@ibgib/core-gib 0.1.43 → 0.1.45

package/src/sync/sync-saga-coordinator.mts

@@ -16,13 +16,16 @@ import { IbGibAddr } from "@ibgib/ts-gib/dist/types.mjs";
 import { GLOBAL_LOG_A_LOT } from "../core-constants.mjs";
 import { IbGibSpaceAny } from "../witness/space/space-base-v1.mjs";
 import { putInSpace, getLatestAddrs, getFromSpace, registerNewIbGib } from "../witness/space/space-helper.mjs";
-import { KeystoneIbGib_V1 } from "../keystone/keystone-types.mjs";
+import { KeystoneIbGib_V1, KeystonePoolConfig_HashV1 } from "../keystone/keystone-types.mjs";
 import { KeystoneService_V1 } from "../keystone/keystone-service-v1.mjs";
+import { deriveKey } from "../keystone/kdf/kdf-helpers.mjs";
+import { KdfStrategy } from "../keystone/kdf/kdf-constants.mjs";
 import { MetaspaceService } from "../witness/space/metaspace/metaspace-types.mjs";
 import {
     SyncStage, SYNC_ATOM, SYNC_MSG_REL8N_NAME, SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN,
     SyncConflictStrategy,
     SYNC_CONFLICT_STRATEGY_VALID_VALUES,
+    DEFAULT_SESSION_IDENTITY_INITIAL_DELEGATE_SECRET,
 } from "./sync-constants.mjs";
 import {
     appendToTimeline, createTimeline, getHistory, getHistoryAddrs, Rel8nInfo, Rel8nRemovalInfo
@@ -47,8 +50,8 @@ import { SYNC_SAGA_MSG_ATOM } from "./sync-saga-message/sync-saga-message-consta
 import { SyncSagaInfo } from "./sync-types.mjs";
 import { splitPerTjpAndOrDna, getTimelinesGroupedByTjp, isIbGib, getIbGibsFromCache_fallbackToSpaces } from "../common/other/ibgib-helper.mjs";
 import { SyncPeerWitness } from "./sync-peer/sync-peer-types.mjs";
-import { SyncSagaContextIbGib_V1, } from "./sync-saga-context/sync-saga-context-types.mjs";
-import { createSyncSagaContext, validateContextAndSagaFrame } from "./sync-saga-context/sync-saga-context-helpers.mjs";
+import { SyncSagaContextData_V1, SyncSagaContextIbGib_V1, SyncSagaContextRel8ns_V1, } from "./sync-saga-context/sync-saga-context-types.mjs";
+import { getSyncSagaContextIb, validateContextAndSagaFrame } from "./sync-saga-context/sync-saga-context-helpers.mjs";
 import { newupSubject, } from "../common/pubsub/subject/subject-helper.mjs";
 import { SubjectWitness } from "../common/pubsub/subject/subject-types.mjs";
 import { getSyncSagaMessageFromFrame } from "./sync-saga-message/sync-saga-message-helpers.mjs";
@@ -60,6 +63,9 @@ import { graftTimelines, } from "./graft-info/graft-info-helpers.mjs";
 import { GRAFT_INFO_REL8N_NAME } from "./graft-info/graft-info-constants.mjs";
 import { GraftInfoIbGib_V1 } from "./graft-info/graft-info-types.mjs";
 import { validateIbGibIntrinsically } from "@ibgib/ts-gib/dist/V1/validate-helper.mjs";
+import { KEYSTONE_VERB_MANAGE } from "../keystone/keystone-constants.mjs";
+import { validateKeystoneGraph } from "../keystone/keystone-helpers.mjs";
+import { SYNC_SAGA_CONTEXT_ATOM } from "./sync-saga-context/sync-saga-context-constants.mjs";
 
 
 const logalot = GLOBAL_LOG_A_LOT;
@@ -83,7 +89,7 @@ export class SyncSagaCoordinator {
     private lc: string = `[${SyncSagaCoordinator.name}]`;
 
     constructor(
-        private keystone: KeystoneService_V1
+        private keystoneSvc: KeystoneService_V1
     ) {
 
