---
id: 10947
title: Add real OIDC auth integration fixture for Memory Core
state: CLOSED
labels:
  - enhancement
  - ai
  - testing
  - architecture
assignees:
  - neo-gemini-pro
createdAt: '2026-05-08T10:46:36Z'
updatedAt: '2026-05-12T02:09:44Z'
githubUrl: 'https://github.com/neomjs/neo/issues/10947'
author: neo-gpt
commentsCount: 0
parentIssue: 10945
subIssues: []
subIssuesCompleted: 0
subIssuesTotal: 0
blockedBy: []
blocking: []
closedAt: '2026-05-08T20:21:34Z'
---
# Add real OIDC auth integration fixture for Memory Core

## Context

Parent epic #10945 needs actionable deployment-pipeline subissues. The current Memory Core integration suite proves the fast `trustProxyIdentity` path, but @tobiu explicitly called out that the deployment-pipeline coverage needs to go far beyond heartbeat checks.

Duplicate sweep before filing:
- `gh issue list --search "OIDC Memory Core integration"` found #10945 only.
- `gh issue list --search "real OIDC GitHub auth deployed integration fixture Memory Core"` found #10945 only.
- KB ticket search for the full multi-user deployment integration framing returned no conceptual duplicate.
- Adjacent auth/deployment parents remain #9999, #10016, and #10691.

## The Problem

The deployed integration tests currently rely on trusted reverse-proxy identity headers. That is useful for a fast local fixture, but it does not prove that an operator-style OIDC/GitHub-account path rejects invalid credentials, accepts valid identity, and propagates the resulting user identity into Memory Core request context.

Without this lane, the team can accidentally ship regressions where proxy-header smoke tests pass but real deployed auth is broken.

## The Architectural Reality

Relevant surfaces:
- `ai/deploy/docker-compose.test.yml` for the Dockerized KB/MC/Chroma/mock-embedding stack.
- `test/playwright/playwright.config.integration.mjs` for the integration runner.
- `test/playwright/integration/fixtures/composeWebServer.mjs` for stack lifecycle.
- `test/playwright/integration/fixtures/mcpClient.mjs` for Streamable HTTP MCP client calls and identity headers.
- `learn/agentos/SharedDeployment.md` and `learn/agentos/DeploymentCookbook.md` for deployed auth expectations.

Adjacent parents: #9999, #10016, #10691, #10945.

## The Fix

Add a higher-fidelity auth fixture beyond direct `trustProxyIdentity` header injection. Decide the smallest viable substrate during intake: local OIDC mock, GitHub-token fixture, or explicitly blocked operator-staging fixture if real credentials are required.

The implementation should verify:
- missing/invalid identity is rejected;
- valid auth creates the expected request identity;
- user identity reaches Memory Core write/read context;
- direct client-spoofed identity headers cannot bypass the trusted auth layer.

## Contract Ledger Matrix

| Target Surface | Source of Authority | Proposed Behavior | Fallback | Docs | Evidence |
|---|---|---|---|---|---|
| Real-auth integration fixture | #10945, #10016, deployment docs | Exercise deployed auth beyond `trustProxyIdentity` shortcut | If live OAuth credentials are required, mark blocked/InputRequired with exact operator prerequisite | SharedDeployment + DeploymentCookbook auth sections | Playwright integration spec rejects invalid auth and accepts validated identity |
| Memory Core request identity | Memory Core auth/request context | Authenticated user identity propagates into memory/session operations | Preserve fast header fixture as MVP/local path | MemoryCore auth docs if touched | Cross-user read/write assertion through MCP calls |

## Acceptance Criteria

- [ ] New or extended integration fixture covers a real-auth path beyond direct trusted-header injection.
- [ ] Invalid/missing auth is rejected before Memory Core tool execution.
- [ ] Valid auth produces stable user identity in Memory Core request context.
- [ ] Spoofed client-provided identity headers cannot bypass trusted auth.
- [ ] The test runs through `npm run test-integration` or documents an explicit blocked operator prerequisite.
- [ ] PR body includes deliberate-regression proof for at least one auth-sensitive assertion.

## Out of Scope

- Replacing the fast `trustProxyIdentity` fixture entirely.
- Building production IdP infrastructure in repo without maintainer approval.
- Changing privacy/RLS semantics covered by #10010/#10011 except as needed for auth proof.

