2026-04-18 13:07:58 +00:00
66 changed files with 788 additions and 523 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -100,6 +100,27 @@ diesel migration generate <name> --migration-dir crates/arbiter-server/migration
 diesel migration run --migration-dir crates/arbiter-server/migrations
 ```

+### Code Conventions
+
+**`#[must_use]` Attribute:**
+Apply the `#[must_use]` attribute to return types of functions where the return value is critical and should not be accidentally ignored. This is commonly used for:
+
+- Methods that return `bool` indicating success/failure or validation state
+- Any function where ignoring the return value indicates a logic error
+
+Do not apply `#[must_use]` redundantly to items (types or functions) that are already annotated with `#[must_use]`.
+
+Example:
+
+```rust
+#[must_use]
+pub fn verify(&self, nonce: i32, context: &[u8], signature: &Signature) -> bool {
+    // verification logic
+}
+```
+
+This forces callers to either use the return value or explicitly ignore it with `let _ = ...;`, preventing silent failures.
+
 ## User Agent (Flutter + Rinf at `useragent/`)

 The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `useragent/native/hub/` as a separate crate that uses `arbiter-useragent` for the gRPC client.
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -100,6 +100,27 @@ diesel migration generate <name> --migration-dir crates/arbiter-server/migration
 diesel migration run --migration-dir crates/arbiter-server/migrations
 ```

+### Code Conventions
+
+**`#[must_use]` Attribute:**
+Apply the `#[must_use]` attribute to return types of functions where the return value is critical and should not be accidentally ignored. This is commonly used for:
+
+- Methods that return `bool` indicating success/failure or validation state
+- Any function where ignoring the return value indicates a logic error
+
+Do not apply `#[must_use]` redundantly to items (types or functions) that are already annotated with `#[must_use]`.
+
+Example:
+
+```rust
+#[must_use]
+pub fn verify(&self, nonce: i32, context: &[u8], signature: &Signature) -> bool {
+    // verification logic
+}
+```
+
+This forces callers to either use the return value or explicitly ignore it with `let _ = ...;`, preventing silent failures.
+
 ## User Agent (Flutter + Rinf at `useragent/`)

 The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `useragent/native/hub/` as a separate crate that uses `arbiter-useragent` for the gRPC client.
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -4,48 +4,170 @@ members = [
 ]
 resolver = "3"

-[workspace.lints.clippy]
-disallowed-methods = "deny"
-

 [workspace.dependencies]
-tonic = { version = "0.14.5", features = [
-    "deflate",
-    "gzip",
-    "tls-connect-info",
-    "zstd",
-] }
-tracing = "0.1.44"
-tokio = { version = "1.52.1", features = ["full"] }
-ed25519-dalek = { version = "3.0.0-pre.6", features = ["rand_core"] }
-chrono = { version = "0.4.44", features = ["serde"] }
-rand = "0.10.1"
-rustls = { version = "0.23.38", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
-smlang = "0.8.0"
-thiserror = "2.0.18"
-async-trait = "0.1.89"
-futures = "0.3.32"
-tokio-stream = { version = "0.1.18", features = ["full"] }
-prost-types = { version = "0.14.3", features = ["chrono"] }
-x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
-rstest = "0.26.1"
-rustls-pki-types = "1.14.0"
 alloy = "2.0.0"
-rcgen = { version = "0.14.7", features = [
-    "aws_lc_rs",
-    "pem",
-    "x509-parser",
-    "zeroize",
-], default-features = false }
-k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
-rsa = { version = "0.9", features = ["sha2"] }
-sha2 = "0.11"
-spki = "0.8"
-prost = "0.14.3"
-miette = { version = "7.6.0", features = ["fancy", "serde"] }
-mutants = "0.0.4"
-ml-dsa = { version = "0.1.0-rc.8", features = ["zeroize"] }
+async-trait = "0.1.89"
 base64 = "0.22.1"
+chrono = { version = "0.4.44", features = ["serde"] }
+ed25519-dalek = { version = "3.0.0-pre.6", features = ["rand_core"] }
+futures = "0.3.32"
+k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
 kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 hmac = "0.13.0"
+miette = { version = "7.6.0", features = ["fancy", "serde"] }
+ml-dsa = { version = "0.1.0-rc.8", features = ["zeroize"] }
+mutants = "0.0.4"
+prost = "0.14.3"
+prost-types = { version = "0.14.3", features = ["chrono"] }
+rand = "0.10.1"
+rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
+rsa = { version = "0.9", features = ["sha2"] }
+rstest = "0.26.1"
+rustls = { version = "0.23.38", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
+rustls-pki-types = "1.14.0"
+sha2 = "0.11"
+smlang = "0.8.0"
+spki = "0.8"
+thiserror = "2.0.18"
+tokio = { version = "1.52.1", features = ["full"] }
+tokio-stream = { version = "0.1.18", features = ["full"] }
+tonic = { version = "0.14.5", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
+tracing = "0.1.44"
+x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
+
+[workspace.lints.rust]
+missing_unsafe_on_extern = "deny"
+unsafe_attr_outside_unsafe = "deny"
+unsafe_op_in_unsafe_fn = "deny"
+unstable_features = "deny"
+
+deprecated_safe_2024 = "warn"
+ffi_unwind_calls = "warn"
+linker_messages = "warn"
+
+elided_lifetimes_in_paths = "warn"
+explicit_outlives_requirements = "warn"
+impl-trait-overcaptures = "warn"
+impl-trait-redundant-captures = "warn"
+redundant_lifetimes = "warn"
+single_use_lifetimes = "warn"
+unused_lifetimes = "warn"
+
+macro_use_extern_crate = "warn"
+redundant_imports = "warn"
+unused_import_braces = "warn"
+unused_macro_rules = "warn"
+unused_qualifications = "warn"
+
+unit_bindings = "warn"
+
+# missing_docs = "warn" # ENABLE BY THE FIRST MAJOR VERSION!!
+unnameable_types = "warn"
+
+[workspace.lints.clippy]
+derive_partial_eq_without_eq = "allow" 
+future_not_send = "allow"
+inconsistent_struct_constructor = "allow"
+inline_always = "allow"
+missing_errors_doc = "allow"
+missing_fields_in_debug = "allow"
+missing_panics_doc = "allow"
+must_use_candidate = "allow"
+needless_pass_by_ref_mut = "allow"
+pub_underscore_fields = "allow"
+redundant_pub_crate = "allow" 
+uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {})
+
+# restriction lints
+alloc_instead_of_core = "warn"
+allow_attributes_without_reason = "warn"
+as_conversions = "warn"
+assertions_on_result_states = "warn"
+cfg_not_test = "warn"
+clone_on_ref_ptr = "warn"
+cognitive_complexity = "warn"
+create_dir = "warn"
+dbg_macro = "warn"
+decimal_literal_representation = "warn"
+default_union_representation = "warn"
+deref_by_slicing = "warn"
+disallowed_script_idents = "warn"
+doc_include_without_cfg = "warn"
+empty_drop = "warn"
+empty_enum_variants_with_brackets = "warn"
+empty_structs_with_brackets = "warn"
+exit = "warn"
+filetype_is_file = "warn"
+float_arithmetic = "warn"
+float_cmp_const = "warn"
+fn_to_numeric_cast_any = "warn"
+get_unwrap = "warn"
+if_then_some_else_none = "warn"
+indexing_slicing = "warn"
+infinite_loop = "warn"
+inline_asm_x86_att_syntax = "warn"
+inline_asm_x86_intel_syntax = "warn"
+integer_division = "warn"
+large_include_file = "warn"
+lossy_float_literal = "warn"
+map_with_unused_argument_over_ranges = "warn"
+mem_forget = "warn"
+missing_assert_message = "warn"
+mixed_read_write_in_expression = "warn"
+modulo_arithmetic = "warn"
+multiple_unsafe_ops_per_block = "warn"
+mutex_atomic = "warn"
+mutex_integer = "warn"
+needless_raw_strings = "warn"
+non_ascii_literal = "warn"
+non_zero_suggestions = "warn"
+pathbuf_init_then_push = "warn"
+pointer_format = "warn"
+precedence_bits = "warn"
+pub_without_shorthand = "warn"
+rc_buffer = "warn"
+rc_mutex = "warn"
+redundant_test_prefix = "warn"
+redundant_type_annotations = "warn"
+ref_patterns = "warn"
+renamed_function_params = "warn"
+rest_pat_in_fully_bound_structs = "warn"
+return_and_then = "warn"
+semicolon_inside_block = "warn"
+str_to_string = "warn"
+string_add = "warn"
+string_lit_chars_any = "warn"
+string_slice = "warn"
+suspicious_xor_used_as_pow = "warn"
+try_err = "warn"
+undocumented_unsafe_blocks = "warn"
+uninlined_format_args = "warn"
+unnecessary_safety_comment = "warn"
+unnecessary_safety_doc = "warn"
+unnecessary_self_imports = "warn"
+unneeded_field_pattern = "warn"
+unused_result_ok = "warn"
+verbose_file_reads = "warn"
+
+# cargo lints
+negative_feature_names = "warn"
+redundant_feature_names = "warn"
+wildcard_dependencies = "warn"
+
+# ENABLE BY THE FIRST MAJOR VERSION!!
+# todo = "warn"
+# unimplemented = "warn"
+# panic = "warn"
+# panic_in_result_fn = "warn"
+# 
+# cargo_common_metadata = "warn"
+# multiple_crate_versions = "warn" # a controversial option since it's really difficult to maintain
+
+disallowed_methods = "deny"
+
+nursery = { level = "warn", priority = -1 }
+pedantic = { level = "warn", priority = -1 }
+
+type_repetition_in_bounds = "allow"   # sometimes, it's better for readability this way
--- a/server/clippy.toml
+++ b/server/clippy.toml
@@ -7,3 +7,22 @@ disallowed-methods = [
    { path = "rsa::traits::Decryptor::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt() on rsa::{pkcs1v15,oaep}::DecryptingKey." },
    { path = "rsa::traits::RandomizedDecryptor::decrypt_with_rng", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt_with_rng() on rsa::{pkcs1v15,oaep}::DecryptingKey." },
 ]
+
+allow-indexing-slicing-in-tests = true
+allow-panic-in-tests = true
+check-inconsistent-struct-field-initializers = true
+suppress-restriction-lint-in-const = true
+allow-renamed-params-for = [
+    "core::convert::From",
+    "core::convert::TryFrom",
+    "core::str::FromStr",
+    "kameo::actor::Actor",
+]
+
+module-items-ordered-within-groupings = ["UPPER_SNAKE_CASE"]
+source-item-ordering = ["enum"]
+trait-assoc-item-kinds-order = [
+    "const",
+    "type",
+    "fn",
+] # community tested standard
--- a/server/crates/arbiter-client/src/auth.rs
+++ b/server/crates/arbiter-client/src/auth.rs
@@ -26,20 +26,19 @@ use chrono::DateTime;
 pub enum AuthError {
    #[error("Server sent invalid auth challenge")]
    InvalidChallenge,
-    #[error("Auth challenge was not returned by server")]
-    MissingAuthChallenge,
-
    #[error("Client approval denied by User Agent")]
    ApprovalDenied,
+    #[error("Auth challenge was not returned by server")]
+    MissingAuthChallenge,

    #[error("No User Agents online to approve client")]
    NoUserAgentsOnline,

-    #[error("Unexpected auth response payload")]
-    UnexpectedAuthResponse,
-
    #[error("Signing key storage error")]
    Storage(#[from] StorageError),
+
+    #[error("Unexpected auth response payload")]
+    UnexpectedAuthResponse,
 }

 fn map_auth_result(code: i32) -> AuthError {
@@ -58,7 +57,7 @@ async fn send_auth_challenge_request(
    transport: &mut ClientTransport,
    metadata: ClientMetadata,
    key: &SigningKey,
-) -> std::result::Result<(), AuthError> {
+) -> Result<(), AuthError> {
    transport
        .send(ClientRequest {
            request_id: next_request_id(),
@@ -79,7 +78,7 @@ async fn send_auth_challenge_request(

 async fn receive_auth_challenge(
    transport: &mut ClientTransport,
-) -> std::result::Result<AuthChallenge, AuthError> {
+) -> Result<AuthChallenge, AuthError> {
    let response = transport
        .recv()
        .await
@@ -100,7 +99,7 @@ async fn send_auth_challenge_solution(
    transport: &mut ClientTransport,
    key: &SigningKey,
    challenge: AuthChallenge,
-) -> std::result::Result<(), AuthError> {
+) -> Result<(), AuthError> {
    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos as i64);
    let challenge = authn::AuthChallenge {
        nonce: *challenge
@@ -128,9 +127,7 @@ async fn send_auth_challenge_solution(
        .map_err(|_| AuthError::UnexpectedAuthResponse)
 }

-async fn receive_auth_confirmation(
-    transport: &mut ClientTransport,
-) -> std::result::Result<(), AuthError> {
+async fn receive_auth_confirmation(transport: &mut ClientTransport) -> Result<(), AuthError> {
    let response = transport
        .recv()
        .await
@@ -151,11 +148,11 @@ async fn receive_auth_confirmation(
    }
 }

-pub(crate) async fn authenticate(
+pub async fn authenticate(
    transport: &mut ClientTransport,
    metadata: ClientMetadata,
    key: &SigningKey,
-) -> std::result::Result<(), AuthError> {
+) -> Result<(), AuthError> {
    send_auth_challenge_request(transport, metadata, key).await?;
    let challenge = receive_auth_challenge(transport).await?;
    send_auth_challenge_solution(transport, key, challenge).await?;
--- a/server/crates/arbiter-client/src/bin/test_connect.rs
+++ b/server/crates/arbiter-client/src/bin/test_connect.rs
@@ -29,16 +29,16 @@ async fn main() {
        }
    };

-    println!("{:#?}", url);
+    println!("{url:#?}");

    let metadata = ClientMetadata {
-        name: "arbiter-client test_connect".to_string(),
-        description: Some("Manual connection smoke test".to_string()),
-        version: Some(env!("CARGO_PKG_VERSION").to_string()),
+        name: "arbiter-client test_connect".to_owned(),
+        description: Some("Manual connection smoke test".to_owned()),
+        version: Some(env!("CARGO_PKG_VERSION").to_owned()),
    };

    match ArbiterClient::connect(url, metadata).await {
        Ok(_) => println!("Connected and authenticated successfully."),
-        Err(err) => eprintln!("Failed to connect: {:#?}", err),
+        Err(err) => eprintln!("Failed to connect: {err:#?}"),
    }
 }
--- a/server/crates/arbiter-client/src/client.rs
+++ b/server/crates/arbiter-client/src/client.rs
@@ -17,33 +17,39 @@ use tokio_stream::wrappers::ReceiverStream;
 use tonic::transport::ClientTlsConfig;

 #[derive(Debug, thiserror::Error)]
-pub enum Error {
-    #[error("gRPC error")]
-    Grpc(#[from] tonic::Status),
+pub enum ArbiterClientError {
+    #[error("Authentication error")]
+    Authentication(#[from] AuthError),

    #[error("Could not establish connection")]
    Connection(#[from] tonic::transport::Error),

-    #[error("Invalid server URI")]
-    InvalidUri(#[from] http::uri::InvalidUri),
+    #[error("gRPC error")]
+    Grpc(#[from] tonic::Status),

    #[error("Invalid CA certificate")]
    InvalidCaCert(#[from] webpki::Error),

-    #[error("Authentication error")]
-    Authentication(#[from] AuthError),
+    #[error("Invalid server URI")]
+    InvalidUri(#[from] http::uri::InvalidUri),

    #[error("Storage error")]
    Storage(#[from] StorageError),
 }

 pub struct ArbiterClient {
-    #[allow(dead_code)]
+    #[expect(
+        dead_code,
+        reason = "transport will be used in future methods for sending requests and receiving responses"
+    )]
    transport: Arc<Mutex<ClientTransport>>,
 }

 impl ArbiterClient {
-    pub async fn connect(url: ArbiterUrl, metadata: ClientMetadata) -> Result<Self, Error> {
+    pub async fn connect(
+        url: ArbiterUrl,
+        metadata: ClientMetadata,
+    ) -> Result<Self, ArbiterClientError> {
        let storage = FileSigningKeyStorage::from_default_location()?;
        Self::connect_with_storage(url, metadata, &storage).await
    }
@@ -52,7 +58,7 @@ impl ArbiterClient {
        url: ArbiterUrl,
        metadata: ClientMetadata,
        storage: &S,
-    ) -> Result<Self, Error> {
+    ) -> Result<Self, ArbiterClientError> {
        let key = storage.load_or_create()?;
        Self::connect_with_key(url, metadata, key).await
    }
@@ -61,7 +67,7 @@ impl ArbiterClient {
        url: ArbiterUrl,
        metadata: ClientMetadata,
        key: SigningKey,
-    ) -> Result<Self, Error> {
+    ) -> Result<Self, ArbiterClientError> {
        let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned();
        let tls = ClientTlsConfig::new().trust_anchor(anchor);

