test(client-auth): update metadata test to reflect frozen-metadata behavior

Three independent failures allowed an offline attacker with DB write access
to sign transactions using a different wallet's private key:
1. evm_wallet had no HMAC envelope — aead_encrypted_id could be swapped silently.
2. AEAD used a static tag as AAD — any valid ciphertext decrypted as any wallet key.
3. No post-decryption check that the derived address matched the requested wallet.

Fix: sign_entity covers (address, aead_encrypted_id) in a single transaction;
CreateNew/Decrypt take caller-provided AAD (wallet address bytes); after decryption
signer.address() is verified against the requested wallet address.

docs/superpowers/plans/2026-03-28-grant-grid-view.md

@@ -0,0 +1,821 @@
+# Grant Grid View Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add an "EVM Grants" dashboard tab that displays all grants as enriched cards (type, chain, wallet address, client name) with per-card revoke support.
+
+**Architecture:** A new `walletAccessListProvider` fetches wallet accesses with their DB row IDs. The screen (`grants.dart`) watches only `evmGrantsProvider` for top-level state. Each `GrantCard` widget (its own file) watches enrichment providers (`walletAccessListProvider`, `evmProvider`, `sdkClientsProvider`) and the revoke mutation directly — keeping rebuilds scoped to the card. The screen is registered as a dashboard tab in `AdaptiveScaffold`.
+
+**Tech Stack:** Flutter, Riverpod (`riverpod_annotation` + `build_runner` codegen), `sizer` (adaptive sizing), `auto_route`, Protocol Buffers (Dart), `Palette` design tokens.
+
+---
+
+## File Map
+
+| File | Action | Responsibility |
+|---|---|---|
+| `operator/lib/theme/palette.dart` | Modify | Add `Palette.token` (indigo accent for token-transfer cards) |
+| `operator/lib/features/connection/evm/wallet_access.dart` | Modify | Add `listAllWalletAccesses()` function |
+| `operator/lib/providers/sdk_clients/wallet_access_list.dart` | Create | `WalletAccessListProvider` — fetches full wallet access list with IDs |
+| `operator/lib/screens/dashboard/evm/grants/widgets/grant_card.dart` | Create | `GrantCard` widget — watches enrichment providers + revoke mutation; one card per grant |
+| `operator/lib/screens/dashboard/evm/grants/grants.dart` | Create | `EvmGrantsScreen` — watches `evmGrantsProvider`; handles loading/error/empty/data states; renders `GrantCard` list |
+| `operator/lib/router.dart` | Modify | Register `EvmGrantsRoute` in dashboard children |
+| `operator/lib/screens/dashboard.dart` | Modify | Add Grants entry to `routes` list and `NavigationDestination` list |
+
+---
+
+## Task 1: Add `Palette.token`
+
+**Files:**
+- Modify: `operator/lib/theme/palette.dart`
+
+- [ ] **Step 1: Add the color**
+
+Replace the contents of `operator/lib/theme/palette.dart` with:
+
+```dart
+import 'package:flutter/material.dart';
+
+class Palette {
+  static const ink = Color(0xFF15263C);
+  static const coral = Color(0xFFE26254);
+  static const cream = Color(0xFFFFFAF4);
+  static const line = Color(0x1A15263C);
+  static const token = Color(0xFF5C6BC0);
+}
+```
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd operator && flutter analyze lib/theme/palette.dart
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(theme): add Palette.token for token-transfer grant cards"
+jj new
+```
+
+---
+
+## Task 2: Add `listAllWalletAccesses` feature function
+
+**Files:**
+- Modify: `operator/lib/features/connection/evm/wallet_access.dart`
+
+`readClientWalletAccess` (existing) filters the list to one client's wallet IDs and returns `Set<int>`. This new function returns the complete unfiltered list with row IDs so the grant cards can resolve wallet_access_id → wallet + client.
+
+- [ ] **Step 1: Append function**
+
+Add at the bottom of `operator/lib/features/connection/evm/wallet_access.dart`:
+
+```dart
+Future<List<SdkClientWalletAccess>> listAllWalletAccesses(
+  Connection connection,
+) async {
+  final response = await connection.ask(
+    OperatorRequest(listWalletAccess: Empty()),
+  );
+  if (!response.hasListWalletAccessResponse()) {
+    throw Exception(
+      'Expected list wallet access response, got ${response.whichPayload()}',
+    );
+  }
+  return response.listWalletAccessResponse.accesses.toList(growable: false);
+}
+```
+
+Each returned `SdkClientWalletAccess` has:
+- `.id` — the `evm_wallet_access` row ID (same value as `wallet_access_id` in a `GrantEntry`)
+- `.access.walletId` — the EVM wallet DB ID
+- `.access.sdkClientId` — the SDK client DB ID
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd operator && flutter analyze lib/features/connection/evm/wallet_access.dart
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(evm): add listAllWalletAccesses feature function"
+jj new
+```
+
+---
+
+## Task 3: Create `WalletAccessListProvider`
+
+**Files:**
+- Create: `operator/lib/providers/sdk_clients/wallet_access_list.dart`
+- Generated: `operator/lib/providers/sdk_clients/wallet_access_list.g.dart`
+
+Mirrors the structure of `EvmGrants` in `providers/evm/evm_grants.dart` — class-based `@riverpod` with a `refresh()` method.
+
+- [ ] **Step 1: Write the provider**
+
+Create `operator/lib/providers/sdk_clients/wallet_access_list.dart`:
+
+```dart
+import 'package:arbiter/features/connection/evm/wallet_access.dart';
+import 'package:arbiter/proto/operator.pb.dart';
+import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:mtcore/markettakers.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'wallet_access_list.g.dart';
+
+@riverpod
+class WalletAccessList extends _$WalletAccessList {
+  @override
+  Future<List<SdkClientWalletAccess>?> build() async {
+    final connection = await ref.watch(connectionManagerProvider.future);
+    if (connection == null) {
+      return null;
+    }
+
+    try {
+      return await listAllWalletAccesses(connection);
+    } catch (e, st) {
+      talker.handle(e, st);
+      rethrow;
+    }
+  }
+
+  Future<void> refresh() async {
+    final connection = await ref.read(connectionManagerProvider.future);
+    if (connection == null) {
+      state = const AsyncData(null);
+      return;
+    }
+
+    state = const AsyncLoading();
+    state = await AsyncValue.guard(() => listAllWalletAccesses(connection));
+  }
+}
+```
+
+- [ ] **Step 2: Run code generation**
+
+```sh
+cd operator && dart run build_runner build --delete-conflicting-outputs
+```
+
+Expected: `operator/lib/providers/sdk_clients/wallet_access_list.g.dart` created. No errors.
+
+- [ ] **Step 3: Verify**
+
+```sh
+cd operator && flutter analyze lib/providers/sdk_clients/
+```
+
+Expected: no issues.
+
+- [ ] **Step 4: Commit**
+
+```sh
+jj describe -m "feat(providers): add WalletAccessListProvider"
+jj new
+```
+
+---
+
+## Task 4: Create `GrantCard` widget
+
+**Files:**
+- Create: `operator/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`
+
+This widget owns all per-card logic: enrichment lookups, revoke action, and rebuild scope. The screen only passes it a `GrantEntry` — the card fetches everything else itself.
+
+**Key types:**
+- `GrantEntry` (from `proto/evm.pb.dart`): `.id`, `.shared.walletAccessId`, `.shared.chainId`, `.specific.whichGrant()`
+- `SpecificGrant_Grant.etherTransfer` / `.tokenTransfer` — enum values for the oneof
+- `SdkClientWalletAccess` (from `proto/operator.pb.dart`): `.id`, `.access.walletId`, `.access.sdkClientId`
+- `WalletEntry` (from `proto/evm.pb.dart`): `.id`, `.address` (List<int>)
+- `SdkClientEntry` (from `proto/operator.pb.dart`): `.id`, `.info.name`
+- `revokeEvmGrantMutation` — `Mutation<void>` (global; all revoke buttons disable together while any revoke is in flight)
+- `executeRevokeEvmGrant(ref, grantId: int)` — `Future<void>`
+
+- [ ] **Step 1: Write the widget**
+
+Create `operator/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`:
+
+```dart
+import 'package:arbiter/proto/evm.pb.dart';
+import 'package:arbiter/proto/operator.pb.dart';
+import 'package:arbiter/providers/evm/evm.dart';
+import 'package:arbiter/providers/evm/evm_grants.dart';
+import 'package:arbiter/providers/sdk_clients/list.dart';
+import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:sizer/sizer.dart';
+
+String _shortAddress(List<int> bytes) {
+  final hex = bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();
+  return '0x${hex.substring(0, 6)}...${hex.substring(hex.length - 4)}';
+}
+
+String _formatError(Object error) {
+  final message = error.toString();
+  if (message.startsWith('Exception: ')) {
+    return message.substring('Exception: '.length);
+  }
+  return message;
+}
+
+class GrantCard extends ConsumerWidget {
+  const GrantCard({super.key, required this.grant});
+
+  final GrantEntry grant;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    // Enrichment lookups — each watch scopes rebuilds to this card only
+    final walletAccesses =
+        ref.watch(walletAccessListProvider).asData?.value ?? const [];
+    final wallets = ref.watch(evmProvider).asData?.value ?? const [];
+    final clients = ref.watch(sdkClientsProvider).asData?.value ?? const [];
