@ibgib/core-gib 0.1.64 → 0.1.66

package/src/keystone/keystone-types.mts

@@ -258,17 +258,20 @@ export interface KeystoneChallengePool {
 
 // #region KeystoneClaimType enum
 export const KEYSTONE_CLAIM_TYPE_ADD_POOL = 'add-pool';
+export const KEYSTONE_CLAIM_TYPE_REMOVE_POOL = 'remove-pool';
 export const KEYSTONE_CLAIM_TYPE_REPLACE_POOL = 'replace-pool';
 export const KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD = 'change-password';
 
 export type KeystoneClaimType =
     | typeof KEYSTONE_CLAIM_TYPE_ADD_POOL
+    | typeof KEYSTONE_CLAIM_TYPE_REMOVE_POOL
     | typeof KEYSTONE_CLAIM_TYPE_REPLACE_POOL
     | typeof KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD
     ;
 
 export const KeystoneClaimType = {
     add_pool: KEYSTONE_CLAIM_TYPE_ADD_POOL,
+    remove_pool: KEYSTONE_CLAIM_TYPE_REMOVE_POOL,
     replace_pool: KEYSTONE_CLAIM_TYPE_REPLACE_POOL,
     change_password: KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD,
 } satisfies { readonly [key: string]: KeystoneClaimType };
@@ -289,6 +292,10 @@ export interface ClaimDetails_AddPool {
     add: string[];
 }
 
+export interface ClaimDetails_RemovePool {
+    remove: string[];
+}
+
 export interface ClaimDetails_ReplacePool {
     replace: string;
 }
@@ -366,12 +373,20 @@ export interface DelegateKeystoneInfo {
      */
     delegateTjpAddr: IbGibAddr;
     /**
-     * concrete addr of **DELEGATE** keystone **at the time when the 
+     * Concrete addr of **DELEGATE** keystone **at the time when the 
      * delegate was added.**
      *
      * So if we have a delegate keystone at D3, then this value would be the
      * addr of that D3 keystone. This will have both a `punctiliarHash` and a
      * `tjpGib` in its `GibInfo`.
+     *
+     * ## intent / architecture (ATOW 07/2026)
+     *
+     * This address captures the registration context of when the delegate was bound.
+     * Delegates are designed to evolve **independently** by design as to *not* require
+     * us to update the parent identity keystone whenever a delegate evolves.
+     * To resolve the active tip of a delegate's timeline, query the space via
+     * `keystoneService.getLatestKeystone({ addr: delegateTjpAddr, metaspace, space })`.
      */
     delegateAddr: IbGibAddr;
     /**

package/src/keystone/policy/profiles/profile-domain.json

@@ -5,25 +5,11 @@
     "securityLevel": "high"
   },
   "pools": {
-    "sync": {
-      "id": "sync",
-      "allowedVerbs": [
-        "sync"
-      ],
-      "algo": "SHA-512",
-      "rounds": 4,
-      "behavior": {
-        "size": 2000,
-        "replenish": "top-up",
-        "selectSequentially": 10,
-        "selectRandomly": 10,
-        "targetBindingCount": 16
-      }
-    },
     "manage": {
       "id": "manage",
       "allowedVerbs": [
-        "manage"
+        "manage",
+        "revoke"
       ],
       "algo": "SHA-512",
       "rounds": 6,
@@ -34,36 +20,6 @@
         "selectRandomly": 12,
         "targetBindingCount": 16
       }
-    },
-    "revoke": {
-      "id": "revoke",
-      "allowedVerbs": [
-        "revoke"
-      ],
-      "algo": "SHA-512",
-      "rounds": 20,
-      "behavior": {
-        "size": 2000,
-        "replenish": "delete-all",
-        "selectSequentially": 50,
-        "selectRandomly": 50,
-        "targetBindingCount": 0
-      }
-    },
-    "sign": {
-      "id": "default",
-      "allowedVerbs": [
-        "sign"
-      ],
-      "algo": "SHA-512",
-      "rounds": 4,
-      "behavior": {
-        "size": 2000,
-        "replenish": "top-up",
-        "selectSequentially": 10,
-        "selectRandomly": 10,
-        "targetBindingCount": 16
-      }
     }
   }
 }