@@ -88,7 +94,8 @@ impl ArbiterClient {
    }

    #[cfg(feature = "evm")]
-    pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, Error> {
+    #[expect(clippy::unused_async, reason = "false positive")]
+    pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, ArbiterClientError> {
        todo!("fetch EVM wallet list from server")
    }
 }
--- a/server/crates/arbiter-client/src/lib.rs
+++ b/server/crates/arbiter-client/src/lib.rs
@@ -5,7 +5,7 @@ mod transport;
 pub mod wallets;

 pub use auth::AuthError;
-pub use client::{ArbiterClient, Error};
+pub use client::{ArbiterClient, ArbiterClientError};
 pub use storage::{FileSigningKeyStorage, SigningKeyStorage, StorageError};

 #[cfg(feature = "evm")]
--- a/server/crates/arbiter-client/src/storage.rs
+++ b/server/crates/arbiter-client/src/storage.rs
@@ -5,15 +5,15 @@ use std::path::{Path, PathBuf};

 #[derive(Debug, thiserror::Error)]
 pub enum StorageError {
-    #[error("I/O error")]
-    Io(#[from] std::io::Error),
-
    #[error("Invalid signing key length in storage: expected {expected} bytes, got {actual} bytes")]
    InvalidKeyLength { expected: usize, actual: usize },
+
+    #[error("I/O error")]
+    Io(#[from] std::io::Error),
 }

 pub trait SigningKeyStorage {
-    fn load_or_create(&self) -> std::result::Result<SigningKey, StorageError>;
+    fn load_or_create(&self) -> Result<SigningKey, StorageError>;
 }

 #[derive(Debug, Clone)]
@@ -28,11 +28,11 @@ impl FileSigningKeyStorage {
        Self { path: path.into() }
    }

-    pub fn from_default_location() -> std::result::Result<Self, StorageError> {
+    pub fn from_default_location() -> Result<Self, StorageError> {
        Ok(Self::new(home_path()?.join(Self::DEFAULT_FILE_NAME)))
    }

-    fn read_key(path: &Path) -> std::result::Result<SigningKey, StorageError> {
+    fn read_key(path: &Path) -> Result<SigningKey, StorageError> {
        let bytes = std::fs::read(path)?;
        let raw: [u8; 32] =
            bytes
@@ -46,7 +46,7 @@ impl FileSigningKeyStorage {
 }

 impl SigningKeyStorage for FileSigningKeyStorage {
-    fn load_or_create(&self) -> std::result::Result<SigningKey, StorageError> {
+    fn load_or_create(&self) -> Result<SigningKey, StorageError> {
        if let Some(parent) = self.path.parent() {
            std::fs::create_dir_all(parent)?;
        }
@@ -126,7 +126,7 @@ mod tests {
                assert_eq!(expected, 32);
                assert_eq!(actual, 31);
            }
-            other => panic!("unexpected error: {other:?}"),
+            other @ StorageError::Io(_) => panic!("unexpected error: {other:?}"),
        }

        std::fs::remove_file(path).expect("temp key file should be removable");
--- a/server/crates/arbiter-client/src/transport.rs
+++ b/server/crates/arbiter-client/src/transport.rs
@@ -3,15 +3,15 @@ use arbiter_proto::proto::client::{ClientRequest, ClientResponse};
 use std::sync::atomic::{AtomicI32, Ordering};
 use tokio::sync::mpsc;

-pub(crate) const BUFFER_LENGTH: usize = 16;
+pub const BUFFER_LENGTH: usize = 16;
 static NEXT_REQUEST_ID: AtomicI32 = AtomicI32::new(1);

-pub(crate) fn next_request_id() -> i32 {
+pub fn next_request_id() -> i32 {
    NEXT_REQUEST_ID.fetch_add(1, Ordering::Relaxed)
 }

 #[derive(Debug, thiserror::Error)]
-pub(crate) enum ClientSignError {
+pub enum ClientSignError {
    #[error("Transport channel closed")]
    ChannelClosed,

@@ -19,27 +19,23 @@ pub(crate) enum ClientSignError {
    ConnectionClosed,
 }

-pub(crate) struct ClientTransport {
+pub struct ClientTransport {
    pub(crate) sender: mpsc::Sender<ClientRequest>,
    pub(crate) receiver: tonic::Streaming<ClientResponse>,
 }

 impl ClientTransport {
-    pub(crate) async fn send(
-        &mut self,
-        request: ClientRequest,
-    ) -> std::result::Result<(), ClientSignError> {
+    pub(crate) async fn send(&mut self, request: ClientRequest) -> Result<(), ClientSignError> {
        self.sender
            .send(request)
            .await
            .map_err(|_| ClientSignError::ChannelClosed)
    }

-    pub(crate) async fn recv(&mut self) -> std::result::Result<ClientResponse, ClientSignError> {
+    pub(crate) async fn recv(&mut self) -> Result<ClientResponse, ClientSignError> {
        match self.receiver.message().await {
            Ok(Some(resp)) => Ok(resp),
-            Ok(None) => Err(ClientSignError::ConnectionClosed),
-            Err(_) => Err(ClientSignError::ConnectionClosed),
+            Ok(None) | Err(_) => Err(ClientSignError::ConnectionClosed),
        }
    }
 }
--- a/server/crates/arbiter-client/src/wallets/evm.rs
+++ b/server/crates/arbiter-client/src/wallets/evm.rs
@@ -58,7 +58,11 @@ pub struct ArbiterEvmWallet {
 }

 impl ArbiterEvmWallet {
-    pub(crate) fn new(transport: Arc<Mutex<ClientTransport>>, address: Address) -> Self {
+    #[expect(
+        dead_code,
+        reason = "new will be used in future methods for creating wallets with different parameters"
+    )]
+    pub(crate) const fn new(transport: Arc<Mutex<ClientTransport>>, address: Address) -> Self {
        Self {
            transport,
            address,
@@ -66,11 +70,12 @@ impl ArbiterEvmWallet {
        }
    }

-    pub fn address(&self) -> Address {
+    pub const fn address(&self) -> Address {
        self.address
    }

-    pub fn with_chain_id(mut self, chain_id: ChainId) -> Self {
+    #[must_use]
+    pub const fn with_chain_id(mut self, chain_id: ChainId) -> Self {
        self.chain_id = Some(chain_id);
        self
    }
@@ -145,6 +150,7 @@ impl TxSigner<Signature> for ArbiterEvmWallet {
            .recv()
            .await
            .map_err(|_| Error::other("failed to receive evm sign transaction response"))?;
+        drop(transport);

        if response.request_id != Some(request_id) {
            return Err(Error::other(
--- a/server/crates/arbiter-crypto/src/authn/v1.rs
+++ b/server/crates/arbiter-crypto/src/authn/v1.rs
@@ -55,7 +55,7 @@ impl AuthChallenge {
            expected: NONCE_SIZE,
            actual: nonce.len(),
        })?;
-        Ok(AuthChallenge {
+        Ok(Self {
            nonce: *random_nonce,
            timestamp: DateTime::from_timestamp_nanos(timestamp),
        })
@@ -84,6 +84,7 @@ impl PublicKey {
        self.0.encode().0.to_vec()
    }

+    #[must_use]
    pub fn verify(&self, challenge: &AuthChallenge, context: &[u8], signature: &Signature) -> bool {
        let challenge = challenge.format();
        self.0
--- a/server/crates/arbiter-crypto/src/hashing.rs
+++ b/server/crates/arbiter-crypto/src/hashing.rs
@@ -50,7 +50,7 @@ impl<T: Hashable + PartialOrd> Hashable for Vec<T> {
    }
 }

-impl<T: Hashable + PartialOrd> Hashable for HashSet<T> {
+impl<T: Hashable + PartialOrd, S: std::hash::BuildHasher> Hashable for HashSet<T, S> {
    fn hash<H: Digest>(&self, hasher: &mut H) {
        let ref_sorted = {
            let mut sorted = self.iter().collect::<Vec<_>>();
--- a/server/crates/arbiter-crypto/src/safecell.rs
+++ b/server/crates/arbiter-crypto/src/safecell.rs
@@ -31,7 +31,7 @@ pub trait SafeCellHandle<T> {
        let mut cell = Self::new(T::default());
        {
            let mut handle = cell.write();
-            f(handle.deref_mut());
+            f(&mut *handle);
        }
        cell
    }
--- a/server/crates/arbiter-macros/src/hashable.rs
+++ b/server/crates/arbiter-macros/src/hashable.rs
@@ -18,7 +18,7 @@ pub(crate) fn derive(input: &DeriveInput) -> TokenStream {
    }
 }

-fn hashable_struct(input: &DeriveInput, struct_data: &syn::DataStruct) -> TokenStream {
+fn hashable_struct(input: &DeriveInput, struct_data: &DataStruct) -> TokenStream {
    let ident = &input.ident;
    let hashable_trait = HASHABLE_TRAIT_PATH.to_path();
    let hmac_digest = HMAC_DIGEST_PATH.to_path();
--- a/server/crates/arbiter-macros/src/utils.rs
+++ b/server/crates/arbiter-macros/src/utils.rs
@@ -1,4 +1,4 @@
-pub(crate) struct ToPath(pub(crate) &'static str);
+pub(crate) struct ToPath(pub &'static str);

 impl ToPath {
    pub(crate) fn to_path(&self) -> syn::Path {
@@ -7,13 +7,18 @@ impl ToPath {
 }

 macro_rules! ensure_path {
-    ($path:path) => {{
+    ($path:path as $name:ident) => {
+        const _: () = {
            #[cfg(test)]
-        #[expect(unused_imports)]
+            #[expect(
+                unused_imports,
+                reason = "Ensures the path is valid and will cause a compile error if not"
+            )]
            use $path as _;
-        ToPath(stringify!($path))
-    }};
+        };
+        pub(crate) const $name: ToPath = ToPath(stringify!($path));
+    };
 }

-pub(crate) const HASHABLE_TRAIT_PATH: ToPath = ensure_path!(::arbiter_crypto::hashing::Hashable);
-pub(crate) const HMAC_DIGEST_PATH: ToPath = ensure_path!(::arbiter_crypto::hashing::Digest);
+ensure_path!(::arbiter_crypto::hashing::Hashable as HASHABLE_TRAIT_PATH);
+ensure_path!(::arbiter_crypto::hashing::Digest as HMAC_DIGEST_PATH);
--- a/server/crates/arbiter-proto/src/url.rs
+++ b/server/crates/arbiter-proto/src/url.rs
@@ -104,7 +104,7 @@ mod tests {

    #[rstest]

-    fn test_parsing_correctness(
+    fn parsing_correctness(
        #[values("127.0.0.1", "localhost", "192.168.1.1", "some.domain.com")] host: &str,

        #[values(None, Some("token123".to_string()))] bootstrap_token: Option<String>,
--- a/server/crates/arbiter-server/src/actors/bootstrap.rs
+++ b/server/crates/arbiter-server/src/actors/bootstrap.rs
@@ -13,8 +13,8 @@ const TOKEN_LENGTH: usize = 64;
 pub async fn generate_token() -> Result<String, std::io::Error> {
    let rng: StdRng = make_rng();

-    let token: String = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
-        Default::default(),
+    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
+        String::default(),
        |mut accum, char| {
            accum += char.to_string().as_str();
            accum
@@ -31,11 +31,11 @@ pub enum Error {
    #[error("Database error: {0}")]
    Database(#[from] db::PoolError),

-    #[error("Database query error: {0}")]
-    Query(#[from] diesel::result::Error),
-
    #[error("I/O error: {0}")]
    Io(#[from] std::io::Error),
+
+    #[error("Database query error: {0}")]
+    Query(#[from] diesel::result::Error),
 }

 #[derive(Actor)]
@@ -69,16 +69,13 @@ impl Bootstrapper {
 impl Bootstrapper {
    #[message]
    pub fn is_correct_token(&self, token: String) -> bool {
-        match &self.token {
-            Some(expected) => {
+        self.token.as_ref().is_some_and(|expected| {
            let expected_bytes = expected.as_bytes();
            let token_bytes = token.as_bytes();

            let choice = expected_bytes.ct_eq(token_bytes);
            bool::from(choice)
-            }
-            None => false,
-        }
+        })
    }

    #[message]
--- a/server/crates/arbiter-server/src/actors/evm/mod.rs
+++ b/server/crates/arbiter-server/src/actors/evm/mod.rs
@@ -16,7 +16,9 @@ use crate::{
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};

-use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
+use alloy::{
+    consensus::TxEip1559, network::TxSignerSync as _, primitives::Address, signers::Signature,
+};
 use diesel::{
    ExpressionMethods, OptionalExtension as _, QueryDsl, SelectableHelper as _, dsl::insert_into,
 };
@@ -158,6 +160,7 @@ impl EvmActor {
    }

    #[message]
+    #[expect(clippy::unused_async, reason = "reserved for impl")]
    pub async fn useragent_delete_grant(&mut self, _grant_id: i32) -> Result<(), Error> {
        // let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
        // let vault = self.vault.clone();
@@ -267,7 +270,6 @@ impl EvmActor {
            .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
            .await?;

-        use alloy::network::TxSignerSync as _;
        Ok(signer.sign_transaction_sync(&mut transaction)?)
    }
 }
--- a/server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs
+++ b/server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs
@@ -42,7 +42,7 @@ impl Actor for ClientApprovalController {
    async fn on_start(
        Args {
            client,
-            mut user_agents,
+            user_agents,
            reply,
        }: Self::Args,
        actor_ref: ActorRef<Self>,
@@ -53,8 +53,9 @@ impl Actor for ClientApprovalController {
            reply: Some(reply),
        };

-        for user_agent in user_agents.drain(..) {
+        for user_agent in user_agents {
            actor_ref.link(&user_agent).await;
+
            let _ = user_agent
                .tell(BeginNewClientApproval {
                    client: client.clone(),
@@ -86,7 +87,7 @@ impl Actor for ClientApprovalController {
 #[messages]
 impl ClientApprovalController {
    #[message(ctx)]
-    pub async fn client_approval_answer(&mut self, approved: bool, ctx: &mut Context<Self, ()>) {
+    pub fn client_approval_answer(&mut self, approved: bool, ctx: &mut Context<Self, ()>) {
        if !approved {
            // Denial wins immediately regardless of other pending responses.
            self.send_reply(Ok(false));
--- a/server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
+++ b/server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
@@ -93,12 +93,9 @@ impl FlowCoordinator {
            unreachable!("Expected `request_client_approval` to have callback channel");
        };

-        let refs = match self.useragent_registry.ask(GetConnected).await {
-            Ok(refs) => refs,
-            Err(_) => {
+        let Ok(refs) = self.useragent_registry.ask(GetConnected).await else {
            reply_sender.send(Err(ApprovalError::NoUserAgentsConnected));
            return reply;
-            }
        };

        if refs.is_empty() {
--- a/server/crates/arbiter-server/src/actors/vault/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault/mod.rs
@@ -80,6 +80,7 @@ enum State {
 }

 /// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed).
+///
 /// Provides API for encrypting and decrypting data using the vault root key.
 /// Abstraction over database to make sure nonces are never reused and encryption keys are never exposed in plaintext outside of this actor.
 #[derive(Actor)]
@@ -126,7 +127,7 @@ impl Vault {
                        .first(conn)
                        .await?;

-                    let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|_| {
+                    let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
                        error!(
                            "Broken database: invalid nonce for root key history id={}",
                            root_key_id
@@ -149,7 +150,7 @@ impl Vault {
        Ok(nonce)
    }

-    fn expect_unsealed(state: &mut State) -> Result<&mut Unsealed, Error> {
+    const fn expect_unsealed(state: &mut State) -> Result<&mut Unsealed, Error> {
        match state {
            State::Unsealed(unsealed) => Ok(unsealed),
            State::Unbootstrapped => Err(Error::NotBootstrapped),
@@ -248,12 +249,11 @@ impl Vault {

        let mut root_key = SafeCell::new(current_key.ciphertext.clone());

