@ibgib/core-gib 0.1.62 → 0.1.63

package/src/keystone/policy/profiles/profile-domain.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "../schemas/keystone.high.schema.json",
+  "metadata": {
+    "name": "Domain Identity Profile",
+    "securityLevel": "high"
+  },
+  "pools": {
+    "sync": {
+      "id": "sync",
+      "allowedVerbs": [
+        "sync"
+      ],
+      "algo": "SHA-512",
+      "rounds": 4,
+      "behavior": {
+        "size": 2000,
+        "replenish": "top-up",
+        "selectSequentially": 10,
+        "selectRandomly": 10,
+        "targetBindingCount": 16
+      }
+    },
+    "manage": {
+      "id": "manage",
+      "allowedVerbs": [
+        "manage"
+      ],
+      "algo": "SHA-512",
+      "rounds": 6,
+      "behavior": {
+        "size": 2000,
+        "replenish": "replace-all",
+        "selectSequentially": 12,
+        "selectRandomly": 12,
+        "targetBindingCount": 16
+      }
+    },
+    "revoke": {
+      "id": "revoke",
+      "allowedVerbs": [
+        "revoke"
+      ],
+      "algo": "SHA-512",
+      "rounds": 20,
+      "behavior": {
+        "size": 2000,
+        "replenish": "delete-all",
+        "selectSequentially": 50,
+        "selectRandomly": 50,
+        "targetBindingCount": 0
+      }
+    },
+    "connect": {
+      "id": "connect",
+      "allowedVerbs": [
+        "connect"
+      ],
+      "algo": "SHA-512",
+      "rounds": 4,
+      "behavior": {
+        "size": 2000,
+        "replenish": "top-up",
+        "selectSequentially": 10,
+        "selectRandomly": 10,
+        "targetBindingCount": 16
+      }
+    },
+    "sign": {
+      "id": "default",
+      "allowedVerbs": [
+        "sign"
+      ],
+      "algo": "SHA-512",
+      "rounds": 4,
+      "behavior": {
+        "size": 2000,
+        "replenish": "top-up",
+        "selectSequentially": 10,
+        "selectRandomly": 10,
+        "targetBindingCount": 16
+      }
+    }
+  }
+}

package/src/keystone/policy/profiles/profile-sync.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "../schemas/keystone.low.schema.json",
+  "metadata": {
+    "name": "Sync Delegate Profile",
+    "securityLevel": "low"
+  },
+  "pools": {
+    "sync": {
+      "id": "sync",
+      "allowedVerbs": [
+        "sync"
+      ],
+      "algo": "SHA-256",
+      "rounds": 1,
+      "behavior": {
+        "size": 100,
+        "replenish": "top-up",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    },
+    "manage": {
+      "id": "manage",
+      "allowedVerbs": [
+        "manage"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 100,
+        "replenish": "replace-all",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    },
+    "revoke": {
+      "id": "revoke",
+      "allowedVerbs": [
+        "revoke"
+      ],
+      "algo": "SHA-256",
+      "rounds": 5,
+      "behavior": {
+        "size": 100,
+        "replenish": "delete-all",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 0
+      }
+    },
+    "connect": {
+      "id": "connect",
+      "allowedVerbs": [
+        "connect"
+      ],
+      "algo": "SHA-256",
+      "rounds": 1,
+      "behavior": {
+        "size": 100,
+        "replenish": "top-up",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    },
+    "sign": {
+      "id": "default",
+      "allowedVerbs": [
+        "sign"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 100,
+        "replenish": "top-up",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    }
+  }
+}

package/src/keystone/strategy/hash-reveal-v1/hash-reveal-v1.mts

@@ -1,4 +1,4 @@
-import { hash } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { hash, HashAlgorithm } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 
 import { KeystoneStrategy } from '../keystone-strategy.mjs';
 import {
@@ -140,3 +140,22 @@ export class KeystoneStrategy_HashRevealV1 extends KeystoneStrategy<
         }
     }
 }
+
+/**
+ * Derives a delegate secret from the parent's masterSecret using KDF.
+ * Salt is the sha512 hash of the masterSecret.
+ * Number of rounds is hardcoded to 1000.
+ */
+export async function deriveDelegateSecret({
+    masterSecret,
+}: {
+    masterSecret: string;
+}): Promise<string> {
+    const salt = await hash({ s: masterSecret, algorithm: HashAlgorithm.sha_512 });
+    return await kdf_recursiveSaltWrap({
+        masterSecret,
+        salt,
+        rounds: 1000,
+        algorithm: HashAlgorithm.sha_512
+    });
+}