package/src/keystone/policy/profiles/profile-sync.json

@@ -23,7 +23,8 @@
     "manage": {
       "id": "manage",
       "allowedVerbs": [
-        "manage"
+        "manage",
+        "revoke"
       ],
       "algo": "SHA-256",
       "rounds": 2,
@@ -35,21 +36,6 @@
         "targetBindingCount": 8
       }
     },
-    "revoke": {
-      "id": "revoke",
-      "allowedVerbs": [
-        "revoke"
-      ],
-      "algo": "SHA-256",
-      "rounds": 5,
-      "behavior": {
-        "size": 100,
-        "replenish": "delete-all",
-        "selectSequentially": 3,
-        "selectRandomly": 3,
-        "targetBindingCount": 0
-      }
-    },
     "connect": {
       "id": "connect",
       "allowedVerbs": [

package/src/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mts

@@ -7,6 +7,7 @@
 
 import { HashAlgorithm, extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { getIbGibAddr, getIbAndGib } from '@ibgib/ts-gib/dist/helper.mjs';
+import { IbGibAddr } from '@ibgib/ts-gib/dist/types.mjs';
 import { validateIbGibAddr, validateIbGibIntrinsically } from '@ibgib/ts-gib/dist/V1/validate-helper.mjs';
 import { getGibInfo } from '@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs';
 import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
@@ -14,14 +15,16 @@ import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
 import { GLOBAL_LOG_A_LOT } from '../../../../core-constants.mjs';
 import {
     KeystoneReplenishStrategy, KeystoneChallengeType, KeystoneIbGib_V1,
-    KeystoneSolution, KeystoneChallenge
+    KeystoneSolution, KeystoneChallenge,
+    KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD, KEYSTONE_CLAIM_TYPE_ADD_POOL,
+    KEYSTONE_CLAIM_TYPE_REMOVE_POOL, KEYSTONE_CLAIM_TYPE_REPLACE_POOL
 } from '../../../../keystone/keystone-types.mjs';
-import { parseKeystoneIb } from '../../../../keystone/keystone-helpers.mjs';
+import { parseKeystoneIb, validateKeystoneIb } from '../../../../keystone/keystone-helpers.mjs';
 import { KeystoneStrategyFactory } from '../../../../keystone/strategy/keystone-strategy-factory.mjs';
 import { KeystoneService_V1 } from '../../../../keystone/keystone-service-v1.mjs';
 import { IbGibSpaceAny } from '../../../../witness/space/space-base-v1.mjs';
 import { MetaspaceService } from '../../../../witness/space/metaspace/metaspace-types.mjs';
-import { POOL_ID_CONNECT, KEYSTONE_VERB_CONNECT, KEYSTONE_VERB_SYNC } from '../../../../keystone/keystone-constants.mjs';
+import { POOL_ID_CONNECT, KEYSTONE_VERB_CONNECT, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_MANAGE } from '../../../../keystone/keystone-constants.mjs';
 import { getTjpAddr } from '../../../../common/other/ibgib-helper.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT
@@ -270,35 +273,69 @@ export async function validateAndRegisterPostKeystones({
 }
 
