WIP: feat-shamir #91

Closed

Skipper wants to merge 107 commits from feat-shamir into main

pull from: feat-shamir

merge into: MarketTakers:main

MarketTakers:main

MarketTakers:cleverwild/sznwsuou

MarketTakers:feat-shamir-custody

MarketTakers:feat-shamir-v2

MarketTakers:push-zvwxtnqkumlx

MarketTakers:error-handling-hardening

MarketTakers:terminate-VaultGate-connection-after-vault-lockout

MarketTakers:hashable-integrable-macro

MarketTakers:zeroized-bootstrap-token

MarketTakers:feat-auto-fix-lints

MarketTakers:enforcing-integrity

MarketTakers:push-wxnlsulvnrpz

MarketTakers:check-uac-cerf

MarketTakers:impl-useragent_delete_grant

MarketTakers:Client-key-replacement-attack

MarketTakers:critical-fix-CI-check-all-features

MarketTakers:win-service

MarketTakers:fix-proto-build-script

MarketTakers:terrors-refactor

MarketTakers:PoC-terrors

MarketTakers:push-lspnytwuyulm

MarketTakers:key-alternative

MarketTakers:push-yyxvkwvyspxv

MarketTakers:security-breaktrougth

Conversation 2 Commits 107 Files Changed 264 +4692 -776

107 Commits

Author	SHA1	Message	Date
CleverWild	9697677a9c	chore(deps): bump kameo version	2026-08-25 14:43:16 +02:00
CleverWild	f1a5fb16d1	feat(vault)!: implement full Shamir re-key flow and governance execution (§3.3–§3.5) ... - Add `rekey.proto` with `ContributePassphrase` / `ContributeRecoveryPassphrase` / `RekeyResult` - Wire `rekey` as a 4th vault stream payload in `vault.proto` and gRPC dispatch - Add `RekeyRootKey` message to `Vault` actor: generates new random seal key, re-encrypts root key, writes new `root_key_history` row - Add `StartRekey`, `ContributeRekey`, `ContributeRecoveryRekey` messages to `VaultCoordinator`; `finalize_rekey` uses threshold-1 fast path identical to bootstrap - `execute_replace_operator` now UPDATEs `operator_identity.public_key` in-place (avoids FK constraint violation), deletes stale `operator` share row, then triggers `StartRekey` - `execute_update_shamir_parameters` triggers `StartRekey` instead of warning stub - `ProposalKind::ReplaceOperator` carries `old_operator_id`; encode/decode updated accordingly - `GlobalActors::spawn` extracts `vault_coordinator` before `Ok(Self { … })` so it can be cloned into `ProposalManager::new` - Add `handle_rekey` in session handlers forwarding passphrase contributions to `VaultCoordinator` - Fix test: rename `replace_operator_inserts_identity_row` → `replace_operator_updates_pubkey_and_starts_rekey`, assert count stays 1 and pubkey is updated	2026-08-25 14:43:16 +02:00
CleverWild	41ba337f9c	refactor(proposal): replace string kind dispatch with ProposalKindTag enum (strum)	2026-08-25 14:43:16 +02:00
CleverWild	b502ec23dc	feat(vault): add recovery passphrase handling for bootstrap and unseal processes	2026-08-25 14:43:16 +02:00
CleverWild	0cce24adf5	fix(crypto): handle 1-of-N Shamir split when ordinary_count=1	2026-08-25 14:43:16 +02:00
CleverWild	74200b6a59	feat(server): recovery operators with sleeping/wakeup mechanism (§3.5/§3.6)	2026-08-25 14:43:16 +02:00
CleverWild	da600f40ed	feat(server): key-rotation proposals require full quorum (§3.3)	2026-08-25 14:43:16 +02:00
CleverWild	75bb842cf1	feat(server): two-operator vault requires at least one recovery share	2026-08-25 14:43:16 +02:00
