Context

Follow-up audit after #10862 / PR #10877 institutionalized canonical NEO_ prefixes across Memory Core, Knowledge Base, and the Tier 1 ai/config.template.mjs, and after #10878 / PR #10879 fixed the obvious Authorization.spec.mjs spawn-fixture miss.

The operator asked for a broader audit because the repo has many env vars and Authorization.spec.mjs might not be the only unit-test fixture left behind.

The Problem

Four Memory Core SessionService unit specs still seed model-provider fixtures with the old bare env-var names:

process.env.MODEL_PROVIDER = 'openAiCompatible';
process.env.OPENAI_COMPATIBLE_MODEL = 'gemma4';

Current ai/mcp/server/memory-core/config.template.mjs no longer reads those bare names. The canonical bindings are:

'modelProvider': 'NEO_MODEL_PROVIDER',
'openAiCompatible.model': 'NEO_OPENAI_COMPATIBLE_MODEL',

Effect: the affected specs no longer exercise the env-var contract they appear to set. They may still pass because the tests later mutate SDK.Memory_Config.data.* directly or because defaults mask the issue, but the pre-import env fixture is stale and misleading.

The Architectural Reality

Audit source of authority:

• ai/config.template.mjs — Tier 1 config now reads process.env.NEO_TRANSPORT.
• ai/mcp/server/knowledge-base/config.template.mjs — KB envBindings use canonical NEO_* names where Neo-owned, while preserving third-party/OIDC names.
• ai/mcp/server/memory-core/config.template.mjs — MC envBindings use canonical NEO_* names, including NEO_MODEL_PROVIDER and NEO_OPENAI_COMPATIBLE_MODEL.

Empirical audit commands run from current origin/dev:

rg -n -P '(?<![A-Z_])(AUTO_SUMMARIZE|AUTO_DREAM|AUTO_GOLDEN_PATH|REAL_TIME_MEMORY_PARSING|AUTO_INGEST_FS|AUTO_SYNC|TRANSPORT|MEMORY_COLLECTION_NAME|SESSION_COLLECTION_NAME|GRAPH_COLLECTION_NAME|GRAPH_DECAY_FACTOR|MODEL_PROVIDER|OPENAI_COMPATIBLE_MODEL|OPENAI_COMPATIBLE_HOST|OPENAI_COMPATIBLE_EMBEDDING_MODEL|OPENAI_COMPATIBLE_API_KEY|VECTOR_DIMENSION)\b' test/playwright/unit

The only real stale hits after #10879 are:

• test/playwright/unit/ai/mcp/server/memory-core/services/SessionService.spec.mjs:5-6
• test/playwright/unit/ai/mcp/server/memory-core/services/SessionService.PrimaryFlagGate.spec.mjs:5-6
• test/playwright/unit/ai/mcp/server/memory-core/services/SessionService.ResumeValidation.spec.mjs:5-6
• test/playwright/unit/ai/mcp/server/memory-core/services/SessionService.SunsetPoller.spec.mjs:5-6

Control check: sibling SessionSummarization.spec.mjs already uses the correct canonical names:

process.env.NEO_MODEL_PROVIDER = 'openAiCompatible';
process.env.NEO_OPENAI_COMPATIBLE_MODEL = 'gemma4';

SSE_PORT occurrences are intentionally out of scope: they cover or use the legacy SSE_PORT alias retained for the #10808 deprecation window. OIDC/OAuth names (NEO_AUTH_*, ONEO_AUTH_*) are third-party/operator-facing canonical names and should remain unchanged.

The Fix

Update only the four stale Memory Core SessionService specs:

Keep the rest of the specs untouched. Do not rename direct config-object mutations such as SDK.Memory_Config.data.modelProvider = 'openAiCompatible'; those are not environment variables.

Acceptance Criteria

• All eight stale assignments across the four SessionService*.spec.mjs files use NEO_MODEL_PROVIDER and NEO_OPENAI_COMPATIBLE_MODEL.
• The audit command above returns zero stale bare-name hits for MC/KB/Tier-1 rename targets under test/playwright/unit.
• node --check passes for all four modified spec files.
• Run the targeted specs, or document preserved pre-existing runtime failure if local Chroma/provider setup prevents a clean run:
  • npm run test-unit -- test/playwright/unit/ai/mcp/server/memory-core/services/SessionService.spec.mjs
  • npm run test-unit -- test/playwright/unit/ai/mcp/server/memory-core/services/SessionService.PrimaryFlagGate.spec.mjs
  • npm run test-unit -- test/playwright/unit/ai/mcp/server/memory-core/services/SessionService.ResumeValidation.spec.mjs
  • npm run test-unit -- test/playwright/unit/ai/mcp/server/memory-core/services/SessionService.SunsetPoller.spec.mjs
• No changes to SSE_PORT, NEO_AUTH_*, ONEO_AUTH_*, HOST, or direct SDK.Memory_Config.data.* property assignments.

Out of Scope

• Modernizing SSE_PORT to MCP_HTTP_PORT; that remains under the #10808 deprecation cleanup lane.
• Renaming third-party canonical auth/env names (NEO_AUTH_*, ONEO_AUTH_*, GEMINI_API_KEY, etc.).
• Refactoring the session-service test setup or replacing direct SDK.Memory_Config.data.* mutations.
• Full integration-harness work under #10805.

Avoided Traps

• False-positive substring matching: TRANSPORT inside NEO_TRANSPORT is not stale. Use PCRE negative lookbehind (rg -P '(?<![A-Z_])...') for audit commands.
• Treating legacy aliases as stale: SSE_PORT is still intentionally readable during the #10808 deprecation window and appears in alias coverage/fixtures.
• Renaming config properties instead of env vars: modelProvider / openAiCompatible.model config paths are correct internal object keys; only process.env.* fixture names are stale.

Related

• #10862 — canonical NEO_ prefix migration across MC / KB / Tier 1 configs.
• PR #10877 — shipped the config-template rename.
• #10878 / PR #10879 — fixed the Authorization.spec.mjs env-fixture miss surfaced after #10877.
• #10808 — SSE_PORT / MCP_HTTP_PORT deprecation window.

Origin Session ID: 3c145296-4486-4442-9334-2d39e87db23f

Retrieval Hint: query_raw_memories(query="SessionService specs MODEL_PROVIDER OPENAI_COMPATIBLE_MODEL NEO_MODEL_PROVIDER env var audit")