## Related

Parent: #10945
Umbrella: #9999, #10016, #10691

Origin Session ID: c02fbf4e-870c-44c0-ba7e-e9ffacce094b

Retrieval Hint: `query_raw_memories(query="real OIDC Memory Core deployment integration trustProxyIdentity")`

## Timeline

- 2026-05-08T10:46:38Z @neo-gpt added the `enhancement` label
- 2026-05-08T10:46:38Z @neo-gpt added the `ai` label
- 2026-05-08T10:46:38Z @neo-gpt added the `testing` label
- 2026-05-08T10:46:38Z @neo-gpt added the `architecture` label
- 2026-05-08T10:46:43Z @neo-gpt added parent issue #10945
- 2026-05-08T10:49:13Z @neo-gpt cross-referenced by #10945
- 2026-05-08T12:02:32Z @neo-gpt cross-referenced by PR #10958
- 2026-05-08T12:05:25Z @neo-opus-ada referenced in commit `2015153` - "docs(agentos): incorporate Cycle 1 GPT review fixes + KB delta-update task (#10957)

@neo-gpt's PR #10958 Cycle 1 review at commentId IC_kwDODSospM8AAAABBqH6pg
flagged two blocking points; both addressed in this commit. Plus operator
added KB delta-update as another orchestrator-scoped task.

GPT RA1 — close-target / AC consistency:
- AC7 (ROADMAP.md cross-link) was deferred in original PR body; now satisfied
  inline in this commit. ROADMAP.md gains a new "v13 Architectural Path"
  section above "Current Focus: v12.2" linking to learn/agentos/v13-path.md
  and naming #9999 as the v13 main epic.
- AC8 native parent_child link was already done via update_issue_relationship
  immediately post-create (#9999 → #10957). Per-sub-issue follow-up comments
  remain post-merge work per ticket §"Out of Scope".

GPT RA2 — §6 audit completeness:
- Added #10945 row (open child of #9999, GPT's M1 lane; 5 valid sub-tickets
  #10947/#10949/#10950/#10951/#10952 with #10948 closed invalid post-correction)
- Added #10957 row (this very doc; meta — closes when this PR merges)

Operator addition (chief-architect input 2026-05-08):
- D3 Orchestrator scope expanded with Knowledge Base delta-update sync
  task. KB already supports delta updates via `npm run ai:sync-kb`;
  orchestrator schedules them on configurable cadence per the same
  per-host singleton pattern.

Co-Authored-By: tobiu <tobiasuhlig78@gmail.com>"
- 2026-05-08T12:18:01Z @tobiu referenced in commit `a77adf0` - "docs(agentos): v13 architectural path strategy document (#10957) (#10958)

* docs(agentos): add v13 architectural path strategy document (#10957)

Resolves #10957.

Authored 2026-05-08 per @tobiu's chief-architect mandate after today's
architectural-hallucination corrections (Factory-pattern partial-rollout
misread + NEO_MC_PRIMARY scoping over-correction).

Document covers the path from current substrate state (post-Bucket-G,
post-Factory-pattern, post-NEO_MC_PRIMARY-correction) to v13 release:

1. Vision — slim MCP servers + mature SDK + clean daemon architecture
2. Current State — empirically verified table comparing today vs target
3. Critical Architectural Decisions — D1 Factory eval (challenge-framed)
   / D2 common base server class / D3 orchestrator daemon architecture
   / D4 SDK migration boundary / D5 NEO_MC_PRIMARY retirement path
4. Sequenced Milestones M1-M7 — current week (M1 substrate stabilization
   with owner-split: Gemini unit-row, GPT integration, Claude doc) →
   v13 release cut
5. Tickets to file/update enumerated for each milestone
6. #9999 sub-issue audit — every open sub-issue triaged with
   on-trajectory / re-scope / verify markers
7. Risks + mitigations
8. Outcome metrics — quantitative v13 readiness targets
9. Provenance — citation chain back to today's correction

Strategic shape (~280 lines), not exhaustive specification. Per-milestone
prescriptions live in their own tickets/PRs; this doc is the chief-architect
anchor for swarm coordination across that work.

Co-Authored-By: tobiu <tobiasuhlig78@gmail.com>

* docs(agentos): incorporate Gemini's PR #10958 review depth-floor adds (#10957)

Cycle 1 review approved at commentId IC_kwDODSospM8AAAABBqGSkg with two
non-blocking considerations for M2/M3 implementation phases. Folding both
into the strategic doc rather than deferring to implementation memory:

D1 (AsyncLocalStorage edge cases) — explicit mention of:
- EventEmitter boundaries (handlers fire in emitter's own context)
- SSE streaming async generators (iterators yielding async to event loop
  can lose context across yield points)

D2 (Common Base Server Class) — added "Extension points the base must
expose" subsection enumerating registerTools / registerServices /
registerMiddleware / registerHealthChecks. The middleware/interceptor
pipeline (custom AuthMiddleware variants, parameter-validation
interceptors, per-server request hooks) was the specific concern Gemini
flagged — currently duplicated across the 2/5 servers that wrap dispatch;
base class makes it pluggable.

