         }
     }
-
-    async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> {
-        let actor = Vault::spawn(
-            Vault::new(db.clone(), GlobalActors::spawn_message_bus())
-                .await
-                .unwrap(),
-        );
-        actor
-            .ask(Bootstrap {
-                seal_key_raw: SafeCell::new(b"integrity-test-seal-key".to_vec()),
-            })
-            .await
-            .unwrap();
-        actor
-    }
-
-    #[tokio::test]
-    async fn revoke_grant_preserves_revoked_integrity() {
-        use crate::db::schema::evm_basic_grant;
-        use diesel::ExpressionMethods as _;
-
-        let db = db::create_test_pool().await;
-        let vault = bootstrapped_vault(&db).await;
-        let engine = super::Engine::new(db.clone(), vault.clone());
-
-        let full_grant = CombinedSettings {
-            shared: SharedGrantSettings {
-                wallet_access_id: WALLET_ACCESS_ID,
-                chain: CHAIN_ID,
-                valid_from: None,
-                valid_until: None,
-                revoked_at: None,
-                max_gas_fee_per_gas: None,
-                max_priority_fee_per_gas: None,
-                rate_limit: None,
-            },
-            specific: super::policies::ether_transfer::Settings {
-                target: vec![RECIPIENT],
-                limit: VolumeRateLimit {
-                    max_volume: U256::from(100u64),
-                    window: Duration::hours(1),
-                },
-            },
-        };
-
-        let grant_id = engine
-            .create_grant::<EtherTransfer>(full_grant)
-            .await
-            .unwrap();
-
-        engine.revoke_grant(grant_id).await.unwrap();
-
-        let mut conn = db.get().await.unwrap();
-        diesel::update(evm_basic_grant::table)
-            .filter(evm_basic_grant::id.eq(grant_id))
-            .set(evm_basic_grant::revoked_at.eq::<Option<SqliteTimestamp>>(None))
-            .execute(&mut conn)
-            .await
-            .unwrap();
-
-        let wallet_access = EvmWalletAccess {
-            id: WALLET_ACCESS_ID,
-            wallet_id: 10,
-            client_id: 20,
-            created_at: SqliteTimestamp(Utc::now()),
-        };
-        let context = EvalContext {
-            target: wallet_access,
-            chain: CHAIN_ID,
-            to: RECIPIENT,
-            value: U256::ONE,
-            calldata: Bytes::new(),
-            max_fee_per_gas: 1,
-            max_priority_fee_per_gas: 1,
-        };
-
-        let grant = EtherTransfer::try_find_grant(
-            &context, &mut conn,
-        )
-        .await
-        .unwrap()
-        .unwrap();
-
-        let result =
-            integrity::verify_entity(&mut conn, &vault, &grant.settings, grant.id).await;
-
-        assert!(matches!(
-            result,
-            Err(integrity::Error::MacMismatch { .. })
-        ));
-    }
-
-    #[test]
-    fn shared_settings_hash_changes_when_revoked_at_changes() {
-        use arbiter_crypto::hashing::Hashable;
-        use sha2::Digest;
-
-        let active = shared_settings();
-        let revoked = SharedGrantSettings {
-            revoked_at: Some(Utc::now()),
-            ..shared_settings()
-        };
-
-        let mut active_hash = sha2::Sha256::new();
-        active.hash(&mut active_hash);
-
-        let mut revoked_hash = sha2::Sha256::new();
-        revoked.hash(&mut revoked_hash);
-
-        assert_ne!(active_hash.finalize(), revoked_hash.finalize());
-    }
 }

server/crates/arbiter-server/src/evm/policies.rs

@@ -144,7 +144,6 @@ pub struct SharedGrantSettings {
 
     pub valid_from: Option<DateTime<Utc>>,
     pub valid_until: Option<DateTime<Utc>>,
-    pub revoked_at: Option<DateTime<Utc>>,
 
     pub max_gas_fee_per_gas: Option<U256>,
     pub max_priority_fee_per_gas: Option<U256>,
@@ -159,7 +158,6 @@ impl SharedGrantSettings {
             chain: model.chain_id.into(),
             valid_from: model.valid_from.map(Into::into),
             valid_until: model.valid_until.map(Into::into),
-            revoked_at: model.revoked_at.map(Into::into),
             max_gas_fee_per_gas: model
                 .max_gas_fee_per_gas
                 .map(|b| utils::try_bytes_to_u256(&b))

server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs

@@ -3,7 +3,8 @@ use crate::{
     db::{
         self, DatabaseConnection,
         models::{
-            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
+            SqliteTimestamp,
         },
         schema::{evm_basic_grant, evm_transaction_log},
     },
@@ -31,7 +32,7 @@ fn ctx(to: Address, value: U256) -> EvalContext {
     EvalContext {
         target: EvmWalletAccess {
             id: WALLET_ACCESS_ID,
-            wallet_id: 10,
+            wallet_id: EvmWalletId::from_raw(10),
             client_id: 20,
             created_at: SqliteTimestamp(Utc::now()),
         },
@@ -79,7 +80,6 @@ fn shared() -> SharedGrantSettings {
         chain: CHAIN_ID,
         valid_from: None,
         valid_until: None,
-        revoked_at: None,
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,

server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs

@@ -2,7 +2,7 @@ use super::{Settings, TokenTransfer};
 use crate::{
     db::{
         self, DatabaseConnection,
-        models::{EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, SqliteTimestamp},
+        models::{EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, SqliteTimestamp},
         schema::evm_basic_grant,
     },
     evm::{
@@ -45,7 +45,7 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
     EvalContext {
         target: EvmWalletAccess {
             id: WALLET_ACCESS_ID,
-            wallet_id: 10,
+            wallet_id: EvmWalletId::from_raw(10),
             client_id: 20,
             created_at: SqliteTimestamp(Utc::now()),
         },
@@ -98,7 +98,6 @@ fn shared() -> SharedGrantSettings {
         chain: CHAIN_ID,
         valid_from: None,
         valid_until: None,
-        revoked_at: None,
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,

server/crates/arbiter-server/src/evm/safe_signer.rs

@@ -44,7 +44,7 @@ impl std::fmt::Debug for SafeSigner {
 /// Returns the protected key bytes and the derived Ethereum address.
 pub fn generate(rng: &mut impl rand::Rng) -> (SafeCell<[u8; 32]>, Address) {
     loop {
-        let mut cell = SafeCell::new_inline(|w: &mut [u8; 32]| {
+        let mut cell = SafeCell::new_inline_default(|w: &mut [u8; 32]| {
             rng.fill_bytes(w);
         });
 

server/crates/arbiter-server/src/grpc/client/auth.rs

@@ -200,7 +200,7 @@ impl Convert for auth::Outbound {
                         .timestamp
                         .timestamp_nanos_opt()
                         .expect("timestamp within range")
-                        .cast_unsigned(),
+                        as u64,
                     random: challenge.nonce.to_vec(),
                 })
             }

server/crates/arbiter-server/src/grpc/operator.rs

@@ -19,6 +19,7 @@ use tracing::{error, info, warn};
 
 mod auth;
 mod evm;
+mod governance;
 mod inbound;
 mod outbound;
 mod sdk_client;
@@ -115,6 +116,7 @@ async fn dispatch_inner(
             warn!("Unsupported post-auth operator auth request");
             Err(Status::invalid_argument("Unsupported operator request"))
         }
+        OperatorRequestPayload::Governance(req) => governance::dispatch(actor, req).await,
     }
 }
 

server/crates/arbiter-server/src/grpc/operator/auth.rs

@@ -80,7 +80,7 @@ impl Sender<Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {
                         .timestamp
                         .timestamp_nanos_opt()
                         .expect("timestamp within range")
-                        .cast_unsigned(),
+                        as u64,
                     random: challenge.nonce.to_vec(),
                 })
             }

