test(server): governance integration tests

feat(server::grpc): wire governance RPCs through operator session
feat(server): introduce ProposalManager actor with quorum voting logic
2026-06-13 15:23:10 +02:00 · 2026-06-13 15:23:10 +02:00 · 2026-06-13 15:11:00 +02:00 · 2026-06-13 15:11:00 +02:00 · 2026-06-13 15:11:00 +02:00 · 2026-06-13 15:11:00 +02:00
60 changed files with 2461 additions and 1222 deletions
--- a/mise.toml
+++ b/mise.toml
@@ -22,3 +22,5 @@ run = '''
 dart pub global activate protoc_plugin && \
 protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
 '''
+
+[tasks.generate_schema]
--- a/protobufs/operator.proto
+++ b/protobufs/operator.proto
@@ -4,25 +4,28 @@ package arbiter.operator;

 import "operator/auth.proto";
 import "operator/evm.proto";
+import "operator/governance.proto";
 import "operator/sdk_client.proto";
 import "operator/vault/vault.proto";

 message OperatorRequest {
  int32 id = 16;
  oneof payload {
-    auth.Request auth = 1;
-    vault.Request vault = 2;
-    evm.Request evm = 3;
-    sdk_client.Request sdk_client = 4;
+    auth.Request            auth        = 1;
+    vault.Request           vault       = 2;
+    evm.Request             evm         = 3;
+    sdk_client.Request      sdk_client  = 4;
+    governance.Request      governance  = 5;
  }
 }

 message OperatorResponse {
  optional int32 id = 16;
  oneof payload {
-    auth.Response auth = 1;
-    vault.Response vault = 2;
-    evm.Response evm = 3;
-    sdk_client.Response sdk_client = 4;
+    auth.Response           auth        = 1;
+    vault.Response          vault       = 2;
+    evm.Response            evm         = 3;
+    sdk_client.Response     sdk_client  = 4;
+    governance.Response     governance  = 5;
  }
 }
--- a/protobufs/operator/governance.proto
+++ b/protobufs/operator/governance.proto
@@ -0,0 +1,66 @@
+syntax = "proto3";
+
+package arbiter.operator.governance;
+
+message Request {
+  oneof payload {
+    CreateProposalRequest create = 1;
+    CastVoteRequest       vote   = 2;
+    QueryPendingRequest   query  = 3;
+  }
+}
+
+message CreateProposalRequest {
+  oneof kind {
+    ApproveSdkClientPayload approve_sdk_client = 1;
+  }
+  optional uint32 ttl_secs = 2;
+}
+
+message ApproveSdkClientPayload {
+  int32 client_id = 1;
+}
+
+message CastVoteRequest {
+  int32 proposal_id = 1;
+  bool  approve     = 2;
+  bytes signature   = 3;
+}
+
+message QueryPendingRequest {}
+
+message Response {
+  oneof payload {
+    CreateProposalResponse created  = 1;
+    VoteResponse           voted    = 2;
+    QueryPendingResponse   pending  = 3;
+  }
+}
+
+message CreateProposalResponse {
+  int32 proposal_id = 1;
+}
+
+message VoteResponse {
+  VoteOutcome outcome = 1;
+}
+
+enum VoteOutcome {
+  VOTE_OUTCOME_UNSPECIFIED  = 0;
+  VOTE_OUTCOME_PENDING      = 1;
+  VOTE_OUTCOME_APPROVED     = 2;
+  VOTE_OUTCOME_REJECTED     = 3;
+}
+
+message ProposalSummary {
+  int32  id            = 1;
+  string kind          = 2;
+  int32  initiator_id  = 3;
+  int64  expires_at    = 4;
+  int64  approve_count = 5;
+  int64  reject_count  = 6;
+}
+
+message QueryPendingResponse {
+  repeated ProposalSummary proposals = 1;
+}
--- a/protobufs/operator/vault/bootstrap.proto
+++ b/protobufs/operator/vault/bootstrap.proto
@@ -8,15 +8,28 @@ message BootstrapEncryptedKey {
  bytes associated_data = 3;
 }

+message DeclareCommittee {
+  uint32 count = 1;
+}
+
+message ContributePassphrase {
+  bytes passphrase = 1;
+}
+
 enum BootstrapResult {
  BOOTSTRAP_RESULT_UNSPECIFIED = 0;
  BOOTSTRAP_RESULT_SUCCESS = 1;
  BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
  BOOTSTRAP_RESULT_INVALID_KEY = 3;
+  BOOTSTRAP_RESULT_AWAITING_CONTRIBUTIONS = 4;
 }

 message Request {
-  BootstrapEncryptedKey encrypted_key = 2;
+  oneof payload {
+    BootstrapEncryptedKey encrypted_key = 2;
+    DeclareCommittee declare_committee = 3;
+    ContributePassphrase contribute_passphrase = 4;
+  }
 }

 message Response {
--- a/protobufs/operator/vault/unseal.proto
+++ b/protobufs/operator/vault/unseal.proto
@@ -15,18 +15,23 @@ message UnsealEncryptedKey {
  bytes associated_data = 3;
 }

+message ContributePassphrase {
+  bytes passphrase = 1;
+}
+
 enum UnsealResult {
  UNSEAL_RESULT_UNSPECIFIED = 0;
  UNSEAL_RESULT_SUCCESS = 1;
  UNSEAL_RESULT_INVALID_KEY = 2;
  UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
-  UNSEAL_RESULT_LOCKED_OUT = 4;
+  UNSEAL_RESULT_AWAITING_CONTRIBUTIONS = 4;
 }

 message Request {
  oneof payload {
    UnsealStart start = 1;
    UnsealEncryptedKey encrypted_key = 2;
+    ContributePassphrase contribute_passphrase = 3;
  }
 }

--- a/protobufs/shared/vault.proto
+++ b/protobufs/shared/vault.proto
@@ -5,7 +5,8 @@ package arbiter.shared;
 enum VaultState {
  VAULT_STATE_UNSPECIFIED = 0;
  VAULT_STATE_UNBOOTSTRAPPED = 1;
-  VAULT_STATE_SEALED = 2;
-  VAULT_STATE_UNSEALED = 3;
-  VAULT_STATE_ERROR = 4;
+  VAULT_STATE_BOOSTRAPPING = 2;
+  VAULT_STATE_SEALED = 3;
+  VAULT_STATE_UNSEALED = 4;
+  VAULT_STATE_ERROR = 5;
 }
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -24,7 +24,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
 "crypto-common 0.1.7",
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -771,7 +771,7 @@ dependencies = [
 "proptest",
 "prost-types",
 "rand 0.10.1",
- "rand_core 0.10.1",
+ "rand_core 0.6.4",
 "rcgen",
 "restructed",
 "rstest",
@@ -787,6 +787,7 @@ dependencies = [
 "tonic",
 "tracing",
 "tracing-subscriber",
+ "vsss-rs",
 "x25519-dalek 2.0.1",
 ]

@@ -1284,7 +1285,7 @@ version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -1613,8 +1614,22 @@ version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 "rand_core 0.6.4",
+ "serdect 0.2.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-bigint"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96272c2ff28b807e09250b180ad1fb7889a3258f7455759b5c3c58b719467130"
+dependencies = [
+ "num-traits",
+ "rand_core 0.6.4",
+ "serdect 0.3.0",
 "subtle",
 "zeroize",
 ]
@@ -1625,7 +1640,7 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 "rand_core 0.6.4",
 "typenum",
 ]
@@ -1928,7 +1943,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -2008,7 +2023,7 @@ dependencies = [
 "digest 0.10.7",
 "elliptic-curve",
 "rfc6979",
- "serdect",
+ "serdect 0.2.0",
 "signature 2.2.0",
 "spki 0.7.3",
 ]
@@ -2041,16 +2056,32 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
 "base16ct",
- "crypto-bigint",
+ "crypto-bigint 0.5.5",
 "digest 0.10.7",
 "ff",
- "generic-array",
+ "generic-array 0.14.7",
 "group",
+ "hkdf",
 "pkcs8 0.10.2",
 "rand_core 0.6.4",
 "sec1",
- "serdect",
+ "serdect 0.2.0",
 "subtle",
+ "tap",
+ "zeroize",
+]
+
+[[package]]
+name = "elliptic-curve-tools"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1de2b6fae800f08032a6ea32995b52925b1d451bff9d445c8ab2932323277faf"
+dependencies = [
+ "elliptic-curve",
+ "heapless",
+ "hex",
+ "multiexp",
+ "serde",
 "zeroize",
 ]

@@ -2124,6 +2155,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
+ "bitvec",
 "rand_core 0.6.4",
 "subtle",
 ]
@@ -2324,6 +2356,17 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "generic-array"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab9e9188e97a93276e1fe7b56401b851e2b45a46d045ca658100c1303ada649"
+dependencies = [
+ "rustversion",
+ "serde_core",
+ "typenum",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -2407,6 +2450,15 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "hash32"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606"
+dependencies = [
+ "byteorder",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -2447,6 +2499,16 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"

+[[package]]
+name = "heapless"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
+dependencies = [
+ "hash32",
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -2474,6 +2536,15 @@ dependencies = [
 "arrayvec",
 ]

+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac 0.12.1",
+]
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -2544,6 +2615,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d46837a0ed51fe95bd3b05de33cd64a1ee88fc797477ca48446872504507c5"
 dependencies = [
 "ctutils",
+ "serde",
 "typenum",
 "zeroize",
 ]
@@ -2809,7 +2881,7 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -2948,7 +3020,7 @@ dependencies = [
 "ecdsa",
 "elliptic-curve",
 "once_cell",
- "serdect",
+ "serdect 0.2.0",
 "sha2 0.10.9",
 "signature 2.2.0",
 ]
@@ -2956,7 +3028,7 @@ dependencies = [
 [[package]]
 name = "kameo"
 version = "0.20.0"
-source = "git+https://github.com/hdbg/kameo.git?rev=805b417#805b41783fe90b54827ecad142b422c7a9b69b9a"
+source = "git+https://github.com/hdbg/kameo.git?rev=3e18ba2#3e18ba24023d0422034e60ff2ea1ecd49e8c3c93"
 dependencies = [
 "downcast-rs",
 "dyn-clone",
@@ -2970,7 +3042,7 @@ dependencies = [
 [[package]]
 name = "kameo_actors"
 version = "0.5.0"
-source = "git+https://github.com/hdbg/kameo.git?rev=805b417#805b41783fe90b54827ecad142b422c7a9b69b9a"
+source = "git+https://github.com/hdbg/kameo.git?rev=3e18ba2#3e18ba24023d0422034e60ff2ea1ecd49e8c3c93"
 dependencies = [
 "futures",
 "glob",
@@ -2982,9 +3054,8 @@ dependencies = [
 [[package]]
 name = "kameo_macros"
 version = "0.20.0"
-source = "git+https://github.com/hdbg/kameo.git?rev=805b417#805b41783fe90b54827ecad142b422c7a9b69b9a"
+source = "git+https://github.com/hdbg/kameo.git?rev=3e18ba2#3e18ba24023d0422034e60ff2ea1ecd49e8c3c93"
 dependencies = [
- "darling 0.23.0",
 "heck",
 "proc-macro2",
 "quote",
@@ -3291,6 +3362,20 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "multiexp"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ec2ce93a6f06ac6cae04c1da3f2a6a24fcfc1f0eb0b4e0f3d302f0df45326cb"
+dependencies = [
+ "ff",
+ "group",
+ "rand_core 0.6.4",
+ "rustversion",
+ "std-shims",
+ "zeroize",
+]
+
 [[package]]
 name = "multimap"
 version = "0.10.1"
@@ -3322,6 +3407,20 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -3330,6 +3429,19 @@ checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
 dependencies = [
 "num-integer",
 "num-traits",
+ "rand 0.8.6",
+ "serde",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+ "rand 0.8.6",
+ "serde",
 ]

 [[package]]
@@ -3347,6 +3459,29 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+ "serde",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -4455,9 +4590,9 @@ checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
 "base16ct",
 "der 0.7.10",
- "generic-array",
+ "generic-array 0.14.7",
 "pkcs8 0.10.2",
- "serdect",
+ "serdect 0.2.0",
 "subtle",
 "zeroize",
 ]
@@ -4623,6 +4758,16 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "serdect"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f42f67da2385b51a5f9652db9c93d78aeaf7610bf5ec366080b6de810604af53"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -4788,6 +4933,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "spin"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -4832,6 +4983,17 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"

+[[package]]
+name = "std-shims"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "227c4f8561598188d0df96dbe749824576174bba278b5b6bb2eacff1066067d0"
+dependencies = [
+ "hashbrown 0.16.1",
+ "rustversion",
+ "spin",
+]
+
 [[package]]
 name = "string_morph"
 version = "0.1.0"
@@ -5575,6 +5737,27 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"

+[[package]]
+name = "vsss-rs"
+version = "5.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ec751bdcc8bda099e269b24cc6b4ad14f9ce8b0490c1599174070e792ecd70c"
+dependencies = [
+ "crypto-bigint 0.5.5",
+ "crypto-bigint 0.6.1",
+ "elliptic-curve",
+ "elliptic-curve-tools",
+ "generic-array 1.4.1",
+ "hex",
+ "hybrid-array",
+ "num",
+ "rand_core 0.6.4",
+ "serde",
+ "sha3 0.10.9",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "wait-timeout"
 version = "0.2.1"
@@ -6262,18 +6445,18 @@ dependencies = [

 [[package]]
 name = "zeroize"
-version = "1.9.0"
+version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
 dependencies = [
 "zeroize_derive",
 ]

 [[package]]
 name = "zeroize_derive"
-version = "1.5.0"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
 dependencies = [
 "proc-macro2",
 "quote",
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -12,8 +12,8 @@ base64 = "0.22.1"
 chrono = { version = "0.4.44", features = ["serde"] }
 futures = "0.3.32"
 k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
-kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
-kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
+kameo = {git = "https://github.com/hdbg/kameo.git", rev = "3e18ba2"}
+kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "3e18ba2"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
 ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
@@ -21,7 +21,6 @@ mutants = "0.0.4"
 prost = "0.14.3"
 prost-types = { version = "0.14.3", features = ["chrono"] }
 rand = "0.10.1"
-rand_core = "0.10.1"
 rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
 rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
@@ -77,7 +76,6 @@ needless_pass_by_ref_mut = "allow"
 pub_underscore_fields = "allow"
 redundant_pub_crate = "allow" 
 uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {})
-too-many-lines = "allow" # this is a very common pattern in server code, and it's not always possible to break it down into smaller modules without hurting readability

 # restriction lints
 alloc_instead_of_core = "warn"
@@ -108,7 +106,6 @@ indexing_slicing = "warn"
 infinite_loop = "warn"
 inline_asm_x86_att_syntax = "warn"
 inline_asm_x86_intel_syntax = "warn"
-integer_division = "warn"
 large_include_file = "warn"
 lossy_float_literal = "warn"
 map_with_unused_argument_over_ranges = "warn"
--- a/server/crates/arbiter-client/src/auth.rs
+++ b/server/crates/arbiter-client/src/auth.rs
@@ -100,7 +100,7 @@ async fn send_auth_challenge_solution(
    key: &SigningKey,
    challenge: AuthChallenge,
 ) -> Result<(), AuthError> {
-    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos.cast_signed());
+    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos as i64);
    let challenge = authn::AuthChallenge {
        nonce: *challenge
            .random
--- a/server/crates/arbiter-crypto/src/authn/v1.rs
+++ b/server/crates/arbiter-crypto/src/authn/v1.rs
@@ -8,6 +8,7 @@ use rand::RngExt;

 pub static CLIENT_CONTEXT: &[u8] = b"arbiter_client";
 pub static OPERATOR_CONTEXT: &[u8] = b"arbiter_operator";
+pub static GOVERNANCE_CONTEXT: &[u8] = b"arbiter_governance_vote";

 const NONCE_SIZE: usize = 32;

@@ -90,6 +91,11 @@ impl PublicKey {
        self.0
            .verify_with_context(&challenge, context, &signature.0)
    }
+
+    #[must_use]
+    pub fn verify_message(&self, message: &[u8], context: &[u8], signature: &Signature) -> bool {
+        self.0.verify_with_context(message, context, &signature.0)
+    }
 }

 impl Signature {
--- a/server/crates/arbiter-crypto/src/safecell.rs
+++ b/server/crates/arbiter-crypto/src/safecell.rs
@@ -22,7 +22,7 @@ pub trait SafeCellHandle<T> {
    fn read(&mut self) -> Self::CellRead<'_>;
    fn write(&mut self) -> Self::CellWrite<'_>;

-    fn new_inline<F>(f: F) -> Self
+    fn new_inline_default<F>(f: F) -> Self
    where
        Self: Sized,
        T: Default,
@@ -36,6 +36,14 @@ pub trait SafeCellHandle<T> {
        cell
    }

+    fn new_inline<F>(f: Box<F>) -> Self
+    where
+        Self: Sized,
+        F: for<'a> FnOnce() -> T,
+    {
+        Self::new(f())
+    }
+
    #[inline(always)]
    fn read_inline<F, R>(&mut self, f: F) -> R
    where
--- a/server/crates/arbiter-proto/src/lib.rs
+++ b/server/crates/arbiter-proto/src/lib.rs
@@ -23,6 +23,10 @@ pub mod proto {
            tonic::include_proto!("arbiter.operator.evm");
        }

+        pub mod governance {
+            tonic::include_proto!("arbiter.operator.governance");
+        }
+
        pub mod sdk_client {
            tonic::include_proto!("arbiter.operator.sdk_client");
        }
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -31,7 +31,6 @@ diesel_migrations = { version = "2.3.2", features = ["sqlite"] }
 async-trait.workspace = true
 tokio-stream.workspace = true
 rand.workspace = true
-rand_core.workspace = true
 rcgen.workspace = true
 chrono.workspace = true
 kameo.workspace = true
@@ -51,6 +50,8 @@ subtle = "2.6.1"
 x25519-dalek.workspace = true
 k256.workspace = true
 kameo_actors.workspace = true
+vsss-rs = "5.4.0"
+rand_core = "0.6"

 [dev-dependencies]
 proptest = "1.11.0"
--- a/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
@@ -43,13 +43,25 @@ create table if not exists arbiter_settings (
 insert into arbiter_settings (id) values (1) on conflict do nothing;
 -- ensure singleton row exists

-create table if not exists operator_client (
+create table if not exists operator_identity (
    id integer not null primary key,
    public_key blob not null,
    created_at integer not null default(unixepoch ('now')),
    updated_at integer not null default(unixepoch ('now'))
 ) STRICT;
-create unique index if not exists uniq_operator_client_public_key on operator_client (public_key);
+create unique index if not exists uniq_operator_identity_public_key on operator_identity (public_key);
+
+create table if not exists operator (
+    id integer primary key references operator_identity(id) on delete restrict, -- same id as operator_identity
+
+    share blob not null,
+    share_nonce blob not null,
+    share_salt blob not null default (randomblob(32)),
+
+    created_at integer not null default(unixepoch ('now')),
+    updated_at integer not null default(unixepoch ('now'))
+
+) STRICT;

 create table if not exists client_metadata (
    id integer not null primary key,
@@ -204,3 +216,24 @@ create table if not exists integrity_envelope (
 ) STRICT;

 create unique index if not exists uniq_integrity_envelope_entity on integrity_envelope (entity_kind, entity_id);
+
+create table if not exists proposal (
+    id           integer not null primary key,
+    kind         text    not null,
+    payload      blob    not null,
+    initiator_id integer not null references operator_identity(id) on delete restrict,
+    created_at   integer not null default(unixepoch('now')),
+    expires_at   integer not null,
+    status       text    not null default 'pending'
+        check (status in ('pending', 'approved', 'rejected', 'expired'))
+) STRICT;
+
+create table if not exists proposal_vote (
+    id          integer not null primary key,
+    proposal_id integer not null references proposal(id) on delete cascade,
+    operator_id integer not null references operator_identity(id) on delete restrict,
+    approve     integer not null check (approve in (0, 1)),
+    signature   blob    not null,
+    voted_at    integer not null default(unixepoch('now')),
+    unique (proposal_id, operator_id)
+) STRICT;
--- a/server/crates/arbiter-server/src/actors/bootstrap.rs
+++ b/server/crates/arbiter-server/src/actors/bootstrap.rs
@@ -1,48 +1,29 @@
 use crate::db::{self, DatabasePool, schema};
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use arbiter_proto::{BOOTSTRAP_PATH, home_path};

 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
-use rand::{RngExt, distr::Alphanumeric, rngs::SysRng};
-use rand_core::UnwrapErr;
-use std::path::{Path, PathBuf};
+use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
 use subtle::ConstantTimeEq as _;
 use thiserror::Error;
-use tracing::warn;

 const TOKEN_LENGTH: usize = 64;

-async fn write_token_file(path: &Path, content: &str) -> Result<(), std::io::Error> {
-    tokio::fs::write(path, content.as_bytes()).await?;
+pub async fn generate_token() -> Result<String, std::io::Error> {
+    let rng: StdRng = make_rng();

-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt as _;
-        tokio::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600)).await?;
-    }
+    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
+        String::default(),
+        |mut accum, char| {
+            accum += char.to_string().as_str();
+            accum
+        },
+    );

-    Ok(())
-}
+    tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;

-async fn generate_token(path: &Path) -> Result<SafeCell<[u8; TOKEN_LENGTH]>, std::io::Error> {
-    let mut cell = SafeCell::new([0u8; TOKEN_LENGTH]);
-    {
-        let mut buf = cell.write();
-        for (slot, b) in buf
-            .iter_mut()
-            .zip(UnwrapErr(SysRng).sample_iter(Alphanumeric))
-        {
-            *slot = b;
-        }
-    }
-
-    let token_str = cell.read_inline(|buf| String::from_utf8_lossy(buf.as_ref()).into_owned());
-
-    write_token_file(path, &token_str).await?;
-
-    Ok(cell)
+    Ok(token)
 }

 #[derive(Error, Debug)]
@@ -59,8 +40,7 @@ pub enum Error {

 #[derive(Actor)]
 pub struct Bootstrapper {
-    token: Option<SafeCell<[u8; TOKEN_LENGTH]>>,
-    token_path: Option<PathBuf>,
+    token: Option<String>,
 }

 impl Bootstrapper {
@@ -68,43 +48,40 @@ impl Bootstrapper {
        let row_count: i64 = {
            let mut conn = db.get().await?;

-            schema::operator_client::table
+            schema::operator::table
                .count()
                .get_result(&mut conn)
                .await?
        };

-        let (token, token_path) = if row_count == 0 {
-            let path = home_path()?.join(BOOTSTRAP_PATH);
-            let token = generate_token(&path).await?;
-            (Some(token), Some(path))
+        let token = if row_count == 0 {
+            let token = generate_token().await?;
+            Some(token)
        } else {
-            (None, None)
+            None
        };

