What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Frontmatter

id	10000
title	Hardened Identity Ingestion & Tenant Isolation
state	Closed
labels	enhancementai
assignees	tobiu
createdAt	Apr 14, 2026, 5:10 PM
updatedAt	Apr 20, 2026, 5:08 PM
githubUrl	https://github.com/neomjs/neo/issues/10000
author	tobiu
commentsCount	0
parentIssue	10016
subIssues	[]
subIssuesCompleted	0
subIssuesTotal	0
blockedBy	[]
blocking	[x] 10017 Migration & Backward Compatibility for Multi-Tenant Schema, [ ] 10011 Native Edge Graph (SQLite): Row-Level Security & Tenant Isolation, [ ] 10010 Memory Core: Team vs Private Context Retrieval Flag
closedAt	Apr 20, 2026, 5:08 PM

Hardened Identity Ingestion & Tenant Isolation

Closed v13.0.0/archive-v13-0-0-chunk-4 enhancementai

tobiu commented on Apr 14, 2026, 5:10 PM

Objective

Implement strict multi-tenant isolation within the Agent OS Memory Core to prevent identity spoofing and ensure data privacy.

Tasks

Configure memory-core/config.template.mjs (Express Server) to extract identity strictly from trusted reverse-proxy HTTP headers (e.g., x-auth-request-preferred-username).
Ensure .env is never fully trusted for multi-user deployments.
Refactor SessionService.mjs to inject the extracted userId into ChromaDB metadata during collection.add() and collection.upsert().
Enforce where: { userId } filtering on all generic Memory Core retrieval queries (e.g., get_session_memories, query_raw_memories).

tobiu added the enhancement label on Apr 14, 2026, 5:10 PM

tobiu added the ai label on Apr 14, 2026, 5:10 PM

tobiu added parent issue #9999 on Apr 14, 2026, 5:11 PM

tobiu cross-referenced by #10016 on Apr 14, 2026, 6:43 PM

tobiu removed parent issue #9999 on Apr 14, 2026, 6:44 PM

tobiu added parent issue #10016 on Apr 14, 2026, 6:44 PM

tobiu marked this issue as blocking #10010 on Apr 14, 2026, 6:44 PM

tobiu marked this issue as blocking #10011 on Apr 14, 2026, 6:44 PM

tobiu marked this issue as blocking #10017 on Apr 14, 2026, 6:44 PM

tobiu cross-referenced by PR #10121 on Apr 20, 2026, 12:40 PM

tobiu cross-referenced by #9748 on Apr 20, 2026, 1:13 PM

tobiu cross-referenced by PR #10123 on Apr 20, 2026, 3:06 PM

tobiu assigned to @tobiu on Apr 20, 2026, 3:54 PM

tobiu referenced in commit 8265e3b - "feat(ai): JWT-claim-driven multi-tenant isolation for Memory Core (#10000)" on Apr 20, 2026, 4:11 PM

tobiu cross-referenced by PR #10128 on Apr 20, 2026, 4:12 PM

tobiu cross-referenced by #10129 on Apr 20, 2026, 5:04 PM

tobiu referenced in commit 78b13a3 - "test(ai): add tenant isolation spec for SummaryService (#10000)" on Apr 20, 2026, 5:06 PM

tobiu closed this issue on Apr 20, 2026, 5:08 PM

tobiu referenced in commit 8c6589e - "feat(ai): JWT-claim-driven multi-tenant isolation for Memory Core (#10000) (#10128) on Apr 20, 2026, 5:08 PM

tobiu cross-referenced by PR #10130 on Apr 20, 2026, 5:26 PM

tobiu cross-referenced by PR #10131 on Apr 20, 2026, 8:26 PM

tobiu cross-referenced by #10144 on Apr 21, 2026, 11:28 AM

tobiu cross-referenced by #10145 on Apr 21, 2026, 8:43 PM

tobiu cross-referenced by PR #10166 on Apr 21, 2026, 9:06 PM

tobiu referenced in commit 7db6c90 - "feat(ai): wire stdio identity + anti-spoof guard for Memory Core MCP (#10145) (#10166) on Apr 21, 2026, 10:16 PM

tobiu cross-referenced by #10146 on Apr 21, 2026, 10:30 PM

tobiu referenced in commit bb17e6b - "fix(ai): Memory Core ChromaDB legacy userId backfill + additive tenant read filter (#10556) (#10567) on May 1, 2026, 12:27 PM