@ibgib/core-gib 0.1.63 → 0.1.64

package/dist/keystone/keystone-service-v1.respec.mjs

@@ -1,13 +1,14 @@
-import { respecfully, iReckon, ifWe, firstOfAll, firstOfEach } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+import { respecfully, iReckon, firstOfAll, firstOfEach, ifWeMight } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
 const maam = `[${import.meta.url}]`, sir = maam;
 import { clone, hash, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { GLOBAL_LOG_A_LOT } from '../core-constants.mjs';
 import { KeystoneStrategyFactory } from './strategy/keystone-strategy-factory.mjs';
+import { KeystoneReplenishStrategy, KeystoneClaimType } from './keystone-types.mjs';
 import { createRevocationPoolConfig, createStandardPoolConfig } from './keystone-config-builder.mjs';
-import { POOL_ID_DEFAULT, POOL_ID_REVOKE, KEYSTONE_VERB_REVOKE, KEYSTONE_VERB_MANAGE, POOL_ID_MANAGE, KEYSTONE_VERB_SYNC } from './keystone-constants.mjs';
+import { POOL_ID_DEFAULT, POOL_ID_REVOKE, KEYSTONE_VERB_REVOKE, KEYSTONE_VERB_MANAGE, POOL_ID_MANAGE, KEYSTONE_VERB_SYNC, POOL_ID_CUSTODIAN_MANAGE } from './keystone-constants.mjs';
 import { KeystoneService_V1, } from './keystone-service-v1.mjs';
-import { selectChallengeIds, validateChallengePool, validateKeystoneIb, validateKeystoneTransition, validateGenesisKeystone } from './keystone-helpers.mjs';
+import { selectChallengeIds, validateChallengePool, validateKeystoneIb, validateKeystoneTransition, validateGenesisKeystone, rotatePoolChallenges } from './keystone-helpers.mjs';
 import { KeystoneProfileBuilder } from './policy/keystone-profile-builder.mjs';
 import { getTjpAddr } from '../common/other/ibgib-helper.mjs';
 import { deriveDelegateSecret } from './strategy/hash-reveal-v1/hash-reveal-v1.mjs';
@@ -160,20 +161,20 @@ await respecfully(sir, 'Suite A: Strategy Vectors (HashRevealV1)', async () => {
         });
     });
     await respecfully(sir, 'Derivation Logic', async () => {
-        await ifWe(sir, 'derivePoolSecret with same inputs returns same output', async () => {
+        await ifWeMight(sir, 'derivePoolSecret with same inputs returns same output', async () => {
             const strategy = KeystoneStrategyFactory.create({ config });
             const secretA = await strategy.derivePoolSecret({ masterSecret });
             const secretB = await strategy.derivePoolSecret({ masterSecret });
             iReckon(sir, secretA).asTo('secret consistency').willEqual(secretB);
             iReckon(sir, secretA).asTo('secret length').isGonnaBeTruthy();
         });
-        await ifWe(sir, 'derivePoolSecret with different master secret returns different output', async () => {
+        await ifWeMight(sir, 'derivePoolSecret with different master secret returns different output', async () => {
             const strategy = KeystoneStrategyFactory.create({ config });
             const secretA = await strategy.derivePoolSecret({ masterSecret });
             const secretB = await strategy.derivePoolSecret({ masterSecret: masterSecret + "_diff" });
             iReckon(sir, secretA).asTo('secrets differ').not.willEqual(secretB);
         });
-        await ifWe(sir, 'derivePoolSecret with different salt returns different output', async () => {
+        await ifWeMight(sir, 'derivePoolSecret with different salt returns different output', async () => {
             // Modify salt in a copy of config
             const configB = { ...config, salt: "OtherPool" };
             const strategyA = KeystoneStrategyFactory.create({ config });
@@ -182,7 +183,7 @@ await respecfully(sir, 'Suite A: Strategy Vectors (HashRevealV1)', async () => {
             const secretB = await strategyB.derivePoolSecret({ masterSecret });
             iReckon(sir, secretA).asTo('salt affects secret').not.willEqual(secretB);
         });
-        await ifWe(sir, 'deriveDelegateSecret derives a consistent secret using KDF', async () => {
+        await ifWeMight(sir, 'deriveDelegateSecret derives a consistent secret using KDF', async () => {
             const secretA = await deriveDelegateSecret({ masterSecret });
             const secretB = await deriveDelegateSecret({ masterSecret });
             iReckon(sir, secretA).asTo('consistency').willEqual(secretB);
@@ -192,7 +193,7 @@ await respecfully(sir, 'Suite A: Strategy Vectors (HashRevealV1)', async () => {
         });
     });
     await respecfully(sir, 'Challenge/Solution Logic', async () => {
-        await ifWe(sir, 'generateSolution -> generateChallenge -> validateSolution loop works', async () => {
+        await ifWeMight(sir, 'generateSolution -> generateChallenge -> validateSolution loop works', async () => {
             const strategy = KeystoneStrategyFactory.create({ config });
             const poolSecret = await strategy.derivePoolSecret({ masterSecret });
             const challengeId = "a3ff7843552870fc28bef2b"; // arbitrary random challengeId
@@ -207,7 +208,7 @@ await respecfully(sir, 'Suite A: Strategy Vectors (HashRevealV1)', async () => {
             const isValid = await strategy.validateSolution({ solution, challenge });
             iReckon(sir, isValid).asTo('valid pair should pass').isGonnaBeTrue();
         });