package/src/sync/sync-conflict-adv-multitimelines.withid.respec.mts

@@ -178,7 +178,10 @@ await respecfully(sir, `Multi-round/timeline permutations with Identity`, async
         metaspace,
         domainIbGibs: [r1_alpha_v1_source_common.ibGib],
         conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-        senderIdentity: senderIdentityLatestSource,
+        senderIdentityInfo: {
+            senderIdentity: senderIdentityLatestSource,
+            senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+        },
         fnSenderSecret: async () => SENDER_SECRET,
     });
 
@@ -300,7 +303,10 @@ await respecfully(sir, `Multi-round/timeline permutations with Identity`, async
         metaspace,
         domainIbGibs: [r2_alpha_v3_source_rel8dBeta.ibGib],
         conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-        senderIdentity: senderIdentityLatestSource,
+        senderIdentityInfo: {
+            senderIdentity: senderIdentityLatestSource,
+            senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+        },
         fnSenderSecret: async () => SENDER_SECRET,
     });
     await r2_syncSaga.done;
@@ -449,7 +455,10 @@ await respecfully(sir, `Multi-round/timeline permutations with Identity`, async
         metaspace,
         domainIbGibs: [r3_alpha_v4_source_mut8fieldC.ibGib, r3_beta_v1_source.ibGib],
         conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-        senderIdentity: senderIdentityLatestSource,
+        senderIdentityInfo: {
+            senderIdentity: senderIdentityLatestSource,
+            senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+        },
         fnSenderSecret: async () => SENDER_SECRET,
     });
     await r3_syncSaga.done;
@@ -625,7 +634,10 @@ await respecfully(sir, `Multi-round/timeline permutations with Identity`, async
         metaspace,
         domainIbGibs: [r4_alpha_v7_source.ibGib, r4_gamma_v0_source.ibGib, r4_beta_v2_source.ibGib],
         conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-        senderIdentity: senderIdentityLatestSource,
+        senderIdentityInfo: {
+            senderIdentity: senderIdentityLatestSource,
+            senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+        },
         fnSenderSecret: async () => SENDER_SECRET,
     });
     await r4_syncSaga.done;

package/src/sync/sync-conflict-basic-divergence.withid.respec.mts

@@ -221,7 +221,10 @@ await respecfully(sir, `Sync Conflict Basic Divergence with Identity`, async ()
                 metaspace,
                 domainIbGibs: [v2a],
                 conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-                senderIdentity: r1_senderIdentity_v0_source,
+                senderIdentityInfo: {
+                    senderIdentity: r1_senderIdentity_v0_source,
+                    senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+                },
                 fnSenderSecret: async () => SENDER_SECRET,
             });
             await resSync.done;

package/src/sync/sync-conflict-basic-multitimelines.withid.respec.mts

@@ -254,7 +254,10 @@ await respecfully(sir, `Sync Conflict Basic Multitimelines with Identity`, async
                 metaspace,
                 domainIbGibs: [alpha_v3_source_rel8beta],
                 conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-                senderIdentity: r1_senderIdentity_v0_source,
+                senderIdentityInfo: {
+                    senderIdentity: r1_senderIdentity_v0_source,
+                    senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+                },
                 fnSenderSecret: async () => SENDER_SECRET,
             });
             await resSync.done;

package/src/sync/sync-conflict-text-merge.withid.respec.mts

@@ -150,9 +150,12 @@ await respecfully(sir, `Text merge (LCS) conflict resolution with Identity`, asy
             localSpace: sourceSpace,
             metaspace,
             domainIbGibs: [r1_alpha_v0_source.ibGib],
-            conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-            senderIdentity: senderIdentityLatestSource,
+            senderIdentityInfo: {
+                senderIdentity: senderIdentityLatestSource,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
+            conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
         });
         await r1_syncSaga.done;
         if (logalot) { console.log(`${lc} R1 Sync Complete.`); }
@@ -286,9 +289,12 @@ await respecfully(sir, `Text merge (LCS) conflict resolution with Identity`, asy
             localSpace: sourceSpace,
             metaspace,
             domainIbGibs: [r2_alpha_v1_source_appendedText.ibGib],
-            conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-            senderIdentity: senderIdentityLatestSource,
+            senderIdentityInfo: {
+                senderIdentity: senderIdentityLatestSource,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
+            conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
         });
         await r2_syncSaga.done;
     } catch (e) {

