fix(authbridge): Pin most-recent A2A intent against FIFO eviction

The session store evicts the oldest events when a bucket exceeds
maxEvents (default 100). This is the right policy in general but
catastrophic for one specific event: the inbound A2A request that
carries the user's intent, which IBAC's LastIntent() relies on to
align outbound tool calls. A chatty agent can fill the buffer with
inference + MCP + observability events in seconds, evicting the
intent and breaking IBAC for the rest of the turn.

listener.skip_hosts is the right primary fix when the offending
traffic is identifiable infrastructure. This commit adds a
defense-in-depth backstop in the store itself: the eviction policy
now pins the most-recent inbound A2A request event so it survives
FIFO trimming. Other events evict in chronological order; the
protected intent stays at its original timestamp, leaving a visible
time gap in the timeline (consumers like abctl see events in the
same monotonic order they were appended, just with a gap).

Only the most-recent intent is pinned. Older intents from earlier
turns evict normally so a multi-turn conversation with huge fan-out
cannot starve the buffer with stale intents. The intent predicate
matches SessionView.LastIntent exactly, so the eviction policy and
the consumer view cannot drift apart.

Tests cover: GSM8K reproducer (intent survives 20 chatty events),
no-intent regression (FIFO unchanged for non-intent buckets),
multi-turn with only most-recent pinned, fast-path when intent is
already in the keep window, chronological-order preservation, and
the all-intents pathological bucket (maxEvents still respected).

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Kelly Abuelsaad <kaymar@gmail.com>

Author: kellyaa

authbridge/CLAUDE.md

@@ -579,14 +579,18 @@ See [`docs/framework-architecture.md`](docs/framework-architecture.md#9-config-h
 
 10. **Outbound passthrough is the safe default**: The `DEFAULT_OUTBOUND_POLICY` defaults to `passthrough`, which means outbound traffic to LLM inference endpoints (e.g., Ollama via `host.docker.internal`) passes through without token exchange. If this were set to `exchange`, all outbound HTTP calls would attempt token exchange and fail for non-Keycloak destinations.
 
-11. **Chatty observability traffic can evict the IBAC user intent**: The session store is FIFO with a default cap of 100 events per session. If an outbound destination is high-volume (e.g., an OpenTelemetry collector sidecar that exports dozens of times per agent turn), each export becomes a session event and the original inbound A2A user intent rolls out the back of the buffer within seconds. IBAC then sees `LastIntent() == nil` and falls through to the `no_user_context` skip path with `sub_reason: no_intent`, allowing every tool call after the first without LLM-judged alignment. Mitigate by listing the offending hosts under `listener.skip_hosts` in the runtime config — matched destinations bypass the pipeline AND session recording entirely (transparent forward), so they no longer compete with agent-meaningful events for buffer slots. Patterns use the same `.`-delimited glob semantics as `authproxy-routes`; ports are stripped before matching. Example:
-    ```yaml
-    listener:
-      skip_hosts:
-        - "otel-collector.*.svc.cluster.local"
-        - "*.metrics.local"
-    ```
-    Any change to `listener.skip_hosts` requires a pod restart (same rule as other `listener.*` fields). Do NOT add hosts here that need IBAC / token-exchange policy applied — bypass means bypass.
+11. **Chatty observability traffic and IBAC user intent**: The session store is FIFO with a default cap of 100 events per session. Two layered defenses keep the inbound A2A user intent visible to IBAC even when an agent generates dozens of outbound events per turn:
+
+    - **Primary fix — `listener.skip_hosts`**: list infrastructure destinations (OTel collectors, metrics endpoints, log shippers) whose traffic should bypass the pipeline AND session recording entirely. Matched requests are forwarded as a transparent proxy: no plugin runs, no event is appended. Patterns use the same `.`-delimited glob semantics as `authproxy-routes`; ports are stripped before matching. Example:
+      ```yaml
+      listener:
+        skip_hosts:
+          - "otel-collector.*.svc.cluster.local"
+          - "*.metrics.local"
+      ```
+      Any change to `listener.skip_hosts` requires a pod restart (same rule as other `listener.*` fields). Do NOT add hosts here that need IBAC / token-exchange policy applied — bypass means bypass.
+
+    - **Backstop — intent pin in the eviction policy**: even with `skip_hosts` empty, the session store now pins the most-recent inbound A2A request event against FIFO eviction. If the buffer overflows, every other event evicts in normal chronological order; the protected intent stays at its original timestamp, leaving a visible time gap in the timeline. Older intents from earlier turns are NOT pinned — only the latest one — so a multi-turn conversation with huge fan-out can't pile up stale intents and starve the buffer. This means IBAC's `LastIntent()` will return non-nil as long as ANY inbound A2A request landed in the bucket since session start, regardless of how chatty the outbound traffic is. The pin is defense-in-depth; reach for `skip_hosts` first when the offending traffic is identifiable infrastructure.
 