-        await ifWe(sir, 'validateSolution fails for mismatched values', async () => {
+        await ifWeMight(sir, 'validateSolution fails for mismatched values', async () => {
             const strategy = KeystoneStrategyFactory.create({ config });
             const poolSecret = await strategy.derivePoolSecret({ masterSecret });
             const challengeId = "8c994f3ed598f150e25513"; // arbitrary random challengeId
@@ -219,7 +220,7 @@ await respecfully(sir, 'Suite A: Strategy Vectors (HashRevealV1)', async () => {
             const isValid = await strategy.validateSolution({ solution: badSolution, challenge });
             iReckon(sir, isValid).asTo('tampered solution should fail').isGonnaBeFalse();
         });
-        await ifWe(sir, 'validateSolution fails for mismatched challenge hashes', async () => {
+        await ifWeMight(sir, 'validateSolution fails for mismatched challenge hashes', async () => {
             const strategy = KeystoneStrategyFactory.create({ config });
             const poolSecret = await strategy.derivePoolSecret({ masterSecret });
             // Generate pair A
@@ -250,7 +251,7 @@ await respecfully(sir, 'Suite B: Service Lifecycle', async () => {
         mockMetaspace = new MockMetaspaceService(mockSpace);
     });
     await respecfully(sir, 'Genesis', async () => {
-        await ifWe(sir, 'creates a valid genesis frame and persists it', async () => {
+        await ifWeMight(sir, 'creates a valid genesis frame and persists it', async () => {
             const salt = (await getUUID()).substring(0, 16);
             const config = createStandardPoolConfig({
                 id: POOL_ID_DEFAULT,
@@ -276,7 +277,7 @@ await respecfully(sir, 'Suite B: Service Lifecycle', async () => {
         });
     });
     await respecfully(sir, 'Signing (Evolution)', async () => {
-        await ifWe(sir, 'evolves the keystone with a valid proof', async () => {
+        await ifWeMight(sir, 'evolves the keystone with a valid proof', async () => {
             const claim = {
                 target: "comment 123^gib",
                 verb: "post"
@@ -301,7 +302,7 @@ await respecfully(sir, 'Suite B: Service Lifecycle', async () => {
         });
     });
     await respecfully(sir, 'Validation', async () => {
-        await ifWe(sir, 'validates the genesis->signed transition', async () => {
+        await ifWeMight(sir, 'validates the genesis->signed transition', async () => {
             const errors = await service.validate({
                 prevIbGib: genesisKeystone,
                 currentIbGib: signedKeystone,
@@ -342,7 +343,7 @@ await respecfully(sir, 'Suite C: Security Vectors', async () => {
         });
     });
     await respecfully(sir, 'Wrong Secret (Forgery)', async () => {
-        await ifWe(sir, 'prevents creation of forged frames', async () => {
+        await ifWeMight(sir, 'prevents creation of forged frames', async () => {
             const claim = { target: "comment 123^gib", verb: "post" };
             let errorCaught = false;
             let errorMsg = "";
@@ -368,7 +369,7 @@ await respecfully(sir, 'Suite C: Security Vectors', async () => {
         });
     });
     await respecfully(sir, 'Policy Violation (Restricted Verbs)', async () => {
-        await ifWe(sir, 'throws error if signing forbidden verb with restricted pool', async () => {
+        await ifWeMight(sir, 'throws error if signing forbidden verb with restricted pool', async () => {
             // Create a specific restricted pool config manually
             const restrictedPoolId = "read_only_pool";
             const restrictedConfig = createStandardPoolConfig({
@@ -436,7 +437,7 @@ await respecfully(sir, 'Suite D: Revocation', async () => {
     });
     await respecfully(sir, 'Revoke Lifecycle', async () => {
         let revokedKeystone;
-        await ifWe(sir, 'successfully creates a revocation frame', async () => {
+        await ifWeMight(sir, 'successfully creates a revocation frame', async () => {
             revokedKeystone = await service.revoke({
                 latestKeystone: genesisKeystone,
                 masterSecret,
@@ -451,7 +452,7 @@ await respecfully(sir, 'Suite D: Revocation', async () => {
             iReckon(sir, data.revocationInfo.reason).willEqual("Key compromised");
             iReckon(sir, data.revocationInfo.proof.claim.verb).willEqual(KEYSTONE_VERB_REVOKE);
         });
-        await ifWe(sir, 'validates the revocation frame', async () => {
+        await ifWeMight(sir, 'validates the revocation frame', async () => {
             const errors = await service.validate({
                 prevIbGib: genesisKeystone,
                 currentIbGib: revokedKeystone,
@@ -460,7 +461,7 @@ await respecfully(sir, 'Suite D: Revocation', async () => {
             });
             iReckon(sir, errors.length).asTo('no validation errors').willEqual(0);
         });
-        await ifWe(sir, 'consumed the revocation pool (Scorched Earth)', async () => {
+        await ifWeMight(sir, 'consumed the revocation pool (Scorched Earth)', async () => {
             const data = revokedKeystone.data;
             const revokePool = data.challengePools.find(p => p.id === POOL_ID_REVOKE);
             // The pool should exist...
