@ibgib/core-gib 0.1.44 → 0.1.47

package/src/keystone/keystone-helpers.mts

@@ -1,4 +1,5 @@
-import { extractErrorMsg, hash, pretty } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { extractErrorMsg, hash, HashAlgorithm, pretty } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { GIB } from "@ibgib/ts-gib/dist/V1/constants.mjs";
 import { Ib, TransformResult } from "@ibgib/ts-gib/dist/types.mjs";
 import { getIbAndGib, getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
 import { validateIbGibIntrinsically } from "@ibgib/ts-gib/dist/V1/validate-helper.mjs";
@@ -7,12 +8,23 @@ import { Factory_V1 } from "@ibgib/ts-gib/dist/V1/factory.mjs";
 import { getGib } from "@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs";
 
 import { GLOBAL_LOG_A_LOT } from "../core-constants.mjs";
-import { KEYSTONE_ATOM } from "./keystone-constants.mjs";
-import { KeystoneData_V1, KeystoneIbGib_V1, KeystoneIb_V1, KeystoneChallengePool, DeterministicResult, KeystoneProof, KeystonePoolConfig, KeystoneReplenishStrategy, KEYSTONE_REPLENISH_STRATEGY_VALID_VALUES, KeystoneClaim, KeystoneSolution } from "./keystone-types.mjs";
+import { KEYSTONE_ATOM, KEYSTONE_HASH_MAX_ROUNDS, KEYSTONE_POOL_ID_REGEXP, KEYSTONE_SALT_REGEXP } from "./keystone-constants.mjs";
+import {
+    KeystoneData_V1, KeystoneIbGib_V1, KeystoneIb_V1, KeystoneChallengePool,
+    DeterministicResult, KeystoneProof, KeystonePoolConfig,
+    KeystoneReplenishStrategy, KEYSTONE_REPLENISH_STRATEGY_VALID_VALUES,
+    KeystoneClaim, KeystoneSolution,
+    KeystoneChallengeType,
+    KEYSTONE_CHALLENGE_TYPE_VALID_VALUES,
+    KeystonePoolConfig_HashV1,
+} from "./keystone-types.mjs";
 import { MetaspaceService } from "../witness/space/metaspace/metaspace-types.mjs";
 import { IbGibSpaceAny } from "../witness/space/space-base-v1.mjs";
 import { KeystoneStrategyFactory } from "./strategy/keystone-strategy-factory.mjs";
-import { GIB } from "@ibgib/ts-gib/dist/V1/constants.mjs";
+import { getDependencyGraph } from "../common/other/graph-helper.mjs";
+import { getIbGibsFromCache_fallbackToSpaces, getTimelinesGroupedByTjp, splitPerTjpAndOrDna } from "../common/other/ibgib-helper.mjs";
+import { IbGib_V1, IbGibData_V1, IbGibRel8ns_V1 } from "@ibgib/ts-gib/dist/V1/types.mjs";
+import { getLatestAddrs } from "../witness/space/space-helper.mjs";
 
 const logalot = GLOBAL_LOG_A_LOT;
 
