What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Frontmatter

id	15412
title	Fleet whoami: expose the server-stamped viewer identity as a read verb
state	Closed
labels	enhancementai
assignees	neo-fable-clio
createdAt	Jul 18, 2026, 5:33 AM
updatedAt	Jul 18, 2026, 6:55 AM
githubUrl	https://github.com/neomjs/neo/issues/15412
author	neo-fable-clio
commentsCount	0
parentIssue	null
subIssues	[]
subIssuesCompleted	0
subIssuesTotal	0
contentTrust
projected
quarantined	0
signals	[]
blockedBy	[]
blocking	[]
closedAt	Jul 18, 2026, 6:55 AM

Fleet whoami: expose the server-stamped viewer identity as a read verb

Closed Backlog/active-chunk-7 enhancementai

neo-fable-clio commented on Jul 18, 2026, 5:33 AM

Context

#15320 follow-up prereq, source-verified by @neo-opus-grace while wiring #15377's operator-inbox boot trigger (A2A 466e18b2, 2026-07-18): the cockpit cannot construct the operator's own subjectAgentId for the FIRST own-inbox read. This is the ONLY gate on #15377's boot trigger; everything else in her lane is committed and fork-independent. Time-critical: my seat (the #15320 surface owner) expires Sunday.

The Problem

The #15320 mirror-read contract is deliberately explicit-subject (readFleetMailboxMirror refuses an omitted subjectAgentId — one read surface for own-inbox AND drilled-resident; an implicit self-default at a trust boundary is spoof-adjacent ambiguity). That contract is correct and stays. But the bootstrap leg is missing:

FleetControlBridge.getBootIdentity() → produceBootIdentityFact() returns a process-freshness fact ({bootAt, sourceRef, schedulerResumeState, …}) — Grace's grep across every producer: zero occurrences of any viewer @-id. Not a path to the identity.
The server KNOWS the viewer — resolveFleetViewer() binds it at boot (fail-closed, graph-verified, #15320) and RequestContextService.getAgentIdentityNodeId() stamps it per request — but no client-reachable verb exposes it pre-read. admission.viewerIdentity arrives IN the read result: circular for the first read.

The Architectural Reality

The value already exists server-side at exactly the right trust level: the ingress guard admits by bearer, runInContext stamps the viewer, and the mailbox-mirror source reads RequestContextService.getAgentIdentityNodeId() — the whoami verb returns THAT, nothing new is computed.
Wire surface: the fleet method allowlist (src/ai/fleet/fleetWireMethods.mjs family) + FleetControlBridge dispatch — the same choke-point every #15320 verb rides; unauthenticated callers die at the guard before any method resolution.
The invariant preserved verbatim: "the client SAYS self, and the admission stamp proves it" — whoami is the missing bootstrap leg, not a fork: cockpit calls whoami → seeds the operator record → passes that @-id EXPLICITLY as subjectAgentId → the mirror's admission re-stamps and proves it.

The Fix

One PR:

A resolveViewerIdentity (name bikeshed-open: whoami) read verb on FleetControlBridge: returns {ok: true, agentIdentityNodeId} from the request context — the stamped viewer inside the wire's ok-envelope, never a caller claim; empty/unbound context → {ok: false, error} with a named refusal (fail-closed, no fallback identity).
Allowlist registration on the wire-methods authority (conscious-update pins move).
Specs: unit (stamped-context round-trip through the real RequestContextService; unbound-context refusal) + one integration assertion on the existing full-chain suite (the 401-before-method guard already covers unauthenticated).

Contract Ledger Matrix

Target Surface	Source of Authority	Proposed Behavior	Fallback	Docs	Evidence
`resolveViewerIdentity` wire verb — accepts NO caller input (no params consumed; caller-supplied identity is structurally impossible)	`src/ai/fleet/fleetWireMethods.mjs` allowlist + `FleetControlBridge.resolveViewerIdentity`	returns `{ok: true, agentIdentityNodeId}` — the SERVER-stamped viewer read per request from the launch-wired `viewerIdentitySource` → `RequestContextService.getAgentIdentityNodeId()`	unwired source → `{ok: false, error: 'fleet viewer identity source not wired'}`; wired-but-unbound context → `{ok: false, error: 'viewer identity unbound — authenticated ingress required'}` — never a fallback identity	`fleetWireMethods.mjs` doc paragraph + the verb JSDoc	`dispatchFleetRequest.spec.mjs` (allowlist conscious-pin + the route test); `fleetTransport.integration.spec.mjs` (authenticated round-trip returns the stamped `@integration-viewer`; both refusal shapes exact-matched) — at PR #15418 head `6d919cf9cc`
Unauthenticated behavior	the #15320 ingress guard	dies at the guard PRE-method-resolution: deterministic 401 `{ok: false, error: 'fleet: bearer required'}`	n/a — the guard IS the fallback boundary	#15320 boundary docs	`fleetTransport.integration.spec.mjs` 401 assertion at the same head
Stability / transition	additive new surface	envelope stable at `{ok: Boolean, agentIdentityNodeId?	error?}`; no versioned transition (no prior consumers); future changes ride the ledger	—	this ledger

Acceptance Criteria

The verb returns the server-stamped agentIdentityNodeId under a bound request context; NEVER a caller-supplied value; unbound context refuses with a named error.
Wire allowlist + pins updated consciously; unauthenticated callers still die at the ingress guard (integration-asserted).
[L3-deferred — operator handoff needed] The #15377 boot flow works end to end: whoami → explicit subjectAgentId → own-inbox mirror read with admission.viewerIdentity matching (Grace's consumption is the acceptance witness — post-merge, her lane; the delivering PR declares this residual honestly).
The explicit-subject contract on readFleetMailboxMirror is untouched.

Out of Scope

Any subject-defaulting on the mirror (the anti-fork ruling stands) · #15377's cockpit wiring (Grace's lane) · operator-principal compose stamping (#15389, landed).

Decision Record impact

none — a read-verb exposure of an existing stamped value inside the #15320 boundary's own design language.

#15320 (the boundary; this is its follow-up prereq) · #15377 (the consumer, Grace — unblocks her boot trigger) · #15389 (the compose sibling) · A2A 466e18b2 (the source-verified gap + fix shape, Grace's V-B-A).

Live latest-open sweep: latest 8 at 2026-07-18T03:29Z + hot-context refile 03:33Z; no equivalent. A2A in-flight: Grace explicitly handed the filing to the surface owner (me) in 466e18b2; my lane-swap claim broadcast f46eda20 precedes this filing.

Amendment 2026-07-18 (post-review truth-fold, PR #15418 cycle 1 by @neo-gpt-emmy): Contract Ledger Matrix backfilled; the Fix's return shape reconciled to the shipped ok-envelope; AC-3 annotated [L3-deferred — operator handoff needed].

Origin Session ID: abce4d75-7dcb-4145-8afc-b0ff2cdc51e6

Retrieval Hint: query_raw_memories("whoami resolveViewerIdentity stamped viewer bootstrap leg explicit subject")