@@ -469,6 +470,42 @@ await respecfully(sir, 'Suite D: Revocation', async () => {
             const remaining = Object.keys(revokePool.challenges);
             iReckon(sir, remaining.length).asTo('pool depleted').willEqual(0);
         });
+        await ifWeMight(sir, 'fails to sign any new claims after revocation', async () => {
+            let errorCaught = false;
+            try {
+                await service.sign({
+                    latestKeystone: revokedKeystone,
+                    masterSecret,
+                    claim: { verb: "post", target: "some_target" },
+                    metaspace: mockMetaspace,
+                    space: mockSpace,
+                });
+            }
+            catch (err) {
+                errorCaught = true;
+                iReckon(sir, err.message).includes("has been revoked");
+            }
+            iReckon(sir, errorCaught).asTo('signing blocked after revocation').isGonnaBeTrue();
+        });
+        await ifWeMight(sir, 'fails to evolve or add pools after revocation', async () => {
+            let errorCaught = false;
+            try {
+                const dummyConfig = createStandardPoolConfig({ id: "dummy", salt: "dummy" });
+                const dummyPool = { id: "dummy", config: dummyConfig, challenges: {} };
+                await service.addPools({
+                    latestKeystone: revokedKeystone,
+                    masterSecret,
+                    newPools: [dummyPool],
+                    metaspace: mockMetaspace,
+                    space: mockSpace,
+                });
+            }
+            catch (err) {
+                errorCaught = true;
+                iReckon(sir, err.message).includes("has been revoked");
+            }
+            iReckon(sir, errorCaught).asTo('adding pools blocked after revocation').isGonnaBeTrue();
+        });
     });
 });
 // ===========================================================================
@@ -522,7 +559,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
         });
     });
     await respecfully(sir, 'Happy Path', async () => {
-        await ifWe(sir, 'authorizes and adds a foreign pool', async () => {
+        await ifWeMight(sir, 'authorizes and adds a foreign pool', async () => {
             const bobPool = await createForeignPool("pool_bob", ["post"]);
             const updatedKeystone = await service.addPools({
                 latestKeystone: aliceKeystone,
@@ -554,7 +591,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
         });
     });
     await respecfully(sir, 'Permissions & Logic', async () => {
-        await ifWe(sir, 'fails if no pool allows "manage" verb', async () => {
+        await ifWeMight(sir, 'fails if no pool allows "manage" verb', async () => {
             // 1. Create a restricted keystone
             let id = "read_only";
             const restrictedConfig = createStandardPoolConfig({ id, salt: id });
@@ -583,7 +620,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
             }
             iReckon(sir, errorCaught).asTo('permission denied').isGonnaBeTrue();
         });
-        await ifWe(sir, 'fails on ID collision', async () => {
+        await ifWeMight(sir, 'fails on ID collision', async () => {
             // Try to add "pool_bob" again (it was added in Happy Path)
             const duplicatePool = await createForeignPool("pool_bob");
             let errorCaught = false;
@@ -658,7 +695,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
         });
     });
     await respecfully(sir, 'Happy Path', async () => {
-        await ifWe(sir, 'authorizes and adds a foreign pool', async () => {
+        await ifWeMight(sir, 'authorizes and adds a foreign pool', async () => {
             const bobPool = await createForeignPool("pool_bob", ["post"]);
             const updatedKeystone = await service.addPools({
                 latestKeystone: aliceKeystone,
@@ -690,7 +727,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
         });
     });
     await respecfully(sir, 'Permissions & Logic', async () => {
-        await ifWe(sir, 'fails if no pool allows "manage" verb', async () => {
+        await ifWeMight(sir, 'fails if no pool allows "manage" verb', async () => {
             // 1. Create a restricted keystone (read-only)
             let id = "read_only";
             const restrictedConfig = createStandardPoolConfig({ id, salt: id });
@@ -719,7 +756,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