package/src/sync/sync-innerspace-constants.withid.respec.mts

@@ -134,7 +134,10 @@ await respecfully(sir, `Sync Constants (No TJP) with Identity`, async () => {
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_c1_v0_source],
-            senderIdentity: r1_senderIdentity_v0_source,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v0_source,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;
@@ -153,7 +156,10 @@ await respecfully(sir, `Sync Constants (No TJP) with Identity`, async () => {
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_c1_v0_source],
-            senderIdentity: r1_senderIdentity_v1_source_postSync1,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v1_source_postSync1,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;
@@ -183,7 +189,10 @@ await respecfully(sir, `Sync Constants (No TJP) with Identity`, async () => {
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_c2_v0_source_rel8C1],
-            senderIdentity: r1_senderIdentity_v2_source_postSync2,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v2_source_postSync2,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;

package/src/sync/sync-innerspace-deep-updates.withid.respec.mts

@@ -162,7 +162,10 @@ await respecfully(sir, `Sync InnerSpaces (Deep Updates) with Identity`, async ()
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_alpha_v2_source],
-            senderIdentity: r1_senderIdentity_v0_source,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v0_source,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;

package/src/sync/sync-innerspace-dest-ahead.withid.respec.mts

@@ -184,7 +184,10 @@ await respecfully(sir, `Sync InnerSpaces (Dest Ahead) with Identity`, async () =
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_alpha_v1_source],
-            senderIdentity: r1_senderIdentity_v0_source,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v0_source,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;

package/src/sync/sync-innerspace-multiple-timelines.withid.respec.mts

@@ -175,7 +175,10 @@ await respecfully(sir, `Sync InnerSpaces (Multiple Timelines) with Identity`, as
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_alpha_v1_source, r1_beta_v2_source],
-            senderIdentity: r1_senderIdentity_v0_source,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v0_source,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;

package/src/sync/sync-innerspace-partial-update.withid.respec.mts

@@ -163,7 +163,10 @@ await respecfully(sir, `Sync InnerSpaces (Partial Update) with Identity`, async
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_alpha_v2_source],
-            senderIdentity: r1_senderIdentity_v0_source,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v0_source,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;

package/src/sync/sync-innerspace.withid.respec.mts

@@ -152,7 +152,10 @@ await respecfully(sir, `Sync InnerSpaces with Identity`, async () => {
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_alpha_v1_source], // Sync the child
-            senderIdentity,
+            senderIdentityInfo: {
+                senderIdentity,
+                senderDomainAddr: getIbGibAddr({ ibGib: senderIdentity }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
             conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
         });

package/src/sync/sync-peer/sync-peer-types.mts

@@ -89,6 +89,10 @@ export interface InitializeSyncPeerOpts {
      * together or omitted together.
      */
     senderIdentity?: KeystoneIbGib_V1;
+    /**
+     * The root Domain Identity address associated with the senderIdentity delegate.
+     */
+    senderDomainAddr?: string;
     /**
      * Returns the plaintext secret corresponding to {@link senderIdentity}.
      * Wrapped in a function to avoid holding the secret in memory longer than needed.

package/src/sync/sync-peer/sync-peer-v1.mts

@@ -224,13 +224,17 @@ export abstract class SyncPeer_V1<
 
             if (!this.opts) { throw new Error(`(UNEXPECTED) this.opts falsy? Call initializeOpts first. (E: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c526)`); }
 
-            const { senderIdentity, fnSenderSecret, sagaId, localMetaspace, localSpace } = this.opts;
+            const { senderIdentity, fnSenderSecret, senderDomainAddr, sagaId, localMetaspace, localSpace } = this.opts;
 
             // No identity provided — anonymous sync, nothing to establish.
             if (!senderIdentity || !fnSenderSecret) {
                 if (logalot) { console.log(`${lc} no senderIdentity/fnSenderSecret — skipping establish (I: f29348a77d1542326d14043ea4b69126)`); }
                 return undefined;
             }
+
+            if (!senderDomainAddr) {
+                throw new Error(`(UNEXPECTED) senderDomainAddr falsy but senderIdentity/fnSenderSecret truthy? if identity is used, senderDomainAddr must be provided. (E: c288fa8e9d3d82fc)`);
+            }
             const senderIdentityAddr = getIbGibAddr({ ibGib: senderIdentity });
             const senderIdentityTjpAddr = getTjpAddr({ ibGib: senderIdentity });
             if (!senderIdentityTjpAddr) { throw new Error(`(UNEXPECTED) senderIdentityTjpAddr falsy? (E: d5d8c3ab25a83a2c127904fe96de1526)`); }

