SIWE provisioning fails: /v1/auth/verify returns 500 Database error / 401 Invalid or expired nonce

[asimov4242]

--provision fails for all wallets: /v1/auth/verify returns 500 Database error (new address) or 401 Invalid or expired nonce (existing address).

Signature verification itself passes — a deliberately bad signature produces a different, earlier error (400 Verification failed), so the SIWE message and signing in src/identity/provision.ts are behaving correctly. The failure is downstream of signature checking.

Reproduction

Run automaton --provision with an EVM wallet. Consistently fails; 4 attempts over 22 minutes on 2026-08-22 (13:27–13:49 UTC), all identical.

Provision failed: SIWE verification failed: 401 {"error":"Invalid or expired nonce"}

Isolating it

I reproduced the flow standalone against https://api.conway.tech — fresh nonce from POST /v1/auth/nonce for each attempt, message built with the same siwe version the repo pins, signed with viem:

Test	Response
Deliberately invalid signature	400 {"error":"Verification failed"}
Brand-new throwaway address, valid signature, fresh nonce	500 {"error":"Database error"}
Replay of an already-consumed nonce	401 {"error":"Invalid or expired nonce"}
Older nonce used after a newer one was issued	500 {"error":"Database error"} (so nonces do not invalidate one another)
Existing registered address, valid signature, fresh nonce	401 {"error":"Invalid or expired nonce"}

An unregistered address with a valid signature and a two-second-old nonce still gets 500 Database error, which looks like the user-insert path failing. A previously registered address takes the lookup path instead and surfaces 401. Both appear to be the same underlying database fault.

Varying domain (conway.tech, api.conway.tech) and chainId (1, 8453) made no difference. Passing address to POST /v1/auth/nonce in the body or query string also made no difference — a nonce is issued either way.

Details

• Server request id: 72ee9ec2-90a6-474c-b96f-55ab4dd5c13a (~13:29 UTC, 2026-08-22)
• Repo at 871c53e, up to date with origin/main
• Node v24.18.0, Windows 11

Happy to supply more traces if useful.