@ibgib/core-gib 0.1.59 → 0.1.61

package/src/keystone/policy/schemas/keystone.medium.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "MediumSecurityKeystoneProfile",
+  "type": "object",
+  "properties": {
+    "metadata": {
+      "type": "object",
+      "properties": {
+        "name": { "type": "string" },
+        "securityLevel": { "type": "string", "const": "medium" }
+      }
+    },
+    "pools": {
+      "type": "object",
+      "properties": {
+        "sync": { "$ref": "./sync-pool.medium.schema.json" },
+        "manage": { "$ref": "./manage-pool.medium.schema.json" },
+        "revoke": { "$ref": "./revoke-pool.medium.schema.json" },
+        "connect": { "$ref": "./connect-pool.medium.schema.json" },
+        "sign": { "$ref": "./sign-pool.medium.schema.json" }
+      },
+      "required": ["sync", "manage", "revoke", "connect", "sign"]
+    }
+  },
+  "required": ["pools"]
+}

package/src/keystone/policy/schemas/manage-pool.high.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "HighSecurityManagePool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "manage" },
+    "allowedVerbs": { "type": "array", "items": { "const": "manage" } },
+    "algo": { "type": "string", "const": "SHA-512" },
+    "rounds": { "type": "integer", "minimum": 4 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 2000 },
+        "replenish": { "type": "string", "enum": ["top-up", "replace-all"] },
+        "selectSequentially": { "type": "integer", "minimum": 10 },
+        "selectRandomly": { "type": "integer", "minimum": 10 },
+        "targetBindingCount": { "type": "integer", "minimum": 16 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/manage-pool.low.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "LowSecurityManagePool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "manage" },
+    "allowedVerbs": { "type": "array", "items": { "const": "manage" } },
+    "algo": { "type": "string", "const": "SHA-256" },
+    "rounds": { "type": "integer", "minimum": 2 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 10 },
+        "replenish": { "type": "string", "enum": ["top-up", "replace-all"] },
+        "selectSequentially": { "type": "integer", "minimum": 1 },
+        "selectRandomly": { "type": "integer", "minimum": 1 },
+        "targetBindingCount": { "type": "integer", "minimum": 3 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/manage-pool.medium.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "MediumSecurityManagePool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "manage" },
+    "allowedVerbs": { "type": "array", "items": { "const": "manage" } },
+    "algo": { "type": "string", "enum": ["SHA-256", "SHA-512"] },
+    "rounds": { "type": "integer", "minimum": 2 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 500 },
+        "replenish": { "type": "string", "enum": ["top-up", "replace-all"] },
+        "selectSequentially": { "type": "integer", "minimum": 5 },
+        "selectRandomly": { "type": "integer", "minimum": 5 },
+        "targetBindingCount": { "type": "integer", "minimum": 10 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/revoke-pool.high.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "HighSecurityRevokePool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "revoke" },
+    "allowedVerbs": { "type": "array", "items": { "const": "revoke" } },
+    "algo": { "type": "string", "const": "SHA-512" },
+    "rounds": { "type": "integer", "minimum": 20 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 2000 },
+        "replenish": { "type": "string", "const": "delete-all" },
+        "selectSequentially": { "type": "integer", "minimum": 50 },
+        "selectRandomly": { "type": "integer", "minimum": 50 },
+        "targetBindingCount": { "type": "integer", "minimum": 0 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/revoke-pool.low.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "LowSecurityRevokePool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "revoke" },
+    "allowedVerbs": { "type": "array", "items": { "const": "revoke" } },
+    "algo": { "type": "string", "const": "SHA-256" },
+    "rounds": { "type": "integer", "minimum": 5 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 12 },
+        "replenish": { "type": "string", "const": "delete-all" },
+        "selectSequentially": { "type": "integer", "minimum": 3 },
+        "selectRandomly": { "type": "integer", "minimum": 3 },
+        "targetBindingCount": { "type": "integer", "minimum": 0 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/revoke-pool.medium.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "MediumSecurityRevokePool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "revoke" },
+    "allowedVerbs": { "type": "array", "items": { "const": "revoke" } },
+    "algo": { "type": "string", "enum": ["SHA-256", "SHA-512"] },
+    "rounds": { "type": "integer", "minimum": 10 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 200 },
+        "replenish": { "type": "string", "const": "delete-all" },
+        "selectSequentially": { "type": "integer", "minimum": 20 },
+        "selectRandomly": { "type": "integer", "minimum": 20 },
+        "targetBindingCount": { "type": "integer", "minimum": 0 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/sign-pool.high.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "HighSecuritySignPool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "default" },