 ## DCO Sign-Off (Mandatory)
 

authbridge/authlib/session/intent_pin_test.go

@@ -0,0 +1,205 @@
+package session
+
+import (
+	"testing"
+	"time"
+
+	"github.com/kagenti/kagenti-extensions/authbridge/authlib/pipeline"
+)
+
+// intent fabricates the same shape SessionView.LastIntent recognizes:
+// inbound A2A request event. Tests below assert that this exact shape
+// survives FIFO eviction so IBAC's LastIntent never returns nil after
+// chatty traffic floods the buffer.
+func intent(method string) pipeline.SessionEvent {
+	return pipeline.SessionEvent{
+		At:        time.Now(),
+		Direction: pipeline.Inbound,
+		Phase:     pipeline.SessionRequest,
+		A2A:       &pipeline.A2AExtension{Method: method},
+	}
+}
+
+// chatter fabricates an outbound non-intent event. Stand-in for the
+// OTel exports / inference calls / tool calls that flooded the bucket
+// in the GSM8K reproducer.
+func chatter(tag string) pipeline.SessionEvent {
+	return pipeline.SessionEvent{
+		At:        time.Now(),
+		Direction: pipeline.Outbound,
+		Phase:     pipeline.SessionRequest,
+		MCP:       &pipeline.MCPExtension{Method: tag},
+	}
+}
+
+// TestStore_PinsIntentAcrossEviction reproduces the GSM8K bug at the
+// store level: an inbound A2A intent followed by enough chatty
+// outbound traffic to overflow maxEvents. Pre-fix, the intent rolled
+// out the back of the FIFO and LastIntent returned nil. Post-fix the
+// intent must survive — that's the property IBAC depends on.
+func TestStore_PinsIntentAcrossEviction(t *testing.T) {
+	s := New(5*time.Minute, 5, 0)
+
+	s.Append("sess", intent("solve-math"))
+	for i := 0; i < 20; i++ {
+		s.Append("sess", chatter("chat"))
+	}
+
+	v := s.View("sess")
+	if v == nil {
+		t.Fatal("View returned nil")
+	}
+	if len(v.Events) != 5 {
+		t.Fatalf("Events len = %d, want 5 (capped at maxEvents)", len(v.Events))
+	}
+	last := v.LastIntent()
+	if last == nil {
+		t.Fatal("LastIntent() = nil; intent must survive eviction even when buried under chatter")
+	}
+	if last.A2A == nil || last.A2A.Method != "solve-math" {
+		t.Errorf("LastIntent A2A.Method = %v, want solve-math", last.A2A)
+	}
+}
+
+// TestStore_NoIntent_FifoEvictionUnchanged is the regression guard:
+// a bucket with no intent in it must keep behaving exactly like
+// today's FIFO. Pinning logic must not change non-intent buckets.
+func TestStore_NoIntent_FifoEvictionUnchanged(t *testing.T) {
+	s := New(5*time.Minute, 3, 0)
+
+	for i := 0; i < 5; i++ {
+		ev := chatter(string(rune('a' + i)))
+		s.Append("sess", ev)
+	}
+
+	v := s.View("sess")
+	if len(v.Events) != 3 {
+		t.Fatalf("Events len = %d, want 3", len(v.Events))
+	}
+	// Oldest two evicted: surviving methods are c, d, e.
+	want := []string{"c", "d", "e"}
+	for i, w := range want {
+		if v.Events[i].MCP.Method != w {
+			t.Errorf("Events[%d].MCP.Method = %q, want %q", i, v.Events[i].MCP.Method, w)
+		}
+	}
+}
+
+// TestStore_OnlyMostRecentIntentPinned: a bucket with multiple
+// intents (multi-turn conversation) must pin only the LATEST.
+// Older intents evict via normal FIFO so pathological traffic
+// (many turns + huge fan-out) can't starve the buffer with stale
+// intents.
+func TestStore_OnlyMostRecentIntentPinned(t *testing.T) {
+	s := New(5*time.Minute, 3, 0)
+
+	s.Append("sess", intent("turn-1"))
+	s.Append("sess", chatter("c1"))
+	s.Append("sess", intent("turn-2"))
+	for i := 0; i < 10; i++ {
+		s.Append("sess", chatter("flood"))
+	}
+
+	v := s.View("sess")
+	if len(v.Events) != 3 {
+		t.Fatalf("Events len = %d, want 3", len(v.Events))
+	}
+	last := v.LastIntent()
+	if last == nil || last.A2A == nil || last.A2A.Method != "turn-2" {
+		t.Errorf("LastIntent.A2A.Method = %v, want turn-2 (only the latest intent is pinned)", last)
