Abstract fixture identities in team/private retrieval spec

Context

PR #11055 added the first Dockerized integration proof for #10951's team/private retrieval lane. Opus approved the PR in Cycle 1 and marked the identity naming concern as non-blocking polish:

https://github.com/neomjs/neo/pull/11055#issuecomment-4413629778

The spec currently uses real swarm member names as test identities:

• neo-gpt
• neo-opus-4-7
• neo-gemini-3-1-pro

Sibling integration coverage such as test/playwright/integration/CrossTenantIsolation.integration.spec.mjs uses abstract fixture identities (alice, bob) instead.

Duplicate sweep before filing:

• KB ticket search for hardcoded swarm member identities integration spec alice bob charlie TeamPrivateRetrieval follow-up returned no relevant documents.
• rg across resources/content/issues, resources/content/issue-archive, and resources/content/discussions found no equivalent team/private retrieval fixture-identity cleanup ticket.
• Adjacent #10330 is related but not duplicate: it concerns legacy AGENT:alice / AGENT:bob / AGENT:charlie graph-node pollution. This ticket explicitly avoids that shape and targets plain proxy identity strings used by the integration MCP fixture.

The Problem

Hardcoding production swarm-member identities in an integration spec couples test-fixture behavior to the current named-maintainer roster. If a named maintainer is renamed, retired, or the canonical seeded identity list changes, the spec can fail for reasons unrelated to the team/private retrieval substrate it is meant to test.

The test only needs three distinct authenticated request identities: owner, peer, and unrelated. Real maintainer names do not add coverage; they add incidental coupling.

The Architectural Reality

Relevant surfaces:

• test/playwright/integration/TeamPrivateRetrieval.integration.spec.mjs from PR #11055.
• test/playwright/integration/CrossTenantIsolation.integration.spec.mjs sibling precedent using abstract identities.
• test/playwright/integration/fixtures/mcpClient.mjs sends the proxy identity through X-PREFERRED-USERNAME.
• ai/mcp/server/memory-core/Server.mjs binds proxy identities into request context and graph identity node IDs.
• #10330 warns against legacy AGENT:alice graph-node pollution; this cleanup should keep using plain username-style proxy identities, not AGENT:*.

The Fix

Rename the #11055 integration spec identities from real swarm-member names to abstract fixture names:

• owner: alice
• peer: bob
• unrelated: charlie

Keep the existing owner/peer/unrelated variable names and assertions. Do not change the tested policy surface or broaden #10951.

Acceptance Criteria

• TeamPrivateRetrieval.integration.spec.mjs uses abstract proxy identities for owner, peer, and unrelated users.
• The cleanup does not introduce AGENT:alice, AGENT:bob, or AGENT:charlie graph-node IDs.
• The spec still verifies owner-private, peer-private, shared Chroma commons, and current broad visibility: "team" graph semantics.
• node --check test/playwright/integration/TeamPrivateRetrieval.integration.spec.mjs passes.
• Docker-equipped CI or local integration run executes TeamPrivateRetrieval.integration.spec.mjs.

Out of Scope

• Changing #10010/#10011 membership-qualified team authorization semantics.
• Reworking the #11055 direct-container-seeding helper.
• Renaming real swarm identities in production AgentIdentity substrate.

Avoided Traps

• Rejected: patching PR #11055 after approval solely for polish. That would restart the review loop after CI is green and the reviewer explicitly marked the point non-blocking.
• Rejected: using legacy AGENT:alice graph IDs. #10330 documents why those were pollution; the intended shape is plain proxy identity usernames through the existing MCP integration fixture.

Related

• PR #11055
• #10951
• #10010
• #10011
• #10330

Origin Session ID: 20a824b0-29d1-4082-ae12-87705ec69c3f

Retrieval Hint: query_raw_memories(query="PR #11055 identity abstraction alice bob charlie TeamPrivateRetrieval")