+    "allowedVerbs": { "type": "array", "items": { "const": "sign" } },
+    "algo": { "type": "string", "const": "SHA-512" },
+    "rounds": { "type": "integer", "minimum": 4 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 1000 },
+        "replenish": { "type": "string", "const": "top-up" },
+        "selectSequentially": { "type": "integer", "minimum": 10 },
+        "selectRandomly": { "type": "integer", "minimum": 10 },
+        "targetBindingCount": { "type": "integer", "minimum": 16 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/sign-pool.low.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "LowSecuritySignPool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "default" },
+    "allowedVerbs": { "type": "array", "items": { "const": "sign" } },
+    "algo": { "type": "string", "const": "SHA-256" },
+    "rounds": { "type": "integer", "minimum": 2 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 20 },
+        "replenish": { "type": "string", "const": "top-up" },
+        "selectSequentially": { "type": "integer", "minimum": 1 },
+        "selectRandomly": { "type": "integer", "minimum": 1 },
+        "targetBindingCount": { "type": "integer", "minimum": 3 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/sign-pool.medium.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "MediumSecuritySignPool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "default" },
+    "allowedVerbs": { "type": "array", "items": { "const": "sign" } },
+    "algo": { "type": "string", "enum": ["SHA-256", "SHA-512"] },
+    "rounds": { "type": "integer", "minimum": 2 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 200 },
+        "replenish": { "type": "string", "const": "top-up" },
+        "selectSequentially": { "type": "integer", "minimum": 5 },
+        "selectRandomly": { "type": "integer", "minimum": 5 },
+        "targetBindingCount": { "type": "integer", "minimum": 10 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/sync-pool.high.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "HighSecuritySyncPool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "sync" },
+    "allowedVerbs": { "type": "array", "items": { "const": "sync" } },
+    "algo": { "type": "string", "const": "SHA-512" },
+    "rounds": { "type": "integer", "minimum": 4 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 2000 },
+        "replenish": { "type": "string", "const": "top-up" },
+        "selectSequentially": { "type": "integer", "minimum": 10 },
+        "selectRandomly": { "type": "integer", "minimum": 10 },
+        "targetBindingCount": { "type": "integer", "minimum": 16 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/sync-pool.low.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "LowSecuritySyncPool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "sync" },
+    "allowedVerbs": { "type": "array", "items": { "const": "sync" } },
+    "algo": { "type": "string", "const": "SHA-256" },
+    "rounds": { "type": "integer", "minimum": 1 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 12 },
+        "replenish": { "type": "string", "const": "top-up" },
+        "selectSequentially": { "type": "integer", "minimum": 1 },
+        "selectRandomly": { "type": "integer", "minimum": 1 },
+        "targetBindingCount": { "type": "integer", "minimum": 3 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/sync-pool.medium.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "MediumSecuritySyncPool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "sync" },
+    "allowedVerbs": { "type": "array", "items": { "const": "sync" } },
+    "algo": { "type": "string", "enum": ["SHA-256", "SHA-512"] },
+    "rounds": { "type": "integer", "minimum": 2 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 500 },
+        "replenish": { "type": "string", "const": "top-up" },
+        "selectSequentially": { "type": "integer", "minimum": 5 },
+        "selectRandomly": { "type": "integer", "minimum": 5 },
+        "targetBindingCount": { "type": "integer", "minimum": 10 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/sync/docs/security-3b.md

@@ -0,0 +1,92 @@
+# Implementation Plan: Phase 3B — Basic Single-Timeline Sync with Identity (Integrated)
+
+This document outlines the implementation plan for Phase 3B of identity integration, focusing on integrating the cryptographic session identity into the WebSocket sync peer architecture, and wiring up the Row 3B dev-tools test buttons.
+
+## 1. Goal
+The goal of Phase 3B is to achieve successful end-to-end synchronization of a test ibgib `X` over a stateful WebSocket connection using asymmetric session identity validation. 
+At the end of the sync saga:
+- Both sender and receiver durable spaces must contain the same evolved Domain Keystone (I1).
+- Both spaces must contain the full session identity keystone (S) graph evolved to the correct turn count ($n = 3$, or potentially $n = 4$ depending on exact commit phase timeline evolution).
+- Both spaces must contain the identical target ibgib `X` dependency graph.
+
+---
+
+## 2. Technical Challenge: Asymmetric Authentication in WebSocket Peers
+In V1, only the sender (Alice) signs the synchronization context. The receiver (Bob) skips signing the response context (`skipSign: true`), relying on transport-level security (TLS) for the return path. 
+Consequently:
+- Alice's request context contains a `signedSessionIdentity`.
+- Bob's response context has `signedSessionIdentity` set to `undefined`.
