@ibgib/core-gib 0.1.64 → 0.1.65

package/src/keystone/keystone-helpers.mts

@@ -20,6 +20,7 @@ import {
     DelegateKeystoneInfo,
     ClaimDetails,
     ClaimDetails_AddPool,
+    ClaimDetails_RemovePool,
     ClaimDetails_ReplacePool,
     ClaimDetails_ChangePassword
 } from "./keystone-types.mjs";
@@ -468,6 +469,13 @@ export async function solveAndReplenish({
 
         const strategy = KeystoneStrategyFactory.create({ config: pool.config });
         const poolSecret = await strategy.derivePoolSecret({ masterSecret });
+
+        // Verify secret correctness before solving
+        const isSecretCorrect = await verifyPoolSecret({ pool, signingSecret: masterSecret });
+        if (!isSecretCorrect) {
+            throw new Error(`Crypto Violation: Invalid signing secret for pool: ${pool.id} (E: 8a4c2b1d3e5f6a7b8c9d0e1f2a3b4c5f)`);
+        }
+
         const solutions: KeystoneSolution[] = [];
 
         // 1. Solve
@@ -877,6 +885,8 @@ export async function validateKeystoneTransition({
         }
 
         // Claim details verification (transition validation)
+        const signingPoolIds = new Set(currData.proofs.map(p => p.solutions?.[0]?.poolId).filter(Boolean));
+
         for (const proof of currData.proofs) {
             const claim = proof.claim;
             if (claim?.details) {
@@ -918,11 +928,12 @@ export async function validateKeystoneTransition({
                             errors.push(`Existing pool ${prevPool.id} was removed during add-pool transition. (E: 5fa2a8cb28c9b60e68994511a5825)`);
                             continue;
                         }
-                        // Verify configuration and challenges did not change
+                        // Verify configuration did not change
                         if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
                             errors.push(`Existing pool config ${prevPool.id} was mutated during add-pool transition. (E: 6fa2a8cb28c9b60e68994511a5825)`);
                         }
-                        if (JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                        // Verify challenges did not change, unless this was the signing pool used to authorize the transition
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
                             errors.push(`Existing pool challenges ${prevPool.id} were mutated during add-pool transition. (E: 7fa2a8cb28c9b60e68994511a5825)`);
                         }
                     }
@@ -959,10 +970,52 @@ export async function validateKeystoneTransition({
                         if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
                             errors.push(`Unrelated pool config ${prevPool.id} was mutated during replace-pool. (E: bfa2a8cb28c9b60e68994511a5825)`);
                         }
-                        if (JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
                             errors.push(`Unrelated pool challenges ${prevPool.id} were mutated during replace-pool. (E: cfa2a8cb28c9b60e68994511a5825)`);
                         }
                     }
+                } else if (type === 'remove-pool') {
+                    const removeInfo = info as ClaimDetails_RemovePool;
+                    if (!removeInfo || !Array.isArray(removeInfo.remove) || removeInfo.remove.length === 0) {
+                        errors.push(`details type is '${type}' but payload is invalid. (E: b7a2a8cb28c9b60e68994511a5825)`);
+                        continue;
+                    }
+
+                    const removeSet = new Set(removeInfo.remove);
+
+                    // Verify that the set of pool IDs in current equals previous minus the removed pools
+                    const prevIds = new Set(prevData.challengePools.map(p => p.id));
+                    const currIds = new Set(currData.challengePools.map(p => p.id));
+
+                    for (const id of removeInfo.remove) {
+                        if (!prevIds.has(id)) {
+                            errors.push(`ClaimDetails_RemovePool lists pool ${id} but it is missing in the previous keystone. (E: c7a2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (currIds.has(id)) {
+                            errors.push(`ClaimDetails_RemovePool lists pool ${id} but it is still present in the evolved keystone. (E: d7a2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+
+                    // Verify size
+                    if (currData.challengePools.length !== prevData.challengePools.length - removeInfo.remove.length) {
+                        errors.push(`Structural mismatch: expected ${prevData.challengePools.length - removeInfo.remove.length} pools, found ${currData.challengePools.length}. (E: e7a2a8cb28c9b60e68994511a5825)`);
+                    }
+
+                    // Verify all remaining pools are unmodified
+                    for (const prevPool of prevData.challengePools) {
+                        if (removeSet.has(prevPool.id)) continue;
+                        const currPool = currData.challengePools.find(p => p.id === prevPool.id);
+                        if (!currPool) {
+                            errors.push(`Pool ${prevPool.id} was unexpectedly removed. (E: f7a2a8cb28c9b60e68994511a5825)`);
+                            continue;
+                        }
+                        if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
+                            errors.push(`Remaining pool config ${prevPool.id} was mutated during remove-pool. (E: 07a2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                            errors.push(`Remaining pool challenges ${prevPool.id} were mutated during remove-pool. (E: 17a2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
 
