@ibgib/core-gib 0.1.53 → 0.1.55

package/dist/sync/sync-saga-coordinator.mjs

@@ -5,10 +5,7 @@ import { getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
 import { Factory_V1 } from "@ibgib/ts-gib/dist/V1/factory.mjs";
 import { GLOBAL_LOG_A_LOT } from "../core-constants.mjs";
 import { putInSpace, getLatestAddrs, getFromSpace, registerNewIbGib } from "../witness/space/space-helper.mjs";
-import { KeystoneChallengeType } from "../keystone/keystone-types.mjs";
-import { deriveKey } from "../keystone/kdf/kdf-helpers.mjs";
-import { KdfStrategy } from "../keystone/kdf/kdf-constants.mjs";
-import { SyncStage, SYNC_ATOM, SYNC_MSG_REL8N_NAME, SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN, SyncConflictStrategy, SYNC_CONFLICT_STRATEGY_VALID_VALUES, SESSION_IDENTITY_KEYSTONE_SECRET_TRANSITIONPOOL, SESSION_IDENTITY_KEYSTONE_CONFIG_ALGO, SESSION_IDENTITY_KEYSTONE_CONFIG_ROUNDS, SESSION_IDENTITY_KEYSTONE_CONFIG_RANDOM, SESSION_IDENTITY_KEYSTONE_CONFIG_REPLENISH_STRATEGY, SESSION_IDENTITY_KEYSTONE_CONFIG_SEQUENTIAL, SESSION_IDENTITY_KEYSTONE_CONFIG_TARGET_BINDING, SESSION_IDENTITY_KEYSTONE_CONFIG_SIZE, SESSION_IDENTITY_KEYSTONE_TRANSITION_POOL_ID, SESSION_IDENTITY_KEYSTONE_CONFIG_SIZE_TRANSITIONPOOL, SESSION_IDENTITY_KEYSTONE_CONFIG_REPLENISH_STRATEGY_TRANSITIONPOOL, SESSION_IDENTITY_KEYSTONE_CONFIG_RANDOM_TRANSITIONPOOL, SESSION_IDENTITY_KEYSTONE_CONFIG_SEQUENTIAL_TRANSITIONPOOL, SESSION_IDENTITY_KEYSTONE_CONFIG_TARGET_BINDING_TRANSITIONPOOL, SESSION_IDENTITY_KEYSTONE_CONFIG_ALGO_TRANSITIONPOOL, SESSION_IDENTITY_KEYSTONE_CONFIG_ROUNDS_TRANSITIONPOOL, SESSION_IDENTITY_KEYSTONE_CONFIG_VERBS_TRANSITIONPOOL, SESSION_IDENTITY_KEYSTONE_CONFIG_VERBS_DELEGATE, SESSION_IDENTITY_KEYSTONE_DELEGATE_POOL_ID, SESSION_IDENTITY_KEYSTONE_PRIMARY_POOL_ID, } from "./sync-constants.mjs";
+import { SyncStage, SYNC_ATOM, SYNC_MSG_REL8N_NAME, SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN, SyncConflictStrategy, SYNC_CONFLICT_STRATEGY_VALID_VALUES, } from "./sync-constants.mjs";
 import { appendToTimeline, createTimeline, getHistory, getHistoryAddrs } from "../timeline/timeline-api.mjs";
 import { SyncMode, } from "./sync-types.mjs";
 import { getSyncSagaFrameOrigin, getFullSyncSagaHistory, getSyncIb, getTempSpaceName, isPastFrame, putInSpace_dnasThenNonDnas, validateFullSyncSagaHistory, getAllOrphanedAddresses, getFinalConflictsInfo } from "./sync-helpers.mjs";
@@ -23,11 +20,7 @@ import { fnObs } from "../common/pubsub/observer/observer-helper.mjs";
 import { graftTimelines, } from "./graft-info/graft-info-helpers.mjs";
 import { GRAFT_INFO_REL8N_NAME } from "./graft-info/graft-info-constants.mjs";
 import { validateIbGibIntrinsically } from "@ibgib/ts-gib/dist/V1/validate-helper.mjs";
-import { KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_SIGN } from "../keystone/keystone-constants.mjs";
-import { addToBindingMap, generateOpaqueChallengeId, validateGenesisKeystone, validateKeystoneGraph } from "../keystone/keystone-helpers.mjs";
 import { SYNC_SAGA_CONTEXT_ATOM } from "./sync-saga-context/sync-saga-context-constants.mjs";
-import { createStandardPoolConfig } from "../keystone/keystone-config-builder.mjs";
-import { KeystoneStrategyFactory } from "../keystone/strategy/keystone-strategy-factory.mjs";
 const logalot = GLOBAL_LOG_A_LOT;
 const logalotControlDomain = false;
 const lcControlDomain = '[ControlDomain]';
@@ -41,23 +34,21 @@ const lcControlDomain = '[ControlDomain]';
  * *   **Sender/Local Node**: The node *initiating* the sync (calling `sync()`).
  * *   **Receiver/Remote Node**: The node *accepting* the sync request (the Peer).
  *
- * Note that in a peer-to-peer architecture, "Sender" and "Receiver" are roles relative
- * to a specific Saga session, not fixed node identities.