server/crates/arbiter-server/src/grpc/operator/evm.rs

@@ -90,7 +90,7 @@ async fn handle_wallet_list(
                 .into_iter()
                 .map(|(id, address)| WalletEntry {
                     address: address.to_vec(),
-                    id,
+                    id: id.to_raw(),
                 })
                 .collect(),
         }),

server/crates/arbiter-server/src/grpc/operator/governance.rs

@@ -0,0 +1,147 @@
+use crate::{
+    actors::proposal_manager::{Error as ProposalError, ProposalKind, VoteOutcome},
+    peers::operator::{
+        OperatorSession,
+        session::handlers::{HandleCastVote, HandleCreateProposal, HandleQueryPending},
+    },
+};
+use arbiter_proto::proto::operator::{
+    governance::{
+        self as proto_gov, CreateProposalRequest, QueryPendingRequest, QueryPendingResponse,
+        VoteOutcome as ProtoVoteOutcome, create_proposal_request::Kind as ProtoKind,
+        request::Payload as GovRequestPayload, response::Payload as GovResponsePayload,
+    },
+    operator_response::Payload as OperatorResponsePayload,
+};
+use kameo::actor::ActorRef;
+use tonic::Status;
+use tracing::warn;
+
+const fn wrap(payload: GovResponsePayload) -> OperatorResponsePayload {
+    OperatorResponsePayload::Governance(proto_gov::Response {
+        payload: Some(payload),
+    })
+}
+
+pub(super) async fn dispatch(
+    actor: &ActorRef<OperatorSession>,
+    req: proto_gov::Request,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let Some(payload) = req.payload else {
+        return Err(Status::invalid_argument(
+            "Missing governance request payload",
+        ));
+    };
+
+    match payload {
+        GovRequestPayload::Create(req) => handle_create(actor, req).await,
+        GovRequestPayload::Vote(req) => handle_vote(actor, req).await,
+        GovRequestPayload::Query(QueryPendingRequest {}) => handle_query(actor).await,
+    }
+}
+
+async fn handle_create(
+    actor: &ActorRef<OperatorSession>,
+    req: CreateProposalRequest,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let kind = match req.kind {
+        Some(ProtoKind::ApproveSdkClient(p)) => ProposalKind::ApproveSdkClient {
+            client_id: p.client_id,
+        },
+        Some(ProtoKind::GrantWalletAccess(p)) => ProposalKind::GrantWalletAccess {
+            wallet_id: p.wallet_id,
+            client_id: p.client_id,
+        },
+        Some(ProtoKind::ApproveServerUpdate(_)) => ProposalKind::ApproveServerUpdate,
+        Some(ProtoKind::ReplaceOperator(p)) => ProposalKind::ReplaceOperator {
+            new_pubkey: p.new_pubkey.try_into()
+                .map_err(|_| Status::invalid_argument("replace_operator: pubkey must be 32 bytes"))?,
+        },
+        Some(ProtoKind::UpdateShamirParameters(p)) => ProposalKind::UpdateShamirParameters {
+            #[expect(clippy::cast_possible_truncation, clippy::as_conversions, reason = "new_n is always a small operator count")]
+            new_n: p.new_n as u8,
+        },
+        Some(ProtoKind::ApprovePersistentGrant(p)) => {
+            use prost::Message as _;
+            ProposalKind::ApprovePersistentGrant { payload_bytes: p.encode_to_vec() }
+        }
+        Some(ProtoKind::ApproveOneOffTransaction(p)) => {
+            use prost::Message as _;
+            ProposalKind::ApproveOneOffTransaction { payload_bytes: p.encode_to_vec() }
+        }
+        None => return Err(Status::invalid_argument("Missing proposal kind")),
+    };
+    let ttl_secs = req.ttl_secs.map(i64::from);
+
+    let proposal_id = actor
+        .ask(HandleCreateProposal { kind, ttl_secs })
+        .await
+        .map_err(|e| {
+            warn!(?e, "create_proposal failed");
+            Status::internal("Failed to create proposal")
+        })?;
+
+    Ok(Some(wrap(GovResponsePayload::Created(
+        proto_gov::CreateProposalResponse { proposal_id },
+    ))))
+}
+
+async fn handle_vote(
+    actor: &ActorRef<OperatorSession>,
+    req: proto_gov::CastVoteRequest,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let result = actor
+        .ask(HandleCastVote {
+            proposal_id: req.proposal_id,
+            approve: req.approve,
+            signature: req.signature,
+        })
+        .await;
+
+    let outcome = match result {
+        Ok(VoteOutcome::Pending) => ProtoVoteOutcome::Pending,
+        Ok(VoteOutcome::QuorumApproved) => ProtoVoteOutcome::Approved,
+        Ok(VoteOutcome::QuorumRejected) => ProtoVoteOutcome::Rejected,
+        Err(kameo::error::SendError::HandlerError(ProposalError::AlreadyVoted)) => {
+            return Err(Status::invalid_argument("Already voted on this proposal"));
+        }
+        Err(kameo::error::SendError::HandlerError(ProposalError::InvalidSignature)) => {
+            return Err(Status::invalid_argument("Invalid vote signature"));
+        }
+        Err(kameo::error::SendError::HandlerError(ProposalError::ProposalNotFound)) => {
+            return Err(Status::not_found("Proposal not found"));
+        }
+        Err(e) => {
+            warn!(?e, "cast_vote failed");
+            return Err(Status::internal("Failed to cast vote"));
+        }
+    };
+
+    Ok(Some(wrap(GovResponsePayload::Voted(
+        proto_gov::VoteResponse {
+            outcome: outcome.into(),
+        },
+    ))))
+}
+
+async fn handle_query(
+    actor: &ActorRef<OperatorSession>,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let summaries = actor.ask(HandleQueryPending {}).await.unwrap_or_default();
+
+    let proposals = summaries
+        .into_iter()
+        .map(|s| proto_gov::ProposalSummary {
+            id: s.id,
+            kind: s.kind,
+            initiator_id: s.initiator_id,
+            expires_at: s.expires_at.0.timestamp(),
+            approve_count: s.approve_count,
+            reject_count: s.reject_count,
+        })
+        .collect();
+
+    Ok(Some(wrap(GovResponsePayload::Pending(
+        QueryPendingResponse { proposals },
+    ))))
+}

server/crates/arbiter-server/src/grpc/operator/inbound.rs

@@ -1,11 +1,10 @@
 use crate::{
-    db::models::{CoreEvmWalletAccess, NewEvmWalletAccess},
+    db::models::{CoreEvmWalletAccess, EvmWalletId, NewEvmWalletAccess},
     evm::policies::{
         SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit, ether_transfer,
         token_transfers,
     },
-    grpc::Convert,
-    grpc::TryConvert,
+    grpc::{Convert, TryConvert},
 };
 use arbiter_proto::{
     proto::evm::{
@@ -87,7 +86,6 @@ impl TryConvert for ProtoSharedSettings {
                 .valid_until
                 .map(ProtoTimestamp::try_convert)
                 .transpose()?,
-            revoked_at: None,
             max_gas_fee_per_gas: self
                 .max_gas_fee_per_gas
                 .as_deref()
@@ -151,7 +149,7 @@ impl Convert for WalletAccess {
 
     fn convert(self) -> Self::Output {
         NewEvmWalletAccess {
-            wallet_id: self.wallet_id,
+            wallet_id: EvmWalletId::from_raw(self.wallet_id),
             client_id: self.sdk_client_id,
         }
     }
@@ -166,7 +164,7 @@ impl TryConvert for SdkClientWalletAccess {
             return Err(Status::invalid_argument("Missing wallet access entry"));
         };
         Ok(CoreEvmWalletAccess {
-            wallet_id: access.wallet_id,
+            wallet_id: EvmWalletId::from_raw(access.wallet_id),
             client_id: access.sdk_client_id,
             id: self.id,
         })

server/crates/arbiter-server/src/grpc/operator/outbound.rs

@@ -103,7 +103,7 @@ impl Convert for EvmWalletAccess {
         Self::Output {
             id: self.id,
             access: Some(WalletAccess {
-                wallet_id: self.wallet_id,
+                wallet_id: self.wallet_id.to_raw(),
                 sdk_client_id: self.client_id,
             }),
         }