package/src/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mts

@@ -21,7 +21,8 @@ import { KeystoneStrategyFactory } from '../../../../keystone/strategy/keystone-
 import { KeystoneService_V1 } from '../../../../keystone/keystone-service-v1.mjs';
 import { IbGibSpaceAny } from '../../../../witness/space/space-base-v1.mjs';
 import { MetaspaceService } from '../../../../witness/space/metaspace/metaspace-types.mjs';
-import { POOL_ID_CONNECT, KEYSTONE_VERB_CONNECT } from '../../../../keystone/keystone-constants.mjs';
+import { POOL_ID_CONNECT, KEYSTONE_VERB_CONNECT, KEYSTONE_VERB_SYNC } from '../../../../keystone/keystone-constants.mjs';
+import { getTjpAddr } from '../../../../common/other/ibgib-helper.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT
 
@@ -297,35 +298,77 @@ export async function validateAndRegisterEvolveKeystone({
             throw new Error(`Intrinsic keystone validation failed: ${intrinsicErrors.join(', ')} (E: 38ea984585edc6ee88d2a698c7895826)`);
         }
 
-        // 2. Verify URL :domainAddr matches the keystone's tjp
-        const infoAddr = getGibInfo({ ibGibAddr: addr });
-        const tjpGib = infoAddr.tjpGib ?? infoAddr.punctiliarHash;
-        const infoDomain = getGibInfo({ ibGibAddr: domainAddr });
-        const expectedTjpGib = infoDomain.tjpGib ?? infoDomain.punctiliarHash;
-        if (tjpGib !== expectedTjpGib) {
-            throw new Error(`Keystone tjpGib (${tjpGib}) does not match URL domainAddr tjpGib (${expectedTjpGib})`);
-        }
-
-        // 3. Load previous frame (the current tip in metaspace)
+        // 2. Load the latest root Domain Identity tip in metaspace
         const keystoneService = new KeystoneService_V1();
-        let prevIbGib: KeystoneIbGib_V1;
+        let parentKeystone: KeystoneIbGib_V1;
         try {
-            prevIbGib = await keystoneService.getLatestKeystone({
+            parentKeystone = await keystoneService.getLatestKeystone({
                 addr: domainAddr,
                 metaspace,
                 space
             });
         } catch (error) {
-            throw new Error(`Could not retrieve previous keystone tip for ${domainAddr}: ${extractErrorMsg(error)} (E: b73ed8aeb0d837d248718b487345d326)`);
+            throw new Error(`Could not retrieve root Domain Identity tip for ${domainAddr}: ${extractErrorMsg(error)} (E: b73ed8aeb0d837d248718b487345d326)`);
         }
 
