@ibgib/core-gib 0.1.65 → 0.1.66

package/src/keystone/keystone-service-v1.respec.mts

@@ -2,7 +2,7 @@ import {
     respecfully, iReckon, ifWe, firstOfAll, firstOfEach, lastOfAll, lastOfEach, respecfullyDear, ifWeMight
 } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
 const maam = `[${import.meta.url}]`, sir = maam;
-import { clone, hash, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { clone, hash, getUUID, extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
 import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 
@@ -158,6 +158,33 @@ class MockMetaspaceService {
         const addr = getIbGibAddr({ ibGib });
         this.timelineHeads.set(tjpGib, addr);
     }
+
+    /**
+     * Resolves the latest address for a timeline.
+     */
+    async getLatestAddr({ addr, tjpAddr, space }: { addr?: string, tjpAddr?: string, space?: any }): Promise<string | undefined> {
+        const targetAddr = tjpAddr || addr;
+        if (!targetAddr) return undefined;
+        const targetSpace = space || this.space;
+        const gib = targetAddr.split('^')[1] || '';
+        let tjpGib = gib.includes('.') ? gib.split('.').slice(1).join('.') : gib;
+        if (this.timelineHeads.has(tjpGib)) {
+            return this.timelineHeads.get(tjpGib);
+        }
+        if (targetSpace && typeof targetSpace.witness === 'function') {
+            const res = await targetSpace.witness({
+                data: {
+                    cmd: 'get',
+                    cmdModifiers: ['latest', 'addrs'],
+                    ibGibAddrs: [targetAddr]
+                }
+            });
+            if (res?.data?.success && res?.data?.latestAddrsMap?.[targetAddr]) {
+                return res.data.latestAddrsMap[targetAddr];
+            }
+        }
+        return targetAddr;
+    }
 }
 
 // ===========================================================================
@@ -1625,606 +1652,814 @@ await respecfully(sir, 'Suite G: Combined Pools & Password Rotation', async () =
     });
 
     await ifWeMight(sir, 'revokes a keystone using a separate revocation pool', async () => {
-        const stdSalt = "std_salt";
-        const revokeSalt = "revoke_salt";
-        const stdConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: stdSalt });
-        const revokeConfig = createStandardPoolConfig({ id: POOL_ID_REVOKE, salt: revokeSalt });
-        revokeConfig.allowedVerbs = [KEYSTONE_VERB_REVOKE];
-        revokeConfig.behavior.replenish = KeystoneReplenishStrategy.deleteAll;
-
-        const keystone = await service.genesis({
-            masterSecret: userSecret,
-            configs: [stdConfig, revokeConfig],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+        const lc = `[revokes a keystone using a separate revocation pool]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 8efbb3af6a483aa4c1205118bd481926)`); }
 
-        const revoked = await service.revoke({
-            latestKeystone: keystone,
-            masterSecret: userSecret,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+            const stdSalt = "std_salt";
+            const revokeSalt = "revoke_salt";
+            const stdConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: stdSalt });
+            const revokeConfig = createStandardPoolConfig({ id: POOL_ID_REVOKE, salt: revokeSalt });
+            revokeConfig.allowedVerbs = [KEYSTONE_VERB_REVOKE];
+            revokeConfig.behavior.replenish = KeystoneReplenishStrategy.deleteAll;
 
-        iReckon(sir, revoked.data?.revocationInfo).asTo('revocationInfo present').isGonnaBeTruthy();
-        const revokePool = revoked.data?.challengePools.find(p => p.id === POOL_ID_REVOKE)!;
-        iReckon(sir, Object.keys(revokePool.challenges).length).asTo('revoke pool depleted').willEqual(0);
+            const keystone = await service.genesis({
+                masterSecret: userSecret,
+                configs: [stdConfig, revokeConfig],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            const revoked = await service.revoke({
+                latestKeystone: keystone,
+                masterSecret: userSecret,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            iReckon(sir, revoked.data?.revocationInfo).asTo('revocationInfo present').isGonnaBeTruthy();
+            const revokePool = revoked.data?.challengePools.find(p => p.id === POOL_ID_REVOKE)!;
+            iReckon(sir, Object.keys(revokePool.challenges).length).asTo('revoke pool depleted').willEqual(0);
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
     });
 
     await ifWeMight(sir, 'revokes a keystone using a combined manage/revoke pool and empties it', async () => {
-        const salt = "combined_salt";
-        const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt });
-        manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const lc = `[revokes a keystone using a combined manage/revoke pool and empties it]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 31d8bc860b7cb09893ccaac3d2cf4826)`); }
 
-        const keystone = await service.genesis({
-            masterSecret: userSecret,
-            configs: [manageConfig],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+            const salt = "combined_salt";
+            const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt });
+            manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
 
-        const revoked = await service.revoke({
-            latestKeystone: keystone,
-            masterSecret: userSecret,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+            const keystone = await service.genesis({
+                masterSecret: userSecret,
+                configs: [manageConfig],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
 
-        iReckon(sir, revoked.data?.revocationInfo).asTo('revocationInfo present').isGonnaBeTruthy();
-        const managePool = revoked.data?.challengePools.find(p => p.id === POOL_ID_MANAGE)!;
-        iReckon(sir, Object.keys(managePool.challenges).length).asTo('combined manage pool depleted').willEqual(0);
+            const revoked = await service.revoke({
+                latestKeystone: keystone,
+                masterSecret: userSecret,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            iReckon(sir, revoked.data?.revocationInfo).asTo('revocationInfo present').isGonnaBeTruthy();
+            const managePool = revoked.data?.challengePools.find(p => p.id === POOL_ID_MANAGE)!;
+            iReckon(sir, Object.keys(managePool.challenges).length).asTo('combined manage pool depleted').willEqual(0);
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
     });
 
     await ifWeMight(sir, 'rotates user password successfully when signed by the user manage pool', async () => {
-        const salt = "manage_salt";
-        const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt });
-        manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const lc = `[rotates user password successfully when signed by the user manage pool]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 580b0bbdc7f80e35d8ee2339ac0eb526)`); }
 