server/crates/arbiter-server/src/grpc/operator/sdk_client.rs

@@ -2,7 +2,7 @@ use crate::{
     db::models::NewEvmWalletAccess,
     grpc::Convert,
     peers::operator::{
-        OutOfBand, OperatorSession,
+        OperatorSession, OutOfBand,
         session::handlers::{
             HandleGrantEvmWalletAccess, HandleListWalletAccess, HandleNewClientApprove,
             HandleRevokeEvmWalletAccess, HandleSdkClientList,
@@ -11,8 +11,8 @@ use crate::{
 };
 use arbiter_crypto::authn;
 use arbiter_proto::proto::{
-    shared::ClientInfo as ProtoClientMetadata,
     operator::{
+        operator_response::Payload as OperatorResponsePayload,
         sdk_client::{
             self as proto_sdk_client, ConnectionCancel as ProtoSdkClientConnectionCancel,
             ConnectionRequest as ProtoSdkClientConnectionRequest,
@@ -24,8 +24,8 @@ use arbiter_proto::proto::{
             request::Payload as SdkClientRequestPayload,
             response::Payload as SdkClientResponsePayload,
         },
-        operator_response::Payload as OperatorResponsePayload,
     },
+    shared::ClientInfo as ProtoClientMetadata,
 };
 
 use kameo::actor::ActorRef;
@@ -115,7 +115,7 @@ async fn handle_list(
             clients: clients
                 .into_iter()
                 .map(|(client, metadata)| ProtoSdkClientEntry {
-                    id: client.id,
+                    id: client.id.to_raw(),
                     pubkey: client.public_key.clone(),
                     info: Some(ProtoClientMetadata {
                         name: metadata.name,

server/crates/arbiter-server/src/grpc/operator/vault.rs

@@ -3,7 +3,6 @@ use crate::{
     peers::operator::{OperatorSession, session::handlers::HandleQueryVaultState},
 };
 use arbiter_proto::{
-    proto::shared::VaultState as ProtoVaultState,
     proto::operator::{
         operator_response::Payload as OperatorResponsePayload,
         vault::{
@@ -11,6 +10,7 @@ use arbiter_proto::{
             response::Payload as VaultResponsePayload,
         },
     },
+    proto::shared::VaultState as ProtoVaultState,
 };
 
 use kameo::actor::ActorRef;

server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs

@@ -1,14 +1,16 @@
 use crate::{
     grpc::{Convert, TryConvert},
     peers::operator::vault_gate::{
-        self as vault_gate, HandleBootstrapEncryptedKey, HandleHandshake, HandleUnsealEncryptedKey,
+        self as vault_gate, HandleBootstrapEncryptedKey, HandleContributeBootstrapPassphrase,
+        HandleContributeUnsealPassphrase, HandleDeclareCommittee, HandleHandshake,
+        HandleUnsealEncryptedKey,
     },
 };
 use arbiter_proto::proto::operator::{
     operator_request::Payload as OperatorRequestPayload,
     vault::{
         self as proto_vault,
-        bootstrap::{self as proto_bootstrap},
+        bootstrap::{self as proto_bootstrap, request::Payload as BootstrapRequestPayload},
         request::Payload as VaultRequestPayload,
         unseal::{self as proto_unseal, request::Payload as UnsealRequestPayload},
     },
@@ -73,6 +75,13 @@ impl TryConvert for UnsealRequestPayload {
         match self {
             Self::Start(start) => start.try_convert(),
             Self::EncryptedKey(key) => Ok(key.convert()),
+            Self::ContributePassphrase(cp) => Ok(
+                vault_gate::Inbound::HandleContributeUnsealPassphrase(
+                    HandleContributeUnsealPassphrase {
+                        passphrase: cp.passphrase,
+                    },
+                ),
+            ),
         }
     }
 }
@@ -107,12 +116,35 @@ impl TryConvert for proto_bootstrap::Request {
     type Error = Status;
 
     fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
-        self.encrypted_key
-            .ok_or_else(|| Status::invalid_argument("Missing bootstrap encrypted key"))?
+        self.payload
+            .ok_or_else(|| Status::invalid_argument("Missing bootstrap payload"))?
             .try_convert()
     }
 }
 
+impl TryConvert for BootstrapRequestPayload {
+    type Output = vault_gate::Inbound;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
+        match self {
+            Self::EncryptedKey(key) => key.try_convert(),
+            Self::DeclareCommittee(dc) => Ok(
+                vault_gate::Inbound::HandleDeclareCommittee(HandleDeclareCommittee {
+                    count: dc.count as usize,
+                }),
+            ),
+            Self::ContributePassphrase(cp) => Ok(
+                vault_gate::Inbound::HandleContributeBootstrapPassphrase(
+                    HandleContributeBootstrapPassphrase {
+                        passphrase: cp.passphrase,
+                    },
+                ),
+            ),
+        }
+    }
+}
+
 impl TryConvert for proto_bootstrap::BootstrapEncryptedKey {
     type Output = vault_gate::Inbound;
     type Error = Status;

server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs

@@ -4,7 +4,6 @@ use crate::{
     peers::operator::vault_gate::{self as vault_gate},
 };
 use arbiter_proto::proto::{
-    shared::VaultState as ProtoVaultState,
     operator::{
         operator_response::Payload as OperatorResponsePayload,
         vault::{
@@ -17,6 +16,7 @@ use arbiter_proto::proto::{
             },
         },
     },
+    shared::VaultState as ProtoVaultState,
 };
 
 use tonic::Status;
@@ -110,6 +110,40 @@ impl TryConvert for vault_gate::Outbound {
                 };
                 Ok(wrap_bootstrap_response(proto_result))
             }
+            Self::HandleDeclareCommittee(result) => {
+                let proto_result = match result {
+                    Ok(()) => ProtoBootstrapResult::Success,
+                    Err(err) => {
+                        warn!(?err, "declare committee failed");
+                        return Err(Status::internal("Failed to declare committee"));
+                    }
+                };
+                Ok(wrap_bootstrap_response(proto_result))
+            }
+            Self::HandleContributeBootstrapPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoBootstrapResult::Success,
+                    Ok(false) => ProtoBootstrapResult::AwaitingContributions,
+                    Err(err) => {
+                        warn!(?err, "contribute bootstrap passphrase failed");
+                        return Err(Status::internal("Failed to contribute bootstrap passphrase"));
+                    }
+                };
+                Ok(wrap_bootstrap_response(proto_result))
+            }
+            Self::HandleContributeUnsealPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoUnsealResult::Success,
+                    Ok(false) => ProtoUnsealResult::AwaitingContributions,
+                    Err(err) => {
+                        warn!(?err, "contribute unseal passphrase failed");
+                        return Err(Status::internal("Failed to contribute unseal passphrase"));
+                    }
+                };
+                Ok(wrap_unseal_response(UnsealResponsePayload::Result(
+                    proto_result.into(),
+                )))
+            }
         }
     }
 }

server/crates/arbiter-server/src/peers/operator/auth/state.rs

@@ -4,7 +4,7 @@ use super::{
 };
 use crate::{
     actors::bootstrap::ConsumeToken,
-    db::{DatabasePool, schema::operator_client},
+    db::{DatabasePool, schema::operator_identity},
     peers::operator::auth::Outbound,
 };
 use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
@@ -14,19 +14,19 @@ use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl};
 use diesel_async::RunQueryDsl;
 use tracing::error;
 
-pub(super) struct ChallengeRequest {
-    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<String>,
+pub(crate) struct ChallengeRequest {
+    pub(crate) pubkey: authn::PublicKey,
+    pub(crate) bootstrap_token: Option<String>,
 }
 
 pub struct ChallengeContext {
-    pub(super) challenge: AuthChallenge,
-    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<String>,
+    pub challenge: AuthChallenge,
+    pub pubkey: authn::PublicKey,
+    pub bootstrap_token: Option<String>,
 }
 