+ * Note that in a peer-to-peer architecture, "Sender" and "Receiver" are roles
+ * relative to a specific Saga, not fixed node ids.
  */
 export class SyncSagaCoordinator {
-    keystoneSvc;
     lc = `[${SyncSagaCoordinator.name}]`;
-    constructor(keystoneSvc) {
-        this.keystoneSvc = keystoneSvc;
+    constructor() {
     }
     /**
      * Executes a synchronization saga using the Symmetric Sync Protocol.
      *
      * @remarks
      * **Execution Context**: **Sender (Local)**.
-     * This method is the entry point for starting a sync session.
+     * This method is the entry point for starting a sync saga.
      */
-    async sync({ peer, domainIbGibs, conflictStrategy = SyncConflictStrategy.abort, useSessionIdentity = true, identity, identitySecret, metaspace, localSpace, }) {
+    async sync({ peer, domainIbGibs, conflictStrategy = SyncConflictStrategy.abort, metaspace, localSpace, }) {
         const lc = `${this.lc}[${this.sync.name}]`;
         if (logalot) {
             console.log(`${lc} starting...`);
@@ -101,35 +92,11 @@ export class SyncSagaCoordinator {
         // Async execution wrapper
         (async () => {
             try {
-                // BOOTSTRAP IDENTITY (Session Keystone)
-                let sessionIdentity = undefined;
-                if (useSessionIdentity) {
-                    if (!identitySecret) {
-                        throw new Error(`useSessionIdentity is true, but identitySecret is falsy. Must provide a secret if you want to use a session identity. (E: 81915860c4dd3ea4dfd81825fa74c126)`);
-                    }
-                    // creates the initial session identity (keystone). the flow
-                    // (i think) will go: evolve saga frame, then sign keystone,
-                    // then create/send context.
-                    const resCreateSessionIdentity = await this.createSessionIdentity({
-                        sagaId,
-                        primaryIdentity: identity,
-                        nonSessionSecret: identitySecret,
-                        metaspace,
-                        localSpace
-                    });
-                    sessionIdentity = resCreateSessionIdentity.sessionIdentity;
-                    if (identity) {
-                        if (!resCreateSessionIdentity.newPrimaryIdentity) {
-                            throw new Error(`(UNEXPECTED) identity truthy but resCreateSessionIdentity.newPrimaryIdentity falsy? (E: 4f82e88a3cc5bd7e58a40f8d77bda826)`);
-                        }
-                        identity = resCreateSessionIdentity.newPrimaryIdentity;
-                    }
-                }
-                // if (logalot) { console.log(`${lc} sessionIdentity: ${sessionIdentity ? pretty(sessionIdentity) : 'undefined'} (I: abc01872800b3a66b819a05898bba826)`); }
+                // CONNECT PEER (if needed)
+                await peer.connect({ sagaId });
                 // CREATE INITIAL FRAME (Stage.init)
                 const { initFrame, initDomainGraph } = await this.createInitFrame({
                     sagaId,
-                    sessionIdentity,
                     domainIbGibs,
                     conflictStrategy,
                     metaspace, localSpace, tempSpace,
@@ -138,8 +105,6 @@ export class SyncSagaCoordinator {
                 await this.executeSagaLoop({
                     initFrame, initDomainGraph,
                     peer,
-                    identitySecret,
-                    sessionIdentity,
                     updates$,
                     localSpace,
                     tempSpace,
@@ -176,7 +141,7 @@ export class SyncSagaCoordinator {
      * @returns next context result if another round, else if commit returns
      * null
      */
-    async continueSync({ sagaContext, mySpace, myTempSpace, identity, identitySecret, metaspace, }) {
+    async continueSync({ sagaContext, mySpace, myTempSpace, metaspace, }) {
         const lc = `${this.lc}[${this.continueSync.name}]`;
         try {
             if (logalot) {
@@ -186,7 +151,6 @@ export class SyncSagaCoordinator {
                 sagaContext,
                 mySpace,
                 myTempSpace,
-                identity,
                 metaspace,
             });
             if (!contextResult) {
@@ -214,8 +178,6 @@ export class SyncSagaCoordinator {
                 sagaFrame: frame,
                 localSpace: mySpace,
                 payloadIbGibsDomain,
-                sessionKeystone: identity,
-                sessionSecret: identitySecret,
                 metaspace,
             });
             const immediateValidationErrors = await validateContextAndSagaFrame({
@@ -236,295 +198,6 @@ export class SyncSagaCoordinator {
             }
         }
     }
-    /**
-     * helper that KDFs the given identitySecret, using {@link sagaId} to do so.