+    final revoking = ref.watch(revokeEvmGrantMutation) is MutationPending;
+
+    final isEther =
+        grant.specific.whichGrant() == SpecificGrant_Grant.etherTransfer;
+    final accent = isEther ? Palette.coral : Palette.token;
+    final typeLabel = isEther ? 'Ether' : 'Token';
+    final theme = Theme.of(context);
+    final muted = Palette.ink.withValues(alpha: 0.62);
+
+    // Resolve wallet_access_id → wallet address + client name
+    final accessById = <int, SdkClientWalletAccess>{
+      for (final a in walletAccesses) a.id: a,
+    };
+    final walletById = <int, WalletEntry>{
+      for (final w in wallets) w.id: w,
+    };
+    final clientNameById = <int, String>{
+      for (final c in clients) c.id: c.info.name,
+    };
+
+    final accessId = grant.shared.walletAccessId;
+    final access = accessById[accessId];
+    final wallet = access != null ? walletById[access.access.walletId] : null;
+
+    final walletLabel = wallet != null
+        ? _shortAddress(wallet.address)
+        : 'Access #$accessId';
+
+    final clientLabel = () {
+      if (access == null) return '';
+      final name = clientNameById[access.access.sdkClientId] ?? '';
+      return name.isEmpty ? 'Client #${access.access.sdkClientId}' : name;
+    }();
+
+    void showError(String message) {
+      if (!context.mounted) return;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
+      );
+    }
+
+    Future<void> revoke() async {
+      try {
+        await executeRevokeEvmGrant(ref, grantId: grant.id);
+      } catch (e) {
+        showError(_formatError(e));
+      }
+    }
+
+    return Container(
+      decoration: BoxDecoration(
+        borderRadius: BorderRadius.circular(24),
+        color: Palette.cream.withValues(alpha: 0.92),
+        border: Border.all(color: Palette.line),
+      ),
+      child: IntrinsicHeight(
+        child: Row(
+          crossAxisAlignment: CrossAxisAlignment.stretch,
+          children: [
+            // Accent strip
+            Container(
+              width: 0.8.w,
+              decoration: BoxDecoration(
+                color: accent,
+                borderRadius: const BorderRadius.horizontal(
+                  left: Radius.circular(24),
+                ),
+              ),
+            ),
+            // Card body
+            Expanded(
+              child: Padding(
+                padding: EdgeInsets.symmetric(
+                  horizontal: 1.6.w,
+                  vertical: 1.4.h,
+                ),
+                child: Column(
+                  crossAxisAlignment: CrossAxisAlignment.start,
+                  children: [
+                    // Row 1: type badge · chain · spacer · revoke button
+                    Row(
+                      children: [
+                        Container(
+                          padding: EdgeInsets.symmetric(
+                            horizontal: 1.w,
+                            vertical: 0.4.h,
+                          ),
+                          decoration: BoxDecoration(
+                            color: accent.withValues(alpha: 0.15),
+                            borderRadius: BorderRadius.circular(8),
+                          ),
+                          child: Text(
+                            typeLabel,
+                            style: theme.textTheme.labelSmall?.copyWith(
+                              color: accent,
+                              fontWeight: FontWeight.w800,
+                            ),
+                          ),
+                        ),
+                        SizedBox(width: 1.w),
+                        Container(
+                          padding: EdgeInsets.symmetric(
+                            horizontal: 1.w,
+                            vertical: 0.4.h,
+                          ),
+                          decoration: BoxDecoration(
+                            color: Palette.ink.withValues(alpha: 0.06),
+                            borderRadius: BorderRadius.circular(8),
+                          ),
+                          child: Text(
+                            'Chain ${grant.shared.chainId}',
+                            style: theme.textTheme.labelSmall?.copyWith(
+                              color: muted,
+                              fontWeight: FontWeight.w700,
+                            ),
+                          ),
+                        ),
+                        const Spacer(),
+                        if (revoking)
+                          SizedBox(
+                            width: 1.8.h,
+                            height: 1.8.h,
+                            child: CircularProgressIndicator(
+                              strokeWidth: 2,
+                              color: Palette.coral,
+                            ),
+                          )
+                        else
+                          OutlinedButton.icon(
+                            onPressed: revoke,
+                            style: OutlinedButton.styleFrom(
+                              foregroundColor: Palette.coral,
+                              side: BorderSide(
+                                color: Palette.coral.withValues(alpha: 0.4),
+                              ),
+                              padding: EdgeInsets.symmetric(
+                                horizontal: 1.w,
+                                vertical: 0.6.h,
+                              ),
+                              shape: RoundedRectangleBorder(
+                                borderRadius: BorderRadius.circular(10),
+                              ),
+                            ),
+                            icon: const Icon(Icons.block_rounded, size: 16),
+                            label: const Text('Revoke'),
+                          ),
+                      ],
+                    ),
+                    SizedBox(height: 0.8.h),
+                    // Row 2: wallet address · client name
+                    Row(
+                      children: [
+                        Text(
+                          walletLabel,
+                          style: theme.textTheme.bodySmall?.copyWith(
+                            color: Palette.ink,
+                            fontFamily: 'monospace',
+                          ),
+                        ),
+                        Padding(
+                          padding: EdgeInsets.symmetric(horizontal: 0.8.w),
+                          child: Text(
+                            '·',
+                            style: theme.textTheme.bodySmall
+                                ?.copyWith(color: muted),
+                          ),
+                        ),
+                        Expanded(
+                          child: Text(
+                            clientLabel,
+                            maxLines: 1,
+                            overflow: TextOverflow.ellipsis,
+                            style: theme.textTheme.bodySmall
+                                ?.copyWith(color: muted),
+                          ),
+                        ),
+                      ],
+                    ),
+                  ],
+                ),
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
+```
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd operator && flutter analyze lib/screens/dashboard/evm/grants/widgets/grant_card.dart
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(grants): add GrantCard widget with self-contained enrichment"
+jj new
+```
+
+---
+
+## Task 5: Create `EvmGrantsScreen`
+
+**Files:**
+- Create: `operator/lib/screens/dashboard/evm/grants/grants.dart`
+
+The screen watches only `evmGrantsProvider` for top-level state (loading / error / no connection / empty / data). When there is data it renders a list of `GrantCard` widgets — each card manages its own enrichment subscriptions.
+
+- [ ] **Step 1: Write the screen**
+
+Create `operator/lib/screens/dashboard/evm/grants/grants.dart`:
+
+```dart
+import 'package:arbiter/proto/evm.pb.dart';
+import 'package:arbiter/providers/evm/evm_grants.dart';
+import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
+import 'package:arbiter/router.gr.dart';
+import 'package:arbiter/screens/dashboard/evm/grants/widgets/grant_card.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:arbiter/widgets/page_header.dart';
+import 'package:auto_route/auto_route.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:sizer/sizer.dart';
+
+String _formatError(Object error) {
+  final message = error.toString();
+  if (message.startsWith('Exception: ')) {
+    return message.substring('Exception: '.length);
+  }
+  return message;
+}
+
+// ─── State panel ──────────────────────────────────────────────────────────────
+
+class _StatePanel extends StatelessWidget {
+  const _StatePanel({
+    required this.icon,
+    required this.title,
+    required this.body,
+    this.actionLabel,
+    this.onAction,
+    this.busy = false,
+  });
+
+  final IconData icon;
+  final String title;
+  final String body;
+  final String? actionLabel;