                 } else if (type === 'change-password') {
                     const changeInfo = info as ClaimDetails_ChangePassword;
@@ -1004,7 +1057,7 @@ export async function validateKeystoneTransition({
                             if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
                                 errors.push(`Unrelated pool config ${prevPool.id} was mutated during change-password. (E: 02b2a8cb28c9b60e68994511a5825)`);
                             }
-                            if (JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                            if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
                                 errors.push(`Unrelated pool challenges ${prevPool.id} were mutated during change-password. (E: 03b2a8cb28c9b60e68994511a5825)`);
                             }
                         }
@@ -1488,4 +1541,36 @@ export async function rotatePoolChallenges({
         ...(prevPool.isForeign !== undefined ? { isForeign: prevPool.isForeign } : {}),
         ...(prevPool.metadata ? { metadata: prevPool.metadata } : {})
     };
+}
+
+/**
+ * Pure helper to verify if a candidate signing secret (passphrase) is correct for a specific challenge pool.
+ * Does not mutate any state.
+ */
+export async function verifyPoolSecret({
+    pool,
+    signingSecret
+}: {
+    pool: KeystoneChallengePool;
+    signingSecret: string;
+}): Promise<boolean> {
+    const challengeIds = Object.keys(pool.challenges);
+    if (challengeIds.length === 0) return false;
+
+    try {
+        const firstId = challengeIds[0];
+        const challenge = pool.challenges[firstId];
+
+        const strategy = KeystoneStrategyFactory.create({ config: pool.config });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: signingSecret });
+        const solution = await strategy.generateSolution({
+            poolSecret,
+            poolId: pool.id,
+            challengeId: firstId
+        });
+
+        return await strategy.validateSolution({ solution, challenge });
+    } catch {
+        return false;
+    }
 }

package/src/keystone/keystone-service-v1.mts

@@ -8,7 +8,7 @@ import {
     KeystoneData_V1, KeystoneIbGib_V1, KeystonePoolConfig, KeystoneClaim,
     KeystoneChallengePool, KeystoneReplenishStrategy, KeystoneRevocationInfo,
     DelegateKeystoneStatus, KeystoneClaimType,
-    ClaimDetails_AddPool, ClaimDetails_ReplacePool, ClaimDetails_ChangePassword
+    ClaimDetails_AddPool, ClaimDetails_RemovePool, ClaimDetails_ReplacePool, ClaimDetails_ChangePassword
 } from './keystone-types.mjs';
 import { KeystoneStrategyFactory } from './strategy/keystone-strategy-factory.mjs';
 import { createStandardPoolConfig } from './keystone-config-builder.mjs';
@@ -24,7 +24,7 @@ import {
     generateOpaqueChallengeId, resolveTargetPool, selectChallengeIds,
     solveAndReplenish, validateKeystoneTransition,
     validateGenesisKeystone, validateKeystoneGraph,
-    generatePoolChallenges, rotatePoolChallenges
+    generatePoolChallenges, rotatePoolChallenges, verifyPoolSecret
 } from './keystone-helpers.mjs';
 import { getLatestAddrs } from '../witness/space/space-helper.mjs';
 import { IbGibSpaceAny } from '../witness/space/space-base-v1.mjs';
@@ -796,6 +796,128 @@ export class KeystoneService_V1 {
         }
     }
 