-        Ok(Self { token, token_path })
-    }
-}
-
-impl Bootstrapper {
-    fn is_correct_token(&mut self, token: &[u8]) -> bool {
-        self.token.as_mut().is_some_and(|expected| {
-            expected.read_inline(|exp| bool::from(exp.as_ref().ct_eq(token)))
-        })
+        Ok(Self { token })
    }
 }

 #[messages]
 impl Bootstrapper {
    #[message]
-    pub async fn consume_token(&mut self, token: Vec<u8>) -> bool {
-        if self.is_correct_token(&token) {
+    pub fn is_correct_token(&self, token: String) -> bool {
+        self.token.as_ref().is_some_and(|expected| {
+            let expected_bytes = expected.as_bytes();
+            let token_bytes = token.as_bytes();
+
+            let choice = expected_bytes.ct_eq(token_bytes);
+            bool::from(choice)
+        })
+    }
+
+    #[message]
+    pub fn consume_token(&mut self, token: String) -> bool {
+        if self.is_correct_token(token) {
            self.token = None;
-            if let Some(path) = self.token_path.take()
-                && let Err(e) = tokio::fs::remove_file(&path).await
-            {
-                warn!(error = ?e, path = ?path, "Failed to delete bootstrap token file after consumption");
-            }
            true
        } else {
            false
@@ -115,9 +92,7 @@ impl Bootstrapper {
 #[messages]
 impl Bootstrapper {
    #[message]
-    pub fn get_token(&mut self) -> Option<String> {
-        self.token
-            .as_mut()
-            .map(|cell| cell.read_inline(|buf| String::from_utf8_lossy(buf.as_ref()).into_owned()))
+    pub fn get_token(&self) -> Option<String> {
+        self.token.clone()
    }
 }
--- a/server/crates/arbiter-server/src/actors/evm/mod.rs
+++ b/server/crates/arbiter-server/src/actors/evm/mod.rs
@@ -1,9 +1,9 @@
 use crate::{
    actors::vault::{CreateNew, Decrypt, Vault},
-    crypto::integrity::{self, Integrable},
+    crypto::integrity,
    db::{
        DatabaseError, DatabasePool,
-        models::{self},
+        models::{self, EvmWalletId},
        schema,
    },
    evm::{
@@ -25,35 +25,14 @@ use diesel::{
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, actor::ActorRef, messages};
 use rand::{SeedableRng, rng, rngs::StdRng};
-use tracing::error;

 pub use crate::evm::safe_signer;

-/// Integrity guard that binds a wallet's encrypted key ID to its Ethereum address.
-/// Both fields are included in the HMAC — swapping `aead_encrypted_id` in the DB
-/// invalidates the envelope MAC, and the AEAD ciphertext is also bound to `address`
-/// as AAD, so decryption fails too.
-#[derive(arbiter_macros::Hashable)]
-struct EvmWalletIntegrity {
-    aead_encrypted_id: i32,
-    address: Address,
-}
-
-impl Integrable for EvmWalletIntegrity {
-    const KIND: &'static str = "evm_wallet";
-}
-
 #[derive(Debug, thiserror::Error)]
 pub enum SignTransactionError {
    #[error("Wallet not found")]
    WalletNotFound,

-    #[error("Decrypted key does not match requested wallet address")]
-    KeyAddressMismatch,
-
-    #[error("Internal signing error")]
-    Internal,
-
    #[error("Database error: {0}")]
    Database(#[from] DatabaseError),

@@ -85,12 +64,6 @@ pub enum Error {
    Integrity(#[from] integrity::Error),
 }

-impl From<diesel::result::Error> for Error {
-    fn from(e: diesel::result::Error) -> Self {
-        Self::Database(DatabaseError::from(e))
-    }
-}
-
 #[derive(Actor)]
 pub struct EvmActor {
    pub vault: ActorRef<Vault>,
@@ -124,45 +97,26 @@ impl EvmActor {

        let aead_id: i32 = self
            .vault
-            .ask(CreateNew {
-                plaintext,
-                aad: address.as_slice().to_vec(),
-            })
+            .ask(CreateNew { plaintext })
            .await
            .map_err(|_| Error::VaultSend)?;

        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let wallet_id = conn
-            .exclusive_transaction(async |conn| {
-                let wallet_id: i32 = insert_into(schema::evm_wallet::table)
-                    .values(&models::NewEvmWallet {
-                        address: address.as_slice().to_vec(),
-                        aead_encrypted_id: aead_id,
-                    })
-                    .returning(schema::evm_wallet::id)
-                    .get_result(conn)
-                    .await
-                    .map_err(DatabaseError::from)
-                    .map_err(Error::Database)?;
-
-                integrity::sign_entity(
-                    conn,
-                    &self.vault,
-                    &EvmWalletIntegrity { address, aead_encrypted_id: aead_id },
-                    wallet_id,
-                )
-                .await
-                .map_err(Error::Integrity)?;
-
-                Ok::<i32, Error>(wallet_id)
+        let wallet_id = insert_into(schema::evm_wallet::table)
+            .values(&models::NewEvmWallet {
+                address: address.as_slice().to_vec(),
+                aead_encrypted_id: aead_id,
            })
-            .await?;
+            .returning(schema::evm_wallet::id)
+            .get_result(&mut conn)
+            .await
+            .map_err(DatabaseError::from)?;

        Ok((wallet_id, address))
    }

    #[message]
-    pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> {
+    pub async fn list_wallets(&self) -> Result<Vec<(EvmWalletId, Address)>, Error> {
        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
        let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
            .select(models::EvmWallet::as_select())
@@ -206,14 +160,23 @@ impl EvmActor {
    }

    #[message]
-    pub async fn useragent_delete_grant(
-        &mut self,
-        grant_id: i32,
-    ) -> Result<(), Error> {
-        self.engine
-            .revoke_grant(grant_id)
+    pub async fn operator_delete_grant(&mut self, grant_id: i32) -> Result<(), Error> {
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+
+        let affected = diesel::update(schema::evm_basic_grant::table)
+            .filter(schema::evm_basic_grant::id.eq(grant_id))
+            .set(schema::evm_basic_grant::revoked_at.eq(models::SqliteTimestamp::now()))
+            .execute(&mut conn)
            .await
-            .map_err(Error::from)
+            .map_err(DatabaseError::from)?;
+
+        if affected == 0 {
+            return Err(Error::Database(DatabaseError::from(
+                diesel::result::Error::NotFound,
+            )));
+        }
+
+        Ok(())
    }

    #[message]
@@ -287,51 +250,16 @@ impl EvmActor {
            .ok_or(SignTransactionError::WalletNotFound)?;
        drop(conn);

-        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let attestation = integrity::verify_entity(
-            &mut conn,
-            &self.vault,
-            &EvmWalletIntegrity {
-                address: wallet_address,
-                aead_encrypted_id: wallet.aead_encrypted_id,
-            },
-            wallet.id,
-        )
-        .await
-        .map_err(|e| {
-            error!(?e, wallet_id = wallet.id, "EVM wallet integrity check failed");
-            SignTransactionError::Internal
-        })?;
-        drop(conn);
-
-        if attestation != integrity::AttestationStatus::Attested {
-            error!(
-                wallet_id = wallet.id,
-                "EVM wallet integrity unavailable; refusing to sign"
-            );
-            return Err(SignTransactionError::Internal);
-        }
-
        let raw_key: SafeCell<Vec<u8>> = self
            .vault
            .ask(Decrypt {
                aead_id: wallet.aead_encrypted_id,
-                aad: wallet.address.clone(),
            })
            .await
            .map_err(|_| SignTransactionError::VaultSend)?;

        let signer = safe_signer::SafeSigner::from_cell(raw_key)?;

-        if signer.address() != wallet_address {
-            error!(
-                expected = %wallet_address,
-                actual = %signer.address(),
-                "Decrypted private key address does not match requested wallet"
-            );
-            return Err(SignTransactionError::KeyAddressMismatch);
-        }
-
        self.engine
            .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
            .await?;
--- a/server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs
+++ b/server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs
@@ -11,9 +11,7 @@ use kameo::{
    prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
    reply::ReplySender,
 };
-use std::{ops::ControlFlow, time::Duration};
-
-const APPROVAL_TIMEOUT: Duration = Duration::from_secs(30);
+use std::ops::ControlFlow;

 pub struct Args {
    pub client: ClientProfile,
@@ -66,14 +64,6 @@ impl Actor for ClientApprovalController {
                .await;
        }

-        let weak = actor_ref.downgrade();
-        tokio::spawn(async move {
-            tokio::time::sleep(APPROVAL_TIMEOUT).await;
-            if let Some(r) = weak.upgrade() {
-                let _ = r.tell(OnApprovalTimeout {}).await;
-            }
-        });
-
        Ok(this)
    }

@@ -114,14 +104,4 @@ impl ClientApprovalController {
            ctx.stop();
        }
    }
-
-    /// Fired after `APPROVAL_TIMEOUT` elapses. Any operator that hasn't responded
-    /// by then is treated as a denial to prevent zombie sessions from blocking the flow.
-    #[message(ctx)]
-    pub fn on_approval_timeout(&mut self, ctx: &mut Context<Self, ()>) {
-        if self.pending > 0 {
-            self.send_reply(Ok(false));
-            ctx.stop();
-        }
-    }
 }
--- a/server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
+++ b/server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
@@ -20,8 +20,6 @@ pub mod client_connect_approval;

 pub struct FlowCoordinator {
    pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
-    /// Maps DB `client_id` → `ActorId` for fast connected-client lookup.
-    client_ids: HashMap<i32, ActorId>,
    operator_registry: ActorRef<OperatorRegistry>,
 }

@@ -29,7 +27,6 @@ impl FlowCoordinator {
    pub fn new(operator_registry: ActorRef<OperatorRegistry>) -> Self {
        Self {
            clients: HashMap::default(),
-            client_ids: HashMap::default(),
            operator_registry,
        }
    }
@@ -51,7 +48,6 @@ impl Actor for FlowCoordinator {
        _: ActorStopReason,
    ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
        if self.clients.remove(&id).is_some() {
-            self.client_ids.retain(|_, actor_id| *actor_id != id);
            info!(
                ?id,
                actor = "FlowCoordinator",
@@ -79,28 +75,14 @@ impl FlowCoordinator {
    #[message(ctx)]
    pub async fn register_client(
        &mut self,
-        client_id: i32,
        actor: ActorRef<ClientSession>,
        ctx: &mut Context<Self, ()>,
    ) {
-        info!(id = %actor.id(), client_id, actor = "FlowCoordinator", event = "client.connected");
+        info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected");
        ctx.actor_ref().link(&actor).await;
-        self.client_ids.insert(client_id, actor.id());
        self.clients.insert(actor.id(), actor);
    }

-    #[message]
-    pub fn is_client_connected(&self, client_id: i32) -> bool {
-        self.client_ids.contains_key(&client_id)
-    }
-
-    /// Returns the DB `client_ids` of all currently connected SDK clients.
-    /// Used by operator sessions on startup to seed their approved-client set.
-    #[message]
-    pub fn get_connected_client_ids(&self) -> Vec<i32> {
-        self.client_ids.keys().copied().collect()
-    }
-
    #[message(ctx)]
    pub async fn request_client_approval(
        &mut self,
--- a/server/crates/arbiter-server/src/actors/mod.rs
+++ b/server/crates/arbiter-server/src/actors/mod.rs
@@ -1,7 +1,8 @@
 use crate::{
    actors::{
        bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
-        operator_registry::OperatorRegistry, vault::Vault,
+        operator_registry::OperatorRegistry, proposal_manager::ProposalManager, vault::Vault,
+        vault_coordinator::VaultCoordinator,
    },
    db,
 };
@@ -14,7 +15,9 @@ pub mod bootstrap;
 pub mod evm;
 pub mod flow_coordinator;
 pub mod operator_registry;
+pub mod proposal_manager;
 pub mod vault;
+pub mod vault_coordinator;

 #[derive(Error, Debug)]
 pub enum SpawnError {
@@ -30,9 +33,11 @@ pub enum SpawnError {
 pub struct GlobalActors {
    pub vault: ActorRef<Vault>,
    pub bootstrapper: ActorRef<Bootstrapper>,
+    pub vault_coordinator: ActorRef<VaultCoordinator>,
    pub flow_coordinator: ActorRef<FlowCoordinator>,
    pub operator_registry: ActorRef<OperatorRegistry>,
    pub evm: ActorRef<EvmActor>,
+    pub proposal_manager: ActorRef<ProposalManager>,
    pub events: ActorRef<MessageBus>,
 }

@@ -47,7 +52,15 @@ impl GlobalActors {
        let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default());
        Ok(Self {
            bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
-            evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db)),
+            evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db.clone())),
+            vault_coordinator: VaultCoordinator::spawn(VaultCoordinator::new(
+                db.clone(),
+                key_holder.clone(),
+            )),
+            proposal_manager: ProposalManager::spawn(ProposalManager::new(
+                db,
+                key_holder.clone(),
+            )),
            vault: key_holder,
            flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::new(
                operator_registry.clone(),
--- a/server/crates/arbiter-server/src/actors/proposal_manager.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager.rs
@@ -0,0 +1,399 @@
+use crate::{
+    actors::vault::Vault,
+    db::{
+        self,
+        models::{NewProposal, NewProposalVote, Proposal, ProposalStatus, SqliteTimestamp},
+        schema,
+    },
+};
+use chrono::Utc;
+use diesel::{ExpressionMethods as _, QueryDsl};
+use diesel_async::RunQueryDsl;
+use kameo::{actor::ActorRef, messages};
+use tracing::{error, warn};
+
+pub const DEFAULT_TTL_SECS: i64 = 7 * 24 * 60 * 60; // 7 days
+
+#[derive(Debug, Clone)]
+pub enum ProposalKind {
+    ApproveSdkClient { client_id: i32 },
+}
+
+impl ProposalKind {
+    pub const fn kind_str(&self) -> &'static str {
+        match self {
+            Self::ApproveSdkClient { .. } => "approve_sdk_client",
+        }
+    }
+
+    pub fn encode_payload(&self) -> Vec<u8> {
+        match self {
+            Self::ApproveSdkClient { client_id } => client_id.to_be_bytes().to_vec(),
+        }
+    }
+
+    pub fn decode(kind: &str, payload: &[u8]) -> Result<Self, String> {
+        match kind {
+            "approve_sdk_client" => {
+                let bytes = <[u8; 4]>::try_from(payload)
+                    .map_err(|_| "invalid payload for approve_sdk_client".to_owned())?;
+                Ok(Self::ApproveSdkClient {
+                    client_id: i32::from_be_bytes(bytes),
+                })
+            }
+            other => Err(format!("unknown proposal kind: {other}")),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum VoteOutcome {
+    Pending,
+    QuorumApproved,
+    QuorumRejected,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("Proposal not found")]
+    ProposalNotFound,
+    #[error("Proposal is not pending")]
+    ProposalNotPending,
+    #[error("Operator already voted on this proposal")]
+    AlreadyVoted,
+    #[error("Invalid vote signature")]
+    InvalidSignature,
+    #[error("Operator not found")]
+    OperatorNotFound,
+    #[error("Database connection error: {0}")]
+    DatabaseConnection(#[from] db::PoolError),
+    #[error("Database query error: {0}")]
+    DatabaseQuery(#[from] diesel::result::Error),
+    #[error("Execution failed: {0}")]
+    ExecutionFailed(String),
+}
+
+#[derive(Debug)]
+pub struct ProposalSummary {
+    pub id: i32,
+    pub kind: String,
+    pub initiator_id: i32,
+    pub expires_at: SqliteTimestamp,
+    pub approve_count: i64,
+    pub reject_count: i64,
+}
+
+pub struct ProposalManager {
+    pub(crate) db: db::DatabasePool,
+    pub(crate) vault: ActorRef<Vault>,
+}
+
+impl ProposalManager {
+    pub const fn new(db: db::DatabasePool, vault: ActorRef<Vault>) -> Self {
+        Self { db, vault }
+    }
+}
+
+impl kameo::Actor for ProposalManager {
+    type Args = Self;
+    type Error = ();
+
+    async fn on_start(
+        args: Self::Args,
+        actor_ref: ActorRef<Self>,
+    ) -> Result<Self, Self::Error> {
+        let weak = actor_ref.downgrade();
+        tokio::spawn(async move {
+            loop {
+                tokio::time::sleep(tokio::time::Duration::from_hours(1)).await;
+                match weak.upgrade() {
+                    Some(r) => {
+                        let _ = r.ask(ExpireStale).await;
+                    }
+                    None => break,
+                }
+            }
+        });
+        Ok(args)
+    }
+}
+
+#[messages]
+impl ProposalManager {
+    #[message]
+    pub async fn create_proposal(
+        &mut self,
+        kind: ProposalKind,
+        initiator_id: i32,
+        ttl_secs: Option<i64>,
+    ) -> Result<i32, Error> {
+        let ttl = ttl_secs.unwrap_or(DEFAULT_TTL_SECS);
+        let expires_at = SqliteTimestamp::from(Utc::now() + chrono::Duration::seconds(ttl));
+
+        let new_proposal = NewProposal {
+            kind: kind.kind_str().to_owned(),
+            payload: kind.encode_payload(),
+            initiator_id,
+            expires_at,
+        };
+
+        let mut conn = self.db.get().await?;
+        let id: i32 = diesel::insert_into(schema::proposal::table)
+            .values(&new_proposal)
+            .returning(schema::proposal::id)
+            .get_result(&mut conn)
+            .await?;
+
+        Ok(id)
+    }
+
+    #[message]
+    pub async fn query_pending(&mut self, operator_id: i32) -> Vec<ProposalSummary> {
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::as_conversions,
+            reason = "fixme! #84; this will break in 2038"
+        )]
+        let now_ts = Utc::now().timestamp() as i32;
+
+        let Ok(mut conn) = self.db.get().await else {
+            warn!("query_pending: failed to acquire DB connection");
+            return vec![];
+        };
+
+        let voted_ids: Vec<i32> = schema::proposal_vote::table
+            .filter(schema::proposal_vote::operator_id.eq(operator_id))
+            .select(schema::proposal_vote::proposal_id)
+            .load(&mut conn)
+            .await
+            .unwrap_or_default();
+
+        let proposals: Vec<Proposal> = schema::proposal::table
+            .filter(schema::proposal::status.eq(ProposalStatus::Pending))
+            .filter(schema::proposal::expires_at.gt(now_ts))
+            .filter(diesel::dsl::not(schema::proposal::id.eq_any(&voted_ids)))
+            .load(&mut conn)
+            .await
+            .unwrap_or_default();
+
+        let mut summaries = Vec::with_capacity(proposals.len());
+        for p in proposals {
+            let approve_count: i64 = schema::proposal_vote::table
+                .filter(schema::proposal_vote::proposal_id.eq(p.id))
+                .filter(schema::proposal_vote::approve.eq(true))
+                .count()
+                .get_result(&mut conn)
+                .await
+                .unwrap_or(0);
+            let reject_count: i64 = schema::proposal_vote::table
+                .filter(schema::proposal_vote::proposal_id.eq(p.id))
+                .filter(schema::proposal_vote::approve.eq(false))
+                .count()
+                .get_result(&mut conn)
+                .await
+                .unwrap_or(0);
+            summaries.push(ProposalSummary {
+                id: p.id,
+                kind: p.kind,
+                initiator_id: p.initiator_id,
+                expires_at: p.expires_at,
+                approve_count,
+                reject_count,
+            });
+        }
+        summaries
+    }
+
+    #[message]
+    pub async fn expire_stale(&mut self) -> usize {
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::as_conversions,
+            reason = "fixme! #84; this will break in 2038"
+        )]
+        let now_ts = Utc::now().timestamp() as i32;
+
+        let Ok(mut conn) = self.db.get().await else {
+            warn!("expire_stale: failed to acquire DB connection");
+            return 0;
+        };
+
+        diesel::update(schema::proposal::table)
+            .filter(schema::proposal::status.eq(ProposalStatus::Pending))
+            .filter(schema::proposal::expires_at.lt(now_ts))
+            .set(schema::proposal::status.eq(ProposalStatus::Expired))
+            .execute(&mut conn)
+            .await
+            .unwrap_or(0)
+    }
+
+    #[message]
+    pub async fn cast_vote(
+        &mut self,
+        proposal_id: i32,
+        operator_id: i32,
+        approve: bool,
+        signature: Vec<u8>,
+    ) -> Result<VoteOutcome, Error> {
+        use arbiter_crypto::authn::{self, GOVERNANCE_CONTEXT};
+
+        let mut conn = self.db.get().await?;
+
+        // Load proposal — must exist
+        let proposal: Proposal = schema::proposal::table
+            .find(proposal_id)
+            .first(&mut conn)
+            .await
+            .map_err(|e| match e {
+                diesel::result::Error::NotFound => Error::ProposalNotFound,
+                other => Error::DatabaseQuery(other),
+            })?;
+
+        // Check for duplicate vote before status check so AlreadyVoted takes priority
+        let existing: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::proposal_vote::operator_id.eq(operator_id))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        if existing > 0 {
+            return Err(Error::AlreadyVoted);
+        }
+
+        if proposal.status != ProposalStatus::Pending {
+            return Err(Error::ProposalNotPending);
+        }
+
+        // Load operator public key from operator_identity
+        let pubkey_bytes: Vec<u8> = schema::operator_identity::table
+            .find(operator_id)
+            .select(schema::operator_identity::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(|e| match e {
+                diesel::result::Error::NotFound => Error::OperatorNotFound,
+                other => Error::DatabaseQuery(other),
+            })?;
+
+        let pubkey = authn::PublicKey::try_from(pubkey_bytes.as_slice())
+            .map_err(|()| Error::InvalidSignature)?;
+
+        // Canonical vote message: proposal_id (i64 big-endian) || approve (u8)
+        let mut vote_msg = Vec::with_capacity(9);
+        vote_msg.extend_from_slice(&i64::from(proposal_id).to_be_bytes());
+        vote_msg.push(u8::from(approve));
+
+        let auth_sig = authn::Signature::try_from(signature.as_slice())
+            .map_err(|()| Error::InvalidSignature)?;
+
+        if !pubkey.verify_message(&vote_msg, GOVERNANCE_CONTEXT, &auth_sig) {
+            return Err(Error::InvalidSignature);
+        }
+
+        // Insert vote
+        diesel::insert_into(schema::proposal_vote::table)
+            .values(&NewProposalVote {
+                proposal_id,
+                operator_id,
+                approve,
+                signature,
+            })
+            .execute(&mut conn)
+            .await?;
+
+        // Quorum check
+        let total_operators: i64 = schema::operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::cast_sign_loss,
+            clippy::as_conversions,
+            reason = "operator count is always a small positive integer"
+        )]
+        let threshold = crate::crypto::shamir::shamir_threshold(total_operators as usize);
+
+        let approve_count: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::proposal_vote::approve.eq(true))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+
+        let reject_count: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::proposal_vote::approve.eq(false))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+
+        #[expect(
+            clippy::cast_possible_wrap,
+            clippy::as_conversions,
+            reason = "threshold is derived from operator count, always fits i64"
+        )]
+        let threshold_i64 = threshold as i64;
+
+        if approve_count >= threshold_i64 {
+            diesel::update(schema::proposal::table.find(proposal_id))
+                .set(schema::proposal::status.eq(ProposalStatus::Approved))
+                .execute(&mut conn)
+                .await?;
+            drop(conn); // release connection before async execution
+            self.execute_proposal(&proposal).await?;
+            return Ok(VoteOutcome::QuorumApproved);
+        }
+
+        if reject_count > total_operators - threshold_i64 {
+            diesel::update(schema::proposal::table.find(proposal_id))
+                .set(schema::proposal::status.eq(ProposalStatus::Rejected))
+                .execute(&mut conn)
+                .await?;
+            return Ok(VoteOutcome::QuorumRejected);
+        }
+
+        Ok(VoteOutcome::Pending)
+    }
+}
+
+impl ProposalManager {
+    async fn execute_proposal(&self, proposal: &Proposal) -> Result<(), Error> {
+        let kind = ProposalKind::decode(&proposal.kind, &proposal.payload)
+            .map_err(Error::ExecutionFailed)?;
+        match kind {
+            ProposalKind::ApproveSdkClient { client_id } => {
+                self.execute_approve_sdk_client(client_id).await
+            }
+        }
+    }
+
+    async fn execute_approve_sdk_client(&self, client_id: i32) -> Result<(), Error> {
+        use arbiter_crypto::authn;
+        use crate::{
+            crypto::integrity,
+            peers::client::ClientCredentials,
+        };
+
+        let mut conn = self.db.get().await.map_err(Error::DatabaseConnection)?;
+
+        let pubkey_bytes: Vec<u8> = schema::program_client::table
+            .find(client_id)
+            .select(schema::program_client::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("client not found: {e}")))?;
+
+        let pubkey = authn::PublicKey::try_from(pubkey_bytes.as_slice())
+            .map_err(|()| Error::ExecutionFailed("invalid client public key".to_owned()))?;
+
+        let creds = ClientCredentials { pubkey };
+
+        integrity::sign_entity(&mut conn, &self.vault, &creds, client_id)
+            .await
+            .map_err(|e| {
+                error!(?e, "Failed to sign integrity envelope for client");
+                Error::ExecutionFailed(e.to_string())
+            })
+    }
+}
--- a/server/crates/arbiter-server/src/actors/vault/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault/mod.rs
@@ -1,13 +1,13 @@
 use crate::{
    crypto::{
-        KeyCell, derive_key,
+        KeyCell,
        encryption::v1::{self, Nonce},
        integrity::v1::HmacSha256,
    },
    db::{
        self,
-        models::{self, RootKeyHistory},
-        schema::{self},
+        models::{self, RootKeyHistory, RootKeyHistoryId},
+        schema,
    },
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
@@ -22,10 +22,9 @@ use hmac::{KeyInit as _, Mac as _};
 use kameo::{Actor, Reply, actor::ActorRef, messages};
 use kameo_actors::message_bus::{MessageBus, Publish};
 use strum::{EnumDiscriminants, IntoDiscriminant};
-use tracing::{error, info, warn};
+use tracing::{error, info};

 pub mod events {
-
    #[derive(Clone, Copy)]
    pub struct Bootstrapped;