+
+### Current Issue in `SyncPeerWebSocketSender_V1`
+In `SyncPeerWebSocketSender_V1.handleRuntimeMessage`, the sender currently attempts to authenticate Bob's response context:
+```typescript
+if (msg.type === SyncWebSocketMsgType.sync_frame_response) {
+    const responseContext = msg.context as SyncSagaContextIbGib_V1;
+
+    // Validate and authenticate Bob's response context first
+    await this.authenticateAndValidate({ context: responseContext });
+```
+Because `authenticateAndValidate` calls `authenticateContextIntrinsically` which expects a signature when `sagaFrame.data.sessionIdentityTjpAddr` is present, this call will throw an error since Bob's response context has no `signedSessionIdentity`.
+
+### Solution
+Change `SyncPeerWebSocketSender_V1.handleRuntimeMessage` to run structural/intrinsic validation instead of full authentication on the response context:
+```typescript
+// Ensure the response context and saga frame are valid structurally
+const validationErrors = await validateContextAndSagaFrame({ context: responseContext });
+if (validationErrors.length > 0) {
+    throw new Error(`Invalid response context received. Errors: ${validationErrors.join(', ')}`);
+}
+```
+The client-side `SyncSagaCoordinator` will then run the turn-by-turn continuation, sequence, and identity validation checks via `validateReturnContext(...)`. This provides a robust stopgap validation for V1 before the receiver-side signing is fully implemented in future versions.
+
+
+---
+
+## 3. UI Integration: Dev Tools Row 3B
+We will wire up the three buttons in `apps/space-gib/src/client/dev-tools.mts` under the `init3bPlaceholder` placeholder handler:
+
+### 3.1. `btn-3b-setup`
+- **Actions**:
+  1. Generates a new long-lived Domain Keystone (I) for Alice using master secret `'test-sender-secret-phase3'` and unique salts (`'senderidentitysyncsaltphase3'`, `'senderidentitymanagesaltphase3'`).
+  2. Registers the genesis Domain Keystone (I) on the server via `apiBridge.postGenesisKeystone(domainI)`.
+  3. Creates a local dummy Target IbGib (X) with distinct test data: `{ hello: 'world3', random: Math.random() }`.
+  4. Stores `domainI`, `domainIMasterSecret`, and `targetX` in `debugState`.
+  5. Updates button text to `✓ 3B Setup Complete` and enables `btn-3b-sync`.
+
+### 3.2. `btn-3b-sync`
+- **Actions**:
+  1. Instantiates `SyncPeerWebSocketSender_V1` targeting the server's WS and evolution endpoints.
+  2. Initializes peer options with Alice's identity, secret, and a newly generated `sagaId`.
+  3. Instantiates `SyncSagaCoordinator`.
+  4. Calls `coordinator.sync(...)` to synchronize Target X to the server.
+  5. Awaits completion (`await syncSaga.done`). This must run without errors.
+  6. Updates button text to `✓ 3B Sync Run` and enables `btn-3b-check`.
+
+### 3.3. `btn-3b-check`
+- **Actions**:
+  1. Resolves the client's latest Target X address and fetches its local dependency graph.
+  2. Resolves the server's latest Target X address and fetches its server-side dependency graph using a new API bridge helper.
+  3. Asserts the client and server Target X graphs are equivalent:
+     - The latest address of X is identical.
+     - Graph node counts are identical.
+     - All keys and values match.
+  4. Resolves the latest session identity (S) address and asserts it evolved to `n = 2` (Init at $n=0$, Connect Handshake at $n=1$, Sync Context Sign at $n=2$).
+  5. Verifies the latest S address and graph are identical on both client and server.
+  6. Verifies the evolved Domain Keystone (I1) is present in both client and server spaces.
+  7. If all checks pass, logs `🎉 ALL PHASE 3B CHECKS PASSED FLAWLESSLY! ✓` and updates button text to `✓ 3B All Passed`.
+
+---
+
+## 4. Concrete Checklist
+
+### [ ] API Bridge Extension
+- [ ] Add `getIbGibGraph(domainAddr, ibGibAddr)` to `SpaceGibApiBridge` (`apps/space-gib/src/client/api/space-gib-api-bridge.mts`) to retrieve dependency graphs with `getGraph=true`.
+
+### [ ] WebSocket Peer Adjustments
+- [ ] Modify `SyncPeerWebSocketSender_V1.handleRuntimeMessage` to bypass `authenticateAndValidate` on Bob's response context, using `validateContextAndSagaFrame` instead.
+
+### [ ] Dev Tools UI (Row 3B) Wiring
+- [ ] Implement `init3bSetupButton` inside `dev-tools.mts`.
+- [ ] Implement `init3bSyncButton` inside `dev-tools.mts`.
+- [ ] Implement `init3bCheckButton` inside `dev-tools.mts`.
+- [ ] Update `initDevTools` to initialize the new button handlers and remove `init3bPlaceholder`.