 /**
- * Isomorphic pure function to validate a keystone evolution transition and related S session keystones,
- * and persist them to metaspace. Shared across REST API evolve handlers and future socket evolution channels.
+ * Isomorphic pure function to validate a keystone evolution transition and
+ * related S session keystones, and persist them to metaspace. Shared across
+ * REST API evolve handlers and future socket evolution channels.
  */
 export async function validateAndRegisterEvolveKeystone({
     domainAddr,
     keystoneIbGib,
-    relatedIbGibs = [],
+    relatedKeystoneIbGibs = [],
     metaspace,
     space
 }: {
+    /**
+     * Address of the root parent domain identity keystone.
+     */
     domainAddr: string;
+    /**
+     * The main evolved keystone frame being synchronized.
+     */
     keystoneIbGib: KeystoneIbGib_V1;
-    relatedIbGibs?: IbGib_V1[];
+    /**
+     * Array of other keystone frames related to this evolution.
+     * Distinction in intent:
+     * 1. Ephemeral Session Keystones: Temporary keystones generated to verify
+     *    WebSocket connection sessions (under 'sync' claims, targeted via
+     *    claim.target = sAddr).
+     * 2. Persistent Delegate Keystones: Long-lived sub-keystones registered in
+     *    the parent's `delegates` dictionary that are evolved concurrently
+     *    (e.g., during 'manage' password changes).
+     */
+    relatedKeystoneIbGibs?: IbGib_V1[];
+    /**
+     * The MetaspaceService instance.
+     */
     metaspace: MetaspaceService;
+    /**
+     * The active storage space.
+     */
     space: IbGibSpaceAny;
 }): Promise<void> {
     const lc = `[${validateAndRegisterEvolveKeystone.name}]`;
     try {
         if (logalot) { console.log(`${lc} starting... (I: 42b826a690881cd5a8fe520cbdfad826)`); }
 
-        const addr = getIbGibAddr({ ibGib: keystoneIbGib });
-
-        // 1. Intrinsic hash validation
+        // 1. Intrinsic hash validation on primary keystone
         const intrinsicErrors = await validateIbGibIntrinsically({ ibGib: keystoneIbGib });
         if (intrinsicErrors && intrinsicErrors.length > 0) {
             throw new Error(`Intrinsic keystone validation failed: ${intrinsicErrors.join(', ')} (E: 38ea984585edc6ee88d2a698c7895826)`);
         }
 
-        // 2. Load the latest root Domain Identity tip in metaspace
+        // 2. Proofs & Verb extraction
+        const proofs = keystoneIbGib.data?.proofs ?? [];
+        if (proofs.length === 0) {
+            throw new Error('No proofs found in evolved keystone data (E: 399f8f51c78d722252ddb2894fdbe25)');
+        }
+        if (proofs.length !== 1) {
+            throw new Error(`evolving keystone with proofs.length !== 1? (E: 14e058a34964dcd7181395382cc60826)`);
+        }
+        const claim = proofs[0].claim;
+        if (!claim) { throw new Error(`proof.claim is falsy (E: 54be88be2c975ef18e571a4286928826)`); }
+        const verb = claim.verb;
+        if (!verb) { throw new Error(`claim.verb is falsy (E: 92cf38af58db2cd90e7132b8940fe326)`); }
+
+        // 3. Load latest root Domain Identity tip in space
         const keystoneService = new KeystoneService_V1();
         let parentKeystone: KeystoneIbGib_V1;
         try {
@@ -318,147 +355,273 @@ export async function validateAndRegisterEvolveKeystone({
         }
 
         const isDelegate = incomingTjpAddr !== parentTjpAddr;
-        let prevIbGib: KeystoneIbGib_V1 | undefined;
-
-        if (isDelegate) {
-            // Verify that the delegate is registered under the root Domain Identity
-            const delegateInfo = parentKeystone.data?.delegates?.[incomingTjpAddr];
-            if (!delegateInfo) {
-                throw new Error(`Incoming delegate keystone (${incomingTjpAddr}) is not registered under parent Domain Identity (${parentTjpAddr}) (E: c288fae39b7d82fe)`);
-            }
 