             }
             iReckon(sir, errorCaught).asTo('permission denied').isGonnaBeTrue();
         });
-        await ifWe(sir, 'fails on ID collision', async () => {
+        await ifWeMight(sir, 'fails on ID collision', async () => {
             // Try to add "pool_bob" again (it was added in Happy Path)
             const duplicatePool = await createForeignPool("pool_bob");
             let errorCaught = false;
@@ -771,7 +808,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
         });
     });
     await respecfully(sir, 'Proof Granularity & Math', async () => {
-        await ifWe(sir, 'generates exactly the expected number of solutions', async () => {
+        await ifWeMight(sir, 'generates exactly the expected number of solutions', async () => {
             signedKeystone = await service.sign({
                 latestKeystone: genesisKeystone,
                 masterSecret: aliceSecret,
@@ -785,7 +822,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             // 2 Sequential + 2 Random = 4
             iReckon(sir, solutions.length).asTo('solution count').willEqual(4);
         });
-        await ifWe(sir, 'verifies the math manually (White-box Crypto Check)', async () => {
+        await ifWeMight(sir, 'verifies the math manually (White-box Crypto Check)', async () => {
             const proof = signedKeystone.data.proofs[0];
             const poolSnapshot = genesisKeystone.data.challengePools.find(p => p.id === poolId);
             // We iterate every solution in the proof and MANUALLY verify the hash relationship
@@ -808,7 +845,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
                 iReckon(sir, calculatedHash).asTo(`Manual hash verification for ${solution.challengeId}`).willEqual(challenge.hash);
             }
         });
-        await ifWe(sir, 'verifies FIFO logic (Deterministic Selection)', async () => {
+        await ifWeMight(sir, 'verifies FIFO logic (Deterministic Selection)', async () => {
             const proof = signedKeystone.data.proofs[0];
             const poolSnapshot = genesisKeystone.data.challengePools.find(p => p.id === poolId);
             // The first N keys in the pool should be the FIFO targets.
@@ -822,7 +859,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             iReckon(sir, hasFirst).asTo(`Solution includes 1st FIFO ID (${expectedFifoIds[0]})`).isGonnaBeTrue();
             iReckon(sir, hasSecond).asTo(`Solution includes 2nd FIFO ID (${expectedFifoIds[1]})`).isGonnaBeTrue();
         });
-        await ifWe(sir, 'verifies Next-Gen Hash-Based Target Binding Selection', async () => {
+        await ifWeMight(sir, 'verifies Next-Gen Hash-Based Target Binding Selection', async () => {
             const bindingConfig = createStandardPoolConfig({
                 id: "binding_pool",
                 salt: "binding_salt",
@@ -864,7 +901,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
                 iReckon(sir, proofIds.includes(id)).asTo(`proof includes selected ID ${id}`).isGonnaBeTrue();
             }
         });
-        await ifWe(sir, 'fails validation if total requested challenges >= size', async () => {
+        await ifWeMight(sir, 'fails validation if total requested challenges >= size', async () => {
             const invalidConfig = createStandardPoolConfig({
                 id: "invalid_pool",
                 salt: "invalid_salt",
@@ -880,7 +917,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
         });
     });
     await respecfully(sir, 'DTO & Serialization', async () => {
-        await ifWe(sir, 'survives a clone/JSON-cycle without corruption', async () => {
+        await ifWeMight(sir, 'survives a clone/JSON-cycle without corruption', async () => {
             // 1. Create a DTO (simulate network transmission/storage)
             // 'clone' does a JSON stringify/parse under the hood (usually) or structured clone.
             const dto = clone(signedKeystone);
@@ -896,7 +933,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             });
             iReckon(sir, errors.length).asTo('DTO validation errors').willEqual(0);
         });
-        await ifWe(sir, 'ensures data contains no functions or circular refs', async () => {
+        await ifWeMight(sir, 'ensures data contains no functions or circular refs', async () => {
             // A crude but effective test: ensure JSON.stringify doesn't throw
             // and the result is equal to the object (if we parsed it back).
