What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Frontmatter

id	15606
title	Document github-pat security posture: allowedUsers + auto-provision exclusion
state	Closed
labels	documentationaisecurity
assignees	neo-kimi-phoebe
createdAt	Jul 20, 2026, 3:24 PM
updatedAt	Jul 20, 2026, 3:37 PM
githubUrl	https://github.com/neomjs/neo/issues/15606
author	neo-kimi-phoebe
commentsCount	0
parentIssue	15598
subIssues	[]
subIssuesCompleted	0
subIssuesTotal	0
contentTrust
projected
quarantined	0
signals	[]
blockedBy	[]
blocking	[]
closedAt	Jul 20, 2026, 3:37 PM

Document github-pat security posture: allowedUsers + auto-provision exclusion

Closed Backlog/active-chunk-8 documentationaisecurity

neo-kimi-phoebe commented on Jul 20, 2026, 3:24 PM

Context

Author-owned follow-up from the cross-family review of PR #15601 (github-pat auth mode, merged) — Vega's APPROVE+FOLLOW-UP verdict (PRR_kwDODSospM8AAAABGjxJiQ): the code is merge-safe (defaults are secure), but two security-posture documentation gaps remain. The gaps only bite because GitHub is a public identity surface — unlike the private-tenant deployment gitlab-pat was built for, any GitHub user can mint a valid PAT.

Live latest-open sweep: checked latest 20 open issues at 2026-07-20T13:20Z — no equivalent. A2A in-flight sweep: no competing claim.

The Problem

Silent posture requirement: with an empty allowedUsers (the default), a github-pat deployment authenticates any github.com user — read-tier MCP access plus identity-less add_memory (graph-gated tools still fail-closed since github-pat is not in the default autoProvisionIdentitySources). The docs do not flag that a github-pat deployment SHOULD set allowedUsers unless it deliberately serves the public.
Unrecorded exclusion rationale: autoProvisionIdentitySources defaults to ['gitlab-pat'] — correctly excluding github-pat — but the leaf carries no comment recording WHY. A future maintainer could add 'github-pat' and open AgentIdentity auto-provisioning to any valid GitHub PAT holder, without the trade-off being visible at the decision point.

The Architectural Reality

ai/configBase.mjs auth section — the autoProvisionIdentitySources leaf (NEO_AUTH_AUTO_PROVISION_IDENTITY_SOURCES, default ['gitlab-pat']) and the shared allowedUsers leaf.
learn/agentos/cloud-deployment/Security.md — the GitHub bearer mode bullet added by PR #15601.
The auth≠admission relationship: #14388 (auth success without a bound AgentIdentity leaves graph-gated tools failing) — the reason the default exclusion is safe, and the thing to link from the leaf comment.

The Fix

Security.md — extend the GitHub bearer mode bullet: a github-pat deployment SHOULD set NEO_AUTH_ALLOWED_USERS (or front the surface with an equivalently scoped allowlist/GHES boundary); with the default empty allowlist, ANY GitHub user authenticates at read tier with identity-less writes.
configBase.mjs — extend the autoProvisionIdentitySources leaf comment: record the deliberate exclusion — github-pat is a public identity surface, so auto-provisioning is opt-in only for deployments that scope their caller set (allowlist, GHES, or private network); link the #14388 auth≠admission relationship.

Decision Record impact

none — documentation + comment-only; no behavior change.

Acceptance Criteria

Security.md github-pat bullet carries the allowedUsers posture requirement
autoProvisionIdentitySources leaf comment records the exclusion WHY + the #14388 relationship
No runtime/config-shape change (parity snapshot untouched)

Out of Scope

Fetch-timeout hardening on the PAT verifiers (tracked separately).
Any change to the default autoProvisionIdentitySources value or the allowlist mechanics.

Parent: #15598 (github-pat auth mode) / PR #15601
Review verdict: Vega's APPROVE+FOLLOW-UP on PR #15601
#14388 (auto-provision AgentIdentity — the auth≠admission precedent)

Origin Session ID: 8d4ce1c3-0bf2-4bb0-bad9-e49836248afe

Retrieval Hint: "github-pat security posture allowedUsers public identity surface auto-provision exclusion"