+    /**
+     * Structural evolution: Removes challenge pools from the keystone.
+     *
+     * Use Case: Unlinking a custodian or delegate SSO pool.
+     *
+     * Requires the Master Secret to authorize the change via a pool containing
+     * the 'manage' verb (the administrative manage pool).
+     */
+    async removePools({
+        latestKeystone,
+        masterSecret,
+        poolIds,
+        metaspace,
+        space,
+    }: {
+        latestKeystone: KeystoneIbGib_V1;
+        /**
+         * Alice's Master Secret.
+         * Required to solve challenges from the Admin/Manage pool to authorize this change.
+         */
+        masterSecret: string;
+        /**
+         * The IDs of the pools to remove.
+         */
+        poolIds: string[];
+        metaspace: MetaspaceService;
+        space: IbGibSpaceAny;
+    }): Promise<KeystoneIbGib_V1> {
+        const lc = `${this.lc}[${this.removePools.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting...`); }
+
+            if (!latestKeystone.data) { throw new Error(`(UNEXPECTED) latestKeystone.data falsy? (E: 8334c8faed128166a999d428c7805b25)`); }
+            const prevData = latestKeystone.data;
+
+            if (prevData.revocationInfo) { throw new Error(`Keystone has been revoked. Cannot remove pools. (E: 9599f8f51c78d722252ddb2894fdbe25)`); }
+
+            if (poolIds.length === 0) { throw new Error(`No pool IDs provided to remove. (E: 7599f8f51c78d722252ddb2894fdbe25)`); }
+
+            // 1. Identify Authority (Resolve Admin Pool)
+            const adminPool = resolveTargetPool({
+                pools: prevData.challengePools,
+                verb: KEYSTONE_VERB_MANAGE,
+            });
+
+            if (logalot) { console.log(`${lc} Authorized via pool: ${adminPool.id}`); }
+
+            // 2. Construct the Management Claim with typed details
+            const target = getIbGibAddr({ ibGib: latestKeystone });
+            const claim: Partial<KeystoneClaim> = {
+                verb: KEYSTONE_VERB_MANAGE,
+                target,
+                details: {
+                    type: KeystoneClaimType.remove_pool,
+                    info: { remove: poolIds } as ClaimDetails_RemovePool
+                }
+            };
+
+            // 3. Calculate Costs
+            const idsToSolve = await selectChallengeIds({
+                pool: adminPool,
+                targetAddr: target
+            });
+
+            // 4. Pay the Cost (Solve & Replenish)
+            const { proof, nextPools: replenishedExistingPools } = await solveAndReplenish({
+                targetPoolId: adminPool.id,
+                prevPools: prevData.challengePools,
+                masterSecret,
+                challengeIds: idsToSolve,
+                claim,
+            });
+
+            // 5. Mutate Structure (Remove the pools)
+            const removeSet = new Set(poolIds);
+            const finalPools = replenishedExistingPools.filter(p => !removeSet.has(p.id));
+
+            // Verify that we actually removed the expected count of pools
+            if (finalPools.length !== replenishedExistingPools.length - poolIds.length) {
+                const missingIds = poolIds.filter(id => !replenishedExistingPools.some(p => p.id === id));
+                throw new Error(`Cannot remove pool. Pool IDs not found in keystone: ${missingIds.join(', ')} (E: 8a4c2b1d3e5f6a7b8c9d0e1f2a3b4c5e)`);
+            }
+
+            // 6. Construct New Data
+            const n = (prevData.n ?? 0) + 1;
+            let checkpointDetails: any | undefined;
+            if (n % KEYSTONE_CHECKPOINT_FREQUENCY === 0) {
+                const currentFrameView: KeystoneIbGib_V1 = {
+                    ...latestKeystone,
+                    data: { ...prevData, challengePools: finalPools }
+                };
+                checkpointDetails = await this.getAggregateDetails({
+                    latestKeystone: currentFrameView,
+                    metaspace,
+                    space
+                });
+            }
+
+            const newData: KeystoneData_V1 = {
+                challengePools: finalPools,
+                proofs: [proof],
+                checkpointDetails,
+                ...(prevData.delegates ? { delegates: prevData.delegates } : {}),
+            };
+
+            // 7. Commit
+            const newKeystone = await evolvePersistAndRegisterKeystone({
+                prevIbGib: latestKeystone,
+                newData,
+                metaspace,
+                space
+            });
+
+            return newKeystone;
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
+    }
+
     /**
      * Consolidates the state of a Keystone identity across its history.
      * Walks back until it hits a checkpoint or genesis.
@@ -1213,4 +1335,30 @@ export class KeystoneService_V1 {
             throw error;
         }
     }
+
+    /**
+     * Verifies if a candidate signing secret (passphrase) is correct for a specific challenge pool.
+     * Does not mutate any state.
+     */
+    async verifySigningSecret({
+        keystoneIbGib,
+        signingSecret,
+        poolId
+    }: {
+        keystoneIbGib: KeystoneIbGib_V1;
+        signingSecret: string;
+        poolId: string;
+    }): Promise<boolean> {
+        const lc = `${this.lc}[${this.verifySigningSecret.name}]`;
+        try {
+            if (!keystoneIbGib.data) return false;
+            const pool = keystoneIbGib.data.challengePools.find(p => p.id === poolId);
+            if (!pool) return false;
+
+            return await verifyPoolSecret({ pool, signingSecret });
+        } catch (error) {
+            console.warn(`${lc} Exception during verification: ${extractErrorMsg(error)}`);
+            return false;
+        }
+    }
 }

