@ibgib/core-gib 0.1.61 → 0.1.63

package/src/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mts

@@ -21,7 +21,8 @@ import { KeystoneStrategyFactory } from '../../../../keystone/strategy/keystone-
 import { KeystoneService_V1 } from '../../../../keystone/keystone-service-v1.mjs';
 import { IbGibSpaceAny } from '../../../../witness/space/space-base-v1.mjs';
 import { MetaspaceService } from '../../../../witness/space/metaspace/metaspace-types.mjs';
-import { POOL_ID_CONNECT, KEYSTONE_VERB_CONNECT } from '../../../../keystone/keystone-constants.mjs';
+import { POOL_ID_CONNECT, KEYSTONE_VERB_CONNECT, KEYSTONE_VERB_SYNC } from '../../../../keystone/keystone-constants.mjs';
+import { getTjpAddr } from '../../../../common/other/ibgib-helper.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT
 
@@ -297,35 +298,77 @@ export async function validateAndRegisterEvolveKeystone({
             throw new Error(`Intrinsic keystone validation failed: ${intrinsicErrors.join(', ')} (E: 38ea984585edc6ee88d2a698c7895826)`);
         }
 
-        // 2. Verify URL :domainAddr matches the keystone's tjp
-        const infoAddr = getGibInfo({ ibGibAddr: addr });
-        const tjpGib = infoAddr.tjpGib ?? infoAddr.punctiliarHash;
-        const infoDomain = getGibInfo({ ibGibAddr: domainAddr });
-        const expectedTjpGib = infoDomain.tjpGib ?? infoDomain.punctiliarHash;
-        if (tjpGib !== expectedTjpGib) {
-            throw new Error(`Keystone tjpGib (${tjpGib}) does not match URL domainAddr tjpGib (${expectedTjpGib})`);
-        }
-
-        // 3. Load previous frame (the current tip in metaspace)
+        // 2. Load the latest root Domain Identity tip in metaspace
         const keystoneService = new KeystoneService_V1();
-        let prevIbGib: KeystoneIbGib_V1;
+        let parentKeystone: KeystoneIbGib_V1;
         try {
-            prevIbGib = await keystoneService.getLatestKeystone({
+            parentKeystone = await keystoneService.getLatestKeystone({
                 addr: domainAddr,
                 metaspace,
                 space
             });
         } catch (error) {
-            throw new Error(`Could not retrieve previous keystone tip for ${domainAddr}: ${extractErrorMsg(error)} (E: b73ed8aeb0d837d248718b487345d326)`);
+            throw new Error(`Could not retrieve root Domain Identity tip for ${domainAddr}: ${extractErrorMsg(error)} (E: b73ed8aeb0d837d248718b487345d326)`);
         }
 
