BeeOS integration follow-ups and rollout lifecycle hardening

config.yaml

@@ -48,7 +48,7 @@ modules:
   - class: modules::observability::OtelModule
     config:
       enabled: true
-      exporter: stdout
+      exporter: memory
       metrics_enabled: true
       logs_enabled: true
       alerts:

crates/tui/src/main.rs

@@ -235,8 +235,15 @@ impl App {
     }
 
     fn client() -> reqwest::Client {
+        let mut headers = reqwest::header::HeaderMap::new();
+        if let Ok(key) = std::env::var("AGENTOS_API_KEY") {
+            if let Ok(val) = reqwest::header::HeaderValue::from_str(&format!("Bearer {}", key)) {
+                headers.insert(reqwest::header::AUTHORIZATION, val);
+            }
+        }
         reqwest::Client::builder()
             .timeout(std::time::Duration::from_secs(5))
+            .default_headers(headers)
             .build()
             .unwrap_or_default()
     }
@@ -525,7 +532,7 @@ impl App {
         let agent_id = if self.chat_agent.is_empty() {
             self.agents.first()
                 .and_then(|a| a["id"].as_str().or(a["name"].as_str()))
-                .unwrap_or("default")
+                .unwrap_or("brain")
                 .to_string()
         } else {
             self.chat_agent.clone()
@@ -1276,7 +1283,7 @@ fn draw_chat(f: &mut Frame, app: &App, area: Rect) {
     let agent_label = if app.chat_agent.is_empty() {
         app.agents.first()
             .and_then(|a| a["name"].as_str())
-            .unwrap_or("default")
+            .unwrap_or("brain")
     } else {
         &app.chat_agent
     };

docs/reviews/sentrux/2026-04-04-022609-codex-agentos-tsc-cleanup.md

@@ -0,0 +1,37 @@
+# Sentrux Review Report
+
+- Actor: `codex`
+- Scope: `agentos-tsc-cleanup`
+- Timestamp: `2026-04-04T02:26:09+07:00`
+- Worktree: `/home/wunitb/unitb_labs/wunb-agentos-beeos/.worktrees/agentos-beeos-main-runtime`
+- Base commit: `4b4de07e2603d71f87bee17a91a8185dcb82e6a7`
+
+## Commands Used
+
+```text
+npx tsc -p tsconfig.json --noEmit --pretty false
+npm test -- src/__tests__/mcp-client.test.ts src/__tests__/security-headers.test.ts src/__tests__/skillkit-bridge.test.ts src/__tests__/streaming.test.ts src/__tests__/llm-router.test.ts src/__tests__/session-lifecycle.test.ts src/__tests__/cron.test.ts src/__tests__/api.test.ts
+git diff --check
+Sentrux scan: /home/wunitb/unitb_labs/wunb-agentos-beeos/.worktrees/agentos-beeos-main-runtime
+Sentrux check_rules
+```
+
+## Findings
+
+- Severity: medium
+- Area: TypeScript compile hygiene and iii-sdk contract drift
+- Evidence: `tsc` initially failed on test mock signatures, `request_format`/`response_format` shape in `src/api.ts`, `unknown` state-list returns in `src/context-cache.ts`, `src/cron.ts`, and `src/session-lifecycle.ts`, plus drift around `agentTier`, `function_id`, and `globalThis.vitest`.
+- Recommended change: align local typings with current iii-sdk schema contract, keep request/response schemas wrapped in a top-level object format node, and prefer explicit narrowing/casts at `state::*` boundaries instead of relying on `any`.
+
+## Handoff For Dev Session
+
+- Files likely affected:
+  `src/api.ts`, `src/llm-router.ts`, `src/types.ts`, `src/context-cache.ts`, `src/cron.ts`, `src/session-lifecycle.ts`, `src/shared/metrics.ts`, `src/evolve.ts`, targeted test files.
+- First fix to attempt:
+  Re-run `tsc` first whenever `iii-sdk` is upgraded, because compile errors clearly expose contract drift before runtime.
+- Verification expected after fix:
+  `npx tsc -p tsconfig.json --noEmit --pretty false` exits 0 and the targeted vitest slice above stays green.
+
+## MegaMemory Update
+
+- Created concept: `agentos-runtime-typescript-contract-cleanup`

src/__tests__/cron.test.ts

@@ -44,14 +44,15 @@ const mockTrigger = vi.fn(async (fnId: string, data?: any): Promise<any> => {
   return null;
 });
 const mockTriggerVoid = vi.fn();
+const mockRegisterTrigger = vi.fn();
 
 const handlers: Record<string, Function> = {};
 vi.mock("iii-sdk", () => ({
   registerWorker: () => ({
     registerFunction: (config: any, handler: Function) => {
       handlers[config.id] = handler;
     },
-    registerTrigger: vi.fn(),
+    registerTrigger: mockRegisterTrigger,
     trigger: (req: any) =>
       req.action
         ? mockTriggerVoid(req.function_id, req.payload)
@@ -158,3 +159,29 @@ describe("cron::reset_rate_limits", () => {
     expect(getScope("rates").has("expired-rate")).toBe(false);
   });
 });
+
+describe("cron trigger registration", () => {
+  it("registers built-in cron jobs with six-field expressions", () => {
+    expect(mockRegisterTrigger).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: "cron",
+        function_id: "cron::cleanup_stale_sessions",
+        config: { expression: "0 0 */6 * * *" },
+      }),
+    );
+    expect(mockRegisterTrigger).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: "cron",
+        function_id: "cron::aggregate_daily_costs",
+        config: { expression: "0 0 * * * *" },
+      }),
+    );
+    expect(mockRegisterTrigger).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: "cron",
+        function_id: "cron::reset_rate_limits",
+        config: { expression: "0 */5 * * * *" },
+      }),
+    );
+  });
+});