+  final Future<void> Function()? onAction;
+  final bool busy;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+
+    return Container(
+      decoration: BoxDecoration(
+        borderRadius: BorderRadius.circular(24),
+        color: Palette.cream.withValues(alpha: 0.92),
+        border: Border.all(color: Palette.line),
+      ),
+      child: Padding(
+        padding: EdgeInsets.all(2.8.h),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            if (busy)
+              SizedBox(
+                width: 2.8.h,
+                height: 2.8.h,
+                child: const CircularProgressIndicator(strokeWidth: 2.5),
+              )
+            else
+              Icon(icon, size: 34, color: Palette.coral),
+            SizedBox(height: 1.8.h),
+            Text(
+              title,
+              style: theme.textTheme.headlineSmall?.copyWith(
+                color: Palette.ink,
+                fontWeight: FontWeight.w800,
+              ),
+            ),
+            SizedBox(height: 1.h),
+            Text(
+              body,
+              style: theme.textTheme.bodyLarge?.copyWith(
+                color: Palette.ink.withValues(alpha: 0.72),
+                height: 1.5,
+              ),
+            ),
+            if (actionLabel != null && onAction != null) ...[
+              SizedBox(height: 2.h),
+              OutlinedButton.icon(
+                onPressed: () => onAction!(),
+                icon: const Icon(Icons.refresh),
+                label: Text(actionLabel!),
+              ),
+            ],
+          ],
+        ),
+      ),
+    );
+  }
+}
+
+// ─── Grant list ───────────────────────────────────────────────────────────────
+
+class _GrantList extends StatelessWidget {
+  const _GrantList({required this.grants});
+
+  final List<GrantEntry> grants;
+
+  @override
+  Widget build(BuildContext context) {
+    return Column(
+      children: [
+        for (var i = 0; i < grants.length; i++)
+          Padding(
+            padding: EdgeInsets.only(
+              bottom: i == grants.length - 1 ? 0 : 1.8.h,
+            ),
+            child: GrantCard(grant: grants[i]),
+          ),
+      ],
+    );
+  }
+}
+
+// ─── Screen ───────────────────────────────────────────────────────────────────
+
+@RoutePage()
+class EvmGrantsScreen extends ConsumerWidget {
+  const EvmGrantsScreen({super.key});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    // Screen watches only the grant list for top-level state decisions
+    final grantsAsync = ref.watch(evmGrantsProvider);
+
+    Future<void> refresh() async {
+      await Future.wait([
+        ref.read(evmGrantsProvider.notifier).refresh(),
+        ref.read(walletAccessListProvider.notifier).refresh(),
+      ]);
+    }
+
+    void showMessage(String message) {
+      if (!context.mounted) return;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
+      );
+    }
+
+    Future<void> safeRefresh() async {
+      try {
+        await refresh();
+      } catch (e) {
+        showMessage(_formatError(e));
+      }
+    }
+
+    final grantsState = grantsAsync.asData?.value;
+    final grants = grantsState?.grants;
+
+    final content = switch (grantsAsync) {
+      AsyncLoading() when grantsState == null => const _StatePanel(
+        icon: Icons.hourglass_top,
+        title: 'Loading grants',
+        body: 'Pulling grant registry from Arbiter.',
+        busy: true,
+      ),
+      AsyncError(:final error) => _StatePanel(
+        icon: Icons.sync_problem,
+        title: 'Grant registry unavailable',
+        body: _formatError(error),
+        actionLabel: 'Retry',
+        onAction: safeRefresh,
+      ),
+      AsyncData(:final value) when value == null => _StatePanel(
+        icon: Icons.portable_wifi_off,
+        title: 'No active server connection',
+        body: 'Reconnect to Arbiter to list EVM grants.',
+        actionLabel: 'Refresh',
+        onAction: safeRefresh,
+      ),
+      _ when grants != null && grants.isEmpty => _StatePanel(
+        icon: Icons.policy_outlined,
+        title: 'No grants yet',
+        body: 'Create a grant to allow SDK clients to sign transactions.',
+        actionLabel: 'Create grant',
+        onAction: () => context.router.push(const CreateEvmGrantRoute()),
+      ),
+      _ => _GrantList(grants: grants ?? const []),
+    };
+
+    return Scaffold(
+      body: SafeArea(
+        child: RefreshIndicator.adaptive(
+          color: Palette.ink,
+          backgroundColor: Colors.white,
+          onRefresh: safeRefresh,
+          child: ListView(
+            physics: const BouncingScrollPhysics(
+              parent: AlwaysScrollableScrollPhysics(),
+            ),
+            padding: EdgeInsets.fromLTRB(2.4.w, 2.4.h, 2.4.w, 3.2.h),
+            children: [
+              PageHeader(
+                title: 'EVM Grants',
+                isBusy: grantsAsync.isLoading,
+                actions: [
+                  FilledButton.icon(
+                    onPressed: () =>
+                        context.router.push(const CreateEvmGrantRoute()),
+                    icon: const Icon(Icons.add_rounded),
+                    label: const Text('Create grant'),
+                  ),
+                  SizedBox(width: 1.w),
+                  OutlinedButton.icon(
+                    onPressed: safeRefresh,
+                    style: OutlinedButton.styleFrom(
+                      foregroundColor: Palette.ink,
+                      side: BorderSide(color: Palette.line),
+                      padding: EdgeInsets.symmetric(
+                        horizontal: 1.4.w,
+                        vertical: 1.2.h,
+                      ),
+                      shape: RoundedRectangleBorder(
+                        borderRadius: BorderRadius.circular(14),
+                      ),
+                    ),
+                    icon: const Icon(Icons.refresh, size: 18),
+                    label: const Text('Refresh'),
+                  ),
+                ],
+              ),
+              SizedBox(height: 1.8.h),
+              content,
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}
+```
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd operator && flutter analyze lib/screens/dashboard/evm/grants/
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(grants): add EvmGrantsScreen"
+jj new
+```
+
+---
+
+## Task 6: Wire router and dashboard tab
+
+**Files:**
+- Modify: `operator/lib/router.dart`
+- Modify: `operator/lib/screens/dashboard.dart`
+- Regenerated: `operator/lib/router.gr.dart`
+
+- [ ] **Step 1: Add route to `router.dart`**
+
+Replace the contents of `operator/lib/router.dart` with:
+
+```dart
+import 'package:auto_route/auto_route.dart';
+
+import 'router.gr.dart';
+
+@AutoRouterConfig(generateForDir: ['lib/screens'])
+class Router extends RootStackRouter {
+  @override
+  List<AutoRoute> get routes => [
+    AutoRoute(page: Bootstrap.page, path: '/bootstrap', initial: true),
+    AutoRoute(page: ServerInfoSetupRoute.page, path: '/server-info'),
+    AutoRoute(page: ServerConnectionRoute.page, path: '/server-connection'),
+    AutoRoute(page: VaultSetupRoute.page, path: '/vault'),
+    AutoRoute(page: ClientDetailsRoute.page, path: '/clients/:clientId'),
+    AutoRoute(page: CreateEvmGrantRoute.page, path: '/evm-grants/create'),
+
+    AutoRoute(
+      page: DashboardRouter.page,
+      path: '/dashboard',
+      children: [
+        AutoRoute(page: EvmRoute.page, path: 'evm'),
+        AutoRoute(page: ClientsRoute.page, path: 'clients'),
+        AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
+        AutoRoute(page: AboutRoute.page, path: 'about'),
+      ],
+    ),
+  ];
+}
+```
+
+- [ ] **Step 2: Update `dashboard.dart`**
+
+In `operator/lib/screens/dashboard.dart`, replace the `routes` constant:
+
+```dart
+final routes = [
+  const EvmRoute(),
+  const ClientsRoute(),
+  const EvmGrantsRoute(),
+  const AboutRoute(),
+];
+```
+
+And replace the `destinations` list inside `AdaptiveScaffold`:
+
+```dart
+destinations: const [
+  NavigationDestination(
+    icon: Icon(Icons.account_balance_wallet_outlined),
+    selectedIcon: Icon(Icons.account_balance_wallet),
+    label: 'Wallets',
+  ),
+  NavigationDestination(
+    icon: Icon(Icons.devices_other_outlined),
+    selectedIcon: Icon(Icons.devices_other),
+    label: 'Clients',
+  ),
+  NavigationDestination(
+    icon: Icon(Icons.policy_outlined),
+    selectedIcon: Icon(Icons.policy),
+    label: 'Grants',
+  ),
+  NavigationDestination(
+    icon: Icon(Icons.info_outline),
+    selectedIcon: Icon(Icons.info),
+    label: 'About',
+  ),
+],
+```
+
+- [ ] **Step 3: Regenerate router**
+
+```sh
+cd operator && dart run build_runner build --delete-conflicting-outputs
+```
+
+Expected: `lib/router.gr.dart` updated, `EvmGrantsRoute` now available, no errors.
+
+- [ ] **Step 4: Full project verify**
+
+```sh
+cd operator && flutter analyze
+```
+
+Expected: no issues.
+
+- [ ] **Step 5: Commit**
+
+```sh
+jj describe -m "feat(nav): add Grants dashboard tab"
+jj new
+```