CleverWild	10bae6877f	refactor(server): typed pubkey len via u32::try_from in ReplaceOperator	2026-08-25 14:43:16 +02:00
CleverWild	0ba9559b5a	feat(server): ProposalKind::ApproveOneOffTransaction	2026-08-25 14:43:16 +02:00
CleverWild	de517b3585	feat(server): ProposalKind::ApprovePersistentGrant	2026-08-25 14:43:16 +02:00
CleverWild	0215bacf31	feat(server): ProposalKind::UpdateShamirParameters	2026-08-25 14:43:16 +02:00
CleverWild	52c204b654	feat(server): ProposalKind::ReplaceOperator	2026-08-25 14:43:16 +02:00
CleverWild	9e4ba24ac9	feat(server): ProposalKind ::GrantWalletAccess and ::ApproveServerUpdate	2026-08-25 14:43:16 +02:00
CleverWild	e027bb13aa	test(server): governance integration tests	2026-08-25 14:43:16 +02:00
CleverWild	26f8a8f57d	feat(server::grpc): wire governance RPCs through operator session	2026-08-25 14:43:16 +02:00
CleverWild	d0f82b31ed	feat(server): introduce ProposalManager actor with quorum voting logic	2026-08-25 14:43:16 +02:00
CleverWild	fbdb432f2e	feat(crypto): expose governance signing context and make shamir_threshold pub const	2026-08-25 14:43:16 +02:00
CleverWild	4e83a184c3	feat(db): add proposal and proposal_vote tables	2026-08-25 14:43:16 +02:00
CleverWild	d2ae344277	feat(proto): add governance proposal/vote RPC definitions	2026-08-25 14:43:16 +02:00
CleverWild	38d8c76626	housekepping: add fixme for start_bootstrap's operator_id	2026-08-25 14:43:16 +02:00
CleverWild	bb76e3b1ec	refactor(server::crypto): use fixed-size [u8; 32] and KeyCell throughout seal key API	2026-08-25 14:43:16 +02:00
CleverWild	488f1d916b	fix(server::tests): tighten unseal test seal_key params to &[u8; 32]	2026-08-25 14:43:16 +02:00
CleverWild	1a179ff335	feat(server::grpc): wire Shamir committee bootstrap and unseal proto messages ... Adds DeclareCommittee and ContributePassphrase variants to bootstrap.proto, ContributePassphrase to unseal.proto, and AwaitingContributions result codes to both. Implements corresponding inbound converters and outbound reply mappings. VaultGate handlers delegate to VaultCoordinator.	2026-08-25 14:43:16 +02:00
CleverWild	8566a73e71	feat(server): introduce VaultCoordinator for multi-operator Shamir bootstrap/unseal ... VaultCoordinator collects operator passphrases, splits the seal key into Shamir shares on bootstrap (encrypting each share with the operator's passphrase via Argon2 + XChaCha20-Poly1305), and reconstructs the seal key from threshold shares on unseal. Adds vsss-rs 5.4.0 and rand_core 0.6 dependencies.	2026-08-25 14:43:16 +02:00
CleverWild	cd706e9eca	refactor(server::actors::vault): clean up Bootstrap/TryUnseal, remove Bootstrapping state ... Bootstrap and TryUnseal now accept a SafeCell<Vec<u8>> seal key directly. The Bootstrapping intermediate state is removed — multi-operator coordination is the responsibility of VaultCoordinator, which calls Bootstrap atomically once all shares are collected.	2026-08-25 14:43:16 +02:00
CleverWild	213486e8c8	feat(server::crypto): add Shamir secret sharing utilities ... Wraps vsss_rs Gf256::split_array / combine_array into thin split_key / combine_shares helpers. Also widens derive_key salt parameter from &[u8;16] to &[u8] to accommodate the 32-byte share salts.	2026-08-25 14:43:16 +02:00