-        let nonce = v1::Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(
-            |_| {
+        let nonce =
+            Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(|()| {
                error!("Broken database: invalid nonce for root key");
                Error::BrokenDatabase
-            },
-        )?;
+            })?;

        seal_key
            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
@@ -291,7 +291,7 @@ impl Vault {
                .ok_or(Error::NotFound)?
        };

-        let nonce = v1::Nonce::try_from(row.current_nonce.as_slice()).map_err(|_| {
+        let nonce = Nonce::try_from(row.current_nonce.as_slice()).map_err(|()| {
            error!(
                "Broken database: invalid nonce for aead_encrypted id={}",
                aead_id
@@ -408,15 +408,8 @@ impl Vault {

 #[cfg(test)]
 mod tests {
-    use diesel::SelectableHelper;
-
-    use diesel_async::RunQueryDsl;
-
-    use crate::{
-        actors::GlobalActors,
-        db::{self},
-    };
-    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+    use crate::actors::GlobalActors;
+    use arbiter_crypto::safecell::SafeCellHandle as _;

    use super::*;

--- a/server/crates/arbiter-server/src/context/mod.rs
+++ b/server/crates/arbiter-server/src/context/mod.rs
@@ -30,16 +30,16 @@ pub enum InitError {
    Io(#[from] std::io::Error),
 }

-pub struct _ServerContextInner {
+pub struct __ServerContextInner {
    pub db: db::DatabasePool,
    pub tls: TlsManager,
    pub actors: GlobalActors,
 }
 #[derive(Clone)]
-pub struct ServerContext(Arc<_ServerContextInner>);
+pub struct ServerContext(Arc<__ServerContextInner>);

 impl std::ops::Deref for ServerContext {
-    type Target = _ServerContextInner;
+    type Target = __ServerContextInner;

    fn deref(&self) -> &Self::Target {
        &self.0
@@ -48,7 +48,7 @@ impl std::ops::Deref for ServerContext {

 impl ServerContext {
    pub async fn new(db: db::DatabasePool) -> Result<Self, InitError> {
-        Ok(Self(Arc::new(_ServerContextInner {
+        Ok(Self(Arc::new(__ServerContextInner {
            actors: GlobalActors::spawn(db.clone()).await?,
            tls: TlsManager::new(db.clone()).await?,
            db,
--- a/server/crates/arbiter-server/src/context/tls.rs
+++ b/server/crates/arbiter-server/src/context/tls.rs
@@ -20,9 +20,10 @@ use thiserror::Error;
 use tonic::transport::CertificateDer;

 const ENCODE_CONFIG: pem::EncodeConfig = {
-    let line_ending = match cfg!(target_family = "windows") {
-        true => pem::LineEnding::CRLF,
-        false => pem::LineEnding::LF,
+    let line_ending = if cfg!(target_family = "windows") {
+        pem::LineEnding::CRLF
+    } else {
+        pem::LineEnding::LF
    };
    pem::EncodeConfig::new().set_line_ending(line_ending)
 };
@@ -50,11 +51,14 @@ pub enum InitError {

 pub type PemCert = String;

-pub fn encode_cert_to_pem(cert: &CertificateDer) -> PemCert {
+pub fn encode_cert_to_pem(cert: &CertificateDer<'_>) -> PemCert {
    pem::encode_config(&Pem::new("CERTIFICATE", cert.to_vec()), ENCODE_CONFIG)
 }

-#[allow(unused)]
+#[expect(
+    unused,
+    reason = "may be needed for future cert rotation implementation"
+)]
 struct SerializedTls {
    cert_pem: PemCert,
    cert_key_pem: String,
@@ -83,7 +87,7 @@ impl TlsCa {

        let cert_key_pem = certified_issuer.key().serialize_pem();

-        #[allow(
+        #[expect(
            clippy::unwrap_used,
            reason = "Broken cert couldn't bootstrap server anyway"
        )]
@@ -122,7 +126,11 @@ impl TlsCa {
        })
    }

-    #[allow(unused)]
+    #[expect(
+        unused,
+        clippy::unnecessary_wraps,
+        reason = "may be needed for future cert rotation implementation"
+    )]
    fn serialize(&self) -> Result<SerializedTls, InitError> {
        let cert_key_pem = self.issuer.key().serialize_pem();
        Ok(SerializedTls {
@@ -131,7 +139,10 @@ impl TlsCa {
        })
    }

-    #[allow(unused)]
+    #[expect(
+        unused,
+        reason = "may be needed for future cert rotation implementation"
+    )]
    fn try_deserialize(cert_pem: &str, cert_key_pem: &str) -> Result<Self, InitError> {
        let keypair =
            KeyPair::from_pem(cert_key_pem).map_err(InitError::KeyDeserializationError)?;
@@ -232,10 +243,10 @@ impl TlsManager {
        }
    }

-    pub fn cert(&self) -> &CertificateDer<'static> {
+    pub const fn cert(&self) -> &CertificateDer<'static> {
        &self.cert
    }
-    pub fn ca_cert(&self) -> &CertificateDer<'static> {
+    pub const fn ca_cert(&self) -> &CertificateDer<'static> {
        &self.ca_cert
    }

--- a/server/crates/arbiter-server/src/crypto/encryption/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/encryption/v1.rs
@@ -4,8 +4,8 @@ use rand::{
    rngs::{StdRng, SysRng},
 };

-pub const ROOT_KEY_TAG: &[u8] = "arbiter/seal/v1".as_bytes();
-pub const TAG: &[u8] = "arbiter/private-key/v1".as_bytes();
+pub const ROOT_KEY_TAG: &[u8] = b"arbiter/seal/v1";
+pub const TAG: &[u8] = b"arbiter/private-key/v1";

 pub const NONCE_LENGTH: usize = 24;

@@ -14,14 +14,16 @@ pub struct Nonce(pub [u8; NONCE_LENGTH]);
 impl Nonce {
    pub fn increment(&mut self) {
        for i in (0..self.0.len()).rev() {
-            if self.0[i] == 0xFF {
-                self.0[i] = 0;
+            if let Some(byte) = self.0.get_mut(i) {
+                if *byte == 0xFF {
+                    *byte = 0;
                } else {
-                self.0[i] += 1;
+                    *byte += 1;
                    break;
                }
            }
        }
+    }

    pub fn to_vec(&self) -> Vec<u8> {
        self.0.to_vec()
@@ -44,19 +46,14 @@ pub type Salt = [u8; ArgonSalt::RECOMMENDED_LENGTH];

 pub fn generate_salt() -> Salt {
    let mut salt = Salt::default();
-    #[allow(
-        clippy::unwrap_used,
-        reason = "Rng failure is unrecoverable and should panic"
-    )]
-    let mut rng = StdRng::try_from_rng(&mut SysRng).unwrap();
+    let mut rng =
+        StdRng::try_from_rng(&mut SysRng).expect("Rng failure is unrecoverable and should panic");
    rng.fill_bytes(&mut salt);
    salt
 }

 #[cfg(test)]
 mod tests {
-    use std::ops::Deref as _;
-
    use super::*;
    use crate::crypto::derive_key;
    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
@@ -74,7 +71,7 @@ mod tests {
        let key1_reader = key1.0.read();
        let key2_reader = key2.0.read();

-        assert_eq!(key1_reader.deref(), key2_reader.deref());
+        assert_eq!(&*key1_reader, &*key2_reader);
    }

    #[test]
@@ -85,14 +82,13 @@ mod tests {

        let mut key = derive_key(password, &salt);
        let key_reader = key.0.read();
-        let key_ref = key_reader.deref();

-        assert_ne!(key_ref.as_slice(), &[0u8; 32][..]);
+        assert_ne!(key_reader.as_slice(), &[0u8; 32][..]);
    }

    #[test]
    // We should fuzz this
-    fn test_nonce_increment() {
+    pub fn nonce_increment() {
        let mut nonce = Nonce([0u8; NONCE_LENGTH]);
        nonce.increment();

--- a/server/crates/arbiter-server/src/crypto/integrity/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/integrity/v1.rs
@@ -64,6 +64,11 @@ fn payload_hash(payload: &impl Hashable) -> [u8; 32] {
 }

 fn push_len_prefixed(out: &mut Vec<u8>, bytes: &[u8]) {
+    #[expect(
+        clippy::cast_possible_truncation,
+        clippy::as_conversions,
+        reason = "fixme! #85"
+    )]
    out.extend_from_slice(&(bytes.len() as u32).to_be_bytes());
    out.extend_from_slice(bytes);
 }
@@ -115,7 +120,7 @@ pub async fn sign_entity<E: Integrable>(
            .ask(SignIntegrity { mac_input })
            .await
            .map_err(|err| match err {
-                kameo::error::SendError::HandlerError(inner) => Error::Vault(inner),
+                SendError::HandlerError(inner) => Error::Vault(inner),
                _ => Error::VaultSend,
            })?;

@@ -125,7 +130,7 @@ pub async fn sign_entity<E: Integrable>(
            entity_id,
            payload_version: E::VERSION,
            key_version,
-            mac: mac.to_vec(),
+            mac: mac.clone(),
        })
        .on_conflict((
            integrity_envelope::entity_id,
@@ -239,12 +244,12 @@ mod tests {

    #[tokio::test]
    async fn sign_writes_envelope_and_verify_passes() {
+        const ENTITY_ID: &[u8] = b"entity-id-7";
+
        let db = db::create_test_pool().await;
        let vault = bootstrapped_vault(&db).await;
        let mut conn = db.get().await.unwrap();

-        const ENTITY_ID: &[u8] = b"entity-id-7";
-
        let entity = DummyEntity {
            payload_version: 1,
            payload: b"payload-v1".to_vec(),
@@ -270,12 +275,12 @@ mod tests {

    #[tokio::test]
    async fn tampered_mac_fails_verification() {
+        const ENTITY_ID: &[u8] = b"entity-id-11";
+
        let db = db::create_test_pool().await;
        let vault = bootstrapped_vault(&db).await;
        let mut conn = db.get().await.unwrap();

-        const ENTITY_ID: &[u8] = b"entity-id-11";
-
        let entity = DummyEntity {
            payload_version: 1,
            payload: b"payload-v1".to_vec(),
@@ -301,12 +306,12 @@ mod tests {

    #[tokio::test]
    async fn changed_payload_fails_verification() {
+        const ENTITY_ID: &[u8] = b"entity-id-21";
+
        let db = db::create_test_pool().await;
        let vault = bootstrapped_vault(&db).await;
        let mut conn = db.get().await.unwrap();

-        const ENTITY_ID: &[u8] = b"entity-id-21";
-
        let entity = DummyEntity {
            payload_version: 1,
            payload: b"payload-v1".to_vec(),
--- a/server/crates/arbiter-server/src/crypto/mod.rs
+++ b/server/crates/arbiter-server/src/crypto/mod.rs
@@ -10,7 +10,6 @@ use rand::{
    Rng as _, SeedableRng as _,
    rngs::{StdRng, SysRng},
 };
-use std::ops::Deref as _;

 pub mod encryption;
 pub mod integrity;
@@ -39,11 +38,8 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
 impl KeyCell {
    pub fn new_secure_random() -> Self {
        let key = SafeCell::new_inline(|key_buffer: &mut Key| {
-            #[allow(
-                clippy::unwrap_used,
-                reason = "Rng failure is unrecoverable and should panic"
-            )]
-            let mut rng = StdRng::try_from_rng(&mut SysRng).unwrap();
+            let mut rng = StdRng::try_from_rng(&mut SysRng)
+                .expect("Rng failure is unrecoverable and should panic");
            rng.fill_bytes(key_buffer);
        });

@@ -57,8 +53,7 @@ impl KeyCell {
        mut buffer: impl AsMut<Vec<u8>>,
    ) -> Result<(), Error> {
        let key_reader = self.0.read();
-        let key_ref = key_reader.deref();
-        let cipher = XChaCha20Poly1305::new(key_ref);
+        let cipher = XChaCha20Poly1305::new(&key_reader);
        let nonce = XNonce::from_slice(nonce.0.as_ref());
        let buffer = buffer.as_mut();
        cipher.encrypt_in_place(nonce, associated_data, buffer)
@@ -70,8 +65,7 @@ impl KeyCell {
        buffer: &mut SafeCell<Vec<u8>>,
    ) -> Result<(), Error> {
        let key_reader = self.0.read();
-        let key_ref = key_reader.deref();
-        let cipher = XChaCha20Poly1305::new(key_ref);
+        let cipher = XChaCha20Poly1305::new(&key_reader);
        let nonce = XNonce::from_slice(nonce.0.as_ref());
        let mut buffer = buffer.write();
        let buffer: &mut Vec<u8> = buffer.as_mut();
@@ -85,8 +79,7 @@ impl KeyCell {
        plaintext: impl AsRef<[u8]>,
    ) -> Result<Vec<u8>, Error> {
        let key_reader = self.0.read();
-        let key_ref = key_reader.deref();
-        let mut cipher = XChaCha20Poly1305::new(key_ref);
+        let mut cipher = XChaCha20Poly1305::new(&key_reader);
        let nonce = XNonce::from_slice(nonce.0.as_ref());

        let ciphertext = cipher.encrypt(
@@ -114,20 +107,15 @@ pub fn derive_key(mut password: SafeCell<Vec<u8>>, salt: &Salt) -> KeyCell {
        }
    };

-    #[allow(clippy::unwrap_used)]
    let hasher = Argon2::new(Algorithm::Argon2id, argon2::Version::V0x13, params);
    let mut key = SafeCell::new(Key::default());
    password.read_inline(|password_source| {
        let mut key_buffer = key.write();
        let key_buffer: &mut [u8] = key_buffer.as_mut();

-        #[allow(
-            clippy::unwrap_used,
-            reason = "Better fail completely than return a weak key"
-        )]
        hasher
-            .hash_password_into(password_source.deref(), salt, key_buffer)
-            .unwrap();
+            .hash_password_into(password_source, salt, key_buffer)
+            .expect("Better fail completely than return a weak key");
    });

    key.into()
--- a/server/crates/arbiter-server/src/db/mod.rs
+++ b/server/crates/arbiter-server/src/db/mod.rs
@@ -22,14 +22,14 @@ const MIGRATIONS: EmbeddedMigrations = embed_migrations!("migrations");

 #[derive(Error, Debug)]
 pub enum DatabaseSetupError {
-    #[error("Failed to determine home directory")]
-    HomeDir(std::io::Error),
+    #[error(transparent)]
+    ConcurrencySetup(diesel::result::Error),

    #[error(transparent)]
    Connection(diesel::ConnectionError),

-    #[error(transparent)]
-    ConcurrencySetup(diesel::result::Error),
+    #[error("Failed to determine home directory")]
+    HomeDir(std::io::Error),

    #[error(transparent)]
    Migration(Box<dyn std::error::Error + Send + Sync>),
@@ -40,10 +40,11 @@ pub enum DatabaseSetupError {

 #[derive(Error, Debug)]
 pub enum DatabaseError {
-    #[error("Database connection error")]
-    Pool(#[from] PoolError),
    #[error("Database query error")]
    Connection(#[from] diesel::result::Error),
+
+    #[error("Database connection error")]
+    Pool(#[from] PoolError),
 }

 #[tracing::instrument(level = "info")]
@@ -92,13 +93,16 @@ fn initialize_database(url: &str) -> Result<(), DatabaseSetupError> {
 }

 #[tracing::instrument(level = "info")]
+/// Creates a connection pool for the `SQLite` database.
+///
+/// # Panics
+/// Panics if the database path is not valid UTF-8.
 pub async fn create_pool(url: Option<&str>) -> Result<DatabasePool, DatabaseSetupError> {
    let database_url = url.map(String::from).unwrap_or(
-        #[allow(clippy::expect_used)]
        database_path()?
            .to_str()
            .expect("database path is not valid UTF-8")
-            .to_string(),
+            .to_owned(),
    );

    initialize_database(&database_url)?;
@@ -133,19 +137,19 @@ pub async fn create_pool(url: Option<&str>) -> Result<DatabasePool, DatabaseSetu
 }

 #[mutants::skip]
+#[expect(clippy::missing_panics_doc, reason = "Tests oriented function")]
+/// Creates a test database pool with a temporary `SQLite` database file.
 pub async fn create_test_pool() -> DatabasePool {
    use rand::distr::{Alphanumeric, SampleString as _};

    let tempfile_name = Alphanumeric.sample_string(&mut rand::rng(), 16);

    let file = std::env::temp_dir().join(tempfile_name);
-    #[allow(clippy::expect_used)]
    let url = file
        .to_str()
        .expect("temp file path is not valid UTF-8")
-        .to_string();
+        .to_owned();