docs/superpowers/specs/2026-03-28-grant-grid-view-design.md

@@ -0,0 +1,170 @@
+# Grant Grid View — Design Spec
+
+**Date:** 2026-03-28
+
+## Overview
+
+Add a "Grants" dashboard tab to the Flutter operator app that displays all EVM grants as a card-based grid. Each card shows a compact summary (type, chain, wallet address, client name) with a revoke action. The tab integrates into the existing `AdaptiveScaffold` navigation alongside Wallets, Clients, and About.
+
+## Scope
+
+- New `walletAccessListProvider` for fetching wallet access entries with their DB row IDs
+- New `EvmGrantsScreen` as a dashboard tab
+- Grant card widget with enriched display (type, chain, wallet, client)
+- Revoke action wired to existing `executeRevokeEvmGrant` mutation
+- Dashboard tab bar and router updated
+- New token-transfer accent color added to `Palette`
+
+**Out of scope:** Fixing grant creation (separate task).
+
+---
+
+## Data Layer
+
+### `walletAccessListProvider`
+
+**File:** `operator/lib/providers/sdk_clients/wallet_access_list.dart`
+
+- `@riverpod` class, watches `connectionManagerProvider.future`
+- Returns `List<SdkClientWalletAccess>?` (null when not connected)
+- Each entry: `.id` (wallet_access_id), `.access.walletId`, `.access.sdkClientId`
+- Exposes a `refresh()` method following the same pattern as `EvmGrants.refresh()`
+
+### Enrichment at render time (Approach A)
+
+The `EvmGrantsScreen` watches four providers:
+1. `evmGrantsProvider` — the grant list
+2. `walletAccessListProvider` — to resolve wallet_access_id → (wallet_id, sdk_client_id)
+3. `evmProvider` — to resolve wallet_id → wallet address
+4. `sdkClientsProvider` — to resolve sdk_client_id → client name
+
+All lookups are in-memory Maps built inside the build method; no extra model class needed.
+
+Fallbacks:
+- Wallet address not found → `"Access #N"` where N is the wallet_access_id
+- Client name not found → `"Client #N"` where N is the sdk_client_id
+
+---
+
+## Route Structure
+
+```
+/dashboard
+  /evm          ← existing (Wallets tab)
+  /clients      ← existing (Clients tab)
+  /grants       ← NEW (Grants tab)
+  /about        ← existing
+
+/evm-grants/create  ← existing push route (unchanged)
+```
+
+### Changes to `router.dart`
+
+Add inside dashboard children:
+```dart
+AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
+```
+
+### Changes to `dashboard.dart`
+
+Add to `routes` list:
+```dart
+const EvmGrantsRoute()
+```
+
+Add `NavigationDestination`:
+```dart
+NavigationDestination(
+  icon: Icon(Icons.policy_outlined),
+  selectedIcon: Icon(Icons.policy),
+  label: 'Grants',
+),
+```
+
+---
+
+## Screen: `EvmGrantsScreen`
+
+**File:** `operator/lib/screens/dashboard/evm/grants/grants.dart`
+
+```
+Scaffold
+└─ SafeArea
+   └─ RefreshIndicator.adaptive (refreshes evmGrantsProvider + walletAccessListProvider)
+      └─ ListView (BouncingScrollPhysics + AlwaysScrollableScrollPhysics)
+         ├─ PageHeader
+         │    title: 'EVM Grants'
+         │    isBusy: evmGrantsProvider.isLoading
+         │    actions: [CreateGrantButton, RefreshButton]
+         ├─ SizedBox(height: 1.8.h)
+         └─ <content>
+```
+
+### State handling
+
+Matches the pattern from `EvmScreen` and `ClientsScreen`:
+
+| State | Display |
+|---|---|
+| Loading (no data yet) | `_StatePanel` with spinner, "Loading grants" |
+| Error | `_StatePanel` with coral icon, error message, Retry button |
+| No connection | `_StatePanel`, "No active server connection" |
+| Empty list | `_StatePanel`, "No grants yet", with Create Grant shortcut |
+| Data | Column of `_GrantCard` widgets |
+
+### Header actions
+
+**CreateGrantButton:** `FilledButton.icon` with `Icons.add_rounded`, pushes `CreateEvmGrantRoute()` via `context.router.push(...)`.
+
+**RefreshButton:** `OutlinedButton.icon` with `Icons.refresh`, calls `ref.read(evmGrantsProvider.notifier).refresh()`.
+
+---
+
+## Grant Card: `_GrantCard`
+
+**Layout:**
+
+```
+Container (rounded 24, Palette.cream bg, Palette.line border)
+└─ IntrinsicHeight > Row
+   ├─ Accent strip (0.8.w wide, full height, rounded left)
+   └─ Padding > Column
+        ├─ Row 1: TypeBadge + ChainChip + Spacer + RevokeButton
+        └─ Row 2: WalletText + "·" + ClientText
+```
+
+**Accent color by grant type:**
+- Ether transfer → `Palette.coral`
+- Token transfer → `Palette.token` (new entry in `Palette` — indigo, e.g. `Color(0xFF5C6BC0)`)
+
+**TypeBadge:** Small pill container with accent color background at 15% opacity, accent-colored text. Label: `'Ether'` or `'Token'`.
+
+**ChainChip:** Small container: `'Chain ${grant.shared.chainId}'`, muted ink color.
+
+**WalletText:** Short hex address (`0xabc...def`) from wallet lookup, `bodySmall`, monospace font family.
+
+**ClientText:** Client name from `sdkClientsProvider` lookup, or fallback string. `bodySmall`, muted ink.
+
+**RevokeButton:**
+- `OutlinedButton` with `Icons.block_rounded` icon, label `'Revoke'`
+- `foregroundColor: Palette.coral`, `side: BorderSide(color: Palette.coral.withValues(alpha: 0.4))`
+- Disabled (replaced with `CircularProgressIndicator`) while `revokeEvmGrantMutation` is pending — note: this is a single global mutation, so all revoke buttons disable while any revoke is in flight
+- On press: calls `executeRevokeEvmGrant(ref, grantId: grant.id)`; shows `SnackBar` on error
+
+---
+
+## Adaptive Sizing
+
+All sizing uses `sizer` units (`1.h`, `1.w`, etc.). No hardcoded pixel values.
+
+---
+
+## Files to Create / Modify
+
+| File | Action |
+|---|---|
+| `lib/theme/palette.dart` | Modify — add `Palette.token` color |
+| `lib/providers/sdk_clients/wallet_access_list.dart` | Create |
+| `lib/screens/dashboard/evm/grants/grants.dart` | Create |
+| `lib/router.dart` | Modify — add grants route to dashboard children |
+| `lib/screens/dashboard.dart` | Modify — add tab to routes list and NavigationDestinations |

mise.toml

@@ -22,5 +22,3 @@ run = '''
 dart pub global activate protoc_plugin && \
 protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
 '''
-
-[tasks.generate_schema]

server/Cargo.toml

@@ -6,34 +6,34 @@ resolver = "3"
 
 
 [workspace.dependencies]
-alloy = "2.4.1"
-async-trait = "0.1.92"
-base64 = "0.23.1"
-chrono = { version = "0.4.45", features = ["serde"] }
-futures = "0.3.34"
+alloy = "2.0.4"
+async-trait = "0.1.89"
+base64 = "0.22.1"
+chrono = { version = "0.4.44", features = ["serde"] }
+futures = "0.3.32"
 k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
 kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
-ml-dsa = { version = "0.1.1", features = ["zeroize"] }
+ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
 mutants = "0.0.4"
-prost = "0.14.4"
-prost-types = { version = "0.14.4", features = ["chrono"] }
-rand = "0.10.2"
+prost = "0.14.3"
+prost-types = { version = "0.14.3", features = ["chrono"] }
+rand = "0.10.1"
 rand_core = "0.10.1"
-rcgen = { version = "0.14.9", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
+rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
-rustls = { version = "0.23.43", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
-rustls-pki-types = "1.15.1"
+rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
+rustls-pki-types = "1.14.1"
 sha2 = "0.11"
 smlang = "0.8.0"
-thiserror = "2.0.20"
-tokio = { version = "1.53.1", features = ["full"] }
-tokio-stream = { version = "0.1.19", features = ["full"] }
-tonic = { version = "0.14.6", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
+thiserror = "2.0.18"
+tokio = { version = "1.52.1", features = ["full"] }
+tokio-stream = { version = "0.1.18", features = ["full"] }
+tonic = { version = "0.14.5", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
 tracing = "0.1.44"
-x25519-dalek = { version = "3.0.0", features = ["getrandom"] }
+x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
 
 [workspace.lints.rust]
 missing_unsafe_on_extern = "deny"

server/crates/arbiter-client/Cargo.toml

@@ -20,8 +20,8 @@ tonic.features = ["tls-aws-lc"]
 tokio.workspace = true
 tokio-stream.workspace = true
 thiserror.workspace = true
-http = "1.5.0"
-rustls-webpki = { version = "0.103.15", features = ["aws-lc-rs"] }
+http = "1.4.0"
+rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] }
 async-trait.workspace = true
 chrono.workspace = true
 

server/crates/arbiter-crypto/Cargo.toml

@@ -6,10 +6,10 @@ edition = "2024"
 [dependencies]
 ml-dsa = {workspace = true, optional = true }
 rand = {workspace = true, optional = true}
-memsafe = {version = "1.0.2", optional = true}
+memsafe = {version = "0.4.0", optional = true}
 hmac.workspace = true
 alloy.workspace = true
-x-wing = { version = "0.1.0", features = ["zeroize"] }
+x-wing = { version = "0.1.0-rc.0", features = ["zeroize"] }
 chrono.workspace = true
 thiserror.workspace = true
 

server/crates/arbiter-crypto/src/authn/v1.rs

@@ -1,8 +1,8 @@
 use chrono::{DateTime, Utc};
 use hmac::digest::Digest;
 use ml_dsa::{
-    EncodedVerifyingKey, Error, ExpandedSigningKey, Generate, MlDsa87, Seed,
-    Signature as MlDsaSignature, SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey,
+    EncodedVerifyingKey, Error, KeyGen, MlDsa87, Seed, Signature as MlDsaSignature,
+    SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _,
 };
 use rand::RngExt;
 
@@ -77,10 +77,7 @@ impl crate::hashing::Hashable for PublicKey {
 pub struct Signature(Box<MlDsaSignature<KeyParams>>);
 
 #[derive(Debug)]
-pub struct SigningKey {
-    key: Box<ExpandedSigningKey<KeyParams>>,
-    seed: Seed,
-}
+pub struct SigningKey(Box<MlDsaSigningKey<KeyParams>>);
 
 impl PublicKey {
     pub fn to_bytes(&self) -> Vec<u8> {
@@ -103,31 +100,24 @@ impl Signature {
 
 impl SigningKey {
     pub fn generate() -> Self {
-        let seed = MlDsaSigningKey::<KeyParams>::generate_from_rng(&mut rand::rng()).to_seed();
-        Self {
-            key: Box::new(ExpandedSigningKey::from_seed(&seed)),
-            seed,
-        }
+        Self(Box::new(KeyParams::key_gen(&mut rand::rng())))
     }
 
     pub fn from_seed(seed: [u8; 32]) -> Self {
-        let seed = Seed::from(seed);
-        Self {
-            key: Box::new(ExpandedSigningKey::from_seed(&seed)),
-            seed,
-        }
+        Self(Box::new(KeyParams::from_seed(&Seed::from(seed))))
     }
 
     pub fn to_seed(&self) -> [u8; 32] {
-        self.seed.into()
+        self.0.to_seed().into()
     }
 
     pub fn public_key(&self) -> PublicKey {
-        self.key.verifying_key().into()
+        self.0.verifying_key().into()
     }
 
     pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> {
-        self.key
+        self.0
+            .signing_key()
             .sign_deterministic(message, context)
             .map(Into::into)
     }
@@ -155,6 +145,12 @@ impl From<MlDsaSignature<KeyParams>> for Signature {
     }
 }
 
+impl From<MlDsaSigningKey<KeyParams>> for SigningKey {
+    fn from(value: MlDsaSigningKey<KeyParams>) -> Self {
+        Self(Box::new(value))
+    }
+}
+
 impl TryFrom<Vec<u8>> for PublicKey {
     type Error = ();
 
@@ -192,15 +188,15 @@ impl TryFrom<&'_ [u8]> for Signature {
 
 #[cfg(test)]
 mod tests {
-    use ml_dsa::{Generate as _, MlDsa87, SigningKey as RealSigningKey, signature::Keypair as _};
+    use ml_dsa::{KeyGen, MlDsa87, signature::Keypair as _};
 
     use crate::authn::AuthChallenge;
 