Co-Authored-By: tobiu <tobiasuhlig78@gmail.com>

* docs(agentos): incorporate Cycle 1 GPT review fixes + KB delta-update task (#10957)

@neo-gpt's PR #10958 Cycle 1 review at commentId IC_kwDODSospM8AAAABBqH6pg
flagged two blocking points; both addressed in this commit. Plus operator
added KB delta-update as another orchestrator-scoped task.

GPT RA1 — close-target / AC consistency:
- AC7 (ROADMAP.md cross-link) was deferred in original PR body; now satisfied
  inline in this commit. ROADMAP.md gains a new "v13 Architectural Path"
  section above "Current Focus: v12.2" linking to learn/agentos/v13-path.md
  and naming #9999 as the v13 main epic.
- AC8 native parent_child link was already done via update_issue_relationship
  immediately post-create (#9999 → #10957). Per-sub-issue follow-up comments
  remain post-merge work per ticket §"Out of Scope".

GPT RA2 — §6 audit completeness:
- Added #10945 row (open child of #9999, GPT's M1 lane; 5 valid sub-tickets
  #10947/#10949/#10950/#10951/#10952 with #10948 closed invalid post-correction)
- Added #10957 row (this very doc; meta — closes when this PR merges)

Operator addition (chief-architect input 2026-05-08):
- D3 Orchestrator scope expanded with Knowledge Base delta-update sync
  task. KB already supports delta updates via `npm run ai:sync-kb`;
  orchestrator schedules them on configurable cadence per the same
  per-host singleton pattern.

Co-Authored-By: tobiu <tobiasuhlig78@gmail.com>

---------

Co-authored-by: tobiu <tobiasuhlig78@gmail.com>"
- 2026-05-08T12:28:11Z @neo-opus-ada cross-referenced by #10960
- 2026-05-08T12:43:35Z @neo-opus-ada added the `release:v13` label
- 2026-05-08T12:46:45Z @neo-opus-ada cross-referenced by #10961
- 2026-05-08T18:08:58Z @neo-gemini-pro assigned to @neo-gemini-pro
- 2026-05-08T18:18:57Z @neo-gemini-pro cross-referenced by PR #10984
- 2026-05-08T19:26:26Z @neo-gemini-pro referenced in commit `f154846` - "test(auth): allow insecure OIDC issuer for integration fixture (#10947)"
- 2026-05-08T19:33:16Z @neo-gemini-pro referenced in commit `05ae95d` - "fix(ai): align OIDC resource server URL for integration tests (#10947)"
- 2026-05-08T19:45:51Z @neo-gemini-pro referenced in commit `0b17d3a` - "fix(ai): add exp claim to mock OIDC tokens to satisfy MCP SDK validation (#10947)"
- 2026-05-08T19:56:53Z @neo-gemini-pro referenced in commit `8d5aa87` - "test(integration): fix OIDC test assertions following identity block changes (#10947)"
- 2026-05-08T20:21:34Z @tobiu closed this issue
- 2026-05-08T20:21:34Z @tobiu referenced in commit `1992bcd` - "feat(integration): finalize OIDC fixture and cross-tenant tests (#10947) (#10984)

* test(integration): finalize OIDC fixture and cross-tenant tests (#10947)

* fix(auth): resolve oidc integration 500 error (#10984)

* test(auth): allow insecure OIDC issuer for integration fixture (#10947)

* fix(ai): align OIDC resource server URL for integration tests (#10947)

* fix(ai): add exp claim to mock OIDC tokens to satisfy MCP SDK validation (#10947)

* test(integration): fix OIDC test assertions following identity block changes (#10947)

* test(integration): fix query_raw_memories assertion shape (#10984)

The query_raw_memories tool returns results inside a 'results' array, not a 'documents' array as incorrectly asserted in the cross-tenant isolation test.

---------

Co-authored-by: neo-gemini-pro <neo-gemini-pro@users.noreply.github.com>"
- 2026-05-12T02:09:44Z @neo-gemini-pro removed the `release:v13` label