-     *
-     * @returns deterministically derived session secret
-     */
-    async deriveSessionSecret({ sagaId, nonSessionSecret, }) {
-        const lc = `${this.lc}[${this.deriveSessionSecret.name}]`;
-        try {
-            if (logalot) {
-                console.log(`${lc} starting... (I: 0de03f8dcd3e32f1fca244e8f2a8a826)`);
-            }
-            // Derive session-specific secret using KDF
-            const sessionSecret = await deriveKey({
-                masterSecret: nonSessionSecret,
-                kdfOpts: {
-                    strategy: KdfStrategy.recursive_salt_wrap,
-                    salt: sagaId,
-                    rounds: 10000,
-                    algorithm: 'SHA-256'
-                }
-            });
-            return sessionSecret;
-        }
-        catch (error) {
-            console.error(`${lc} ${extractErrorMsg(error)}`);
-            throw error;
-        }
-        finally {
-            if (logalot) {
-                console.log(`${lc} complete.`);
-            }
-        }
-    }
-    async getInitialWeakTransitionSessionSecret({ sagaId, }) {
-        const lc = `${this.lc}[${this.getInitialWeakTransitionSessionSecret.name}]`;
-        try {
-            if (logalot) {
-                console.log(`${lc} starting... (I: 872ab81a78827b9f2822b78459203226)`);
-            }
-            // Create delegate pool bootstrap secret (publicly derivable)
-            const initialTransitionSecret = await deriveKey({
-                masterSecret: SESSION_IDENTITY_KEYSTONE_SECRET_TRANSITIONPOOL, // Weak, publicly derivable secret
-                kdfOpts: {
-                    strategy: KdfStrategy.recursive_salt_wrap,
-                    salt: sagaId,
-                    rounds: 1, // Minimal rounds - this is meant to be weak
-                    algorithm: 'SHA-256'
-                }
-            });
-            return initialTransitionSecret;
-        }
-        catch (error) {
-            console.error(`${lc} ${extractErrorMsg(error)}`);
-            throw error;
-        }
-        finally {
-            if (logalot) {
-                console.log(`${lc} complete.`);
-            }
-        }
-    }
-    async getTransitionKeystonePool({ sagaId, }) {
-        const lc = `${this.lc}[${this.getTransitionKeystonePool.name}]`;
-        try {
-            if (logalot) {
-                console.log(`${lc} starting... (I: 1ec1c8db7438938b08b96559fcee0826)`);
-            }
-            const config = createStandardPoolConfig({
-                salt: sagaId,
-                id: SESSION_IDENTITY_KEYSTONE_TRANSITION_POOL_ID,
-                type: KeystoneChallengeType.hash_reveal_v1,
-                size: SESSION_IDENTITY_KEYSTONE_CONFIG_SIZE_TRANSITIONPOOL,
-                replenishStrategy: SESSION_IDENTITY_KEYSTONE_CONFIG_REPLENISH_STRATEGY_TRANSITIONPOOL,
-                random: SESSION_IDENTITY_KEYSTONE_CONFIG_RANDOM_TRANSITIONPOOL,
-                sequential: SESSION_IDENTITY_KEYSTONE_CONFIG_SEQUENTIAL_TRANSITIONPOOL,
-                targetBinding: SESSION_IDENTITY_KEYSTONE_CONFIG_TARGET_BINDING_TRANSITIONPOOL,
-                hashAlgorithm: SESSION_IDENTITY_KEYSTONE_CONFIG_ALGO_TRANSITIONPOOL,
-                hashRounds: SESSION_IDENTITY_KEYSTONE_CONFIG_ROUNDS_TRANSITIONPOOL,
-                verbs: SESSION_IDENTITY_KEYSTONE_CONFIG_VERBS_TRANSITIONPOOL,
-            });
-            const strategy = KeystoneStrategyFactory.create({ config });
-            const poolSecret = await strategy.derivePoolSecret({
-                masterSecret: await this.getInitialWeakTransitionSessionSecret({ sagaId }),
-            });
-            const challenges = {};
-            const bindingMap = {};
-            const targetSize = config.behavior.size;
-            const timestamp = Date.now().toString();
-            for (let i = 0; i < targetSize; i++) {
-                const challengeId = await generateOpaqueChallengeId({
-                    salt: config.salt, timestamp, index: i
-                });
-                const solution = await strategy.generateSolution({
-                    poolSecret, poolId: config.salt, challengeId,
-                });
-                const challenge = await strategy.generateChallenge({ solution });
-                challenges[challengeId] = challenge;
-                // Populate Binding Map
-                addToBindingMap(bindingMap, challengeId);
-            }
-            const transitionPool = {
-                id: SESSION_IDENTITY_KEYSTONE_TRANSITION_POOL_ID,
-                config,
-                challenges,
-                bindingMap,
-                isForeign: true,
-                // metadata: { origin: 'receiver', role: 'delegate' } // don't need metadata since we have the pool id being 'delegate' (i think)
-            };
-            return transitionPool;
-        }
-        catch (error) {
-            console.error(`${lc} ${extractErrorMsg(error)}`);
-            throw error;
-        }
-        finally {
-            if (logalot) {
-                console.log(`${lc} complete.`);
-            }
-        }
-    }
-    async getDelegateKeystonePool({ sagaId, }) {
-        const lc = `${this.lc}[${this.getDelegateKeystonePool.name}]`;
-        try {
-            if (logalot) {
-                console.log(`${lc} starting... (I: 6b1d338f8e988e68f8d77e72ed00d526)`);
-            }
-            // todo: change this to a helper function that does the delegated
-            // functionality better. also the f***ing binding map needs better
-            // implementation. f***ng glazed over by AI.