-        const keystone = await service.genesis({
-            masterSecret: userSecret,
-            configs: [manageConfig],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+            const salt = "manage_salt";
+            const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt });
+            manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
 
-        const newSecret = "NewUserSecret_999";
-        const rotated = await service.changePassword({
-            latestKeystone: keystone,
-            newMasterSecret: newSecret,
-            signingSecret: userSecret,
-            signingPoolId: POOL_ID_MANAGE,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+            const keystone = await service.genesis({
+                masterSecret: userSecret,
+                configs: [manageConfig],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
 
-        iReckon(sir, rotated).isGonnaBeTruthy();
+            const newSecret = "NewUserSecret_999";
+            const { newKeystone: rotated } = await service.changePassword({
+                keystoneIbGib: keystone,
+                newMasterSecret: newSecret,
+                signingSecret: userSecret,
+                signingPoolId: POOL_ID_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
 
-        // 1. Try to sign using the new secret (should succeed)
-        const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
-        const signedNew = await service.sign({
-            latestKeystone: rotated,
-            masterSecret: newSecret,
-            claim,
-            poolId: POOL_ID_MANAGE,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-        iReckon(sir, signedNew).isGonnaBeTruthy();
+            iReckon(sir, rotated).isGonnaBeTruthy();
 
-        // 2. Try to sign using the old secret (should fail)
-        let errorCaught = false;
-        try {
-            await service.sign({
+            // 1. Try to sign using the new secret (should succeed)
+            const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
+            const signedNew = await service.sign({
                 latestKeystone: rotated,
-                masterSecret: userSecret,
+                masterSecret: newSecret,
                 claim,
                 poolId: POOL_ID_MANAGE,
                 metaspace: mockMetaspace,
                 space: mockSpace as any,
             });
-        } catch {
-            errorCaught = true;
+            iReckon(sir, signedNew).isGonnaBeTruthy();
+
+            // 2. Try to sign using the old secret (should fail)
+            let errorCaught = false;
+            try {
+                await service.sign({
+                    latestKeystone: rotated,
+                    masterSecret: userSecret,
+                    claim,
+                    poolId: POOL_ID_MANAGE,
+                    metaspace: mockMetaspace,
+                    space: mockSpace as any,
+                });
+            } catch {
+                errorCaught = true;
+            }
+            iReckon(sir, errorCaught).asTo('old secret signing rejected').isGonnaBeTrue();
+
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
         }
-        iReckon(sir, errorCaught).asTo('old secret signing rejected').isGonnaBeTrue();
     });
 
     await ifWeMight(sir, 'recovers user password successfully when signed by the custodian manage pool', async () => {
-        const userSalt = "user_salt";
-        const custodianSalt = "custodian_salt";
+        const lc = `[recovers user password successfully when signed by the custodian manage pool]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 409df8ee1ae81d8b45c4a9c98e6e7626)`); }
+
+            const userSalt = "user_salt";
+            const custodianSalt = "custodian_salt";
+
+            const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
+            userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+
+            const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
+            custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+
+            // We simulate constructing the custodian pool "offline" by the server
+            const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+            const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+            const challenges: { [id: string]: any } = {};
+            for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+                const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+                const challengeId = raw.substring(0, 16);
+                const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+                challenges[challengeId] = await strategy.generateChallenge({ solution });
+            }
+            const custodianPool: KeystoneChallengePool = {
+                id: POOL_ID_CUSTODIAN_MANAGE,
+                config: custodianManageConfig,
+                challenges,
+                isForeign: true
+            };
 
-        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
-        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+            const keystone = await service.genesis({
+                masterSecret: userSecret,
+                configs: [userManageConfig],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
 
-        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
-        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+            // Add the custodian pool to the keystone
+            const keystoneWithCustodian = await service.addPools({
+                latestKeystone: keystone,
+                masterSecret: userSecret,
+                newPools: [custodianPool],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
 
-        // We simulate constructing the custodian pool "offline" by the server
-        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
-        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
-        const challenges: { [id: string]: any } = {};
-        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
-            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
-            const challengeId = raw.substring(0, 16);
-            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
-            challenges[challengeId] = await strategy.generateChallenge({ solution });
+            // The user forgets their secret. Recover using custodianSecret!
+            const recoveredSecret = "RecoveredUserSecret_777";
+            const { newKeystone: recoveredKeystone } = await service.changePassword({
+                keystoneIbGib: keystoneWithCustodian,
+                newMasterSecret: recoveredSecret,
+                signingSecret: custodianSecret,
+                signingPoolId: POOL_ID_CUSTODIAN_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            iReckon(sir, recoveredKeystone).isGonnaBeTruthy();
+
+            // Verify we can sign with recovered secret
+            const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
+            const signedNew = await service.sign({
+                latestKeystone: recoveredKeystone,
+                masterSecret: recoveredSecret,
+                claim,
+                poolId: POOL_ID_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+            iReckon(sir, signedNew).isGonnaBeTruthy();
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
         }
-        const custodianPool: KeystoneChallengePool = {
-            id: POOL_ID_CUSTODIAN_MANAGE,
-            config: custodianManageConfig,
-            challenges,
-            isForeign: true
-        };
+    });
 