package/src/keystone/keystone-service-v1.respec.mts

@@ -1167,7 +1167,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
                 .withDescription('Alice domain keystone');
 
             const configs = await builder.compileConfigs();
-            iReckon(sir, configs.length).asTo('number of pools').willEqual(4);
+            iReckon(sir, configs.length).asTo('number of pools').willEqual(1);
 
             const connectPool = configs.find(c => c.id === 'connect');
             iReckon(sir, connectPool).asTo('connect pool omitted').isGonnaBeUndefined();
@@ -1964,6 +1964,61 @@ await respecfully(sir, 'Suite G: Combined Pools & Password Rotation', async () =
             currentIbGib: rotated
         });
         iReckon(sir, errors.length).willEqual(0);
+
+        // Verify we can sign using the rotated 'manage' pool with the new passphrase
+        const manageClaim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target_manage" };
+        const signedWithNewManage = await service.sign({
+            latestKeystone: rotated,
+            masterSecret: newPassphrase,
+            claim: manageClaim,
+            poolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+        iReckon(sir, signedWithNewManage).isGonnaBeTruthy();
+
+        // Verify we can sign using the rotated 'secondary-native' pool with the new passphrase
+        const syncClaim = { verb: KEYSTONE_VERB_SYNC, target: "test_target_sync" };
+        const signedWithNewSync = await service.sign({
+            latestKeystone: rotated,
+            masterSecret: newPassphrase,
+            claim: syncClaim,
+            poolId: "secondary-native",
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+        iReckon(sir, signedWithNewSync).isGonnaBeTruthy();
+
+        // Verify signing with the OLD master secret fails on both pools
+        let oldManageFailed = false;
+        try {
+            await service.sign({
+                latestKeystone: rotated,
+                masterSecret: userSecret,
+                claim: manageClaim,
+                poolId: POOL_ID_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+        } catch {
+            oldManageFailed = true;
+        }
+        iReckon(sir, oldManageFailed).isGonnaBeTrue();
+
+        let oldSyncFailed = false;
+        try {
+            await service.sign({
+                latestKeystone: rotated,
+                masterSecret: userSecret,
+                claim: syncClaim,
+                poolId: "secondary-native",
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+        } catch {
+            oldSyncFailed = true;
+        }
+        iReckon(sir, oldSyncFailed).isGonnaBeTrue();
     });
 