-pub(super) struct ChallengeSolution {
-    pub(super) solution: Vec<u8>,
+pub(crate) struct ChallengeSolution {
+    pub(crate) solution: Vec<u8>,
 }
 
 smlang::statemachine!(
@@ -44,9 +44,9 @@ async fn get_client_id(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<O
         Error::internal("Database unavailable")
     })?;
 
-    operator_client::table
-        .filter(operator_client::public_key.eq(pubkey.to_bytes()))
-        .select(operator_client::id)
+    operator_identity::table
+        .filter(operator_identity::public_key.eq(pubkey.to_bytes()))
+        .select(operator_identity::id)
         .first::<i32>(&mut conn)
         .await
         .optional()
@@ -63,9 +63,9 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
         Error::internal("Database unavailable")
     })?;
 
-    let id: i32 = diesel::insert_into(operator_client::table)
-        .values((operator_client::public_key.eq(pubkey_bytes),))
-        .returning(operator_client::id)
+    let id: i32 = diesel::insert_into(operator_identity::table)
+        .values((operator_identity::public_key.eq(pubkey_bytes),))
+        .returning(operator_identity::id)
         .get_result(&mut conn)
         .await
         .map_err(|e| {

server/crates/arbiter-server/src/peers/operator/mod.rs

@@ -180,6 +180,7 @@ where
 
     Ok(OperatorSession::spawn(OperatorSession::new(
         props.clone(),
+        creds.clone(),
         oob_sender,
     )))
 }

server/crates/arbiter-server/src/peers/operator/session/handlers.rs

@@ -1,12 +1,16 @@
 use super::{Error, OperatorSession};
 use crate::{
-    actors::evm::{
-        ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
-        SignTransactionError as EvmSignError,
+    actors::{
+        evm::{
+            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorDeleteGrant,
+            OperatorListGrants, SignTransactionError as EvmSignError,
+        },
+        flow_coordinator::client_connect_approval::ClientApprovalAnswer,
+        vault::VaultState,
+    },
+    db::models::{
+        EvmWalletAccess, EvmWalletId, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata,
     },
-    actors::flow_coordinator::client_connect_approval::ClientApprovalAnswer,
-    actors::vault::VaultState,
-    db::models::{EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata},
     evm::policies::{Grant, SpecificGrant},
 };
 use arbiter_crypto::authn;
@@ -70,7 +74,9 @@ impl OperatorSession {
     }
 
     #[message]
-    pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<(i32, Address)>, Error> {
+    pub(crate) async fn handle_evm_wallet_list(
+        &mut self,
+    ) -> Result<Vec<(EvmWalletId, Address)>, Error> {
         match self.props.actors.evm.ask(ListWallets {}).await {
             Ok(wallets) => Ok(wallets),
             Err(err) => {
@@ -116,22 +122,23 @@ impl OperatorSession {
     }
 
     #[message]
-    pub(crate) fn handle_grant_delete(&mut self, grant_id: i32) -> Result<(), GrantMutationError> {
-        // match self
-        //     .props
-        //     .actors
-        //     .evm
-        //     .ask(OperatorDeleteGrant { grant_id })
-        //     .await
-        // {
-        //     Ok(()) => Ok(()),
-        //     Err(err) => {
-        //         error!(?err, "EVM grant delete failed");
-        //         Err(GrantMutationError::Internal)
-        //     }
-        // }
-        let _ = grant_id;
-        todo!()
+    pub(crate) async fn handle_grant_delete(
+        &mut self,
+        grant_id: i32,
+    ) -> Result<(), GrantMutationError> {
+        match self
+            .props
+            .actors
+            .evm
+            .ask(OperatorDeleteGrant { grant_id })
+            .await
+        {
+            Ok(()) => Ok(()),
+            Err(err) => {
+                error!(?err, "EVM grant delete failed");
+                Err(GrantMutationError::Internal)
+            }
+        }
     }
 
     #[message]
@@ -211,8 +218,9 @@ impl OperatorSession {
     pub(crate) async fn handle_list_wallet_access(
         &mut self,
     ) -> Result<Vec<EvmWalletAccess>, Error> {
+        use crate::db::schema::evm_wallet_access;
         let mut conn = self.props.db.get().await?;
-        let access_entries = crate::db::schema::evm_wallet_access::table
+        let access_entries = evm_wallet_access::table
             .select(EvmWalletAccess::as_select())
             .load::<_>(&mut conn)
             .await?;
@@ -271,3 +279,59 @@ impl OperatorSession {
         Ok(clients)
     }
 }
+
+#[messages]
+impl OperatorSession {
+    #[message]
+    pub(crate) async fn handle_create_proposal(
+        &mut self,
+        kind: crate::actors::proposal_manager::ProposalKind,
+        ttl_secs: Option<i64>,
+    ) -> Result<i32, Error> {
+        use crate::actors::proposal_manager::CreateProposal;
+        let initiator_id = self.credentials.id;
+        self.props
+            .actors
+            .proposal_manager
+            .ask(CreateProposal { kind, initiator_id, ttl_secs })
+            .await
+            .map_err(|e| {
+                error!(?e, "create_proposal failed");
+                Error::internal("Failed to create proposal")
+            })
+    }
+
+    #[message]
+    pub(crate) async fn handle_cast_vote(
+        &mut self,
+        proposal_id: i32,
+        approve: bool,
+        signature: Vec<u8>,
+    ) -> Result<crate::actors::proposal_manager::VoteOutcome, crate::actors::proposal_manager::Error> {
+        use crate::actors::proposal_manager::CastVote;
+        let operator_id = self.credentials.id;
+        self.props
+            .actors
+            .proposal_manager
+            .ask(CastVote { proposal_id, operator_id, approve, signature })
+            .await
+            .map_err(|err| match err {
+                SendError::HandlerError(e) => e,
+                _ => crate::actors::proposal_manager::Error::ExecutionFailed("actor unavailable".to_owned()),
+            })
+    }
+
+    #[message]
+    pub(crate) async fn handle_query_pending(
+        &mut self,
+    ) -> Vec<crate::actors::proposal_manager::ProposalSummary> {
+        use crate::actors::proposal_manager::QueryPending;
+        let operator_id = self.credentials.id;
+        self.props
+            .actors
+            .proposal_manager
+            .ask(QueryPending { operator_id })
+            .await
+            .unwrap_or_default()
+    }
+}

server/crates/arbiter-server/src/peers/operator/session/mod.rs

@@ -1,7 +1,7 @@
-use super::{OutOfBand, OperatorConnection};
+use super::{Credentials, OutOfBand, OperatorConnection};
 use crate::{
     actors::{
-        flow_coordinator::client_connect_approval::{ClientApprovalAnswer, ClientApprovalController},
+        flow_coordinator::client_connect_approval::ClientApprovalController,
         operator_registry::ConnectOperator,
     },
     peers::client::ClientProfile,
@@ -51,6 +51,7 @@ pub struct PendingClientApproval {
 
 pub struct OperatorSession {
     props: OperatorConnection,
+    credentials: Credentials,
     sender: Box<dyn Sender<OutOfBand>>,
 
     pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>,
@@ -59,9 +60,10 @@ pub struct OperatorSession {
 pub mod handlers;
 
 impl OperatorSession {
-    pub(crate) fn new(props: OperatorConnection, sender: Box<dyn Sender<OutOfBand>>) -> Self {
+    pub(crate) fn new(props: OperatorConnection, credentials: Credentials, sender: Box<dyn Sender<OutOfBand>>) -> Self {
         Self {
             props,
+            credentials,
             sender,
             pending_client_approvals: HashMap::default(),
         }
@@ -88,7 +90,6 @@ impl OperatorSession {
                 actor = "operator",
                 event = "failed to announce new client connection"
             );
-            let _ = controller.tell(ClientApprovalAnswer { approved: false }).await;
             return;
         }
 

server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs

@@ -3,8 +3,9 @@ use crate::{
     actors::{
         GlobalActors,
         vault::{self, Bootstrap, GetState, TryUnseal, VaultState, events},
+        vault_coordinator::{ContributeBootstrap, ContributeUnseal, StartBootstrap},
     },
-    crypto::integrity::{self},
+    crypto::{KeyCell, integrity::{self}},
     db::DatabasePool,
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
@@ -17,6 +18,9 @@ use tokio::sync::oneshot;
 use tracing::{error, info};
 use x25519_dalek::{EphemeralSecret, PublicKey, SharedSecret};
 