-        const keystone = await service.genesis({
-            masterSecret: userSecret,
-            configs: [userManageConfig],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+    await ifWeMight(sir, 'rotates custodian manage pool successfully', async () => {
+        const lc = `[rotates custodian manage pool successfully]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 76d9a76dc2487949d7deb31696d3e126)`); }
+
+            const userSalt = "user_salt";
+            const custodianSalt = "custodian_salt";
+
+            const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
+            userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+
+            const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
+            custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+
+            // Custodian Pool genesis
+            const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+            const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+            const challenges: { [id: string]: any } = {};
+            for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+                const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+                const challengeId = raw.substring(0, 16);
+                const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+                challenges[challengeId] = await strategy.generateChallenge({ solution });
+            }
+            const custodianPool: KeystoneChallengePool = {
+                id: POOL_ID_CUSTODIAN_MANAGE,
+                config: custodianManageConfig,
+                challenges,
+                isForeign: true
+            };
 
-        // Add the custodian pool to the keystone
-        const keystoneWithCustodian = await service.addPools({
-            latestKeystone: keystone,
-            masterSecret: userSecret,
-            newPools: [custodianPool],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+            const keystone = await service.genesis({
+                masterSecret: userSecret,
+                configs: [userManageConfig],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
 
-        // The user forgets their secret. Recover using custodianSecret!
-        const recoveredSecret = "RecoveredUserSecret_777";
-        const recoveredKeystone = await service.changePassword({
-            latestKeystone: keystoneWithCustodian,
-            newMasterSecret: recoveredSecret,
-            signingSecret: custodianSecret,
-            signingPoolId: POOL_ID_CUSTODIAN_MANAGE,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+            const keystoneWithCustodian = await service.addPools({
+                latestKeystone: keystone,
+                masterSecret: userSecret,
+                newPools: [custodianPool],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
 
-        iReckon(sir, recoveredKeystone).isGonnaBeTruthy();
+            // Rotate custodian credentials to new secret
+            const newCustodianSecret = "NewCustodianSecret_888";
+            const newCustodianConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: "new_custodian_salt" });
+            newCustodianConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+
+            const newStrategy = KeystoneStrategyFactory.create({ config: newCustodianConfig });
+            const newPoolSecret = await newStrategy.derivePoolSecret({ masterSecret: newCustodianSecret });
+            const newChallenges: { [id: string]: any } = {};
+            for (let i = 0; i < newCustodianConfig.behavior.size; i++) {
+                const raw = await hash({ s: `${newCustodianConfig.salt}${Date.now()}${i}` });
+                const challengeId = raw.substring(0, 16);
+                const solution = await newStrategy.generateSolution({ poolSecret: newPoolSecret, poolId: newCustodianConfig.id, challengeId });
+                newChallenges[challengeId] = await newStrategy.generateChallenge({ solution });
+            }
+            const newCustodianPool: KeystoneChallengePool = {
+                id: POOL_ID_CUSTODIAN_MANAGE,
+                config: newCustodianConfig,
+                challenges: newChallenges,
+                isForeign: true
+            };
 
-        // Verify we can sign with recovered secret
-        const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
-        const signedNew = await service.sign({
-            latestKeystone: recoveredKeystone,
-            masterSecret: recoveredSecret,
-            claim,
-            poolId: POOL_ID_MANAGE,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-        iReckon(sir, signedNew).isGonnaBeTruthy();
+            // Rotate signed by user manage pool
+            const rotated = await service.replacePool({
+                latestKeystone: keystoneWithCustodian,
+                newPool: newCustodianPool,
+                signingSecret: userSecret,
+                signingPoolId: POOL_ID_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            iReckon(sir, rotated).isGonnaBeTruthy();
+
+            // Verify we can sign with new custodian secret
+            const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
+            const signedNew = await service.sign({
+                latestKeystone: rotated,
+                masterSecret: newCustodianSecret,
+                claim,
+                poolId: POOL_ID_CUSTODIAN_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+            iReckon(sir, signedNew).isGonnaBeTruthy();
+
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
     });
 
-    await ifWeMight(sir, 'rotates custodian manage pool successfully', async () => {
-        const userSalt = "user_salt";
-        const custodianSalt = "custodian_salt";
+    await ifWeMight(sir, 'rotates all non-foreign pools during changePassword by default', async () => {
+        const lc = `[rotates all non-foreign pools during changePassword by default]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 8449682eda6389e9d514888f9ce86f26)`); }
+
+            const userSalt = "user_salt";
+            const custodianSalt = "custodian_salt";
+            const secondarySalt = "secondary_salt";
+
+            const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
+            userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+
+            // Another native/non-foreign pool
+            const secondaryNativeConfig = createStandardPoolConfig({ id: "secondary-native", salt: secondarySalt });
+            secondaryNativeConfig.allowedVerbs = [KEYSTONE_VERB_SYNC];
+
+            // A custodian/foreign pool
+            const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
+            custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+
+            // Custodian Pool genesis
+            const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+            const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+            const challenges: { [id: string]: any } = {};
+            for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+                const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+                const challengeId = raw.substring(0, 16);
+                const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+                challenges[challengeId] = await strategy.generateChallenge({ solution });
+            }
+            const custodianPool: KeystoneChallengePool = {
+                id: POOL_ID_CUSTODIAN_MANAGE,
+                config: custodianManageConfig,
+                challenges,
+                isForeign: true
+            };
+
+            const keystone = await service.genesis({
+                masterSecret: userSecret,
+                configs: [userManageConfig, secondaryNativeConfig],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            const keystoneWithCustodian = await service.addPools({
+                latestKeystone: keystone,
+                masterSecret: userSecret,
+                newPools: [custodianPool],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            // Rotate passphrase/password
+            const newPassphrase = "SuperNewSecretPassphrase_999";
+            const { newKeystone: rotated } = await service.changePassword({
+                keystoneIbGib: keystoneWithCustodian,
+                newMasterSecret: newPassphrase,
+                signingSecret: userSecret,
+                signingPoolId: POOL_ID_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
 
-        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
-        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+            iReckon(sir, rotated).isGonnaBeTruthy();
 