             const jsonStr = JSON.stringify(signedKeystone);
@@ -915,7 +952,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
         });
     });
     await respecfully(sir, 'KeystoneProfileBuilder and Modular Schemas', async () => {
-        await ifWe(sir, 'compiles configs successfully with medium profile', async () => {
+        await ifWeMight(sir, 'compiles configs successfully with medium profile', async () => {
             const builder = KeystoneProfileBuilder.buildKeystone('medium')
                 .withUsername('alice')
                 .withEmail('alice@example.com')
@@ -934,7 +971,17 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             iReckon(sir, details.description).asTo('description').willEqual('Alice test keystone');
             iReckon(sir, details.extraInfo).asTo('extraInfo').willEqual('abc');
         });
-        await ifWe(sir, 'supports customized overrides', async () => {
+        await ifWeMight(sir, 'compiles configs successfully with domain profile (omitting connect)', async () => {
+            const builder = KeystoneProfileBuilder.buildKeystone('domain')
+                .withUsername('alice')
+                .withEmail('alice@example.com')
+                .withDescription('Alice domain keystone');
+            const configs = await builder.compileConfigs();
+            iReckon(sir, configs.length).asTo('number of pools').willEqual(4);
+            const connectPool = configs.find(c => c.id === 'connect');
+            iReckon(sir, connectPool).asTo('connect pool omitted').isGonnaBeUndefined();
+        });
+        await ifWeMight(sir, 'supports customized overrides', async () => {
             const builder = KeystoneProfileBuilder.buildKeystone('test')
                 .customizePool('sync', {
                 behavior: {
@@ -949,7 +996,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
         });
     });
     await respecfully(sir, 'Keystone Metadata Validation', async () => {
-        await ifWe(sir, 'validates correct username and description', async () => {
+        await ifWeMight(sir, 'validates correct username and description', async () => {
             const service = new KeystoneService_V1();
             const space = new MockIbGibSpace();
             const metaspace = new MockMetaspaceService(space);
@@ -970,7 +1017,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             const errors = await service.validateGenesisKeystone({ keystoneIbGib });
             iReckon(sir, errors.length).asTo('errors count').willEqual(0);
         });
-        await ifWe(sir, 'fails validation for invalid username length or character', async () => {
+        await ifWeMight(sir, 'fails validation for invalid username length or character', async () => {
             const service = new KeystoneService_V1();
             const space = new MockIbGibSpace();
             const metaspace = new MockMetaspaceService(space);
@@ -990,7 +1037,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             iReckon(sir, errors.length).asTo('errors count').willEqual(1);
             iReckon(sir, errors[0]).includes('invalid username');
         });
-        await ifWe(sir, 'fails validation for invalid description characters', async () => {
+        await ifWeMight(sir, 'fails validation for invalid description characters', async () => {
             const service = new KeystoneService_V1();
             const space = new MockIbGibSpace();
             const metaspace = new MockMetaspaceService(space);
@@ -1047,7 +1094,7 @@ await respecfully(sir, 'Suite E: Delegation (Register/Unregister)', async () =>
             space: mockSpace,
         });
     });
-    await ifWe(sir, 'registers a delegate keystone and evolves parent using manage pool', async () => {
+    await ifWeMight(sir, 'registers a delegate keystone and evolves parent using manage pool', async () => {
         // Register the delegate
         const evolvedParent = await service.registerDelegate({
             parentKeystone,
@@ -1067,7 +1114,7 @@ await respecfully(sir, 'Suite E: Delegation (Register/Unregister)', async () =>
         iReckon(sir, delegateInfo).asTo('delegate info registered').isGonnaBeTruthy();
         iReckon(sir, delegateInfo?.delegateTjpAddr).asTo('delegate tjp matches').willEqual(delegateTjpAddr);
     });
-    await ifWe(sir, 'gets correct delegate status via parent TJP address', async () => {
+    await ifWeMight(sir, 'gets correct delegate status via parent TJP address', async () => {
         const parentTjpAddr = getTjpAddr({ ibGib: parentKeystone });
         if (!parentTjpAddr) {
             throw new Error(`(UNEXPECTED) parentTjpAddr falsy? (E: b7ce2835ccd951d8c99257328be3b826)`);
@@ -1103,7 +1150,7 @@ await respecfully(sir, 'Suite E: Delegation (Register/Unregister)', async () =>
         iReckon(sir, statusAfter.registered).asTo('registered status').isGonnaBeTrue();
         iReckon(sir, statusAfter.delegateInfo?.delegateTjpAddr).asTo('status tjp matches').willEqual(delegateTjpAddr);
     });
-    await ifWe(sir, 'unregisters a registered delegate keystone', async () => {
+    await ifWeMight(sir, 'unregisters a registered delegate keystone', async () => {
         // Register first
         const evolvedParent = await service.registerDelegate({
             parentKeystone,
@@ -1129,7 +1176,7 @@ await respecfully(sir, 'Suite E: Delegation (Register/Unregister)', async () =>
         const info = finalParent.data?.delegates?.[delegateTjpAddr];
         iReckon(sir, info).asTo('delegate info removed').isGonnaBeUndefined();
     });
-    await ifWe(sir, 'throws if parent does not have a manage pool', async () => {
+    await ifWeMight(sir, 'throws if parent does not have a manage pool', async () => {
         // Create a parent WITHOUT a manage pool
         const salt = (await getUUID()).substring(0, 16);
         const defaultConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt });
@@ -1189,13 +1236,13 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
             space: mockSpace,
         });
     });
-    await ifWe(sir, 'validateKeystoneIb returns true for valid keystone ib and false for others', async () => {
+    await ifWeMight(sir, 'validateKeystoneIb returns true for valid keystone ib and false for others', async () => {