@@ -46,8 +45,6 @@ pub enum Error {
    Sealed,
    #[error("Invalid key provided")]
    InvalidKey,
-    #[error("Vault locked: too many failed unseal attempts")]
-    LockedOut,

    #[error("Requested aead entry not found")]
    NotFound,
@@ -63,13 +60,10 @@ pub enum Error {

    #[error("Broken database")]
    BrokenDatabase,
-
-    #[error("Integrity key version mismatch: envelope uses key {envelope}, current key is {current}")]
-    KeyVersionMismatch { envelope: i32, current: i32 },
 }

 struct Unsealed {
-    root_key_history_id: i32,
+    root_key_history_id: RootKeyHistoryId,
    root_key: KeyCell,
 }

@@ -78,14 +72,13 @@ struct Unsealed {
 enum State {
    #[default]
    Unbootstrapped,
+
    Sealed {
-        root_key_history_id: i32,
+        root_key_history_id: RootKeyHistoryId,
    },
    Unsealed(Unsealed),
 }

-const MAX_UNSEAL_ATTEMPTS: u32 = 5;
-
 /// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed).
 ///
 /// Provides API for encrypting and decrypting data using the vault root key.
@@ -95,10 +88,8 @@ pub struct Vault {
    db: db::DatabasePool,
    state: State,
    events: ActorRef<MessageBus>,
-    unseal_failures: u32,
 }

-#[messages]
 impl Vault {
    pub async fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Result<Self, Error> {
        let state = {
@@ -118,12 +109,15 @@ impl Vault {
            }
        };

-        Ok(Self { db, state, events, unseal_failures: 0 })
+        Ok(Self { db, state, events })
    }

-    // Exclusive transaction to avoid race condtions if multiple vaults write
+    // Exclusive transaction to avoid race conditions if multiple vaults write
    // additional layer of protection against nonce-reuse
-    async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> {
+    async fn get_new_nonce(
+        pool: &db::DatabasePool,
+        root_key_id: RootKeyHistoryId,
+    ) -> Result<Nonce, Error> {
        let mut conn = pool.get().await?;

        let nonce = conn
@@ -136,7 +130,7 @@ impl Vault {

                let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
                    error!(
-                        "Broken database: invalid nonce for root key history id={}",
+                        "Broken database: invalid nonce for root key history id={:#?}",
                        root_key_id
                    );
                    Error::BrokenDatabase
@@ -163,43 +157,47 @@ impl Vault {
            State::Sealed { .. } => Err(Error::Sealed),
        }
    }
+}

+#[messages]
+impl Vault {
    #[message]
-    pub async fn bootstrap(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
-        if !matches!(self.state, State::Unbootstrapped) {
+    pub async fn bootstrap(&mut self, mut seal_key: KeyCell) -> Result<(), Error> {
+        if !matches!(&self.state, State::Unbootstrapped) {
            return Err(Error::AlreadyBootstrapped);
        }
-        let salt = v1::generate_salt();
-        let mut seal_key = derive_key(seal_key_raw, &salt);
+
        let mut root_key = KeyCell::new_secure_random();

        // Zero nonces are fine because they are one-time
        let root_key_nonce = Nonce::default();
        let data_encryption_nonce = Nonce::default();

-        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|reader| {
-            let root_key_reader = reader.as_slice();
+        // Generate salt (kept for schema compat)
+        let root_key_salt = v1::generate_salt();
+
+        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|rk| {
            seal_key
-                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader)
+                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, rk.as_slice())
                .map_err(|err| {
                    error!(?err, "Fatal bootstrap error");
                    Error::Encryption(err)
                })
        })?;

+        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
        let mut conn = self.db.get().await?;

-        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
        let root_key_history_id = conn
            .transaction(async |conn| {
-                let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
+                let root_key_history_id = insert_into(schema::root_key_history::table)
                    .values(&models::NewRootKeyHistory {
                        ciphertext: root_key_ciphertext.clone(),
                        tag: v1::ROOT_KEY_TAG.to_vec(),
                        root_key_encryption_nonce: root_key_nonce.to_vec(),
                        data_encryption_nonce: data_encryption_nonce_bytes.clone(),
                        schema_version: 1,
-                        salt: salt.to_vec(),
+                        salt: root_key_salt.to_vec(),
                    })
                    .returning(schema::root_key_history::id)
                    .get_result(&mut *conn)
@@ -210,7 +208,9 @@ impl Vault {
                    .execute(&mut *conn)
                    .await?;

-                Result::<_, diesel::result::Error>::Ok(root_key_history_id)
+                Result::<_, diesel::result::Error>::Ok(RootKeyHistoryId::from_raw(
+                    root_key_history_id,
+                ))
            })
            .await?;

@@ -226,70 +226,47 @@ impl Vault {
    }

    #[message]
-    pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
-        if self.unseal_failures >= MAX_UNSEAL_ATTEMPTS {
-            return Err(Error::LockedOut);
-        }
-
+    pub async fn try_unseal(&mut self, mut seal_key: KeyCell) -> Result<(), Error> {
        let State::Sealed {
            root_key_history_id,
        } = &self.state
        else {
            return Err(Error::NotBootstrapped);
        };
+        let root_key_history_id = *root_key_history_id;

-        // We don't want to hold connection while doing expensive KDF work
+        // We don't want to hold connection while doing expensive work
        let current_key = {
            let mut conn = self.db.get().await?;
            schema::root_key_history::table
-                .filter(schema::root_key_history::id.eq(*root_key_history_id))
+                .filter(schema::root_key_history::id.eq(root_key_history_id))
                .select(RootKeyHistory::as_select())
                .first(&mut conn)
                .await?
        };

-        let salt = &current_key.salt;
-        let salt = v1::Salt::try_from(salt.as_slice()).map_err(|_| {
-            error!("Broken database: invalid salt for root key");
-            Error::BrokenDatabase
-        })?;
-        let mut seal_key = derive_key(seal_key_raw, &salt);
-
-        let mut root_key = SafeCell::new(current_key.ciphertext.clone());
-
        let nonce =
            Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(|()| {
                error!("Broken database: invalid nonce for root key");
                Error::BrokenDatabase
            })?;

-        if seal_key
-            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
-            .is_err()
-        {
-            self.unseal_failures += 1;
-            if self.unseal_failures >= MAX_UNSEAL_ATTEMPTS {
-                error!(
-                    attempts = self.unseal_failures,
-                    "Vault locked: maximum failed unseal attempts reached"
-                );
-            } else {
-                warn!(
-                    attempts = self.unseal_failures,
-                    remaining = MAX_UNSEAL_ATTEMPTS - self.unseal_failures,
-                    "Failed unseal attempt"
-                );
-            }
-            return Err(Error::InvalidKey);
-        }
+        let mut root_key_bytes = SafeCell::new(current_key.ciphertext.clone());
+        seal_key
+            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key_bytes)
+            .map_err(|err| {
+                error!(?err, "Failed to unseal root key: invalid seal key");
+                Error::InvalidKey
+            })?;
+
+        let root_key = KeyCell::try_from(root_key_bytes).map_err(|()| {
+            error!("Broken database: invalid encryption key size");
+            Error::BrokenDatabase
+        })?;

-        self.unseal_failures = 0;
        self.state = State::Unsealed(Unsealed {
            root_key_history_id: current_key.id,
-            root_key: KeyCell::try_from(root_key).map_err(|err| {
-                error!(?err, "Broken database: invalid encryption key size");
-                Error::BrokenDatabase
-            })?,
+            root_key,
        });

        info!("Vault unsealed successfully");
@@ -298,10 +275,26 @@ impl Vault {
        Ok(())
    }

-    /// Decrypts an AEAD entry. The `aad` must match the value used at encryption time;
-    /// a mismatch causes authentication failure, preventing cross-wallet key swaps.
    #[message]
-    pub async fn decrypt(&mut self, aead_id: i32, aad: Vec<u8>) -> Result<SafeCell<Vec<u8>>, Error> {
+    pub async fn seal(&mut self) -> Result<(), Error> {
+        let Unsealed {
+            root_key_history_id,
+            ..
+        } = Self::expect_unsealed(&mut self.state)?;
+
+        self.state = State::Sealed {
+            root_key_history_id: *root_key_history_id,
+        };
+        let _ = self.events.tell(Publish(events::VaultResealed)).await;
+        Ok(())
+    }
+}
+
+// Server-side cryptographic operations
+#[messages]
+impl Vault {
+    #[message]
+    pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
        let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?;

        let row: models::AeadEncrypted = {
@@ -323,15 +316,13 @@ impl Vault {
            Error::BrokenDatabase
        })?;
        let mut output = SafeCell::new(row.ciphertext);
-        root_key.decrypt_in_place(&nonce, &aad, &mut output)?;
+        root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?;
        Ok(output)
    }

-    /// Creates a new `aead_encrypted` entry and returns its ID.
-    /// The `aad` is bound into the ciphertext and must be reproduced exactly at decryption time.
    // Creates new `aead_encrypted` entry in the database and returns it's ID
    #[message]
-    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>, aad: Vec<u8>) -> Result<i32, Error> {
+    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>) -> Result<i32, Error> {
        let Unsealed {
            root_key,
            root_key_history_id,
@@ -343,7 +334,7 @@ impl Vault {

        let mut ciphertext_buffer = plaintext.write();
        let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut();
-        root_key.encrypt_in_place(&nonce, &aad, &mut *ciphertext_buffer)?;
+        root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?;

        let ciphertext = std::mem::take(ciphertext_buffer);

@@ -370,7 +361,10 @@ impl Vault {
    }

    #[message]
-    pub fn sign_integrity(&mut self, mac_input: Vec<u8>) -> Result<(i32, Vec<u8>), Error> {
+    pub fn sign_integrity(
+        &mut self,
+        mac_input: Vec<u8>,
+    ) -> Result<(RootKeyHistoryId, Vec<u8>), Error> {
        let Unsealed {
            root_key,
            root_key_history_id,
@@ -380,7 +374,7 @@ impl Vault {
            HmacSha256::new_from_slice(k)
                .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
        });
-        hmac.update(&root_key_history_id.to_be_bytes());
+        hmac.update(&root_key_history_id.to_raw().to_be_bytes());
        hmac.update(&mac_input);

        let mac = hmac.finalize().into_bytes().to_vec();
@@ -392,7 +386,7 @@ impl Vault {
        &mut self,
        mac_input: Vec<u8>,
        expected_mac: Vec<u8>,
-        key_version: i32,
+        key_version: RootKeyHistoryId,
    ) -> Result<bool, Error> {
        let Unsealed {
            root_key,
@@ -400,35 +394,18 @@ impl Vault {
        } = Self::expect_unsealed(&mut self.state)?;

        if *root_key_history_id != key_version {
-            return Err(Error::KeyVersionMismatch {
-                envelope: key_version,
-                current: *root_key_history_id,
-            });
+            return Ok(false);
        }

        let mut hmac = root_key.0.read_inline(|k| {
            HmacSha256::new_from_slice(k)
                .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
        });
-        hmac.update(&key_version.to_be_bytes());
+        hmac.update(&key_version.to_raw().to_be_bytes());
        hmac.update(&mac_input);

        Ok(hmac.verify_slice(&expected_mac).is_ok())
    }
-
-    #[message]
-    pub async fn seal(&mut self) -> Result<(), Error> {
-        let Unsealed {
-            root_key_history_id,
-            ..
-        } = Self::expect_unsealed(&mut self.state)?;
-
-        self.state = State::Sealed {
-            root_key_history_id: *root_key_history_id,
-        };
-        let _ = self.events.tell(Publish(events::VaultResealed)).await;
-        Ok(())
-    }
 }

 #[cfg(test)]
@@ -442,8 +419,7 @@ mod tests {
        let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
            .await
            .unwrap();
-        let seal_key = SafeCell::new(b"test-seal-key".to_vec());
-        actor.bootstrap(seal_key).await.unwrap();
+        actor.bootstrap(KeyCell::from([0u8; 32])).await.unwrap();
        actor
    }

@@ -452,13 +428,12 @@ mod tests {
    async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
        let db = db::create_test_pool().await;
        let mut actor = bootstrapped_actor(&db).await;
-
        let State::Unsealed(Unsealed {
            root_key_history_id,
            ..
        }) = actor.state
        else {
-            panic!("expected unsealed state")
+            panic!("expected unsealed state");
        };

        let n1 = Vault::get_new_nonce(&db, root_key_history_id)
@@ -478,7 +453,7 @@ mod tests {
        assert_eq!(root_row.data_encryption_nonce, n2.to_vec());

        let id = actor
-            .create_new(SafeCell::new(b"post-interleave".to_vec()), b"test-aad".to_vec())
+            .create_new(SafeCell::new(b"post-interleave".to_vec()))
            .await
            .unwrap();
        let row: models::AeadEncrypted = schema::aead_encrypted::table
--- a/server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs
@@ -0,0 +1,303 @@
+use std::collections::HashMap;
+
+use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+use diesel::{ExpressionMethods as _, QueryDsl};
+use diesel_async::RunQueryDsl;
+use kameo::{Actor, actor::ActorRef, messages};
+use rand_core::{OsRng, RngCore as _};
+use tracing::error;
+
+use crate::{
+    actors::vault::{Bootstrap, TryUnseal, Vault},
+    crypto::{KeyCell, derive_key, encryption::v1::Nonce, shamir, shamir::shamir_threshold},
+    db::{self, models, schema},
+};
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("Already coordinating a bootstrap")]
+    AlreadyBootstrapping,
+    #[error("Already coordinating an unseal")]
+    AlreadyUnsealing,
+    #[error("Bootstrap not in progress")]
+    NotBootstrapping,
+    #[error("Unseal not in progress")]
+    NotUnsealing,
+    #[error("Operator already contributed")]
+    DuplicateContribution,
+    #[error("Operator not found in database")]
+    OperatorNotFound,
+    #[error("Invalid passphrase (decryption failed)")]
+    InvalidPassphrase,
+    #[error("Shamir error: {0}")]
+    Shamir(String),
+    #[error("Database connection error: {0}")]
+    DatabaseConnection(#[from] db::PoolError),
+    #[error("Database query error: {0}")]
+    DatabaseQuery(#[from] diesel::result::Error),
+    #[error("Encryption error")]
+    Encryption,
+    #[error("Vault error")]
+    VaultError,
+    #[error("Broken database")]
+    BrokenDatabase,
+}
+
+// Passphrases stored as plain Vec<u8> (not SafeCell) so CoordinatorState is Sync.
+// They are ephemeral and dropped immediately after use.
+enum CoordinatorState {
+    Idle,
+    Bootstrapping {
+        declared_count: usize,
+        passphrases: HashMap<i32, Vec<u8>>,
+    },
+    Unsealing {
+        threshold: usize,
+        passphrases: HashMap<i32, Vec<u8>>,
+    },
+}
+
+#[derive(Actor)]
+pub struct VaultCoordinator {
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    state: CoordinatorState,
+}
+
+impl VaultCoordinator {
+    pub const fn new(db: db::DatabasePool, vault: ActorRef<Vault>) -> Self {
+        Self {
+            db,
+            vault,
+            state: CoordinatorState::Idle,
+        }
+    }
+}
+
+const SHARE_AAD: &[u8] = b"arbiter/shamir-share/v1";
+
+async fn finalize_bootstrap(
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    passphrases: HashMap<i32, Vec<u8>>,
+) -> Result<(), Error> {
+    let total = passphrases.len();
+    let threshold = shamir_threshold(total);
+
+    // Generate random 32-byte seal key
+    let mut seal_key_bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut seal_key_bytes);
+
+    // Split seal key into shares using Shamir (OsRng from rand_core 0.6, compatible with vsss-rs)
+    let shares = shamir::split_key(threshold, total, &seal_key_bytes, OsRng)
+        .map_err(|e| Error::Shamir(e.to_string()))?;
+
+    let seal_key = KeyCell::from(seal_key_bytes);
+
+    let mut conn = db.get().await?;
+
+    for ((operator_id_raw, passphrase_bytes), share) in passphrases.into_iter().zip(shares) {
+        // Generate a fresh share_salt for this operator
+        let mut share_salt = vec![0u8; 32];
+        OsRng.fill_bytes(&mut share_salt);
+
+        // Derive share encryption key from passphrase + salt
+        let mut passphrase_cell = SafeCell::new(passphrase_bytes);
+        let mut share_seal_key = derive_key(&mut passphrase_cell, &share_salt);
+
+        // Encrypt this operator's share
+        let nonce = Nonce::default();
+        let encrypted_share = share_seal_key
+            .encrypt(&nonce, SHARE_AAD, &share)
+            .map_err(|_| Error::Encryption)?;
+
+        let nonce_bytes = nonce.to_vec();
+
+        diesel::replace_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(Some(operator_id_raw)),
+                schema::operator::share.eq(&encrypted_share),
+                schema::operator::share_nonce.eq(&nonce_bytes),
+                schema::operator::share_salt.eq(&share_salt),
+                schema::operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
+    }
+
+    vault
+        .ask(Bootstrap { seal_key })
+        .await
+        .map_err(|err| {
+            error!(?err, "Vault bootstrap failed");
+            Error::VaultError
+        })?;
+
+    Ok(())
+}
+
+async fn finalize_unseal(
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    passphrases: HashMap<i32, Vec<u8>>,
+) -> Result<(), Error> {
+    let mut conn = db.get().await?;
+    let mut shares: Vec<Vec<u8>> = Vec::new();
+
+    for (operator_id_raw, passphrase_bytes) in passphrases {
+        let (encrypted_share, share_nonce_bytes, share_salt): (Vec<u8>, Vec<u8>, Vec<u8>) =
+            schema::operator::table
+                .filter(schema::operator::id.eq(Some(operator_id_raw)))
+                .select((
+                    schema::operator::share,
+                    schema::operator::share_nonce,
+                    schema::operator::share_salt,
+                ))
+                .first(&mut conn)
+                .await
+                .map_err(|_| Error::OperatorNotFound)?;
+
+        let nonce = Nonce::try_from(share_nonce_bytes.as_slice()).map_err(|()| {
+            error!(operator_id = operator_id_raw, "Invalid nonce in DB");
+            Error::BrokenDatabase
+        })?;
+
+        let mut passphrase_cell = SafeCell::new(passphrase_bytes);
+        let mut share_seal_key = derive_key(&mut passphrase_cell, &share_salt);
+
+        let mut share_buffer = SafeCell::new(encrypted_share);
+        share_seal_key
+            .decrypt_in_place(&nonce, SHARE_AAD, &mut share_buffer)
+            .map_err(|_| Error::InvalidPassphrase)?;
+
+        let decrypted_share = share_buffer.read().clone();
+        shares.push(decrypted_share);
+    }
+
+    let seal_key_bytes =
+        shamir::combine_shares(&shares).map_err(|e| Error::Shamir(e.to_string()))?;
+
+    let seal_key = KeyCell::from(seal_key_bytes);
+
+    vault
+        .ask(TryUnseal { seal_key })
+        .await
+        .map_err(|err| {
+            error!(?err, "Vault unseal failed");
+            Error::VaultError
+        })?;
+
+    Ok(())
+}
+
+#[messages]
+impl VaultCoordinator {
+    /// Phase 1 of multi-operator bootstrap: declare the committee size.
+    #[message]
+    #[expect(clippy::unused_async, reason = "kameo requires messages to be async")]
+    pub async fn start_bootstrap(
+        &mut self,
+        operator_id: i32,
+        declared_count: usize,
+    ) -> Result<(), Error> {
+        let _ = operator_id; // fixme!: any authenticated operator may announce the committee size. the first call wins
+        if !matches!(self.state, CoordinatorState::Idle) {
+            return Err(Error::AlreadyBootstrapping);
+        }
+        self.state = CoordinatorState::Bootstrapping {
+            declared_count,
+            passphrases: HashMap::new(),
+        };
+        Ok(())
+    }
+
+    /// Phase 2 of multi-operator bootstrap: contribute a passphrase.
+    /// Returns Ok(true) when all operators contributed and bootstrap finalized.
+    #[message]
+    pub async fn contribute_bootstrap(
+        &mut self,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        let CoordinatorState::Bootstrapping {
+            declared_count,
+            passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotBootstrapping);
+        };
+
+        if passphrases.contains_key(&operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        // Extract bytes immediately so state stays Sync
+        let passphrase_bytes = passphrase.read().to_vec();
+        passphrases.insert(operator_id, passphrase_bytes);
+
+        if passphrases.len() < *declared_count {
+            return Ok(false);
+        }
+
+        let CoordinatorState::Bootstrapping { passphrases, .. } =
+            std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_bootstrap(self.db.clone(), self.vault.clone(), passphrases).await?;
+        Ok(true)
+    }
+
+    /// Contribute a passphrase for vault unseal.
+    /// Returns Ok(true) when threshold reached and vault is unsealed.
+    #[message]
+    pub async fn contribute_unseal(
+        &mut self,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        if matches!(self.state, CoordinatorState::Idle) {
+            let mut conn = self.db.get().await?;
+            let count: i64 = schema::operator::table
+                .count()
+                .get_result(&mut conn)
+                .await?;
+            let threshold = shamir_threshold(usize::try_from(count).unwrap_or_default());
+
+            self.state = CoordinatorState::Unsealing {
+                threshold,
+                passphrases: HashMap::new(),
+            };
+        }
+
+        let CoordinatorState::Unsealing {
+            threshold,
+            passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotUnsealing);
+        };
+
+        if passphrases.contains_key(&operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        let passphrase_bytes = passphrase.read().to_vec();
+        passphrases.insert(operator_id, passphrase_bytes);
+
+        if passphrases.len() < *threshold {
+            return Ok(false);
+        }
+
+        let CoordinatorState::Unsealing { passphrases, .. } =
+            std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_unseal(self.db.clone(), self.vault.clone(), passphrases).await?;
+        Ok(true)
+    }
+}
--- a/server/crates/arbiter-server/src/crypto/encryption/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/encryption/v1.rs
@@ -61,12 +61,12 @@ mod tests {
    #[test]
    fn derive_seal_key_deterministic() {
        static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
-        let password2 = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
+        let mut password2 = SafeCell::new(PASSWORD.to_vec());
        let salt = generate_salt();