@@ -512,6 +524,156 @@ export async function solveAndReplenish({
     }
 }
 
+export async function validateChallengePool_typeHashRevealV1({ pool }: {
+    pool: KeystoneChallengePool;
+}): Promise<string[]> {
+    const lc = `[${validateChallengePool_typeHashRevealV1.name}]`;
+    try {
+        if (logalot) { console.log(`${lc} starting... (I: e2ffd568b698cc12d8c5e838d73ae726)`); }
+
+        if (!pool.config) { throw new Error(`(UNEXPECTED) pool.configy falsy? (E: fcde88fe20e8004a58d7e445436bf526)`); }
+        if (pool.config.type !== KeystoneChallengeType.hash_reveal_v1) {
+            throw new Error(`(UNEXPECTED) pool.config.type !== KeystoneChallengeType.hash_reveal_v1? (E: e205f8872909c37168a624a9df778c26)`);
+        }
+
+        const errors: string[] = [];
+
+        const { algo, rounds, salt, } = pool.config as KeystonePoolConfig_HashV1;
+
+        const validAlgos: HashAlgorithm[] = [HashAlgorithm.sha_256];
+        if (algo) {
+            if (!validAlgos.includes(algo)) {
+                errors.push(`${lc} invalid hash algorithm (${algo}). Must be one of ${validAlgos}. (E: a22399ca3a68e63ffcc7507699be5826)`);
+            }
+        } else {
+            errors.push(`${lc} algorithm required. (E: 8cd6bfb0590862b9bae24d98d2cf3826)`)
+        }
+
+        if (rounds && typeof rounds === 'number' && Number.isInteger(rounds)) {
+            if (rounds > KEYSTONE_HASH_MAX_ROUNDS) {
+                errors.push(`${lc} rounds too high. max rounds: ${KEYSTONE_HASH_MAX_ROUNDS} (E: 31ce082f7fd88d6b58ef08a816458826)`);
+            }
+        } else {
+            errors.push(`${lc} invalid rounds (${rounds}). must be positive integer. (E: 73c643ccda78afaf28d52a6871a9e826)`);
+        }
+
+        if (salt && typeof salt === 'string') {
+            // no limits on this? sanity check?
+            if (!KEYSTONE_SALT_REGEXP.test(salt)) {
+                errors.push(`${lc} invalid salt (${salt.substring(0, 99)}). Must match regexp ${KEYSTONE_SALT_REGEXP}`);
+            }
+        } else {
+            errors.push(`${lc} invalid salt (${salt}). must be truthy string value. (E: 564a4844ec88fc1988197ce89c381426)`);
+        }
+
+        return errors;
+
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    } finally {
+        if (logalot) { console.log(`${lc} complete.`); }
+    }
+}
+
+export async function validateChallengePool({ pool }: {
+    pool: KeystoneChallengePool;
+}): Promise<string[]> {
+    const lc = `[${validateChallengePool.name}]`;
+    try {
+        if (logalot) { console.log(`${lc} starting... (I: 1a0eafc158a83d1ba8fc019d5c979a26)`); }
+        const errors: string[] = [];
+
+        if (pool.config) {
+            // first validate common to all pools, regardless of type...
+            if (pool.config.id) {
+                if (!KEYSTONE_POOL_ID_REGEXP.test(pool.config.id)) {
+                    // not 100% that this is needed but hey
+                    errors.push(`${lc} pool.config.id is not formatted correctly. must pass regexp: ${KEYSTONE_POOL_ID_REGEXP.source}`);
+                }
+            } else {
+                errors.push(`${lc} pool.config.id falsy (E: 31d7943d95f877326d5f4ea14463d626)`);
+            }
+
+            if (pool.config.behavior) {
+                const { size } = pool.config.behavior;
+                if (!size || size === 0) {
+                    errors.push(`${lc} invalid pool.config.behavior.size (${size}). Must be positive integer. (E: b221e36ec102bdc944552248ce8fe626)`)
+                }
+                // todo: more behavior checks
+            } else {
+                errors.push(`${lc} pool.config.behavior falsy (E: bede081c066c39732eefe2f92e296326)`)
+            }
+
+            // ...then do type-specific validation
+            const poolType = pool.config.type;
+            switch (poolType) {
+                case KeystoneChallengeType.hash_reveal_v1:
+                    const errorsHashRevealV1 = await validateChallengePool_typeHashRevealV1({ pool });
+                    errorsHashRevealV1.forEach(x => errors.push(x));
+                    break;
+                default:
+                    throw new Error(`(UNEXPECTED) unknown pool.config.type (${poolType})? We only implement the following at this time: ${KEYSTONE_CHALLENGE_TYPE_VALID_VALUES} (E: cce5285cf7580b8bc82172488eba2826)`);
+            }
+        } else {
+            errors.push(`${lc} pool.config falsy. (E: 8d05c875a1d2c58018a5eaf803977d26)`);
+        }
+
+        return errors;
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    } finally {
+        if (logalot) { console.log(`${lc} complete.`); }
+    }
+}
+
+
+export async function validateGenesisKeystone({
+    keystoneIbGib
+}: {
+    keystoneIbGib: KeystoneIbGib_V1;