-        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
-        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+            const data = rotated.data!;
+            const rotatedManage = data.challengePools.find(p => p.id === POOL_ID_MANAGE)!;
+            const rotatedSecondary = data.challengePools.find(p => p.id === "secondary-native")!;
+            const rotatedCustodian = data.challengePools.find(p => p.id === POOL_ID_CUSTODIAN_MANAGE)!;
 
-        // Custodian Pool genesis
-        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
-        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
-        const challenges: { [id: string]: any } = {};
-        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
-            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
-            const challengeId = raw.substring(0, 16);
-            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
-            challenges[challengeId] = await strategy.generateChallenge({ solution });
+            // Verify native pools rotated (salt changed)
+            iReckon(sir, rotatedManage.config.salt).not.willEqual(userSalt);
+            iReckon(sir, rotatedSecondary.config.salt).not.willEqual(secondarySalt);
+
+            // Verify foreign pool was not modified (salt identical)
+            iReckon(sir, rotatedCustodian.config.salt).willEqual(custodianSalt);
+
+            // Verify we can validate transition
+            const errors = await service.validate({
+                prevIbGib: keystoneWithCustodian,
+                currentIbGib: rotated
+            });
+            iReckon(sir, errors.length).willEqual(0);
+
+            // Verify we can sign using the rotated 'manage' pool with the new passphrase
+            const manageClaim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target_manage" };
+            const signedWithNewManage = await service.sign({
+                latestKeystone: rotated,
+                masterSecret: newPassphrase,
+                claim: manageClaim,
+                poolId: POOL_ID_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+            iReckon(sir, signedWithNewManage).isGonnaBeTruthy();
+
+            // Verify we can sign using the rotated 'secondary-native' pool with the new passphrase
+            const syncClaim = { verb: KEYSTONE_VERB_SYNC, target: "test_target_sync" };
+            const signedWithNewSync = await service.sign({
+                latestKeystone: rotated,
+                masterSecret: newPassphrase,
+                claim: syncClaim,
+                poolId: "secondary-native",
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+            iReckon(sir, signedWithNewSync).isGonnaBeTruthy();
+
+            // Verify signing with the OLD master secret fails on both pools
+            let oldManageFailed = false;
+            try {
+                await service.sign({
+                    latestKeystone: rotated,
+                    masterSecret: userSecret,
+                    claim: manageClaim,
+                    poolId: POOL_ID_MANAGE,
+                    metaspace: mockMetaspace,
+                    space: mockSpace as any,
+                });
+            } catch {
+                oldManageFailed = true;
+            }
+            iReckon(sir, oldManageFailed).isGonnaBeTrue();
+
+            let oldSyncFailed = false;
+            try {
+                await service.sign({
+                    latestKeystone: rotated,
+                    masterSecret: userSecret,
+                    claim: syncClaim,
+                    poolId: "secondary-native",
+                    metaspace: mockMetaspace,
+                    space: mockSpace as any,
+                });
+            } catch {
+                oldSyncFailed = true;
+            }
+            iReckon(sir, oldSyncFailed).isGonnaBeTrue();
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
         }
-        const custodianPool: KeystoneChallengePool = {
-            id: POOL_ID_CUSTODIAN_MANAGE,
-            config: custodianManageConfig,
-            challenges,
-            isForeign: true
-        };
+    });
 
-        const keystone = await service.genesis({
-            masterSecret: userSecret,
-            configs: [userManageConfig],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+    await ifWeMight(sir, 'fails validation if password rotation details or constraints are violated', async () => {
+        const lc = `[fails validation if password rotation details or constraints are violated]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: b497f8486c58b25922d28b5efbd24826)`); }
+
+            // Construct invalid change-password transition
+            const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: "salt1" });
+            userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+
+            const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: "salt2" });
+            custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+
+            // Custodian Pool genesis
+            const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+            const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+            const challenges: { [id: string]: any } = {};
+            for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+                const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+                const challengeId = raw.substring(0, 16);
+                const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+                challenges[challengeId] = await strategy.generateChallenge({ solution });
+            }
+            const custodianPool: KeystoneChallengePool = {
+                id: POOL_ID_CUSTODIAN_MANAGE,
+                config: custodianManageConfig,
+                challenges,
+                isForeign: true
+            };
 
-        const keystoneWithCustodian = await service.addPools({
-            latestKeystone: keystone,
-            masterSecret: userSecret,
-            newPools: [custodianPool],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+            const keystone = await service.genesis({
+                masterSecret: userSecret,
+                configs: [userManageConfig],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
 
-        // Rotate custodian credentials to new secret
-        const newCustodianSecret = "NewCustodianSecret_888";
-        const newCustodianConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: "new_custodian_salt" });
-        newCustodianConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+            const keystoneWithCustodian = await service.addPools({
+                latestKeystone: keystone,
+                masterSecret: userSecret,
+                newPools: [custodianPool],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
 