-            // Verify that the delegate is authorized for sync
-            const allowedVerbs = delegateInfo.allowedVerbs ?? [];
-            if (!allowedVerbs.includes(KEYSTONE_VERB_SYNC)) {
-                throw new Error(`Incoming delegate keystone is not authorized for sync. Allowed verbs: ${allowedVerbs.join(', ')} (E: a288fae39b7d82ff)`);
-            }
+        // 4. Primary Verb Branching
+        switch (verb) {
+            case KEYSTONE_VERB_MANAGE:
+                await validateManageEvolveKeystone({
+                    keystoneIbGib,
+                    relatedKeystoneIbGibs,
+                    parentKeystone,
+                    isDelegate,
+                    domainAddr,
+                    metaspace,
+                    space
+                });
+                break;
+
+            case KEYSTONE_VERB_SYNC:
+                await validateSyncEvolveKeystone({
+                    keystoneIbGib,
+                    relatedKeystoneIbGibs,
+                    parentKeystone,
+                    isDelegate,
+                    domainAddr,
+                    metaspace,
+                    space
+                });
+                break;
 
-            // Load delegate's latest frame from space (if any)
-            const delegateLatestAddr = await metaspace.getLatestAddr({
-                addr: incomingTjpAddr,
-                space
-            });
-            if (delegateLatestAddr) {
-                const resGet = await metaspace.get({ addr: delegateLatestAddr, space });
-                if (resGet.success && resGet.ibGibs && resGet.ibGibs.length > 0) {
-                    prevIbGib = resGet.ibGibs[0] as KeystoneIbGib_V1;
-                }
-            }
-        } else {
-            // For root Domain Identity evolution, it must transition from the parent keystone tip
-            prevIbGib = parentKeystone;
+            default:
+                throw new Error(`Unsupported keystone evolution verb: ${verb} (E: eca4681b05486d1f784c0cb815ef9926)`);
         }
 
-        // 3. Validate Evolution Transition or Graph
-        if (prevIbGib) {
-            const validationErrors = await keystoneService.validate({
-                currentIbGib: keystoneIbGib,
-                prevIbGib
-            });
-            if (validationErrors && validationErrors.length > 0) {
-                throw new Error(`Keystone evolution validation failed: ${validationErrors.join(', ')} (E: 5212f8492ac839953842631834bcd826)`);
-            }
-        } else {
-            // Validate delegate's genesis or entire graph if no previous tip exists
-            const validationErrors = await keystoneService.validateKeystoneGraph({
-                keystoneIbGib,
-                getLatest: false,
-                invalidIfMoreRecentKeystoneFoundInSpace: false,
-                space
-            });
-            if (validationErrors && validationErrors.length > 0) {
-                throw new Error(`Keystone graph validation failed: ${validationErrors.join(', ')} (E: 3a288fae39b7d82e)`);
-            }
-        }
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    } finally {
+        if (logalot) { console.log(`${lc} complete.`); }
+    }
+}
 