-        // 4. Validate Evolution Transition
-        const validationErrors = await keystoneService.validate({
-            currentIbGib: keystoneIbGib,
-            prevIbGib
-        });
-        if (validationErrors && validationErrors.length > 0) {
-            throw new Error(`Keystone evolution validation failed: ${validationErrors.join(', ')} (E: 5212f8492ac839953842631834bcd826)`);
+        const parentTjpAddr = getTjpAddr({ ibGib: parentKeystone });
+        const incomingTjpAddr = getTjpAddr({ ibGib: keystoneIbGib });
+        if (!incomingTjpAddr) {
+            throw new Error(`Incoming keystone does not have a TJP address (E: d288fae39b7d825d)`);
+        }
+
+        const isDelegate = incomingTjpAddr !== parentTjpAddr;
+        let prevIbGib: KeystoneIbGib_V1 | undefined;
+
+        if (isDelegate) {
+            // Verify that the delegate is registered under the root Domain Identity
+            const delegateInfo = parentKeystone.data?.delegates?.[incomingTjpAddr];
+            if (!delegateInfo) {
+                throw new Error(`Incoming delegate keystone (${incomingTjpAddr}) is not registered under parent Domain Identity (${parentTjpAddr}) (E: c288fae39b7d82fe)`);
+            }
+
+            // Verify that the delegate is authorized for sync
+            const allowedVerbs = delegateInfo.allowedVerbs ?? [];
+            if (!allowedVerbs.includes(KEYSTONE_VERB_SYNC)) {
+                throw new Error(`Incoming delegate keystone is not authorized for sync. Allowed verbs: ${allowedVerbs.join(', ')} (E: a288fae39b7d82ff)`);
+            }
+
+            // Load delegate's latest frame from space (if any)
+            const delegateLatestAddr = await metaspace.getLatestAddr({
+                addr: incomingTjpAddr,
+                space
+            });
+            if (delegateLatestAddr) {
+                const resGet = await metaspace.get({ addr: delegateLatestAddr, space });
+                if (resGet.success && resGet.ibGibs && resGet.ibGibs.length > 0) {
+                    prevIbGib = resGet.ibGibs[0] as KeystoneIbGib_V1;
+                }
+            }
+        } else {
+            // For root Domain Identity evolution, it must transition from the parent keystone tip
+            prevIbGib = parentKeystone;
+        }
+
+        // 3. Validate Evolution Transition or Graph
+        if (prevIbGib) {
+            const validationErrors = await keystoneService.validate({
+                currentIbGib: keystoneIbGib,
+                prevIbGib
+            });
+            if (validationErrors && validationErrors.length > 0) {
+                throw new Error(`Keystone evolution validation failed: ${validationErrors.join(', ')} (E: 5212f8492ac839953842631834bcd826)`);
+            }
+        } else {
+            // Validate delegate's genesis or entire graph if no previous tip exists
+            const validationErrors = await keystoneService.validateKeystoneGraph({
+                keystoneIbGib,
+                getLatest: false,
+                invalidIfMoreRecentKeystoneFoundInSpace: false,
+                space
+            });
+            if (validationErrors && validationErrors.length > 0) {
+                throw new Error(`Keystone graph validation failed: ${validationErrors.join(', ')} (E: 3a288fae39b7d82e)`);
+            }
         }
 
         // 5. Check Single Pool Restriction
@@ -352,8 +395,39 @@ export async function validateAndRegisterEvolveKeystone({
         const { verb } = claim;
         if (!verb) { throw new Error(`claim.verb is falsy (E: 92cf38af58db2cd90e7132b8940fe326)`); }
 
+        if (verb === 'manage') {
+            const prevDelegates = prevIbGib?.data?.delegates ?? {};
+            const currDelegates = keystoneIbGib.data?.delegates ?? {};
+            for (const [delegateTjpAddr, delegateInfo] of Object.entries(currDelegates)) {
+                if (!prevDelegates[delegateTjpAddr]) {
+                    const delegateAddr = delegateInfo.delegateAddr;
+                    const delegateIbGib = relatedIbGibs.find(ibGib => getIbGibAddr({ ibGib }) === delegateAddr);
+                    if (!delegateIbGib) {
+                        throw new Error(`Evolved delegate keystone ${delegateAddr} must be provided in relatedIbGibs (E: 1fe5a68438e288ab4e86c90d81d142826)`);
+                    }
+                    const delegateErrors = await keystoneService.validateGenesisKeystone({ keystoneIbGib: delegateIbGib as any });
+                    if (delegateErrors && delegateErrors.length > 0) {
+                        throw new Error(`Genesis validation failed for delegate keystone ${delegateAddr}: ${delegateErrors.join(', ')} (E: d8afdc1dbed48c000455b35585dc26826)`);
+                    }
+                }
+            }
+
+            await metaspace.put({ ibGibs: [keystoneIbGib, ...relatedIbGibs], space });
+            await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
+            for (const related of relatedIbGibs) {
+                if (related.ib?.startsWith('keystone')) {
+                    await metaspace.registerNewIbGib({ ibGib: related, space });
+                }
+            }
+            return;
+        }
+
         if (verb !== 'sync') {
-            throw new Error(`non-sync keystone evolution not yet implemented (E: eca4681b05486d1f784c0cb815ef9926)`);
+            throw new Error(`non-sync/non-manage keystone evolution not yet implemented (E: eca4681b05486d1f784c0cb815ef9926)`);
+        }
+
+        if (!isDelegate) {
+            throw new Error(`Root Domain Identity (${parentTjpAddr}) is not allowed to sync directly. A delegate must be used. (E: 2c88fae39b7d82fd)`);
         }
 
         const sAddr = claim.target;