         iReckon(sir, await validateKeystoneIb({ ib: 'keystone' })).isGonnaBeTrue();
         iReckon(sir, await validateKeystoneIb({ ib: 'keystone user info' })).isGonnaBeTrue();
         iReckon(sir, await validateKeystoneIb({ ib: 'invalidAtom' })).isGonnaBeFalse();
         iReckon(sir, await validateKeystoneIb({ ib: 'not_keystone sub_atom' })).isGonnaBeFalse();
     });
-    await ifWe(sir, 'validateGenesisKeystone fails validation if ib is invalid', async () => {
+    await ifWeMight(sir, 'validateGenesisKeystone fails validation if ib is invalid', async () => {
         const invalidGenesis = {
             ...parentKeystone,
             ib: 'not_a_keystone^' + parentKeystone.gib,
@@ -1204,7 +1251,7 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
         iReckon(sir, errors.length > 0).isGonnaBeTrue();
         iReckon(sir, errors[0]).includes('invalid keystone ib');
     });
-    await ifWe(sir, 'validateKeystoneTransition passes for valid delegate registration', async () => {
+    await ifWeMight(sir, 'validateKeystoneTransition passes for valid delegate registration', async () => {
         const evolvedParent = await service.registerDelegate({
             parentKeystone,
             delegateKeystone,
@@ -1219,7 +1266,7 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
         });
         iReckon(sir, errors.length).willEqual(0);
     });
-    await ifWe(sir, 'validateKeystoneTransition fails if delegates map is mutated without manage proof', async () => {
+    await ifWeMight(sir, 'validateKeystoneTransition fails if delegates map is mutated without manage proof', async () => {
         const evolvedParent = await service.registerDelegate({
             parentKeystone,
             delegateKeystone,
@@ -1242,7 +1289,7 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
         iReckon(sir, errors.length > 0).isGonnaBeTrue();
         iReckon(sir, errors.some(e => e.includes('Policy Violation: Delegates map was mutated'))).isGonnaBeTrue();
     });
-    await ifWe(sir, 'validateKeystoneTransition fails if delegate key does not match delegateTjpAddr', async () => {
+    await ifWeMight(sir, 'validateKeystoneTransition fails if delegate key does not match delegateTjpAddr', async () => {
         const evolvedParent = await service.registerDelegate({
             parentKeystone,
             delegateKeystone,
@@ -1266,7 +1313,7 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
         iReckon(sir, errors.length > 0).isGonnaBeTrue();
         iReckon(sir, errors.some(e => e.includes('does not match delegateTjpAddr'))).isGonnaBeTrue();
     });
-    await ifWe(sir, 'validateKeystoneTransition fails if delegate addresses have invalid keystone ib', async () => {
+    await ifWeMight(sir, 'validateKeystoneTransition fails if delegate addresses have invalid keystone ib', async () => {
         const evolvedParent = await service.registerDelegate({
             parentKeystone,
             delegateKeystone,
@@ -1288,7 +1335,7 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
         iReckon(sir, errors.length > 0).isGonnaBeTrue();
         iReckon(sir, errors.some(e => e.includes('not a valid keystone address'))).isGonnaBeTrue();
     });
-    await ifWe(sir, 'validateKeystoneTransition fails if thisAddr is not in the parent timeline history', async () => {
+    await ifWeMight(sir, 'validateKeystoneTransition fails if thisAddr is not in the parent timeline history', async () => {
         const evolvedParent = await service.registerDelegate({
             parentKeystone,
             delegateKeystone,
@@ -1311,4 +1358,384 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
         iReckon(sir, errors.some(e => e.includes('not a valid historical address in the parent keystone timeline'))).isGonnaBeTrue();
     });
 });
+// ===========================================================================
+// SUITE G: COMBINED POOLS & PASSWORD ROTATION
+// ===========================================================================
+await respecfully(sir, 'Suite G: Combined Pools & Password Rotation', async () => {
+    const service = new KeystoneService_V1();
+    const userSecret = "UserMasterSecret_123";
+    const custodianSecret = "CustodianSecret_456";
+    let mockSpace;
+    let mockMetaspace;
+    firstOfEach(sir, async () => {
+        mockSpace = new MockIbGibSpace();
+        mockMetaspace = new MockMetaspaceService(mockSpace);
+    });
+    await ifWeMight(sir, 'revokes a keystone using a separate revocation pool', async () => {
+        const stdSalt = "std_salt";
+        const revokeSalt = "revoke_salt";
+        const stdConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: stdSalt });
+        const revokeConfig = createStandardPoolConfig({ id: POOL_ID_REVOKE, salt: revokeSalt });
+        revokeConfig.allowedVerbs = [KEYSTONE_VERB_REVOKE];
+        revokeConfig.behavior.replenish = KeystoneReplenishStrategy.deleteAll;
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [stdConfig, revokeConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const revoked = await service.revoke({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, revoked.data?.revocationInfo).asTo('revocationInfo present').isGonnaBeTruthy();
+        const revokePool = revoked.data?.challengePools.find(p => p.id === POOL_ID_REVOKE);
+        iReckon(sir, Object.keys(revokePool.challenges).length).asTo('revoke pool depleted').willEqual(0);
+    });
+    await ifWeMight(sir, 'revokes a keystone using a combined manage/revoke pool and empties it', async () => {
+        const salt = "combined_salt";
+        const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt });
+        manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [manageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const revoked = await service.revoke({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, revoked.data?.revocationInfo).asTo('revocationInfo present').isGonnaBeTruthy();
+        const managePool = revoked.data?.challengePools.find(p => p.id === POOL_ID_MANAGE);
+        iReckon(sir, Object.keys(managePool.challenges).length).asTo('combined manage pool depleted').willEqual(0);
+    });
+    await ifWeMight(sir, 'rotates user password successfully when signed by the user manage pool', async () => {
+        const salt = "manage_salt";