-        const newStrategy = KeystoneStrategyFactory.create({ config: newCustodianConfig });
-        const newPoolSecret = await newStrategy.derivePoolSecret({ masterSecret: newCustodianSecret });
-        const newChallenges: { [id: string]: any } = {};
-        for (let i = 0; i < newCustodianConfig.behavior.size; i++) {
-            const raw = await hash({ s: `${newCustodianConfig.salt}${Date.now()}${i}` });
-            const challengeId = raw.substring(0, 16);
-            const solution = await newStrategy.generateSolution({ poolSecret: newPoolSecret, poolId: newCustodianConfig.id, challengeId });
-            newChallenges[challengeId] = await newStrategy.generateChallenge({ solution });
+            // Create an invalid frame manually where a foreign pool is rotated during change-password
+            const badRotatedPool = await rotatePoolChallenges({
+                prevPool: custodianPool,
+                newMasterSecret: "bad_secret"
+            });
+
+            const { newKeystone: evolved } = await service.changePassword({
+                keystoneIbGib: keystoneWithCustodian,
+                newMasterSecret: "new_pass",
+                signingSecret: userSecret,
+                signingPoolId: POOL_ID_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            // Inject the foreign pool rotation manually to simulate an attacker
+            const attackerData = {
+                ...evolved.data!,
+                challengePools: evolved.data!.challengePools.map(p => p.id === POOL_ID_CUSTODIAN_MANAGE ? badRotatedPool : p)
+            };
+            // Update details claim to say we rotated custodian-manage
+            attackerData.proofs[0].claim.details = {
+                type: KeystoneClaimType.change_password,
+                info: { change: [POOL_ID_MANAGE, POOL_ID_CUSTODIAN_MANAGE] } as ClaimDetails_ChangePassword
+            };
+
+            const attackerKeystone = {
+                ...evolved,
+                data: attackerData
+            };
+
+            const errors = await service.validate({
+                prevIbGib: keystoneWithCustodian,
+                currentIbGib: attackerKeystone
+            });
+
+            iReckon(sir, errors.length > 0).isGonnaBeTrue();
+            const hasForeignViolation = errors.some(e => e.includes("Security Violation") && e.includes("foreign pool"));
+            iReckon(sir, hasForeignViolation).isGonnaBeTrue();
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
         }
-        const newCustodianPool: KeystoneChallengePool = {
-            id: POOL_ID_CUSTODIAN_MANAGE,
-            config: newCustodianConfig,
-            challenges: newChallenges,
-            isForeign: true
-        };
+    });
 