-    #[allow(clippy::expect_used)]
    create_pool(Some(&url))
        .await
        .expect("Failed to create test database pool")
--- a/server/crates/arbiter-server/src/db/models.rs
+++ b/server/crates/arbiter-server/src/db/models.rs
@@ -1,5 +1,7 @@
-#![allow(unused)]
-#![allow(clippy::all)]
+#![allow(
+    clippy::duplicated_attributes,
+    reason = "restructed's #[view] causes false positives"
+)]
 use crate::db::schema::{
    self, aead_encrypted, arbiter_settings, evm_basic_grant, evm_ether_transfer_grant,
    evm_ether_transfer_grant_target, evm_ether_transfer_limit, evm_token_transfer_grant,
@@ -7,7 +9,6 @@ use crate::db::schema::{
    integrity_envelope, root_key_history, tls_history,
 };

-use chrono::{DateTime, Utc};
 use diesel::{prelude::*, sqlite::Sqlite};
 use restructed::Models;

@@ -27,16 +28,16 @@ pub mod types {
    pub struct SqliteTimestamp(pub DateTime<Utc>);
    impl SqliteTimestamp {
        pub fn now() -> Self {
-            SqliteTimestamp(Utc::now())
+            Self(Utc::now())
        }
    }

-    impl From<chrono::DateTime<Utc>> for SqliteTimestamp {
-        fn from(dt: chrono::DateTime<Utc>) -> Self {
-            SqliteTimestamp(dt)
+    impl From<DateTime<Utc>> for SqliteTimestamp {
+        fn from(dt: DateTime<Utc>) -> Self {
+            Self(dt)
        }
    }
-    impl From<SqliteTimestamp> for chrono::DateTime<Utc> {
+    impl From<SqliteTimestamp> for DateTime<Utc> {
        fn from(ts: SqliteTimestamp) -> Self {
            ts.0
        }
@@ -47,6 +48,11 @@ pub mod types {
            &'b self,
            out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
        ) -> diesel::serialize::Result {
+            #[expect(
+                clippy::cast_possible_truncation,
+                clippy::as_conversions,
+                reason = "fixme! #84; this will break up in 2038 :3"
+            )]
            let unix_timestamp = self.0.timestamp() as i32;
            out.set_value(unix_timestamp);
            Ok(IsNull::No)
@@ -69,7 +75,47 @@ pub mod types {
            let datetime =
                DateTime::from_timestamp(unix_timestamp, 0).ok_or("Timestamp is out of bounds")?;

-            Ok(SqliteTimestamp(datetime))
+            Ok(Self(datetime))
+        }
+    }
+
+    #[derive(Debug, FromSqlRow, AsExpression, Clone)]
+    #[diesel(sql_type = Integer)]
+    #[repr(transparent)] // hint compiler to optimize the wrapper struct away
+    pub struct ChainId(pub i32);
+
+    #[expect(
+        clippy::cast_sign_loss,
+        clippy::cast_possible_truncation,
+        clippy::as_conversions,
+        reason = "safe because chain_id is stored as i32 but is guaranteed to be a valid ChainId by the API when creating grants"
+    )]
+    const _: () = {
+        impl From<ChainId> for alloy::primitives::ChainId {
+            fn from(chain_id: ChainId) -> Self {
+                chain_id.0 as Self
+            }
+        }
+        impl From<alloy::primitives::ChainId> for ChainId {
+            fn from(chain_id: alloy::primitives::ChainId) -> Self {
+                Self(chain_id as _)
+            }
+        }
+    };
+
+    impl FromSql<Integer, Sqlite> for ChainId {
+        fn from_sql(
+            bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
+        ) -> diesel::deserialize::Result<Self> {
+            FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
+        }
+    }
+    impl ToSql<Integer, Sqlite> for ChainId {
+        fn to_sql<'b>(
+            &'b self,
+            out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
+        ) -> diesel::serialize::Result {
+            ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
        }
    }
 }
@@ -235,7 +281,7 @@ pub struct EvmEtherTransferLimit {
 pub struct EvmBasicGrant {
    pub id: i32,
    pub wallet_access_id: i32, // references evm_wallet_access.id
-    pub chain_id: i32,
+    pub chain_id: ChainId,
    pub valid_from: Option<SqliteTimestamp>,
    pub valid_until: Option<SqliteTimestamp>,
    pub max_gas_fee_per_gas: Option<Vec<u8>>,
@@ -258,7 +304,7 @@ pub struct EvmTransactionLog {
    pub id: i32,
    pub grant_id: i32,
    pub wallet_access_id: i32,
-    pub chain_id: i32,
+    pub chain_id: ChainId,
    pub eth_value: Vec<u8>,
    pub signed_at: SqliteTimestamp,
 }
@@ -333,7 +379,7 @@ pub struct EvmTokenTransferLog {
    pub id: i32,
    pub grant_id: i32,
    pub log_id: i32,
-    pub chain_id: i32,
+    pub chain_id: ChainId,
    pub token_contract: Vec<u8>,
    pub recipient_address: Vec<u8>,
    pub value: Vec<u8>,
--- a/server/crates/arbiter-server/src/evm/abi.rs
+++ b/server/crates/arbiter-server/src/evm/abi.rs
@@ -45,7 +45,7 @@ sol! {

 sol! {
    /// Permit2 — Uniswap's canonical token approval manager.
-    /// Replaces per-contract ERC-20 approve() with a single approval hub.
+    /// Replaces per-contract ERC-20 `approve()` with a single approval hub.
    #[derive(Debug)]
    interface IPermit2 {
        struct TokenPermissions {
--- a/server/crates/arbiter-server/src/evm/mod.rs
+++ b/server/crates/arbiter-server/src/evm/mod.rs
@@ -34,7 +34,7 @@ mod utils;
 #[derive(Debug, thiserror::Error)]
 pub enum PolicyError {
    #[error("Database error")]
-    Database(#[from] crate::db::DatabaseError),
+    Database(#[from] DatabaseError),
    #[error("Transaction violates policy: {0:?}")]
    Violations(Vec<EvalViolation>),
    #[error("No matching grant found")]
@@ -66,7 +66,7 @@ pub enum AnalyzeError {
 #[derive(Debug, thiserror::Error)]
 pub enum ListError {
    #[error("Database error")]
-    Database(#[from] crate::db::DatabaseError),
+    Database(#[from] DatabaseError),

    #[error("Integrity verification failed for grant")]
    Integrity(#[from] integrity::Error),
@@ -127,7 +127,7 @@ async fn check_shared_constraints(
            .get_result(conn)
            .await?;

-        if count >= rate_limit.count as i64 {
+        if count >= rate_limit.count.into() {
            violations.push(EvalViolation::RateLimitExceeded);
        }
    }
@@ -185,7 +185,7 @@ impl Engine {
                        .values(&NewEvmTransactionLog {
                            grant_id: grant.common_settings_id,
                            wallet_access_id: context.target.id,
-                            chain_id: context.chain as i32,
+                            chain_id: context.chain.into(),
                            eth_value: utils::u256_to_bytes(context.value).to_vec(),
                            signed_at: Utc::now().into(),
                        })
@@ -207,7 +207,7 @@ impl Engine {
 }

 impl Engine {
-    pub fn new(db: db::DatabasePool, vault: ActorRef<Vault>) -> Self {
+    pub const fn new(db: db::DatabasePool, vault: ActorRef<Vault>) -> Self {
        Self { db, vault }
    }

@@ -226,9 +226,15 @@ impl Engine {
                Box::pin(async move {
                    use schema::evm_basic_grant;

+                    #[expect(
+                        clippy::cast_possible_truncation,
+                        clippy::cast_possible_wrap,
+                        clippy::as_conversions,
+                        reason = "fixme! #86"
+                    )]
                    let basic_grant: EvmBasicGrant = insert_into(evm_basic_grant::table)
                        .values(&NewEvmBasicGrant {
-                            chain_id: full_grant.shared.chain as i32,
+                            chain_id: full_grant.shared.chain.into(),
                            wallet_access_id: full_grant.shared.wallet_access_id,
                            valid_from: full_grant.shared.valid_from.map(SqliteTimestamp),
                            valid_until: full_grant.shared.valid_until.map(SqliteTimestamp),
@@ -313,7 +319,7 @@ impl Engine {
        let TxKind::Call(to) = transaction.to else {
            return Err(VetError::ContractCreationNotSupported);
        };
-        let context = policies::EvalContext {
+        let context = EvalContext {
            target,
            chain: transaction.chain_id,
            to,
@@ -404,10 +410,16 @@ mod tests {
        conn: &mut DatabaseConnection,
        shared: &SharedGrantSettings,
    ) -> EvmBasicGrant {
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::cast_possible_wrap,
+            clippy::as_conversions,
+            reason = "fixme! #86"
+        )]
        insert_into(evm_basic_grant::table)
            .values(NewEvmBasicGrant {
                wallet_access_id: shared.wallet_access_id,
-                chain_id: shared.chain as i32,
+                chain_id: shared.chain.into(),
                valid_from: shared.valid_from.map(SqliteTimestamp),
                valid_until: shared.valid_until.map(SqliteTimestamp),
                max_gas_fee_per_gas: shared
@@ -571,7 +583,7 @@ mod tests {
            .values(NewEvmTransactionLog {
                grant_id: basic_grant.id,
                wallet_access_id: WALLET_ACCESS_ID,
-                chain_id: CHAIN_ID as i32,
+                chain_id: CHAIN_ID.into(),
                eth_value: super::utils::u256_to_bytes(U256::ZERO).to_vec(),
                signed_at: SqliteTimestamp(Utc::now()),
            })
--- a/server/crates/arbiter-server/src/evm/policies.rs
+++ b/server/crates/arbiter-server/src/evm/policies.rs
@@ -1,6 +1,6 @@
 use crate::{
    crypto::integrity::v1::Integrable,
-    db::models::{self, EvmBasicGrant, EvmWalletAccess},
+    db::models::{EvmBasicGrant, EvmWalletAccess},
    evm::utils,
 };

@@ -85,10 +85,10 @@ pub trait Policy: Sized {

    // Create a new grant in the database based on the provided grant details, and return its ID
    fn create_grant(
-        basic: &models::EvmBasicGrant,
+        basic: &EvmBasicGrant,
        grant: &Self::Settings,
        conn: &mut impl AsyncConnection<Backend = Sqlite>,
-    ) -> impl std::future::Future<Output = QueryResult<DatabaseID>> + Send;
+    ) -> impl Future<Output = QueryResult<DatabaseID>> + Send;

    // Try to find an existing grant that matches the transaction context, and return its details if found
    // Additionally, return ID of basic grant for shared-logic checks like rate limits and validity periods
@@ -155,7 +155,7 @@ impl SharedGrantSettings {
    pub(crate) fn try_from_model(model: EvmBasicGrant) -> QueryResult<Self> {
        Ok(Self {
            wallet_access_id: model.wallet_access_id,
-            chain: model.chain_id as u64, // safe because chain_id is stored as i32 but is guaranteed to be a valid ChainId by the API when creating grants
+            chain: model.chain_id.into(),
            valid_from: model.valid_from.map(Into::into),
            valid_until: model.valid_until.map(Into::into),
            max_gas_fee_per_gas: model
@@ -166,10 +166,11 @@ impl SharedGrantSettings {
                .max_priority_fee_per_gas
                .map(|b| utils::try_bytes_to_u256(&b))
                .transpose()?,
+            #[expect(clippy::cast_sign_loss, clippy::as_conversions, reason = "fixme! #86")]
            rate_limit: match (model.rate_limit_count, model.rate_limit_window_secs) {
                (Some(count), Some(window_secs)) => Some(TransactionRateLimit {
                    count: count as u32,
-                    window: Duration::seconds(window_secs as i64),
+                    window: Duration::seconds(window_secs.into()),
                }),
                _ => None,
            },
@@ -179,7 +180,7 @@ impl SharedGrantSettings {
    pub async fn query_by_id(
        conn: &mut impl AsyncConnection<Backend = Sqlite>,
        id: i32,
-    ) -> diesel::result::QueryResult<Self> {
+    ) -> QueryResult<Self> {
        use crate::db::schema::evm_basic_grant;

        let basic_grant: EvmBasicGrant = evm_basic_grant::table
--- a/server/crates/arbiter-server/src/evm/policies/ether_transfer/mod.rs
+++ b/server/crates/arbiter-server/src/evm/policies/ether_transfer/mod.rs
@@ -7,7 +7,7 @@ use crate::{
    },
    db::schema::{evm_basic_grant, evm_ether_transfer_limit, evm_transaction_log},
    db::{
-        models::{self, NewEvmEtherTransferGrant, NewEvmEtherTransferGrantTarget},
+        models::{NewEvmEtherTransferGrant, NewEvmEtherTransferGrantTarget},
        schema::{evm_ether_transfer_grant, evm_ether_transfer_grant_target},
    },
    evm::policies::{
@@ -20,7 +20,6 @@ use crate::{
 use alloy::primitives::{Address, U256};
 use chrono::{DateTime, Duration, Utc};
 use diesel::{
-    ExpressionMethods, JoinOnDsl,
    dsl::{auto_type, insert_into},
    prelude::*,
    sqlite::Sqlite,
@@ -47,8 +46,8 @@ impl Display for Meaning {
    }
 }
 impl From<Meaning> for SpecificMeaning {
-    fn from(val: Meaning) -> SpecificMeaning {
-        SpecificMeaning::EtherTransfer(val)
+    fn from(val: Meaning) -> Self {
+        Self::EtherTransfer(val)
    }
 }

@@ -63,8 +62,8 @@ impl Integrable for Settings {
 }

 impl From<Settings> for SpecificGrant {
-    fn from(val: Settings) -> SpecificGrant {
-        SpecificGrant::EtherTransfer(val)
+    fn from(val: Settings) -> Self {
+        Self::EtherTransfer(val)
    }
 }

@@ -75,9 +74,7 @@ async fn query_relevant_past_transaction(
 ) -> QueryResult<Vec<(U256, DateTime<Utc>)>> {
    let past_transactions: Vec<(Vec<u8>, SqliteTimestamp)> = evm_transaction_log::table
        .filter(evm_transaction_log::grant_id.eq(grant_id))
-        .filter(
-            evm_transaction_log::signed_at.ge(SqliteTimestamp(chrono::Utc::now() - longest_window)),
-        )
+        .filter(evm_transaction_log::signed_at.ge(SqliteTimestamp(Utc::now() - longest_window)))
        .select((
            evm_transaction_log::eth_value,
            evm_transaction_log::signed_at,
@@ -104,7 +101,7 @@ async fn check_rate_limits(

    let past_transaction = query_relevant_past_transaction(grant.id, window, db).await?;

-    let window_start = chrono::Utc::now() - grant.settings.specific.limit.window;
+    let window_start = Utc::now() - grant.settings.specific.limit.window;
    let prospective_cumulative_volume: U256 = past_transaction
        .iter()
        .filter(|(_, timestamp)| timestamp >= &window_start)
@@ -154,10 +151,15 @@ impl Policy for EtherTransfer {
    }

    async fn create_grant(
-        basic: &models::EvmBasicGrant,
+        basic: &EvmBasicGrant,
        grant: &Self::Settings,
        conn: &mut impl AsyncConnection<Backend = Sqlite>,
-    ) -> diesel::result::QueryResult<DatabaseID> {
+    ) -> QueryResult<DatabaseID> {
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::as_conversions,
+            reason = "fixme! #86"
+        )]
        let limit_id: i32 = insert_into(evm_ether_transfer_limit::table)
            .values(NewEvmEtherTransferLimit {
                window_secs: grant.limit.window.num_seconds() as i32,
@@ -192,7 +194,7 @@ impl Policy for EtherTransfer {
    async fn try_find_grant(
        context: &EvalContext,
        conn: &mut impl AsyncConnection<Backend = Sqlite>,
-    ) -> diesel::result::QueryResult<Option<Grant<Self::Settings>>> {
+    ) -> QueryResult<Option<Grant<Self::Settings>>> {
        let target_bytes = context.to.to_vec();

        // Find a grant where:
@@ -246,7 +248,7 @@ impl Policy for EtherTransfer {
            limit: VolumeRateLimit {
                max_volume: utils::try_bytes_to_u256(&limit.max_volume)
                    .map_err(|err| diesel::result::Error::DeserializationError(Box::new(err)))?,
-                window: chrono::Duration::seconds(limit.window_secs as i64),
+                window: Duration::seconds(limit.window_secs.into()),
            },
        };