-    use super::{CLIENT_CONTEXT, OPERATOR_CONTEXT, PublicKey, Signature, SigningKey};
+    use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT};
 
     #[test]
     fn public_key_round_trip_decodes() {
-        let key = RealSigningKey::<MlDsa87>::generate();
+        let key = MlDsa87::key_gen(&mut rand::rng());
         let encoded = PublicKey::from(key.verifying_key()).to_bytes();
 
         let decoded = PublicKey::try_from(encoded.as_slice()).expect("public key should decode");

server/crates/arbiter-macros/Cargo.toml

@@ -10,7 +10,7 @@ doctest = false
 [dependencies]
 proc-macro2 = "1.0"
 quote = "1.0"
-syn = { version = "3.0", features = ["derive", "fold", "full", "visit-mut"] }
+syn = { version = "2.0", features = ["derive", "fold", "full", "visit-mut"] }
 
 [dev-dependencies]
 arbiter-crypto = { path = "../arbiter-crypto" }

server/crates/arbiter-proto/Cargo.toml

@@ -9,7 +9,7 @@ license = "Apache-2.0"
 tonic.workspace = true
 tokio.workspace = true
 futures.workspace = true
-tonic-prost = "0.14.6"
+tonic-prost = "0.14.5"
 prost.workspace = true
 kameo.workspace = true
 url = "2.5.8"
@@ -22,7 +22,7 @@ async-trait.workspace = true
 tokio-stream.workspace = true
 
 [build-dependencies]
-tonic-prost-build = "0.14.6"
+tonic-prost-build = "0.14.5"
 
 [dev-dependencies]
 rstest.workspace = true

server/crates/arbiter-server/Cargo.toml

@@ -9,14 +9,8 @@ license = "Apache-2.0"
 workspace = true
 
 [dependencies]
-diesel = { version = "2.3.12", features = [
-    "chrono",
-    "returning_clauses_for_sqlite_3_35",
-    "serde_json",
-    "time",
-    "uuid",
-] }
-diesel-async = { version = "0.9.2", features = [
+diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
+diesel-async = { version = "0.9.0", features = [
     "bb8",
     "migrations",
     "sqlite",
@@ -41,17 +35,17 @@ rand_core.workspace = true
 rcgen.workspace = true
 chrono.workspace = true
 kameo.workspace = true
-chacha20poly1305 = { version = "0.11.0" }
-argon2 = { version = "0.6.0", features = ["zeroize"] }
+chacha20poly1305 = { version = "0.10.1", features = ["std"] }
+argon2 = { version = "0.5.3", features = ["zeroize"] }
 restructed = "0.2.2"
 strum = { version = "0.28.0", features = ["derive"] }
-pem = "4.0.0"
+pem = "3.0.6"
 sha2.workspace = true
 hmac.workspace = true
 alloy.workspace = true
 prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
-anyhow = "1.0.104"
+anyhow = "1.0.102"
 mutants.workspace = true
 subtle = "2.6.1"
 x25519-dalek.workspace = true

server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql

@@ -43,24 +43,13 @@ create table if not exists arbiter_settings (
 insert into arbiter_settings (id) values (1) on conflict do nothing;
 -- ensure singleton row exists
 
-create table if not exists operator_identity (
+create table if not exists operator_client (
     id integer not null primary key,
     public_key blob not null,
     created_at integer not null default(unixepoch ('now')),
     updated_at integer not null default(unixepoch ('now'))
 ) STRICT;
-create unique index if not exists uniq_operator_identity_public_key on operator_identity (public_key);
-
-create table if not exists operator (
-    id integer primary key references operator_identity(id) on delete restrict, -- same id as operator_identity
-
-    share blob not null,
-    share_nonce blob not null,
-
-    created_at integer not null default(unixepoch ('now')),
-    updated_at integer not null default(unixepoch ('now'))
-
-) STRICT;
+create unique index if not exists uniq_operator_client_public_key on operator_client (public_key);
 
 create table if not exists client_metadata (
     id integer not null primary key,

server/crates/arbiter-server/src/actors/bootstrap.rs

@@ -68,7 +68,7 @@ impl Bootstrapper {
         let row_count: i64 = {
             let mut conn = db.get().await?;
 
-            schema::operator::table
+            schema::operator_client::table
                 .count()
                 .get_result(&mut conn)
                 .await?

server/crates/arbiter-server/src/actors/evm/mod.rs

@@ -3,7 +3,7 @@ use crate::{
     crypto::integrity::{self, Integrable},
     db::{
         DatabaseError, DatabasePool,
-        models::{self, EvmWalletId},
+        models::{self},
         schema,
     },
     evm::{
@@ -162,7 +162,7 @@ impl EvmActor {
     }
 
     #[message]
-    pub async fn list_wallets(&self) -> Result<Vec<(EvmWalletId, Address)>, Error> {
+    pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> {
         let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
         let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
             .select(models::EvmWallet::as_select())
@@ -295,18 +295,18 @@ impl EvmActor {
                 address: wallet_address,
                 aead_encrypted_id: wallet.aead_encrypted_id,
             },
-            wallet.id.to_raw(),
+            wallet.id,
         )
         .await
         .map_err(|e| {
-            error!(?e, ?wallet.id, "EVM wallet integrity check failed");
+            error!(?e, wallet_id = wallet.id, "EVM wallet integrity check failed");
             SignTransactionError::Internal
         })?;
         drop(conn);
 
         if attestation != integrity::AttestationStatus::Attested {
             error!(
-                ?wallet.id,
+                wallet_id = wallet.id,
                 "EVM wallet integrity unavailable; refusing to sign"
             );
             return Err(SignTransactionError::Internal);

server/crates/arbiter-server/src/actors/vault/mod.rs

@@ -6,7 +6,7 @@ use crate::{
     },
     db::{
         self,
-        models::{self, RootKeyHistory, RootKeyHistoryId},
+        models::{self, RootKeyHistory},
         schema::{self},
     },
 };
@@ -25,6 +25,7 @@ use strum::{EnumDiscriminants, IntoDiscriminant};
 use tracing::{error, info, warn};
 
 pub mod events {
+
     #[derive(Clone, Copy)]
     pub struct Bootstrapped;
 
@@ -63,12 +64,12 @@ pub enum Error {
     #[error("Broken database")]
     BrokenDatabase,
 
-    #[error("Integrity key version mismatch: envelope uses key {envelope:?}, current key is {current:?}")]
-    KeyVersionMismatch { envelope: RootKeyHistoryId, current: RootKeyHistoryId },
+    #[error("Integrity key version mismatch: envelope uses key {envelope}, current key is {current}")]
+    KeyVersionMismatch { envelope: i32, current: i32 },
 }
 
 struct Unsealed {
-    root_key_history_id: RootKeyHistoryId,
+    root_key_history_id: i32,
     root_key: KeyCell,
 }
 
@@ -77,9 +78,8 @@ struct Unsealed {
 enum State {
     #[default]
     Unbootstrapped,
-
     Sealed {
-        root_key_history_id: RootKeyHistoryId,
+        root_key_history_id: i32,
     },
     Unsealed(Unsealed),
 }
@@ -123,10 +123,7 @@ impl Vault {
 
     // Exclusive transaction to avoid race condtions if multiple vaults write
     // additional layer of protection against nonce-reuse
-    async fn get_new_nonce(
-        pool: &db::DatabasePool,
-        root_key_id: RootKeyHistoryId,
-    ) -> Result<Nonce, Error> {
+    async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> {
         let mut conn = pool.get().await?;
 
         let nonce = conn
@@ -139,7 +136,7 @@ impl Vault {
 
                 let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
                     error!(
-                        "Broken database: invalid nonce for root key history id={:#?}",
+                        "Broken database: invalid nonce for root key history id={}",
                         root_key_id
                     );
                     Error::BrokenDatabase
@@ -195,7 +192,7 @@ impl Vault {
         let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
         let root_key_history_id = conn
             .transaction(async |conn| {
-                let root_key_history_id = insert_into(schema::root_key_history::table)
+                let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
                     .values(&models::NewRootKeyHistory {
                         ciphertext: root_key_ciphertext.clone(),
                         tag: v1::ROOT_KEY_TAG.to_vec(),
@@ -213,9 +210,7 @@ impl Vault {
                     .execute(&mut *conn)
                     .await?;
 
-                Result::<_, diesel::result::Error>::Ok(RootKeyHistoryId::from_raw(
-                    root_key_history_id,
-                ))
+                Result::<_, diesel::result::Error>::Ok(root_key_history_id)
             })
             .await?;
 
@@ -375,10 +370,7 @@ impl Vault {
     }
 
     #[message]
-    pub fn sign_integrity(
-        &mut self,
-        mac_input: Vec<u8>,
-    ) -> Result<(RootKeyHistoryId, Vec<u8>), Error> {
+    pub fn sign_integrity(&mut self, mac_input: Vec<u8>) -> Result<(i32, Vec<u8>), Error> {
         let Unsealed {
             root_key,
             root_key_history_id,
@@ -388,7 +380,7 @@ impl Vault {
             HmacSha256::new_from_slice(k)
                 .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
         });
-        hmac.update(&root_key_history_id.to_raw().to_be_bytes());
+        hmac.update(&root_key_history_id.to_be_bytes());
         hmac.update(&mac_input);
 
         let mac = hmac.finalize().into_bytes().to_vec();
@@ -400,7 +392,7 @@ impl Vault {
         &mut self,
         mac_input: Vec<u8>,
         expected_mac: Vec<u8>,
-        key_version: RootKeyHistoryId,
+        key_version: i32,
     ) -> Result<bool, Error> {
         let Unsealed {
             root_key,
@@ -418,7 +410,7 @@ impl Vault {
             HmacSha256::new_from_slice(k)
                 .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
         });
-        hmac.update(&key_version.to_raw().to_be_bytes());
+        hmac.update(&key_version.to_be_bytes());
         hmac.update(&mac_input);
 