-            const config = createStandardPoolConfig({
-                salt: sagaId,
-                id: SESSION_IDENTITY_KEYSTONE_DELEGATE_POOL_ID,
-                type: KeystoneChallengeType.hash_reveal_v1,
-                size: SESSION_IDENTITY_KEYSTONE_CONFIG_SIZE,
-                replenishStrategy: SESSION_IDENTITY_KEYSTONE_CONFIG_REPLENISH_STRATEGY,
-                random: SESSION_IDENTITY_KEYSTONE_CONFIG_RANDOM,
-                sequential: SESSION_IDENTITY_KEYSTONE_CONFIG_SEQUENTIAL,
-                targetBinding: SESSION_IDENTITY_KEYSTONE_CONFIG_TARGET_BINDING,
-                hashAlgorithm: SESSION_IDENTITY_KEYSTONE_CONFIG_ALGO,
-                hashRounds: SESSION_IDENTITY_KEYSTONE_CONFIG_ROUNDS,
-                verbs: SESSION_IDENTITY_KEYSTONE_CONFIG_VERBS_DELEGATE,
-            });
-            const strategy = KeystoneStrategyFactory.create({ config });
-            const poolSecret = await strategy.derivePoolSecret({
-                masterSecret: SESSION_IDENTITY_KEYSTONE_SECRET_TRANSITIONPOOL
-            });
-            const challenges = {};
-            const bindingMap = {};
-            const targetSize = config.behavior.size;
-            const timestamp = Date.now().toString();
-            for (let i = 0; i < targetSize; i++) {
-                const challengeId = await generateOpaqueChallengeId({
-                    salt: config.salt, timestamp, index: i
-                });
-                const solution = await strategy.generateSolution({
-                    poolSecret, poolId: config.salt, challengeId,
-                });
-                const challenge = await strategy.generateChallenge({ solution });
-                challenges[challengeId] = challenge;
-                // Populate Binding Map
-                addToBindingMap(bindingMap, challengeId);
-            }
-            const delegatePool = {
-                id: SESSION_IDENTITY_KEYSTONE_DELEGATE_POOL_ID,
-                config,
-                challenges,
-                bindingMap,
-                isForeign: true,
-                // metadata: { origin: 'receiver', role: 'delegate' } // don't need metadata since we have the pool id being 'delegate' (i think)
-            };
-            return delegatePool;
-        }
-        catch (error) {
-            console.error(`${lc} ${extractErrorMsg(error)}`);
-            throw error;
-        }
-        finally {
-            if (logalot) {
-                console.log(`${lc} complete.`);
-            }
-        }
-    }
-    /**
-     * creates a session identity keystone based off of the given args.
-     *
-     * Then, if the {@link primaryIdentity} keystone is provided, this also
-     * **signs** this keystone pointing to the address of the sess
-     * @param param0
-     * @returns
-     */
-    async createSessionIdentity({ sagaId, primaryIdentity, nonSessionSecret, metaspace, localSpace, }) {
-        const lc = `${this.lc}[${this.createSessionIdentity.name}]`;
-        try {
-            if (logalot) {
-                console.log(`${lc} starting... (I: 428392a4ee636b7bd8f7d5d89a87e826)`);
-            }
-            if (!nonSessionSecret) {
-                throw new Error(`(UNEXPECTED) nonSessionSecret falsy? This is expected to be truthy by this point. (E: 8ce053fe59825a6678713128953b9d26)`);
-            }
-            const primarySessionSecret = await this.deriveSessionSecret({
-                sagaId, nonSessionSecret
-            });
-            // Generate keystone with two initial pools in two steps.
-            //   1. Create primary pool with genesis method to correspond to the
-            //      sender/sender's secret/identity.
-            //   2. Create a separate pool and add separately because a
-            //      different pw + config is used for the transition pool.
-            const primaryPoolConfig = {
-                allowedVerbs: [KEYSTONE_VERB_MANAGE],
-                id: SESSION_IDENTITY_KEYSTONE_PRIMARY_POOL_ID,
-                salt: sagaId,
-                behavior: {
-                    size: SESSION_IDENTITY_KEYSTONE_CONFIG_SIZE, // Large pool for many signatures
-                    replenish: SESSION_IDENTITY_KEYSTONE_CONFIG_REPLENISH_STRATEGY,
-                    selectSequentially: SESSION_IDENTITY_KEYSTONE_CONFIG_SEQUENTIAL,
-                    selectRandomly: SESSION_IDENTITY_KEYSTONE_CONFIG_RANDOM,
-                    targetBindingChars: SESSION_IDENTITY_KEYSTONE_CONFIG_TARGET_BINDING,
-                },
-                type: KeystoneChallengeType.hash_reveal_v1,
-                algo: SESSION_IDENTITY_KEYSTONE_CONFIG_ALGO,
-                rounds: SESSION_IDENTITY_KEYSTONE_CONFIG_ROUNDS,
-            };
-            const sessionIdentity_genesis = await this.keystoneSvc.genesis({
-                masterSecret: primarySessionSecret,
-                configs: [primaryPoolConfig],
-                metaspace,
-                space: localSpace,
-            });
-            // #region sanity validation of genesis keystone
-            /**
-             * not necessary but since it's a new design, I'm putting in this
-             * immediate validation just to put it through its paces. (worth the
-             * slight perf hit).