-        // Rotate signed by user manage pool
-        const rotated = await service.replacePool({
-            latestKeystone: keystoneWithCustodian,
-            newPool: newCustodianPool,
-            signingSecret: userSecret,
-            signingPoolId: POOL_ID_MANAGE,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
+    await ifWeMight(sir, 'verifies signing secrets correctly for a pool', async () => {
+        const lc = `[verifies signing secrets correctly for a pool]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 343eb84f5768ff0adcf2308c68404826)`); }
+
+            const userSecret = "alice_secret_123";
+            const builder = KeystoneProfileBuilder.buildKeystone('low')
+                .withUsername('alice')
+                .withEmail('alice@example.com')
+                .withDescription('Alice test keystone');
+
+            const configs = await builder.compileConfigs();
+            const keystone = await service.genesis({
+                masterSecret: userSecret,
+                configs,
+                frameDetails: builder.getFrameDetails(),
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            // 1. Correct secret on manage pool
+            const isCorrectManage = await service.verifySigningSecret({
+                keystoneIbGib: keystone,
+                signingSecret: userSecret,
+                poolId: POOL_ID_MANAGE
+            });
+            iReckon(sir, isCorrectManage).asTo('correct manage secret').isGonnaBeTrue();
+
+            // 2. Incorrect secret on manage pool
+            const isWrongManage = await service.verifySigningSecret({
+                keystoneIbGib: keystone,
+                signingSecret: "wrong_secret",
+                poolId: POOL_ID_MANAGE
+            });
+            iReckon(sir, isWrongManage).asTo('incorrect manage secret').isGonnaBeFalse();
+
+            // 3. Correct secret on default/sign pool
+            const isCorrectDefault = await service.verifySigningSecret({
+                keystoneIbGib: keystone,
+                signingSecret: userSecret,
+                poolId: 'default'
+            });
+            iReckon(sir, isCorrectDefault).asTo('correct default secret').isGonnaBeTrue();
+
+            // 4. Invalid/non-existent pool ID
+            const isInvalidPool = await service.verifySigningSecret({
+                keystoneIbGib: keystone,
+                signingSecret: userSecret,
+                poolId: 'invalid_pool_id_123'
+            });
+            iReckon(sir, isInvalidPool).asTo('invalid pool id').isGonnaBeFalse();
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
+    });
+
+    await ifWeMight(sir, 'removes pools successfully, validating transitions and auth', async () => {
+        const lc = `[removes pools successfully, validating transitions and auth]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 2e2e747d6808b05c1e452a680d94b726)`); }
+
+            const userSecret = "alice_secret_123";
+            const customPoolId = "custodian-manage-google";
+            const configs = [
+                createStandardPoolConfig({
+                    id: POOL_ID_MANAGE,
+                    salt: "manage_salt",
+                }),
+                createStandardPoolConfig({
+                    id: customPoolId,
+                    salt: "custodian_salt",
+                })
+            ];
+
+            const keystone = await service.genesis({
+                masterSecret: userSecret,
+                configs,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            // 1. Success path: remove customPoolId using correct secret
+            const evolvedKeystone = await service.removePools({
+                latestKeystone: keystone,
+                masterSecret: userSecret,
+                poolIds: [customPoolId],
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            iReckon(sir, evolvedKeystone).asTo('evolved keystone exists').isGonnaBeTruthy();
+            iReckon(sir, evolvedKeystone.data?.challengePools.length).asTo('pool count reduced').willEqual(1);
+            iReckon(sir, evolvedKeystone.data?.challengePools[0].id).asTo('manage pool remains').willEqual(POOL_ID_MANAGE);
+
+            // Verify transition is fully valid
+            const errors = await service.validate({
+                prevIbGib: keystone,
+                currentIbGib: evolvedKeystone
+            });
+            iReckon(sir, errors.length).asTo('transition validation succeeds').willEqual(0);
+
+            // 2. Sad path: invalid master secret
+            let cryptoErrorCaught = false;
+            try {
+                await service.removePools({
+                    latestKeystone: keystone,
+                    masterSecret: "wrong_secret",
+                    poolIds: [customPoolId],
+                    metaspace: mockMetaspace,
+                    space: mockSpace as any,
+                });
+            } catch (e: any) {
+                if (e.message.includes('Crypto Violation')) {
+                    cryptoErrorCaught = true;
+                }
+            }
+            iReckon(sir, cryptoErrorCaught).asTo('forgery check prevents removal').isGonnaBeTrue();
+
+            // 3. Sad path: non-existent pool ID
+            let notFoundErrorCaught = false;
+            try {
+                await service.removePools({
+                    latestKeystone: keystone,
+                    masterSecret: userSecret,
+                    poolIds: ["non-existent-pool"],
+                    metaspace: mockMetaspace,
+                    space: mockSpace as any,
+                });
+            } catch (e: any) {
+                if (e.message.includes('not found in keystone')) {
+                    notFoundErrorCaught = true;
+                }
+            }
+            iReckon(sir, notFoundErrorCaught).asTo('non-existent pool ID rejected').isGonnaBeTrue();
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
+    });
+
+    await ifWeMight(sir, 'rotates registered delegate keystone challenge pools when changing user password', async () => {
+        const lc = `[rotates registered delegate keystone challenge pools when changing user password]`;
+        try {
+            if (logalot) { console.log(`${lc} starting...`); }
+
+            const userSecret = "alice_initial_pass_123";
+            const newSecret = "alice_new_pass_456";
+
+            // 1. Create primary keystone
+            const parentConfigs = [
+                createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: "parent_manage_salt" }),
+                createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: "parent_default_salt" })
+            ];
+            const parentKeystone = await service.genesis({
+                masterSecret: userSecret,
+                configs: parentConfigs,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            // 2. Create delegate keystone using derived delegateSecret from userSecret (matching real app creation behavior)
+            const delegateSecret = await deriveDelegateSecret({ masterSecret: userSecret });
+            const delegateConfigs = [
+                createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: "delegate_manage_salt" }),
+                createStandardPoolConfig({ id: "delegate_sync_pool", salt: "delegate_sync_salt" })
+            ];
+            const delegateKeystone = await service.genesis({
+                masterSecret: delegateSecret,
+                configs: delegateConfigs,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            const delegateTjp = getTjpAddr({ ibGib: delegateKeystone });
+            if (!delegateTjp) { throw new Error('delegateTjp missing'); }
+
+            // 3. Register delegate under primary keystone
+            const registeredParent = await service.registerDelegate({
+                parentKeystone,
+                delegateKeystone,
+                masterSecret: userSecret,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+                allowedVerbs: [KEYSTONE_VERB_SYNC],
+            });
+
+            // 4. Change user password on parent keystone.
+            // Note: We explicitly set `poolIds: undefined` to reinforce that passing undefined
+            // instructs changePassword to rotate all non-foreign pools on the primary keystone
+            // AND all registered outward delegates. (In production caller code, poolIds parameter can simply be omitted).
+            const { newKeystone: evolvedParent, newDelegates } = await service.changePassword({
+                keystoneIbGib: registeredParent,
+                newMasterSecret: newSecret,
+                signingSecret: userSecret,
+                signingPoolId: POOL_ID_MANAGE,
+                poolIds: undefined,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+
+            // 5. Retrieve latest delegate keystone from metaspace/space
+            if (newDelegates && newDelegates.length === 1) {
+                const latestDelegate = newDelegates[0];
+
+                // 6. Verify primary keystone challenge pools have rotated to new secret
+                for (const pool of evolvedParent.data!.challengePools) {
+                    if (!pool.isForeign) {
+                        const oldValid = await service.verifySigningSecret({
+                            keystoneIbGib: evolvedParent,
+                            signingSecret: userSecret,
+                            poolId: pool.id
+                        });
+                        iReckon(sir, oldValid).asTo(`parent pool ${pool.id} old secret invalid`).isGonnaBeFalse();
+
+                        const newValid = await service.verifySigningSecret({
+                            keystoneIbGib: evolvedParent,
+                            signingSecret: newSecret,
+                            poolId: pool.id
+                        });
+                        iReckon(sir, newValid).asTo(`parent pool ${pool.id} new secret valid`).isGonnaBeTrue();
+                    }
+                }
+
+                // 7. Verify delegate keystone challenge pools have rotated to new secret
+                const oldDelegateSecret = await deriveDelegateSecret({ masterSecret: userSecret });
+                const newDelegateSecret = await deriveDelegateSecret({ masterSecret: newSecret });
+                for (const pool of latestDelegate.data!.challengePools) {
+                    if (!pool.isForeign) {
+                        const oldValid = await service.verifySigningSecret({
+                            keystoneIbGib: latestDelegate,
+                            signingSecret: oldDelegateSecret,
+                            poolId: pool.id
+                        });
+                        iReckon(sir, oldValid).asTo(`delegate pool ${pool.id} old secret invalid`).isGonnaBeFalse();
+
+                        const newValid = await service.verifySigningSecret({
+                            keystoneIbGib: latestDelegate,
+                            signingSecret: newDelegateSecret,
+                            poolId: pool.id
+                        });
+                        iReckon(sir, newValid).asTo(`delegate pool ${pool.id} new secret valid`).isGonnaBeTrue();
+                    }
+                }
+
+            } else {
+                iReckon(sir, true).asTo('newDelegates should have had length 1 but is empty/falsy').isGonnaBeFalse();
+            }
+
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
+    });
+});
 