     }
@@ -94,18 +100,14 @@ export class SyncSagaCoordinator {
      * @remarks
      * **Execution Context**: **Sender (Local)**.
      * This method is the entry point for starting a sync session.
-     *
-     * @param opts.peer - The remote peer witness to communicate with.
-     * @param opts.localSpace - The local space that will be read from and written to.
-     * @param opts.metaspace - Service for creating temp spaces and managing ibgibs.
-     * @param opts.domainIbGibs - The root ibgibs defining the scope of the sync.
-     * @param opts.useSessionIdentity - (Optional) Whether to create an ephemeral session identity. Default: true.
      */
     public async sync({
         peer,
         domainIbGibs,
         conflictStrategy = SyncConflictStrategy.abort,
         useSessionIdentity = true,
+        identity,
+        identitySecret,
         metaspace,
         localSpace,
     }: {
@@ -121,7 +123,8 @@ export class SyncSagaCoordinator {
          */
         domainIbGibs: IbGib_V1[],
         /**
-         * The space containing the {@link domainIbGibs} we want to sync.
+         * The space containing the {@link domainIbGibs} we want to sync. If
+         * sync is successful, any updates to timelines will be stored here.
          */
         localSpace: IbGibSpaceAny;
         /**
@@ -129,11 +132,17 @@ export class SyncSagaCoordinator {
          */
         metaspace: MetaspaceService;
         /**
-         * The identity authorizing this sync.
+         * The primary (i.e. non-session) identity authorizing this sync.
+         *
+         * If this is truthy, then {@link identitySecret} must also be provided.
          */
         identity?: KeystoneIbGib_V1;
         /**
          * The secret for the identity (to sign the commit).
+         *
+         * If provided, this will drive both signing {@link identity} keystone
+         * (if provided) AND session keystone (if {@link useSessionIdentity} is
+         * true).
          */
         identitySecret?: string;
         /**
@@ -144,8 +153,10 @@ export class SyncSagaCoordinator {
          */
         conflictStrategy?: SyncConflictStrategy;
         /**
-         * If true, creates an ephemeral session identity for the sync process to
-         * secure the sync transaction itself.
+         * If true, creates an ephemeral session identity for the sync process
+         * to secure the sync transaction itself.
+         *
+         * If this is true, {@link identitySecret} must also be provided.
          *
          * @default true
          */
@@ -196,9 +207,16 @@ export class SyncSagaCoordinator {
             try {
 
                 // BOOTSTRAP IDENTITY (Session Keystone)
-                const sessionIdentity = useSessionIdentity
-                    ? await this.getSessionIdentity({ sagaId, metaspace, localSpace })
-                    : undefined;
+                let sessionIdentity: KeystoneIbGib_V1 | undefined = undefined;
+
+                if (useSessionIdentity) {
+                    if (!identitySecret) { throw new Error(`useSessionIdentity is true, but identitySecret is falsy. Must provide a secret if you want to use a session identity. (E: 81915860c4dd3ea4dfd81825fa74c126)`); }
+                    // creates the initial session identity (keystone). the flow
+                    // (i think) will go: evolve saga frame, then sign keystone,
+                    // then create/send context.
+                    sessionIdentity = await this.getSessionIdentity({ sagaId, identitySecret, metaspace, localSpace });
+                }
+
                 // if (logalot) { console.log(`${lc} sessionIdentity: ${sessionIdentity ? pretty(sessionIdentity) : 'undefined'} (I: abc01872800b3a66b819a05898bba826)`); }
 
                 // CREATE INITIAL FRAME (Stage.init)
@@ -214,6 +232,7 @@ export class SyncSagaCoordinator {
                 await this.executeSagaLoop({
                     initFrame, initDomainGraph,
                     peer,
+                    identitySecret,
                     sessionIdentity,
                     updates$,
                     localSpace,
@@ -266,7 +285,13 @@ export class SyncSagaCoordinator {
          * Local temp space relative to the execution context's POV
          */
         myTempSpace: IbGibSpaceAny,
+        /**
+         * @see {@link sync} `identity` param.
+         */
         identity?: KeystoneIbGib_V1,
+        /**
+         * @see {@link sync} `identitySecret` param.
+         */
         identitySecret?: string,
         metaspace: MetaspaceService,
     }): Promise<SyncSagaContextIbGib_V1 | null> {
@@ -279,7 +304,6 @@ export class SyncSagaCoordinator {
                 mySpace,
                 myTempSpace,
                 identity,
-                identitySecret,
                 metaspace,
             });
 
@@ -303,12 +327,13 @@ export class SyncSagaCoordinator {
             // create the return context
             const { frame, payloadIbGibsDomain } = contextResult.nextFrameInfo;
 