+	}
+	// Older intent should be gone (evicted by FIFO with only the
+	// latest pinned).
+	for _, e := range v.Events {
+		if e.A2A != nil && e.A2A.Method == "turn-1" {
+			t.Errorf("turn-1 intent survived; only the most recent intent should be pinned")
+		}
+	}
+}
+
+// TestStore_IntentInKeepWindow_TrivialFifo: when the intent is
+// already in the keep window (i.e. plain FIFO would preserve it
+// anyway), the result is byte-identical to plain FIFO. Catches
+// regressions where the pin path mutates or reorders unnecessarily.
+func TestStore_IntentInKeepWindow_TrivialFifo(t *testing.T) {
+	s := New(5*time.Minute, 3, 0)
+
+	s.Append("sess", chatter("a"))
+	s.Append("sess", chatter("b"))
+	s.Append("sess", intent("recent-intent"))
+	s.Append("sess", chatter("c"))
+	s.Append("sess", chatter("d"))
+
+	v := s.View("sess")
+	if len(v.Events) != 3 {
+		t.Fatalf("Events len = %d, want 3", len(v.Events))
+	}
+	// Plain FIFO would preserve [intent, c, d] — and the intent is
+	// already in the keep window, so the pin path takes the fast
+	// branch and produces exactly that.
+	if v.Events[0].A2A == nil || v.Events[0].A2A.Method != "recent-intent" {
+		t.Errorf("Events[0] = %v, want recent-intent (FIFO order preserved)", v.Events[0])
+	}
+	if v.Events[1].MCP == nil || v.Events[1].MCP.Method != "c" {
+		t.Errorf("Events[1].MCP.Method = %v, want c", v.Events[1].MCP)
+	}
+	if v.Events[2].MCP == nil || v.Events[2].MCP.Method != "d" {
+		t.Errorf("Events[2].MCP.Method = %v, want d", v.Events[2].MCP)
+	}
+}
+
+// TestStore_PinnedIntentChronologicalOrder: with the intent pinned
+// from the eviction prefix, the surviving slice must still be
+// chronologically ordered (At ascending). Consumers like abctl
+// render events in slice order assuming monotonic time; a
+// non-monotonic result here would break the timeline UI.
+func TestStore_PinnedIntentChronologicalOrder(t *testing.T) {
+	s := New(5*time.Minute, 3, 0)
+
+	// Append intent first so it has the earliest timestamp, then
+	// flood with chatter. Pin path keeps intent at index 0 and the
+	// most-recent two chatters at indices 1, 2.
+	intentEv := intent("first")
+	intentEv.At = time.Date(2026, 1, 1, 12, 0, 0, 0, time.UTC)
+	s.Append("sess", intentEv)
+	for i := 0; i < 10; i++ {
+		ev := chatter("chat")
+		ev.At = time.Date(2026, 1, 1, 12, 0, i+1, 0, time.UTC)
+		s.Append("sess", ev)
+	}
+
+	v := s.View("sess")
+	if len(v.Events) != 3 {
+		t.Fatalf("Events len = %d, want 3", len(v.Events))
+	}
+	for i := 1; i < len(v.Events); i++ {
+		if !v.Events[i].At.After(v.Events[i-1].At) {
+			t.Errorf("Events[%d].At (%v) not after Events[%d].At (%v) — pin must preserve chronological order",
+				i, v.Events[i].At, i-1, v.Events[i-1].At)
+		}
+	}
+	if v.Events[0].A2A == nil || v.Events[0].A2A.Method != "first" {
+		t.Errorf("Events[0] should be the pinned intent, got %v", v.Events[0])
+	}
+}
+
+// TestStore_AllIntentsBucket: a pathological bucket made entirely
+// of intent events must still respect maxEvents. Only the most
+// recent intent is "protected" — the rest evict via plain FIFO.
+// This bounds the worst case (intents alone cannot starve the buffer).
+func TestStore_AllIntentsBucket(t *testing.T) {
+	s := New(5*time.Minute, 3, 0)
+
+	for i := 0; i < 10; i++ {
+		s.Append("sess", intent(string(rune('a'+i))))
+	}
+
+	v := s.View("sess")
+	if len(v.Events) != 3 {
+		t.Fatalf("Events len = %d, want 3 (maxEvents must hold even for all-intent buckets)", len(v.Events))
+	}
+	last := v.LastIntent()
+	if last == nil || last.A2A == nil || last.A2A.Method != "j" {
+		t.Errorf("LastIntent.Method = %v, want j (most recent intent)", last)
+	}
+}