-        // 4. Validate Evolution Transition
-        const validationErrors = await keystoneService.validate({
-            currentIbGib: keystoneIbGib,
-            prevIbGib
-        });
-        if (validationErrors && validationErrors.length > 0) {
-            throw new Error(`Keystone evolution validation failed: ${validationErrors.join(', ')} (E: 5212f8492ac839953842631834bcd826)`);
+        const parentTjpAddr = getTjpAddr({ ibGib: parentKeystone });
+        const incomingTjpAddr = getTjpAddr({ ibGib: keystoneIbGib });
+        if (!incomingTjpAddr) {
+            throw new Error(`Incoming keystone does not have a TJP address (E: d288fae39b7d825d)`);
+        }
+
+        const isDelegate = incomingTjpAddr !== parentTjpAddr;
+        let prevIbGib: KeystoneIbGib_V1 | undefined;
+
+        if (isDelegate) {
+            // Verify that the delegate is registered under the root Domain Identity
+            const delegateInfo = parentKeystone.data?.delegates?.[incomingTjpAddr];
+            if (!delegateInfo) {
+                throw new Error(`Incoming delegate keystone (${incomingTjpAddr}) is not registered under parent Domain Identity (${parentTjpAddr}) (E: c288fae39b7d82fe)`);
+            }
+
+            // Verify that the delegate is authorized for sync
+            const allowedVerbs = delegateInfo.allowedVerbs ?? [];
+            if (!allowedVerbs.includes(KEYSTONE_VERB_SYNC)) {
+                throw new Error(`Incoming delegate keystone is not authorized for sync. Allowed verbs: ${allowedVerbs.join(', ')} (E: a288fae39b7d82ff)`);
+            }
+
+            // Load delegate's latest frame from space (if any)
+            const delegateLatestAddr = await metaspace.getLatestAddr({
+                addr: incomingTjpAddr,
+                space
+            });
+            if (delegateLatestAddr) {
+                const resGet = await metaspace.get({ addr: delegateLatestAddr, space });
+                if (resGet.success && resGet.ibGibs && resGet.ibGibs.length > 0) {
+                    prevIbGib = resGet.ibGibs[0] as KeystoneIbGib_V1;
+                }
+            }
+        } else {
+            // For root Domain Identity evolution, it must transition from the parent keystone tip
+            prevIbGib = parentKeystone;
+        }
+
+        // 3. Validate Evolution Transition or Graph
+        if (prevIbGib) {
+            const validationErrors = await keystoneService.validate({
+                currentIbGib: keystoneIbGib,
+                prevIbGib
+            });
+            if (validationErrors && validationErrors.length > 0) {
+                throw new Error(`Keystone evolution validation failed: ${validationErrors.join(', ')} (E: 5212f8492ac839953842631834bcd826)`);
+            }
+        } else {
+            // Validate delegate's genesis or entire graph if no previous tip exists
+            const validationErrors = await keystoneService.validateKeystoneGraph({
+                keystoneIbGib,
+                getLatest: false,
+                invalidIfMoreRecentKeystoneFoundInSpace: false,
+                space
+            });
+            if (validationErrors && validationErrors.length > 0) {
+                throw new Error(`Keystone graph validation failed: ${validationErrors.join(', ')} (E: 3a288fae39b7d82e)`);
+            }
         }
 
         // 5. Check Single Pool Restriction
@@ -352,8 +395,39 @@ export async function validateAndRegisterEvolveKeystone({
         const { verb } = claim;
         if (!verb) { throw new Error(`claim.verb is falsy (E: 92cf38af58db2cd90e7132b8940fe326)`); }
 
+        if (verb === 'manage') {
+            const prevDelegates = prevIbGib?.data?.delegates ?? {};
+            const currDelegates = keystoneIbGib.data?.delegates ?? {};
+            for (const [delegateTjpAddr, delegateInfo] of Object.entries(currDelegates)) {
+                if (!prevDelegates[delegateTjpAddr]) {
+                    const delegateAddr = delegateInfo.delegateAddr;
+                    const delegateIbGib = relatedIbGibs.find(ibGib => getIbGibAddr({ ibGib }) === delegateAddr);
+                    if (!delegateIbGib) {
+                        throw new Error(`Evolved delegate keystone ${delegateAddr} must be provided in relatedIbGibs (E: 1fe5a68438e288ab4e86c90d81d142826)`);
+                    }
+                    const delegateErrors = await keystoneService.validateGenesisKeystone({ keystoneIbGib: delegateIbGib as any });
+                    if (delegateErrors && delegateErrors.length > 0) {
+                        throw new Error(`Genesis validation failed for delegate keystone ${delegateAddr}: ${delegateErrors.join(', ')} (E: d8afdc1dbed48c000455b35585dc26826)`);
+                    }
+                }
+            }
+
+            await metaspace.put({ ibGibs: [keystoneIbGib, ...relatedIbGibs], space });
+            await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
+            for (const related of relatedIbGibs) {
+                if (related.ib?.startsWith('keystone')) {
+                    await metaspace.registerNewIbGib({ ibGib: related, space });
+                }
+            }
+            return;
+        }
+
         if (verb !== 'sync') {
-            throw new Error(`non-sync keystone evolution not yet implemented (E: eca4681b05486d1f784c0cb815ef9926)`);
+            throw new Error(`non-sync/non-manage keystone evolution not yet implemented (E: eca4681b05486d1f784c0cb815ef9926)`);
+        }
+
+        if (!isDelegate) {
+            throw new Error(`Root Domain Identity (${parentTjpAddr}) is not allowed to sync directly. A delegate must be used. (E: 2c88fae39b7d82fd)`);
         }
 