package/src/sync/sync-saga-coordinator.mts

@@ -31,6 +31,7 @@ import {
     DomainIbGibAnalysisInfo, NextSagaFrameInfo,
     HandleSagaResponseContextResult,
     SyncSagaFrameDependencyGraph,
+    SyncSenderIdentityInfo,
 } from "./sync-types.mjs";
 import { getSyncSagaFrameOrigin, getFullSyncSagaHistory, getSyncIb, getTempSpaceName, isPastFrame, putInSpace_dnasThenNonDnas, validateFullSyncSagaHistory, getAllOrphanedAddresses, getFinalConflictsInfo, getSyncSagaFrameDependencyGraph } from "./sync-helpers.mjs";
 import { getDeltaDependencyGraph, getDependencyGraph, toFlatGraph } from "../common/other/graph-helper.mjs";
@@ -143,7 +144,7 @@ export class SyncSagaCoordinator {
     public async sync({
         peer,
         domainIbGibs,
-        senderIdentity,
+        senderIdentityInfo,
         fnSenderSecret,
         conflictStrategy = SyncConflictStrategy.abort,
         metaspace,
@@ -161,19 +162,16 @@ export class SyncSagaCoordinator {
          */
         domainIbGibs: IbGib_V1[],
         /**
-         * If present, this is the primary identity of the sender, i.e., who is
-         * initiating the sync.
-         *
-         * This should be the most recent frame (tip) of the senderIdentity's
-         * timeline.
+         * Optional structure containing both the sender's delegate identity (Alice's device key)
+         * and the parent root Domain Identity address (senderDomainAddr).
          *
          * NOTE: {@link fnSenderSecret} must be truthy if this is truthy, and vice versa.
          */
-        senderIdentity?: KeystoneIbGib_V1,
+        senderIdentityInfo?: SyncSenderIdentityInfo,
         /**
-         * secret corresponding to {@link senderIdentity}.
+         * secret corresponding to {@link senderIdentityInfo.senderIdentity}.
          *
-         * NOTE: {@link senderIdentity} must be truthy if this is truthy, and vice versa.
+         * NOTE: {@link senderIdentityInfo} must be truthy if this is truthy, and vice versa.
          */
         fnSenderSecret?: () => Promise<string>;
         /**
@@ -201,11 +199,17 @@ export class SyncSagaCoordinator {
             throw new Error(`${lc} source (or localSpace) required (E: 25df3761f7686a1099a552f83c95d326)`);
         }
 
-        if (senderIdentity || fnSenderSecret) {
-            if (!senderIdentity) { throw new Error(`(UNEXPECTED) senderIdentity falsy but fnSenderSecret truthy? if either is used, both must be truthy. (E: e366628a4919c7d727d2cbd8e5b75e26)`); }
-            if (!fnSenderSecret) { throw new Error(`(UNEXPECTED) fnSenderSecret falsy but senderIdentity truthy? if either is used, both must be truthy. (E: 7d55ce37ae482fec48e3398158161926)`); }
+        if (senderIdentityInfo || fnSenderSecret) {
+            if (!senderIdentityInfo) { throw new Error(`(UNEXPECTED) senderIdentityInfo falsy but fnSenderSecret truthy? if either is used, both must be truthy. (E: e366628a4919c7d727d2cbd8e5b75e26)`); }
+            if (!fnSenderSecret) { throw new Error(`(UNEXPECTED) fnSenderSecret falsy but senderIdentityInfo truthy? if either is used, both must be truthy. (E: 7d55ce37ae482fec48e3398158161926)`); }
+            
+            const { senderIdentity, senderDomainAddr } = senderIdentityInfo;
+            if (!senderIdentity) { throw new Error(`(UNEXPECTED) senderIdentity falsy in senderIdentityInfo? if senderIdentityInfo is provided, both senderIdentity and senderDomainAddr must be truthy. (E: a3c17fae2978926d)`); }
+            if (!senderDomainAddr) { throw new Error(`(UNEXPECTED) senderDomainAddr falsy in senderIdentityInfo? if senderIdentityInfo is provided, both senderIdentity and senderDomainAddr must be truthy. (E: d288fae39b7d825c)`); }
         }
 
+        const { senderIdentity, senderDomainAddr } = senderIdentityInfo ?? {};
+
         // 1. SETUP SAGA METADATA
         const sagaId = await getUUID();
 
@@ -247,6 +251,7 @@ export class SyncSagaCoordinator {
                 peer.setOptionalOpts({
                     sagaId,
                     senderIdentity,
+                    senderDomainAddr,
                     fnSenderSecret,
                     sessionConnectPoolConfig: this.defaultSessionConnectPoolConfig(),
                     sessionSyncPoolConfig: this.defaultSessionSyncPoolConfig(),