Block a user
SDK client metadata is silently rewritten on reconnect
User-agent auth accepts integrity-unavailable state while sealed
Bootstrap token registration lacks proof of possession
Bootstrap token persists on disk with weak file permissions
Unseal and bootstrap handshake lack brute-force protection
Client key is not integrity-protected
revoked_at is not included in signature
Encrypted key material not bound to wallet address — cross-wallet signing possible
Come up with mechanism for enforcing integrity protection usage
Implement User Agent client library
doc: multi-operator rules