-        let mut key1 = derive_key(password, &salt);
-        let mut key2 = derive_key(password2, &salt);
+        let mut key1 = derive_key(&mut password, &salt);
+        let mut key2 = derive_key(&mut password2, &salt);

        let key1_reader = key1.0.read();
        let key2_reader = key2.0.read();
@@ -77,10 +77,10 @@ mod tests {
    #[test]
    fn successful_derive() {
        static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
        let salt = generate_salt();

-        let mut key = derive_key(password, &salt);
+        let mut key = derive_key(&mut password, &salt);
        let key_reader = key.0.read();

        assert_ne!(key_reader.as_slice(), &[0u8; 32][..]);
--- a/server/crates/arbiter-server/src/crypto/integrity/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/integrity/v1.rs
@@ -192,9 +192,7 @@ pub async fn verify_entity<E: Integrable>(
        Ok(false) => Err(Error::MacMismatch {
            entity_kind: E::KIND,
        }),
-        Err(SendError::HandlerError(
-            vault::Error::Sealed | vault::Error::KeyVersionMismatch { .. },
-        )) => Ok(AttestationStatus::Unavailable),
+        Err(SendError::HandlerError(vault::Error::Sealed)) => Ok(AttestationStatus::Unavailable),
        Err(_) => Err(Error::VaultSend),
    }
 }
@@ -217,8 +215,6 @@ mod tests {
        },
        db::{self, schema},
    };
-    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-
    use super::{Error, Integrable, sign_entity, verify_entity};
    #[derive(Clone, arbiter_macros::Hashable)]
    struct DummyEntity {
@@ -237,7 +233,7 @@ mod tests {
        );
        actor
            .ask(Bootstrap {
-                seal_key_raw: SafeCell::new(b"integrity-test-seal-key".to_vec()),
+                seal_key: crate::crypto::KeyCell::from([0u8; 32]),
            })
            .await
            .unwrap();
@@ -333,47 +329,4 @@ mod tests {
            .unwrap_err();
        assert!(matches!(err, Error::MacMismatch { .. }));
    }
-
-    #[tokio::test]
-    async fn key_version_mismatch_returns_unavailable_not_mac_mismatch() {
-        use crate::db::schema::integrity_envelope;
-        use super::AttestationStatus;
-
-        const ENTITY_ID: &[u8] = b"entity-id-rotation-test";
-
-        let db = db::create_test_pool().await;
-        let vault = bootstrapped_vault(&db).await;
-        let mut conn = db.get().await.unwrap();
-
-        let entity = DummyEntity {
-            payload_version: 1,
-            payload: b"payload-v1".to_vec(),
-        };
-
-        sign_entity(&mut conn, &vault, &entity, ENTITY_ID)
-            .await
-            .unwrap();
-
-        // Simulate key rotation: update the stored key_version to a stale value.
-        // After real rotation the vault's root_key_history_id would advance, but
-        // here we achieve the same mismatch by back-dating the envelope's key_version.
-        diesel::update(integrity_envelope::table)
-            .filter(integrity_envelope::entity_kind.eq("dummy_entity"))
-            .filter(integrity_envelope::entity_id.eq(ENTITY_ID))
-            .set(integrity_envelope::key_version.eq(0))
-            .execute(&mut conn)
-            .await
-            .unwrap();
-
-        // Must NOT error — version mismatch is Unavailable, not tampered.
-        let status = verify_entity(&mut conn, &vault, &entity, ENTITY_ID)
-            .await
-            .expect("key version mismatch must not be treated as an error");
-
-        assert_eq!(
-            status,
-            AttestationStatus::Unavailable,
-            "stale key_version must yield Unavailable, not MacMismatch"
-        );
-    }
 }
--- a/server/crates/arbiter-server/src/crypto/mod.rs
+++ b/server/crates/arbiter-server/src/crypto/mod.rs
@@ -1,5 +1,5 @@
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-use encryption::v1::{Nonce, Salt};
+use encryption::v1::Nonce;

 use argon2::{Algorithm, Argon2};
 use chacha20poly1305::{
@@ -13,6 +13,7 @@ use rand::{

 pub mod encryption;
 pub mod integrity;
+pub mod shamir;

 pub struct KeyCell(pub SafeCell<Key>);
 impl From<SafeCell<Key>> for KeyCell {
@@ -20,6 +21,15 @@ impl From<SafeCell<Key>> for KeyCell {
        Self(value)
    }
 }
+impl From<[u8; 32]> for KeyCell {
+    fn from(bytes: [u8; 32]) -> Self {
+        let cell = SafeCell::new_inline_default(|key: &mut Key| {
+            key.copy_from_slice(&bytes);
+        });
+        Self(cell)
+    }
+}
+
 impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
    type Error = ();

@@ -28,7 +38,7 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
        if value.len() != size_of::<Key>() {
            return Err(());
        }
-        let cell = SafeCell::new_inline(|cell_write: &mut Key| {
+        let cell = SafeCell::new_inline_default(|cell_write: &mut Key| {
            cell_write.copy_from_slice(&value);
        });
        Ok(Self(cell))
@@ -37,7 +47,7 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {

 impl KeyCell {
    pub fn new_secure_random() -> Self {
-        let key = SafeCell::new_inline(|key_buffer: &mut Key| {
+        let key = SafeCell::new_inline_default(|key_buffer: &mut Key| {
            let mut rng = StdRng::try_from_rng(&mut SysRng)
                .expect("Rng failure is unrecoverable and should panic");
            rng.fill_bytes(key_buffer);
@@ -94,7 +104,7 @@ impl KeyCell {
 }

 /// Derive a fixed-length key from the password using Argon2id, which is designed for password hashing and key derivation.
-pub fn derive_key(mut password: SafeCell<Vec<u8>>, salt: &Salt) -> KeyCell {
+pub fn derive_key(password: &mut SafeCell<Vec<u8>>, salt: &[u8]) -> KeyCell {
    let params = {
        #[cfg(debug_assertions)]
        {
@@ -132,10 +142,10 @@ mod tests {
    #[test]
    fn encrypt_decrypt() {
        static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
        let salt = generate_salt();

-        let mut key = derive_key(password, &salt);
+        let mut key = derive_key(&mut password, &salt);
        let nonce = Nonce(*b"unique nonce 123 1231233"); // 24 bytes for XChaCha20Poly1305
        let associated_data = b"associated data";
        let mut buffer = b"secret data".to_vec();
--- a/server/crates/arbiter-server/src/crypto/shamir.rs
+++ b/server/crates/arbiter-server/src/crypto/shamir.rs
@@ -0,0 +1,41 @@
+use vsss_rs::Gf256;
+
+#[derive(Debug, thiserror::Error)]
+pub enum ShamirError {
+    #[error("Failed to split key: {0}")]
+    Split(String),
+    #[error("Failed to combine shares: {0}")]
+    Combine(String),
+}
+
+/// Split `key` into `total` shares where any `threshold` shares can reconstruct it.
+/// Each returned Vec<u8> is a share with format [`identifier_byte`, `value_bytes`...].
+pub fn split_key(
+    threshold: usize,
+    total: usize,
+    key: &[u8; 32],
+    rng: impl rand_core::RngCore + rand_core::CryptoRng,
+) -> Result<Vec<Vec<u8>>, ShamirError> {
+    Gf256::split_array(threshold, total, key.as_slice(), rng)
+        .map_err(|e| ShamirError::Split(format!("{e:?}")))
+}
+
+/// Returns the minimum number of shares required to reconstruct the secret
+/// for a committee of `n` operators.
+#[must_use]
+pub const fn shamir_threshold(n: usize) -> usize {
+    match n {
+        0 => panic!("No operators"),
+        1 => 1,
+        2 => 2,
+        n => n / 2 + 1,
+    }
+}
+
+/// Reconstruct the secret from `threshold` or more shares.
+pub fn combine_shares(shares: &[Vec<u8>]) -> Result<[u8; 32], ShamirError> {
+    let bytes = Gf256::combine_array(shares)
+        .map_err(|e| ShamirError::Combine(format!("{e:?}")))?;
+    <[u8; 32]>::try_from(bytes.as_slice())
+        .map_err(|_| ShamirError::Combine("unexpected reconstructed key length".to_owned()))
+}
--- a/server/crates/arbiter-server/src/db/models.rs
+++ b/server/crates/arbiter-server/src/db/models.rs
@@ -15,10 +15,11 @@ use restructed::Models;
 pub mod types {
    use chrono::{DateTime, Utc};
    use diesel::{
+        backend::Backend,
        deserialize::{FromSql, FromSqlRow},
        expression::AsExpression,
        serialize::{IsNull, ToSql},
-        sql_types::Integer,
+        sql_types::{Integer, Text},
        sqlite::{Sqlite, SqliteType},
    };

@@ -61,7 +62,7 @@ pub mod types {

    impl FromSql<Integer, Sqlite> for SqliteTimestamp {
        fn from_sql(
-            mut bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
+            mut bytes: <Sqlite as Backend>::RawValue<'_>,
        ) -> diesel::deserialize::Result<Self> {
            let Some(SqliteType::Long) = bytes.value_type() else {
                return Err(format!(
@@ -79,10 +80,41 @@ pub mod types {
        }
    }

-    #[derive(Debug, FromSqlRow, AsExpression, Clone)]
-    #[diesel(sql_type = Integer)]
-    #[repr(transparent)] // hint compiler to optimize the wrapper struct away
-    pub struct ChainId(pub i32);
+    macro_rules! declare_id {
+        ($name:ident) => {
+            #[derive(Debug, FromSqlRow, AsExpression, Clone, Hash, Copy, PartialEq, Eq)]
+            #[diesel(sql_type = Integer)]
+            #[repr(transparent)] // hint compiler to optimize the wrapper struct away
+            pub struct $name(i32);
+
+            impl $name {
+                pub const fn to_raw(self) -> i32 {
+                    self.0
+                }
+                pub const fn from_raw(raw: i32) -> Self {
+                    Self(raw)
+                }
+            }
+
+            impl FromSql<Integer, Sqlite> for $name {
+                fn from_sql(
+                    bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
+                ) -> diesel::deserialize::Result<Self> {
+                    FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
+                }
+            }
+            impl ToSql<Integer, Sqlite> for $name {
+                fn to_sql<'b>(
+                    &'b self,
+                    out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
+                ) -> diesel::serialize::Result {
+                    ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
+                }
+            }
+        };
+    }
+
+    declare_id!(ChainId);

    #[expect(
        clippy::cast_sign_loss,
@@ -103,19 +135,50 @@ pub mod types {
        }
    };

-    impl FromSql<Integer, Sqlite> for ChainId {
-        fn from_sql(
-            bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
-        ) -> diesel::deserialize::Result<Self> {
-            FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
-        }
+    declare_id!(OperatorId);
+    declare_id!(OperatorIdentityId);
+    declare_id!(AeadEncryptedId);
+    declare_id!(RootKeyHistoryId);
+    declare_id!(TlsHistoryId);
+    declare_id!(EvmWalletId);
+    declare_id!(ClientId);
+
+    #[derive(Debug, Clone, PartialEq, Eq, AsExpression, FromSqlRow)]
+    #[diesel(sql_type = Text)]
+    pub enum ProposalStatus {
+        Pending,
+        Approved,
+        Rejected,
+        Expired,
    }
-    impl ToSql<Integer, Sqlite> for ChainId {
+
+    impl ToSql<Text, Sqlite> for ProposalStatus {
        fn to_sql<'b>(
            &'b self,
            out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
        ) -> diesel::serialize::Result {
-            ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
+            let s: &str = match self {
+                Self::Pending => "pending",
+                Self::Approved => "approved",
+                Self::Rejected => "rejected",
+                Self::Expired => "expired",
+            };
+            <str as ToSql<Text, Sqlite>>::to_sql(s, out)
+        }
+    }
+
+    impl FromSql<Text, Sqlite> for ProposalStatus {
+        fn from_sql(
+            bytes: <Sqlite as Backend>::RawValue<'_>,
+        ) -> diesel::deserialize::Result<Self> {
+            let s = <String as FromSql<Text, Sqlite>>::from_sql(bytes)?;
+            match s.as_str() {
+                "pending" => Ok(Self::Pending),
+                "approved" => Ok(Self::Approved),
+                "rejected" => Ok(Self::Rejected),
+                "expired" => Ok(Self::Expired),
+                other => Err(format!("Unknown proposal status: {other}").into()),
+            }
        }
    }
 }
@@ -130,12 +193,12 @@ pub use types::*;
 )]
 #[diesel(table_name = aead_encrypted, check_for_backend(Sqlite))]
 pub struct AeadEncrypted {
-    pub id: i32,
+    pub id: AeadEncryptedId,
    pub ciphertext: Vec<u8>,
    pub tag: Vec<u8>,
    pub current_nonce: Vec<u8>,
    pub schema_version: i32,
-    pub associated_root_key_id: i32, // references root_key_history.id
+    pub associated_root_key_id: RootKeyHistoryId,
    pub created_at: SqliteTimestamp,
 }

@@ -148,7 +211,7 @@ pub struct AeadEncrypted {
    attributes_with = "deriveless"
 )]
 pub struct RootKeyHistory {
-    pub id: i32,
+    pub id: RootKeyHistoryId,
    pub ciphertext: Vec<u8>,
    pub tag: Vec<u8>,
    pub root_key_encryption_nonce: Vec<u8>,
@@ -166,7 +229,7 @@ pub struct RootKeyHistory {
    attributes_with = "deriveless"
 )]
 pub struct TlsHistory {
-    pub id: i32,
+    pub id: TlsHistoryId,
    pub cert: String,
    pub cert_key: String, // PEM Encoded private key
    pub ca_cert: String,  // PEM Encoded certificate for cert signing
@@ -191,7 +254,7 @@ pub struct ArbiterSettings {
    attributes_with = "deriveless"
 )]
 pub struct EvmWallet {
-    pub id: i32,
+    pub id: EvmWalletId,
    pub address: Vec<u8>,
    pub aead_encrypted_id: i32,
    pub created_at: SqliteTimestamp,
@@ -213,7 +276,7 @@ pub struct EvmWallet {
 )]
 pub struct EvmWalletAccess {
    pub id: i32,
-    pub wallet_id: i32,
+    pub wallet_id: EvmWalletId,
    pub client_id: i32,
    pub created_at: SqliteTimestamp,
 }
@@ -240,7 +303,7 @@ pub struct ProgramClientMetadataHistory {
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = schema::program_client, check_for_backend(Sqlite))]
 pub struct ProgramClient {
-    pub id: i32,
+    pub id: ClientId,
    pub public_key: Vec<u8>,
    pub metadata_id: i32,
    pub created_at: SqliteTimestamp,
@@ -250,12 +313,23 @@ pub struct ProgramClient {
 #[derive(Queryable, Debug)]
 #[diesel(table_name = schema::operator_client, check_for_backend(Sqlite))]
 pub struct OperatorClient {
-    pub id: i32,
+    pub id: OperatorIdentityId,
    pub public_key: Vec<u8>,
    pub created_at: SqliteTimestamp,
    pub updated_at: SqliteTimestamp,
 }

+#[derive(Queryable, Debug)]
+#[diesel(table_name = schema::operator, check_for_backend(Sqlite))]
+pub struct Operator {
+    pub id: OperatorId,
+    pub share: Vec<u8>,
+    pub share_nonce: Vec<u8>,
+    pub share_salt: Vec<u8>,
+    pub created_at: SqliteTimestamp,
+    pub updated_at: SqliteTimestamp,
+}
+
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = evm_ether_transfer_limit, check_for_backend(Sqlite))]
 #[view(
@@ -399,8 +473,50 @@ pub struct IntegrityEnvelope {
    pub entity_kind: String,
    pub entity_id: Vec<u8>,
    pub payload_version: i32,
-    pub key_version: i32,
+    pub key_version: RootKeyHistoryId,
    pub mac: Vec<u8>,
    pub signed_at: SqliteTimestamp,
    pub created_at: SqliteTimestamp,
 }
+
+#[derive(Debug, Queryable, Selectable, Identifiable)]
+#[diesel(table_name = schema::proposal, check_for_backend(Sqlite))]
+pub struct Proposal {
+    pub id: i32,
+    pub kind: String,
+    pub payload: Vec<u8>,
+    pub initiator_id: i32,
+    pub created_at: SqliteTimestamp,
+    pub expires_at: SqliteTimestamp,
+    pub status: ProposalStatus,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::proposal, check_for_backend(Sqlite))]
+pub struct NewProposal {
+    pub kind: String,
+    pub payload: Vec<u8>,
+    pub initiator_id: i32,
+    // status defaults to 'pending' at the DB layer
+    pub expires_at: SqliteTimestamp,
+}
+
+#[derive(Debug, Queryable, Selectable, Identifiable)]
+#[diesel(table_name = schema::proposal_vote, check_for_backend(Sqlite))]
+pub struct ProposalVote {
+    pub id: i32,
+    pub proposal_id: i32,
+    pub operator_id: i32,
+    pub approve: bool,
+    pub signature: Vec<u8>,
+    pub voted_at: SqliteTimestamp,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::proposal_vote, check_for_backend(Sqlite))]
+pub struct NewProposalVote {
+    pub proposal_id: i32,
+    pub operator_id: i32,
+    pub approve: bool,
+    pub signature: Vec<u8>,
+}
--- a/server/crates/arbiter-server/src/db/schema.rs
+++ b/server/crates/arbiter-server/src/db/schema.rs
@@ -152,6 +152,49 @@ diesel::table! {
    }
 }

+diesel::table! {
+    operator (id) {
+        id -> Nullable<Integer>,
+        share -> Binary,
+        share_nonce -> Binary,
+        share_salt -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
+diesel::table! {
+    operator_identity (id) {
+        id -> Integer,
+        public_key -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
+diesel::table! {
+    proposal (id) {
+        id -> Integer,
+        kind -> Text,
+        payload -> Binary,
+        initiator_id -> Integer,
+        created_at -> Integer,
+        expires_at -> Integer,
+        status -> Text,
+    }
+}
+
+diesel::table! {
+    proposal_vote (id) {
+        id -> Integer,
+        proposal_id -> Integer,
+        operator_id -> Integer,
+        approve -> Bool,
+        signature -> Binary,
+        voted_at -> Integer,
+    }
+}
+
 diesel::table! {
    program_client (id) {
        id -> Integer,
@@ -185,15 +228,6 @@ diesel::table! {
    }
 }

-diesel::table! {
-    operator_client (id) {
-        id -> Integer,
-        public_key -> Binary,
-        created_at -> Integer,
-        updated_at -> Integer,
-    }
-}
-
 diesel::joinable!(aead_encrypted -> root_key_history (associated_root_key_id));
 diesel::joinable!(arbiter_settings -> root_key_history (root_key_id));
 diesel::joinable!(arbiter_settings -> tls_history (tls_id));
@@ -212,7 +246,11 @@ diesel::joinable!(evm_transaction_log -> evm_wallet_access (wallet_access_id));
 diesel::joinable!(evm_wallet -> aead_encrypted (aead_encrypted_id));
 diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
 diesel::joinable!(evm_wallet_access -> program_client (client_id));
+diesel::joinable!(operator -> operator_identity (id));
 diesel::joinable!(program_client -> client_metadata (metadata_id));
+diesel::joinable!(proposal -> operator_identity (initiator_id));
+diesel::joinable!(proposal_vote -> proposal (proposal_id));
+diesel::joinable!(proposal_vote -> operator_identity (operator_id));

 diesel::allow_tables_to_appear_in_same_query!(
    aead_encrypted,
@@ -230,8 +268,11 @@ diesel::allow_tables_to_appear_in_same_query!(
    evm_wallet,
    evm_wallet_access,
    integrity_envelope,
+    operator,
+    operator_identity,
    program_client,
+    proposal,
+    proposal_vote,
    root_key_history,
    tls_history,
-    operator_client,
 );
--- a/server/crates/arbiter-server/src/evm/mod.rs
+++ b/server/crates/arbiter-server/src/evm/mod.rs
@@ -1,34 +1,28 @@
-use diesel_async::{AsyncConnection, RunQueryDsl};
-use kameo::actor::ActorRef;
-
 use crate::{
    actors::vault::Vault,
    crypto::integrity,
    db::{
        self, DatabaseError,
        models::{
-            EvmBasicGrant, EvmEtherTransferGrant, EvmEtherTransferGrantTarget,
-            EvmEtherTransferLimit, EvmTokenTransferGrant, EvmTokenTransferVolumeLimit,
-            EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
        },
        schema::{self, evm_transaction_log},
    },
    evm::policies::{
        CombinedSettings, DatabaseID, EvalContext, EvalViolation, Grant, Policy,
-        SharedGrantSettings, SpecificGrant, SpecificMeaning, VolumeRateLimit,
-        ether_transfer::EtherTransfer, token_transfers::TokenTransfer,
+        SharedGrantSettings, SpecificGrant, SpecificMeaning, ether_transfer::EtherTransfer,
+        token_transfers::TokenTransfer,
    },
 };

 use alloy::{
    consensus::TxEip1559,
-    primitives::{Address, TxKind, U256},
+    primitives::{TxKind, U256},
 };
 use chrono::Utc;
-use diesel::{
-    ExpressionMethods as _, OptionalExtension, QueryDsl as _, QueryResult, SelectableHelper,
-    insert_into, sqlite::Sqlite, update,
-};
+use diesel::{ExpressionMethods as _, QueryDsl as _, QueryResult, insert_into, sqlite::Sqlite};
+use diesel_async::{AsyncConnection, RunQueryDsl};
+use kameo::actor::ActorRef;

 pub mod abi;
 pub mod safe_signer;
@@ -278,151 +272,6 @@ impl Engine {
        Ok(id)
    }