         Ok(hmac.verify_slice(&expected_mac).is_ok())
@@ -442,7 +434,6 @@ impl Vault {
 #[cfg(test)]
 mod tests {
     use crate::actors::GlobalActors;
-    use crate::db::models::RootKeyHistory;
     use arbiter_crypto::safecell::SafeCellHandle as _;
 
     use super::*;

server/crates/arbiter-server/src/crypto/encryption/v1.rs

@@ -1,3 +1,4 @@
+use argon2::password_hash::Salt as ArgonSalt;
 use rand::{
     Rng as _, SeedableRng,
     rngs::{StdRng, SysRng},
@@ -41,7 +42,7 @@ impl<'a> TryFrom<&'a [u8]> for Nonce {
     }
 }
 
-pub type Salt = [u8; argon2::RECOMMENDED_SALT_LEN];
+pub type Salt = [u8; ArgonSalt::RECOMMENDED_LENGTH];
 
 pub fn generate_salt() -> Salt {
     let mut salt = Salt::default();

server/crates/arbiter-server/src/crypto/mod.rs

@@ -3,8 +3,8 @@ use encryption::v1::{Nonce, Salt};
 
 use argon2::{Algorithm, Argon2};
 use chacha20poly1305::{
-    AeadInOut, Key, KeyInit as _, XChaCha20Poly1305, XNonce,
-    aead::{Aead, Error, Payload},
+    AeadInPlace, Key, KeyInit as _, XChaCha20Poly1305, XNonce,
+    aead::{AeadMut, Error, Payload},
 };
 use rand::{
     Rng as _, SeedableRng as _,
@@ -54,9 +54,9 @@ impl KeyCell {
     ) -> Result<(), Error> {
         let key_reader = self.0.read();
         let cipher = XChaCha20Poly1305::new(&key_reader);
-        let nonce = XNonce::from(nonce.0);
+        let nonce = XNonce::from_slice(nonce.0.as_ref());
         let buffer = buffer.as_mut();
-        cipher.encrypt_in_place(&nonce, associated_data, buffer)
+        cipher.encrypt_in_place(nonce, associated_data, buffer)
     }
     pub fn decrypt_in_place(
         &mut self,
@@ -66,10 +66,10 @@ impl KeyCell {
     ) -> Result<(), Error> {
         let key_reader = self.0.read();
         let cipher = XChaCha20Poly1305::new(&key_reader);
-        let nonce = XNonce::from(nonce.0);
+        let nonce = XNonce::from_slice(nonce.0.as_ref());
         let mut buffer = buffer.write();
         let buffer: &mut Vec<u8> = buffer.as_mut();
-        cipher.decrypt_in_place(&nonce, associated_data, buffer)
+        cipher.decrypt_in_place(nonce, associated_data, buffer)
     }
 
     pub fn encrypt(
@@ -79,11 +79,11 @@ impl KeyCell {
         plaintext: impl AsRef<[u8]>,
     ) -> Result<Vec<u8>, Error> {
         let key_reader = self.0.read();
-        let cipher = XChaCha20Poly1305::new(&key_reader);
-        let nonce = XNonce::from(nonce.0);
+        let mut cipher = XChaCha20Poly1305::new(&key_reader);
+        let nonce = XNonce::from_slice(nonce.0.as_ref());
 
         let ciphertext = cipher.encrypt(
-            &nonce,
+            nonce,
             Payload {
                 msg: plaintext.as_ref(),
                 aad: associated_data,

server/crates/arbiter-server/src/db/models.rs

@@ -79,41 +79,10 @@ pub mod types {
         }
     }
 
-    macro_rules! declare_id {
-        ($name:ident) => {
-            #[derive(Debug, FromSqlRow, AsExpression, Clone, Hash, Copy, PartialEq, Eq)]
-            #[diesel(sql_type = Integer)]
-            #[repr(transparent)] // hint compiler to optimize the wrapper struct away
-            pub struct $name(i32);
-
-            impl $name {
-                pub const fn to_raw(self) -> i32 {
-                    self.0
-                }
-                pub const fn from_raw(raw: i32) -> Self {
-                    Self(raw)
-                }
-            }
-
-            impl FromSql<Integer, Sqlite> for $name {
-                fn from_sql(
-                    bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
-                ) -> diesel::deserialize::Result<Self> {
-                    FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
-                }
-            }
-            impl ToSql<Integer, Sqlite> for $name {
-                fn to_sql<'b>(
-                    &'b self,
-                    out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
-                ) -> diesel::serialize::Result {
-                    ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
-                }
-            }
-        };
-    }
-
-    declare_id!(ChainId);
+    #[derive(Debug, FromSqlRow, AsExpression, Clone)]
+    #[diesel(sql_type = Integer)]
+    #[repr(transparent)] // hint compiler to optimize the wrapper struct away
+    pub struct ChainId(pub i32);
 
     #[expect(
         clippy::cast_sign_loss,
@@ -134,13 +103,21 @@ pub mod types {
         }
     };
 
-    declare_id!(OperatorId);
-    declare_id!(OperatorIdentityId);
-    declare_id!(AeadEncryptedId);
-    declare_id!(RootKeyHistoryId);
-    declare_id!(TlsHistoryId);
-    declare_id!(EvmWalletId);
-    declare_id!(ClientId);
+    impl FromSql<Integer, Sqlite> for ChainId {
+        fn from_sql(
+            bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
+        ) -> diesel::deserialize::Result<Self> {
+            FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
+        }
+    }
+    impl ToSql<Integer, Sqlite> for ChainId {
+        fn to_sql<'b>(
+            &'b self,
+            out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
+        ) -> diesel::serialize::Result {
+            ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
+        }
+    }
 }
 pub use types::*;
 
@@ -153,12 +130,12 @@ pub use types::*;
 )]
 #[diesel(table_name = aead_encrypted, check_for_backend(Sqlite))]
 pub struct AeadEncrypted {
-    pub id: AeadEncryptedId,
+    pub id: i32,
     pub ciphertext: Vec<u8>,
     pub tag: Vec<u8>,
     pub current_nonce: Vec<u8>,
     pub schema_version: i32,
-    pub associated_root_key_id: RootKeyHistoryId,
+    pub associated_root_key_id: i32, // references root_key_history.id
     pub created_at: SqliteTimestamp,
 }
 
@@ -171,7 +148,7 @@ pub struct AeadEncrypted {
     attributes_with = "deriveless"
 )]
 pub struct RootKeyHistory {
-    pub id: RootKeyHistoryId,
+    pub id: i32,
     pub ciphertext: Vec<u8>,
     pub tag: Vec<u8>,
     pub root_key_encryption_nonce: Vec<u8>,
@@ -189,7 +166,7 @@ pub struct RootKeyHistory {
     attributes_with = "deriveless"
 )]
 pub struct TlsHistory {
-    pub id: TlsHistoryId,
+    pub id: i32,
     pub cert: String,
     pub cert_key: String, // PEM Encoded private key
     pub ca_cert: String,  // PEM Encoded certificate for cert signing
@@ -214,7 +191,7 @@ pub struct ArbiterSettings {
     attributes_with = "deriveless"
 )]
 pub struct EvmWallet {
-    pub id: EvmWalletId,
+    pub id: i32,
     pub address: Vec<u8>,
     pub aead_encrypted_id: i32,
     pub created_at: SqliteTimestamp,
@@ -236,7 +213,7 @@ pub struct EvmWallet {
 )]
 pub struct EvmWalletAccess {
     pub id: i32,
-    pub wallet_id: EvmWalletId,
+    pub wallet_id: i32,
     pub client_id: i32,
     pub created_at: SqliteTimestamp,
 }
@@ -263,7 +240,7 @@ pub struct ProgramClientMetadataHistory {
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = schema::program_client, check_for_backend(Sqlite))]
 pub struct ProgramClient {
-    pub id: ClientId,
+    pub id: i32,
     pub public_key: Vec<u8>,
     pub metadata_id: i32,
     pub created_at: SqliteTimestamp,
@@ -273,22 +250,12 @@ pub struct ProgramClient {
 #[derive(Queryable, Debug)]
 #[diesel(table_name = schema::operator_client, check_for_backend(Sqlite))]
 pub struct OperatorClient {
-    pub id: OperatorIdentityId,
+    pub id: i32,
     pub public_key: Vec<u8>,
     pub created_at: SqliteTimestamp,
     pub updated_at: SqliteTimestamp,
 }
 
