diff --git a/requirements.txt b/requirements.txt
index 4c8afea..ab717df 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -13,5 +13,5 @@ numpy>=1.24.0
 opencv-python-headless>=4.8.0
 # Core artdag from GitHub (tracks main branch)
 git+https://github.com/gilesbradshaw/art-dag.git@main
-# Shared components
-git+https://git.rose-ash.com/art-dag/common.git@889ea98
+# Shared components (tracks master branch)
+git+https://git.rose-ash.com/art-dag/common.git@master
diff --git a/tests/test_auth.py b/tests/test_auth.py
new file mode 100644
index 0000000..a4eb163
--- /dev/null
+++ b/tests/test_auth.py
@@ -0,0 +1,42 @@
+"""
+Tests for authentication service.
+"""
+
+import pytest
+
+
+class TestUserContext:
+    """Tests for UserContext dataclass."""
+
+    def test_user_context_accepts_l2_server(self) -> None:
+        """
+        Regression test: UserContext must accept l2_server field.
+
+        Bug found 2026-01-12: auth_service.py passes l2_server to UserContext
+        but the art-common library was pinned to old version without this field.
+        """
+        from artdag_common.middleware.auth import UserContext
+
+        # This should not raise TypeError
+        ctx = UserContext(
+            username="testuser",
+            actor_id="@testuser@example.com",
+            token="test-token",
+            l2_server="https://l2.example.com",
+        )
+
+        assert ctx.username == "testuser"
+        assert ctx.actor_id == "@testuser@example.com"
+        assert ctx.token == "test-token"
+        assert ctx.l2_server == "https://l2.example.com"
+
+    def test_user_context_l2_server_optional(self) -> None:
+        """l2_server should be optional (default None)."""
+        from artdag_common.middleware.auth import UserContext
+
+        ctx = UserContext(
+            username="testuser",
+            actor_id="@testuser@example.com",
+        )
+
+        assert ctx.l2_server is None