-            const responseCtx = await createSyncSagaContext({
+            const responseCtx = await this.createSyncSagaContext({
                 sagaFrame: frame,
                 localSpace: mySpace,
                 payloadIbGibsDomain,
-                // todo: we need to thoroughly go through the identity per each step after getting basic merging
-                sessionKeystones: identity ? [identity] : undefined, // ??
+                sessionKeystone: identity,
+                sessionSecret: identitySecret,
+                metaspace,
             });
 
             const immediateValidationErrors = await validateContextAndSagaFrame({
@@ -325,12 +350,74 @@ export class SyncSagaCoordinator {
         }
     }
 
+    private async getSessionSecret({
+        sagaId,
+        identitySecret,
+    }: {
+        sagaId: string,
+        identitySecret: string,
+    }): Promise<string> {
+        const lc = `${this.lc}[${this.getSessionSecret.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 0de03f8dcd3e32f1fca244e8f2a8a826)`); }
+
+            // Derive session-specific secret using KDF
+            const sessionSecret = await deriveKey({
+                masterSecret: identitySecret,
+                kdfOpts: {
+                    strategy: KdfStrategy.recursive_salt_wrap,
+                    salt: sagaId,
+                    rounds: 10000,
+                    algorithm: 'SHA-256'
+                }
+            });
+
+            return sessionSecret;
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
+    }
+
+    private async getInitialWeakDelegateSessionSecret({
+        sagaId,
+    }: {
+        sagaId: string,
+    }): Promise<string> {
+        const lc = `${this.lc}[${this.getInitialWeakDelegateSessionSecret.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 872ab81a78827b9f2822b78459203226)`); }
+
+            // Create delegate pool bootstrap secret (publicly derivable)
+            const initialDelegateSecret = await deriveKey({
+                masterSecret: DEFAULT_SESSION_IDENTITY_INITIAL_DELEGATE_SECRET, // Weak, publicly derivable secret
+                kdfOpts: {
+                    strategy: KdfStrategy.recursive_salt_wrap,
+                    salt: sagaId,
+                    rounds: 1, // Minimal rounds - this is meant to be weak
+                    algorithm: 'SHA-256'
+                }
+            });
+
+            return initialDelegateSecret;
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
+    }
+
     private async getSessionIdentity({
         sagaId,
+        identitySecret,
         metaspace,
         localSpace,
     }: {
         sagaId: string,
+        identitySecret: string,
         metaspace: MetaspaceService,
         localSpace: IbGibSpaceAny,
     }): Promise<KeystoneIbGib_V1> {
@@ -338,20 +425,59 @@ export class SyncSagaCoordinator {
         try {
             if (logalot) { console.log(`${lc} starting... (I: 428392a4ee636b7bd8f7d5d89a87e826)`); }
 
-            const config: any = {
-                id: 'default',
+            if (!identitySecret) { throw new Error(`(UNEXPECTED) identitySecret falsy? This is expected to be truthy by this point. (E: 8ce053fe59825a6678713128953b9d26)`); }
+
+            const sessionSecret = await this.getSessionSecret({ sagaId, identitySecret });
+
+            const init = await this.getInitialWeakDelegateSessionSecret({ sagaId });
+
+
+            // Create TWO pool configs: Primary (strong) + Delegate (weak bootstrap)
+            const primaryPoolConfig: KeystonePoolConfig_HashV1 = {
+                allowedVerbs: [KEYSTONE_VERB_MANAGE],
+                id: 'primary',
+                type: 'hash-reveal-v1',
+                salt: sagaId,
+                behavior: {
+                    size: 100,  // Large pool for many signatures
+                    replenish: 'top-up',
+                    selectSequentially: 2,
+                    selectRandomly: 2,
+                    targetBindingChars: 10
+                },
+                algo: 'SHA-256',
+                rounds: 1
+            };
+
+            const delegatePoolConfig: any = {
+                id: 'delegate',
                 type: 'hash-reveal-v1',
                 salt: sagaId,
-                behavior: { size: 10, replenish: 'top-up', selectSequentially: 1, selectRandomly: 1, targetBindingChars: 0 },
-                algo: 'SHA-256', rounds: 1
+                behavior: {
+                    size: 10,  // Small pool - only for initial handshake
+                    replenish: 'top-up',
+                    selectSequentially: 1,
+                    selectRandomly: 1,
+                    targetBindingChars: 0
+                },
+                algo: 'SHA-256',
+                rounds: 1
             };
-            const sessionIdentity = await this.keystone.genesis({
-                masterSecret: sagaId,
-                configs: [config],
+
+            // Generate keystone with DUAL pools. We have to first genesis with
+            // one and then add the other, because we have two distinct
+            // secrets.
+            const sessionIdentity = await this.keystoneSvc.genesis({
+                masterSecret: sessionSecret,
+                configs: [primaryPoolConfig],
                 metaspace,
-                space: localSpace // ✅ FIXED: Use durable space, not temp space
+                space: localSpace
             });
 