-#[derive(Queryable, Debug)]
-#[diesel(table_name = schema::operator, check_for_backend(Sqlite))]
-pub struct Operator {
-    pub id: OperatorId,
-    pub share: Vec<u8>,
-    pub share_nonce: Vec<u8>,
-    pub created_at: SqliteTimestamp,
-    pub updated_at: SqliteTimestamp,
-}
-
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = evm_ether_transfer_limit, check_for_backend(Sqlite))]
 #[view(
@@ -432,7 +399,7 @@ pub struct IntegrityEnvelope {
     pub entity_kind: String,
     pub entity_id: Vec<u8>,
     pub payload_version: i32,
-    pub key_version: RootKeyHistoryId,
+    pub key_version: i32,
     pub mac: Vec<u8>,
     pub signed_at: SqliteTimestamp,
     pub created_at: SqliteTimestamp,

server/crates/arbiter-server/src/db/schema.rs

@@ -152,25 +152,6 @@ diesel::table! {
     }
 }
 
-diesel::table! {
-    operator (id) {
-        id -> Nullable<Integer>,
-        share -> Binary,
-        share_nonce -> Binary,
-        created_at -> Integer,
-        updated_at -> Integer,
-    }
-}
-
-diesel::table! {
-    operator_identity (id) {
-        id -> Integer,
-        public_key -> Binary,
-        created_at -> Integer,
-        updated_at -> Integer,
-    }
-}
-
 diesel::table! {
     program_client (id) {
         id -> Integer,
@@ -204,6 +185,15 @@ diesel::table! {
     }
 }
 
+diesel::table! {
+    operator_client (id) {
+        id -> Integer,
+        public_key -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
 diesel::joinable!(aead_encrypted -> root_key_history (associated_root_key_id));
 diesel::joinable!(arbiter_settings -> root_key_history (root_key_id));
 diesel::joinable!(arbiter_settings -> tls_history (tls_id));
@@ -222,7 +212,6 @@ diesel::joinable!(evm_transaction_log -> evm_wallet_access (wallet_access_id));
 diesel::joinable!(evm_wallet -> aead_encrypted (aead_encrypted_id));
 diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
 diesel::joinable!(evm_wallet_access -> program_client (client_id));
-diesel::joinable!(operator -> operator_identity (id));
 diesel::joinable!(program_client -> client_metadata (metadata_id));
 
 diesel::allow_tables_to_appear_in_same_query!(
@@ -241,9 +230,8 @@ diesel::allow_tables_to_appear_in_same_query!(
     evm_wallet,
     evm_wallet_access,
     integrity_envelope,
-    operator,
-    operator_identity,
     program_client,
     root_key_history,
     tls_history,
+    operator_client,
 );

server/crates/arbiter-server/src/evm/mod.rs

@@ -514,8 +514,7 @@ mod tests {
     use crate::db::{
         self, DatabaseConnection,
         models::{
-            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
-            SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
         },
         schema::{evm_basic_grant, evm_transaction_log},
     };
@@ -535,7 +534,7 @@ mod tests {
         EvalContext {
             target: EvmWalletAccess {
                 id: WALLET_ACCESS_ID,
-                wallet_id: EvmWalletId::from_raw(5),
+                wallet_id: 10,
                 client_id: 20,
                 created_at: SqliteTimestamp(Utc::now()),
             },
@@ -825,7 +824,7 @@ mod tests {
 
         let wallet_access = EvmWalletAccess {
             id: WALLET_ACCESS_ID,
-            wallet_id: EvmWalletId::from_raw(10),
+            wallet_id: 10,
             client_id: 20,
             created_at: SqliteTimestamp(Utc::now()),
         };

server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs

@@ -3,8 +3,7 @@ use crate::{
     db::{
         self, DatabaseConnection,
         models::{
-            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
-            SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
         },
         schema::{evm_basic_grant, evm_transaction_log},
     },
@@ -32,7 +31,7 @@ fn ctx(to: Address, value: U256) -> EvalContext {
     EvalContext {
         target: EvmWalletAccess {
             id: WALLET_ACCESS_ID,
-            wallet_id: EvmWalletId::from_raw(10),
+            wallet_id: 10,
             client_id: 20,
             created_at: SqliteTimestamp(Utc::now()),
         },

server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs

@@ -2,7 +2,7 @@ use super::{Settings, TokenTransfer};
 use crate::{
     db::{
         self, DatabaseConnection,
-        models::{EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, SqliteTimestamp},
+        models::{EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, SqliteTimestamp},
         schema::evm_basic_grant,
     },
     evm::{
@@ -45,7 +45,7 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
     EvalContext {
         target: EvmWalletAccess {
             id: WALLET_ACCESS_ID,
-            wallet_id: EvmWalletId::from_raw(10),
+            wallet_id: 10,
             client_id: 20,
             created_at: SqliteTimestamp(Utc::now()),
         },

server/crates/arbiter-server/src/grpc/operator/evm.rs

@@ -90,7 +90,7 @@ async fn handle_wallet_list(
                 .into_iter()
                 .map(|(id, address)| WalletEntry {
                     address: address.to_vec(),
-                    id: id.to_raw(),
+                    id,
                 })
                 .collect(),
         }),

server/crates/arbiter-server/src/grpc/operator/inbound.rs

@@ -1,10 +1,11 @@
 use crate::{
-    db::models::{CoreEvmWalletAccess, EvmWalletId, NewEvmWalletAccess},
+    db::models::{CoreEvmWalletAccess, NewEvmWalletAccess},
     evm::policies::{
         SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit, ether_transfer,
         token_transfers,
     },
-    grpc::{Convert, TryConvert},
+    grpc::Convert,
+    grpc::TryConvert,
 };
 use arbiter_proto::{
     proto::evm::{
@@ -150,7 +151,7 @@ impl Convert for WalletAccess {
 
     fn convert(self) -> Self::Output {
         NewEvmWalletAccess {
-            wallet_id: EvmWalletId::from_raw(self.wallet_id),
+            wallet_id: self.wallet_id,
             client_id: self.sdk_client_id,
         }
     }
@@ -165,7 +166,7 @@ impl TryConvert for SdkClientWalletAccess {
             return Err(Status::invalid_argument("Missing wallet access entry"));
         };
         Ok(CoreEvmWalletAccess {
-            wallet_id: EvmWalletId::from_raw(access.wallet_id),
+            wallet_id: access.wallet_id,
             client_id: access.sdk_client_id,
             id: self.id,
         })

server/crates/arbiter-server/src/grpc/operator/outbound.rs

@@ -103,7 +103,7 @@ impl Convert for EvmWalletAccess {
         Self::Output {
             id: self.id,
             access: Some(WalletAccess {
-                wallet_id: self.wallet_id.to_raw(),
+                wallet_id: self.wallet_id,
                 sdk_client_id: self.client_id,
             }),
         }

server/crates/arbiter-server/src/grpc/operator/sdk_client.rs

@@ -2,7 +2,7 @@ use crate::{
     db::models::NewEvmWalletAccess,
     grpc::Convert,
     peers::operator::{
-        OperatorSession, OutOfBand,
+        OutOfBand, OperatorSession,
         session::handlers::{
             HandleGrantEvmWalletAccess, HandleListWalletAccess, HandleNewClientApprove,
             HandleRevokeEvmWalletAccess, HandleSdkClientList,
@@ -11,8 +11,8 @@ use crate::{
 };
 use arbiter_crypto::authn;
 use arbiter_proto::proto::{
+    shared::ClientInfo as ProtoClientMetadata,
     operator::{
-        operator_response::Payload as OperatorResponsePayload,
         sdk_client::{
             self as proto_sdk_client, ConnectionCancel as ProtoSdkClientConnectionCancel,
             ConnectionRequest as ProtoSdkClientConnectionRequest,
@@ -24,8 +24,8 @@ use arbiter_proto::proto::{
             request::Payload as SdkClientRequestPayload,
             response::Payload as SdkClientResponsePayload,
         },
+        operator_response::Payload as OperatorResponsePayload,
     },
-    shared::ClientInfo as ProtoClientMetadata,
 };
 
 use kameo::actor::ActorRef;
@@ -115,7 +115,7 @@ async fn handle_list(
             clients: clients
                 .into_iter()
                 .map(|(client, metadata)| ProtoSdkClientEntry {
-                    id: client.id.to_raw(),
+                    id: client.id,
                     pubkey: client.public_key.clone(),
                     info: Some(ProtoClientMetadata {
                         name: metadata.name,

server/crates/arbiter-server/src/peers/operator/auth/state.rs

@@ -4,7 +4,7 @@ use super::{
 };
 use crate::{
     actors::bootstrap::ConsumeToken,
-    db::{DatabasePool, schema::operator_identity},
+    db::{DatabasePool, schema::operator_client},
     peers::operator::auth::Outbound,
 };
 use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
@@ -43,9 +43,9 @@ async fn get_client_id(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<O
         Error::internal("Database unavailable")
     })?;
 
-    operator_identity::table
-        .filter(operator_identity::public_key.eq(pubkey.to_bytes()))
-        .select(operator_identity::id)
+    operator_client::table
+        .filter(operator_client::public_key.eq(pubkey.to_bytes()))
+        .select(operator_client::id)
         .first::<i32>(&mut conn)
         .await
         .optional()
@@ -62,9 +62,9 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
         Error::internal("Database unavailable")
     })?;
 
-    let id: i32 = diesel::insert_into(operator_identity::table)
-        .values((operator_identity::public_key.eq(pubkey_bytes),))
-        .returning(operator_identity::id)
+    let id: i32 = diesel::insert_into(operator_client::table)
+        .values((operator_client::public_key.eq(pubkey_bytes),))
+        .returning(operator_client::id)
         .get_result(&mut conn)
         .await
         .map_err(|e| {

server/crates/arbiter-server/src/peers/operator/session/handlers.rs

@@ -1,17 +1,13 @@
 use super::{Error, OperatorSession};
 use crate::{
-    actors::{
-        evm::{
-            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
-            SignTransactionError as EvmSignError,
-        },
-        flow_coordinator::{IsClientConnected, client_connect_approval::ClientApprovalAnswer},
-        vault::VaultState,
+    actors::evm::{
+        ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
+        SignTransactionError as EvmSignError,
     },
+    actors::flow_coordinator::{IsClientConnected, client_connect_approval::ClientApprovalAnswer},
+    actors::vault::VaultState,
     db::{
-        models::{
-            EvmWalletAccess, EvmWalletId, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata,
-        },
+        models::{EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata},
         schema::program_client,
     },
     evm::policies::{Grant, SpecificGrant},
@@ -80,9 +76,7 @@ impl OperatorSession {
     }
 