+}): Promise<string[]> {
+    const lc = `[${validateGenesisKeystone.name}]`;
+    try {
+        if (logalot) { console.log(`${lc} starting... (I: ec6ba82ec848b5ac3d8953e89d8d9826)`); }
+
+        const errors: string[] = [];
+
+        const { data, rel8ns } = keystoneIbGib;
+
+        // no proofs/solutions yet
+        if (data.proofs && data.proofs.length > 0) {
+            errors.push(`${lc} proofs already exist on genesis keystone. (E: 7a5e15f20918f1bbd8ffb62857dcd526)`);
+        }
+
+        for (const pool of data.challengePools) {
+            // validate each pool intrinsically (config, sanity)
+            const poolErrors = await validateChallengePool({ pool });
+            poolErrors.forEach(x => errors.push(x));
+
+            //  additionally ensure each pool has challenges. This is only on
+            //  this genesis keystone, as it is valid to have pool without
+            //  challenges after revocation
+            if (!pool.challenges || Object.keys(pool.challenges).length === 0) {
+                errors.push(`${lc} invalid pool (${pool.id}). pool.challenges is falsy/empty. (E: 8cd16a5416ae62a058342828be465b26)`);
+            }
+        }
+
+        // not stated as revoked already
+        if (!!data.revocationInfo) {
+            errors.push(`${lc} genesis keystone already has revocationInfo. (E: e11408d0c558d0fa948efbce611ec826)`);
+        }
+
+        return errors;
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    } finally {
+        if (logalot) { console.log(`${lc} complete.`); }
+    }
+}
+
 /**
  * Validates the transition from Prev -> Curr.
  * Enforces Cryptography AND Behavioral Policy.
@@ -782,4 +944,157 @@ export async function createKeystoneIbGibImpl({
     } finally {
         if (logalot) { console.log(`${lc} complete.`); }
     }
-}
+}
+
+export async function validateKeystoneGraph({
+    keystoneIbGib,
+    getLatest,
+    invalidIfMoreRecentKeystoneFoundInSpace,
+    space,
+}: {
+    keystoneIbGib: KeystoneIbGib_V1,
+    /**
+     * if true, then this will get the latest keystone known in the incoming
+     * {@link keystoneIbGib} timeline, as found in {@link space}.
+     */
+    getLatest: boolean,
+    invalidIfMoreRecentKeystoneFoundInSpace: boolean,
+    space: IbGibSpaceAny,
+}): Promise<string[]> {
+    const lc = `[${validateKeystoneGraph.name}]`;
+    try {
+        if (logalot) { console.log(`${lc} starting... (I: 22e1ca1d5a08a3f90b7fe9da95df7b26)`); }
+
+        // maybe too defensive but...
+        if (!keystoneIbGib) { throw new Error(`(UNEXPECTED) keystoneIbGib falsy? (E: 26482871d529fff6e8899c5d8a6c3826)`); }
+
+        // #region leaving off here
+        // asdf
+        // just implemented validate keystone graph. incorporate this into the
+        // context ibgib, which now has the session ibgib as part of it. each
+        // step in ping pong should validate the entire keystone graph
+
+        // #endregion leaving off here
+        const errors: string[] = [];
+
+        // first, get the latest if that is the case...
+        if (getLatest) {
+            const keystoneAddr = getIbGibAddr({ ibGib: keystoneIbGib });
+            const resGetLatestAddrs = await getLatestAddrs({
+                ibGibs: [keystoneIbGib],
+                space,
+            });
+            if (!resGetLatestAddrs.data) { throw new Error(`(UNEXPECTED) resGetLatestAddrs.data falsy? (E: 3a23b3b420a8da1928219ca8d47b2126)`); }
+            if (!resGetLatestAddrs.data.latestAddrsMap) { throw new Error(`(UNEXPECTED) resGetLatestAddrs.data.latestAddrsMap falsy? (E: 93f1180598fb65a4b8d36e08d6c50426)`); }
+
+            const { latestAddrsMap } = resGetLatestAddrs.data;
+            if (Object.keys(latestAddrsMap).length === 0) {
+                throw new Error(`(UNEXPECTED) latestAddrsMap truthy but empty? (E: 7142f8f7625b9186281d08251e407826)`);
+            }
+
+            const latestAddr = latestAddrsMap[keystoneAddr];
+            if (latestAddr) {
+                if (latestAddr !== keystoneAddr) {
+                    if (invalidIfMoreRecentKeystoneFoundInSpace) {
+                        errors.push(`${lc} more recent keystone (${latestAddr}) found than the one passed in (${keystoneAddr}) in space (${space.ib}). (E: 64bf48de9448ee5c7528bf03bed2a826)`);
+                    } else {
+                        // get the latest ibgib and point the incoming ref to that
+                        const [latestKeystoneIbGib] = await getIbGibsFromCache_fallbackToSpaces({
+                            addrs: [latestAddr],
+                            space,
+                        });
+                        keystoneIbGib = latestKeystoneIbGib as KeystoneIbGib_V1;
+                    }
+                } else {