-        iReckon(sir, rotated).isGonnaBeTruthy();
-
-        // Verify we can sign with new custodian secret
-        const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
-        const signedNew = await service.sign({
-            latestKeystone: rotated,
-            masterSecret: newCustodianSecret,
-            claim,
-            poolId: POOL_ID_CUSTODIAN_MANAGE,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-        iReckon(sir, signedNew).isGonnaBeTruthy();
-    });
-
-    await ifWeMight(sir, 'rotates all non-foreign pools during changePassword by default', async () => {
-        const userSalt = "user_salt";
-        const custodianSalt = "custodian_salt";
-        const secondarySalt = "secondary_salt";
-
-        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
-        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
-
-        // Another native/non-foreign pool
-        const secondaryNativeConfig = createStandardPoolConfig({ id: "secondary-native", salt: secondarySalt });
-        secondaryNativeConfig.allowedVerbs = [KEYSTONE_VERB_SYNC];
-
-        // A custodian/foreign pool
-        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
-        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
-
-        // Custodian Pool genesis
-        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
-        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
-        const challenges: { [id: string]: any } = {};
-        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
-            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
-            const challengeId = raw.substring(0, 16);
-            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
-            challenges[challengeId] = await strategy.generateChallenge({ solution });
-        }
-        const custodianPool: KeystoneChallengePool = {
-            id: POOL_ID_CUSTODIAN_MANAGE,
-            config: custodianManageConfig,
-            challenges,
-            isForeign: true
-        };
-
-        const keystone = await service.genesis({
-            masterSecret: userSecret,
-            configs: [userManageConfig, secondaryNativeConfig],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-
-        const keystoneWithCustodian = await service.addPools({
-            latestKeystone: keystone,
-            masterSecret: userSecret,
-            newPools: [custodianPool],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-
-        // Rotate passphrase/password
-        const newPassphrase = "SuperNewSecretPassphrase_999";
-        const rotated = await service.changePassword({
-            latestKeystone: keystoneWithCustodian,
-            newMasterSecret: newPassphrase,
-            signingSecret: userSecret,
-            signingPoolId: POOL_ID_MANAGE,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-
-        iReckon(sir, rotated).isGonnaBeTruthy();
-
-        const data = rotated.data!;
-        const rotatedManage = data.challengePools.find(p => p.id === POOL_ID_MANAGE)!;
-        const rotatedSecondary = data.challengePools.find(p => p.id === "secondary-native")!;
-        const rotatedCustodian = data.challengePools.find(p => p.id === POOL_ID_CUSTODIAN_MANAGE)!;
-
-        // Verify native pools rotated (salt changed)
-        iReckon(sir, rotatedManage.config.salt).not.willEqual(userSalt);
-        iReckon(sir, rotatedSecondary.config.salt).not.willEqual(secondarySalt);
-
-        // Verify foreign pool was not modified (salt identical)
-        iReckon(sir, rotatedCustodian.config.salt).willEqual(custodianSalt);
-
-        // Verify we can validate transition
-        const errors = await service.validate({
-            prevIbGib: keystoneWithCustodian,
-            currentIbGib: rotated
-        });
-        iReckon(sir, errors.length).willEqual(0);
-
-        // Verify we can sign using the rotated 'manage' pool with the new passphrase
-        const manageClaim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target_manage" };
-        const signedWithNewManage = await service.sign({
-            latestKeystone: rotated,
-            masterSecret: newPassphrase,
-            claim: manageClaim,
-            poolId: POOL_ID_MANAGE,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-        iReckon(sir, signedWithNewManage).isGonnaBeTruthy();
-
-        // Verify we can sign using the rotated 'secondary-native' pool with the new passphrase
-        const syncClaim = { verb: KEYSTONE_VERB_SYNC, target: "test_target_sync" };
-        const signedWithNewSync = await service.sign({
-            latestKeystone: rotated,
-            masterSecret: newPassphrase,
-            claim: syncClaim,
-            poolId: "secondary-native",
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-        iReckon(sir, signedWithNewSync).isGonnaBeTruthy();
-
-        // Verify signing with the OLD master secret fails on both pools
-        let oldManageFailed = false;
-        try {
-            await service.sign({
-                latestKeystone: rotated,
-                masterSecret: userSecret,
-                claim: manageClaim,
-                poolId: POOL_ID_MANAGE,
-                metaspace: mockMetaspace,
-                space: mockSpace as any,
-            });
-        } catch {
-            oldManageFailed = true;
-        }
-        iReckon(sir, oldManageFailed).isGonnaBeTrue();
-
-        let oldSyncFailed = false;
-        try {
-            await service.sign({
-                latestKeystone: rotated,
-                masterSecret: userSecret,
-                claim: syncClaim,
-                poolId: "secondary-native",
-                metaspace: mockMetaspace,
-                space: mockSpace as any,
-            });
-        } catch {
-            oldSyncFailed = true;
-        }
-        iReckon(sir, oldSyncFailed).isGonnaBeTrue();
-    });
-
-    await ifWeMight(sir, 'fails validation if password rotation details or constraints are violated', async () => {
-        // Construct invalid change-password transition
-        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: "salt1" });
-        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
-
-        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: "salt2" });
-        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
-
-        // Custodian Pool genesis
-        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
-        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
-        const challenges: { [id: string]: any } = {};
-        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
-            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
-            const challengeId = raw.substring(0, 16);
-            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
-            challenges[challengeId] = await strategy.generateChallenge({ solution });
-        }
-        const custodianPool: KeystoneChallengePool = {
-            id: POOL_ID_CUSTODIAN_MANAGE,