-        // 5. Check Single Pool Restriction
-        const proofs = keystoneIbGib.data?.proofs ?? [];
-        if (proofs.length === 0) {
-            throw new Error('No proofs found in evolved keystone data');
-        }
-        const poolIds = new Set<string>();
-        for (const proof of proofs) {
-            for (const solution of proof.solutions || []) {
-                if (solution.poolId) {
-                    poolIds.add(solution.poolId);
+/**
+ * Validates and registers a keystone evolution authorized by a 'manage' verb claim.
+ *
+ * ## Assumptions (ATOW 07/2026)
+ * - The primary Domain Identity evolution step is authorized by a single proof.
+ * - Sub-verb details (`claim.details?.type`) specify the structural management operation
+ *   (e.g. 'change-password', 'add-pool', 'remove-pool').
+ * - Under 'change-password', relatedKeystoneIbGibs contains outward delegate keystones being
+ *   registered or evolved concurrently.
+ * - Delegates evolve independently by design, so `delegateInfo.delegateAddr` in the parent keystone
+ *   captures historical registration context. Active delegate tip resolution queries the space via
+ *   `keystoneService.getLatestKeystone({ addr: delegateTjpAddr, metaspace, space })`.
+ */
+async function validateManageEvolveKeystone({
+    keystoneIbGib,
+    relatedKeystoneIbGibs,
+    parentKeystone,
+    isDelegate,
+    domainAddr,
+    metaspace,
+    space,
+}: {
+    keystoneIbGib: KeystoneIbGib_V1;
+    relatedKeystoneIbGibs: IbGib_V1[];
+    parentKeystone: KeystoneIbGib_V1;
+    isDelegate: boolean;
+    domainAddr: IbGibAddr;
+    metaspace: MetaspaceService;
+    space: IbGibSpaceAny;
+}): Promise<void> {
+    const lc = `[validateManageEvolveKeystone]`;
+    const keystoneService = new KeystoneService_V1();
+
+    // 1. Validate parent Domain Identity keystone transition from current tip in space
+    const transitionErrors = await keystoneService.validate({
+        currentIbGib: keystoneIbGib,
+        prevIbGib: parentKeystone
+    });
+    if (transitionErrors && transitionErrors.length > 0) {
+        throw new Error(`Parent Domain Identity evolution validation failed: ${transitionErrors.join(', ')} (E: 5212f8492ac839953842631834bcd826)`);
+    }
+
+    const proof = keystoneIbGib.data?.proofs?.[0];
+    const claim = proof?.claim;
+    const claimType = claim?.details?.type;
+
+    const prevDelegates = parentKeystone.data?.delegates ?? {};
+    const currDelegates = keystoneIbGib.data?.delegates ?? {};
+
+    // 2. Sub-verb branching based on claim details type
+    switch (claimType) {
+        case KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD:
+        case KEYSTONE_CLAIM_TYPE_ADD_POOL:
+        case KEYSTONE_CLAIM_TYPE_REMOVE_POOL:
+        case KEYSTONE_CLAIM_TYPE_REPLACE_POOL:
+        default:
+            // Validate all related delegate keystones provided in cargo
+            for (const related of relatedKeystoneIbGibs) {
+                const ibIsValid = await validateKeystoneIb({ ib: related.ib });
+                if (!ibIsValid) {
+                    throw new Error(`Invalid related keystone ibgib. related.ib (${related.ib}) is not a valid keystone ib. (E: 89dff2f48fa8c33b449081e2478c6826)`);
                 }
-            }
-        }
-        if (poolIds.size > 1) {
-            throw new Error(`Multiple pools evolved (${Array.from(poolIds).join(', ')}). Only one pool evolution allowed at a time. (E: 4a9b28ae33e8e3eb4ddbad981aa7b126)`);
-        }
 
-        // 6. Check that the verb is 'sync'
-        if (proofs.length !== 1) { throw new Error(`evolving keystone with proofs.length !== 1? (E: 14e058a34964dcd7181395382cc60826)`); }
-        const claim = proofs[0].claim;
-        if (!claim) { throw new Error(`proof.claim is falsy (E: 54be88be2c975ef18e571a4286928826)`); }
-        const { verb } = claim;
-        if (!verb) { throw new Error(`claim.verb is falsy (E: 92cf38af58db2cd90e7132b8940fe326)`); }
+                const relatedTjp = getTjpAddr({ ibGib: related });
+                if (!relatedTjp) {
+                    throw new Error(`Related keystone in relatedKeystoneIbGibs is missing a TJP address (E: 2fe5a68438e288ab4e86c90d81d142826)`);
+                }
+                const relatedAddr = getIbGibAddr({ ibGib: related });
+
+                // Assert it is registered under the current delegates map of the parent
+                const delegateInfo = currDelegates[relatedTjp];
+                if (!delegateInfo) {
+                    throw new Error(`Related keystone (${relatedTjp}) is not a registered delegate under parent Domain Identity (E: 3fe5a68438e288ab4e86c90d81d142826)`);
+                }
 