         const sAddr = claim.target;

package/src/sync/sync-saga-coordinator.mts

@@ -31,6 +31,7 @@ import {
     DomainIbGibAnalysisInfo, NextSagaFrameInfo,
     HandleSagaResponseContextResult,
     SyncSagaFrameDependencyGraph,
+    SyncSenderIdentityInfo,
 } from "./sync-types.mjs";
 import { getSyncSagaFrameOrigin, getFullSyncSagaHistory, getSyncIb, getTempSpaceName, isPastFrame, putInSpace_dnasThenNonDnas, validateFullSyncSagaHistory, getAllOrphanedAddresses, getFinalConflictsInfo, getSyncSagaFrameDependencyGraph } from "./sync-helpers.mjs";
 import { getDeltaDependencyGraph, getDependencyGraph, toFlatGraph } from "../common/other/graph-helper.mjs";
@@ -143,7 +144,7 @@ export class SyncSagaCoordinator {
     public async sync({
         peer,
         domainIbGibs,
-        senderIdentity,
+        senderIdentityInfo,
         fnSenderSecret,
         conflictStrategy = SyncConflictStrategy.abort,
         metaspace,
@@ -161,19 +162,16 @@ export class SyncSagaCoordinator {
          */
         domainIbGibs: IbGib_V1[],
         /**
-         * If present, this is the primary identity of the sender, i.e., who is
-         * initiating the sync.
-         *
-         * This should be the most recent frame (tip) of the senderIdentity's
-         * timeline.
+         * Optional structure containing both the sender's delegate identity (Alice's device key)
+         * and the parent root Domain Identity address (senderDomainAddr).
          *
          * NOTE: {@link fnSenderSecret} must be truthy if this is truthy, and vice versa.
          */
-        senderIdentity?: KeystoneIbGib_V1,
+        senderIdentityInfo?: SyncSenderIdentityInfo,
         /**
-         * secret corresponding to {@link senderIdentity}.
+         * secret corresponding to {@link senderIdentityInfo.senderIdentity}.
          *
-         * NOTE: {@link senderIdentity} must be truthy if this is truthy, and vice versa.
+         * NOTE: {@link senderIdentityInfo} must be truthy if this is truthy, and vice versa.
          */
         fnSenderSecret?: () => Promise<string>;
         /**
@@ -201,11 +199,17 @@ export class SyncSagaCoordinator {
             throw new Error(`${lc} source (or localSpace) required (E: 25df3761f7686a1099a552f83c95d326)`);
         }
 
-        if (senderIdentity || fnSenderSecret) {
-            if (!senderIdentity) { throw new Error(`(UNEXPECTED) senderIdentity falsy but fnSenderSecret truthy? if either is used, both must be truthy. (E: e366628a4919c7d727d2cbd8e5b75e26)`); }
-            if (!fnSenderSecret) { throw new Error(`(UNEXPECTED) fnSenderSecret falsy but senderIdentity truthy? if either is used, both must be truthy. (E: 7d55ce37ae482fec48e3398158161926)`); }
+        if (senderIdentityInfo || fnSenderSecret) {
+            if (!senderIdentityInfo) { throw new Error(`(UNEXPECTED) senderIdentityInfo falsy but fnSenderSecret truthy? if either is used, both must be truthy. (E: e366628a4919c7d727d2cbd8e5b75e26)`); }
+            if (!fnSenderSecret) { throw new Error(`(UNEXPECTED) fnSenderSecret falsy but senderIdentityInfo truthy? if either is used, both must be truthy. (E: 7d55ce37ae482fec48e3398158161926)`); }
+            
+            const { senderIdentity, senderDomainAddr } = senderIdentityInfo;
+            if (!senderIdentity) { throw new Error(`(UNEXPECTED) senderIdentity falsy in senderIdentityInfo? if senderIdentityInfo is provided, both senderIdentity and senderDomainAddr must be truthy. (E: a3c17fae2978926d)`); }
+            if (!senderDomainAddr) { throw new Error(`(UNEXPECTED) senderDomainAddr falsy in senderIdentityInfo? if senderIdentityInfo is provided, both senderIdentity and senderDomainAddr must be truthy. (E: d288fae39b7d825c)`); }
         }
 