-    pub async fn revoke_grant(
-        &self,
-        basic_grant_id: i32,
-    ) -> Result<(), DatabaseError> {
-        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let vault = self.vault.clone();
-
-        conn.transaction(async move |conn| {
-            use crate::db::schema::{
-                evm_basic_grant, evm_ether_transfer_grant, evm_ether_transfer_grant_target,
-                evm_ether_transfer_limit, evm_token_transfer_grant,
-                evm_token_transfer_volume_limit,
-            };
-
-            update(evm_basic_grant::table)
-                .filter(evm_basic_grant::id.eq(basic_grant_id))
-                .set(evm_basic_grant::revoked_at.eq(SqliteTimestamp(Utc::now())))
-                .execute(&mut *conn)
-                .await?;
-
-            let basic_grant: EvmBasicGrant = evm_basic_grant::table
-                .filter(evm_basic_grant::id.eq(basic_grant_id))
-                .select(EvmBasicGrant::as_select())
-                .first(&mut *conn)
-                .await?;
-
-            let shared = SharedGrantSettings::try_from_model(basic_grant)?;
-
-            if let Some(ether_grant) = evm_ether_transfer_grant::table
-                .filter(evm_ether_transfer_grant::basic_grant_id.eq(basic_grant_id))
-                .select(EvmEtherTransferGrant::as_select())
-                .first(&mut *conn)
-                .await
-                .optional()?
-            {
-                let target_rows: Vec<EvmEtherTransferGrantTarget> =
-                    evm_ether_transfer_grant_target::table
-                        .filter(evm_ether_transfer_grant_target::grant_id.eq(ether_grant.id))
-                        .select(EvmEtherTransferGrantTarget::as_select())
-                        .load(&mut *conn)
-                        .await?;
-                let targets: Vec<Address> = target_rows
-                    .into_iter()
-                    .filter_map(|target| {
-                        let arr: [u8; 20] = target.address.try_into().ok()?;
-                        Some(Address::from(arr))
-                    })
-                    .collect();
-
-                let limit: EvmEtherTransferLimit = evm_ether_transfer_limit::table
-                    .filter(evm_ether_transfer_limit::id.eq(ether_grant.limit_id))
-                    .select(EvmEtherTransferLimit::as_select())
-                    .first(&mut *conn)
-                    .await?;
-
-                let settings = CombinedSettings {
-                    shared: shared.clone(),
-                    specific: policies::ether_transfer::Settings {
-                        target: targets,
-                        limit: VolumeRateLimit {
-                            max_volume: utils::try_bytes_to_u256(&limit.max_volume).map_err(
-                                |err| {
-                                    diesel::result::Error::DeserializationError(Box::new(err))
-                                },
-                            )?,
-                            window: chrono::Duration::seconds(limit.window_secs.into()),
-                        },
-                    },
-                };
-
-                integrity::sign_entity(&mut *conn, &vault, &settings, basic_grant_id)
-                    .await
-                    .map_err(|_| diesel::result::Error::RollbackTransaction)?;
-
-                return QueryResult::Ok(());
-            }
-
-            if let Some(token_grant) = evm_token_transfer_grant::table
-                .filter(evm_token_transfer_grant::basic_grant_id.eq(basic_grant_id))
-                .select(EvmTokenTransferGrant::as_select())
-                .first(&mut *conn)
-                .await
-                .optional()?
-            {
-                let volume_limit_rows: Vec<EvmTokenTransferVolumeLimit> =
-                    evm_token_transfer_volume_limit::table
-                        .filter(evm_token_transfer_volume_limit::grant_id.eq(token_grant.id))
-                        .select(EvmTokenTransferVolumeLimit::as_select())
-                        .load(&mut *conn)
-                        .await?;
-                let volume_limits: Vec<VolumeRateLimit> = volume_limit_rows
-                    .into_iter()
-                    .map(|row| {
-                        Ok(VolumeRateLimit {
-                            max_volume: utils::try_bytes_to_u256(&row.max_volume).map_err(
-                                |err| {
-                                    diesel::result::Error::DeserializationError(Box::new(err))
-                                },
-                            )?,
-                            window: chrono::Duration::seconds(row.window_secs.into()),
-                        })
-                    })
-                    .collect::<QueryResult<Vec<_>>>()?;
-
-                let target: Option<Address> = match token_grant.receiver {
-                    None => None,
-                    Some(bytes) => {
-                        let arr: [u8; 20] = bytes.try_into().map_err(|_| {
-                            diesel::result::Error::DeserializationError(
-                                "Invalid receiver address length".into(),
-                            )
-                        })?;
-                        Some(Address::from(arr))
-                    }
-                };
-
-                let token_contract: [u8; 20] =
-                    token_grant.token_contract.clone().try_into().map_err(|_| {
-                        diesel::result::Error::DeserializationError(
-                            "Invalid token contract address length".into(),
-                        )
-                    })?;
-
-                let settings = CombinedSettings {
-                    shared,
-                    specific: policies::token_transfers::Settings {
-                        token_contract: Address::from(token_contract),
-                        target,
-                        volume_limits,
-                    },
-                };
-
-                integrity::sign_entity(&mut *conn, &vault, &settings, basic_grant_id)
-                    .await
-                    .map_err(|_| diesel::result::Error::RollbackTransaction)?;
-
-                return QueryResult::Ok(());
-            }
-
-            Err(diesel::result::Error::NotFound)
-        })
-        .await
-        .map_err(DatabaseError::from)
-    }
-
    async fn list_one_kind<Kind: Policy, Y>(
        &self,
        conn: &mut impl AsyncConnection<Backend = Sqlite>,
@@ -502,26 +351,21 @@ impl Engine {
 #[cfg(test)]
 mod tests {
    use alloy::primitives::{Address, Bytes, U256, address};
-    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
    use chrono::{Duration, Utc};
    use diesel::{SelectableHelper, insert_into};
    use diesel_async::RunQueryDsl;
-    use kameo::{actor::ActorRef, prelude::Spawn};
    use rstest::rstest;

-    use crate::actors::{GlobalActors, vault::{Bootstrap, Vault}};
-    use crate::crypto::integrity;
    use crate::db::{
        self, DatabaseConnection,
        models::{
-            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
+            SqliteTimestamp,
        },
        schema::{evm_basic_grant, evm_transaction_log},
    };
-    use crate::evm::policies::ether_transfer::EtherTransfer;
    use crate::evm::policies::{
-        CombinedSettings, EvalContext, EvalViolation, Policy, SharedGrantSettings,
-        TransactionRateLimit, VolumeRateLimit,
+        EvalContext, EvalViolation, SharedGrantSettings, TransactionRateLimit,
    };

    use super::check_shared_constraints;
@@ -534,7 +378,7 @@ mod tests {
        EvalContext {
            target: EvmWalletAccess {
                id: WALLET_ACCESS_ID,
-                wallet_id: 10,
+                wallet_id: EvmWalletId::from_raw(5),
                client_id: 20,
                created_at: SqliteTimestamp(Utc::now()),
            },
@@ -553,7 +397,6 @@ mod tests {
            chain: CHAIN_ID,
            valid_from: None,
            valid_until: None,
-            revoked_at: None,
            max_gas_fee_per_gas: None,
            max_priority_fee_per_gas: None,
            rate_limit: None,
@@ -762,115 +605,4 @@ mod tests {
            assert!(violations.is_empty());
        }
    }
-
-    async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> {
-        let actor = Vault::spawn(
-            Vault::new(db.clone(), GlobalActors::spawn_message_bus())
-                .await
-                .unwrap(),
-        );
-        actor
-            .ask(Bootstrap {
-                seal_key_raw: SafeCell::new(b"integrity-test-seal-key".to_vec()),
-            })
-            .await
-            .unwrap();
-        actor
-    }
-
-    #[tokio::test]
-    async fn revoke_grant_preserves_revoked_integrity() {
-        use crate::db::schema::evm_basic_grant;
-        use diesel::ExpressionMethods as _;
-
-        let db = db::create_test_pool().await;
-        let vault = bootstrapped_vault(&db).await;
-        let engine = super::Engine::new(db.clone(), vault.clone());
-
-        let full_grant = CombinedSettings {
-            shared: SharedGrantSettings {
-                wallet_access_id: WALLET_ACCESS_ID,
-                chain: CHAIN_ID,
-                valid_from: None,
-                valid_until: None,
-                revoked_at: None,
-                max_gas_fee_per_gas: None,
-                max_priority_fee_per_gas: None,
-                rate_limit: None,
-            },
-            specific: super::policies::ether_transfer::Settings {
-                target: vec![RECIPIENT],
-                limit: VolumeRateLimit {
-                    max_volume: U256::from(100u64),
-                    window: Duration::hours(1),
-                },
-            },
-        };
-
-        let grant_id = engine
-            .create_grant::<EtherTransfer>(full_grant)
-            .await
-            .unwrap();
-
-        engine.revoke_grant(grant_id).await.unwrap();
-
-        let mut conn = db.get().await.unwrap();
-        diesel::update(evm_basic_grant::table)
-            .filter(evm_basic_grant::id.eq(grant_id))
-            .set(evm_basic_grant::revoked_at.eq::<Option<SqliteTimestamp>>(None))
-            .execute(&mut conn)
-            .await
-            .unwrap();
-
-        let wallet_access = EvmWalletAccess {
-            id: WALLET_ACCESS_ID,
-            wallet_id: 10,
-            client_id: 20,
-            created_at: SqliteTimestamp(Utc::now()),
-        };
-        let context = EvalContext {
-            target: wallet_access,
-            chain: CHAIN_ID,
-            to: RECIPIENT,
-            value: U256::ONE,
-            calldata: Bytes::new(),
-            max_fee_per_gas: 1,
-            max_priority_fee_per_gas: 1,
-        };
-
-        let grant = EtherTransfer::try_find_grant(
-            &context, &mut conn,
-        )
-        .await
-        .unwrap()
-        .unwrap();
-
-        let result =
-            integrity::verify_entity(&mut conn, &vault, &grant.settings, grant.id).await;
-
-        assert!(matches!(
-            result,
-            Err(integrity::Error::MacMismatch { .. })
-        ));
-    }
-
-    #[test]
-    fn shared_settings_hash_changes_when_revoked_at_changes() {
-        use arbiter_crypto::hashing::Hashable;
-        use sha2::Digest;
-
-        let active = shared_settings();
-        let revoked = SharedGrantSettings {
-            revoked_at: Some(Utc::now()),
-            ..shared_settings()
-        };
-
-        let mut active_hash = sha2::Sha256::new();
-        active.hash(&mut active_hash);
-
-        let mut revoked_hash = sha2::Sha256::new();
-        revoked.hash(&mut revoked_hash);
-
-        assert_ne!(active_hash.finalize(), revoked_hash.finalize());
-    }
 }
--- a/server/crates/arbiter-server/src/evm/policies.rs
+++ b/server/crates/arbiter-server/src/evm/policies.rs
@@ -144,7 +144,6 @@ pub struct SharedGrantSettings {

    pub valid_from: Option<DateTime<Utc>>,
    pub valid_until: Option<DateTime<Utc>>,
-    pub revoked_at: Option<DateTime<Utc>>,

    pub max_gas_fee_per_gas: Option<U256>,
    pub max_priority_fee_per_gas: Option<U256>,
@@ -159,7 +158,6 @@ impl SharedGrantSettings {
            chain: model.chain_id.into(),
            valid_from: model.valid_from.map(Into::into),
            valid_until: model.valid_until.map(Into::into),
-            revoked_at: model.revoked_at.map(Into::into),
            max_gas_fee_per_gas: model
                .max_gas_fee_per_gas
                .map(|b| utils::try_bytes_to_u256(&b))
--- a/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
@@ -3,7 +3,8 @@ use crate::{
    db::{
        self, DatabaseConnection,
        models::{
-            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
+            SqliteTimestamp,
        },
        schema::{evm_basic_grant, evm_transaction_log},
    },
@@ -31,7 +32,7 @@ fn ctx(to: Address, value: U256) -> EvalContext {
    EvalContext {
        target: EvmWalletAccess {
            id: WALLET_ACCESS_ID,
-            wallet_id: 10,
+            wallet_id: EvmWalletId::from_raw(10),
            client_id: 20,
            created_at: SqliteTimestamp(Utc::now()),
        },
@@ -79,7 +80,6 @@ fn shared() -> SharedGrantSettings {
        chain: CHAIN_ID,
        valid_from: None,
        valid_until: None,
-        revoked_at: None,
        max_gas_fee_per_gas: None,
        max_priority_fee_per_gas: None,
        rate_limit: None,
--- a/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
@@ -2,7 +2,7 @@ use super::{Settings, TokenTransfer};
 use crate::{
    db::{
        self, DatabaseConnection,
-        models::{EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, SqliteTimestamp},
+        models::{EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, SqliteTimestamp},
        schema::evm_basic_grant,
    },
    evm::{
@@ -45,7 +45,7 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
    EvalContext {
        target: EvmWalletAccess {
            id: WALLET_ACCESS_ID,
-            wallet_id: 10,
+            wallet_id: EvmWalletId::from_raw(10),
            client_id: 20,
            created_at: SqliteTimestamp(Utc::now()),
        },
@@ -98,7 +98,6 @@ fn shared() -> SharedGrantSettings {
        chain: CHAIN_ID,
        valid_from: None,
        valid_until: None,
-        revoked_at: None,
        max_gas_fee_per_gas: None,
        max_priority_fee_per_gas: None,
        rate_limit: None,
--- a/server/crates/arbiter-server/src/evm/safe_signer.rs
+++ b/server/crates/arbiter-server/src/evm/safe_signer.rs
@@ -44,7 +44,7 @@ impl std::fmt::Debug for SafeSigner {
 /// Returns the protected key bytes and the derived Ethereum address.
 pub fn generate(rng: &mut impl rand::Rng) -> (SafeCell<[u8; 32]>, Address) {
    loop {
-        let mut cell = SafeCell::new_inline(|w: &mut [u8; 32]| {
+        let mut cell = SafeCell::new_inline_default(|w: &mut [u8; 32]| {
            rng.fill_bytes(w);
        });

--- a/server/crates/arbiter-server/src/grpc/client/auth.rs
+++ b/server/crates/arbiter-server/src/grpc/client/auth.rs
@@ -200,7 +200,7 @@ impl Convert for auth::Outbound {
                        .timestamp
                        .timestamp_nanos_opt()
                        .expect("timestamp within range")
-                        .cast_unsigned(),
+                        as u64,
                    random: challenge.nonce.to_vec(),
                })
            }
--- a/server/crates/arbiter-server/src/grpc/operator.rs
+++ b/server/crates/arbiter-server/src/grpc/operator.rs
@@ -19,6 +19,7 @@ use tracing::{error, info, warn};

 mod auth;
 mod evm;
+mod governance;
 mod inbound;
 mod outbound;
 mod sdk_client;
@@ -115,6 +116,7 @@ async fn dispatch_inner(
            warn!("Unsupported post-auth operator auth request");
            Err(Status::invalid_argument("Unsupported operator request"))
        }
+        OperatorRequestPayload::Governance(req) => governance::dispatch(actor, req).await,
    }
 }

--- a/server/crates/arbiter-server/src/grpc/operator/auth.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/auth.rs
@@ -80,7 +80,7 @@ impl Sender<Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {
                        .timestamp
                        .timestamp_nanos_opt()
                        .expect("timestamp within range")
-                        .cast_unsigned(),
+                        as u64,
                    random: challenge.nonce.to_vec(),
                })
            }
@@ -171,7 +171,7 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {

                Some(auth::Inbound::AuthChallengeRequest {
                    pubkey,
-                    bootstrap_token: bootstrap_token.map(String::into_bytes),
+                    bootstrap_token,
                })
            }
            AuthRequestPayload::ChallengeSolution(ProtoAuthChallengeSolution { signature }) => {
--- a/server/crates/arbiter-server/src/grpc/operator/evm.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/evm.rs
@@ -90,7 +90,7 @@ async fn handle_wallet_list(
                .into_iter()
                .map(|(id, address)| WalletEntry {
                    address: address.to_vec(),
-                    id,
+                    id: id.to_raw(),
                })
                .collect(),
        }),
@@ -217,11 +217,6 @@ async fn handle_sign_transaction(
                result: Some(vet_error.convert()),
            }
        }
-        Err(kameo::error::SendError::HandlerError(
-            SessionSignTransactionError::ClientNotConnected,
-        )) => {
-            return Err(Status::permission_denied("client not connected"));
-        }
        Err(kameo::error::SendError::HandlerError(SessionSignTransactionError::Internal)) => {
            EvmSignTransactionResponse {
                result: Some(EvmSignTransactionResult::Error(
--- a/server/crates/arbiter-server/src/grpc/operator/governance.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/governance.rs
@@ -0,0 +1,126 @@
+use crate::{
+    actors::proposal_manager::{Error as ProposalError, ProposalKind, VoteOutcome},
+    peers::operator::{
+        OperatorSession,
+        session::handlers::{HandleCastVote, HandleCreateProposal, HandleQueryPending},
+    },
+};
+use arbiter_proto::proto::operator::{
+    governance::{
+        self as proto_gov, CreateProposalRequest, QueryPendingRequest, QueryPendingResponse,
+        VoteOutcome as ProtoVoteOutcome, create_proposal_request::Kind as ProtoKind,
+        request::Payload as GovRequestPayload, response::Payload as GovResponsePayload,
+    },
+    operator_response::Payload as OperatorResponsePayload,
+};
+use kameo::actor::ActorRef;
+use tonic::Status;
+use tracing::warn;
+
+const fn wrap(payload: GovResponsePayload) -> OperatorResponsePayload {
+    OperatorResponsePayload::Governance(proto_gov::Response {
+        payload: Some(payload),
+    })
+}
+
+pub(super) async fn dispatch(
+    actor: &ActorRef<OperatorSession>,
+    req: proto_gov::Request,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let Some(payload) = req.payload else {
+        return Err(Status::invalid_argument(
+            "Missing governance request payload",
+        ));
+    };
+
+    match payload {
+        GovRequestPayload::Create(req) => handle_create(actor, req).await,
+        GovRequestPayload::Vote(req) => handle_vote(actor, req).await,
+        GovRequestPayload::Query(QueryPendingRequest {}) => handle_query(actor).await,
+    }
+}
+
+async fn handle_create(
+    actor: &ActorRef<OperatorSession>,
+    req: CreateProposalRequest,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let kind = match req.kind {
+        Some(ProtoKind::ApproveSdkClient(p)) => ProposalKind::ApproveSdkClient {
+            client_id: p.client_id,
+        },
+        None => return Err(Status::invalid_argument("Missing proposal kind")),
+    };
+    let ttl_secs = req.ttl_secs.map(i64::from);
+
+    let proposal_id = actor
+        .ask(HandleCreateProposal { kind, ttl_secs })
+        .await
+        .map_err(|e| {
+            warn!(?e, "create_proposal failed");
+            Status::internal("Failed to create proposal")
+        })?;
+
+    Ok(Some(wrap(GovResponsePayload::Created(
+        proto_gov::CreateProposalResponse { proposal_id },
+    ))))
+}
+
+async fn handle_vote(
+    actor: &ActorRef<OperatorSession>,
+    req: proto_gov::CastVoteRequest,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let result = actor
+        .ask(HandleCastVote {
+            proposal_id: req.proposal_id,
+            approve: req.approve,
+            signature: req.signature,
+        })
+        .await;
+
+    let outcome = match result {
+        Ok(VoteOutcome::Pending) => ProtoVoteOutcome::Pending,
+        Ok(VoteOutcome::QuorumApproved) => ProtoVoteOutcome::Approved,
+        Ok(VoteOutcome::QuorumRejected) => ProtoVoteOutcome::Rejected,
+        Err(kameo::error::SendError::HandlerError(ProposalError::AlreadyVoted)) => {
+            return Err(Status::invalid_argument("Already voted on this proposal"));
+        }
+        Err(kameo::error::SendError::HandlerError(ProposalError::InvalidSignature)) => {
+            return Err(Status::invalid_argument("Invalid vote signature"));
+        }
+        Err(kameo::error::SendError::HandlerError(ProposalError::ProposalNotFound)) => {
+            return Err(Status::not_found("Proposal not found"));
+        }
+        Err(e) => {
+            warn!(?e, "cast_vote failed");
+            return Err(Status::internal("Failed to cast vote"));
+        }
+    };
+
+    Ok(Some(wrap(GovResponsePayload::Voted(
+        proto_gov::VoteResponse {
+            outcome: outcome.into(),
+        },
+    ))))
+}
+
+async fn handle_query(
+    actor: &ActorRef<OperatorSession>,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let summaries = actor.ask(HandleQueryPending {}).await.unwrap_or_default();
+
+    let proposals = summaries
+        .into_iter()
+        .map(|s| proto_gov::ProposalSummary {
+            id: s.id,
+            kind: s.kind,
+            initiator_id: s.initiator_id,
+            expires_at: s.expires_at.0.timestamp(),
+            approve_count: s.approve_count,
+            reject_count: s.reject_count,
+        })
+        .collect();
+
+    Ok(Some(wrap(GovResponsePayload::Pending(
+        QueryPendingResponse { proposals },
+    ))))
+}
--- a/server/crates/arbiter-server/src/grpc/operator/inbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/inbound.rs
@@ -1,11 +1,10 @@
 use crate::{
-    db::models::{CoreEvmWalletAccess, NewEvmWalletAccess},
+    db::models::{CoreEvmWalletAccess, EvmWalletId, NewEvmWalletAccess},
    evm::policies::{
        SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit, ether_transfer,
        token_transfers,
    },
-    grpc::Convert,
-    grpc::TryConvert,
+    grpc::{Convert, TryConvert},
 };
 use arbiter_proto::{
    proto::evm::{
@@ -87,7 +86,6 @@ impl TryConvert for ProtoSharedSettings {
                .valid_until
                .map(ProtoTimestamp::try_convert)
                .transpose()?,
-            revoked_at: None,
            max_gas_fee_per_gas: self
                .max_gas_fee_per_gas
                .as_deref()
@@ -151,7 +149,7 @@ impl Convert for WalletAccess {