-             */
-            const validationErrors = await validateGenesisKeystone({
-                keystoneIbGib: sessionIdentity_genesis
-            });
-            if (validationErrors) {
-                throw new Error(`(UNEXPECTED) the sessionIdentity_genesis that we just created already has validation errors just after creation? (E: e9ca08cf0f8858bb1ace8b9fa89f8726)`);
-            }
-            // #endregion sanity validation of genesis keystone
-            const transitionPool = await this.getTransitionKeystonePool({ sagaId });
-            /**
-             * Note this actually **signs** the initial {@link sessionIdentity_genesis}
-             * and requires the use of a pool with management priveleges.
-             */
-            const sessionIdentity_withTransitionPool = await this.keystoneSvc.addPools({
-                latestKeystone: sessionIdentity_genesis,
-                /**
-                 * this secret does not do the delegate pool challenges,
-                 * rather, this is the sessionSecret itself to evolve the
-                 * keystone **to add** the delegate pool in the first place.
-                 */
-                masterSecret: primarySessionSecret,
-                metaspace,
-                space: localSpace,
-                newPools: [transitionPool],
-            });
-            let newPrimaryIdentity = undefined;
-            if (primaryIdentity) {
-                newPrimaryIdentity = await this.keystoneSvc.sign({
-                    latestKeystone: primaryIdentity,
-                    poolId: primaryPoolConfig.id,
-                    claim: {
-                        verb: KEYSTONE_VERB_SIGN,
-                        target: getIbGibAddr({ ibGib: sessionIdentity_withTransitionPool }),
-                    },
-                    masterSecret: nonSessionSecret,
-                    metaspace,
-                    space: localSpace,
-                    // frameDetails: undefined, // anything to put here?
-                    // requiredChallengeIds: undefined, // not relevant I think
-                });
-            }
-            return {
-                sessionIdentity: sessionIdentity_withTransitionPool,
-                newPrimaryIdentity,
-            };
-        }
-        catch (error) {
-            console.error(`${lc} ${extractErrorMsg(error)}`);
-            throw error;
-        }
-        finally {
-            if (logalot) {
-                console.log(`${lc} complete.`);
-            }
-        }
-    }
     /**
      * Drives the FSM loop of the Saga.
      *
@@ -540,7 +213,7 @@ export class SyncSagaCoordinator {
      * the NEXT request context.
      * When the Peer responds with data (in the response context), it is resolved and put into `tempSpace`.
      */
-    async executeSagaLoop({ initFrame, initDomainGraph, peer, sessionIdentity, identitySecret, updates$, localSpace, tempSpace, metaspace }) {
+    async executeSagaLoop({ initFrame, initDomainGraph, peer, updates$, localSpace, tempSpace, metaspace }) {
         const lc = `${this.lc}[${this.executeSagaLoop.name}]`;
         /** The current frame we just generated (e.g., Init or Delta Request) */
         let currentFrame = initFrame;
@@ -589,8 +262,6 @@ export class SyncSagaCoordinator {
             // ...create/compose the Request Context itself...
             const requestCtx = await this.createSyncSagaContext({
                 sagaFrame: currentFrame,
-                sessionKeystone: sessionIdentity,
-                sessionSecret: identitySecret,
                 /**
                  * init frame: empty
                  * ack frame: possible push offers
@@ -614,7 +285,7 @@ export class SyncSagaCoordinator {
             // if (logalot) { console.log(`${lc} transmitting... requestCtx: ${pretty(requestCtx)} (I: 8cf20817c66899abdb1e76df50356826)`); }
             updates$.next(requestCtx); // spins off for saga UI updates
             // ...And send the context.
-            peer.setOptionalOpts({ localSpace, localTempSpace: tempSpace, keystoneSvc: this.keystoneSvc });
+            peer.setOptionalOpts({ localSpace, localTempSpace: tempSpace, });
             const responseCtx = await peer.witness(requestCtx);
             // the send returned, but a peer can return a falsy responseCtx, if
             // we just sent a commit to them and they're done. If so, there will
@@ -713,10 +384,6 @@ export class SyncSagaCoordinator {
             const { frame, payloadIbGibsDomain, } = contextResult.nextFrameInfo;
             currentFrame = frame;
             nextDomainIbGibs = [...(payloadIbGibsDomain || [])];
-            // Track identity evolution
-            if (responseCtx.signedSessionKeystone) {
-                sessionIdentity = responseCtx.signedSessionKeystone;
-            }
             // #region Log handler output for next iteration
             if (logalotControlDomain) {
                 const handlerDomainAddrs = nextDomainIbGibs.map(p => getIbGibAddr({ ibGib: p }));
@@ -738,7 +405,7 @@ export class SyncSagaCoordinator {
      * the other ibgibs that are related to this context stone should already be
      * put/registered in {@link localSpace}.