+pub use VaultGateMessage as Inbound;
+pub use VaultGateMessageReply as Outbound;
+
 pub mod state;
 
 #[derive(Debug, thiserror::Error)]
@@ -98,11 +102,9 @@ impl VaultGate {
         nonce: &[u8],
         ciphertext: &[u8],
         associated_data: &[u8],
-    ) -> Result<SafeCell<Vec<u8>>, ()> {
+    ) -> Result<KeyCell, ()> {
         let nonce = XNonce::from_slice(nonce);
-
         let cipher = XChaCha20Poly1305::new(secret.as_bytes().into());
-
         let mut key_buffer = SafeCell::new(ciphertext.to_vec());
 
         let decryption_result = key_buffer.write_inline(|write_handle| {
@@ -110,7 +112,9 @@ impl VaultGate {
         });
 
         match decryption_result {
-            Ok(()) => Ok(key_buffer),
+            Ok(()) => KeyCell::try_from(key_buffer).map_err(|()| {
+                error!("Decrypted key material has unexpected length");
+            }),
             Err(err) => {
                 error!(?err, "Failed to decrypt encrypted key material");
                 Err(())
@@ -119,7 +123,7 @@ impl VaultGate {
     }
 }
 
-#[messages(messages = Inbound, replies = Outbound)]
+#[messages(enum)]
 impl VaultGate {
     #[message]
     pub fn handle_handshake(
@@ -152,17 +156,14 @@ impl VaultGate {
             return Err(Error::State);
         };
 
-        let Ok(seal_key_buffer) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-        else {
+        let Ok(seal_key) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data) else {
             return Err(Error::InvalidKey);
         };
 
         match self
             .actors
             .vault
-            .ask(TryUnseal {
-                seal_key_raw: seal_key_buffer,
-            })
+            .ask(TryUnseal { seal_key })
             .await
         {
             Ok(()) => {
@@ -192,17 +193,14 @@ impl VaultGate {
             return Err(Error::State);
         };
 
-        let Ok(seal_key_buffer) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-        else {
+        let Ok(seal_key) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data) else {
             return Err(Error::InvalidKey);
         };
 
         match self
             .actors
             .vault
-            .ask(Bootstrap {
-                seal_key_raw: seal_key_buffer,
-            })
+            .ask(Bootstrap { seal_key })
             .await
         {
             Ok(()) => {
@@ -234,6 +232,50 @@ impl VaultGate {
 
         Ok(answer)
     }
+
+    #[message]
+    pub async fn handle_declare_committee(&mut self, count: usize) -> Result<(), Error> {
+        self.actors
+            .vault_coordinator
+            .ask(StartBootstrap {
+                operator_id: self.auth_creds.id,
+                declared_count: count,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_bootstrap_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeBootstrap {
+                operator_id: self.auth_creds.id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_unseal_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeUnseal {
+                operator_id: self.auth_creds.id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
 }
 
 impl Message<events::Bootstrapped> for VaultGate {

server/crates/arbiter-server/tests/client/auth.rs

@@ -1,8 +1,5 @@
 use super::common::ChannelTransport;
-use arbiter_crypto::{
-    authn::{self, AuthChallenge, CLIENT_CONTEXT},
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use arbiter_crypto::authn::{self, AuthChallenge, CLIENT_CONTEXT};
 use arbiter_proto::{
     ClientMetadata,
     transport::{Receiver, Sender},
@@ -16,7 +13,7 @@ use arbiter_server::{
 
 use diesel::{ExpressionMethods as _, NullableExpressionMethods as _, QueryDsl as _, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 
 fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> ClientMetadata {
     ClientMetadata {
@@ -73,7 +70,7 @@ async fn insert_registered_client(
 
 fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -> authn::Signature {
     let challenge = challenge.format();
-    key.expanded_key()
+    key.signing_key()
         .sign_deterministic(&challenge, CLIENT_CONTEXT)
         .unwrap()
         .into()
@@ -81,13 +78,13 @@ fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -
 
 async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
     let mut conn = db.get().await.unwrap();
-    let sentinel_key = verifying_key(&SigningKey::<MlDsa87>::generate())
+    let sentinel_key = verifying_key(&MlDsa87::key_gen(&mut rand::rng()))
         .encode()
         .0
         .to_vec();
 
-    insert_into(schema::operator_client::table)
-        .values((schema::operator_client::public_key.eq(sentinel_key),))
+    insert_into(schema::operator_identity::table)
+        .values((schema::operator_identity::public_key.eq(sentinel_key),))
         .execute(&mut conn)
         .await
         .unwrap();
@@ -100,7 +97,7 @@ async fn spawn_test_actors(db: &db::DatabasePool) -> GlobalActors {
     actors
         .vault
         .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
         })
         .await
         .unwrap();
@@ -120,7 +117,7 @@ pub async fn unregistered_pubkey_rejected() {
         connect_client(props, &mut server_transport).await;
     });
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
 
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
@@ -140,7 +137,7 @@ pub async fn challenge_auth() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
 
     Box::pin(insert_registered_client(
         &db,
@@ -206,7 +203,7 @@ pub async fn challenge_auth() {
 pub async fn metadata_unchanged_does_not_append_history() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     let requested = metadata("client", Some("desc"), Some("1.0.0"));
 
     Box::pin(insert_registered_client(
@@ -269,7 +266,7 @@ pub async fn metadata_unchanged_does_not_append_history() {
 pub async fn metadata_change_appends_history_and_repoints_binding() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
 
     Box::pin(insert_registered_client(
         &db,
@@ -357,7 +354,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     let requested = metadata("client", Some("desc"), Some("1.0.0"));
 
     {

server/crates/arbiter-server/tests/common/mod.rs

@@ -2,7 +2,6 @@
     dead_code,
     reason = "Common test utilities that may not be used in every test"
 )]
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use arbiter_proto::transport::{Bi, Error, Receiver, Sender};
 use arbiter_server::{
     actors::{GlobalActors, vault::Vault},
@@ -19,7 +18,7 @@ pub(crate) async fn bootstrapped_vault(db: &db::DatabasePool) -> Vault {
         .await
         .unwrap();
     actor
-        .bootstrap(SafeCell::new(b"test-seal-key".to_vec()))
+        .bootstrap(arbiter_server::crypto::KeyCell::from([0u8; 32]))
         .await
         .unwrap();
     actor