+                    // the incoming ibgib **is** the latest keystone, so nothing more to be done.
+                    if (logalot) { console.log(`${lc} incoming keystone (${keystoneAddr}) is the latest in the space (${space.ib}) (I: 8ffbd8d6cbc8a461e5e7f1084bd22a26)`); }
+                }
+            } else {
+                // keystone not found in space?
+                console.warn(`${lc} keystoneIbGib (${keystoneAddr}) not found in space (${space.ib}). I don't know what the implications of this are. (W: 258c88742448db34a585669484771826)`)
+            }
+        }
+
+        const dependencyGraph = await getDependencyGraph({
+            ibGib: keystoneIbGib,
+            space,
+        });
+
+        const depIbGibs = Object.values(dependencyGraph);
+        const { mapWithTjp_NoDna, mapWithTjp_YesDna, mapWithoutTjps, } =
+            splitPerTjpAndOrDna({ ibGibs: depIbGibs });
+
+
+        // there should be no DNA
+        if (Object.keys(mapWithTjp_YesDna).length > 0) {
+            errors.push(`${lc} DNA found. Keystones should NOT have DNA. (E: a3ec7827c4284cdea61c2372c0615826)`);
+        }
+
+        // is there a tjp? I think there is, so mapWithoutTjps should also be
+        // empty
+        if (Object.keys(mapWithoutTjps).length > 0) {
+            errors.push(`${lc} Non-tjp ibgibs found? Keystones are expected to have tjps. (E: a3ec7827c4284cdea61c2372c0615826)`);
+        }
+
+        if (Object.keys(mapWithTjp_NoDna).length > 0) {
+            // happy path here. These should be the keystone ibgibs. we will put
+            // them in order, then do validation on the transitions. We will
+            // also check other graph-scoped integrity of keystones (like do
+            // certain properties match among ALL keystones, etc.)
+
+            const keystoneIbGibs_unordered = Object.values(mapWithTjp_NoDna);
+
+            const orderedKeystonesMap = getTimelinesGroupedByTjp({ ibGibs: keystoneIbGibs_unordered });
+            const keys = Object.keys(orderedKeystonesMap);
+            if (keys.length === 0) {
+                throw new Error(`(UNEXPECTED) orderedKeystonesMap empty? (E: d437b80bef58e83a034b28af46278726)`);
+            } else if (keys.length > 0) {
+                // keys.length > 0
+                throw new Error(`(UNEXPECTED) more than one timeline in keystone graph? ATOW (02/19/2026) we are expecting only a single timeline. (E: 66085b14e3887a59c872afd240511f26)`);
+            }
+            // happy path: exactly one timeline
+            const keystoneTjpAddr = keys[0];
+            const keystoneIbGibs_ordered = orderedKeystonesMap[keystoneTjpAddr] as KeystoneIbGib_V1[];
+
+            if (keystoneIbGibs_ordered.length === 0) { throw new Error(`(UNEXPECTED) empty keystoneIbGibs_ordered? (E: 4a6b085aa8a76828a8d65367e7e56526)`); }
+
+            const genesisErrors = await validateGenesisKeystone({
+                keystoneIbGib: keystoneIbGibs_ordered[0]
+            });
+            genesisErrors.forEach(x => errors.push(x));
+
+            if (keystoneIbGibs_ordered.length === 1) {
+                // only the genesis keystone, which has already been done.
+            } else {
+                // more than 1 keystone, so validate the transitions
+                for (let i = 0; i < keystoneIbGibs_ordered.length - 1; i++) {
+                    const prevIbGib = keystoneIbGibs_ordered[i];
+                    const currentIbGib = keystoneIbGibs_ordered[i + 1];
+                    const transitionErrors = await validateKeystoneTransition({
+                        prevIbGib, currentIbGib
+                    });
+                    if (transitionErrors.length > 0) {
+                        errors.push(`${lc} keystone has ${transitionErrors.length} transition errors. i: ${i}. prevIbGib addr: ${getIbGibAddr({ ibGib: prevIbGib })}. currentIbGib addr: ${getIbGibAddr({ ibGib: currentIbGib })}. (E: 3ac17be916141d0c286ca5a87bb1b426)`);
+                        transitionErrors.forEach(x => errors.push(x));
+                    }
+
+                    break; // stop after the first found transition error
+                }
+            }
+        } else {
+            // one of the other errors regarding mapWithTjp_YesDna or
+            // mapWithoutTjps will exist at this point, so we don't need to add
+            // any more errors.
+            if (errors.length === 0) { throw new Error(`(UNEXPECTED) mapWithTjp_NoDna empty (which is an error) but errors.length === 0? If we get here, we expect one of the other errors to have been populated. (E: 7bca2866b6f8fca318923de8c88e8826)`); }
+        }
+
+        return errors;
+
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    } finally {
+        if (logalot) { console.log(`${lc} complete.`); }
+    }
+}
+