-        if (verb === 'manage') {
-            const prevDelegates = prevIbGib?.data?.delegates ?? {};
-            const currDelegates = keystoneIbGib.data?.delegates ?? {};
-            for (const [delegateTjpAddr, delegateInfo] of Object.entries(currDelegates)) {
-                if (!prevDelegates[delegateTjpAddr]) {
-                    const delegateAddr = delegateInfo.delegateAddr;
-                    const delegateIbGib = relatedIbGibs.find(ibGib => getIbGibAddr({ ibGib }) === delegateAddr);
-                    if (!delegateIbGib) {
-                        throw new Error(`Evolved delegate keystone ${delegateAddr} must be provided in relatedIbGibs (E: 1fe5a68438e288ab4e86c90d81d142826)`);
+                const delegateIsNewlyRegistered = !prevDelegates[relatedTjp];
+                if (delegateIsNewlyRegistered) {
+                    const delegateKeystone = related as KeystoneIbGib_V1;
+                    if (delegateKeystone.data?.n !== 0) {
+                        throw new Error(`Newly registered delegate keystone (${relatedAddr}) has data.n !== 0 (${delegateKeystone.data?.n}). Registering non-genesis delegate keystones is not supported at this time. (E: 4cdd0dee42d7d437ef6af698150cfe26)`);
                     }
-                    const delegateErrors = await keystoneService.validateGenesisKeystone({ keystoneIbGib: delegateIbGib as any });
-                    if (delegateErrors && delegateErrors.length > 0) {
-                        throw new Error(`Genesis validation failed for delegate keystone ${delegateAddr}: ${delegateErrors.join(', ')} (E: d8afdc1dbed48c000455b35585dc26826)`);
+                    const genesisErrors = await keystoneService.validateGenesisKeystone({
+                        keystoneIbGib: delegateKeystone
+                    });
+                    if (genesisErrors && genesisErrors.length > 0) {
+                        throw new Error(`Genesis validation failed for new delegate keystone ${relatedAddr}: ${genesisErrors.join(', ')} (E: d8afdc1dbed48c000455b35585dc26826)`);
+                    }
+                } else {
+                    // Transition/Evolution validation against the delegate's active tip in space
+                    let prevDelegateTip: KeystoneIbGib_V1 | undefined;
+                    try {
+                        prevDelegateTip = await keystoneService.getLatestKeystone({
+                            addr: relatedTjp,
+                            metaspace,
+                            space
+                        });
+                    } catch (err) {
+                        throw new Error(`Could not find previous delegate tip for ${relatedTjp} in space: ${extractErrorMsg(err)} (E: 5fe5a68438e288ab4e86c90d81d142826)`);
                     }
-                }
-            }
 
-            await metaspace.put({ ibGibs: [keystoneIbGib, ...relatedIbGibs], space });
-            await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
-            for (const related of relatedIbGibs) {
-                if (related.ib?.startsWith('keystone')) {
-                    await metaspace.registerNewIbGib({ ibGib: related, space });
+                    const evolutionErrors = await keystoneService.validate({
+                        currentIbGib: related as KeystoneIbGib_V1,
+                        prevIbGib: prevDelegateTip
+                    });
+                    if (evolutionErrors && evolutionErrors.length > 0) {
+                        throw new Error(`Evolution transition validation failed for delegate keystone ${relatedAddr}: ${evolutionErrors.join(', ')} (E: 6fe5a68438e288ab4e86c90d81d142826)`);
+                    }
                 }
             }
-            return;
-        }
+            break;
+    }
 
-        if (verb !== 'sync') {
-            throw new Error(`non-sync/non-manage keystone evolution not yet implemented (E: eca4681b05486d1f784c0cb815ef9926)`);
+    // Persist parent and related keystones
+    await metaspace.put({ ibGibs: [keystoneIbGib, ...relatedKeystoneIbGibs], space });
+    await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
+    for (const related of relatedKeystoneIbGibs) {
+        if (related.ib?.startsWith('keystone')) {
+            await metaspace.registerNewIbGib({ ibGib: related, space });
         }
+    }
+}
 