server/crates/arbiter-server/tests/governance.rs

@@ -0,0 +1,832 @@
+use arbiter_crypto::authn::{self, GOVERNANCE_CONTEXT};
+use arbiter_server::{
+    actors::{
+        GlobalActors,
+        proposal_manager::{CastVote, CreateProposal, Error as ProposalError, ExpireStale, ProposalKind, QueryPending, VoteOutcome},
+    },
+    crypto::KeyCell,
+    db,
+};
+use arbiter_server::actors::vault::Bootstrap;
+use arbiter_server::db::schema::{aead_encrypted, evm_basic_grant, evm_wallet, evm_wallet_access, operator_identity, proposal_result};
+use diesel::{ExpressionMethods, QueryDsl, insert_into};
+use diesel_async::RunQueryDsl;
+
+async fn register_operator(db: &db::DatabasePool, pubkey: &authn::PublicKey) -> i32 {
+    let mut conn = db.get().await.unwrap();
+    insert_into(operator_identity::table)
+        .values(operator_identity::public_key.eq(pubkey.to_bytes()))
+        .returning(operator_identity::id)
+        .get_result::<i32>(&mut conn)
+        .await
+        .unwrap()
+}
+
+fn make_vote_message(proposal_id: i32, approve: bool) -> Vec<u8> {
+    let mut msg = Vec::with_capacity(9);
+    msg.extend_from_slice(&(proposal_id as i64).to_be_bytes());
+    msg.push(u8::from(approve));
+    msg
+}
+
+async fn insert_evm_wallet(db: &db::DatabasePool) -> i32 {
+    let mut conn = db.get().await.unwrap();
+    let aead_id: i32 = insert_into(aead_encrypted::table)
+        .values((
+            aead_encrypted::current_nonce.eq(vec![0u8; 4]),
+            aead_encrypted::ciphertext.eq(vec![0u8; 32]),
+            aead_encrypted::tag.eq(vec![0u8; 16]),
+            aead_encrypted::associated_root_key_id.eq(0i32),
+        ))
+        .returning(aead_encrypted::id)
+        .get_result::<i32>(&mut conn)
+        .await
+        .unwrap();
+    insert_into(evm_wallet::table)
+        .values((
+            evm_wallet::address.eq(vec![0u8; 20]),
+            evm_wallet::aead_encrypted_id.eq(aead_id),
+        ))
+        .returning(evm_wallet::id)
+        .get_result::<i32>(&mut conn)
+        .await
+        .unwrap()
+}
+
+async fn insert_unapproved_client(db: &db::DatabasePool, pubkey: &authn::PublicKey) -> i32 {
+    use arbiter_server::db::schema::{client_metadata, program_client};
+    let mut conn = db.get().await.unwrap();
+    let metadata_id: i32 = insert_into(client_metadata::table)
+        .values((
+            client_metadata::name.eq("test-client"),
+            client_metadata::description.eq(Option::<String>::None),
+            client_metadata::version.eq(Option::<String>::None),
+        ))
+        .returning(client_metadata::id)
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+
+    insert_into(program_client::table)
+        .values((
+            program_client::public_key.eq(pubkey.to_bytes()),
+            program_client::metadata_id.eq(metadata_id),
+        ))
+        .returning(program_client::id)
+        .get_result(&mut conn)
+        .await
+        .unwrap()
+}
+
+#[tokio::test]
+async fn create_proposal_returns_id() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap {
+            seal_key: KeyCell::from([0u8; 32]),
+        })
+        .await
+        .unwrap();
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id: 42 },
+            initiator_id: 1,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    assert!(proposal_id > 0);
+}
+
+#[tokio::test]
+async fn single_operator_vote_reaches_quorum() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op_id = register_operator(&db, &signing_key.public_key()).await;
+
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op_id,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = signing_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op_id,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+}
+
+#[tokio::test]
+async fn two_operator_first_vote_is_pending() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let key1 = authn::SigningKey::generate();
+    let key2 = authn::SigningKey::generate();
+    let op1 = register_operator(&db, &key1.public_key()).await;
+    let _op2 = register_operator(&db, &key2.public_key()).await;
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op1,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = key1.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op1,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::Pending);
+}
+
+#[tokio::test]
+async fn duplicate_vote_rejected() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let key = authn::SigningKey::generate();
+    let op = register_operator(&db, &key.public_key()).await;
+
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    // Second vote same operator
+    let sig2 = key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let result = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op,
+            approve: true,
+            signature: sig2.to_bytes(),
+        })
+        .await;
+
+    assert!(matches!(
+        result,
+        Err(kameo::error::SendError::HandlerError(ProposalError::AlreadyVoted))
+    ));
+}
+
+#[tokio::test]
+async fn invalid_signature_rejected() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let key = authn::SigningKey::generate();
+    let op = register_operator(&db, &key.public_key()).await;
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let result = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op,
+            approve: true,
+            signature: vec![0u8; 32], // garbage
+        })
+        .await;
+
+    assert!(matches!(
+        result,
+        Err(kameo::error::SendError::HandlerError(ProposalError::InvalidSignature))
+    ));
+}
+
+#[tokio::test]
+async fn query_pending_excludes_already_voted() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op = register_operator(&db, &signing_key.public_key()).await;
+
+    let client_key1 = authn::SigningKey::generate();
+    let client_id1 = insert_unapproved_client(&db, &client_key1.public_key()).await;
+    let client_key2 = authn::SigningKey::generate();
+    let client_id2 = insert_unapproved_client(&db, &client_key2.public_key()).await;
+
+    let p1 = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id: client_id1 },
+            initiator_id: op,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let p2 = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id: client_id2 },
+            initiator_id: op,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    // Vote on p1 — with 1 operator this reaches quorum (QuorumApproved)
+    let msg = make_vote_message(p1, true);
+    let sig = signing_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id: p1,
+            operator_id: op,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+
+    // QueryPending should return only p2
+    let pending = actors
+        .proposal_manager
+        .ask(QueryPending { operator_id: op })
+        .await
+        .unwrap();
+
+    assert_eq!(pending.len(), 1);
+    assert_eq!(pending[0].id, p2);
+}
+
+#[tokio::test]
+async fn expire_stale_marks_old_proposals_expired() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op = register_operator(&db, &signing_key.public_key()).await;
+
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    // Create proposal with ttl_secs = -1 so it's immediately expired
+    let _proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op,
+            ttl_secs: Some(-1),
+        })
+        .await
+        .unwrap();
+
+    let expired = actors
+        .proposal_manager
+        .ask(ExpireStale)
+        .await
+        .unwrap();
+    assert_eq!(expired, 1);
+
+    let pending = actors
+        .proposal_manager
+        .ask(QueryPending { operator_id: op })
+        .await
+        .unwrap();
+    assert!(pending.is_empty());
+}
+
+#[tokio::test]
+async fn approve_sdk_client_writes_integrity_envelope() {
+    use arbiter_server::db::schema::integrity_envelope;
+
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let op_key = authn::SigningKey::generate();
+    let op_id = register_operator(&db, &op_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op_id,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = op_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op_id,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+
+    let mut conn = db.get().await.unwrap();
+    let count: i64 = integrity_envelope::table
+        .filter(integrity_envelope::entity_kind.eq("client_credentials"))
+        .count()
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(count, 1);
+}
+
+#[tokio::test]
+async fn grant_wallet_access_on_quorum_approval() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op_id = register_operator(&db, &signing_key.public_key()).await;
+
+    let wallet_id = insert_evm_wallet(&db).await;
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::GrantWalletAccess { wallet_id, client_id },
+            initiator_id: op_id,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = signing_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op_id,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+
+    let mut conn = db.get().await.unwrap();
+    let count: i64 = evm_wallet_access::table
+        .filter(evm_wallet_access::wallet_id.eq(wallet_id))
+        .filter(evm_wallet_access::client_id.eq(client_id))
+        .count()
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(count, 1);
+}
+
+#[tokio::test]
+async fn approve_persistent_grant_creates_basic_grant_row() {
+    use arbiter_proto::proto::operator::governance::{
+        ApprovePersistentGrantPayload, EtherTransferSpecProto, VolumeLimitProto,
+        approve_persistent_grant_payload::Specific,
+    };
+    use prost::Message as _;
+
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op_id = register_operator(&db, &signing_key.public_key()).await;
+
+    // Insert a dummy wallet and client, then a wallet_access row
+    let wallet_id = insert_evm_wallet(&db).await;
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let mut conn = db.get().await.unwrap();
+    let wallet_access_id: i32 = insert_into(evm_wallet_access::table)
+        .values((
+            evm_wallet_access::wallet_id.eq(wallet_id),
+            evm_wallet_access::client_id.eq(client_id),
+        ))
+        .returning(evm_wallet_access::id)
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    drop(conn);
+
+    let payload = ApprovePersistentGrantPayload {
+        wallet_access_id,
+        chain_id: 1,
+        valid_from_secs: None,
+        valid_until_secs: None,
+        max_gas_fee_per_gas: None,
+        max_priority_fee_per_gas: None,
+        rate_limit: None,
+        specific: Some(Specific::EtherTransfer(EtherTransferSpecProto {
+            targets: vec![vec![0u8; 20]],
+            limit: Some(VolumeLimitProto {
+                max_volume: alloy::primitives::U256::from(1_000_000u64).to_be_bytes_vec(),
+                window_secs: 86400,
+            }),
+        })),
+    };
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApprovePersistentGrant { payload_bytes: payload.encode_to_vec() },
+            initiator_id: op_id,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = signing_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op_id,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+
+    let mut conn = db.get().await.unwrap();
+    let count: i64 = evm_basic_grant::table
+        .filter(evm_basic_grant::wallet_access_id.eq(wallet_access_id))
+        .count()
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(count, 1);
+}
+
+#[tokio::test]
+async fn approve_one_off_transaction_stores_result() {
+    use arbiter_proto::proto::operator::governance::ApproveOneOffTransactionPayload;
+    use arbiter_server::actors::evm::{Generate, OperatorCreateGrant};
+    use arbiter_server::evm::policies::{
+        SharedGrantSettings, SpecificGrant, VolumeRateLimit, ether_transfer,
+    };
+    use alloy::primitives::{Address, U256};
+    use chrono::Duration;
+    use prost::Message as _;
+
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op_id = register_operator(&db, &signing_key.public_key()).await;
+
+    // Create a real encrypted wallet
+    let (wallet_id, wallet_address) = actors.evm.ask(Generate {}).await.unwrap();
+
+    // Create a client and wallet_access
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let mut conn = db.get().await.unwrap();
+    let wallet_access_id: i32 = insert_into(evm_wallet_access::table)
+        .values((
+            evm_wallet_access::wallet_id.eq(wallet_id),
+            evm_wallet_access::client_id.eq(client_id),
+        ))
+        .returning(evm_wallet_access::id)
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    drop(conn);
+
+    // Create a grant that permits ether transfer to address zero
+    let to_address = Address::ZERO;
+    actors
+        .evm
+        .ask(OperatorCreateGrant {
+            basic: SharedGrantSettings {
+                wallet_access_id,
+                chain: 1,
+                valid_from: None,
+                valid_until: None,
+                max_gas_fee_per_gas: None,
+                max_priority_fee_per_gas: None,
+                rate_limit: None,
+            },
+            grant: SpecificGrant::EtherTransfer(ether_transfer::Settings {
+                target: vec![to_address],
+                limit: VolumeRateLimit {
+                    max_volume: U256::from(1_000_000_000_000_000_000u128),
+                    window: Duration::hours(24),
+                },
+            }),
+        })
+        .await
+        .unwrap();
+
+    // Encode the one-off transaction payload
+    let payload = ApproveOneOffTransactionPayload {
+        client_id,
+        wallet_address: wallet_address.as_slice().to_vec(),
+        chain_id: 1,
+        nonce: 0,
+        gas_limit: 21000,
+        max_fee_per_gas: 1u128.to_be_bytes().to_vec(),
+        max_priority_fee_per_gas: 1u128.to_be_bytes().to_vec(),
+        to: to_address.as_slice().to_vec(),
+        value: U256::from(1u64).to_be_bytes_vec(),
+        input: vec![],
+    };
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveOneOffTransaction { payload_bytes: payload.encode_to_vec() },
+            initiator_id: op_id,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = signing_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op_id,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+
+    let mut conn = db.get().await.unwrap();
+    let count: i64 = proposal_result::table
+        .filter(proposal_result::proposal_id.eq(proposal_id))
+        .count()
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(count, 1);
+}
+
+#[tokio::test]
+async fn replace_operator_inserts_identity_row() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op_id = register_operator(&db, &signing_key.public_key()).await;
+
+    let new_op_key = authn::SigningKey::generate();
+    let new_pubkey = new_op_key.public_key().to_bytes();
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ReplaceOperator { new_pubkey },
+            initiator_id: op_id,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = signing_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op_id,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+
+    let mut conn = db.get().await.unwrap();
+    let count: i64 = operator_identity::table
+        .count()
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(count, 2); // original + new
+}
+
+#[tokio::test]
+async fn update_shamir_parameters_reaches_quorum() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op_id = register_operator(&db, &signing_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::UpdateShamirParameters { new_n: 5 },
+            initiator_id: op_id,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = signing_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op_id,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+}
+
+#[tokio::test]
+async fn approve_server_update_reaches_quorum() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op_id = register_operator(&db, &signing_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveServerUpdate,
+            initiator_id: op_id,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = signing_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op_id,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+}