    fn convert(self) -> Self::Output {
        NewEvmWalletAccess {
-            wallet_id: self.wallet_id,
+            wallet_id: EvmWalletId::from_raw(self.wallet_id),
            client_id: self.sdk_client_id,
        }
    }
@@ -166,7 +164,7 @@ impl TryConvert for SdkClientWalletAccess {
            return Err(Status::invalid_argument("Missing wallet access entry"));
        };
        Ok(CoreEvmWalletAccess {
-            wallet_id: access.wallet_id,
+            wallet_id: EvmWalletId::from_raw(access.wallet_id),
            client_id: access.sdk_client_id,
            id: self.id,
        })
--- a/server/crates/arbiter-server/src/grpc/operator/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/outbound.rs
@@ -103,7 +103,7 @@ impl Convert for EvmWalletAccess {
        Self::Output {
            id: self.id,
            access: Some(WalletAccess {
-                wallet_id: self.wallet_id,
+                wallet_id: self.wallet_id.to_raw(),
                sdk_client_id: self.client_id,
            }),
        }
--- a/server/crates/arbiter-server/src/grpc/operator/sdk_client.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/sdk_client.rs
@@ -2,7 +2,7 @@ use crate::{
    db::models::NewEvmWalletAccess,
    grpc::Convert,
    peers::operator::{
-        OutOfBand, OperatorSession,
+        OperatorSession, OutOfBand,
        session::handlers::{
            HandleGrantEvmWalletAccess, HandleListWalletAccess, HandleNewClientApprove,
            HandleRevokeEvmWalletAccess, HandleSdkClientList,
@@ -11,8 +11,8 @@ use crate::{
 };
 use arbiter_crypto::authn;
 use arbiter_proto::proto::{
-    shared::ClientInfo as ProtoClientMetadata,
    operator::{
+        operator_response::Payload as OperatorResponsePayload,
        sdk_client::{
            self as proto_sdk_client, ConnectionCancel as ProtoSdkClientConnectionCancel,
            ConnectionRequest as ProtoSdkClientConnectionRequest,
@@ -24,8 +24,8 @@ use arbiter_proto::proto::{
            request::Payload as SdkClientRequestPayload,
            response::Payload as SdkClientResponsePayload,
        },
-        operator_response::Payload as OperatorResponsePayload,
    },
+    shared::ClientInfo as ProtoClientMetadata,
 };

 use kameo::actor::ActorRef;
@@ -115,7 +115,7 @@ async fn handle_list(
            clients: clients
                .into_iter()
                .map(|(client, metadata)| ProtoSdkClientEntry {
-                    id: client.id,
+                    id: client.id.to_raw(),
                    pubkey: client.public_key.clone(),
                    info: Some(ProtoClientMetadata {
                        name: metadata.name,
--- a/server/crates/arbiter-server/src/grpc/operator/vault.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault.rs
@@ -3,7 +3,6 @@ use crate::{
    peers::operator::{OperatorSession, session::handlers::HandleQueryVaultState},
 };
 use arbiter_proto::{
-    proto::shared::VaultState as ProtoVaultState,
    proto::operator::{
        operator_response::Payload as OperatorResponsePayload,
        vault::{
@@ -11,6 +10,7 @@ use arbiter_proto::{
            response::Payload as VaultResponsePayload,
        },
    },
+    proto::shared::VaultState as ProtoVaultState,
 };

 use kameo::actor::ActorRef;
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs
@@ -1,14 +1,16 @@
 use crate::{
    grpc::{Convert, TryConvert},
    peers::operator::vault_gate::{
-        self as vault_gate, HandleBootstrapEncryptedKey, HandleHandshake, HandleUnsealEncryptedKey,
+        self as vault_gate, HandleBootstrapEncryptedKey, HandleContributeBootstrapPassphrase,
+        HandleContributeUnsealPassphrase, HandleDeclareCommittee, HandleHandshake,
+        HandleUnsealEncryptedKey,
    },
 };
 use arbiter_proto::proto::operator::{
    operator_request::Payload as OperatorRequestPayload,
    vault::{
        self as proto_vault,
-        bootstrap::{self as proto_bootstrap},
+        bootstrap::{self as proto_bootstrap, request::Payload as BootstrapRequestPayload},
        request::Payload as VaultRequestPayload,
        unseal::{self as proto_unseal, request::Payload as UnsealRequestPayload},
    },
@@ -73,6 +75,13 @@ impl TryConvert for UnsealRequestPayload {
        match self {
            Self::Start(start) => start.try_convert(),
            Self::EncryptedKey(key) => Ok(key.convert()),
+            Self::ContributePassphrase(cp) => Ok(
+                vault_gate::Inbound::HandleContributeUnsealPassphrase(
+                    HandleContributeUnsealPassphrase {
+                        passphrase: cp.passphrase,
+                    },
+                ),
+            ),
        }
    }
 }
@@ -107,12 +116,35 @@ impl TryConvert for proto_bootstrap::Request {
    type Error = Status;

    fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
-        self.encrypted_key
-            .ok_or_else(|| Status::invalid_argument("Missing bootstrap encrypted key"))?
+        self.payload
+            .ok_or_else(|| Status::invalid_argument("Missing bootstrap payload"))?
            .try_convert()
    }
 }

+impl TryConvert for BootstrapRequestPayload {
+    type Output = vault_gate::Inbound;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
+        match self {
+            Self::EncryptedKey(key) => key.try_convert(),
+            Self::DeclareCommittee(dc) => Ok(
+                vault_gate::Inbound::HandleDeclareCommittee(HandleDeclareCommittee {
+                    count: dc.count as usize,
+                }),
+            ),
+            Self::ContributePassphrase(cp) => Ok(
+                vault_gate::Inbound::HandleContributeBootstrapPassphrase(
+                    HandleContributeBootstrapPassphrase {
+                        passphrase: cp.passphrase,
+                    },
+                ),
+            ),
+        }
+    }
+}
+
 impl TryConvert for proto_bootstrap::BootstrapEncryptedKey {
    type Output = vault_gate::Inbound;
    type Error = Status;
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
@@ -4,7 +4,6 @@ use crate::{
    peers::operator::vault_gate::{self as vault_gate},
 };
 use arbiter_proto::proto::{
-    shared::VaultState as ProtoVaultState,
    operator::{
        operator_response::Payload as OperatorResponsePayload,
        vault::{
@@ -17,6 +16,7 @@ use arbiter_proto::proto::{
            },
        },
    },
+    shared::VaultState as ProtoVaultState,
 };

 use tonic::Status;
@@ -87,7 +87,6 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(()) => ProtoUnsealResult::Success,
                    Err(vault_gate::Error::InvalidKey) => ProtoUnsealResult::InvalidKey,
-                    Err(vault_gate::Error::LockedOut) => ProtoUnsealResult::LockedOut,
                    Err(err) => {
                        warn!(?err, "unseal failed");
                        return Err(Status::internal("Failed to unseal vault"));
@@ -111,6 +110,40 @@ impl TryConvert for vault_gate::Outbound {
                };
                Ok(wrap_bootstrap_response(proto_result))
            }
+            Self::HandleDeclareCommittee(result) => {
+                let proto_result = match result {
+                    Ok(()) => ProtoBootstrapResult::Success,
+                    Err(err) => {
+                        warn!(?err, "declare committee failed");
+                        return Err(Status::internal("Failed to declare committee"));
+                    }
+                };
+                Ok(wrap_bootstrap_response(proto_result))
+            }
+            Self::HandleContributeBootstrapPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoBootstrapResult::Success,
+                    Ok(false) => ProtoBootstrapResult::AwaitingContributions,
+                    Err(err) => {
+                        warn!(?err, "contribute bootstrap passphrase failed");
+                        return Err(Status::internal("Failed to contribute bootstrap passphrase"));
+                    }
+                };
+                Ok(wrap_bootstrap_response(proto_result))
+            }
+            Self::HandleContributeUnsealPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoUnsealResult::Success,
+                    Ok(false) => ProtoUnsealResult::AwaitingContributions,
+                    Err(err) => {
+                        warn!(?err, "contribute unseal passphrase failed");
+                        return Err(Status::internal("Failed to contribute unseal passphrase"));
+                    }
+                };
+                Ok(wrap_unseal_response(UnsealResponsePayload::Result(
+                    proto_result.into(),
+                )))
+            }
        }
    }
 }
--- a/server/crates/arbiter-server/src/peers/client/auth.rs
+++ b/server/crates/arbiter-server/src/peers/client/auth.rs
@@ -8,7 +8,7 @@ use crate::{
    crypto::integrity::{self, AttestationStatus},
    db::{
        self,
-        models::ProgramClientMetadata,
+        models::{ProgramClientMetadata, SqliteTimestamp},
        schema::program_client,
    },
 };
@@ -18,13 +18,14 @@ use arbiter_proto::{
    transport::{Bi, expect_message},
 };

+use chrono::Utc;
 use diesel::{
    ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, SelectableHelper as _,
-    dsl::insert_into,
+    dsl::insert_into, update,
 };
 use diesel_async::RunQueryDsl as _;
 use kameo::{actor::ActorRef, error::SendError};
-use tracing::{error, warn};
+use tracing::error;

 #[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
 pub enum Error {
@@ -210,47 +211,71 @@ async fn insert_client(
    .await
 }

-/// Compares stored metadata against what a reconnecting client presents.
-/// Metadata is frozen after initial operator approval and must not be silently
-/// overwritten. Doing so would let an approved client forge its displayed
-/// identity in later approval prompts. Drift is logged and ignored.
-async fn check_metadata_drift(
+async fn sync_client_metadata(
    db: &db::DatabasePool,
    client_id: i32,
-    presented: &ClientMetadata,
+    metadata: &ClientMetadata,
 ) -> Result<(), Error> {
-    use crate::db::schema::client_metadata;
+    use crate::db::schema::{client_metadata, client_metadata_history};
+
+    let now = SqliteTimestamp(Utc::now());

    let mut conn = db.get().await.map_err(|e| {
        error!(error = ?e, "Database pool error");
        Error::DatabasePoolUnavailable
    })?;

-    let current: ProgramClientMetadata = program_client::table
-        .find(client_id)
-        .inner_join(client_metadata::table)
-        .select(ProgramClientMetadata::as_select())
-        .first(&mut conn)
-        .await
-        .map_err(|e| {
-            error!(error = ?e, "Database error");
-            Error::DatabaseOperationFailed
-        })?;
+    conn.exclusive_transaction(async |conn| {
+        let (current_metadata_id, current): (i32, ProgramClientMetadata) = program_client::table
+            .find(client_id)
+            .inner_join(client_metadata::table)
+            .select((
+                program_client::metadata_id,
+                ProgramClientMetadata::as_select(),
+            ))
+            .first(&mut *conn)
+            .await?;

-    let changed = current.name != presented.name
-        || current.description != presented.description
-        || current.version != presented.version;
+        let unchanged = current.name == metadata.name
+            && current.description == metadata.description
+            && current.version == metadata.version;
+        if unchanged {
+            return Ok(());
+        }

-    if changed {
-        warn!(
-            client_id,
-            stored_name = %current.name,
-            presented_name = %presented.name,
-            "reconnecting client presented different metadata; ignoring - metadata is frozen after operator approval"
-        );
-    }
+        insert_into(client_metadata_history::table)
+            .values((
+                client_metadata_history::metadata_id.eq(current_metadata_id),
+                client_metadata_history::client_id.eq(client_id),
+            ))
+            .execute(&mut *conn)
+            .await?;

-    Ok(())
+        let metadata_id = insert_into(client_metadata::table)
+            .values((
+                client_metadata::name.eq(&metadata.name),
+                client_metadata::description.eq(&metadata.description),
+                client_metadata::version.eq(&metadata.version),
+            ))
+            .returning(client_metadata::id)
+            .get_result::<i32>(&mut *conn)
+            .await?;
+
+        update(program_client::table.find(client_id))
+            .set((
+                program_client::metadata_id.eq(metadata_id),
+                program_client::updated_at.eq(now),
+            ))
+            .execute(&mut *conn)
+            .await?;
+
+        Ok::<(), diesel::result::Error>(())
+    })
+    .await
+    .map_err(|e| {
+        error!(error = ?e, "Database error");
+        Error::DatabaseOperationFailed
+    })
 }

 async fn challenge_client<T>(
@@ -299,7 +324,6 @@ where

    let client_id = if let Some(id) = get_client_id(&props.db, &pubkey).await? {
        verify_integrity(&props.db, &props.actors.vault, &pubkey).await?;
-        check_metadata_drift(&props.db, id, &metadata).await?;
        id
    } else {
        approve_new_client(
@@ -313,6 +337,8 @@ where
        insert_client(&props.db, &props.actors.vault, &pubkey, &metadata).await?
    };

+    sync_client_metadata(&props.db, client_id, &metadata).await?;
+
    let challenge = AuthChallenge::generate(&mut rand::rng());
    challenge_client(transport, pubkey, challenge).await?;

--- a/server/crates/arbiter-server/src/peers/client/session.rs
+++ b/server/crates/arbiter-server/src/peers/client/session.rs
@@ -83,7 +83,7 @@ impl Actor for ClientSession {
        args.props
            .actors
            .flow_coordinator
-            .ask(RegisterClient { client_id: args.client_id, actor: this })
+            .ask(RegisterClient { actor: this })
            .await
            .map_err(|_| Error::ConnectionRegistrationFailed)?;
        Ok(args)
--- a/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
@@ -14,7 +14,7 @@ mod state;
 pub enum Inbound {
    AuthChallengeRequest {
        pubkey: authn::PublicKey,
-        bootstrap_token: Option<Vec<u8>>,
+        bootstrap_token: Option<String>,
    },
    AuthChallengeSolution {
        signature: Vec<u8>,
--- a/server/crates/arbiter-server/src/peers/operator/auth/state.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/state.rs
@@ -4,7 +4,7 @@ use super::{
 };
 use crate::{
    actors::bootstrap::ConsumeToken,
-    db::{DatabasePool, schema::operator_client},
+    db::{DatabasePool, schema::operator_identity},
    peers::operator::auth::Outbound,
 };
 use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
@@ -14,18 +14,19 @@ use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl};
 use diesel_async::RunQueryDsl;
 use tracing::error;

-pub(super) struct ChallengeRequest {
-    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<Vec<u8>>,
+pub(crate) struct ChallengeRequest {
+    pub(crate) pubkey: authn::PublicKey,
+    pub(crate) bootstrap_token: Option<String>,
 }

 pub struct ChallengeContext {
-    pub(super) challenge: AuthChallenge,
-    pub(super) pubkey: authn::PublicKey,
+    pub challenge: AuthChallenge,
+    pub pubkey: authn::PublicKey,
+    pub bootstrap_token: Option<String>,
 }

-pub(super) struct ChallengeSolution {
-    pub(super) solution: Vec<u8>,
+pub(crate) struct ChallengeSolution {
+    pub(crate) solution: Vec<u8>,
 }

 smlang::statemachine!(
@@ -43,9 +44,9 @@ async fn get_client_id(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<O
        Error::internal("Database unavailable")
    })?;

-    operator_client::table
-        .filter(operator_client::public_key.eq(pubkey.to_bytes()))
-        .select(operator_client::id)
+    operator_identity::table
+        .filter(operator_identity::public_key.eq(pubkey.to_bytes()))
+        .select(operator_identity::id)
        .first::<i32>(&mut conn)
        .await
        .optional()
@@ -62,9 +63,9 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
        Error::internal("Database unavailable")
    })?;

-    let id: i32 = diesel::insert_into(operator_client::table)
-        .values((operator_client::public_key.eq(pubkey_bytes),))
-        .returning(operator_client::id)
+    let id: i32 = diesel::insert_into(operator_identity::table)
+        .values((operator_identity::public_key.eq(pubkey_bytes),))
+        .returning(operator_identity::id)
        .get_result(&mut conn)
        .await
        .map_err(|e| {
@@ -78,16 +79,11 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
 pub(super) struct AuthContext<'a, T: ?Sized> {
    pub(super) conn: &'a mut OperatorConnection,
    pub(super) transport: &'a mut T,
-    bootstrap_token: Option<Vec<u8>>,
 }

 impl<'a, T: ?Sized> AuthContext<'a, T> {
    pub(super) const fn new(conn: &'a mut OperatorConnection, transport: &'a mut T) -> Self {
-        Self {
-            conn,
-            transport,
-            bootstrap_token: None,
-        }
+        Self { conn, transport }
    }
 }

@@ -112,8 +108,6 @@ where
            }
        }

-        self.bootstrap_token = bootstrap_token;
-
        let challenge = AuthChallenge::generate(&mut rand::rng());

        self.transport
@@ -126,12 +120,20 @@ where
                Error::Transport
            })?;

-        Ok(ChallengeContext { challenge, pubkey })
+        Ok(ChallengeContext {
+            challenge,
+            pubkey,
+            bootstrap_token,
+        })
    }

    async fn verify_solution(
        &mut self,
-        ChallengeContext { challenge, pubkey }: &ChallengeContext,
+        ChallengeContext {
+            challenge,
+            pubkey,
+            bootstrap_token,
+        }: &ChallengeContext,
        ChallengeSolution { solution }: ChallengeSolution,
    ) -> Result<Credentials, Self::Error> {
        let signature = authn::Signature::try_from(solution.as_slice()).map_err(|()| {
@@ -150,13 +152,15 @@ where
        }

        // Resolve client id: bootstrap (consume token + register) or lookup
-        let id = match self.bootstrap_token.take() {
+        let id = match bootstrap_token {
            Some(token) => {
                let token_ok: bool = self
                    .conn
                    .actors
                    .bootstrapper
-                    .ask(ConsumeToken { token })
+                    .ask(ConsumeToken {
+                        token: token.clone(),
+                    })
                    .await
                    .map_err(|e| {
                        error!(?e, "Failed to consume bootstrap token");
--- a/server/crates/arbiter-server/src/peers/operator/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/mod.rs
@@ -180,6 +180,7 @@ where

    Ok(OperatorSession::spawn(OperatorSession::new(
        props.clone(),
+        creds.clone(),
        oob_sender,
    )))
 }
--- a/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
@@ -1,14 +1,15 @@
 use super::{Error, OperatorSession};
 use crate::{
-    actors::evm::{
-        ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
-        SignTransactionError as EvmSignError,
+    actors::{
+        evm::{
+            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorDeleteGrant,
+            OperatorListGrants, SignTransactionError as EvmSignError,
+        },
+        flow_coordinator::client_connect_approval::ClientApprovalAnswer,
+        vault::VaultState,
    },
-    actors::flow_coordinator::{IsClientConnected, client_connect_approval::ClientApprovalAnswer},
-    actors::vault::VaultState,
-    db::{
-        models::{EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata},
-        schema::program_client,
+    db::models::{
+        EvmWalletAccess, EvmWalletId, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata,
    },
    evm::policies::{Grant, SpecificGrant},
 };
@@ -18,16 +19,13 @@ use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
 use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
 use diesel_async::{AsyncConnection, RunQueryDsl};
 use kameo::{error::SendError, messages, prelude::Context};
-use tracing::{error, info, warn};
+use tracing::error;

 #[derive(Debug, Error)]
 pub enum SignTransactionError {
    #[error("Policy evaluation failed")]
    Vet(#[from] crate::evm::VetError),

-    #[error("Client not connected")]
-    ClientNotConnected,
-
    #[error("Internal signing error")]
    Internal,
 }
@@ -76,7 +74,9 @@ impl OperatorSession {
    }

    #[message]
-    pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<(i32, Address)>, Error> {
+    pub(crate) async fn handle_evm_wallet_list(
+        &mut self,
+    ) -> Result<Vec<(EvmWalletId, Address)>, Error> {
        match self.props.actors.evm.ask(ListWallets {}).await {
            Ok(wallets) => Ok(wallets),
            Err(err) => {
@@ -122,22 +122,23 @@ impl OperatorSession {
    }

    #[message]
-    pub(crate) fn handle_grant_delete(&mut self, grant_id: i32) -> Result<(), GrantMutationError> {
-        // match self
-        //     .props
-        //     .actors
-        //     .evm
-        //     .ask(OperatorDeleteGrant { grant_id })
-        //     .await
-        // {
-        //     Ok(()) => Ok(()),
-        //     Err(err) => {
-        //         error!(?err, "EVM grant delete failed");
-        //         Err(GrantMutationError::Internal)
-        //     }
-        // }
-        let _ = grant_id;
-        todo!()
+    pub(crate) async fn handle_grant_delete(
+        &mut self,
+        grant_id: i32,
+    ) -> Result<(), GrantMutationError> {
+        match self
+            .props
+            .actors
+            .evm
+            .ask(OperatorDeleteGrant { grant_id })
+            .await
+        {
+            Ok(()) => Ok(()),
+            Err(err) => {
+                error!(?err, "EVM grant delete failed");
+                Err(GrantMutationError::Internal)
+            }
+        }
    }

    #[message]
@@ -147,30 +148,6 @@ impl OperatorSession {
        wallet_address: Address,
        transaction: TxEip1559,
    ) -> Result<Signature, SignTransactionError> {
-        if !self.approved_client_ids.contains(&client_id) {
-            warn!(
-                client_id,
-                "operator attempted to sign for client not in its approved set"
-            );
-            return Err(SignTransactionError::ClientNotConnected);
-        }
-
-        let connected = self
-            .props
-            .actors
-            .flow_coordinator
-            .ask(IsClientConnected { client_id })
-            .await
-            .unwrap_or(false);
-
-        if !connected {
-            self.approved_client_ids.remove(&client_id);
-            warn!(client_id, "operator attempted to sign for disconnected client");
-            return Err(SignTransactionError::ClientNotConnected);
-        }
-
-        info!(client_id, event = "sign_transaction", "operator.sign_transaction");
-
        match self
            .props
            .actors
@@ -226,7 +203,7 @@ impl OperatorSession {
            use crate::db::schema::evm_wallet_access;
            for entry in entries {
                diesel::delete(evm_wallet_access::table)
-                    .filter(evm_wallet_access::id.eq(entry))
+                    .filter(evm_wallet_access::wallet_id.eq(entry))
                    .execute(&mut *conn)
                    .await?;
            }
@@ -241,8 +218,9 @@ impl OperatorSession {
    pub(crate) async fn handle_list_wallet_access(
        &mut self,
    ) -> Result<Vec<EvmWalletAccess>, Error> {
+        use crate::db::schema::evm_wallet_access;
        let mut conn = self.props.db.get().await?;
-        let access_entries = crate::db::schema::evm_wallet_access::table
+        let access_entries = evm_wallet_access::table
            .select(EvmWalletAccess::as_select())
            .load::<_>(&mut conn)
            .await?;
@@ -279,30 +257,6 @@ impl OperatorSession {

        ctx.actor_ref().unlink(&pending_approval.controller).await;