CleverWild	974ac38266	feat(server::db): add share_salt column to operator table ... Each operator row now stores a 32-byte random salt used to derive the per-operator share encryption key from their passphrase (Argon2 KDF).	2026-08-25 14:43:16 +02:00
CleverWild	e0d1686026	feat(server::actors::evm): implement operator_delete_grant ... Sets revoked_at on the evm_basic_grant row; returns NotFound if the grant does not exist. Wires the handler in OperatorSession replacing the todo!().	2026-08-25 14:43:16 +02:00
CleverWild	37d93b2263	fix(server::peers::operator::auth): make ChallengeContext pub for smlang state machine ... smlang generates a public state enum whose variants contain ChallengeContext, requiring the type itself to be fully public. Also tightens the wildcard arm in client auth to an exhaustive match.	2026-08-25 14:43:16 +02:00
Skipper	30210a4ed5	feat(grpc): governance contract	2026-08-25 14:43:16 +02:00
Skipper	0a80363ea7	WIP: some things	2026-08-25 14:41:43 +02:00
Skipper	a773255935	refactor(server::db): introduced newtype wrappers for entity id's in database	2026-05-04 19:35:27 +02:00
Skipper	3f801abdff	housekeeping(server): deps upgrade + diesel migration to AsyncFnOnce	2026-05-01 11:22:40 +02:00
Skipper	2b44570ab4	fix(server): MacOS build version	2026-04-19 13:47:47 +02:00
Skipper	1f9b253433	housekeeping(server): removed unused deps	2026-04-19 13:46:49 +02:00
Skipper	a1c3ffd2d1	refactor: rename to to better reflect meaning	2026-04-19 13:41:50 +02:00
Skipper	fd25de32a1	docs: move to folder and update to new challenge payload	2026-04-18 15:17:18 +02:00
Skipper	9ab074170b	merge: feat-lints into main	2026-04-18 15:04:33 +02:00
Stas	18b8a3bbf5	Merge pull request 'refactor-integrity-check' (#90) from refactor-integrity-check into main ... Reviewed-on: #90	2026-04-18 11:54:30 +00:00
Skipper	38cf1b98b9	housekeeping(server): clippy warns fix	2026-04-18 13:53:11 +02:00
Skipper	9cf87b2058	merge: refactor-integrity-check into main	2026-04-18 13:46:28 +02:00
Skipper	929d50b589	housekeeping(server): clean too-broad visibility markers and organize imports	2026-04-18 13:30:09 +02:00
Skipper	70acfc99b5	merge: refactor-integrity-check into main	2026-04-18 13:19:13 +02:00
Stas	28f84d03ab	Merge pull request 'housekeeping(server): dependencies upgrade' (#89) from push-zmvtzuwrnyyv into main ... Reviewed-on: #89	2026-04-17 19:20:50 +00:00
Skipper	4a8e51ef32	docs: updated to new auth challenge format and removed stale TOCTOU race condition note	2026-04-17 18:25:55 +02:00
Skipper	9ee86afc19	fix(useragent): now using new challenge format	2026-04-17 18:19:51 +02:00
Skipper	790026e93b	fix(server::tests): api surface of auth challenge changed	2026-04-17 17:58:22 +02:00
Skipper	0e09afda5d	refactor(server::{useragent::auth, client::auth}): use random based + timestamp nonce instead of monotonic counter in database	2026-04-17 17:44:42 +02:00
Skipper	51e6571d80	refactor(server): now keeps track of useragents, instead of	2026-04-17 00:00:43 +02:00
Skipper	3b828d5874	refactor(server::grpc::vault_gate): standard approach using / traits	2026-04-16 22:15:18 +02:00
Skipper	a6f94e3115	fix(server): sending fixed vault state when on stage	2026-04-16 19:36:41 +02:00