+        const { senderIdentity, senderDomainAddr } = senderIdentityInfo ?? {};
+
         // 1. SETUP SAGA METADATA
         const sagaId = await getUUID();
 
@@ -247,6 +251,7 @@ export class SyncSagaCoordinator {
                 peer.setOptionalOpts({
                     sagaId,
                     senderIdentity,
+                    senderDomainAddr,
                     fnSenderSecret,
                     sessionConnectPoolConfig: this.defaultSessionConnectPoolConfig(),
                     sessionSyncPoolConfig: this.defaultSessionSyncPoolConfig(),

package/src/sync/sync-types.mts

@@ -1,5 +1,6 @@
 import { IbGibAddr } from "@ibgib/ts-gib/dist/types.mjs";
 import { IbGib_V1, IbGibData_V1, IbGibRel8ns_V1 } from "@ibgib/ts-gib/dist/V1/types.mjs";
+import { KeystoneIbGib_V1 } from "../keystone/keystone-types.mjs";
 
 import { SubjectWitness } from "../common/pubsub/subject/subject-types.mjs";
 import { SyncSagaContextIbGib_V1 } from "./sync-saga-context/sync-saga-context-types.mjs";
@@ -221,3 +222,8 @@ export interface SessionGenesisFrameDetails {
  * to get this working.
  */
 export type StageInProtocol = "beforeSend" | "beforeReceive";
+
+export interface SyncSenderIdentityInfo {
+    senderIdentity: KeystoneIbGib_V1;
+    senderDomainAddr: string;
+}

package/src/sync/sync-withid.connect.respec.mts

@@ -10,7 +10,7 @@
  */
 
 import {
-    respecfully, ifWe, iReckon,
+    respecfully, ifWe, ifWeMight, iReckon,
 } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
 const maam = `[${import.meta.url}]`, sir = maam;
 import { clone, delay, extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
@@ -184,7 +184,10 @@ await respecfully(sir, `Test Phase 2: peer.connect()`, async () => {
 
         const syncSaga = await senderCoordinator.sync({
             domainIbGibs: [xStone],
-            senderIdentity,
+            senderIdentityInfo: {
+                senderIdentity,
+                senderDomainAddr: getIbGibAddr({ ibGib: senderIdentity }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
             peer,
             localSpace: sourceSpace,

package/src/sync/sync-withid.establish.respec.mts

@@ -244,7 +244,10 @@ await respecfully(sir, `Test Phase 1: establishSessionIdentity`, async () => {
 
         const syncSaga = await senderCoordinator.sync({
             domainIbGibs: [xStone],
-            senderIdentity,
+            senderIdentityInfo: {
+                senderIdentity,
+                senderDomainAddr: getIbGibAddr({ ibGib: senderIdentity }),
+            },
             fnSenderSecret: async () => { return SENDER_SECRET },
             peer: await newTestPeer(),
             localSpace: sourceSpace,

package/src/sync/sync-withid.pingpong.respec.mts

@@ -141,7 +141,10 @@ await respecfully(sir, `Test Phase 3A: Ping Pong Sync with Identity`, async () =
 
         const syncSaga = await senderCoordinator.sync({
             domainIbGibs: [xStone],
-            senderIdentity,
+            senderIdentityInfo: {
+                senderIdentity,
+                senderDomainAddr: getIbGibAddr({ ibGib: senderIdentity }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
             peer,
             localSpace: sourceSpace,