     await ifWeMight(sir, 'fails validation if password rotation details or constraints are violated', async () => {
@@ -2046,4 +2101,130 @@ await respecfully(sir, 'Suite G: Combined Pools & Password Rotation', async () =
         const hasForeignViolation = errors.some(e => e.includes("Security Violation") && e.includes("foreign pool"));
         iReckon(sir, hasForeignViolation).isGonnaBeTrue();
     });
+
+    await ifWeMight(sir, 'verifies signing secrets correctly for a pool', async () => {
+        const userSecret = "alice_secret_123";
+        const builder = KeystoneProfileBuilder.buildKeystone('low')
+            .withUsername('alice')
+            .withEmail('alice@example.com')
+            .withDescription('Alice test keystone');
+
+        const configs = await builder.compileConfigs();
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs,
+            frameDetails: builder.getFrameDetails(),
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        // 1. Correct secret on manage pool
+        const isCorrectManage = await service.verifySigningSecret({
+            keystoneIbGib: keystone,
+            signingSecret: userSecret,
+            poolId: POOL_ID_MANAGE
+        });
+        iReckon(sir, isCorrectManage).asTo('correct manage secret').isGonnaBeTrue();
+
+        // 2. Incorrect secret on manage pool
+        const isWrongManage = await service.verifySigningSecret({
+            keystoneIbGib: keystone,
+            signingSecret: "wrong_secret",
+            poolId: POOL_ID_MANAGE
+        });
+        iReckon(sir, isWrongManage).asTo('incorrect manage secret').isGonnaBeFalse();
+
+        // 3. Correct secret on default/sign pool
+        const isCorrectDefault = await service.verifySigningSecret({
+            keystoneIbGib: keystone,
+            signingSecret: userSecret,
+            poolId: 'default'
+        });
+        iReckon(sir, isCorrectDefault).asTo('correct default secret').isGonnaBeTrue();
+
+        // 4. Invalid/non-existent pool ID
+        const isInvalidPool = await service.verifySigningSecret({
+            keystoneIbGib: keystone,
+            signingSecret: userSecret,
+            poolId: 'invalid_pool_id_123'
+        });
+        iReckon(sir, isInvalidPool).asTo('invalid pool id').isGonnaBeFalse();
+    });
+
+    await ifWeMight(sir, 'removes pools successfully, validating transitions and auth', async () => {
+        const userSecret = "alice_secret_123";
+        const customPoolId = "custodian-manage-google";
+        const configs = [
+            createStandardPoolConfig({
+                id: POOL_ID_MANAGE,
+                salt: "manage_salt",
+            }),
+            createStandardPoolConfig({
+                id: customPoolId,
+                salt: "custodian_salt",
+            })
+        ];
+
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        // 1. Success path: remove customPoolId using correct secret
+        const evolvedKeystone = await service.removePools({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            poolIds: [customPoolId],
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        iReckon(sir, evolvedKeystone).asTo('evolved keystone exists').isGonnaBeTruthy();
+        iReckon(sir, evolvedKeystone.data?.challengePools.length).asTo('pool count reduced').willEqual(1);
+        iReckon(sir, evolvedKeystone.data?.challengePools[0].id).asTo('manage pool remains').willEqual(POOL_ID_MANAGE);
+
+        // Verify transition is fully valid
+        const errors = await service.validate({
+            prevIbGib: keystone,
+            currentIbGib: evolvedKeystone
+        });
+        iReckon(sir, errors.length).asTo('transition validation succeeds').willEqual(0);
+
+        // 2. Sad path: invalid master secret
+        let cryptoErrorCaught = false;
+        try {
+            await service.removePools({
+                latestKeystone: keystone,
+                masterSecret: "wrong_secret",
+                poolIds: [customPoolId],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+        } catch (e: any) {
+            if (e.message.includes('Crypto Violation')) {
+                cryptoErrorCaught = true;
+            }
+        }
+        iReckon(sir, cryptoErrorCaught).asTo('forgery check prevents removal').isGonnaBeTrue();
+
+        // 3. Sad path: non-existent pool ID
+        let notFoundErrorCaught = false;
+        try {
+            await service.removePools({
+                latestKeystone: keystone,
+                masterSecret: userSecret,
+                poolIds: ["non-existent-pool"],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+        } catch (e: any) {
+            if (e.message.includes('not found in keystone')) {
+                notFoundErrorCaught = true;
+            }
+        }
+        iReckon(sir, notFoundErrorCaught).asTo('non-existent pool ID rejected').isGonnaBeTrue();
+    });
 });
+