     #[message]
-    pub(crate) async fn handle_evm_wallet_list(
-        &mut self,
-    ) -> Result<Vec<(EvmWalletId, Address)>, Error> {
+    pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<(i32, Address)>, Error> {
         match self.props.actors.evm.ask(ListWallets {}).await {
             Ok(wallets) => Ok(wallets),
             Err(err) => {
@@ -334,7 +328,7 @@ impl OperatorSession {
 
 #[cfg(test)]
 mod tests {
-    use crate::db::{self, models::{EvmWalletId, NewEvmWalletAccess}, schema::evm_wallet_access};
+    use crate::db::{self, models::NewEvmWalletAccess, schema::evm_wallet_access};
     use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
     use diesel_async::{AsyncConnection, RunQueryDsl};
 
@@ -354,7 +348,7 @@ mod tests {
         // entry B: id will be 2, wallet_id=1, client_id=20
         let entry_a = diesel::insert_into(evm_wallet_access::table)
             .values(NewEvmWalletAccess {
-                wallet_id: EvmWalletId::from_raw(1),
+                wallet_id: 1,
                 client_id: 10,
             })
             .returning(EvmWalletAccess::as_select())
@@ -364,7 +358,7 @@ mod tests {
 
         let entry_b = diesel::insert_into(evm_wallet_access::table)
             .values(NewEvmWalletAccess {
-                wallet_id: EvmWalletId::from_raw(1),
+                wallet_id: 1,
                 client_id: 20,
             })
             .returning(EvmWalletAccess::as_select())
@@ -417,7 +411,7 @@ mod tests {
         for i in 1_i32..=5 {
             diesel::insert_into(evm_wallet_access::table)
                 .values(NewEvmWalletAccess {
-                    wallet_id: EvmWalletId::from_raw(99),
+                    wallet_id: 99,
                     client_id: i,
                 })
                 .execute(&mut *conn)
@@ -428,7 +422,7 @@ mod tests {
         // Real target: wallet_id=1, will get id=6.
         let target = diesel::insert_into(evm_wallet_access::table)
             .values(NewEvmWalletAccess {
-                wallet_id: EvmWalletId::from_raw(1),
+                wallet_id: 1,
                 client_id: 1,
             })
             .returning(EvmWalletAccess::as_select())
@@ -438,7 +432,7 @@ mod tests {
 
         // Sanity: target.id != target.wallet_id
         assert_ne!(
-            target.id, target.wallet_id.to_raw(),
+            target.id, target.wallet_id,
             "test prerequisite: id and wallet_id must differ"
         );
 

server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs

@@ -10,7 +10,7 @@ use crate::{
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use state::State;
 
-use chacha20poly1305::{AeadInOut, KeyInit as _, XChaCha20Poly1305, XNonce};
+use chacha20poly1305::{AeadInPlace, KeyInit as _, XChaCha20Poly1305, XNonce};
 use kameo::{Actor, error::SendError, messages, prelude::Message};
 use kameo_actors::message_bus::Register;
 use tokio::sync::oneshot;
@@ -101,17 +101,14 @@ impl VaultGate {
         ciphertext: &[u8],
         associated_data: &[u8],
     ) -> Result<SafeCell<Vec<u8>>, ()> {
-        let Ok(nonce) = XNonce::try_from(nonce) else {
-            error!("Encrypted key material carries a nonce of the wrong length");
-            return Err(());
-        };
+        let nonce = XNonce::from_slice(nonce);
 
         let cipher = XChaCha20Poly1305::new(secret.as_bytes().into());
 
         let mut key_buffer = SafeCell::new(ciphertext.to_vec());
 
         let decryption_result = key_buffer.write_inline(|write_handle| {
-            cipher.decrypt_in_place(&nonce, associated_data, write_handle)
+            cipher.decrypt_in_place(nonce, associated_data, write_handle)
         });
 
         match decryption_result {

server/crates/arbiter-server/tests/client/auth.rs

@@ -16,7 +16,7 @@ use arbiter_server::{
 
 use diesel::{ExpressionMethods as _, NullableExpressionMethods as _, QueryDsl as _, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 
 fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> ClientMetadata {
     ClientMetadata {
@@ -73,7 +73,7 @@ async fn insert_registered_client(
 
 fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -> authn::Signature {
     let challenge = challenge.format();
-    key.expanded_key()
+    key.signing_key()
         .sign_deterministic(&challenge, CLIENT_CONTEXT)
         .unwrap()
         .into()
@@ -81,13 +81,13 @@ fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -
 
 async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
     let mut conn = db.get().await.unwrap();
-    let sentinel_key = verifying_key(&SigningKey::<MlDsa87>::generate())
+    let sentinel_key = verifying_key(&MlDsa87::key_gen(&mut rand::rng()))
         .encode()
         .0
         .to_vec();
 
-    insert_into(schema::operator_identity::table)
-        .values((schema::operator_identity::public_key.eq(sentinel_key),))
+    insert_into(schema::operator_client::table)
+        .values((schema::operator_client::public_key.eq(sentinel_key),))
         .execute(&mut conn)
         .await
         .unwrap();
@@ -120,7 +120,7 @@ pub async fn unregistered_pubkey_rejected() {
         connect_client(props, &mut server_transport).await;
     });
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
 
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
@@ -140,7 +140,7 @@ pub async fn challenge_auth() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
 
     Box::pin(insert_registered_client(
         &db,
@@ -206,7 +206,7 @@ pub async fn challenge_auth() {
 pub async fn metadata_unchanged_does_not_append_history() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     let requested = metadata("client", Some("desc"), Some("1.0.0"));
 
     Box::pin(insert_registered_client(
@@ -269,7 +269,7 @@ pub async fn metadata_unchanged_does_not_append_history() {
 pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
 
     Box::pin(insert_registered_client(
         &db,
@@ -360,7 +360,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     let requested = metadata("client", Some("desc"), Some("1.0.0"));
 
     {

server/crates/arbiter-server/tests/operator/auth.rs

@@ -14,7 +14,7 @@ use arbiter_server::{
 use async_trait::async_trait;
 use diesel::{ExpressionMethods as _, QueryDsl, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 use tokio::sync::mpsc;
 
 fn verifying_key(key: &SigningKey<MlDsa87>) -> VerifyingKey<MlDsa87> {
@@ -26,7 +26,7 @@ fn sign_operator_challenge(
     challenge: &AuthChallenge,
 ) -> authn::Signature {
     let challenge = challenge.format();
-    key.expanded_key()
+    key.signing_key()
         .sign_deterministic(&challenge, OPERATOR_CONTEXT)
         .unwrap()
         .into()
@@ -170,7 +170,7 @@ pub async fn bootstrap_token_auth() {
         auth::authenticate(&mut props, &mut server_transport).await
     });
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
@@ -206,8 +206,8 @@ pub async fn bootstrap_token_auth() {
     task.await.unwrap().unwrap();
 
     let mut conn = db.get().await.unwrap();
-    let stored_pubkey: Vec<u8> = schema::operator_identity::table
-        .select(schema::operator_identity::public_key)
+    let stored_pubkey: Vec<u8> = schema::operator_client::table
+        .select(schema::operator_client::public_key)
         .first::<Vec<u8>>(&mut conn)
         .await
         .unwrap();
@@ -227,7 +227,7 @@ pub async fn bootstrap_invalid_token_auth() {
         auth::authenticate(&mut props, &mut server_transport).await
     });
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
@@ -259,7 +259,7 @@ pub async fn bootstrap_invalid_token_auth() {
     ));
 
     let mut conn = db.get().await.unwrap();
-    let count: i64 = schema::operator_identity::table
+    let count: i64 = schema::operator_client::table
         .count()
         .get_result::<i64>(&mut conn)
         .await
@@ -280,14 +280,14 @@ pub async fn challenge_auth() {
         .await
         .unwrap();
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {
         let mut conn = db.get().await.unwrap();
-        let id: i32 = insert_into(schema::operator_identity::table)
-            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
-            .returning(schema::operator_identity::id)
+        let id: i32 = insert_into(schema::operator_client::table)
+            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
+            .returning(schema::operator_client::id)
             .get_result(&mut conn)
             .await
             .unwrap();
@@ -366,13 +366,13 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
         .await
         .unwrap();
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {
         let mut conn = db.get().await.unwrap();
-        insert_into(schema::operator_identity::table)
-            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
+        insert_into(schema::operator_client::table)
+            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
             .execute(&mut conn)
             .await
             .unwrap();
@@ -439,14 +439,14 @@ pub async fn challenge_auth_rejects_invalid_signature() {
         .await
         .unwrap();
 
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {
         let mut conn = db.get().await.unwrap();
-        let id: i32 = insert_into(schema::operator_identity::table)
-            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
-            .returning(schema::operator_identity::id)
+        let id: i32 = insert_into(schema::operator_client::table)
+            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
+            .returning(schema::operator_client::id)
             .get_result(&mut conn)
             .await
             .unwrap();

server/crates/arbiter-server/tests/operator/unseal.rs

@@ -16,7 +16,7 @@ use arbiter_server::{
     },
 };
 
-use chacha20poly1305::{AeadInOut, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
 use kameo::actor::Spawn as _;
 use tokio::sync::oneshot;
 use x25519_dalek::{EphemeralSecret, PublicKey};