WIP: feat-shamir #91

Draft

Skipper wants to merge 31 commits from feat-shamir into main

pull from: feat-shamir

merge into: MarketTakers:main

MarketTakers:main

MarketTakers:terminate-VaultGate-connection-after-vault-lockout

MarketTakers:hashable-integrable-macro

MarketTakers:zeroized-bootstrap-token

MarketTakers:push-zvwxtnqkumlx

MarketTakers:feat-auto-fix-lints

MarketTakers:enforcing-integrity

MarketTakers:push-wxnlsulvnrpz

MarketTakers:check-uac-cerf

MarketTakers:impl-useragent_delete_grant

MarketTakers:Client-key-replacement-attack

MarketTakers:critical-fix-CI-check-all-features

MarketTakers:win-service

MarketTakers:fix-proto-build-script

MarketTakers:terrors-refactor

MarketTakers:PoC-terrors

MarketTakers:push-lspnytwuyulm

MarketTakers:key-alternative

MarketTakers:push-yyxvkwvyspxv

MarketTakers:security-breaktrougth

Conversation 2 Commits 31 Files Changed 54 +4677 -331

Skipper commented 2026-05-01 08:20:50 +00:00

Owner

Copy Link

Consensus part of the spec and voting.

Specs: https://git.markettakers.org/MarketTakers/arbiter/src/branch/main/docs/ARCHITECTURE.md#3-multi-operator-governance

Consensus part of the spec and voting. Specs: https://git.markettakers.org/MarketTakers/arbiter/src/branch/main/docs/ARCHITECTURE.md#3-multi-operator-governance

Skipper added 2 commits 2026-05-01 08:20:50 +00:00

feat(server): introducle table separation in preparation of shamir secret sharing vault 5f239c426d

refactor(server::db): introduced newtype wrappers for entity id's in database f074a4f00b

Skipper force-pushed feat-shamir from f074a4f00b to 9dbb18ae82 2026-05-20 19:04:33 +00:00 Compare

CleverWild added 7 commits 2026-06-12 17:43:40 +00:00

fix(server::peers::operator::auth): make ChallengeContext pub for smlang state machine ... d1b96c8409

smlang generates a public state enum whose variants contain ChallengeContext,
requiring the type itself to be fully public. Also tightens the wildcard arm
in client auth to an exhaustive match.

feat(server::actors::evm): implement operator_delete_grant ... 34850137df

Sets revoked_at on the evm_basic_grant row; returns NotFound if the grant
does not exist. Wires the handler in OperatorSession replacing the todo!().

feat(server::db): add share_salt column to operator table ... 3e5f0cb3df

Each operator row now stores a 32-byte random salt used to derive the
per-operator share encryption key from their passphrase (Argon2 KDF).

feat(server::crypto): add Shamir secret sharing utilities ... 50fe18d6ce

Wraps vsss_rs Gf256::split_array / combine_array into thin split_key /
combine_shares helpers. Also widens derive_key salt parameter from &[u8;16]
to &[u8] to accommodate the 32-byte share salts.

refactor(server::actors::vault): clean up Bootstrap/TryUnseal, remove Bootstrapping state ... 9764b0d5ce

Bootstrap and TryUnseal now accept a SafeCell<Vec<u8>> seal key directly.
The Bootstrapping intermediate state is removed — multi-operator coordination
is the responsibility of VaultCoordinator, which calls Bootstrap atomically
once all shares are collected.

feat(server): introduce VaultCoordinator for multi-operator Shamir bootstrap/unseal ... 6f65c907a3

VaultCoordinator collects operator passphrases, splits the seal key into
Shamir shares on bootstrap (encrypting each share with the operator's
passphrase via Argon2 + XChaCha20-Poly1305), and reconstructs the seal
key from threshold shares on unseal. Adds vsss-rs 5.4.0 and rand_core 0.6
dependencies.

feat(server::grpc): wire Shamir committee bootstrap and unseal proto messages ... 0d364d1951

Adds DeclareCommittee and ContributePassphrase variants to bootstrap.proto,
ContributePassphrase to unseal.proto, and AwaitingContributions result codes
to both. Implements corresponding inbound converters and outbound reply
mappings. VaultGate handlers delegate to VaultCoordinator.

CleverWild self-assigned this 2026-06-12 17:45:33 +00:00

CleverWild added 2 commits 2026-06-12 19:15:33 +00:00

fix(server::tests): tighten unseal test seal_key params to &[u8; 32] a3b98ca024

refactor(server::crypto): use fixed-size [u8; 32] and KeyCell throughout seal key API 0098c3c08a

CleverWild added 1 commit 2026-06-12 20:01:23 +00:00

housekepping: add fixme for start_bootstrap's operator_id 6f270ef0c4

CleverWild added 6 commits 2026-06-13 13:31:10 +00:00

feat(proto): add governance proposal/vote RPC definitions 0cb0de759b

feat(db): add proposal and proposal_vote tables d7950beb09

feat(crypto): expose governance signing context and make shamir_threshold pub const af13465c03

feat(server): introduce ProposalManager actor with quorum voting logic 8517b981f2

feat(server::grpc): wire governance RPCs through operator session f981ddeb79

test(server): governance integration tests 0b331d90bf

CleverWild added 1 commit 2026-06-13 13:51:44 +00:00

feat(server): ProposalKind ::GrantWalletAccess and ::ApproveServerUpdate 514a4cb2d1