server/crates/arbiter-server/tests/operator/auth.rs

@@ -1,8 +1,5 @@
 use super::common::ChannelTransport;
-use arbiter_crypto::{
-    authn::{self, AuthChallenge, OPERATOR_CONTEXT},
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
 use arbiter_proto::transport::{Error as TransportError, Receiver, Sender};
 use arbiter_server::{
     actors::{GlobalActors, bootstrap::GetToken, vault::Bootstrap},
@@ -14,7 +11,7 @@ use arbiter_server::{
 use async_trait::async_trait;
 use diesel::{ExpressionMethods as _, QueryDsl, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 use tokio::sync::mpsc;
 
 fn verifying_key(key: &SigningKey<MlDsa87>) -> VerifyingKey<MlDsa87> {
@@ -26,7 +23,7 @@ fn sign_operator_challenge(
     challenge: &AuthChallenge,
 ) -> authn::Signature {
     let challenge = challenge.format();
-    key.expanded_key()
+    key.signing_key()
         .sign_deterministic(&challenge, OPERATOR_CONTEXT)
         .unwrap()
         .into()
@@ -157,7 +154,7 @@ pub async fn bootstrap_token_auth() {
     actors
         .vault
         .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
         })
         .await
         .unwrap();
@@ -170,7 +167,7 @@ pub async fn bootstrap_token_auth() {
         auth::authenticate(&mut props, &mut server_transport).await
     });
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
@@ -206,8 +203,8 @@ pub async fn bootstrap_token_auth() {
     task.await.unwrap().unwrap();
 
     let mut conn = db.get().await.unwrap();
-    let stored_pubkey: Vec<u8> = schema::operator_client::table
-        .select(schema::operator_client::public_key)
+    let stored_pubkey: Vec<u8> = schema::operator_identity::table
+        .select(schema::operator_identity::public_key)
         .first::<Vec<u8>>(&mut conn)
         .await
         .unwrap();
@@ -227,7 +224,7 @@ pub async fn bootstrap_invalid_token_auth() {
         auth::authenticate(&mut props, &mut server_transport).await
     });
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
@@ -259,7 +256,7 @@ pub async fn bootstrap_invalid_token_auth() {
     ));
 
     let mut conn = db.get().await.unwrap();
-    let count: i64 = schema::operator_client::table
+    let count: i64 = schema::operator_identity::table
         .count()
         .get_result::<i64>(&mut conn)
         .await
@@ -275,19 +272,19 @@ pub async fn challenge_auth() {
     actors
         .vault
         .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
         })
         .await
         .unwrap();
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {
         let mut conn = db.get().await.unwrap();
-        let id: i32 = insert_into(schema::operator_client::table)
-            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
-            .returning(schema::operator_client::id)
+        let id: i32 = insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
+            .returning(schema::operator_identity::id)
             .get_result(&mut conn)
             .await
             .unwrap();
@@ -361,18 +358,18 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
     actors
         .vault
         .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
         })
         .await
         .unwrap();
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {
         let mut conn = db.get().await.unwrap();
-        insert_into(schema::operator_client::table)
-            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
+        insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
             .execute(&mut conn)
             .await
             .unwrap();
@@ -400,7 +397,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
     let challenge = match response {
         Ok(resp) => match resp {
             auth::Outbound::AuthChallenge { challenge } => challenge,
-            other @ auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got {other:?}"),
+            other => panic!("Expected AuthChallenge, got {other:?}"),
         },
         Err(err) => panic!("Expected Ok response, got Err({err:?})"),
     };
@@ -434,19 +431,19 @@ pub async fn challenge_auth_rejects_invalid_signature() {
     actors
         .vault
         .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
         })
         .await
         .unwrap();
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {
         let mut conn = db.get().await.unwrap();
-        let id: i32 = insert_into(schema::operator_client::table)
-            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
-            .returning(schema::operator_client::id)
+        let id: i32 = insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
+            .returning(schema::operator_identity::id)
             .get_result(&mut conn)
             .await
             .unwrap();