package/src/sync/unused-identity-backup.mts.md

@@ -1,311 +0,0 @@
-I am removing ALL identity/session/identities/keystone-related code from sync
-and starting over, now that I have a clearer idea of the requirements.
-
-This is code that I thought would be reusable with minimal adjustments later.
-
-TODO: I have mangled some of the hits for these terms by adding a space after
-the first letter. After i am done, need to go back through and search for "k
-eystone", "i dentity" "s ession" for these mangled terms.
-
-```typescript
-import { KeystoneIbGib_V1, } from "../keystone/keystone-types.mjs";
-import { KeystoneService_V1 } from '../../keystone/keystone-service-v1.mjs';
-import { validateKeystoneGraph, validateKeystoneTransition } from '../../keystone/keystone-helpers.mjs';
-
-/**
- * creates a session identity keystone based off of the given args.
- *
- * Then, if the {@link primaryIdentity} keystone is provided, this also
- * **signs** this keystone pointing to the address of the sess
- */
-public async createSessionIdentity({
-    sagaId,
-    primaryIdentity,
-    nonSessionSecret,
-    metaspace,
-    localSpace,
-}: {
-    /**
-     * unique to any one particular saga.
-     */
-    sagaId: string,
-    /**
-     * optional main identity, e.g., Alice's keystone
-     */
-    primaryIdentity: KeystoneIbGib_V1 | undefined,
-    /**
-     * driving secret behind the sync operation. usually, this will be the
-     * secret corresponding to a primary identity keystone. But this can
-     * also just be a one-time secret just to have more security in the
-     * transmission intrinsically.
-     */
-    nonSessionSecret: string,
-    metaspace: MetaspaceService,
-    localSpace: IbGibSpaceAny,
-}): Promise<{
-    sessionIdentity: KeystoneIbGib_V1,
-    sessionSecret: string,
-    /**
-     * if truthy, this evolved from the incoming {@link primaryIdentity} and
-     * has already persisted/registered in the incoming {@link localSpace}.
-     */
-    newPrimaryIdentity: KeystoneIbGib_V1 | undefined
-}> {
-    const lc = `${this.lc}[${this.createSessionIdentity.name}]`;
-    try {
-        if (logalot) { console.log(`${lc} starting... (I: 428392a4ee636b7bd8f7d5d89a87e826)`); }
-
-        if (!nonSessionSecret) { throw new Error(`(UNEXPECTED) nonSessionSecret falsy? This is expected to be truthy by this point. (E: 8ce053fe59825a6678713128953b9d26)`); }
-
-        debugger; // step through create session id
-        const sessionSecret = await this.deriveSessionSecret({
-            sagaId, nonSessionSecret
-        });
-
-        // Generate keystone with two initial pools in two steps.
-        //   1. Create primary pool with genesis method to correspond to the
-        //      sender/sender's secret/identity.
-        //   2. Create a separate pool and add separately because a
-        //      different pw + config is used for the transition pool.
-
-        if (!this.sessionKeystonePoolConfig) { throw new Error(`this.sessionKeystonePoolConfig falsy. createSessionIdentity requires the coordinator to have this config set. (E: d65bb868d5e3e72c585d64d594e2b826)`); }
-        const sessionIdentity_genesis = await this.keystoneSvc.genesis({
-            masterSecret: sessionSecret,
-            configs: [this.sessionKeystonePoolConfig],
-            metaspace,
-            space: localSpace,
-        });
-
-        // #region sanity validation of genesis keystone
-        /**
-         * not necessary but since it's a new design, I'm putting in this
-         * immediate validation just to put it through its paces. (worth the
-         * slight perf hit).
-         */
-        const validationErrors = await validateGenesisKeystone({
-            keystoneIbGib: sessionIdentity_genesis
-        });
-        if (validationErrors && validationErrors.length > 0) { throw new Error(`(UNEXPECTED) the sessionIdentity_genesis that we just created already has validation errors just after creation? errors: ${validationErrors} (E: e9ca08cf0f8858bb1ace8b9fa89f8726)`); }
-        // #endregion sanity validation of genesis keystone
-
-        let newPrimaryIdentity: KeystoneIbGib_V1 | undefined = undefined;
-        if (primaryIdentity) {
-            newPrimaryIdentity = await this.keystoneSvc.sign({