authbridge/authlib/session/store.go

@@ -193,10 +193,7 @@ func (s *Store) Append(sessionID string, event pipeline.SessionEvent) {
 	s.publishLocked(event)
 
 	if s.maxEvents > 0 && len(sess.Events) > s.maxEvents {
-		excess := len(sess.Events) - s.maxEvents
-		trimmed := make([]pipeline.SessionEvent, s.maxEvents)
-		copy(trimmed, sess.Events[excess:])
-		sess.Events = trimmed
+		sess.Events = trimEventsPinIntent(sess.Events, s.maxEvents)
 	}
 
 	// Evict oldest session if cap is exceeded.
@@ -205,6 +202,77 @@ func (s *Store) Append(sessionID string, event pipeline.SessionEvent) {
 	}
 }
 
+// isIntentEvent matches the SessionView.LastIntent predicate: an
+// inbound A2A request event. IBAC and any future intent-aware
+// guardrail call LastIntent and need the most recent such event to
+// survive FIFO eviction. Defined here so the eviction policy and
+// the consumer view can never drift apart.
+func isIntentEvent(e pipeline.SessionEvent) bool {
+	return e.Direction == pipeline.Inbound &&
+		e.Phase == pipeline.SessionRequest &&
+		e.A2A != nil
+}
+
+// trimEventsPinIntent reduces events to len <= maxEvents while
+// preserving the most-recent intent event, even when that intent
+// sits in the prefix that FIFO would normally evict. All other
+// events evict in chronological order; the protected intent stays
+// at its original index, leaving a temporal gap between it and the
+// first non-evicted event after it. That gap is visible in
+// /v1/sessions and abctl as a discontinuity in the timeline, which
+// is the right shape: the intent's append time is preserved
+// (consumers can correlate against the inbound request's wall-clock
+// timestamp) and chronological order across surviving events stays
+// monotonic.
+//
+// Why pin only the MOST-RECENT intent: a session can carry several
+// user turns ("solve this", then "now do that") and only the latest
+// is what IBAC aligns subsequent tool calls against. Pinning all
+// intents would let stale ones pile up under pathological loads
+// (slow turns + huge fan-out) and starve the buffer.
+//
+// Pathological case — the buffer is mostly intents, exceeds
+// maxEvents, and only the latest is pinned: older intents evict via
+// normal FIFO. There is no scenario where this returns more than
+// maxEvents events.
+//
+// Caller guarantees len(events) > maxEvents and maxEvents > 0;
+// otherwise this is a no-op shape (returns events unchanged).
+func trimEventsPinIntent(events []pipeline.SessionEvent, maxEvents int) []pipeline.SessionEvent {
+	if maxEvents <= 0 || len(events) <= maxEvents {
+		return events
+	}
+	excess := len(events) - maxEvents
+
+	// Locate the most-recent intent. If it sits in the keep window
+	// (index >= excess) it survives a plain FIFO trim — fast path.
+	intentIdx := -1
+	for i := len(events) - 1; i >= 0; i-- {
+		if isIntentEvent(events[i]) {
+			intentIdx = i
+			break
+		}
+	}
+	if intentIdx == -1 || intentIdx >= excess {
+		// No protected event in the eviction prefix; FIFO trim.
+		trimmed := make([]pipeline.SessionEvent, maxEvents)
+		copy(trimmed, events[excess:])
+		return trimmed
+	}
+
+	// Protected intent is in the eviction prefix. Build the result
+	// as: [pinned intent] ++ [last maxEvents-1 non-intent-prefix
+	// events]. We keep the intent at the front so its original
+	// timestamp is preserved AND the resulting slice stays
+	// chronologically ordered (intent.At < kept-tail.At by construction —
+	// it's the oldest surviving event).
+	out := make([]pipeline.SessionEvent, 0, maxEvents)
+	out = append(out, events[intentIdx])
+	tailStart := len(events) - (maxEvents - 1)
+	out = append(out, events[tailStart:]...)
+	return out
+}
+
 // View returns a read-only snapshot of the session's events.
 // Returns nil if the session doesn't exist or is expired.
 func (s *Store) View(sessionID string) *pipeline.SessionView {