hdbg	f49e995c2f	WIP: kameo::messages wiring for transport generalization	2026-04-16 17:18:46 +02:00
Skipper	e88df432fb	housekeeping(server): dependencies upgrade	2026-04-14 19:10:07 +02:00
hdbg	87ee0fe87b	feat(user-agent): add VaultGate for sealed vault authentication	2026-04-12 11:53:05 +02:00
CleverWild	41b3fc5d39	fix(lints): remove unstable ones	2026-04-10 01:00:21 +02:00
CleverWild	f6a0c32b9d	feat: rustc and clippy linting	2026-04-10 00:42:43 +02:00
hdbg	205227a3df	fix(server::integrity): vault now differentias between expected/unexpected states for commands more granularly	2026-04-08 18:21:48 +02:00
hdbg	a4070e7df7	fix(useragent): unsafe, but working implementation of ml-dsa	2026-04-08 17:43:51 +02:00
hdbg	6b8da567dd	fix(server::user_agent): useragents now self-sign themselves on bootstrap	2026-04-08 17:40:45 +02:00
hdbg	1585f90cae	refactor(server): reorganized client/user_agent actors into separate module peers and added event MessageBus	2026-04-08 12:34:16 +02:00
Stas	62dff3f810	Merge pull request 'refactor(hashing): introduce Hashable derive macro and migrate server types' (#82) from hashing-proc-macro into main ... Reviewed-on: #82 Reviewed-by: Stas <business@jexter.tech>	2026-04-08 00:18:40 +00:00
CleverWild	6e22f368c9	refactor(hashing): introduce Hashable derive macro and migrate server types	2026-04-08 01:32:59 +02:00
Stas	f3cf6a9438	Merge pull request 'Post-quantum crypto and better useragent security' (#80) from push-xrxykvkuxpsv into main ... Reviewed-on: #80	2026-04-07 19:26:54 +00:00
hdbg	a9f9fc2a9d	housekeeping(server): fixed clippy warns	2026-04-07 16:28:47 +02:00
hdbg	d22ab49e3d	refactor(server): moved shared module crypto into arbiter-crypto	2026-04-07 16:24:51 +02:00
hdbg	a845181ef6	docs: ml-dsa scheme everywhere	2026-04-07 15:02:32 +02:00
hdbg	0d424f3afc	refactor(server): migrated auth to ml-dsa	2026-04-07 14:55:31 +02:00
hdbg	1497884ce6	fix(server::bootsrapper): token compare is now constant-time	2026-04-06 18:33:47 +02:00
hdbg	b3464cf8a6	tests(server::client::auth): integrity envelope insertion for valid paths	2026-04-06 18:24:13 +02:00
hdbg	46d1318b6f	feat(server): add integrity verification for client keys	2026-04-06 18:13:11 +02:00
Stas	9c80d51d45	Merge pull request 'fix(server): replaced postcard-based integrity fingerprint with custom trait providing order-independent hashing' (#77) from push-opwuyuwxknyo into main ... Reviewed-on: #77	2026-04-06 15:42:47 +00:00
hdbg	33456a644d	tests(server): property-based testing for ordering independency for hash	2026-04-06 17:40:41 +02:00
hdbg	5bc0c42cc7	fix(server): replaced postcard-based integrity fingerprint with custom trait providing order-independent hashing	2026-04-06 16:25:32 +02:00
hdbg	f6b62ab884	fix(server): added chain_id check and covered check_shared_constraints with unit tests	2026-04-06 12:57:18 +02:00
hdbg	2dd5a3f32f	tests(server): initial cargo-mutants	2026-04-06 12:03:56 +02:00
hdbg	1aca9d4007	fix(server): simplify hash function for debug profile	2026-04-05 22:50:28 +02:00
Stas	5ee1b49c43	Merge pull request 'feat(server): integrity envelope engine for EVM grants with HMAC verification' (#51) from integrity-envelope into main ... Reviewed-on: #51	2026-04-05 16:26:51 +00:00