-        if approved {
-            let pubkey_bytes = pending_approval.pubkey.to_bytes();
-            match self.props.db.get().await {
-                Ok(mut conn) => {
-                    match program_client::table
-                        .filter(program_client::public_key.eq(pubkey_bytes.as_slice()))
-                        .select(program_client::id)
-                        .first::<i32>(&mut conn)
-                        .await
-                    {
-                        Ok(client_id) => {
-                            self.approved_client_ids.insert(client_id);
-                        }
-                        Err(err) => {
-                            error!(?err, "Failed to look up client_id for approved pubkey");
-                        }
-                    }
-                }
-                Err(err) => {
-                    error!(?err, "DB pool error after client approval");
-                }
-            }
-        }
-
        Ok(())
    }

@@ -326,141 +280,58 @@ impl OperatorSession {
    }
 }

-#[cfg(test)]
-mod tests {
-    use crate::db::{self, models::NewEvmWalletAccess, schema::evm_wallet_access};
-    use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
-    use diesel_async::{AsyncConnection, RunQueryDsl};
-
-    /// Regression test: revocation must delete by access-entry `id`, not by `wallet_id`.
-    ///
-    /// Before the fix, revoking `entry_id=1` would delete all rows where `wallet_id=1`,
-    /// wiping out every client's access to wallet #1.
-    #[tokio::test]
-    async fn revoke_deletes_by_entry_id_not_wallet_id() {
-        use crate::db::models::EvmWalletAccess;
-
-        let pool = db::create_test_pool().await;
-        let mut conn = pool.get().await.expect("pool connection");
-
-        // Insert two access entries for the same wallet but different clients.
-        // entry A: id will be 1, wallet_id=1, client_id=10
-        // entry B: id will be 2, wallet_id=1, client_id=20
-        let entry_a = diesel::insert_into(evm_wallet_access::table)
-            .values(NewEvmWalletAccess {
-                wallet_id: 1,
-                client_id: 10,
+#[messages]
+impl OperatorSession {
+    #[message]
+    pub(crate) async fn handle_create_proposal(
+        &mut self,
+        kind: crate::actors::proposal_manager::ProposalKind,
+        ttl_secs: Option<i64>,
+    ) -> Result<i32, Error> {
+        use crate::actors::proposal_manager::CreateProposal;
+        let initiator_id = self.credentials.id;
+        self.props
+            .actors
+            .proposal_manager
+            .ask(CreateProposal { kind, initiator_id, ttl_secs })
+            .await
+            .map_err(|e| {
+                error!(?e, "create_proposal failed");
+                Error::internal("Failed to create proposal")
            })
-            .returning(EvmWalletAccess::as_select())
-            .get_result(&mut *conn)
-            .await
-            .expect("insert entry A");
-
-        let entry_b = diesel::insert_into(evm_wallet_access::table)
-            .values(NewEvmWalletAccess {
-                wallet_id: 1,
-                client_id: 20,
-            })
-            .returning(EvmWalletAccess::as_select())
-            .get_result(&mut *conn)
-            .await
-            .expect("insert entry B");
-
-        // Revoke only entry A by its primary key id.
-        conn.transaction(async |conn| {
-            diesel::delete(evm_wallet_access::table)
-                .filter(evm_wallet_access::id.eq(entry_a.id))
-                .execute(&mut *conn)
-                .await
-        })
-        .await
-        .expect("revoke entry A");
-
-        // Entry A must be gone.
-        let gone = evm_wallet_access::table
-            .filter(evm_wallet_access::id.eq(entry_a.id))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count entry A");
-        assert_eq!(gone, 0, "revoked entry must be deleted");
-
-        // Entry B (same wallet, different client) must still exist.
-        let still_there = evm_wallet_access::table
-            .filter(evm_wallet_access::id.eq(entry_b.id))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count entry B");
-        assert_eq!(still_there, 1, "unrelated entry must not be deleted");
    }

-    /// Regression test: when `entry_id` and `wallet_id` differ, only the correct row is removed.
-    ///
-    /// This specifically catches the case where `entry.id=5` and `wallet_id=1` are different values;
-    /// the old bug would delete by `wallet_id`, potentially matching a completely different entry.
-    #[tokio::test]
-    async fn revoke_with_mismatched_wallet_and_entry_ids() {
-        use crate::db::models::EvmWalletAccess;
-
-        let pool = db::create_test_pool().await;
-        let mut conn = pool.get().await.expect("pool connection");
-
-        // Insert entries to force auto-increment IDs to diverge from wallet_ids.
-        // We'll insert 5 placeholder entries first so that the real entry gets id=6.
-        for i in 1_i32..=5 {
-            diesel::insert_into(evm_wallet_access::table)
-                .values(NewEvmWalletAccess {
-                    wallet_id: 99,
-                    client_id: i,
-                })
-                .execute(&mut *conn)
-                .await
-                .expect("insert placeholder");
-        }
-
-        // Real target: wallet_id=1, will get id=6.
-        let target = diesel::insert_into(evm_wallet_access::table)
-            .values(NewEvmWalletAccess {
-                wallet_id: 1,
-                client_id: 1,
+    #[message]
+    pub(crate) async fn handle_cast_vote(
+        &mut self,
+        proposal_id: i32,
+        approve: bool,
+        signature: Vec<u8>,
+    ) -> Result<crate::actors::proposal_manager::VoteOutcome, crate::actors::proposal_manager::Error> {
+        use crate::actors::proposal_manager::CastVote;
+        let operator_id = self.credentials.id;
+        self.props
+            .actors
+            .proposal_manager
+            .ask(CastVote { proposal_id, operator_id, approve, signature })
+            .await
+            .map_err(|err| match err {
+                SendError::HandlerError(e) => e,
+                _ => crate::actors::proposal_manager::Error::ExecutionFailed("actor unavailable".to_owned()),
            })
-            .returning(EvmWalletAccess::as_select())
-            .get_result(&mut *conn)
+    }
+
+    #[message]
+    pub(crate) async fn handle_query_pending(
+        &mut self,
+    ) -> Vec<crate::actors::proposal_manager::ProposalSummary> {
+        use crate::actors::proposal_manager::QueryPending;
+        let operator_id = self.credentials.id;
+        self.props
+            .actors
+            .proposal_manager
+            .ask(QueryPending { operator_id })
            .await
-            .expect("insert target");
-
-        // Sanity: target.id != target.wallet_id
-        assert_ne!(
-            target.id, target.wallet_id,
-            "test prerequisite: id and wallet_id must differ"
-        );
-
-        // Revoke by entry id.
-        conn.transaction(async |conn| {
-            diesel::delete(evm_wallet_access::table)
-                .filter(evm_wallet_access::id.eq(target.id))
-                .execute(&mut *conn)
-                .await
-        })
-        .await
-        .expect("revoke target");
-
-        let remaining = evm_wallet_access::table
-            .filter(evm_wallet_access::id.eq(target.id))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count target");
-        assert_eq!(remaining, 0, "target must be deleted by its entry id");
-
-        // Placeholders for wallet_id=99 must be untouched.
-        let placeholders = evm_wallet_access::table
-            .filter(evm_wallet_access::wallet_id.eq(99))
-            .count()
-            .get_result::<i64>(&mut *conn)
-            .await
-            .expect("count placeholders");
-        assert_eq!(placeholders, 5, "unrelated entries must survive");
+            .unwrap_or_default()
    }
 }
--- a/server/crates/arbiter-server/src/peers/operator/session/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/mod.rs
@@ -1,14 +1,16 @@
-use super::{OutOfBand, OperatorConnection};
+use super::{Credentials, OutOfBand, OperatorConnection};
 use crate::{
    actors::{
-        flow_coordinator::{GetConnectedClientIds, client_connect_approval::{ClientApprovalAnswer, ClientApprovalController}}, operator_registry::ConnectOperator,
-    }, peers::client::ClientProfile,
+        flow_coordinator::client_connect_approval::ClientApprovalController,
+        operator_registry::ConnectOperator,
+    },
+    peers::client::ClientProfile,
 };
 use arbiter_crypto::authn;
 use arbiter_proto::transport::Sender;

 use kameo::{Actor, actor::ActorRef, messages};
-use std::{borrow::Cow, collections::{HashMap, HashSet}};
+use std::{borrow::Cow, collections::HashMap};
 use thiserror::Error;
 use tracing::error;

@@ -49,24 +51,21 @@ pub struct PendingClientApproval {

 pub struct OperatorSession {
    props: OperatorConnection,
+    credentials: Credentials,
    sender: Box<dyn Sender<OutOfBand>>,

    pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>,
-    /// DB `client_ids` this operator session is allowed to sign for.
-    /// Seeded from currently-connected clients on start, then updated as
-    /// approvals are granted or denied during the session lifetime.
-    approved_client_ids: HashSet<i32>,
 }

 pub mod handlers;

 impl OperatorSession {
-    pub(crate) fn new(props: OperatorConnection, sender: Box<dyn Sender<OutOfBand>>) -> Self {
+    pub(crate) fn new(props: OperatorConnection, credentials: Credentials, sender: Box<dyn Sender<OutOfBand>>) -> Self {
        Self {
            props,
+            credentials,
            sender,
            pending_client_approvals: HashMap::default(),
-            approved_client_ids: HashSet::default(),
        }
    }
 }
@@ -91,7 +90,6 @@ impl OperatorSession {
                actor = "operator",
                event = "failed to announce new client connection"
            );
-            let _ = controller.tell(ClientApprovalAnswer { approved: false }).await;
            return;
        }

@@ -110,7 +108,7 @@ impl Actor for OperatorSession {

    type Error = Error;

-    async fn on_start(mut args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
+    async fn on_start(args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
        args.props
            .actors
            .operator_registry
@@ -125,16 +123,6 @@ impl Actor for OperatorSession {
                );
                Error::internal("Failed to register operator connection with operator registry")
            })?;
-
-        // Seed approved set with clients already connected when this session starts.
-        // New clients will be added via handle_new_client_approve as they are approved.
-        match args.props.actors.flow_coordinator.ask(GetConnectedClientIds {}).await {
-            Ok(ids) => args.approved_client_ids.extend(ids),
-            Err(err) => {
-                error!(?err, "Failed to fetch connected client IDs on operator session start");
-            }
-        }
-
        Ok(args)
    }

--- a/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
@@ -3,20 +3,24 @@ use crate::{
    actors::{
        GlobalActors,
        vault::{self, Bootstrap, GetState, TryUnseal, VaultState, events},
+        vault_coordinator::{ContributeBootstrap, ContributeUnseal, StartBootstrap},
    },
-    crypto::integrity::{self},
+    crypto::{KeyCell, integrity::{self}},
    db::DatabasePool,
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use state::State;

 use chacha20poly1305::{AeadInPlace, KeyInit as _, XChaCha20Poly1305, XNonce};
-use kameo::{Actor, error::SendError, messages, prelude::{Context, Message}};
+use kameo::{Actor, error::SendError, messages, prelude::Message};
 use kameo_actors::message_bus::Register;
 use tokio::sync::oneshot;
 use tracing::{error, info};
 use x25519_dalek::{EphemeralSecret, PublicKey, SharedSecret};

+pub use VaultGateMessage as Inbound;
+pub use VaultGateMessageReply as Outbound;
+
 pub mod state;

 #[derive(Debug, thiserror::Error)]
@@ -25,8 +29,6 @@ pub enum Error {
    AlreadyBootstrapped,
    #[error("Invalid key provided")]
    InvalidKey,
-    #[error("Vault locked: too many failed unseal attempts")]
-    LockedOut,

    #[error("State transition failed")]
    State,
@@ -100,11 +102,9 @@ impl VaultGate {
        nonce: &[u8],
        ciphertext: &[u8],
        associated_data: &[u8],
-    ) -> Result<SafeCell<Vec<u8>>, ()> {
+    ) -> Result<KeyCell, ()> {
        let nonce = XNonce::from_slice(nonce);
-
        let cipher = XChaCha20Poly1305::new(secret.as_bytes().into());
-
        let mut key_buffer = SafeCell::new(ciphertext.to_vec());

        let decryption_result = key_buffer.write_inline(|write_handle| {
@@ -112,7 +112,9 @@ impl VaultGate {
        });

        match decryption_result {
-            Ok(()) => Ok(key_buffer),
+            Ok(()) => KeyCell::try_from(key_buffer).map_err(|()| {
+                error!("Decrypted key material has unexpected length");
+            }),
            Err(err) => {
                error!(?err, "Failed to decrypt encrypted key material");
                Err(())
@@ -121,7 +123,7 @@ impl VaultGate {
    }
 }

-#[messages(messages = Inbound, replies = Outbound)]
+#[messages(enum)]
 impl VaultGate {
    #[message]
    pub fn handle_handshake(
@@ -143,29 +145,25 @@ impl VaultGate {
        })
    }

-    #[message(ctx)]
+    #[message]
    pub async fn handle_unseal_encrypted_key(
        &mut self,
        nonce: Vec<u8>,
        ciphertext: Vec<u8>,
        associated_data: Vec<u8>,
-        ctx: &mut Context<Self, Result<(), Error>>,
    ) -> Result<(), Error> {
        let State::ReadyForExchange { secret, .. } = &self.state else {
            return Err(Error::State);
        };

-        let Ok(seal_key_buffer) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-        else {
+        let Ok(seal_key) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data) else {
            return Err(Error::InvalidKey);
        };

        match self
            .actors
            .vault
-            .ask(TryUnseal {
-                seal_key_raw: seal_key_buffer,
-            })
+            .ask(TryUnseal { seal_key })
            .await
        {
            Ok(()) => {
@@ -173,12 +171,6 @@ impl VaultGate {
                Ok(())
            }
            Err(SendError::HandlerError(vault::Error::InvalidKey)) => Err(Error::InvalidKey),
-            Err(SendError::HandlerError(vault::Error::LockedOut)) => {
-                // Vault is permanently locked — terminate this gate so the
-                // run_vault_gate loop breaks and the connection is closed.
-                ctx.stop();
-                Err(Error::LockedOut)
-            }
            Err(SendError::HandlerError(err)) => {
                error!(?err, "Vault failed to unseal key");
                Err(Error::InvalidKey)
@@ -201,17 +193,14 @@ impl VaultGate {
            return Err(Error::State);
        };

-        let Ok(seal_key_buffer) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-        else {
+        let Ok(seal_key) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data) else {
            return Err(Error::InvalidKey);
        };

        match self
            .actors
            .vault
-            .ask(Bootstrap {
-                seal_key_raw: seal_key_buffer,
-            })
+            .ask(Bootstrap { seal_key })
            .await
        {
            Ok(()) => {
@@ -243,6 +232,50 @@ impl VaultGate {

        Ok(answer)
    }
+
+    #[message]
+    pub async fn handle_declare_committee(&mut self, count: usize) -> Result<(), Error> {
+        self.actors
+            .vault_coordinator
+            .ask(StartBootstrap {
+                operator_id: self.auth_creds.id,
+                declared_count: count,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_bootstrap_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeBootstrap {
+                operator_id: self.auth_creds.id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_unseal_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeUnseal {
+                operator_id: self.auth_creds.id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
 }

 impl Message<events::Bootstrapped> for VaultGate {
@@ -251,7 +284,7 @@ impl Message<events::Bootstrapped> for VaultGate {
    async fn handle(
        &mut self,
        _: events::Bootstrapped,
-        ctx: &mut Context<Self, Self::Reply>,
+        ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
    ) -> Self::Reply {
        let result = async {
            let mut conn = self
@@ -287,7 +320,7 @@ impl Message<events::Unsealed> for VaultGate {
    async fn handle(
        &mut self,
        _: events::Unsealed,
-        ctx: &mut Context<Self, Self::Reply>,
+        ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
    ) -> Self::Reply {
        if let Some(tx) = self.promotion_tx.take() {
            let _ = tx.send(Ok(()));
--- a/server/crates/arbiter-server/tests/client/auth.rs
+++ b/server/crates/arbiter-server/tests/client/auth.rs
@@ -1,8 +1,5 @@
 use super::common::ChannelTransport;
-use arbiter_crypto::{
-    authn::{self, AuthChallenge, CLIENT_CONTEXT},
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use arbiter_crypto::authn::{self, AuthChallenge, CLIENT_CONTEXT};
 use arbiter_proto::{
    ClientMetadata,
    transport::{Receiver, Sender},
@@ -86,8 +83,8 @@ async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
        .0
        .to_vec();

-    insert_into(schema::operator_client::table)
-        .values((schema::operator_client::public_key.eq(sentinel_key),))
+    insert_into(schema::operator_identity::table)
+        .values((schema::operator_identity::public_key.eq(sentinel_key),))
        .execute(&mut conn)
        .await
        .unwrap();
@@ -100,7 +97,7 @@ async fn spawn_test_actors(db: &db::DatabasePool) -> GlobalActors {
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -266,7 +263,7 @@ pub async fn metadata_unchanged_does_not_append_history() {

 #[tokio::test]
 #[test_log::test]
-pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
+pub async fn metadata_change_appends_history_and_repoints_binding() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;
    let new_key = MlDsa87::key_gen(&mut rand::rng());
@@ -287,7 +284,6 @@ pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
        connect_client(props, &mut server_transport).await;
    });

-    // Reconnect presenting different metadata — must be silently ignored.
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
@@ -314,7 +310,6 @@ pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
            client_metadata, client_metadata_history, program_client,
        };
        let mut conn = db.get().await.unwrap();
-        // Metadata is frozen: no new row, no history entry.
        let metadata_count: i64 = client_metadata::table
            .count()
            .get_result(&mut conn)
@@ -340,16 +335,15 @@ pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
            .first::<(String, Option<String>, Option<String>)>(&mut conn)
            .await
            .unwrap();
-        assert_eq!(metadata_count, 1, "frozen: no new metadata row on reconnect");
-        assert_eq!(history_count, 0, "frozen: no history entry on reconnect");
+        assert_eq!(metadata_count, 2);
+        assert_eq!(history_count, 1);
        assert_eq!(
            current,
            (
                "client".to_owned(),
-                Some("old".to_owned()),
-                Some("1.0.0".to_owned())
-            ),
-            "frozen: original metadata must be preserved"
+                Some("new".to_owned()),
+                Some("2.0.0".to_owned())
+            )
        );
    }
 }
--- a/server/crates/arbiter-server/tests/common/mod.rs
+++ b/server/crates/arbiter-server/tests/common/mod.rs
@@ -2,7 +2,6 @@
    dead_code,
    reason = "Common test utilities that may not be used in every test"
 )]
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use arbiter_proto::transport::{Bi, Error, Receiver, Sender};
 use arbiter_server::{
    actors::{GlobalActors, vault::Vault},
@@ -19,7 +18,7 @@ pub(crate) async fn bootstrapped_vault(db: &db::DatabasePool) -> Vault {
        .await
        .unwrap();
    actor
-        .bootstrap(SafeCell::new(b"test-seal-key".to_vec()))
+        .bootstrap(arbiter_server::crypto::KeyCell::from([0u8; 32]))
        .await
        .unwrap();
    actor
--- a/server/crates/arbiter-server/tests/governance.rs
+++ b/server/crates/arbiter-server/tests/governance.rs
@@ -0,0 +1,424 @@
+use arbiter_crypto::authn::{self, GOVERNANCE_CONTEXT};
+use arbiter_server::{
+    actors::{
+        GlobalActors,
+        proposal_manager::{CastVote, CreateProposal, Error as ProposalError, ExpireStale, ProposalKind, QueryPending, VoteOutcome},
+    },
+    crypto::KeyCell,
+    db,
+};
+use arbiter_server::actors::vault::Bootstrap;
+use arbiter_server::db::schema::operator_identity;
+use diesel::{ExpressionMethods, QueryDsl, insert_into};
+use diesel_async::RunQueryDsl;
+
+async fn register_operator(db: &db::DatabasePool, pubkey: &authn::PublicKey) -> i32 {
+    let mut conn = db.get().await.unwrap();
+    insert_into(operator_identity::table)
+        .values(operator_identity::public_key.eq(pubkey.to_bytes()))
+        .returning(operator_identity::id)
+        .get_result::<i32>(&mut conn)
+        .await
+        .unwrap()
+}
+
+fn make_vote_message(proposal_id: i32, approve: bool) -> Vec<u8> {
+    let mut msg = Vec::with_capacity(9);
+    msg.extend_from_slice(&(proposal_id as i64).to_be_bytes());
+    msg.push(u8::from(approve));
+    msg
+}
+
+async fn insert_unapproved_client(db: &db::DatabasePool, pubkey: &authn::PublicKey) -> i32 {
+    use arbiter_server::db::schema::{client_metadata, program_client};
+    let mut conn = db.get().await.unwrap();
+    let metadata_id: i32 = insert_into(client_metadata::table)
+        .values((
+            client_metadata::name.eq("test-client"),
+            client_metadata::description.eq(Option::<String>::None),
+            client_metadata::version.eq(Option::<String>::None),
+        ))
+        .returning(client_metadata::id)
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+
+    insert_into(program_client::table)
+        .values((
+            program_client::public_key.eq(pubkey.to_bytes()),
+            program_client::metadata_id.eq(metadata_id),
+        ))
+        .returning(program_client::id)
+        .get_result(&mut conn)
+        .await
+        .unwrap()
+}
+
+#[tokio::test]
+async fn create_proposal_returns_id() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap {
+            seal_key: KeyCell::from([0u8; 32]),
+        })
+        .await
+        .unwrap();
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id: 42 },
+            initiator_id: 1,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    assert!(proposal_id > 0);
+}
+
+#[tokio::test]
+async fn single_operator_vote_reaches_quorum() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op_id = register_operator(&db, &signing_key.public_key()).await;
+
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op_id,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = signing_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op_id,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+}
+
+#[tokio::test]
+async fn two_operator_first_vote_is_pending() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let key1 = authn::SigningKey::generate();
+    let key2 = authn::SigningKey::generate();
+    let op1 = register_operator(&db, &key1.public_key()).await;
+    let _op2 = register_operator(&db, &key2.public_key()).await;
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op1,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = key1.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op1,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::Pending);
+}
+
+#[tokio::test]
+async fn duplicate_vote_rejected() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let key = authn::SigningKey::generate();
+    let op = register_operator(&db, &key.public_key()).await;
+
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    // Second vote same operator
+    let sig2 = key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let result = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op,
+            approve: true,
+            signature: sig2.to_bytes(),
+        })
+        .await;
+
+    assert!(matches!(
+        result,
+        Err(kameo::error::SendError::HandlerError(ProposalError::AlreadyVoted))
+    ));
+}
+
+#[tokio::test]
+async fn invalid_signature_rejected() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let key = authn::SigningKey::generate();
+    let op = register_operator(&db, &key.public_key()).await;
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let result = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op,
+            approve: true,
+            signature: vec![0u8; 32], // garbage
+        })
+        .await;
+
+    assert!(matches!(
+        result,
+        Err(kameo::error::SendError::HandlerError(ProposalError::InvalidSignature))
+    ));
+}
+
+#[tokio::test]
+async fn query_pending_excludes_already_voted() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op = register_operator(&db, &signing_key.public_key()).await;
+
+    let client_key1 = authn::SigningKey::generate();
+    let client_id1 = insert_unapproved_client(&db, &client_key1.public_key()).await;
+    let client_key2 = authn::SigningKey::generate();
+    let client_id2 = insert_unapproved_client(&db, &client_key2.public_key()).await;
+
+    let p1 = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id: client_id1 },
+            initiator_id: op,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let p2 = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id: client_id2 },
+            initiator_id: op,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    // Vote on p1 — with 1 operator this reaches quorum (QuorumApproved)
+    let msg = make_vote_message(p1, true);
+    let sig = signing_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id: p1,
+            operator_id: op,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+
+    // QueryPending should return only p2
+    let pending = actors
+        .proposal_manager
+        .ask(QueryPending { operator_id: op })
+        .await
+        .unwrap();
+
+    assert_eq!(pending.len(), 1);
+    assert_eq!(pending[0].id, p2);
+}
+
+#[tokio::test]
+async fn expire_stale_marks_old_proposals_expired() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let signing_key = authn::SigningKey::generate();
+    let op = register_operator(&db, &signing_key.public_key()).await;
+
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    // Create proposal with ttl_secs = -1 so it's immediately expired
+    let _proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op,
+            ttl_secs: Some(-1),
+        })
+        .await
+        .unwrap();
+
+    let expired = actors
+        .proposal_manager
+        .ask(ExpireStale)
+        .await
+        .unwrap();
+    assert_eq!(expired, 1);
+
+    let pending = actors
+        .proposal_manager
+        .ask(QueryPending { operator_id: op })
+        .await
+        .unwrap();
+    assert!(pending.is_empty());
+}
+
+#[tokio::test]
+async fn approve_sdk_client_writes_integrity_envelope() {
+    use arbiter_server::db::schema::integrity_envelope;
+
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    actors
+        .vault
+        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
+        .await
+        .unwrap();
+
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
+    let op_key = authn::SigningKey::generate();
+    let op_id = register_operator(&db, &op_key.public_key()).await;
+
+    let proposal_id = actors
+        .proposal_manager
+        .ask(CreateProposal {
+            kind: ProposalKind::ApproveSdkClient { client_id },
+            initiator_id: op_id,
+            ttl_secs: None,
+        })
+        .await
+        .unwrap();
+
+    let msg = make_vote_message(proposal_id, true);
+    let sig = op_key.sign_message(&msg, GOVERNANCE_CONTEXT).unwrap();
+    let outcome = actors
+        .proposal_manager
+        .ask(CastVote {
+            proposal_id,
+            operator_id: op_id,
+            approve: true,
+            signature: sig.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(outcome, VoteOutcome::QuorumApproved);
+
+    let mut conn = db.get().await.unwrap();
+    let count: i64 = integrity_envelope::table
+        .filter(integrity_envelope::entity_kind.eq("client_credentials"))
+        .count()
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(count, 1);
+}
--- a/server/crates/arbiter-server/tests/operator/auth.rs
+++ b/server/crates/arbiter-server/tests/operator/auth.rs
@@ -1,8 +1,5 @@
 use super::common::ChannelTransport;
-use arbiter_crypto::{
-    authn::{self, AuthChallenge, OPERATOR_CONTEXT},
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
 use arbiter_proto::transport::{Error as TransportError, Receiver, Sender};
 use arbiter_server::{
    actors::{GlobalActors, bootstrap::GetToken, vault::Bootstrap},
@@ -157,7 +154,7 @@ pub async fn bootstrap_token_auth() {
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -174,7 +171,7 @@ pub async fn bootstrap_token_auth() {
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some(token.into_bytes()),
+            bootstrap_token: Some(token),
        })
        .await
        .unwrap();
@@ -206,8 +203,8 @@ pub async fn bootstrap_token_auth() {
    task.await.unwrap().unwrap();