+            // TODO: Store delegate pool separate challenges derived from bootstrap secret
+            // This allows receiver to verify/evolve the delegate pool
+            // For now, the keystone genesis with multiple configs handles this
+
             return sessionIdentity;
         } catch (error) {
             console.error(`${lc} ${extractErrorMsg(error)}`);
@@ -381,6 +507,7 @@ export class SyncSagaCoordinator {
         initDomainGraph,
         peer,
         sessionIdentity,
+        identitySecret,
         updates$,
         localSpace,
         tempSpace,
@@ -396,6 +523,10 @@ export class SyncSagaCoordinator {
         initDomainGraph: FlatIbGibGraph,
         peer: SyncPeerWitness,
         sessionIdentity?: KeystoneIbGib_V1,
+        /**
+         * if {@link sessionIdentity} provided, this must also be truthy
+         */
+        identitySecret?: string,
         updates$: SubjectWitness<SyncSagaContextIbGib_V1>,
         metaspace: MetaspaceService
         localSpace: IbGibSpaceAny,
@@ -444,9 +575,10 @@ export class SyncSagaCoordinator {
             // #endregion set up peer observable for any domainPayloadsMap
 
             // ...create/compose the Request Context itself...
-            const requestCtx = await createSyncSagaContext({
+            const requestCtx = await this.createSyncSagaContext({
                 sagaFrame: currentFrame,
-                sessionKeystones: sessionIdentity ? [sessionIdentity] : undefined,
+                sessionKeystone: sessionIdentity,
+                sessionSecret: identitySecret,
                 /**
                  * init frame: empty
                  * ack frame: possible push offers
@@ -455,6 +587,7 @@ export class SyncSagaCoordinator {
                  */
                 payloadIbGibsDomain: nextDomainIbGibs,
                 localSpace,
+                metaspace,
             });
 
             // #region Log what we're sending
@@ -582,6 +715,146 @@ export class SyncSagaCoordinator {
         }
     }
 