-        if (!isDelegate) {
-            throw new Error(`Root Domain Identity (${parentTjpAddr}) is not allowed to sync directly. A delegate must be used. (E: 2c88fae39b7d82fd)`);
-        }
+/**
+ * Validates and registers a sync delegate keystone evolution and its associated session keystone.
+ *
+ * ## Assumptions (ATOW 07/2026)
+ * - The evolving keystone must be an authorized outward delegate (Root Domain Identity cannot sync directly).
+ * - The claim verb is 'sync'.
+ * - relatedKeystoneIbGibs contains the newly created session keystone (S^Stjp) target address specified in claim.target.
+ */
+async function validateSyncEvolveKeystone({
+    keystoneIbGib,
+    relatedKeystoneIbGibs,
+    parentKeystone,
+    isDelegate,
+    domainAddr,
+    metaspace,
+    space,
+}: {
+    keystoneIbGib: KeystoneIbGib_V1;
+    relatedKeystoneIbGibs: IbGib_V1[];
+    parentKeystone: KeystoneIbGib_V1;
+    isDelegate: boolean;
+    domainAddr: IbGibAddr;
+    metaspace: MetaspaceService;
+    space: IbGibSpaceAny;
+}): Promise<void> {
+    const lc = `[validateSyncEvolveKeystone]`;
+    const keystoneService = new KeystoneService_V1();
 
-        const sAddr = claim.target;
-        if (!sAddr) {
-            throw new Error('No target address found in sync claim');
-        }
+    if (!isDelegate) {
+        throw new Error(`Root Domain Identity (${domainAddr}) is not allowed to sync directly. A delegate must be used. (E: 2c88fae39b7d82fd)`);
+    }
 
-        // Validate S^Stjp (session keystone ibgib) from relatedIbGibs
-        const sIbGib = relatedIbGibs.find(ibGib => getIbGibAddr({ ibGib }) === sAddr) as KeystoneIbGib_V1 | undefined;
-        if (!sIbGib) {
-            throw new Error(`Session keystone ${sAddr} must be provided in relatedIbGibs (E: fe5a68438e288ab4e86c90d81d142826)`);
-        }
+    const incomingTjpAddr = getTjpAddr({ ibGib: keystoneIbGib });
+    if (!incomingTjpAddr) {
+        throw new Error(`Incoming delegate keystone missing TJP address (E: d288fae39b7d825e)`);
+    }
 
-        const sIntrinsicErrors = await validateIbGibIntrinsically({ ibGib: sIbGib });
-        if (sIntrinsicErrors && sIntrinsicErrors.length > 0) {
-            throw new Error(`Intrinsic validation failed for S^Stjp: ${sIntrinsicErrors.join(', ')} (E: 802d8350c3cccbd7184dd43866c05526)`);
-        }
+    // Verify delegate is registered under root Domain Identity
+    const delegateInfo = parentKeystone.data?.delegates?.[incomingTjpAddr];
+    if (!delegateInfo) {
+        throw new Error(`Incoming delegate keystone (${incomingTjpAddr}) is not registered under parent Domain Identity (E: c288fae39b7d82fe)`);
+    }
+
+    // Verify delegate is authorized for sync
+    const allowedVerbs = delegateInfo.allowedVerbs ?? [];
+    if (!allowedVerbs.includes(KEYSTONE_VERB_SYNC)) {
+        throw new Error(`Incoming delegate keystone is not authorized for sync. Allowed verbs: ${allowedVerbs.join(', ')} (E: a288fae39b7d82ff)`);
+    }
+
+    // Load delegate's previous tip from space using keystoneService.getLatestKeystone if it exists
+    let prevDelegateTip: KeystoneIbGib_V1 | undefined;
+    try {
+        prevDelegateTip = await keystoneService.getLatestKeystone({
+            addr: incomingTjpAddr,
+            metaspace,
+            space
+        });
+    } catch (err) {
+        // No previous tip found in space yet; will validate graph below
+    }
 