    let mut conn = db.get().await.unwrap();
-    let stored_pubkey: Vec<u8> = schema::operator_client::table
-        .select(schema::operator_client::public_key)
+    let stored_pubkey: Vec<u8> = schema::operator_identity::table
+        .select(schema::operator_identity::public_key)
        .first::<Vec<u8>>(&mut conn)
        .await
        .unwrap();
@@ -231,7 +228,7 @@ pub async fn bootstrap_invalid_token_auth() {
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some(b"invalid_token".to_vec()),
+            bootstrap_token: Some("invalid_token".to_owned()),
        })
        .await
        .unwrap();
@@ -259,7 +256,7 @@ pub async fn bootstrap_invalid_token_auth() {
    ));

    let mut conn = db.get().await.unwrap();
-    let count: i64 = schema::operator_client::table
+    let count: i64 = schema::operator_identity::table
        .count()
        .get_result::<i64>(&mut conn)
        .await
@@ -275,7 +272,7 @@ pub async fn challenge_auth() {
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -285,9 +282,9 @@ pub async fn challenge_auth() {

    {
        let mut conn = db.get().await.unwrap();
-        let id: i32 = insert_into(schema::operator_client::table)
-            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
-            .returning(schema::operator_client::id)
+        let id: i32 = insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
+            .returning(schema::operator_identity::id)
            .get_result(&mut conn)
            .await
            .unwrap();
@@ -361,7 +358,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -371,8 +368,8 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {

    {
        let mut conn = db.get().await.unwrap();
-        insert_into(schema::operator_client::table)
-            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
+        insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
            .execute(&mut conn)
            .await
            .unwrap();
@@ -400,7 +397,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
    let challenge = match response {
        Ok(resp) => match resp {
            auth::Outbound::AuthChallenge { challenge } => challenge,
-            other @ auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got {other:?}"),
+            other => panic!("Expected AuthChallenge, got {other:?}"),
        },
        Err(err) => panic!("Expected Ok response, got Err({err:?})"),
    };
@@ -434,7 +431,7 @@ pub async fn challenge_auth_rejects_invalid_signature() {
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -444,9 +441,9 @@ pub async fn challenge_auth_rejects_invalid_signature() {

    {
        let mut conn = db.get().await.unwrap();
-        let id: i32 = insert_into(schema::operator_client::table)
-            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
-            .returning(schema::operator_client::id)
+        let id: i32 = insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
+            .returning(schema::operator_identity::id)
            .get_result(&mut conn)
            .await
            .unwrap();
--- a/server/crates/arbiter-server/tests/operator/unseal.rs
+++ b/server/crates/arbiter-server/tests/operator/unseal.rs
@@ -1,7 +1,4 @@
-use arbiter_crypto::{
-    authn,
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use arbiter_crypto::authn;
 use arbiter_server::{
    actors::{
        GlobalActors,
@@ -22,7 +19,7 @@ use tokio::sync::oneshot;
 use x25519_dalek::{EphemeralSecret, PublicKey};

 async fn setup_sealed_gate(
-    seal_key: &[u8],
+    seal_key: &[u8; 32],
 ) -> (
    db::DatabasePool,
    kameo::actor::ActorRef<VaultGate>,
@@ -34,7 +31,7 @@ async fn setup_sealed_gate(
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(seal_key.to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from(*seal_key),
        })
        .await
        .unwrap();
@@ -50,7 +47,7 @@ async fn setup_sealed_gate(

 async fn client_dh_encrypt(
    gate: &kameo::actor::ActorRef<VaultGate>,
-    key_to_send: &[u8],
+    key_to_send: &[u8; 32],
 ) -> HandleUnsealEncryptedKey {
    let client_secret = EphemeralSecret::random();
    let client_public = PublicKey::from(&client_secret);
@@ -83,7 +80,7 @@ async fn client_dh_encrypt(
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_success() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    let encrypted_key = client_dh_encrypt(&gate, seal_key).await;
@@ -95,10 +92,10 @@ pub async fn unseal_success() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_wrong_seal_key() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

-    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
+    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key-padded-to-32-bytes!!!!").await;

    let response = gate.ask(encrypted_key).await;
    assert!(matches!(
@@ -112,7 +109,7 @@ pub async fn unseal_wrong_seal_key() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_corrupted_ciphertext() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    let client_secret = EphemeralSecret::random();
@@ -140,55 +137,14 @@ pub async fn unseal_corrupted_ciphertext() {
    ));
 }

-/// After MAX_UNSEAL_ATTEMPTS wrong keys, the vault locks and the VaultGate
-/// must stop itself so the connection is dropped.
-#[tokio::test]
-#[test_log::test]
-pub async fn lockout_stops_vault_gate() {
-    use kameo::error::SendError;
-
-    let seal_key = b"real-seal-key";
-    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;
-
-    // Exhaust all MAX_UNSEAL_ATTEMPTS (5) with wrong keys; each returns InvalidKey.
-    for _ in 0..5 {
-        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
-        assert!(matches!(
-            gate.ask(encrypted_key).await,
-            Err(SendError::HandlerError(VaultGateError::InvalidKey))
-        ));
-    }
-
-    // Sixth attempt: vault is now locked, returns LockedOut, and the gate stops itself.
-    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
-    assert!(matches!(
-        gate.ask(encrypted_key).await,
-        Err(SendError::HandlerError(VaultGateError::LockedOut))
-    ));
-
-    // Give the actor scheduler time to process the stop signal.
-    tokio::time::sleep(std::time::Duration::from_millis(50)).await;
-
-    // Any subsequent message must be rejected because the gate is stopped.
-    let client_secret = EphemeralSecret::random();
-    let client_public = PublicKey::from(&client_secret);
-    assert!(
-        matches!(
-            gate.ask(HandleHandshake { client_pubkey: client_public }).await,
-            Err(SendError::ActorNotRunning(_))
-        ),
-        "VaultGate must be stopped after LockedOut"
-    );
-}
-
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_retry_after_invalid_key() {
-    let seal_key = b"real-seal-key";
+    let seal_key = b"real-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    {
-        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
+        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key-padded-to-32-bytes!!!!").await;

        let response = gate.ask(encrypted_key).await;
        assert!(matches!(
--- a/server/crates/arbiter-server/tests/vault/concurrency.rs
+++ b/server/crates/arbiter-server/tests/vault/concurrency.rs
@@ -14,8 +14,6 @@ use kameo::actor::{ActorRef, Spawn as _};
 use std::collections::{HashMap, HashSet};
 use tokio::task::JoinSet;

-const TEST_AAD: &[u8] = b"test-aad";
-
 async fn write_concurrently(
    actor: ActorRef<Vault>,
    prefix: &'static str,
@@ -29,7 +27,6 @@ async fn write_concurrently(
            let id = actor
                .ask(CreateNew {
                    plaintext: SafeCell::new(plaintext.clone()),
-                    aad: TEST_AAD.to_vec(),
                })
                .await
                .unwrap();
@@ -123,7 +120,7 @@ async fn insert_failure_does_not_create_partial_row() {
    drop(conn);

    let err = actor
-        .create_new(SafeCell::new(b"should fail".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"should fail".to_vec()))
        .await
        .unwrap_err();
    assert!(matches!(err, Error::DatabaseTransaction(_)));
@@ -169,12 +166,12 @@ async fn decrypt_roundtrip_after_high_concurrency() {
        .await
        .unwrap();
    decryptor
-        .try_unseal(SafeCell::new(b"test-seal-key".to_vec()))
+        .try_unseal(arbiter_server::crypto::KeyCell::from([0u8; 32]))
        .await
        .unwrap();

    for (id, plaintext) in expected {
-        let mut decrypted = decryptor.decrypt(id, TEST_AAD.to_vec()).await.unwrap();
+        let mut decrypted = decryptor.decrypt(id).await.unwrap();
        assert_eq!(*decrypted.read(), plaintext);
    }
 }
--- a/server/crates/arbiter-server/tests/vault/lifecycle.rs
+++ b/server/crates/arbiter-server/tests/vault/lifecycle.rs
@@ -5,24 +5,22 @@ use arbiter_server::{
        GlobalActors,
        vault::{Error, Vault},
    },
-    crypto::encryption::v1::{Nonce, ROOT_KEY_TAG},
+    crypto::{KeyCell, encryption::v1::{Nonce, ROOT_KEY_TAG}},
    db::{self, models, schema},
 };

 use diesel::{QueryDsl, SelectableHelper};
 use diesel_async::RunQueryDsl;

-const TEST_AAD: &[u8] = b"test-aad";
-
 #[tokio::test]
 #[test_log::test]
-async fn bootstrap() {
+async fn test_bootstrap() {
    let db = db::create_test_pool().await;
    let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
        .await
        .unwrap();

-    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key = KeyCell::from([0u8; 32]);
    actor.bootstrap(seal_key).await.unwrap();

    let mut conn = db.get().await.unwrap();
@@ -41,25 +39,25 @@ async fn bootstrap() {

 #[tokio::test]
 #[test_log::test]
-async fn bootstrap_rejects_double() {
+async fn test_bootstrap_rejects_double() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

-    let seal_key2 = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key2 = KeyCell::from([0u8; 32]);
    let err = actor.bootstrap(seal_key2).await.unwrap_err();
    assert!(matches!(err, Error::AlreadyBootstrapped));
 }

 #[tokio::test]
 #[test_log::test]
-async fn create_new_before_bootstrap_fails() {
+async fn test_create_new_before_bootstrap_fails() {
    let db = db::create_test_pool().await;
    let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
        .await
        .unwrap();

    let err = actor
-        .create_new(SafeCell::new(b"data".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"data".to_vec()))
        .await
        .unwrap_err();
    assert!(matches!(err, Error::NotBootstrapped));
@@ -67,19 +65,19 @@ async fn create_new_before_bootstrap_fails() {

 #[tokio::test]
 #[test_log::test]
-async fn decrypt_before_bootstrap_fails() {
+async fn test_decrypt_before_bootstrap_fails() {
    let db = db::create_test_pool().await;
    let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
        .await
        .unwrap();

-    let err = actor.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor.decrypt(1).await.unwrap_err();
    assert!(matches!(err, Error::NotBootstrapped));
 }

 #[tokio::test]
 #[test_log::test]
-async fn new_restores_sealed_state() {
+async fn test_new_restores_sealed_state() {
    let db = db::create_test_pool().await;
    let actor = common::bootstrapped_vault(&db).await;
    drop(actor);
@@ -87,19 +85,19 @@ async fn new_restores_sealed_state() {
    let mut actor2 = Vault::new(db, GlobalActors::spawn_message_bus())
        .await
        .unwrap();
-    let err = actor2.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor2.decrypt(1).await.unwrap_err();
    assert!(matches!(err, Error::Sealed));
 }

 #[tokio::test]
 #[test_log::test]
-async fn unseal_correct_password() {
+async fn test_unseal_correct_password() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

    let plaintext = b"survive a restart";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
        .await
        .unwrap();
    drop(actor);
@@ -107,22 +105,22 @@ async fn unseal_correct_password() {
    let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
        .await
        .unwrap();
-    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key = KeyCell::from([0u8; 32]);
    actor.try_unseal(seal_key).await.unwrap();

-    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }

 #[tokio::test]
 #[test_log::test]
-async fn unseal_wrong_then_correct_password() {
+async fn test_unseal_wrong_then_correct_password() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

    let plaintext = b"important data";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
        .await
        .unwrap();
    drop(actor);
@@ -131,13 +129,13 @@ async fn unseal_wrong_then_correct_password() {
        .await
        .unwrap();

-    let bad_key = SafeCell::new(b"wrong-password".to_vec());
+    let bad_key = KeyCell::from([1u8; 32]);
    let err = actor.try_unseal(bad_key).await.unwrap_err();
    assert!(matches!(err, Error::InvalidKey));

-    let good_key = SafeCell::new(b"test-seal-key".to_vec());
+    let good_key = KeyCell::from([0u8; 32]);
    actor.try_unseal(good_key).await.unwrap();

-    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }
--- a/server/crates/arbiter-server/tests/vault/storage.rs
+++ b/server/crates/arbiter-server/tests/vault/storage.rs
@@ -10,47 +10,45 @@ use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper, dsl::update};
 use diesel_async::RunQueryDsl;
 use std::collections::HashSet;

-const TEST_AAD: &[u8] = b"test-aad";
-
 #[tokio::test]
 #[test_log::test]
-async fn create_decrypt_roundtrip() {
+async fn test_create_decrypt_roundtrip() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

    let plaintext = b"hello arbiter";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
        .await
        .unwrap();

-    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }

 #[tokio::test]
 #[test_log::test]
-async fn decrypt_nonexistent_returns_not_found() {
+async fn test_decrypt_nonexistent_returns_not_found() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

-    let err = actor.decrypt(9999, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor.decrypt(9999).await.unwrap_err();
    assert!(matches!(err, Error::NotFound));
 }

 #[tokio::test]
 #[test_log::test]
-async fn ciphertext_differs_across_entries() {
+async fn test_ciphertext_differs_across_entries() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

    let plaintext = b"same content";
    let id1 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
        .await
        .unwrap();
    let id2 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(plaintext.to_vec()))
        .await
        .unwrap();

@@ -70,22 +68,22 @@ async fn ciphertext_differs_across_entries() {

    assert_ne!(row1.ciphertext, row2.ciphertext);

-    let mut d1 = actor.decrypt(id1, TEST_AAD.to_vec()).await.unwrap();
-    let mut d2 = actor.decrypt(id2, TEST_AAD.to_vec()).await.unwrap();
+    let mut d1 = actor.decrypt(id1).await.unwrap();
+    let mut d2 = actor.decrypt(id2).await.unwrap();
    assert_eq!(*d1.read(), plaintext);
    assert_eq!(*d2.read(), plaintext);
 }

 #[tokio::test]
 #[test_log::test]
-async fn nonce_never_reused() {
+async fn test_nonce_never_reused() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

    let n = 5;
    for i in 0..n {
        actor
-            .create_new(SafeCell::new(format!("secret {i}").into_bytes()), TEST_AAD.to_vec())
+            .create_new(SafeCell::new(format!("secret {i}").into_bytes()))
            .await
            .unwrap();
    }
@@ -139,7 +137,7 @@ async fn broken_db_nonce_format_fails_closed() {
    drop(conn);

    let err = actor
-        .create_new(SafeCell::new(b"must fail".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"must fail".to_vec()))
        .await
        .unwrap_err();
    assert!(matches!(err, Error::BrokenDatabase));
@@ -147,7 +145,7 @@ async fn broken_db_nonce_format_fails_closed() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;
    let id = actor
-        .create_new(SafeCell::new(b"decrypt target".to_vec()), TEST_AAD.to_vec())
+        .create_new(SafeCell::new(b"decrypt target".to_vec()))
        .await
        .unwrap();
    let mut conn = db.get().await.unwrap();
@@ -158,6 +156,6 @@ async fn broken_db_nonce_format_fails_closed() {
        .unwrap();
    drop(conn);

-    let err = actor.decrypt(id, TEST_AAD.to_vec()).await.unwrap_err();
+    let err = actor.decrypt(id).await.unwrap_err();
    assert!(matches!(err, Error::BrokenDatabase));
 }
Author	SHA1	Message	Date
CleverWild	0b331d90bf	test(server): governance integration tests Some checks failed ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-13 15:23:10 +02:00
CleverWild	f981ddeb79	feat(server::grpc): wire governance RPCs through operator session	2026-06-13 15:23:10 +02:00
CleverWild	8517b981f2	feat(server): introduce ProposalManager actor with quorum voting logic	2026-06-13 15:11:00 +02:00
CleverWild	af13465c03	feat(crypto): expose governance signing context and make shamir_threshold pub const	2026-06-13 15:11:00 +02:00
CleverWild	d7950beb09	feat(db): add proposal and proposal_vote tables	2026-06-13 15:11:00 +02:00
CleverWild	0cb0de759b	feat(proto): add governance proposal/vote RPC definitions	2026-06-13 15:11:00 +02:00
CleverWild	6f270ef0c4	housekepping: add fixme for start_bootstrap's operator_id Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-12 22:01:17 +02:00
CleverWild	0098c3c08a	refactor(server::crypto): use fixed-size [u8; 32] and KeyCell throughout seal key API Some checks failed ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-12 21:15:07 +02:00
CleverWild	a3b98ca024	fix(server::tests): tighten unseal test seal_key params to &[u8; 32]	2026-06-12 21:11:48 +02:00
CleverWild	0d364d1951	feat(server::grpc): wire Shamir committee bootstrap and unseal proto messages Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details Adds DeclareCommittee and ContributePassphrase variants to bootstrap.proto, ContributePassphrase to unseal.proto, and AwaitingContributions result codes to both. Implements corresponding inbound converters and outbound reply mappings. VaultGate handlers delegate to VaultCoordinator.	2026-06-12 19:43:17 +02:00
CleverWild	6f65c907a3	feat(server): introduce VaultCoordinator for multi-operator Shamir bootstrap/unseal VaultCoordinator collects operator passphrases, splits the seal key into Shamir shares on bootstrap (encrypting each share with the operator's passphrase via Argon2 + XChaCha20-Poly1305), and reconstructs the seal key from threshold shares on unseal. Adds vsss-rs 5.4.0 and rand_core 0.6 dependencies.	2026-06-12 19:43:09 +02:00
CleverWild	9764b0d5ce	refactor(server::actors::vault): clean up Bootstrap/TryUnseal, remove Bootstrapping state Bootstrap and TryUnseal now accept a SafeCell<Vec<u8>> seal key directly. The Bootstrapping intermediate state is removed — multi-operator coordination is the responsibility of VaultCoordinator, which calls Bootstrap atomically once all shares are collected.	2026-06-12 19:43:02 +02:00
CleverWild	50fe18d6ce	feat(server::crypto): add Shamir secret sharing utilities Wraps vsss_rs Gf256::split_array / combine_array into thin split_key / combine_shares helpers. Also widens derive_key salt parameter from &[u8;16] to &[u8] to accommodate the 32-byte share salts.	2026-06-12 19:42:56 +02:00
CleverWild	3e5f0cb3df	feat(server::db): add share_salt column to operator table Each operator row now stores a 32-byte random salt used to derive the per-operator share encryption key from their passphrase (Argon2 KDF).	2026-06-12 19:42:49 +02:00
CleverWild	34850137df	feat(server::actors::evm): implement operator_delete_grant Sets revoked_at on the evm_basic_grant row; returns NotFound if the grant does not exist. Wires the handler in OperatorSession replacing the todo!().	2026-06-12 19:42:43 +02:00
CleverWild	d1b96c8409	fix(server::peers::operator::auth): make ChallengeContext pub for smlang state machine smlang generates a public state enum whose variants contain ChallengeContext, requiring the type itself to be fully public. Also tightens the wildcard arm in client auth to an exhaustive match.	2026-06-12 19:42:37 +02:00
Skipper	9dbb18ae82	WIP: some things Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-05-20 21:04:16 +02:00
Skipper	a773255935	refactor(server::db): introduced newtype wrappers for entity id's in database	2026-05-04 19:35:27 +02:00