      */
-    async createSyncSagaContext({ sagaFrame, sessionKeystone, sessionSecret, payloadIbGibsDomain, metaspace, localSpace, }) {
+    async createSyncSagaContext({ sagaFrame, payloadIbGibsDomain, metaspace, localSpace, }) {
         const lc = `[${this.createSyncSagaContext.name}]`;
         try {
             if (logalot) {
@@ -751,9 +418,6 @@ export class SyncSagaCoordinator {
             if (!sagaFrame.data.n && sagaFrame.data.n !== 0) {
                 throw new Error(`(UNEXPECTED) sagaFrame.data.n falsy and not 0? (E: 45b508da64a8b28428b11765d684b826)`);
             }
-            if (sessionKeystone && !sessionSecret) {
-                throw new Error(`(UNEXPECTED) sessionKeystone truthy but sessionSecret falsy? (E: 705ecc25038b12df0e94c90c5561e426)`);
-            }
             // #endregion sanity/validation
             const date = new Date();
             const timestamp = getTimestamp(date);
@@ -770,25 +434,10 @@ export class SyncSagaCoordinator {
             if (payloadAddrsDomain && payloadAddrsDomain.length > 0) {
                 data[SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN] = payloadAddrsDomain;
             }
-            // rel8ns should always have saga frame, sometimes have keystone
+            // rel8ns should always have saga frame
             const rel8ns = {
                 sagaFrame: [getIbGibAddr({ ibGib: sagaFrame })],
             };
-            if (sessionKeystone) {
-                const keystoneErrors = await validateKeystoneGraph({
-                    keystoneIbGib: sessionKeystone,
-                    space: localSpace,
-                    getLatest: true,
-                    invalidIfMoreRecentKeystoneFoundInSpace: true,
-                });
-                if (keystoneErrors.length > 0) {
-                    throw new Error(`invalid sessionKeystone. errors: ${keystoneErrors} (E: 3881b8caf2d803767a331e1141e84826)`);
-                }
-                // this addr is BEFORE we sign. So each context ibgib itself will
-                // point to the frame of the keystone just before that keystone
-                // signs with this context as its target.
-                rel8ns.sessionKeystone = [getIbGibAddr({ ibGib: sessionKeystone })];
-            }
             // Generate standard ib
             const ib = await getSyncSagaContextIb({ data });
             const contextIbGib = await Factory_V1.stone({
@@ -810,20 +459,6 @@ export class SyncSagaCoordinator {
             if (payloadIbGibsDomain && payloadIbGibsDomain.length > 0) {
                 contextIbGib.payloadIbGibsDomain = payloadIbGibsDomain;
             }
-            if (sessionKeystone) {
-                if (!sessionSecret) {
-                    throw new Error(`(UNEXPECTED) sessionKeystone truthy but sessionSecret falsy? we should have thrown before now (E: a2b0517a37b559543968b888f2067826)`);
-                }
-                const contextAddr = getIbGibAddr({ ibGib: contextIbGib });
-                contextIbGib.signedSessionKeystone = await this.keystoneSvc.sign({
-                    latestKeystone: sessionKeystone,
-                    claim: { target: contextAddr, }, // verb?
-                    space: localSpace,
-                    masterSecret: sessionSecret,
-                    metaspace,
-                });
-                contextIbGib.fnIdentitySecret = () => Promise.resolve(sessionSecret);
-            }
             return contextIbGib;
         }
         catch (error) {
@@ -921,7 +556,7 @@ export class SyncSagaCoordinator {
      * Generates the first frame containing the Knowledge Map of the Local Space.
      * This is sent to the Receiver to begin Gap Analysis.
      */
-    async createInitFrame({ sagaId, sessionIdentity, domainIbGibs, conflictStrategy, metaspace, localSpace, tempSpace, }) {
+    async createInitFrame({ sagaId, domainIbGibs, conflictStrategy, metaspace, localSpace, tempSpace, }) {
         const lc = `${this.lc}[${this.createInitFrame.name}]`;
         try {
             if (logalot) {
@@ -944,7 +579,6 @@ export class SyncSagaCoordinator {
                 sagaId,
                 stage: SyncStage.init,
                 knowledgeMap: knowledgeMap,
-                identity: sessionIdentity, // KeystoneIbGib is already public data
                 mode: SyncMode.sync,
                 stones: srcStones.map(s => getIbGibAddr({ ibGib: s })),
             };
@@ -963,7 +597,6 @@ export class SyncSagaCoordinator {
             const sagaFrame = await this.evolveSyncSagaIbGib({
                 msgStones: [initStone],
                 conflictStrategy,
-                sessionIdentity,
                 metaspace,
                 localSpace,
             });
@@ -1066,7 +699,7 @@ export class SyncSagaCoordinator {
      * receiver, since the sender's {@link executeSagaLoop} is what actually
      * drives the ping-pong process.