hdbg	00745bb381	tests(server): fixed for new integrity checks	2026-04-05 14:49:02 +02:00
hdbg	b122aa464c	refactor(server): rework envelopes and integrity check	2026-04-05 14:17:00 +02:00
hdbg	9fab945a00	fix(server): remove stale mentions of miette	2026-04-05 10:45:24 +02:00
CleverWild	aeed664e9a	chore: inline integrity proto types	2026-04-05 10:44:21 +02:00
CleverWild	4057c1fc12	feat(server): integrity envelope engine for EVM grants with HMAC verification	2026-04-05 10:44:21 +02:00
hdbg	f5eb51978d	docs: add recovery operators and multi-operator details	2026-04-05 08:27:24 +00:00
hdbg	d997e0f843	docs: add multi-operator governance section	2026-04-05 08:27:24 +00:00
hdbg	7aca281a81	merge: @main into client-integrity-verification	2026-04-05 10:25:46 +02:00
hdbg	01b12515bd	housekeeping(server): fixed clippy warns	2026-04-04 14:33:48 +02:00
hdbg	4a50daa7ea	refactor(user-agent): remove backfill pubkey integrity tags	2026-04-04 14:32:00 +02:00
hdbg	352ee3ee63	fix(server): previously, user agent auth accepted invalid signatures	2026-04-04 14:28:07 +02:00
hdbg	dd51d756da	refactor(server): separate crypto by purpose and moved outside of actor into separate module	2026-04-04 14:21:52 +02:00
CleverWild	0bb6e596ac	feat(auth): implement attestation status verification for public keys	2026-04-04 12:10:45 +02:00
CleverWild	881f16bb1a	fix(keyholder): comment drift	2026-04-04 12:02:50 +02:00
CleverWild	78895bca5b	refactor(keyholder): generalize derive_useragent_integrity_key and compute_useragent_pubkey_integrity_tag corespondenly to derive_integrity_key and compute_integrity_tag	2026-04-04 12:00:39 +02:00
CleverWild	a02ef68a70	feat(auth): add seal-key-derived pubkey integrity tags with auth enforcement and unseal backfill	2026-03-30 00:17:04 +02:00
hdbg	e5be55e141	style(dashboard): format code and add title margin	2026-03-29 10:54:02 +02:00
hdbg	8f0eb7130b	feat(grants-create): add configurable grant authorization fields	2026-03-29 00:37:58 +01:00
hdbg	94fe04a6a4	refactor(useragent::evm::grants): split into more files & flutter_form_builder usage	2026-03-29 00:37:58 +01:00
hdbg	976c11902c	fix(useragent::dashboard): screen pushed twice due to improper listen hook	2026-03-29 00:37:58 +01:00
hdbg	c8d2662a36	refactor(grants): wrap grant list in SingleChildScrollView	2026-03-29 00:37:58 +01:00
hdbg	ac5fedddd1	style(dashboard): remove const from _CalloutBell and add title to nav rail	2026-03-29 00:37:58 +01:00
hdbg	0c2d4986a2	refactor(useragent): moved shared CreamPanel and StatePanel into generic widgets	2026-03-29 00:37:58 +01:00
hdbg	a3203936d2	feat(evm): add EVM grants screen with create UI and list	2026-03-29 00:37:58 +01:00
hdbg	fb1c0ec130	refactor(proto): restructure wallet access messages for improved data organization	2026-03-29 00:37:58 +01:00
hdbg	2a21758369	refactor(server::evm): removed repetetive errors and error variants	2026-03-29 00:37:58 +01:00
hdbg	1abb5fa006	refactor(useragent::evm::table): broke down into more widgets	2026-03-29 00:37:58 +01:00
hdbg	e1b1c857fa	refactor(useragent::evm): moved out header into general widget	2026-03-29 00:37:58 +01:00
hdbg	4216007af3	feat(useragent): vibe-coded access list	2026-03-29 00:37:58 +01:00