-            config: custodianManageConfig,
-            challenges,
-            isForeign: true
-        };
-
-        const keystone = await service.genesis({
-            masterSecret: userSecret,
-            configs: [userManageConfig],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-
-        const keystoneWithCustodian = await service.addPools({
-            latestKeystone: keystone,
-            masterSecret: userSecret,
-            newPools: [custodianPool],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-
-        // Create an invalid frame manually where a foreign pool is rotated during change-password
-        const badRotatedPool = await rotatePoolChallenges({
-            prevPool: custodianPool,
-            newMasterSecret: "bad_secret"
-        });
-
-        const evolved = await service.changePassword({
-            latestKeystone: keystoneWithCustodian,
-            newMasterSecret: "new_pass",
-            signingSecret: userSecret,
-            signingPoolId: POOL_ID_MANAGE,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-
-        // Inject the foreign pool rotation manually to simulate an attacker
-        const attackerData = {
-            ...evolved.data!,
-            challengePools: evolved.data!.challengePools.map(p => p.id === POOL_ID_CUSTODIAN_MANAGE ? badRotatedPool : p)
-        };
-        // Update details claim to say we rotated custodian-manage
-        attackerData.proofs[0].claim.details = {
-            type: KeystoneClaimType.change_password,
-            info: { change: [POOL_ID_MANAGE, POOL_ID_CUSTODIAN_MANAGE] } as ClaimDetails_ChangePassword
-        };
-
-        const attackerKeystone = {
-            ...evolved,
-            data: attackerData
-        };
-
-        const errors = await service.validate({
-            prevIbGib: keystoneWithCustodian,
-            currentIbGib: attackerKeystone
-        });
-
-        iReckon(sir, errors.length > 0).isGonnaBeTrue();
-        const hasForeignViolation = errors.some(e => e.includes("Security Violation") && e.includes("foreign pool"));
-        iReckon(sir, hasForeignViolation).isGonnaBeTrue();
-    });
-
-    await ifWeMight(sir, 'verifies signing secrets correctly for a pool', async () => {
-        const userSecret = "alice_secret_123";
-        const builder = KeystoneProfileBuilder.buildKeystone('low')
-            .withUsername('alice')
-            .withEmail('alice@example.com')
-            .withDescription('Alice test keystone');
-
-        const configs = await builder.compileConfigs();
-        const keystone = await service.genesis({
-            masterSecret: userSecret,
-            configs,
-            frameDetails: builder.getFrameDetails(),
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-
-        // 1. Correct secret on manage pool
-        const isCorrectManage = await service.verifySigningSecret({
-            keystoneIbGib: keystone,
-            signingSecret: userSecret,
-            poolId: POOL_ID_MANAGE
-        });
-        iReckon(sir, isCorrectManage).asTo('correct manage secret').isGonnaBeTrue();
-
-        // 2. Incorrect secret on manage pool
-        const isWrongManage = await service.verifySigningSecret({
-            keystoneIbGib: keystone,
-            signingSecret: "wrong_secret",
-            poolId: POOL_ID_MANAGE
-        });
-        iReckon(sir, isWrongManage).asTo('incorrect manage secret').isGonnaBeFalse();
-
-        // 3. Correct secret on default/sign pool
-        const isCorrectDefault = await service.verifySigningSecret({
-            keystoneIbGib: keystone,
-            signingSecret: userSecret,
-            poolId: 'default'
-        });
-        iReckon(sir, isCorrectDefault).asTo('correct default secret').isGonnaBeTrue();
-
-        // 4. Invalid/non-existent pool ID
-        const isInvalidPool = await service.verifySigningSecret({
-            keystoneIbGib: keystone,
-            signingSecret: userSecret,
-            poolId: 'invalid_pool_id_123'
-        });
-        iReckon(sir, isInvalidPool).asTo('invalid pool id').isGonnaBeFalse();
-    });
-
-    await ifWeMight(sir, 'removes pools successfully, validating transitions and auth', async () => {
-        const userSecret = "alice_secret_123";
-        const customPoolId = "custodian-manage-google";
-        const configs = [
-            createStandardPoolConfig({
-                id: POOL_ID_MANAGE,
-                salt: "manage_salt",
-            }),
-            createStandardPoolConfig({
-                id: customPoolId,
-                salt: "custodian_salt",
-            })
-        ];
-
-        const keystone = await service.genesis({
-            masterSecret: userSecret,
-            configs,
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-
-        // 1. Success path: remove customPoolId using correct secret
-        const evolvedKeystone = await service.removePools({
-            latestKeystone: keystone,
-            masterSecret: userSecret,
-            poolIds: [customPoolId],
-            metaspace: mockMetaspace,
-            space: mockSpace as any,
-        });
-
-        iReckon(sir, evolvedKeystone).asTo('evolved keystone exists').isGonnaBeTruthy();
-        iReckon(sir, evolvedKeystone.data?.challengePools.length).asTo('pool count reduced').willEqual(1);
-        iReckon(sir, evolvedKeystone.data?.challengePools[0].id).asTo('manage pool remains').willEqual(POOL_ID_MANAGE);
-
-        // Verify transition is fully valid
-        const errors = await service.validate({
-            prevIbGib: keystone,
-            currentIbGib: evolvedKeystone
-        });
-        iReckon(sir, errors.length).asTo('transition validation succeeds').willEqual(0);
-
-        // 2. Sad path: invalid master secret
-        let cryptoErrorCaught = false;
-        try {
-            await service.removePools({
-                latestKeystone: keystone,
-                masterSecret: "wrong_secret",
-                poolIds: [customPoolId],
-                metaspace: mockMetaspace,
-                space: mockSpace as any,
-            });
-        } catch (e: any) {
-            if (e.message.includes('Crypto Violation')) {
-                cryptoErrorCaught = true;
-            }
-        }
-        iReckon(sir, cryptoErrorCaught).asTo('forgery check prevents removal').isGonnaBeTrue();
-
-        // 3. Sad path: non-existent pool ID
-        let notFoundErrorCaught = false;
-        try {
-            await service.removePools({
-                latestKeystone: keystone,
-                masterSecret: userSecret,
-                poolIds: ["non-existent-pool"],
-                metaspace: mockMetaspace,
-                space: mockSpace as any,
-            });
-        } catch (e: any) {
-            if (e.message.includes('not found in keystone')) {
-                notFoundErrorCaught = true;
-            }
-        }
-        iReckon(sir, notFoundErrorCaught).asTo('non-existent pool ID rejected').isGonnaBeTrue();
-    });
-});
-