+
+    /**
+     * Creates new SyncSagaContext stone. Puts/registers in {@link localSpace}
+     * immediately after creation.
+     *
+     * @returns The context ibGib.
+     *
+     * ## notes
+     *
+     * the other ibgibs that are related to this context stone should already be
+     * put/registered in {@link localSpace}.
+     */
+    private async createSyncSagaContext({
+        sagaFrame,
+        sessionKeystone,
+        sessionSecret,
+        payloadIbGibsDomain,
+        metaspace,
+        localSpace,
+    }: {
+        /**
+         * The main saga frame (Init, Ack, etc.).
+         */
+        sagaFrame: SyncIbGib_V1;
+        /**
+         * Session identity keystone.
+         */
+        sessionKeystone: KeystoneIbGib_V1 | undefined;
+        /**
+         * If using session ({@link sessionKeystone} is truthy), this must be
+         * provided in order to sign it.
+         */
+        sessionSecret: string | undefined;
+        /**
+         * Domain payload ibgibs when the sync saga frame includes actual domain
+         * payloads to send, e.g., in a Delta frame.
+         */
+        payloadIbGibsDomain?: IbGib_V1[];
+        /**
+         * reference to the current metaspace
+         */
+        metaspace: MetaspaceService,
+        /**
+         * we persist the context in the local/sender space (relative to our
+         * execution POV) right when we create it.
+         */
+        localSpace: IbGibSpaceAny;
+    }): Promise<SyncSagaContextIbGib_V1> {
+        const lc = `[${this.createSyncSagaContext.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 6b87bee313e811d1d2fc90e87fbec826)`); }
+
+            // #region sanity/validation
+            if (!sagaFrame.data) { throw new Error(`(UNEXPECTED) sagaFrame.data falsy? (E: 04c49b4cccba6842a8b52e4c6f570726)`); }
+            if (!sagaFrame.data.n && sagaFrame.data.n !== 0) { throw new Error(`(UNEXPECTED) sagaFrame.data.n falsy and not 0? (E: 45b508da64a8b28428b11765d684b826)`); }
+            if (sessionKeystone && !sessionSecret) { throw new Error(`(UNEXPECTED) sessionKeystone truthy but sessionSecret falsy? (E: 705ecc25038b12df0e94c90c5561e426)`); }
+            // #endregion sanity/validation
+
+            const date = new Date();
+            const timestamp = getTimestamp(date);
+            const timestampMs = date.getMilliseconds();
+
+            const data: SyncSagaContextData_V1 = {
+                timestamp,
+                timestampMs,
+                sagaN: sagaFrame.data.n,
+            };
+
+            // Domain Payloads
+            const payloadAddrsDomain = payloadIbGibsDomain ?
+                payloadIbGibsDomain?.map(x => getIbGibAddr({ ibGib: x })) :
+                undefined;
+            if (payloadAddrsDomain && payloadAddrsDomain.length > 0) {
+                data[SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN] = payloadAddrsDomain;
+            }
+
+            // rel8ns should always have saga frame, sometimes have keystone
+            const rel8ns: SyncSagaContextRel8ns_V1 = {
+                sagaFrame: [getIbGibAddr({ ibGib: sagaFrame })],
+            };
+            if (sessionKeystone) {
+                const keystoneErrors = await validateKeystoneGraph({
+                    keystoneIbGib: sessionKeystone,
+                    space: localSpace
+                });
+                if (keystoneErrors.length > 0) {
+                    throw new Error(`invalid sessionKeystone. errors: ${keystoneErrors} (E: 3881b8caf2d803767a331e1141e84826)`);
+                }
+                // this addr is BEFORE we sign. So each context ibgib itself will
+                // point to the frame of the keystone just before that keystone
+                // signs with this context as its target.
+                rel8ns.sessionKeystone = [getIbGibAddr({ ibGib: sessionKeystone })];
+            }
+
+            // Generate standard ib
+            const ib = await getSyncSagaContextIb({ data });
+
+            const contextIbGib = await Factory_V1.stone<SyncSagaContextData_V1, SyncSagaContextRel8ns_V1>({
+                parentPrimitiveIb: SYNC_SAGA_CONTEXT_ATOM,
+                ib,
+                data,
+                rel8ns,
+            }) as SyncSagaContextIbGib_V1;
+
+            // put/register immediately. Note that contextIbGib at this point is
+            // pure DTO, i.e., only ib, gib, data, rel8ns props.
+            await putInSpace({ ibGib: contextIbGib, space: localSpace, });
+            await registerNewIbGib({
+                ibGib: contextIbGib,
+                space: localSpace,
+                fnBroadcast: undefined,
+            });
+
+            // Attach actual ibgibs for transport (not pure DTO now)
+            contextIbGib.sagaFrame = sagaFrame;
+            if (payloadIbGibsDomain && payloadIbGibsDomain.length > 0) {
+                contextIbGib.payloadIbGibsDomain = payloadIbGibsDomain;
+            }
+
+            if (sessionKeystone) {
+                if (!sessionSecret) { throw new Error(`(UNEXPECTED) sessionKeystone truthy but sessionSecret falsy? we should have thrown before now (E: a2b0517a37b559543968b888f2067826)`); }
+                const contextAddr = getIbGibAddr({ ibGib: contextIbGib });
+                contextIbGib.signedSessionKeystone = await this.keystoneSvc.sign({
+                    latestKeystone: sessionKeystone,
+                    claim: { target: contextAddr, }, // verb?
+                    space: localSpace,
+                    masterSecret: sessionSecret,
+                    metaspace,
+                });
+            }
+
+            return contextIbGib;
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
+    }
+
     /**
      * Helper to get Knowledge Map for specific domain ibGibs or TJPs.
      * Useful for testing and external validation.
@@ -755,7 +1028,7 @@ export class SyncSagaCoordinator {
             const sagaFrame = await this.evolveSyncSagaIbGib({
                 msgStones: [initStone],
                 conflictStrategy,
-                sessionIdentity: sessionIdentity,
+                sessionIdentity,
                 metaspace,
                 localSpace,
             });
@@ -873,7 +1146,6 @@ export class SyncSagaCoordinator {
         mySpace,
         myTempSpace,
         identity,
-        identitySecret,
         metaspace,
     }: {
         sagaContext: SyncSagaContextIbGib_V1,
@@ -893,7 +1165,6 @@ export class SyncSagaCoordinator {
          */
         myTempSpace: IbGibSpaceAny,
         identity?: KeystoneIbGib_V1,
-        identitySecret?: string,
         metaspace: MetaspaceService,
     }): Promise<HandleSagaResponseContextResult> {
         const lc = `${this.lc}[${this.handleResponseSagaContext.name}]`;
@@ -916,7 +1187,7 @@ export class SyncSagaCoordinator {
                         sagaIbGib,
                         messageData: messageData as SyncSagaMessageInitData_V1,
                         metaspace, mySpace, myTempSpace,
-                        identity, identitySecret
+                        identity,
                     });
                     break;
 