+        const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt });
+        manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [manageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const newSecret = "NewUserSecret_999";
+        const rotated = await service.changePassword({
+            latestKeystone: keystone,
+            newMasterSecret: newSecret,
+            signingSecret: userSecret,
+            signingPoolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, rotated).isGonnaBeTruthy();
+        // 1. Try to sign using the new secret (should succeed)
+        const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
+        const signedNew = await service.sign({
+            latestKeystone: rotated,
+            masterSecret: newSecret,
+            claim,
+            poolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, signedNew).isGonnaBeTruthy();
+        // 2. Try to sign using the old secret (should fail)
+        let errorCaught = false;
+        try {
+            await service.sign({
+                latestKeystone: rotated,
+                masterSecret: userSecret,
+                claim,
+                poolId: POOL_ID_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace,
+            });
+        }
+        catch {
+            errorCaught = true;
+        }
+        iReckon(sir, errorCaught).asTo('old secret signing rejected').isGonnaBeTrue();
+    });
+    await ifWeMight(sir, 'recovers user password successfully when signed by the custodian manage pool', async () => {
+        const userSalt = "user_salt";
+        const custodianSalt = "custodian_salt";
+        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
+        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
+        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // We simulate constructing the custodian pool "offline" by the server
+        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+        const challenges = {};
+        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+            const challengeId = raw.substring(0, 16);
+            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+            challenges[challengeId] = await strategy.generateChallenge({ solution });
+        }
+        const custodianPool = {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config: custodianManageConfig,
+            challenges,
+            isForeign: true
+        };
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [userManageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // Add the custodian pool to the keystone
+        const keystoneWithCustodian = await service.addPools({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            newPools: [custodianPool],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // The user forgets their secret. Recover using custodianSecret!
+        const recoveredSecret = "RecoveredUserSecret_777";
+        const recoveredKeystone = await service.changePassword({
+            latestKeystone: keystoneWithCustodian,
+            newMasterSecret: recoveredSecret,
+            signingSecret: custodianSecret,
+            signingPoolId: POOL_ID_CUSTODIAN_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, recoveredKeystone).isGonnaBeTruthy();
+        // Verify we can sign with recovered secret
+        const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
+        const signedNew = await service.sign({
+            latestKeystone: recoveredKeystone,
+            masterSecret: recoveredSecret,
+            claim,
+            poolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, signedNew).isGonnaBeTruthy();
+    });
+    await ifWeMight(sir, 'rotates custodian manage pool successfully', async () => {
+        const userSalt = "user_salt";
+        const custodianSalt = "custodian_salt";
+        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
+        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
+        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // Custodian Pool genesis
+        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+        const challenges = {};
+        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+            const challengeId = raw.substring(0, 16);
+            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+            challenges[challengeId] = await strategy.generateChallenge({ solution });
+        }
+        const custodianPool = {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config: custodianManageConfig,
+            challenges,
+            isForeign: true
+        };
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [userManageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const keystoneWithCustodian = await service.addPools({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            newPools: [custodianPool],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // Rotate custodian credentials to new secret
+        const newCustodianSecret = "NewCustodianSecret_888";
+        const newCustodianConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: "new_custodian_salt" });
+        newCustodianConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const newStrategy = KeystoneStrategyFactory.create({ config: newCustodianConfig });
+        const newPoolSecret = await newStrategy.derivePoolSecret({ masterSecret: newCustodianSecret });
+        const newChallenges = {};
+        for (let i = 0; i < newCustodianConfig.behavior.size; i++) {
+            const raw = await hash({ s: `${newCustodianConfig.salt}${Date.now()}${i}` });
+            const challengeId = raw.substring(0, 16);
+            const solution = await newStrategy.generateSolution({ poolSecret: newPoolSecret, poolId: newCustodianConfig.id, challengeId });
+            newChallenges[challengeId] = await newStrategy.generateChallenge({ solution });
+        }
+        const newCustodianPool = {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config: newCustodianConfig,
+            challenges: newChallenges,
+            isForeign: true
+        };
+        // Rotate signed by user manage pool
+        const rotated = await service.replacePool({
+            latestKeystone: keystoneWithCustodian,
+            newPool: newCustodianPool,
+            signingSecret: userSecret,