      */
-    async handleResponseSagaContext({ sagaContext, initDomainGraph, mySpace, myTempSpace, identity, metaspace, }) {
+    async handleResponseSagaContext({ sagaContext, initDomainGraph, mySpace, myTempSpace, metaspace, }) {
         const lc = `${this.lc}[${this.handleResponseSagaContext.name}]`;
         try {
             if (logalot) {
@@ -1091,7 +724,6 @@ export class SyncSagaCoordinator {
                         sagaIbGib,
                         messageData: messageData,
                         metaspace, mySpace, myTempSpace,
-                        identity,
                     });
                     break;
                 case SyncStage.ack:
@@ -1103,7 +735,6 @@ export class SyncSagaCoordinator {
                         sagaIbGib,
                         initDomainGraph,
                         metaspace, mySpace, myTempSpace,
-                        identity,
                     });
                     break;
                 case SyncStage.delta:
@@ -1111,7 +742,6 @@ export class SyncSagaCoordinator {
                         sagaContext,
                         sagaIbGib,
                         metaspace, mySpace, myTempSpace,
-                        identity,
                     });
                     break;
                 case SyncStage.commit:
@@ -1121,7 +751,6 @@ export class SyncSagaCoordinator {
                     nextFrameInfo = await this.handleCommitFrame({
                         sagaIbGib,
                         metaspace, mySpace, myTempSpace,
-                        identity,
                     });
                     break;
                 default:
@@ -1156,7 +785,7 @@ export class SyncSagaCoordinator {
      * 3.  Identifies what Receiver needs (`deltaRequestAddrInfos`).
      * 4.  Returns an `Ack` frame containing these lists.
      */
-    async handleInitFrame({ sagaIbGib, messageData, mySpace, myTempSpace, metaspace, identity, }) {
+    async handleInitFrame({ sagaIbGib, messageData, mySpace, myTempSpace, metaspace, }) {
         const lc = `${this.lc}[${this.handleInitFrame.name}]`;
         try {
             if (logalot) {
@@ -1430,7 +1059,6 @@ export class SyncSagaCoordinator {
             const ackFrame = await this.evolveSyncSagaIbGib({
                 prevSagaIbGib: sagaIbGib,
                 msgStones: [ackStone],
-                sessionIdentity: identity,
                 localSpace: mySpace,
                 metaspace,
             });
@@ -1525,7 +1153,7 @@ export class SyncSagaCoordinator {
      *
      * Returns a `Delta` frame.
      */
-    async handleAckFrame({ sagaContext, sagaIbGib, initDomainGraph, mySpace, myTempSpace, metaspace, identity, }) {
+    async handleAckFrame({ sagaContext, sagaIbGib, initDomainGraph, mySpace, myTempSpace, metaspace, }) {
         const lc = `${this.lc}[${this.handleAckFrame.name}]`;
         try {
             if (logalot) {
@@ -1754,16 +1382,14 @@ export class SyncSagaCoordinator {
             const deltaFrame = await this.evolveSyncSagaIbGib({
                 prevSagaIbGib: sagaIbGib,
                 msgStones: [deltaStone],
-                sessionIdentity: identity,
                 localSpace: mySpace,
                 metaspace,
             });
             if (logalot) {
                 console.log(`${lc} Delta Frame created. Rel8ns: ${JSON.stringify(deltaFrame.rel8ns)}`);
             }
-            // Build control payloads: frame + its dependencies (msg stone, identity)
+            // Build control payloads: frame + its dependencies (msg stone)
             // const payloadIbGibsControl: IbGib_V1[] = [deltaFrame, deltaStone];
-            // if (identity) { payloadIbGibsControl.push(identity); }
             return { frame: deltaFrame, payloadIbGibsDomain: outgoingPayloadsDomain_all, };
         }
         catch (error) {
@@ -1789,7 +1415,7 @@ export class SyncSagaCoordinator {
      * we just have the receiver do the merging, since they should have full
      * knowledge at that point for most (all?) cases AFAICT.
      */
-    async handleDeltaFrame({ sagaContext, sagaIbGib, mySpace, myTempSpace, metaspace, identity, }) {
+    async handleDeltaFrame({ sagaContext, sagaIbGib, mySpace, myTempSpace, metaspace, }) {
         const lc = `${this.lc}[${this.handleDeltaFrame.name}]`;
         try {
             if (logalot) {
@@ -1994,7 +1620,6 @@ export class SyncSagaCoordinator {
                 const deltaFrame = await this.evolveSyncSagaIbGib({
                     prevSagaIbGib: sagaIbGib,
                     msgStones: [deltaStone],
-                    sessionIdentity: identity,
                     localSpace: mySpace,
                     metaspace,
                 });
@@ -2017,7 +1642,6 @@ export class SyncSagaCoordinator {
                             sagaIbGib,
                             errors: validationErrors,
                             metaspace, mySpace,
-                            identity,
                         });
                         return { frame: errorCommitFrame, }; /* <<<< returns early */
                     }
@@ -2033,7 +1657,6 @@ export class SyncSagaCoordinator {
                         errors: undefined,
                         metaspace,
                         mySpace,
-                        identity,
                     });
                     return { frame: commitFrame, };
                 }
@@ -2055,7 +1678,6 @@ export class SyncSagaCoordinator {
                     const deltaFrame = await this.evolveSyncSagaIbGib({
                         prevSagaIbGib: sagaIbGib,
                         msgStones: [deltaStone],
-                        sessionIdentity: identity,