@@ -266,7 +268,7 @@ impl Policy for EtherTransfer {
        _log_id: i32,
        _grant: &Grant<Self::Settings>,
        _conn: &mut impl AsyncConnection<Backend = Sqlite>,
-    ) -> diesel::result::QueryResult<()> {
+    ) -> QueryResult<()> {
        // Basic log is sufficient

        Ok(())
@@ -319,7 +321,7 @@ impl Policy for EtherTransfer {
            .map(|(basic, specific)| {
                let targets: Vec<Address> = targets_by_grant
                    .get(&specific.id)
-                    .map(|v| v.as_slice())
+                    .map(Vec::as_slice)
                    .unwrap_or_default()
                    .iter()
                    .filter_map(|t| {
@@ -343,7 +345,7 @@ impl Policy for EtherTransfer {
                                max_volume: utils::try_bytes_to_u256(&limit.max_volume).map_err(
                                    |e| diesel::result::Error::DeserializationError(Box::new(e)),
                                )?,
-                                window: Duration::seconds(limit.window_secs as i64),
+                                window: Duration::seconds(limit.window_secs.into()),
                            },
                        },
                    },
--- a/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
@@ -22,7 +22,7 @@ use diesel::{SelectableHelper, insert_into};
 use diesel_async::RunQueryDsl;

 const WALLET_ACCESS_ID: i32 = 1;
-const CHAIN_ID: u64 = 1;
+const CHAIN_ID: alloy::primitives::ChainId = 1;

 const ALLOWED: Address = address!("1111111111111111111111111111111111111111");
 const OTHER: Address = address!("2222222222222222222222222222222222222222");
@@ -48,7 +48,7 @@ async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicG
    insert_into(evm_basic_grant::table)
        .values(NewEvmBasicGrant {
            wallet_access_id: WALLET_ACCESS_ID,
-            chain_id: CHAIN_ID as i32,
+            chain_id: CHAIN_ID.into(),
            valid_from: None,
            valid_until: None,
            max_gas_fee_per_gas: None,
@@ -161,7 +161,7 @@ async fn evaluate_passes_when_volume_within_limit() {
        .values(NewEvmTransactionLog {
            grant_id,
            wallet_access_id: WALLET_ACCESS_ID,
-            chain_id: CHAIN_ID as i32,
+            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(500u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
        })
@@ -203,7 +203,7 @@ async fn evaluate_rejects_volume_over_limit() {
        .values(NewEvmTransactionLog {
            grant_id,
            wallet_access_id: WALLET_ACCESS_ID,
-            chain_id: CHAIN_ID as i32,
+            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(1_000u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
        })
@@ -246,7 +246,7 @@ async fn evaluate_passes_at_exactly_volume_limit() {
        .values(NewEvmTransactionLog {
            grant_id,
            wallet_access_id: WALLET_ACCESS_ID,
-            chain_id: CHAIN_ID as i32,
+            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(900u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
        })
--- a/server/crates/arbiter-server/src/evm/policies/token_transfers/mod.rs
+++ b/server/crates/arbiter-server/src/evm/policies/token_transfers/mod.rs
@@ -27,7 +27,6 @@ use alloy::{
 };
 use chrono::{DateTime, Duration, Utc};
 use diesel::{
-    ExpressionMethods,
    dsl::{auto_type, insert_into},
    prelude::*,
    sqlite::Sqlite,
@@ -58,8 +57,8 @@ impl std::fmt::Display for Meaning {
    }
 }
 impl From<Meaning> for SpecificMeaning {
-    fn from(val: Meaning) -> SpecificMeaning {
-        SpecificMeaning::TokenTransfer(val)
+    fn from(val: Meaning) -> Self {
+        Self::TokenTransfer(val)
    }
 }

@@ -75,8 +74,8 @@ impl Integrable for Settings {
 }

 impl From<Settings> for SpecificGrant {
-    fn from(val: Settings) -> SpecificGrant {
-        SpecificGrant::TokenTransfer(val)
+    fn from(val: Settings) -> Self {
+        Self::TokenTransfer(val)
    }
 }

@@ -87,10 +86,7 @@ async fn query_relevant_past_transfers(
 ) -> QueryResult<Vec<(U256, DateTime<Utc>)>> {
    let past_logs: Vec<(Vec<u8>, SqliteTimestamp)> = evm_token_transfer_log::table
        .filter(evm_token_transfer_log::grant_id.eq(grant_id))
-        .filter(
-            evm_token_transfer_log::created_at
-                .ge(SqliteTimestamp(chrono::Utc::now() - longest_window)),
-        )
+        .filter(evm_token_transfer_log::created_at.ge(SqliteTimestamp(Utc::now() - longest_window)))
        .select((
            evm_token_transfer_log::value,
            evm_token_transfer_log::created_at,
@@ -130,7 +126,7 @@ async fn check_volume_rate_limits(
    let past_transfers = query_relevant_past_transfers(grant.id, longest_window, db).await?;

    for limit in &grant.settings.specific.volume_limits {
-        let window_start = chrono::Utc::now() - limit.window;
+        let window_start = Utc::now() - limit.window;
        let prospective_cumulative_volume: U256 = past_transfers
            .iter()
            .filter(|(_, timestamp)| timestamp >= &window_start)
@@ -206,6 +202,11 @@ impl Policy for TokenTransfer {
            .await?;

        for limit in &grant.volume_limits {
+            #[expect(
+                clippy::cast_possible_truncation,
+                clippy::as_conversions,
+                reason = "fixme! #86"
+            )]
            insert_into(evm_token_transfer_volume_limit::table)
                .values(NewEvmTokenTransferVolumeLimit {
                    grant_id,
@@ -255,7 +256,7 @@ impl Policy for TokenTransfer {
                    max_volume: utils::try_bytes_to_u256(&row.max_volume).map_err(|err| {
                        diesel::result::Error::DeserializationError(Box::new(err))
                    })?,
-                    window: Duration::seconds(row.window_secs as i64),
+                    window: Duration::seconds(row.window_secs.into()),
                })
            })
            .collect::<QueryResult<Vec<_>>>()?;
@@ -305,7 +306,7 @@ impl Policy for TokenTransfer {
            .values(NewEvmTokenTransferLog {
                grant_id: grant.id,
                log_id,
-                chain_id: context.chain as i32,
+                chain_id: context.chain.into(),
                token_contract: context.to.to_vec(),
                recipient_address: meaning.to.to_vec(),
                value: utils::u256_to_bytes(meaning.value).to_vec(),
@@ -354,7 +355,7 @@ impl Policy for TokenTransfer {
            .map(|(basic, specific)| {
                let volume_limits: Vec<VolumeRateLimit> = limits_by_grant
                    .get(&specific.id)
-                    .map(|v| v.as_slice())
+                    .map(Vec::as_slice)
                    .unwrap_or_default()
                    .iter()
                    .map(|row| {
@@ -362,7 +363,7 @@ impl Policy for TokenTransfer {
                            max_volume: utils::try_bytes_to_u256(&row.max_volume).map_err(|e| {
                                diesel::result::Error::DeserializationError(Box::new(e))
                            })?,
-                            window: Duration::seconds(row.window_secs as i64),
+                            window: Duration::seconds(row.window_secs.into()),
                        })
                    })
                    .collect::<QueryResult<Vec<_>>>()?;
--- a/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
@@ -62,7 +62,7 @@ async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicG
    insert_into(evm_basic_grant::table)
        .values(NewEvmBasicGrant {
            wallet_access_id: WALLET_ACCESS_ID,
-            chain_id: CHAIN_ID as i32,
+            chain_id: CHAIN_ID.into(),
            valid_from: None,
            valid_until: None,
            max_gas_fee_per_gas: None,
@@ -241,12 +241,11 @@ async fn evaluate_passes_volume_at_exact_limit() {
        .unwrap();

    // Record a past transfer of 900, with current transfer 100 => exactly 1000 limit
-    use crate::db::{models::NewEvmTokenTransferLog, schema::evm_token_transfer_log};
-    insert_into(evm_token_transfer_log::table)
-        .values(NewEvmTokenTransferLog {
+    insert_into(db::schema::evm_token_transfer_log::table)
+        .values(db::models::NewEvmTokenTransferLog {
            grant_id,
            log_id: 0,
-            chain_id: CHAIN_ID as i32,
+            chain_id: CHAIN_ID.into(),
            token_contract: DAI.to_vec(),
            recipient_address: RECIPIENT.to_vec(),
            value: utils::u256_to_bytes(U256::from(900u64)).to_vec(),
@@ -286,12 +285,11 @@ async fn evaluate_rejects_volume_over_limit() {
        .await
        .unwrap();

-    use crate::db::{models::NewEvmTokenTransferLog, schema::evm_token_transfer_log};
-    insert_into(evm_token_transfer_log::table)
-        .values(NewEvmTokenTransferLog {
+    insert_into(db::schema::evm_token_transfer_log::table)
+        .values(db::models::NewEvmTokenTransferLog {
            grant_id,
            log_id: 0,
-            chain_id: CHAIN_ID as i32,
+            chain_id: CHAIN_ID.into(),
            token_contract: DAI.to_vec(),
            recipient_address: RECIPIENT.to_vec(),
            value: utils::u256_to_bytes(U256::from(1_000u64)).to_vec(),
--- a/server/crates/arbiter-server/src/evm/safe_signer.rs
+++ b/server/crates/arbiter-server/src/evm/safe_signer.rs
@@ -82,8 +82,8 @@ impl SafeSigner {
        })
    }

+    #[expect(clippy::significant_drop_tightening, reason = "false positive")]
    fn sign_hash_inner(&self, hash: &B256) -> Result<Signature> {
-        #[allow(clippy::expect_used)]
        let mut cell = self.key.lock().expect("SafeSigner mutex poisoned");
        let reader = cell.read();
        let sig: (ecdsa::Signature, RecoveryId) = reader.sign_prehash(hash.as_ref())?;
@@ -96,7 +96,6 @@ impl SafeSigner {
        {
            return Err(Error::TransactionChainIdMismatch {
                signer: chain_id,
-                #[allow(clippy::expect_used)]
                tx: tx.chain_id().expect("Chain ID is guaranteed to be set"),
            });
        }
--- a/server/crates/arbiter-server/src/evm/utils.rs
+++ b/server/crates/arbiter-server/src/evm/utils.rs
@@ -7,7 +7,7 @@ pub(super) struct LengthError {
    pub(super) actual: usize,
 }

-pub(super) fn u256_to_bytes(value: U256) -> [u8; 32] {
+pub const fn u256_to_bytes(value: U256) -> [u8; 32] {
    value.to_le_bytes()
 }
 pub(super) fn bytes_to_u256(bytes: &[u8]) -> Option<U256> {
--- a/server/crates/arbiter-server/src/grpc/client.rs
+++ b/server/crates/arbiter-server/src/grpc/client.rs
@@ -98,8 +98,7 @@ pub async fn start(mut conn: ClientConnection, mut bi: GrpcBi<ClientRequest, Cli
        Err(err) => {
            let _ = bi
                .send(Err(Status::unauthenticated(format!(
-                    "Authentication failed: {}",
-                    err
+                    "Authentication failed: {err}",
                ))))
                .await;
            warn!(error = ?err, "Client authentication failed");
--- a/server/crates/arbiter-server/src/grpc/client/auth.rs
+++ b/server/crates/arbiter-server/src/grpc/client/auth.rs
@@ -1,6 +1,6 @@
 use crate::{
-    grpc::request_tracker::RequestTracker,
-    peers::client::{self, ClientConnection, auth},
+    grpc::{Convert, request_tracker::RequestTracker},
+    peers::client::{ClientConnection, auth},
 };
 use arbiter_crypto::authn;
 use arbiter_proto::{
@@ -32,7 +32,7 @@ pub(super) struct AuthTransportAdapter<'a> {
 }

 impl<'a> AuthTransportAdapter<'a> {
-    pub(super) fn new(
+    pub(super) const fn new(
        bi: &'a mut GrpcBi<ClientRequest, ClientResponse>,
        request_tracker: &'a mut RequestTracker,
    ) -> Self {
@@ -42,44 +42,6 @@ impl<'a> AuthTransportAdapter<'a> {
        }
    }

-    fn response_to_proto(response: auth::Outbound) -> AuthResponsePayload {
-        match response {
-            auth::Outbound::AuthChallenge { challenge } => {
-                AuthResponsePayload::Challenge(ProtoAuthChallenge {
-                    timestamp_nanos: challenge
-                        .timestamp
-                        .timestamp_nanos_opt()
-                        .expect("timestamp within range")
-                        as u64,
-                    random: challenge.nonce.to_vec(),
-                })
-            }
-            auth::Outbound::AuthSuccess => {
-                AuthResponsePayload::Result(ProtoAuthResult::Success.into())
-            }
-        }
-    }
-
-    fn error_to_proto(error: auth::Error) -> AuthResponsePayload {
-        AuthResponsePayload::Result(
-            match error {
-                auth::Error::InvalidChallengeSolution => ProtoAuthResult::InvalidSignature,
-                auth::Error::ApproveError(auth::ApproveError::Denied) => {
-                    ProtoAuthResult::ApprovalDenied
-                }
-                auth::Error::ApproveError(auth::ApproveError::Upstream(
-                    crate::actors::flow_coordinator::ApprovalError::NoUserAgentsConnected,
-                )) => ProtoAuthResult::NoUserAgentsOnline,
-                auth::Error::ApproveError(auth::ApproveError::Internal)
-                | auth::Error::DatabasePoolUnavailable
-                | auth::Error::DatabaseOperationFailed
-                | auth::Error::IntegrityCheckFailed
-                | auth::Error::Transport => ProtoAuthResult::Internal,
-            }
-            .into(),
-        )
-    }
-
    async fn send_client_response(
        &mut self,
        payload: AuthResponsePayload,
@@ -107,8 +69,8 @@ impl Sender<Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {
        item: Result<auth::Outbound, auth::Error>,
    ) -> Result<(), TransportError> {
        let payload = match item {
-            Ok(message) => AuthTransportAdapter::response_to_proto(message),
-            Err(err) => AuthTransportAdapter::error_to_proto(err),
+            Ok(message) => message.convert(),
+            Err(err) => err.convert(),
        };

        self.send_client_response(payload).await
@@ -171,7 +133,7 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
                };
                Some(auth::Inbound::AuthChallengeRequest {
                    pubkey,
-                    metadata: client_metadata_from_proto(client_info),
+                    metadata: client_info.convert(),
                })
            }
            AuthRequestPayload::ChallengeSolution(ProtoAuthChallengeSolution { signature }) => {
@@ -189,11 +151,61 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {

 impl Bi<auth::Inbound, Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {}

-fn client_metadata_from_proto(metadata: ProtoClientInfo) -> ClientMetadata {
+impl Convert for ProtoClientInfo {
+    type Output = ClientMetadata;
+
+    fn convert(self) -> Self::Output {
        ClientMetadata {
-        name: metadata.name,
-        description: metadata.description,
-        version: metadata.version,
+            name: self.name,
+            description: self.description,
+            version: self.version,
+        }
+    }
+}
+
+impl Convert for auth::Error {
+    type Output = AuthResponsePayload;
+
+    fn convert(self) -> Self::Output {
+        use auth::Error::{
+            ApproveError, DatabaseOperationFailed, DatabasePoolUnavailable, IntegrityCheckFailed,
+            InvalidChallengeSolution, Transport,
+        };
+        AuthResponsePayload::Result(
+            match self {
+                InvalidChallengeSolution => ProtoAuthResult::InvalidSignature,
+                ApproveError(auth::ApproveError::Denied) => ProtoAuthResult::ApprovalDenied,
+                ApproveError(auth::ApproveError::Upstream(
+                    crate::actors::flow_coordinator::ApprovalError::NoUserAgentsConnected,
+                )) => ProtoAuthResult::NoUserAgentsOnline,
+                ApproveError(auth::ApproveError::Internal)
+                | DatabasePoolUnavailable
+                | DatabaseOperationFailed
+                | IntegrityCheckFailed
+                | Transport => ProtoAuthResult::Internal,
+            }
+            .into(),
+        )
+    }
+}
+
+impl Convert for auth::Outbound {
+    type Output = AuthResponsePayload;
+
+    fn convert(self) -> Self::Output {
+        match self {
+            Self::AuthChallenge { challenge } => {
+                AuthResponsePayload::Challenge(ProtoAuthChallenge {
+                    timestamp_nanos: challenge
+                        .timestamp
+                        .timestamp_nanos_opt()
+                        .expect("timestamp within range")
+                        as u64,
+                    random: challenge.nonce.to_vec(),
+                })
+            }
+            Self::AuthSuccess => AuthResponsePayload::Result(ProtoAuthResult::Success.into()),
+        }
    }
 }