package/src/keystone/keystone-types.mts

@@ -336,7 +336,10 @@ export interface KeystoneRel8ns_V1 extends IbGibRel8ns_V1 {
     // Specific hard-links for composite keystones go here later.
 }
 
-export interface KeystoneIbGib_V1 extends IbGib_V1<KeystoneData_V1, KeystoneRel8ns_V1> { }
+export interface KeystoneIbGib_V1 extends IbGib_V1<KeystoneData_V1, KeystoneRel8ns_V1> {
+    data: KeystoneData_V1;
+    rel8ns: KeystoneRel8ns_V1;
+}
 
 export interface DeterministicResult {
     /**

package/src/sync/sync-peer/sync-peer-v1.mts

@@ -133,13 +133,23 @@ export abstract class SyncPeer_V1<TInitializeOpts extends InitializeSyncPeerOpts
 
             if (!this.opts) { throw new Error(`(UNEXPECTED) this.opts falsy? Concrete class should have initialized sender opts by now. (E: 0b9e28287318fdf8bf9f5a6886a24826)`); }
 
-            // NOTE: There are two basic types of peers:
-            // * local-only (peer)
+            // #region leaving off here
+            // NOTES: the context ibgib now has a reference to the signed
+            // keystone. the signed keystone targets the context ibgib, and the
+            // context ibgib itself points to the previous frame of the
+            // keystone. I've started on creating a validateKeystone function,
+            // whcih I need to at least add the validate transitions to. I
+            // _think_ I need to also fill in some authentication here in this
+            // peer at the very least, then I can move on to other layers.
+            // #endregion leaving off here
+
+            // NOTE: There are three basic types of peers:
+            // * local-only
             //   * this peer is both sender/receiver peer
             //   * for local merges and relatively fast spaces
             // * proxy to remote space
             //   * this peer is both sender/receiver peer
-            //   * works directly with remote/outerspaces
+            //   * works directly with remote/outerspaces via API calls
             //   * Less efficient over-the-wire xfer due to chatiness
             // * symmetric node sender/receiver peers
             //   * separate sender/receiver classes