-                latestKeystone: primaryIdentity,
-                poolId: this.sessionKeystonePoolConfig.id,
-                claim: {
-                    verb: KEYSTONE_VERB_SIGN,
-                    target: getIbGibAddr({ ibGib: sessionIdentity_genesis }),
-                },
-                masterSecret: nonSessionSecret,
-                metaspace,
-                space: localSpace,
-                // frameDetails: undefined, // anything to put here?
-                // requiredChallengeIds: undefined, // not relevant I think
-            });
-        }
-
-        // --- IMMEDIATE PERSISTENCE (Audit Trail Rule) ---
-        // The initial session keystone is trusted locally and must be stored
-        // in the durable space immediately so the FSM and validation steps
-        // can use it to sign outgoing contexts.
-        const identityIbGibs: IbGib_V1[] = [
-            sessionIdentity_genesis
-        ];
-        if (newPrimaryIdentity) {
-            identityIbGibs.push(newPrimaryIdentity);
-        }
-
-        // identity ibgibs are single framed without dna, so we only have to
-        // worry about each individual frame (i.e. no dependency graph)
-        await metaspace.put({
-            ibGibs: identityIbGibs,
-            space: localSpace,
-        });
-        for (const identityIbGib of identityIbGibs) {
-            await registerNewIbGib({
-                ibGib: identityIbGib,
-                space: localSpace,
-                fnBroadcast: undefined,
-            });
-        }
-        // ------------------------------------------------
-
-        return {
-            sessionIdentity: sessionIdentity_genesis,
-            sessionSecret,
-            newPrimaryIdentity,
-        }
-    } catch (error) {
-        console.error(`${lc} ${extractErrorMsg(error)}`);
-        throw error;
-    } finally {
-        if (logalot) { console.log(`${lc} complete.`); }
-    }
-}
-
-/**
-    * helper that KDFs the given identitySecret, using {@link sagaId} to do so.
-    *
-    * @returns deterministically derived session secret
-    */
-private async deriveSessionSecret({
-    sagaId,
-    nonSessionSecret,
-}: {
-    sagaId: string,
-    /**
-        * driving secret behind the sync operation. usually, this will be the
-        * secret corresponding to a primary identity keystone. But this can
-        * also just be a one-time secret just to have more security in the
-        * transmission intrinsically.
-        */
-    nonSessionSecret: string,
-}): Promise<string> {
-    const lc = `${this.lc}[${this.deriveSessionSecret.name}]`;
-    try {
-        if (logalot) { console.log(`${lc} starting... (I: 0de03f8dcd3e32f1fca244e8f2a8a826)`); }
-
-        // Derive session-specific secret using KDF
-        const sessionSecret = await deriveKey({
-            masterSecret: nonSessionSecret,
-            kdfOpts: {
-                strategy: KdfStrategy.recursive_salt_wrap,
-                salt: sagaId,
-                rounds: 10000,
-                algorithm: 'SHA-256'
-            }
-        });
-
-        return sessionSecret;
-    } catch (error) {
-        console.error(`${lc} ${extractErrorMsg(error)}`);
-        throw error;
-    } finally {
-        if (logalot) { console.log(`${lc} complete.`); }
-    }
-}
-
-
-
-/**
- * move to sync-peer-helpers.mts as a pure function?
- */
-export async function authenticateContext({
-    context,
-    space,
-    keystoneSvc,
-}: {
-    context: SyncSagaContextIbGib_V1,
-    space: IbGibSpaceAny,
-    keystoneSvc?: KeystoneService_V1,
-}): Promise<string[]> {
-    const lc = `[${authenticateContext.name}]`;
-    try {
-        if (logalot) { console.log(`${lc} starting... (I: 2677a482dfa873dcd1aa04a3031ff826)`); }
-
-        const errors: string[] = [];
-        if (!keystoneSvc) {
-            if (logalot) { console.warn(`${lc} No keystoneSvc provided. Skipping context authentication. (W: d34b8ad93d84a1ba8d8f7facd288826)`); }
-            return errors;
-        }
-
-        // Bill Architecture: We only sign at the context level.
-        // If the context refers to a session keystone, we must have a signedSessionKeystone
-        // as well to verify the most recent turn.
-        const { sessionKeystone: prevKeystoneAddrs } = context.rel8ns || {};