@@ -203,5 +215,5 @@ pub(super) async fn start(
    request_tracker: &mut RequestTracker,
 ) -> Result<i32, auth::Error> {
    let mut transport = AuthTransportAdapter::new(bi, request_tracker);
-    client::auth::authenticate(conn, &mut transport).await
+    auth::authenticate(conn, &mut transport).await
 }
--- a/server/crates/arbiter-server/src/grpc/client/evm.rs
+++ b/server/crates/arbiter-server/src/grpc/client/evm.rs
@@ -23,7 +23,7 @@ use kameo::actor::ActorRef;
 use tonic::Status;
 use tracing::warn;

-fn wrap_response(payload: EvmResponsePayload) -> ClientResponsePayload {
+const fn wrap_response(payload: EvmResponsePayload) -> ClientResponsePayload {
    ClientResponsePayload::Evm(proto_evm::Response {
        payload: Some(payload),
    })
--- a/server/crates/arbiter-server/src/grpc/client/vault.rs
+++ b/server/crates/arbiter-server/src/grpc/client/vault.rs
@@ -28,7 +28,7 @@ pub(super) async fn dispatch(
    };

    match payload {
-        VaultRequestPayload::QueryState(_) => {
+        VaultRequestPayload::QueryState(()) => {
            let state = match actor.ask(HandleQueryVaultState {}).await {
                Ok(VaultState::Unbootstrapped) => ProtoVaultState::Unbootstrapped,
                Ok(VaultState::Sealed) => ProtoVaultState::Sealed,
--- a/server/crates/arbiter-server/src/grpc/common/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/common/outbound.rs
@@ -31,16 +31,16 @@ impl Convert for SpecificMeaning {

    fn convert(self) -> Self::Output {
        let kind = match self {
-            SpecificMeaning::EtherTransfer(meaning) => ProtoSpecificMeaningKind::EtherTransfer(
+            Self::EtherTransfer(meaning) => ProtoSpecificMeaningKind::EtherTransfer(
                arbiter_proto::proto::shared::evm::EtherTransferMeaning {
                    to: meaning.to.to_vec(),
                    value: u256_to_proto_bytes(meaning.value),
                },
            ),
-            SpecificMeaning::TokenTransfer(meaning) => ProtoSpecificMeaningKind::TokenTransfer(
+            Self::TokenTransfer(meaning) => ProtoSpecificMeaningKind::TokenTransfer(
                arbiter_proto::proto::shared::evm::TokenTransferMeaning {
                    token: Some(ProtoTokenInfo {
-                        symbol: meaning.token.symbol.to_string(),
+                        symbol: meaning.token.symbol.to_owned(),
                        address: meaning.token.contract.to_vec(),
                        chain_id: meaning.token.chain,
                    }),
@@ -61,25 +61,21 @@ impl Convert for EvalViolation {

    fn convert(self) -> Self::Output {
        let kind = match self {
-            EvalViolation::InvalidTarget { target } => {
+            Self::InvalidTarget { target } => {
                ProtoEvalViolationKind::InvalidTarget(target.to_vec())
            }
-            EvalViolation::GasLimitExceeded {
+            Self::GasLimitExceeded {
                max_gas_fee_per_gas,
                max_priority_fee_per_gas,
            } => ProtoEvalViolationKind::GasLimitExceeded(GasLimitExceededViolation {
                max_gas_fee_per_gas: max_gas_fee_per_gas.map(u256_to_proto_bytes),
                max_priority_fee_per_gas: max_priority_fee_per_gas.map(u256_to_proto_bytes),
            }),
-            EvalViolation::RateLimitExceeded => ProtoEvalViolationKind::RateLimitExceeded(()),
-            EvalViolation::VolumetricLimitExceeded => {
-                ProtoEvalViolationKind::VolumetricLimitExceeded(())
-            }
-            EvalViolation::InvalidTime => ProtoEvalViolationKind::InvalidTime(()),
-            EvalViolation::InvalidTransactionType => {
-                ProtoEvalViolationKind::InvalidTransactionType(())
-            }
-            EvalViolation::MismatchingChainId { expected, actual } => {
+            Self::RateLimitExceeded => ProtoEvalViolationKind::RateLimitExceeded(()),
+            Self::VolumetricLimitExceeded => ProtoEvalViolationKind::VolumetricLimitExceeded(()),
+            Self::InvalidTime => ProtoEvalViolationKind::InvalidTime(()),
+            Self::InvalidTransactionType => ProtoEvalViolationKind::InvalidTransactionType(()),
+            Self::MismatchingChainId { expected, actual } => {
                ProtoEvalViolationKind::ChainIdMismatch(proto_eval_violation::ChainIdMismatch {
                    expected,
                    actual,
@@ -96,13 +92,13 @@ impl Convert for VetError {

    fn convert(self) -> Self::Output {
        let kind = match self {
-            VetError::ContractCreationNotSupported => {
+            Self::ContractCreationNotSupported => {
                ProtoTransactionEvalErrorKind::ContractCreationNotSupported(())
            }
-            VetError::UnsupportedTransactionType => {
+            Self::UnsupportedTransactionType => {
                ProtoTransactionEvalErrorKind::UnsupportedTransactionType(())
            }
-            VetError::Evaluated(meaning, policy_error) => match policy_error {
+            Self::Evaluated(meaning, policy_error) => match policy_error {
                PolicyError::NoMatchingGrant => {
                    ProtoTransactionEvalErrorKind::NoMatchingGrant(NoMatchingGrantError {
                        meaning: Some(meaning.convert()),
--- a/server/crates/arbiter-server/src/grpc/request_tracker.rs
+++ b/server/crates/arbiter-server/src/grpc/request_tracker.rs
@@ -20,7 +20,7 @@ impl RequestTracker {

    // This is used to set the response id for auth responses, which need to match the request id of the auth challenge request.
    // -1 offset is needed because request() increments the next_request_id after returning the current request id.
-    pub(super) fn current_request_id(&self) -> i32 {
+    pub(super) const fn current_request_id(&self) -> i32 {
        self.next_request_id - 1
    }
 }
--- a/server/crates/arbiter-server/src/grpc/user_agent/auth.rs
+++ b/server/crates/arbiter-server/src/grpc/user_agent/auth.rs
@@ -25,7 +25,7 @@ pub(super) struct AuthTransportAdapter<'a> {
 }

 impl<'a> AuthTransportAdapter<'a> {
-    pub(super) fn new(
+    pub(super) const fn new(
        bi: &'a mut GrpcBi<UserAgentRequest, UserAgentResponse>,
        request_tracker: &'a mut RequestTracker,
    ) -> Self {
@@ -35,11 +35,11 @@ impl<'a> AuthTransportAdapter<'a> {
        }
    }

-    pub(super) fn bi_mut(&mut self) -> &mut GrpcBi<UserAgentRequest, UserAgentResponse> {
+    pub(super) const fn bi_mut(&mut self) -> &mut GrpcBi<UserAgentRequest, UserAgentResponse> {
        self.bi
    }

-    pub(super) fn tracker_mut(&mut self) -> &mut RequestTracker {
+    pub(super) const fn tracker_mut(&mut self) -> &mut RequestTracker {
        self.request_tracker
    }

--- a/server/crates/arbiter-server/src/grpc/user_agent/evm.rs
+++ b/server/crates/arbiter-server/src/grpc/user_agent/evm.rs
@@ -37,7 +37,7 @@ use kameo::actor::ActorRef;
 use tonic::Status;
 use tracing::warn;

-fn wrap_evm_response(payload: EvmResponsePayload) -> UserAgentResponsePayload {
+const fn wrap_evm_response(payload: EvmResponsePayload) -> UserAgentResponsePayload {
    UserAgentResponsePayload::Evm(proto_evm::Response {
        payload: Some(payload),
    })
@@ -52,8 +52,8 @@ pub(super) async fn dispatch(
    };

    match payload {
-        EvmRequestPayload::WalletCreate(_) => handle_wallet_create(actor).await,
-        EvmRequestPayload::WalletList(_) => handle_wallet_list(actor).await,
+        EvmRequestPayload::WalletCreate(()) => handle_wallet_create(actor).await,
+        EvmRequestPayload::WalletList(()) => handle_wallet_list(actor).await,
        EvmRequestPayload::GrantCreate(req) => handle_grant_create(actor, req).await,
        EvmRequestPayload::GrantDelete(req) => handle_grant_delete(actor, req).await,
        EvmRequestPayload::GrantList(_) => handle_grant_list(actor).await,
--- a/server/crates/arbiter-server/src/grpc/user_agent/inbound.rs
+++ b/server/crates/arbiter-server/src/grpc/user_agent/inbound.rs
@@ -22,11 +22,11 @@ use chrono::{DateTime, TimeZone, Utc};
 use prost_types::Timestamp as ProtoTimestamp;
 use tonic::Status;

-fn address_from_bytes(bytes: Vec<u8>) -> Result<Address, Status> {
+fn address_from_bytes(bytes: &[u8]) -> Result<Address, Status> {
    if bytes.len() != 20 {
        return Err(Status::invalid_argument("Invalid EVM address"));
    }
-    Ok(Address::from_slice(&bytes))
+    Ok(Address::from_slice(bytes))
 }

 fn u256_from_proto_bytes(bytes: &[u8]) -> Result<U256, Status> {
@@ -41,7 +41,7 @@ impl TryConvert for ProtoTimestamp {
    type Error = Status;

    fn try_convert(self) -> Result<DateTime<Utc>, Status> {
-        Utc.timestamp_opt(self.seconds, self.nanos as u32)
+        Utc.timestamp_opt(self.seconds, self.nanos.try_into().unwrap_or_default())
            .single()
            .ok_or_else(|| Status::invalid_argument("Invalid timestamp"))
    }
@@ -116,7 +116,8 @@ impl TryConvert for ProtoSpecificGrant {
                limit,
            })) => Ok(SpecificGrant::EtherTransfer(ether_transfer::Settings {
                target: targets
-                    .into_iter()
+                    .iter()
+                    .map(Vec::as_slice)
                    .map(address_from_bytes)
                    .collect::<Result<_, _>>()?,
                limit: limit
@@ -130,8 +131,10 @@ impl TryConvert for ProtoSpecificGrant {
                target,
                volume_limits,
            })) => Ok(SpecificGrant::TokenTransfer(token_transfers::Settings {
-                token_contract: address_from_bytes(token_contract)?,
-                target: target.map(address_from_bytes).transpose()?,
+                token_contract: address_from_bytes(&token_contract)?,
+                target: target
+                    .map(|target| address_from_bytes(&target))
+                    .transpose()?,
                volume_limits: volume_limits
                    .into_iter()
                    .map(ProtoVolumeRateLimit::try_convert)
--- a/server/crates/arbiter-server/src/grpc/user_agent/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/user_agent/outbound.rs
@@ -22,7 +22,7 @@ impl Convert for DateTime<Utc> {
    fn convert(self) -> ProtoTimestamp {
        ProtoTimestamp {
            seconds: self.timestamp(),
-            nanos: self.timestamp_subsec_nanos() as i32,
+            nanos: self.timestamp_subsec_nanos().try_into().unwrap_or(i32::MAX),
        }
    }
 }
@@ -74,13 +74,13 @@ impl Convert for SpecificGrant {

    fn convert(self) -> ProtoSpecificGrant {
        let grant = match self {
-            SpecificGrant::EtherTransfer(s) => {
+            Self::EtherTransfer(s) => {
                ProtoSpecificGrantType::EtherTransfer(ProtoEtherTransferSettings {
                    targets: s.target.into_iter().map(|a| a.to_vec()).collect(),
                    limit: Some(s.limit.convert()),
                })
            }
-            SpecificGrant::TokenTransfer(s) => {
+            Self::TokenTransfer(s) => {
                ProtoSpecificGrantType::TokenTransfer(ProtoTokenTransferSettings {
                    token_contract: s.token_contract.to_vec(),
                    target: s.target.map(|a| a.to_vec()),
--- a/server/crates/arbiter-server/src/grpc/user_agent/sdk_client.rs
+++ b/server/crates/arbiter-server/src/grpc/user_agent/sdk_client.rs
@@ -32,7 +32,7 @@ use kameo::actor::ActorRef;
 use tonic::Status;
 use tracing::{info, warn};

-fn wrap_sdk_client_response(payload: SdkClientResponsePayload) -> UserAgentResponsePayload {
+const fn wrap_sdk_client_response(payload: SdkClientResponsePayload) -> UserAgentResponsePayload {
    UserAgentResponsePayload::SdkClient(proto_sdk_client::Response {
        payload: Some(payload),
    })
@@ -75,14 +75,14 @@ pub(super) async fn dispatch(
        SdkClientRequestPayload::Revoke(_) => Err(Status::unimplemented(
            "SdkClientRevoke is not yet implemented",
        )),
-        SdkClientRequestPayload::List(_) => handle_list(actor).await,
+        SdkClientRequestPayload::List(()) => handle_list(actor).await,
        SdkClientRequestPayload::GrantWalletAccess(req) => {
            handle_grant_wallet_access(actor, req).await
        }
        SdkClientRequestPayload::RevokeWalletAccess(req) => {
            handle_revoke_wallet_access(actor, req).await
        }
-        SdkClientRequestPayload::ListWalletAccess(_) => handle_list_wallet_access(actor).await,
+        SdkClientRequestPayload::ListWalletAccess(()) => handle_list_wallet_access(actor).await,
    }
 }

@@ -91,7 +91,7 @@ async fn handle_connection_response(
    resp: ProtoSdkClientConnectionResponse,
 ) -> Result<Option<UserAgentResponsePayload>, Status> {
    let pubkey = authn::PublicKey::try_from(resp.pubkey.as_slice())
-        .map_err(|_| Status::invalid_argument("Invalid ML-DSA public key"))?;
+        .map_err(|()| Status::invalid_argument("Invalid ML-DSA public key"))?;

    actor
        .ask(HandleNewClientApprove {
@@ -116,12 +116,17 @@ async fn handle_list(
                .into_iter()
                .map(|(client, metadata)| ProtoSdkClientEntry {
                    id: client.id,
-                    pubkey: client.public_key.to_vec(),
+                    pubkey: client.public_key.clone(),
                    info: Some(ProtoClientMetadata {
                        name: metadata.name,
                        description: metadata.description,
                        version: metadata.version,
                    }),
+                    #[expect(
+                        clippy::cast_possible_truncation,
+                        clippy::as_conversions,
+                        reason = "fixme! #84"
+                    )]
                    created_at: client.created_at.0.timestamp() as i32,
                })
                .collect(),
@@ -142,7 +147,7 @@ async fn handle_grant_wallet_access(
    actor: &ActorRef<UserAgentSession>,
    req: ProtoSdkClientGrantWalletAccess,
 ) -> Result<Option<UserAgentResponsePayload>, Status> {
-    let entries: Vec<NewEvmWalletAccess> = req.accesses.into_iter().map(|a| a.convert()).collect();
+    let entries: Vec<NewEvmWalletAccess> = req.accesses.into_iter().map(Convert::convert).collect();
    match actor.ask(HandleGrantEvmWalletAccess { entries }).await {
        Ok(()) => {
            info!("Successfully granted wallet access");
@@ -182,7 +187,7 @@ async fn handle_list_wallet_access(
    match actor.ask(HandleListWalletAccess {}).await {
        Ok(accesses) => Ok(Some(wrap_sdk_client_response(
            SdkClientResponsePayload::ListWalletAccess(ListWalletAccessResponse {
-                accesses: accesses.into_iter().map(|a| a.convert()).collect(),
+                accesses: accesses.into_iter().map(Convert::convert).collect(),
            }),
        ))),
        Err(err) => {
--- a/server/crates/arbiter-server/src/grpc/user_agent/vault.rs
+++ b/server/crates/arbiter-server/src/grpc/user_agent/vault.rs
@@ -17,7 +17,7 @@ use kameo::actor::ActorRef;
 use tonic::Status;
 use tracing::warn;