package/src/keystone/keystone-types.mts

@@ -258,17 +258,20 @@ export interface KeystoneChallengePool {
 
 // #region KeystoneClaimType enum
 export const KEYSTONE_CLAIM_TYPE_ADD_POOL = 'add-pool';
+export const KEYSTONE_CLAIM_TYPE_REMOVE_POOL = 'remove-pool';
 export const KEYSTONE_CLAIM_TYPE_REPLACE_POOL = 'replace-pool';
 export const KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD = 'change-password';
 
 export type KeystoneClaimType =
     | typeof KEYSTONE_CLAIM_TYPE_ADD_POOL
+    | typeof KEYSTONE_CLAIM_TYPE_REMOVE_POOL
     | typeof KEYSTONE_CLAIM_TYPE_REPLACE_POOL
     | typeof KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD
     ;
 
 export const KeystoneClaimType = {
     add_pool: KEYSTONE_CLAIM_TYPE_ADD_POOL,
+    remove_pool: KEYSTONE_CLAIM_TYPE_REMOVE_POOL,
     replace_pool: KEYSTONE_CLAIM_TYPE_REPLACE_POOL,
     change_password: KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD,
 } satisfies { readonly [key: string]: KeystoneClaimType };
@@ -289,6 +292,10 @@ export interface ClaimDetails_AddPool {
     add: string[];
 }
 
+export interface ClaimDetails_RemovePool {
+    remove: string[];
+}
+
 export interface ClaimDetails_ReplacePool {
     replace: string;
 }

package/src/keystone/policy/profiles/profile-domain.json

@@ -5,25 +5,11 @@
     "securityLevel": "high"
   },
   "pools": {
-    "sync": {
-      "id": "sync",
-      "allowedVerbs": [
-        "sync"
-      ],
-      "algo": "SHA-512",
-      "rounds": 4,
-      "behavior": {
-        "size": 2000,
-        "replenish": "top-up",
-        "selectSequentially": 10,
-        "selectRandomly": 10,
-        "targetBindingCount": 16
-      }
-    },
     "manage": {
       "id": "manage",
       "allowedVerbs": [
-        "manage"
+        "manage",
+        "revoke"
       ],
       "algo": "SHA-512",
       "rounds": 6,
@@ -34,36 +20,6 @@
         "selectRandomly": 12,
         "targetBindingCount": 16
       }
-    },
-    "revoke": {
-      "id": "revoke",
-      "allowedVerbs": [
-        "revoke"
-      ],
-      "algo": "SHA-512",
-      "rounds": 20,
-      "behavior": {
-        "size": 2000,
-        "replenish": "delete-all",
-        "selectSequentially": 50,
-        "selectRandomly": 50,
-        "targetBindingCount": 0
-      }
-    },
-    "sign": {
-      "id": "default",
-      "allowedVerbs": [
-        "sign"
-      ],
-      "algo": "SHA-512",
-      "rounds": 4,
-      "behavior": {
-        "size": 2000,
-        "replenish": "top-up",
-        "selectSequentially": 10,
-        "selectRandomly": 10,
-        "targetBindingCount": 16
-      }
     }
   }
 }

package/src/keystone/policy/profiles/profile-sync.json

@@ -23,7 +23,8 @@
     "manage": {
       "id": "manage",
       "allowedVerbs": [
-        "manage"
+        "manage",
+        "revoke"
       ],
       "algo": "SHA-256",
       "rounds": 2,
@@ -35,21 +36,6 @@
         "targetBindingCount": 8
       }
     },
-    "revoke": {
-      "id": "revoke",
-      "allowedVerbs": [
-        "revoke"
-      ],
-      "algo": "SHA-256",
-      "rounds": 5,
-      "behavior": {
-        "size": 100,
-        "replenish": "delete-all",
-        "selectSequentially": 3,
-        "selectRandomly": 3,
-        "targetBindingCount": 0
-      }
-    },
     "connect": {
       "id": "connect",
       "allowedVerbs": [