-        const { signedSessionKeystone: currKeystone } = context;
-
-        if (prevKeystoneAddrs && prevKeystoneAddrs.length > 0) {
-            if (!currKeystone) {
-                errors.push(`context.rel8ns.sessionKeystone present but context.signedSessionKeystone falsy. (E: b6e5a8ad93d84260a8d8e7facd288826)`);
-                return errors;
-            }
-
-            // Retrieve the previous keystone frame from space
-            const prevKeystoneAddr = prevKeystoneAddrs[0];
-            const getPrevRes = await getFromSpace({ addr: prevKeystoneAddr, space });
-            if (!getPrevRes.success || !getPrevRes.ibGibs || getPrevRes.ibGibs.length === 0) {
-                errors.push(`couldn't find previous session keystone (${prevKeystoneAddr}) in space (${space.ib}). (E: 7c34b8ad94d84a9ba8cbe7facd288826)`);
-                return errors;
-            }
-            const prevKeystone = getPrevRes.ibGibs[0] as KeystoneIbGib_V1;
-
-            // 1. Validate the transition (API replay of evolution + intrinsic validation)
-            const transitionErrors = await keystoneSvc.validate({
-                currentIbGib: currKeystone,
-                prevIbGib: prevKeystone,
-            });
-            if (transitionErrors.length > 0) {
-                errors.push(`Invalid session keystone transition: ${transitionErrors.join(', ')} (E: d34b8ad95d84b90a8d8ef7facd288826)`);
-            }
-
-            // 2. Verify that the signature in current keystone actually targets this context
-            const contextAddr = getIbGibAddr({ ibGib: context });
-            const proofTargetsThisContext = currKeystone.data?.proofs.some(p => p.claim.target === contextAddr);
-            if (!proofTargetsThisContext) {
-                errors.push(`Session keystone signature does not target the current context ibgib (${contextAddr}). (E: f3e5a8ad96d84c1ba8d8f7facd288826)`);
-            }
-        }
-
-        return errors;
-    } catch (error) {
-        console.error(`${lc} ${extractErrorMsg(error)}`);
-        throw error;
-    } finally {
-        if (logalot) { console.log(`${lc} complete.`); }
-    }
-}
-
-
-
-// #region this sync peer innerspace sendContextRequest
-
-            // Bill architecture: Keystone identity transportation.
-            // On each turn, the sender must include the current signed session
-            // keystone. If it's the first turn (Init), we include the entire
-            // keystone graph to ensure the receiver has the primary-to-session
-            // authorized link.
-            const identityIbGibs: IbGib_V1[] = [];
-            const { signedSessionKeystone } = context;
-            if (signedSessionKeystone) {
-                if (msg.data.stage === SyncStage.init) {
-                    // transmit full keystone graph on the first connect handshake
-                    const keystoneGraph = await getDependencyGraph({
-                        ibGib: signedSessionKeystone,
-                        space: localSpace,
-                    });
-                    identityIbGibs.push(...Object.values(keystoneGraph));
-                } else {
-                    // transmit only the latest evolution for subsequent turns
-                    identityIbGibs.push(signedSessionKeystone);
-                }
-            }
-
-// #endregion this sync peer innerspace sendContextRequest
-
-
-// #region SyncSagaContextRel8ns_V1
-
-    /**
-     * The Ephemeral Session Keystone Identity used for this saga. Required for
-     * validating the saga frame and this context.
-     *
-     * WARNING!!!: THIS DOES NOT POINT TO THE CURRENT SESSION KEYSTONE IN
-     * {@link SyncSagaContextIbGib_V1.signedSessionKeystone}. This points to the
-     * PREVIOUS FRAME (immediate past) of that frame. That session keystone
-     * signs with THIS context's frame as its target, so it is logically
-     * impossible because the hash would be different.
-     *
-     * ## notes
-     *
-     * ATOW (02/18/2026), this is a single address that will have a primary pool
-     * for the sender and a delegated pool for the receiver.
-     *
-     * @see {@link SyncSagaContextIbGib_V1.signedSessionKeystone}
-     */
-    sessionKeystone?: IbGibAddr[];
-
-// #endregion SyncSagaContextRel8ns_V1
-
-```