-fn wrap_vault_response(payload: VaultResponsePayload) -> UserAgentResponsePayload {
+const fn wrap_vault_response(payload: VaultResponsePayload) -> UserAgentResponsePayload {
    UserAgentResponsePayload::Vault(proto_vault::Response {
        payload: Some(payload),
    })
@@ -32,7 +32,7 @@ pub(super) async fn dispatch(
    };

    match payload {
-        VaultRequestPayload::QueryState(_) => handle_query_vault_state(actor).await,
+        VaultRequestPayload::QueryState(()) => handle_query_vault_state(actor).await,
        VaultRequestPayload::Unseal(_) | VaultRequestPayload::Bootstrap(_) => {
            Err(Status::permission_denied(
                "Vault is already unsealed; unseal/bootstrap not permitted in session",
--- a/server/crates/arbiter-server/src/grpc/user_agent/vault_gate/inbound.rs
+++ b/server/crates/arbiter-server/src/grpc/user_agent/vault_gate/inbound.rs
@@ -22,7 +22,7 @@ impl TryConvert for UserAgentRequestPayload {

    fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
        match self {
-            UserAgentRequestPayload::Vault(req) => req.try_convert(),
+            Self::Vault(req) => req.try_convert(),
            _ => Err(Status::permission_denied(
                "Only vault operations are permitted before unsealing",
            )),
@@ -47,9 +47,9 @@ impl TryConvert for VaultRequestPayload {

    fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
        match self {
-            VaultRequestPayload::QueryState(_) => Ok(vault_gate::Inbound::HandleVaultState),
-            VaultRequestPayload::Unseal(req) => req.try_convert(),
-            VaultRequestPayload::Bootstrap(req) => req.try_convert(),
+            Self::QueryState(()) => Ok(vault_gate::Inbound::HandleVaultState),
+            Self::Unseal(req) => req.try_convert(),
+            Self::Bootstrap(req) => req.try_convert(),
        }
    }
 }
@@ -71,8 +71,8 @@ impl TryConvert for UnsealRequestPayload {

    fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
        match self {
-            UnsealRequestPayload::Start(start) => start.try_convert(),
-            UnsealRequestPayload::EncryptedKey(key) => Ok(key.convert()),
+            Self::Start(start) => start.try_convert(),
+            Self::EncryptedKey(key) => Ok(key.convert()),
        }
    }
 }
--- a/server/crates/arbiter-server/src/grpc/user_agent/vault_gate/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/user_agent/vault_gate/outbound.rs
@@ -22,13 +22,13 @@ use arbiter_proto::proto::{
 use tonic::Status;
 use tracing::warn;

-fn wrap_vault_response(payload: VaultResponsePayload) -> UserAgentResponsePayload {
+const fn wrap_vault_response(payload: VaultResponsePayload) -> UserAgentResponsePayload {
    UserAgentResponsePayload::Vault(proto_vault::Response {
        payload: Some(payload),
    })
 }

-fn wrap_unseal_response(payload: UnsealResponsePayload) -> UserAgentResponsePayload {
+const fn wrap_unseal_response(payload: UnsealResponsePayload) -> UserAgentResponsePayload {
    wrap_vault_response(VaultResponsePayload::Unseal(proto_unseal::Response {
        payload: Some(payload),
    }))
@@ -45,9 +45,9 @@ impl Convert for VaultState {

    fn convert(self) -> UserAgentResponsePayload {
        let proto_state = match self {
-            VaultState::Unbootstrapped => ProtoVaultState::Unbootstrapped,
-            VaultState::Sealed => ProtoVaultState::Sealed,
-            VaultState::Unsealed => ProtoVaultState::Unsealed,
+            Self::Unbootstrapped => ProtoVaultState::Unbootstrapped,
+            Self::Sealed => ProtoVaultState::Sealed,
+            Self::Unsealed => ProtoVaultState::Unsealed,
        };
        wrap_vault_response(VaultResponsePayload::State(proto_state.into()))
    }
@@ -71,19 +71,19 @@ impl TryConvert for vault_gate::Outbound {

    fn try_convert(self) -> Result<UserAgentResponsePayload, Status> {
        match self {
-            vault_gate::Outbound::HandleVaultState(result) => result
+            Self::HandleVaultState(result) => result
                .map_err(|err| {
                    warn!(?err, "vault state query failed");
                    Status::internal("Failed to query vault state")
                })
                .map(VaultState::convert),
-            vault_gate::Outbound::HandleHandshake(result) => result
+            Self::HandleHandshake(result) => result
                .map_err(|err| {
                    warn!(?err, "handshake failed");
                    Status::internal("Failed to start unseal flow")
                })
                .map(vault_gate::HandshakeResponse::convert),
-            vault_gate::Outbound::HandleUnsealEncryptedKey(result) => {
+            Self::HandleUnsealEncryptedKey(result) => {
                let proto_result = match result {
                    Ok(()) => ProtoUnsealResult::Success,
                    Err(vault_gate::Error::InvalidKey) => ProtoUnsealResult::InvalidKey,
@@ -96,7 +96,7 @@ impl TryConvert for vault_gate::Outbound {
                    proto_result.into(),
                )))
            }
-            vault_gate::Outbound::HandleBootstrapEncryptedKey(result) => {
+            Self::HandleBootstrapEncryptedKey(result) => {
                let proto_result = match result {
                    Ok(()) => ProtoBootstrapResult::Success,
                    Err(vault_gate::Error::InvalidKey) => ProtoBootstrapResult::InvalidKey,
--- a/server/crates/arbiter-server/src/lib.rs
+++ b/server/crates/arbiter-server/src/lib.rs
@@ -1,4 +1,3 @@
-#![forbid(unsafe_code)]
 use crate::context::ServerContext;

 pub mod actors;
@@ -15,7 +14,7 @@ pub struct Server {
 }

 impl Server {
-    pub fn new(context: ServerContext) -> Self {
+    pub const fn new(context: ServerContext) -> Self {
        Self { context }
    }
 }
--- a/server/crates/arbiter-server/src/peers/client/auth.rs
+++ b/server/crates/arbiter-server/src/peers/client/auth.rs
@@ -161,7 +161,8 @@ async fn insert_client(
    pubkey: &authn::PublicKey,
    metadata: &ClientMetadata,
 ) -> Result<i32, Error> {
-    use crate::db::schema::{client_metadata, program_client};
+    use crate::db::schema::client_metadata;
+
    let pubkey = pubkey.clone();
    let metadata = metadata.clone();

@@ -329,12 +330,10 @@ where
        return Err(Error::Transport);
    };

-    let client_id = match get_client_id(&props.db, &pubkey).await? {
-        Some(id) => {
+    let client_id = if let Some(id) = get_client_id(&props.db, &pubkey).await? {
        verify_integrity(&props.db, &props.actors.vault, &pubkey).await?;
        id
-        }
-        None => {
+    } else {
        approve_new_client(
            &props.actors,
            ClientProfile {
@@ -344,7 +343,6 @@ where
        )
        .await?;
        insert_client(&props.db, &props.actors.vault, &pubkey, &metadata).await?
-        }
    };

    sync_client_metadata(&props.db, client_id, &metadata).await?;
--- a/server/crates/arbiter-server/src/peers/client/mod.rs
+++ b/server/crates/arbiter-server/src/peers/client/mod.rs
@@ -29,7 +29,7 @@ pub struct ClientConnection {
 }

 impl ClientConnection {
-    pub fn new(db: db::DatabasePool, actors: GlobalActors) -> Self {
+    pub const fn new(db: db::DatabasePool, actors: GlobalActors) -> Self {
        Self { db, actors }
    }
 }
@@ -42,7 +42,7 @@ where
    T: Bi<auth::Inbound, Result<auth::Outbound, auth::Error>> + Send + ?Sized,
 {
    let fut = auth::authenticate(&mut props, transport);
-    println!("authenticate future size: {}", std::mem::size_of_val(&fut));
+    println!("authenticate future size: {}", size_of_val(&fut));
    match fut.await {
        Ok(client_id) => {
            ClientSession::spawn(ClientSession::new(props, client_id));
--- a/server/crates/arbiter-server/src/peers/client/session.rs
+++ b/server/crates/arbiter-server/src/peers/client/session.rs
@@ -20,7 +20,7 @@ pub struct ClientSession {
 }

 impl ClientSession {
-    pub(crate) fn new(props: ClientConnection, client_id: i32) -> Self {
+    pub(crate) const fn new(props: ClientConnection, client_id: i32) -> Self {
        Self { props, client_id }
    }
 }
@@ -91,7 +91,7 @@ impl Actor for ClientSession {
 }

 impl ClientSession {
-    pub fn new_test(db: db::DatabasePool, actors: GlobalActors) -> Self {
+    pub const fn new_test(db: db::DatabasePool, actors: GlobalActors) -> Self {
        let props = ClientConnection::new(db, actors);
        Self {
            props,
--- a/server/crates/arbiter-server/src/peers/user_agent/auth/mod.rs
+++ b/server/crates/arbiter-server/src/peers/user_agent/auth/mod.rs
@@ -2,7 +2,10 @@ use super::{Credentials, UserAgentConnection};
 use arbiter_crypto::authn::{self, AuthChallenge};
 use arbiter_proto::transport::Bi;

-use state::*;
+use state::{
+    AuthContext, AuthError, AuthEvents, AuthStateMachine, AuthStates, ChallengeRequest,
+    ChallengeSolution,
+};
 use tracing::error;

 mod state;
--- a/server/crates/arbiter-server/src/peers/user_agent/auth/state.rs
+++ b/server/crates/arbiter-server/src/peers/user_agent/auth/state.rs
@@ -82,14 +82,14 @@ pub(super) struct AuthContext<'a, T: ?Sized> {
 }

 impl<'a, T: ?Sized> AuthContext<'a, T> {
-    pub(super) fn new(conn: &'a mut UserAgentConnection, transport: &'a mut T) -> Self {
+    pub(super) const fn new(conn: &'a mut UserAgentConnection, transport: &'a mut T) -> Self {
        Self { conn, transport }
    }
 }

 impl<T> AuthStateMachineContext for AuthContext<'_, T>
 where
-    T: Bi<super::Inbound, Result<super::Outbound, Error>> + Send + ?Sized,
+    T: Bi<super::Inbound, Result<Outbound, Error>> + Send + ?Sized,
 {
    type Error = Error;

@@ -138,7 +138,7 @@ where
        }: &ChallengeContext,
        ChallengeSolution { solution }: ChallengeSolution,
    ) -> Result<Credentials, Self::Error> {
-        let signature = authn::Signature::try_from(solution.as_slice()).map_err(|_| {
+        let signature = authn::Signature::try_from(solution.as_slice()).map_err(|()| {
            error!("Failed to decode signature in challenge solution");
            Error::InvalidChallengeSolution
        })?;
--- a/server/crates/arbiter-server/src/peers/user_agent/mod.rs
+++ b/server/crates/arbiter-server/src/peers/user_agent/mod.rs
@@ -4,7 +4,7 @@ use crate::{
        vault::{GetState, Vault},
    },
    crypto::integrity::{self, AttestationStatus, Integrable},
-    db::{self, DatabaseError, DatabasePool},
+    db::{DatabaseError, DatabasePool},
    peers::client::ClientProfile,
 };
 use arbiter_crypto::authn;
@@ -42,12 +42,12 @@ pub enum OutOfBand {

 #[derive(Clone)]
 pub struct UserAgentConnection {
-    pub(crate) db: db::DatabasePool,
+    pub(crate) db: DatabasePool,
    pub(crate) actors: GlobalActors,
 }

 impl UserAgentConnection {
-    pub fn new(db: db::DatabasePool, actors: GlobalActors) -> Self {
+    pub const fn new(db: DatabasePool, actors: GlobalActors) -> Self {
        Self { db, actors }
    }
 }
--- a/server/crates/arbiter-server/src/peers/user_agent/session/handlers.rs
+++ b/server/crates/arbiter-server/src/peers/user_agent/session/handlers.rs
@@ -98,7 +98,7 @@ impl UserAgentSession {
    pub(crate) async fn handle_grant_create(
        &mut self,
        basic: crate::evm::policies::SharedGrantSettings,
-        grant: crate::evm::policies::SpecificGrant,
+        grant: SpecificGrant,
    ) -> Result<i32, GrantMutationError> {
        match self
            .props
@@ -116,10 +116,7 @@ impl UserAgentSession {
    }

    #[message]
-    pub(crate) async fn handle_grant_delete(
-        &mut self,
-        grant_id: i32,
-    ) -> Result<(), GrantMutationError> {
+    pub(crate) fn handle_grant_delete(&mut self, grant_id: i32) -> Result<(), GrantMutationError> {
        // match self
        //     .props
        //     .actors
@@ -237,12 +234,10 @@ impl UserAgentSession {
        pubkey: authn::PublicKey,
        ctx: &mut Context<Self, Result<(), Error>>,
    ) -> Result<(), Error> {
-        let pending_approval = match self.pending_client_approvals.remove(&pubkey.to_bytes()) {
-            Some(approval) => approval,
-            None => {
+        let Some(pending_approval) = self.pending_client_approvals.remove(&pubkey.to_bytes())
+        else {
            error!("Received client connection response for unknown client");
            return Err(Error::internal("Unknown client in connection response"));
-            }
        };

        pending_approval
--- a/server/crates/arbiter-server/src/peers/user_agent/session/mod.rs
+++ b/server/crates/arbiter-server/src/peers/user_agent/session/mod.rs
@@ -106,10 +106,7 @@ impl Actor for UserAgentSession {

    type Error = Error;

-    async fn on_start(
-        args: Self::Args,
-        this: kameo::prelude::ActorRef<Self>,
-    ) -> Result<Self, Self::Error> {
+    async fn on_start(args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
        args.props
            .actors
            .useragent_registry
--- a/server/crates/arbiter-server/src/peers/user_agent/vault_gate/mod.rs
+++ b/server/crates/arbiter-server/src/peers/user_agent/vault_gate/mod.rs
@@ -8,7 +8,7 @@ use crate::{
    db::DatabasePool,
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-use state::*;
+use state::State;

 use chacha20poly1305::{AeadInPlace, KeyInit as _, XChaCha20Poly1305, XNonce};
 use kameo::{Actor, error::SendError, messages, prelude::Message};
@@ -110,7 +110,7 @@ impl VaultGate {
        });

        match decryption_result {
-            Ok(_) => Ok(key_buffer),
+            Ok(()) => Ok(key_buffer),
            Err(err) => {
                error!(?err, "Failed to decrypt encrypted key material");
                Err(())
@@ -122,9 +122,9 @@ impl VaultGate {
 #[messages(messages = Inbound, replies = Outbound)]
 impl VaultGate {
    #[message]
-    pub async fn handle_handshake(
+    pub fn handle_handshake(
        &mut self,
-        client_pubkey: x25519_dalek::PublicKey,
+        client_pubkey: PublicKey,
    ) -> Result<HandshakeResponse, Error> {
        let ephemeral_secret = EphemeralSecret::random();
        let public_key = PublicKey::from(&ephemeral_secret);
@@ -152,12 +152,9 @@ impl VaultGate {
            return Err(Error::State);
        };

-        let seal_key_buffer = match Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-        {
-            Ok(buffer) => buffer,
-            Err(()) => {
+        let Ok(seal_key_buffer) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
+        else {
            return Err(Error::InvalidKey);
-            }
        };

        match self
@@ -168,7 +165,7 @@ impl VaultGate {
            })
            .await
        {
-            Ok(_) => {
+            Ok(()) => {
                info!("Successfully unsealed key with client-provided key");
                Ok(())
            }
@@ -195,12 +192,9 @@ impl VaultGate {
            return Err(Error::State);
        };

-        let seal_key_buffer = match Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-        {
-            Ok(buffer) => buffer,
-            Err(()) => {
+        let Ok(seal_key_buffer) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
+        else {
            return Err(Error::InvalidKey);
-            }
        };

        match self
@@ -211,7 +205,7 @@ impl VaultGate {
            })
            .await
        {
-            Ok(_) => {
+            Ok(()) => {
                info!("Successfully bootstrapped vault with client-provided key");
                Ok(())
            }
--- a/server/crates/arbiter-server/tests/client/auth.rs
+++ b/server/crates/arbiter-server/tests/client/auth.rs
@@ -16,7 +16,7 @@ use arbiter_server::{

 use diesel::{ExpressionMethods as _, NullableExpressionMethods as _, QueryDsl as _, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair as _};
+use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};

 fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> ClientMetadata {
    ClientMetadata {
@@ -26,6 +26,10 @@ fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> Cli
    }
 }