@@ -987,7 +1258,6 @@ export class SyncSagaCoordinator {
         myTempSpace,
         metaspace,
         identity,
-        // identitySecret,
     }: {
         sagaIbGib: SyncIbGib_V1,
         messageData: SyncSagaMessageInitData_V1,
@@ -1004,7 +1274,6 @@ export class SyncSagaCoordinator {
         myTempSpace: IbGibSpaceAny,
         metaspace: MetaspaceService,
         identity?: KeystoneIbGib_V1,
-        identitySecret?: string,
     }): Promise<NextSagaFrameInfo> {
         const lc = `${this.lc}[${this.handleInitFrame.name}]`;
         try {
@@ -2530,10 +2799,9 @@ export class SyncSagaCoordinator {
         localSpace: IbGibSpaceAny,
         metaspace: MetaspaceService,
         /**
-         * does NOT evolve the keystone. this should be done by the caller.
-         * (NOT IMPLEMENTED YET ANYWAY)
+         * does NOT evolve the keystone.
          */
-        sessionIdentity?: KeystoneIbGib_V1,
+        sessionIdentity: KeystoneIbGib_V1 | undefined,
     }): Promise<SyncIbGib_V1> {
         const lc = `${this.lc}[${this.evolveSyncSagaIbGib.name}]`;
         try {
@@ -2617,6 +2885,11 @@ export class SyncSagaCoordinator {
                 const rel8ns: SyncRel8ns_V1 = { [SYNC_MSG_REL8N_NAME]: stoneAddrs, };
                 if (identityAddr) { rel8ns.identity = [identityAddr]; }
 
+                // Attach session keystone to saga frame via hard rel8n
+                if (sessionIdentity) {
+                    rel8ns.sessionKeystones = [getIbGibAddr({ ibGib: sessionIdentity })];
+                }
+
                 const resNew = await createTimeline({
                     space: localSpace,
                     metaspace,

package/src/sync/sync-saga-message/sync-saga-message-types.mts

@@ -55,7 +55,7 @@ export interface SyncSagaMessageIbGib_V1 extends IbGib_V1<SyncSagaMessageData_V1
 /**
  * The "Hello" of the sync protocol.
  *
- * Exchanges knowledge maps (what I have) and identity (who I am).
+ * Exchanges knowledge maps (what I have).
  */
 export interface SyncSagaMessageInitData_V1 extends SyncSagaMessageData_V1 {
     stage: typeof SyncStage.init;
@@ -68,12 +68,6 @@ export interface SyncSagaMessageInitData_V1 extends SyncSagaMessageData_V1 {
      */
     knowledgeMap: { [tjp: string]: IbGibAddr };
 
-    /**
-     * The Keystone Identity of the sender.
-     * Required for the first handshake or if the receiver doesn't know the sender.
-     */
-    identity?: KeystoneIbGib_V1;
-
     /**
      * What the sender wants to do.
      * e.g. "push" (I have data for you) or "pull" (Give me data).

package/src/sync/sync-types.mts

@@ -195,6 +195,18 @@ export interface SyncRel8ns_V1 extends IbGibRel8ns_V1 {
      */
     identity?: string[];
 
+    /**
+     * Session keystones used for signing saga frames.
+     *
+     * Array contains addresses of keystone evolution chain:
+     * - Index 0: Genesis keystone (dual-pool architecture)
+     * - Index N: Latest evolved keystone after signing operations
+     *
+     * Each sync endpoint retrieves the session keystone from this rel8n
+     * rather than searching spaces. Keystones are stored in durable spaces.
+     */
+    sessionKeystones?: IbGibAddr[];
+
     /**
      * The message stone that contains the information about the particular
      * stage of the sync process we are in.