-        const sGenesisErrors = await keystoneService.validateGenesisKeystone({ keystoneIbGib: sIbGib });
-        if (sGenesisErrors && sGenesisErrors.length > 0) {
-            throw new Error(`Genesis validation failed for S^Stjp: ${sGenesisErrors.join(', ')} (E: 8afdc1dbed48c000455b35585dc26826)`);
+    if (prevDelegateTip) {
+        const validationErrors = await keystoneService.validate({
+            currentIbGib: keystoneIbGib,
+            prevIbGib: prevDelegateTip
+        });
+        if (validationErrors && validationErrors.length > 0) {
+            throw new Error(`Delegate keystone evolution validation failed: ${validationErrors.join(', ')} (E: 5212f8492ac839953842631834bcd827)`);
+        }
+    } else {
+        const validationErrors = await keystoneService.validateKeystoneGraph({
+            keystoneIbGib,
+            getLatest: false,
+            invalidIfMoreRecentKeystoneFoundInSpace: false,
+            space
+        });
+        if (validationErrors && validationErrors.length > 0) {
+            throw new Error(`Delegate keystone graph validation failed: ${validationErrors.join(', ')} (E: 3a288fae39b7d82f)`);
         }
+    }
 
-        // Persist and Register both I and S
-        await metaspace.put({ ibGibs: [keystoneIbGib, sIbGib], space });
-        await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
-        await metaspace.registerNewIbGib({ ibGib: sIbGib, space });
-    } catch (error) {
-        console.error(`${lc} ${extractErrorMsg(error)}`);
-        throw error;
-    } finally {
-        if (logalot) { console.log(`${lc} complete.`); }
+    const proof = keystoneIbGib.data?.proofs?.[0];
+    const claim = proof?.claim;
+    const sAddr = claim?.target;
+    if (!sAddr) {
+        throw new Error('No target address found in sync claim');
     }
+
+    // Validate S^Stjp (session keystone ibgib) from relatedKeystoneIbGibs
+    const sIbGib = relatedKeystoneIbGibs.find(ibGib => getIbGibAddr({ ibGib }) === sAddr) as KeystoneIbGib_V1 | undefined;
+    if (!sIbGib) {
+        throw new Error(`Session keystone ${sAddr} must be provided in relatedKeystoneIbGibs (E: fe5a68438e288ab4e86c90d81d142826)`);
+    }
+
+    const sIntrinsicErrors = await validateIbGibIntrinsically({ ibGib: sIbGib });
+    if (sIntrinsicErrors && sIntrinsicErrors.length > 0) {
+        throw new Error(`Intrinsic validation failed for S^Stjp: ${sIntrinsicErrors.join(', ')} (E: 802d8350c3cccbd7184dd43866c05526)`);
+    }
+
+    const sGenesisErrors = await keystoneService.validateGenesisKeystone({ keystoneIbGib: sIbGib });
+    if (sGenesisErrors && sGenesisErrors.length > 0) {
+        throw new Error(`Genesis validation failed for S^Stjp: ${sGenesisErrors.join(', ')} (E: 8afdc1dbed48c000455b35585dc26826)`);
+    }
+
+    // Persist and Register both I and S
+    await metaspace.put({ ibGibs: [keystoneIbGib, sIbGib], space });
+    await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
+    await metaspace.registerNewIbGib({ ibGib: sIbGib, space });
 }

package/src/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-sender/sync-peer-websocket-sender-v1.mts

@@ -105,7 +105,7 @@ export class SyncPeerWebSocketSender_V1
                 },
                 body: JSON.stringify({
                     keystoneIbGib: newSenderIdentity,
-                    relatedIbGibs: [sessionIdentity]
+                    relatedKeystoneIbGibs: [sessionIdentity]
                 }),
             });