CleverWild added 5 commits 2026-06-13 20:05:28 +00:00

feat(server): ProposalKind::ReplaceOperator f080a8615f

feat(server): ProposalKind::UpdateShamirParameters ab767fe158

feat(server): ProposalKind::ApprovePersistentGrant b2b159b16f

feat(server): ProposalKind::ApproveOneOffTransaction 99e2b841e9

refactor(server): typed pubkey len via u32::try_from in ReplaceOperator 3b090cd3ce

CleverWild added 1 commit 2026-06-13 20:14:28 +00:00

feat(server): two-operator vault requires at least one recovery share f8c621b20e

CleverWild added 1 commit 2026-06-13 20:20:53 +00:00

feat(server): key-rotation proposals require full quorum (§3.3) 2fda0484fc

CleverWild added 1 commit 2026-06-13 20:31:14 +00:00

feat(server): recovery operators with sleeping/wakeup mechanism (§3.5/§3.6) eb16da3a20

CleverWild added 2 commits 2026-06-13 21:10:06 +00:00

fix(crypto): handle 1-of-N Shamir split when ordinary_count=1 6017ef29ca

feat(vault): add recovery passphrase handling for bootstrap and unseal processes 9f9b6820c2

CleverWild added 2 commits 2026-06-14 13:11:16 +00:00

refactor(proposal): replace string kind dispatch with ProposalKindTag enum (strum) aff87c13ca

feat(vault)!: implement full Shamir re-key flow and governance execution (§3.3–§3.5) ... 7ab47ec563

- Add `rekey.proto` with `ContributePassphrase` / `ContributeRecoveryPassphrase` / `RekeyResult`
- Wire `rekey` as a 4th vault stream payload in `vault.proto` and gRPC dispatch
- Add `RekeyRootKey` message to `Vault` actor: generates new random seal key, re-encrypts root key, writes new `root_key_history` row
- Add `StartRekey`, `ContributeRekey`, `ContributeRecoveryRekey` messages to `VaultCoordinator`; `finalize_rekey` uses threshold-1 fast path identical to bootstrap
- `execute_replace_operator` now UPDATEs `operator_identity.public_key` in-place (avoids FK constraint violation), deletes stale `operator` share row, then triggers `StartRekey`
- `execute_update_shamir_parameters` triggers `StartRekey` instead of warning stub
- `ProposalKind::ReplaceOperator` carries `old_operator_id`; encode/decode updated accordingly
- `GlobalActors::spawn` extracts `vault_coordinator` before `Ok(Self { … })` so it can be cloned into `ProposalManager::new`
- Add `handle_rekey` in session handlers forwarding passphrase contributions to `VaultCoordinator`
- Fix test: rename `replace_operator_inserts_identity_row` → `replace_operator_updates_pubkey_and_starts_rekey`, assert count stays 1 and pubkey is updated

Skipper commented 2026-06-19 14:05:28 +00:00

Author

Owner

Copy Link

so what is the status of this?

so what is the status of this?

CleverWild commented 2026-06-30 18:05:35 +00:00

Member

Copy Link

waiting for review.
Core functionality is implemented, but there were some gaps in spec understanding, but I no longer know them.

waiting for review. Core functionality is implemented, but there were some gaps in spec understanding, but I no longer know them.

Some checks failed

Hide all checks

ci/woodpecker/pr/server-lint Pipeline failed

Required

Details

ci/woodpecker/pr/server-audit Pipeline was successful

Required

Details

ci/woodpecker/pr/server-vet Pipeline failed

Details

ci/woodpecker/pr/server-test Pipeline was successful

Required

Details

This pull request has changes conflicting with the target branch.

• protobufs/operator/vault/unseal.proto
• server/Cargo.lock
• server/crates/arbiter-server/src/actors/evm/mod.rs
• server/crates/arbiter-server/src/actors/vault/mod.rs
• server/crates/arbiter-server/src/peers/operator/auth/state.rs
• server/crates/arbiter-server/src/peers/operator/session/handlers.rs
• server/crates/arbiter-server/src/peers/operator/session/mod.rs

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat-shamir:feat-shamir

git checkout feat-shamir

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

Compat

Breaking

Breaking change that won't be backward compatible

Difficulty

High

3

Hard difficulty. Experience needed to fix: A lot.

Difficulty

Low

1

Easy difficulty. Experience needed to fix: Not much. Good first issue.

Difficulty

Medium

2

Medium difficulty. Experience needed to fix: Intermediate.

Kind

Bug

This is a bug.

Kind

Enhancement

Improve existing functionality.

Kind

Feature

New functionality

Kind

RFC

Request for comments

Kind

Security

This is security issue

Kind

Testing

This is testing issue.

Kind

Tracking issue

An issue tracking the progress of sth. like the implementation of an RFC

Priority

Critical

1

The priority is critical

Priority

High

2

The priority is high

Priority

Low

4

The priority is low

Priority

Medium

3

The priority is medium

Reviewed

Confirmed

1

Issue has been confirmed

Reviewed

Duplicate

2

This issue or pull request already exists

Reviewed

Invalid

3

Invalid issue

Reviewed

Pending

4

Requires review by dev

Reviewed

Won't Fix

3

This issue won't be fixed

Status

Abandoned

3

Somebody has started to work on this but abandoned work

Status

Blocked

1

Something is blocking this issue or pull request

Status

Need More Info

2

Feedback is required to reproduce issue or to continue work

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

CleverWild Skipper Tangonell goodvin testuser

No Assignees CleverWild

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MarketTakers/arbiter#91