package/src/sync/sync-saga-context/sync-saga-context-helpers.mts

@@ -20,33 +20,12 @@ import { IbGibSpaceAny } from '../../witness/space/space-base-v1.mjs';
 import { putInSpace, registerNewIbGib } from '../../witness/space/space-helper.mjs';
 import { SyncIbGib_V1 } from '../sync-types.mjs';
 import { validateSyncSagaFrame } from '../sync-helpers.mjs';
+import { validateKeystoneGraph, validateKeystoneTransition } from '../../keystone/keystone-helpers.mjs';
+import { KeystoneService_V1 } from '../../keystone/keystone-service-v1.mjs';
+import { KeystoneIbGib_V1 } from '../../keystone/keystone-types.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT;
 
-/**
- * Options for creating a SyncSagaContext ibgib.
- */
-export interface CreateSyncSagaContextOptions {
-    /**
-     * The main saga frame (Init, Ack, etc.).
-     */
-    sagaFrame: SyncIbGib_V1;
-    /**
-     * Session identity keystones.
-     */
-    sessionKeystones?: IbGib_V1[];
-    /**
-     * Domain payload ibgibs when the sync saga frame includes actual domain
-     * payloads to send, e.g., in a Delta frame.
-     */
-    payloadIbGibsDomain?: IbGib_V1[];
-    /**
-     * we persist the context in the local/sender space (relative to our
-     * execution POV) right when we create it.
-     */
-    localSpace: IbGibSpaceAny;
-}
-
 /**
  * Constructs the standard 'ib' string for a Sync Saga Context stone.
  */
@@ -117,89 +96,6 @@ export async function parseSyncSagaContextIb({
     }
 }
 
-/**
- * Creates new SyncSagaContext stone. Puts/registers in {@link localSpace}
- * immediately after creation.
- *
- * @returns The context ibGib.
- *
- * ## notes
- *
- * the other ibgibs that are related to this context stone should already be
- * put/registered in {@link localSpace}.
- */
-export async function createSyncSagaContext({
-    sagaFrame,
-    sessionKeystones,
-    payloadIbGibsDomain,
-    localSpace,
-}: CreateSyncSagaContextOptions): Promise<SyncSagaContextIbGib_V1> {
-    const lc = `[${createSyncSagaContext.name}]`;
-    try {
-        if (logalot) { console.log(`${lc} starting... (I: 6b87bee313e811d1d2fc90e87fbec826)`); }
-
-        if (!sagaFrame.data) { throw new Error(`(UNEXPECTED) sagaFrame.data falsy? (E: 04c49b4cccba6842a8b52e4c6f570726)`); }
-        if (!sagaFrame.data.n && sagaFrame.data.n !== 0) { throw new Error(`(UNEXPECTED) sagaFrame.data.n falsy and not 0? (E: 45b508da64a8b28428b11765d684b826)`); }
-
-        const date = new Date();
-        const timestamp = getTimestamp(date);
-        const timestampMs = date.getMilliseconds();
-
-        const data: SyncSagaContextData_V1 = {
-            timestamp,
-            timestampMs,
-            sagaN: sagaFrame.data.n,
-        };
-
-        // Domain Payloads
-        const payloadAddrsDomain = payloadIbGibsDomain ?
-            payloadIbGibsDomain?.map(x => getIbGibAddr({ ibGib: x })) :
-            undefined;
-        if (payloadAddrsDomain && payloadAddrsDomain.length > 0) {
-            data[SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN] = payloadAddrsDomain;
-        }
-
-        // rel8ns should always have saga frame, sometimes have keystone
-        const rel8ns: SyncSagaContextRel8ns_V1 = {
-            sagaFrame: [getIbGibAddr({ ibGib: sagaFrame })],
-        };
-        if (sessionKeystones && sessionKeystones.length > 0) {
-            rel8ns.sessionKeystone = sessionKeystones.map(x => getIbGibAddr({ ibGib: x }));
-        }
-
-        // Generate standard ib
-        const ib = await getSyncSagaContextIb({ data });
-
-        const contextIbGib = await Factory_V1.stone<SyncSagaContextData_V1, SyncSagaContextRel8ns_V1>({
-            parentPrimitiveIb: SYNC_SAGA_CONTEXT_ATOM,
-            ib,
-            data,
-            rel8ns,
-        }) as SyncSagaContextIbGib_V1;
-
-        // put/register immediately. Note that contextIbGib at this point is
-        // pure DTO, i.e., only ib, gib, data, rel8ns props.
-        await putInSpace({ ibGib: contextIbGib, space: localSpace, });
-        await registerNewIbGib({
-            ibGib: contextIbGib,
-            space: localSpace,
-            fnBroadcast: undefined,
-        });
-
-        // Attach actual ibgibs for transport (not pure DTO now)
-        contextIbGib.sagaFrame = sagaFrame;
-        if (payloadIbGibsDomain && payloadIbGibsDomain.length > 0) {
-            contextIbGib.payloadIbGibsDomain = payloadIbGibsDomain;
-        }
-
-        return contextIbGib;
-    } catch (error) {
-        console.error(`${lc} ${extractErrorMsg(error)}`);
-        throw error;
-    } finally {
-        if (logalot) { console.log(`${lc} complete.`); }
-    }
-}
 