                         localSpace: mySpace,
                         metaspace
                     });
@@ -2079,20 +1701,11 @@ export class SyncSagaCoordinator {
                         const commitFrame = await this.evolveSyncSagaIbGib({
                             prevSagaIbGib: deltaFrame, // Build on top of the Delta we just created/persisted
                             msgStones: [commitStone],
-                            sessionIdentity: identity,
                             localSpace: mySpace,
                             metaspace
                         });
-                        // Build control payloads for commit
-                        const commitCtrlPayloads2 = [commitFrame, commitStone];
-                        if (identity) {
-                            commitCtrlPayloads2.push(identity);
-                        }
                         return { frame: commitFrame, };
                     }
-                    // Build control payloads for delta propose
-                    // const deltaCtrlPayloads: IbGib_V1[] = [deltaFrame, deltaStone];
-                    // if (identity) { deltaCtrlPayloads.push(identity); }
                     return { frame: deltaFrame, payloadIbGibsDomain: outgoingPayload };
                 }
             }
@@ -2110,7 +1723,7 @@ export class SyncSagaCoordinator {
     /**
      * should throw if fails
      */
-    async executeLocalCommit({ deltaFrame, commitFrame, sagaHistory, metaspace, localSpace, localTempSpace, identity, }) {
+    async executeLocalCommit({ deltaFrame, commitFrame, sagaHistory, metaspace, localSpace, localTempSpace, }) {
         const lc = `${this.lc}[${this.executeLocalCommit.name}]`;
         try {
             if (logalot) {
@@ -2382,7 +1995,7 @@ export class SyncSagaCoordinator {
             }
         }
     }
-    async createCommitFrame({ sagaIbGib, errors, metaspace, mySpace, identity, }) {
+    async createCommitFrame({ sagaIbGib, errors, metaspace, mySpace, }) {
         const lc = `[${this.createCommitFrame.name}]`;
         try {
             if (logalot) {
@@ -2410,7 +2023,6 @@ export class SyncSagaCoordinator {
             const commitFrame = await this.evolveSyncSagaIbGib({
                 prevSagaIbGib: sagaIbGib,
                 msgStones: [commitStone],
-                sessionIdentity: identity,
                 localSpace: mySpace,
                 metaspace,
             });
@@ -2426,7 +2038,7 @@ export class SyncSagaCoordinator {
             }
         }
     }
-    async handleCommitFrame({ sagaIbGib, mySpace, myTempSpace, metaspace, identity, }) {
+    async handleCommitFrame({ sagaIbGib, mySpace, myTempSpace, metaspace, }) {
         const lc = `${this.lc}[${this.handleCommitFrame.name}]`;
         try {
             if (logalot) {
@@ -2461,7 +2073,6 @@ export class SyncSagaCoordinator {
                         sagaIbGib,
                         metaspace,
                         mySpace,
-                        identity,
                         errors: validationErrors,
                     });
                     return { frame: errorCommitFrame, }; /* <<<< returns early */
@@ -2491,7 +2102,6 @@ export class SyncSagaCoordinator {
                 errors: [emsg],
                 metaspace,
                 mySpace,
-                identity,
             });
             return { frame: errorCommitFrame };
         }
@@ -2599,7 +2209,7 @@ export class SyncSagaCoordinator {
     /**
      * Evolves the saga timeline with a new frame.
      */
-    async evolveSyncSagaIbGib({ prevSagaIbGib, conflictStrategy, msgStones, sessionIdentity, localSpace, metaspace, }) {
+    async evolveSyncSagaIbGib({ prevSagaIbGib, conflictStrategy, msgStones, localSpace, metaspace, }) {
         const lc = `${this.lc}[${this.evolveSyncSagaIbGib.name}]`;
         try {
             // Validation
@@ -2622,7 +2232,6 @@ export class SyncSagaCoordinator {
                     throw new Error(`${lc} Mismatched stage in stones. Expected ${stage}, got ${d.stage} (E: d12c6571b0882f762921b60880c3f826)`);
                 }
             }
-            const identityAddr = sessionIdentity ? getIbGibAddr({ ibGib: sessionIdentity }) : undefined;
             if (prevSagaIbGib) {
                 /**
                  * rel8ns always include the new msg stone(s)
@@ -2633,10 +2242,6 @@ export class SyncSagaCoordinator {
                         ibGibs: msgStones,
                     }
                 ];
-                // if we're authenticating/signing, we'll have identity
-                if (sessionIdentity) {
-                    rel8nInfos.push({ rel8nName: 'identity', ibGibs: [sessionIdentity], });
-                }
                 // remove the existing sync msg stones' addrs
                 if (!prevSagaIbGib.rel8ns) {
                     throw new Error(`(UNEXPECTED) prevSagaIbGib.rel8ns falsy? (E: 81375841aff85b1e48ea42ca218e6826)`);
@@ -2676,13 +2281,6 @@ export class SyncSagaCoordinator {
                 // rel8ns
                 const stoneAddrs = msgStones.map(s => getIbGibAddr({ ibGib: s }));
                 const rel8ns = { [SYNC_MSG_REL8N_NAME]: stoneAddrs, };
-                if (identityAddr) {
-                    rel8ns.identity = [identityAddr];
-                }
-                // Attach session keystone to saga frame via hard rel8n
-                if (sessionIdentity) {
-                    rel8ns.sessionKeystone = [getIbGibAddr({ ibGib: sessionIdentity })];
-                }
                 const resNew = await createTimeline({
                     space: localSpace,
                     metaspace,