+fn verifying_key(key: &SigningKey<MlDsa87>) -> VerifyingKey<MlDsa87> {
+    <SigningKey<MlDsa87> as Keypair>::verifying_key(key)
+}
+
 async fn insert_registered_client(
    db: &db::DatabasePool,
    actors: &GlobalActors,
@@ -47,7 +51,7 @@ async fn insert_registered_client(
        .unwrap();
    let client_id: i32 = insert_into(program_client::table)
        .values((
-            program_client::public_key.eq(pubkey.encode().to_vec()),
+            program_client::public_key.eq(pubkey.encode().0.to_vec()),
            program_client::metadata_id.eq(metadata_id),
        ))
        .returning(program_client::id)
@@ -77,9 +81,9 @@ fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -

 async fn insert_bootstrap_sentinel_useragent(db: &db::DatabasePool) {
    let mut conn = db.get().await.unwrap();
-    let sentinel_key = MlDsa87::key_gen(&mut rand::rng())
-        .verifying_key()
+    let sentinel_key = verifying_key(&MlDsa87::key_gen(&mut rand::rng()))
        .encode()
+        .0
        .to_vec();

    insert_into(schema::useragent_client::table)
@@ -105,7 +109,7 @@ async fn spawn_test_actors(db: &db::DatabasePool) -> GlobalActors {

 #[tokio::test]
 #[test_log::test]
-async fn test_unregistered_pubkey_rejected() {
+pub async fn unregistered_pubkey_rejected() {
    let db = db::create_test_pool().await;

    let (server_transport, mut test_transport) = ChannelTransport::new();
@@ -120,7 +124,7 @@ async fn test_unregistered_pubkey_rejected() {

    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: new_key.verifying_key().into(),
+            pubkey: verifying_key(&new_key).into(),
            metadata: metadata("client", Some("desc"), Some("1.0.0")),
        })
        .await
@@ -132,18 +136,18 @@ async fn test_unregistered_pubkey_rejected() {

 #[tokio::test]
 #[test_log::test]
-async fn test_challenge_auth() {
+pub async fn challenge_auth() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;

    let new_key = MlDsa87::key_gen(&mut rand::rng());

-    insert_registered_client(
+    Box::pin(insert_registered_client(
        &db,
        &actors,
-        new_key.verifying_key(),
+        verifying_key(&new_key),
        &metadata("client", Some("desc"), Some("1.0.0")),
-    )
+    ))
    .await;

    let (server_transport, mut test_transport) = ChannelTransport::new();
@@ -156,7 +160,7 @@ async fn test_challenge_auth() {
    // Send challenge request
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: new_key.verifying_key().into(),
+            pubkey: verifying_key(&new_key).into(),
            metadata: metadata("client", Some("desc"), Some("1.0.0")),
        })
        .await
@@ -170,7 +174,7 @@ async fn test_challenge_auth() {
    let challenge = match response {
        Ok(resp) => match resp {
            auth::Outbound::AuthChallenge { challenge } => challenge,
-            other => panic!("Expected AuthChallenge, got {other:?}"),
+            other @ auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got {other:?}"),
        },
        Err(err) => panic!("Expected Ok response, got Err({err:?})"),
    };
@@ -199,13 +203,19 @@ async fn test_challenge_auth() {

 #[tokio::test]
 #[test_log::test]
-async fn test_metadata_unchanged_does_not_append_history() {
+pub async fn metadata_unchanged_does_not_append_history() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;
    let new_key = MlDsa87::key_gen(&mut rand::rng());
    let requested = metadata("client", Some("desc"), Some("1.0.0"));

-    insert_registered_client(&db, &actors, new_key.verifying_key(), &requested).await;
+    Box::pin(insert_registered_client(
+        &db,
+        &actors,
+        verifying_key(&new_key),
+        &requested,
+    ))
+    .await;

    let props = ClientConnection::new(db.clone(), actors);

@@ -217,7 +227,7 @@ async fn test_metadata_unchanged_does_not_append_history() {

    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: new_key.verifying_key().into(),
+            pubkey: verifying_key(&new_key).into(),
            metadata: requested,
        })
        .await
@@ -226,7 +236,7 @@ async fn test_metadata_unchanged_does_not_append_history() {
    let response = test_transport.recv().await.unwrap().unwrap();
    let challenge = match response {
        auth::Outbound::AuthChallenge { challenge } => challenge,
-        other => panic!("Expected AuthChallenge, got {other:?}"),
+        auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got AuthSuccess"),
    };
    let signature = sign_client_challenge(&new_key, &challenge);
    test_transport
@@ -256,17 +266,17 @@ async fn test_metadata_unchanged_does_not_append_history() {

 #[tokio::test]
 #[test_log::test]
-async fn test_metadata_change_appends_history_and_repoints_binding() {
+pub async fn metadata_change_appends_history_and_repoints_binding() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;
    let new_key = MlDsa87::key_gen(&mut rand::rng());

-    insert_registered_client(
+    Box::pin(insert_registered_client(
        &db,
        &actors,
-        new_key.verifying_key(),
+        verifying_key(&new_key),
        &metadata("client", Some("old"), Some("1.0.0")),
-    )
+    ))
    .await;

    let props = ClientConnection::new(db.clone(), actors);
@@ -279,7 +289,7 @@ async fn test_metadata_change_appends_history_and_repoints_binding() {

    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: new_key.verifying_key().into(),
+            pubkey: verifying_key(&new_key).into(),
            metadata: metadata("client", Some("new"), Some("2.0.0")),
        })
        .await
@@ -288,14 +298,14 @@ async fn test_metadata_change_appends_history_and_repoints_binding() {
    let response = test_transport.recv().await.unwrap().unwrap();
    let challenge = match response {
        auth::Outbound::AuthChallenge { challenge } => challenge,
-        other => panic!("Expected AuthChallenge, got {other:?}"),
+        auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got AuthSuccess"),
    };
    let signature = sign_client_challenge(&new_key, &challenge);
    test_transport
        .send(auth::Inbound::AuthChallengeSolution { signature })
        .await
        .unwrap();
-    let _ = test_transport.recv().await.unwrap();
+    drop(test_transport.recv().await.unwrap());
    task.await.unwrap();

    {
@@ -343,7 +353,7 @@ async fn test_metadata_change_appends_history_and_repoints_binding() {

 #[tokio::test]
 #[test_log::test]
-async fn test_challenge_auth_rejects_integrity_tag_mismatch() {
+pub async fn challenge_auth_rejects_integrity_tag_mismatch() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;

@@ -365,7 +375,7 @@ async fn test_challenge_auth_rejects_integrity_tag_mismatch() {
            .unwrap();
        insert_into(program_client::table)
            .values((
-                program_client::public_key.eq(new_key.verifying_key().encode().to_vec()),
+                program_client::public_key.eq(verifying_key(&new_key).encode().0.to_vec()),
                program_client::metadata_id.eq(metadata_id),
            ))
            .execute(&mut conn)
@@ -382,7 +392,7 @@ async fn test_challenge_auth_rejects_integrity_tag_mismatch() {

    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: new_key.verifying_key().into(),
+            pubkey: verifying_key(&new_key).into(),
            metadata: requested,
        })
        .await
--- a/server/crates/arbiter-server/tests/common/mod.rs
+++ b/server/crates/arbiter-server/tests/common/mod.rs
@@ -1,3 +1,7 @@
+#![allow(
+    dead_code,
+    reason = "Common test utilities that may not be used in every test"
+)]
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use arbiter_proto::transport::{Bi, Error, Receiver, Sender};
 use arbiter_server::{
@@ -10,7 +14,6 @@ use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use tokio::sync::mpsc;

-#[allow(dead_code)]
 pub(crate) async fn bootstrapped_vault(db: &db::DatabasePool) -> Vault {
    let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
        .await
@@ -22,7 +25,6 @@ pub(crate) async fn bootstrapped_vault(db: &db::DatabasePool) -> Vault {
    actor
 }

-#[allow(dead_code)]
 pub(crate) async fn root_key_history_id(db: &db::DatabasePool) -> i32 {
    let mut conn = db.get().await.unwrap();
    let id = schema::arbiter_settings::table
@@ -33,14 +35,12 @@ pub(crate) async fn root_key_history_id(db: &db::DatabasePool) -> i32 {
    id.expect("root_key_id should be set after bootstrap")
 }

-#[allow(dead_code)]
 pub(crate) struct ChannelTransport<T, Y> {
    receiver: mpsc::Receiver<T>,
    sender: mpsc::Sender<Y>,
 }

 impl<T, Y> ChannelTransport<T, Y> {
-    #[allow(dead_code)]
    pub(crate) fn new() -> (Self, ChannelTransport<Y, T>) {
        let (tx1, rx1) = mpsc::channel(10);
        let (tx2, rx2) = mpsc::channel(10);
--- a/server/crates/arbiter-server/tests/user_agent/auth.rs
+++ b/server/crates/arbiter-server/tests/user_agent/auth.rs
@@ -14,9 +14,13 @@ use arbiter_server::{
 use async_trait::async_trait;
 use diesel::{ExpressionMethods as _, QueryDsl, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{KeyGen, MlDsa87, SigningKey, signature::Keypair as _};
+use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 use tokio::sync::mpsc;

+fn verifying_key(key: &SigningKey<MlDsa87>) -> VerifyingKey<MlDsa87> {
+    <SigningKey<MlDsa87> as Keypair>::verifying_key(key)
+}
+
 fn sign_useragent_challenge(
    key: &SigningKey<MlDsa87>,
    challenge: &AuthChallenge,
@@ -147,7 +151,7 @@ impl Sender<auth::Inbound> for StartTestTransport {

 #[tokio::test]
 #[test_log::test]
-async fn test_bootstrap_token_auth() {
+pub async fn bootstrap_token_auth() {
    let db = db::create_test_pool().await;
    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
@@ -169,7 +173,7 @@ async fn test_bootstrap_token_auth() {
    let new_key = MlDsa87::key_gen(&mut rand::rng());
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: new_key.verifying_key().into(),
+            pubkey: verifying_key(&new_key).into(),
            bootstrap_token: Some(token),
        })
        .await
@@ -207,12 +211,12 @@ async fn test_bootstrap_token_auth() {
        .first::<Vec<u8>>(&mut conn)
        .await
        .unwrap();
-    assert_eq!(stored_pubkey, new_key.verifying_key().encode().to_vec());
+    assert_eq!(stored_pubkey, verifying_key(&new_key).encode().0.to_vec());
 }

 #[tokio::test]
 #[test_log::test]
-async fn test_bootstrap_invalid_token_auth() {
+pub async fn bootstrap_invalid_token_auth() {
    let db = db::create_test_pool().await;
    let actors = GlobalActors::spawn(db.clone()).await.unwrap();

@@ -226,8 +230,8 @@ async fn test_bootstrap_invalid_token_auth() {
    let new_key = MlDsa87::key_gen(&mut rand::rng());
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: new_key.verifying_key().into(),
-            bootstrap_token: Some("invalid_token".to_string()),
+            pubkey: verifying_key(&new_key).into(),
+            bootstrap_token: Some("invalid_token".to_owned()),
        })
        .await
        .unwrap();
@@ -265,7 +269,7 @@ async fn test_bootstrap_invalid_token_auth() {

 #[tokio::test]
 #[test_log::test]
-async fn test_challenge_auth() {
+pub async fn challenge_auth() {
    let db = db::create_test_pool().await;
    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
@@ -277,7 +281,7 @@ async fn test_challenge_auth() {
        .unwrap();

    let new_key = MlDsa87::key_gen(&mut rand::rng());
-    let pubkey_bytes = new_key.verifying_key().encode().to_vec();
+    let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();

    {
        let mut conn = db.get().await.unwrap();
@@ -292,7 +296,7 @@ async fn test_challenge_auth() {
            &actors.vault,
            &Credentials {
                id,
-                pubkey: new_key.verifying_key().into(),
+                pubkey: verifying_key(&new_key).into(),
            },
            id,
        )
@@ -309,7 +313,7 @@ async fn test_challenge_auth() {

    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: new_key.verifying_key().into(),
+            pubkey: verifying_key(&new_key).into(),
            bootstrap_token: None,
        })
        .await
@@ -322,7 +326,7 @@ async fn test_challenge_auth() {
    let challenge = match response {
        Ok(resp) => match resp {
            auth::Outbound::AuthChallenge { challenge } => challenge,
-            other => panic!("Expected AuthChallenge, got {other:?}"),
+            auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got AuthSuccess"),
        },
        Err(err) => panic!("Expected Ok response, got Err({err:?})"),
    };
@@ -350,7 +354,7 @@ async fn test_challenge_auth() {

 #[tokio::test]
 #[test_log::test]
-async fn test_challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
+pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
    let db = db::create_test_pool().await;
    let actors = GlobalActors::spawn(db.clone()).await.unwrap();

@@ -363,7 +367,7 @@ async fn test_challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
        .unwrap();

    let new_key = MlDsa87::key_gen(&mut rand::rng());
-    let pubkey_bytes = new_key.verifying_key().encode().to_vec();
+    let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();

    {
        let mut conn = db.get().await.unwrap();
@@ -383,7 +387,7 @@ async fn test_challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {

    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: new_key.verifying_key().into(),
+            pubkey: verifying_key(&new_key).into(),
            bootstrap_token: None,
        })
        .await
@@ -424,7 +428,7 @@ async fn test_challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {

 #[tokio::test]
 #[test_log::test]
-async fn test_challenge_auth_rejects_invalid_signature() {
+pub async fn challenge_auth_rejects_invalid_signature() {
    let db = db::create_test_pool().await;
    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
@@ -436,7 +440,7 @@ async fn test_challenge_auth_rejects_invalid_signature() {
        .unwrap();

    let new_key = MlDsa87::key_gen(&mut rand::rng());
-    let pubkey_bytes = new_key.verifying_key().encode().to_vec();
+    let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();

    {
        let mut conn = db.get().await.unwrap();
@@ -451,7 +455,7 @@ async fn test_challenge_auth_rejects_invalid_signature() {
            &actors.vault,
            &Credentials {
                id,
-                pubkey: new_key.verifying_key().into(),
+                pubkey: verifying_key(&new_key).into(),
            },
            id,
        )
@@ -468,7 +472,7 @@ async fn test_challenge_auth_rejects_invalid_signature() {

    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
-            pubkey: new_key.verifying_key().into(),
+            pubkey: verifying_key(&new_key).into(),
            bootstrap_token: None,
        })
        .await
@@ -481,7 +485,7 @@ async fn test_challenge_auth_rejects_invalid_signature() {
    let challenge = match response {
        Ok(resp) => match resp {
            auth::Outbound::AuthChallenge { challenge } => challenge,
-            other => panic!("Expected AuthChallenge, got {other:?}"),
+            auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got AuthSuccess"),
        },
        Err(err) => panic!("Expected Ok response, got Err({err:?})"),
    };
--- a/server/crates/arbiter-server/tests/user_agent/unseal.rs
+++ b/server/crates/arbiter-server/tests/user_agent/unseal.rs
@@ -82,7 +82,7 @@ async fn client_dh_encrypt(

 #[tokio::test]
 #[test_log::test]
-async fn test_unseal_success() {
+pub async fn unseal_success() {
    let seal_key = b"test-seal-key";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

@@ -94,8 +94,9 @@ async fn test_unseal_success() {

 #[tokio::test]
 #[test_log::test]
-async fn test_unseal_wrong_seal_key() {
-    let (_db, gate, _promotion_rx) = setup_sealed_gate(b"correct-key").await;
+pub async fn unseal_wrong_seal_key() {
+    let seal_key = b"test-seal-key";
+    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;

@@ -110,8 +111,9 @@ async fn test_unseal_wrong_seal_key() {

 #[tokio::test]
 #[test_log::test]
-async fn test_unseal_corrupted_ciphertext() {
-    let (_db, gate, _promotion_rx) = setup_sealed_gate(b"test-key").await;
+pub async fn unseal_corrupted_ciphertext() {
+    let seal_key = b"test-seal-key";
+    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    let client_secret = EphemeralSecret::random();
    let client_public = PublicKey::from(&client_secret);
@@ -140,7 +142,7 @@ async fn test_unseal_corrupted_ciphertext() {

 #[tokio::test]
 #[test_log::test]
-async fn test_unseal_retry_after_invalid_key() {
+pub async fn unseal_retry_after_invalid_key() {
    let seal_key = b"real-seal-key";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;