 /**
  * Validates ONLY the {@link context} ibgib itself and saga frame/msg stone(s)

package/src/sync/sync-saga-context/sync-saga-context-types.mts

@@ -8,6 +8,7 @@ import { IbGibData_V1, IbGibRel8ns_V1, IbGib_V1 } from '@ibgib/ts-gib/dist/V1/ty
 import { SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN } from '../sync-constants.mjs';
 import { SyncIbGib_V1 } from '../sync-types.mjs';
 import { SYNC_SAGA_CONTEXT_ATOM } from './sync-saga-context-constants.mjs';
+import { KeystoneIbGib_V1 } from '../../keystone/keystone-types.mjs';
 
 export interface SyncSagaContextIb_V1 {
     atom: typeof SYNC_SAGA_CONTEXT_ATOM;
@@ -49,13 +50,21 @@ export interface SyncSagaContextRel8ns_V1 extends IbGibRel8ns_V1 {
     sagaFrame: IbGibAddr[];
 
     /**
-     * The Ephemeral Session Keystone Identity used for this saga.
-     * Required for validating the saga frame signature.
+     * The Ephemeral Session Keystone Identity used for this saga. Required for
+     * validating the saga frame and this context.
+     *
+     * WARNING!!!: THIS DOES NOT POINT TO THE CURRENT SESSION KEYSTONE IN
+     * {@link SyncSagaContextIbGib_V1.signedSessionKeystone}. This points to the
+     * PREVIOUS FRAME (immediate past) of that frame. That session keystone
+     * signs with THIS context's frame as its target, so it is logically
+     * impossible because the hash would be different.
      *
      * ## notes
      *
-     * This will be different for the sender and receiver, yes? hmm...
-     * I think I need to put "sender" or "receiver" in the session keystone ib.
+     * ATOW (02/18/2026), this is a single address that will have a primary pool
+     * for the sender and a delegated pool for the receiver.
+     *
+     * @see {@link SyncSagaContextIbGib_V1.signedSessionKeystone}
      */
     sessionKeystone?: IbGibAddr[];
 }
@@ -79,4 +88,16 @@ export interface SyncSagaContextIbGib_V1 extends IbGib_V1<SyncSagaContextData_V1
      * This frame's addr should be {@link SyncSagaContextRel8ns_V1.sagaFrame}.
      */
     sagaFrame: SyncIbGib_V1;
+
+    /**
+     * If session keystone is in play, then this will be populated with that
+     * keystone. This session keystone will point to the this context ibgib,
+     * BUT, this context ibgib will point to the **PREVIOUS** frame of the
+     * keystone.
+     *
+     * So in order to verify this context ibgib, we must verify the keystone
+     * points to this context ibgib AND that this context ibgib points to the
+     * previous frame of the keystone.
+     */
+    signedSessionKeystone?: KeystoneIbGib_V1;
 }