server/crates/arbiter-server/tests/operator/unseal.rs

@@ -1,7 +1,4 @@
-use arbiter_crypto::{
-    authn,
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use arbiter_crypto::authn;
 use arbiter_server::{
     actors::{
         GlobalActors,
@@ -22,7 +19,7 @@ use tokio::sync::oneshot;
 use x25519_dalek::{EphemeralSecret, PublicKey};
 
 async fn setup_sealed_gate(
-    seal_key: &[u8],
+    seal_key: &[u8; 32],
 ) -> (
     db::DatabasePool,
     kameo::actor::ActorRef<VaultGate>,
@@ -34,7 +31,7 @@ async fn setup_sealed_gate(
     actors
         .vault
         .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(seal_key.to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from(*seal_key),
         })
         .await
         .unwrap();
@@ -50,7 +47,7 @@ async fn setup_sealed_gate(
 
 async fn client_dh_encrypt(
     gate: &kameo::actor::ActorRef<VaultGate>,
-    key_to_send: &[u8],
+    key_to_send: &[u8; 32],
 ) -> HandleUnsealEncryptedKey {
     let client_secret = EphemeralSecret::random();
     let client_public = PublicKey::from(&client_secret);
@@ -83,7 +80,7 @@ async fn client_dh_encrypt(
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_success() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
     let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;
 
     let encrypted_key = client_dh_encrypt(&gate, seal_key).await;
@@ -95,10 +92,10 @@ pub async fn unseal_success() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_wrong_seal_key() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
     let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;
 
-    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
+    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key-padded-to-32-bytes!!!!").await;
 
     let response = gate.ask(encrypted_key).await;
     assert!(matches!(
@@ -112,7 +109,7 @@ pub async fn unseal_wrong_seal_key() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_corrupted_ciphertext() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
     let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;
 
     let client_secret = EphemeralSecret::random();
@@ -143,11 +140,11 @@ pub async fn unseal_corrupted_ciphertext() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_retry_after_invalid_key() {
-    let seal_key = b"real-seal-key";
+    let seal_key = b"real-seal-key-padded-to-32bytes!";
     let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;
 
     {
-        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
+        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key-padded-to-32-bytes!!!!").await;
 
         let response = gate.ask(encrypted_key).await;
         assert!(matches!(

server/crates/arbiter-server/tests/vault/concurrency.rs

@@ -166,7 +166,7 @@ async fn decrypt_roundtrip_after_high_concurrency() {
         .await
         .unwrap();
     decryptor
-        .try_unseal(SafeCell::new(b"test-seal-key".to_vec()))
+        .try_unseal(arbiter_server::crypto::KeyCell::from([0u8; 32]))
         .await
         .unwrap();
 

server/crates/arbiter-server/tests/vault/lifecycle.rs

@@ -5,7 +5,7 @@ use arbiter_server::{
         GlobalActors,
         vault::{Error, Vault},
     },
-    crypto::encryption::v1::{Nonce, ROOT_KEY_TAG},
+    crypto::{KeyCell, encryption::v1::{Nonce, ROOT_KEY_TAG}},
     db::{self, models, schema},
 };
 
@@ -14,13 +14,13 @@ use diesel_async::RunQueryDsl;
 
 #[tokio::test]
 #[test_log::test]
-async fn bootstrap() {
+async fn test_bootstrap() {
     let db = db::create_test_pool().await;
     let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
         .await
         .unwrap();
 
-    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key = KeyCell::from([0u8; 32]);
     actor.bootstrap(seal_key).await.unwrap();
 
     let mut conn = db.get().await.unwrap();
@@ -39,18 +39,18 @@ async fn bootstrap() {
 
 #[tokio::test]
 #[test_log::test]
-async fn bootstrap_rejects_double() {
+async fn test_bootstrap_rejects_double() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
-    let seal_key2 = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key2 = KeyCell::from([0u8; 32]);
     let err = actor.bootstrap(seal_key2).await.unwrap_err();
     assert!(matches!(err, Error::AlreadyBootstrapped));
 }
 
 #[tokio::test]
 #[test_log::test]
-async fn create_new_before_bootstrap_fails() {
+async fn test_create_new_before_bootstrap_fails() {
     let db = db::create_test_pool().await;
     let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
         .await
@@ -65,7 +65,7 @@ async fn create_new_before_bootstrap_fails() {
 
 #[tokio::test]
 #[test_log::test]
-async fn decrypt_before_bootstrap_fails() {
+async fn test_decrypt_before_bootstrap_fails() {
     let db = db::create_test_pool().await;
     let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
         .await
@@ -77,7 +77,7 @@ async fn decrypt_before_bootstrap_fails() {
 
 #[tokio::test]
 #[test_log::test]
-async fn new_restores_sealed_state() {
+async fn test_new_restores_sealed_state() {
     let db = db::create_test_pool().await;
     let actor = common::bootstrapped_vault(&db).await;
     drop(actor);
@@ -91,7 +91,7 @@ async fn new_restores_sealed_state() {
 
 #[tokio::test]
 #[test_log::test]
-async fn unseal_correct_password() {
+async fn test_unseal_correct_password() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
@@ -105,7 +105,7 @@ async fn unseal_correct_password() {
     let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
         .await
         .unwrap();
-    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key = KeyCell::from([0u8; 32]);
     actor.try_unseal(seal_key).await.unwrap();
 
     let mut decrypted = actor.decrypt(aead_id).await.unwrap();
@@ -114,7 +114,7 @@ async fn unseal_correct_password() {
 
 #[tokio::test]
 #[test_log::test]
-async fn unseal_wrong_then_correct_password() {
+async fn test_unseal_wrong_then_correct_password() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
@@ -129,11 +129,11 @@ async fn unseal_wrong_then_correct_password() {
         .await
         .unwrap();
 
-    let bad_key = SafeCell::new(b"wrong-password".to_vec());
+    let bad_key = KeyCell::from([1u8; 32]);
     let err = actor.try_unseal(bad_key).await.unwrap_err();
     assert!(matches!(err, Error::InvalidKey));
 
-    let good_key = SafeCell::new(b"test-seal-key".to_vec());
+    let good_key = KeyCell::from([0u8; 32]);
     actor.try_unseal(good_key).await.unwrap();
 
     let mut decrypted = actor.decrypt(aead_id).await.unwrap();

server/crates/arbiter-server/tests/vault/storage.rs

@@ -12,7 +12,7 @@ use std::collections::HashSet;
 
 #[tokio::test]
 #[test_log::test]
-async fn create_decrypt_roundtrip() {
+async fn test_create_decrypt_roundtrip() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
@@ -28,7 +28,7 @@ async fn create_decrypt_roundtrip() {
 
 #[tokio::test]
 #[test_log::test]
-async fn decrypt_nonexistent_returns_not_found() {
+async fn test_decrypt_nonexistent_returns_not_found() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
@@ -38,7 +38,7 @@ async fn decrypt_nonexistent_returns_not_found() {
 
 #[tokio::test]
 #[test_log::test]
-async fn ciphertext_differs_across_entries() {
+async fn test_ciphertext_differs_across_entries() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
@@ -76,7 +76,7 @@ async fn ciphertext_differs_across_entries() {
 
 #[tokio::test]
 #[test_log::test]
-async fn nonce_never_reused() {
+async fn test_nonce_never_reused() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;