+            signingPoolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, rotated).isGonnaBeTruthy();
+        // Verify we can sign with new custodian secret
+        const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
+        const signedNew = await service.sign({
+            latestKeystone: rotated,
+            masterSecret: newCustodianSecret,
+            claim,
+            poolId: POOL_ID_CUSTODIAN_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, signedNew).isGonnaBeTruthy();
+    });
+    await ifWeMight(sir, 'rotates all non-foreign pools during changePassword by default', async () => {
+        const userSalt = "user_salt";
+        const custodianSalt = "custodian_salt";
+        const secondarySalt = "secondary_salt";
+        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
+        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // Another native/non-foreign pool
+        const secondaryNativeConfig = createStandardPoolConfig({ id: "secondary-native", salt: secondarySalt });
+        secondaryNativeConfig.allowedVerbs = [KEYSTONE_VERB_SYNC];
+        // A custodian/foreign pool
+        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
+        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // Custodian Pool genesis
+        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+        const challenges = {};
+        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+            const challengeId = raw.substring(0, 16);
+            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+            challenges[challengeId] = await strategy.generateChallenge({ solution });
+        }
+        const custodianPool = {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config: custodianManageConfig,
+            challenges,
+            isForeign: true
+        };
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [userManageConfig, secondaryNativeConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const keystoneWithCustodian = await service.addPools({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            newPools: [custodianPool],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // Rotate passphrase/password
+        const newPassphrase = "SuperNewSecretPassphrase_999";
+        const rotated = await service.changePassword({
+            latestKeystone: keystoneWithCustodian,
+            newMasterSecret: newPassphrase,
+            signingSecret: userSecret,
+            signingPoolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, rotated).isGonnaBeTruthy();
+        const data = rotated.data;
+        const rotatedManage = data.challengePools.find(p => p.id === POOL_ID_MANAGE);
+        const rotatedSecondary = data.challengePools.find(p => p.id === "secondary-native");
+        const rotatedCustodian = data.challengePools.find(p => p.id === POOL_ID_CUSTODIAN_MANAGE);
+        // Verify native pools rotated (salt changed)
+        iReckon(sir, rotatedManage.config.salt).not.willEqual(userSalt);
+        iReckon(sir, rotatedSecondary.config.salt).not.willEqual(secondarySalt);
+        // Verify foreign pool was not modified (salt identical)
+        iReckon(sir, rotatedCustodian.config.salt).willEqual(custodianSalt);
+        // Verify we can validate transition
+        const errors = await service.validate({
+            prevIbGib: keystoneWithCustodian,
+            currentIbGib: rotated
+        });
+        iReckon(sir, errors.length).willEqual(0);
+    });
+    await ifWeMight(sir, 'fails validation if password rotation details or constraints are violated', async () => {
+        // Construct invalid change-password transition
+        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: "salt1" });
+        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: "salt2" });
+        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // Custodian Pool genesis
+        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+        const challenges = {};
+        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+            const challengeId = raw.substring(0, 16);
+            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+            challenges[challengeId] = await strategy.generateChallenge({ solution });
+        }
+        const custodianPool = {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config: custodianManageConfig,
+            challenges,
+            isForeign: true
+        };
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [userManageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const keystoneWithCustodian = await service.addPools({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            newPools: [custodianPool],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // Create an invalid frame manually where a foreign pool is rotated during change-password
+        const badRotatedPool = await rotatePoolChallenges({
+            prevPool: custodianPool,
+            newMasterSecret: "bad_secret"
+        });
+        const evolved = await service.changePassword({
+            latestKeystone: keystoneWithCustodian,
+            newMasterSecret: "new_pass",
+            signingSecret: userSecret,
+            signingPoolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // Inject the foreign pool rotation manually to simulate an attacker
+        const attackerData = {
+            ...evolved.data,
+            challengePools: evolved.data.challengePools.map(p => p.id === POOL_ID_CUSTODIAN_MANAGE ? badRotatedPool : p)
+        };
+        // Update details claim to say we rotated custodian-manage
+        attackerData.proofs[0].claim.details = {
+            type: KeystoneClaimType.change_password,
+            info: { change: [POOL_ID_MANAGE, POOL_ID_CUSTODIAN_MANAGE] }
+        };
+        const attackerKeystone = {
+            ...evolved,
+            data: attackerData
+        };
+        const errors = await service.validate({
+            prevIbGib: keystoneWithCustodian,
+            currentIbGib: attackerKeystone
+        });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        const hasForeignViolation = errors.some(e => e.includes("Security Violation") && e.includes("foreign pool"));
+        iReckon(sir, hasForeignViolation).isGonnaBeTrue();
+    });
+});
 //# sourceMappingURL=keystone-service-v1.respec.mjs.map