src/__tests__/eval.test.ts

@@ -239,6 +239,68 @@ describe("eval::suite", () => {
       call("eval::suite", authReq({ suiteId: "nope" })),
     ).rejects.toThrow("Suite not found");
   });
+
+  it("returns suite metadata and baseline comparison context BeeOS can display", async () => {
+    seedKv("eval_suites", "suite-routing", {
+      suiteId: "suite-routing",
+      name: "Routing Suite",
+      functionId: "test::double",
+      metadata: {
+        candidateClass: "routing",
+        baselineFunctionId: "beeos::route-task-baseline",
+      },
+      testCases: [
+        {
+          input: { value: 2 },
+          expected: { result: 4 },
+          scorer: "exact_match",
+        },
+      ],
+    });
+
+    const result = await call(
+      "eval::suite",
+      authReq({ suiteId: "suite-routing" }),
+    );
+
+    expect(result.metadata).toEqual({
+      candidateClass: "routing",
+      baselineFunctionId: "beeos::route-task-baseline",
+      baselineAggregate: expect.objectContaining({
+        testCount: 1,
+      }),
+    });
+  });
+
+  it("preserves weighted aggregation for candidate suite results", async () => {
+    seedKv("eval_suites", "weighted-suite", {
+      suiteId: "weighted-suite",
+      name: "Weighted Suite",
+      functionId: "test::double",
+      testCases: [
+        {
+          input: { value: 2 },
+          expected: { result: 999 },
+          scorer: "exact_match",
+          weight: 1,
+        },
+        {
+          input: { value: 5 },
+          expected: { result: 10 },
+          scorer: "exact_match",
+          weight: 3,
+        },
+      ],
+    });
+
+    const result = await call(
+      "eval::suite",
+      authReq({ suiteId: "weighted-suite" }),
+    );
+
+    expect(result.aggregate.correctness).toBe(0.75);
+    expect(result.aggregate.passRate).toBe(0.5);
+  });
 });
 
 describe("eval::history", () => {

src/__tests__/evolve.test.ts

@@ -157,6 +157,32 @@ describe("evolve::generate", () => {
       call("evolve::generate", authReq({ goal: "test" })),
     ).rejects.toThrow("goal, name, and agentId are required");
   });
+
+  it("preserves candidate class and rollout metadata on generated records", async () => {
+    const result = await call(
+      "evolve::generate",
+      authReq({
+        goal: "Improve routing",
+        name: "router_candidate",
+        agentId: "agent-1",
+        metadata: {
+          candidateClass: "routing",
+          riskLabel: "medium",
+          rolloutState: "draft",
+          rolloutHint: "shadow",
+          sourceObservationId: "obs-1",
+        },
+      }),
+    );
+
+    expect(result.metadata).toMatchObject({
+      candidateClass: "routing",
+      riskLabel: "medium",
+      rolloutState: "draft",
+      rolloutHint: "shadow",
+      sourceObservationId: "obs-1",
+    });
+  });
 });
 
 describe("evolve::register", () => {
@@ -216,6 +242,14 @@ describe("evolve::register", () => {
     );
     expect(result.registered).toBe(false);
     expect(result.reason).toContain("Security scan failed");
+    expect(getScope("evolved_functions").get("evolved::bad_v1")).toEqual(
+      expect.objectContaining({
+        status: "killed",
+        metadata: expect.objectContaining({
+          rolloutState: "killed",
+        }),
+      }),
+    );
 
     mockTrigger.mockImplementation(originalImpl);
   });
@@ -239,6 +273,71 @@ describe("evolve::register", () => {
       call("evolve::register", authReq({})),
     ).rejects.toThrow("functionId is required");
   });
+
+  it("preserves BeeOS candidate metadata through registration while advancing rollout state", async () => {
+    seedKv("evolved_functions", "evolved::router_v1", {
+      functionId: "evolved::router_v1",
+      code: "async (input) => { return input; }",
+      description: "routing candidate",
+      authorAgentId: "agent-1",
+      version: 1,
+      status: "draft",
+      securityReport: { scanSafe: false, sandboxPassed: false, findingCount: 0 },
+      metadata: {
+        candidateClass: "routing",
+        riskLabel: "medium",
+        rolloutState: "draft",
+        rolloutHint: "shadow",
+      },
+    });
+
+    await call(
+      "evolve::register",
+      authReq({ functionId: "evolved::router_v1" }),
+    );
+
+    expect(getScope("evolved_functions").get("evolved::router_v1")).toEqual(
+      expect.objectContaining({
+        status: "staging",
+        metadata: expect.objectContaining({
+          candidateClass: "routing",
+          riskLabel: "medium",
+          rolloutState: "staging",
+          rolloutHint: "shadow",
+        }),
+      }),
+    );
+  });
+
+  it("marks rollout metadata killed when sandbox validation fails", async () => {
+    seedKv("evolved_functions", "evolved::sandbox_bad_v1", {
+      functionId: "evolved::sandbox_bad_v1",
+      code: "async () => { throw new Error('boom'); }",
+      description: "sandbox fail",
+      authorAgentId: "agent-1",
+      version: 1,
+      status: "draft",
+      securityReport: { scanSafe: false, sandboxPassed: false, findingCount: 0 },
+      metadata: {
+        rolloutState: "draft",
+      },
+    });
+
+    const result = await call(
+      "evolve::register",
+      authReq({ functionId: "evolved::sandbox_bad_v1" }),
+    );
+
+    expect(result.registered).toBe(false);
+    expect(getScope("evolved_functions").get("evolved::sandbox_bad_v1")).toEqual(
+      expect.objectContaining({
+        status: "killed",
+        metadata: expect.objectContaining({
+          rolloutState: "killed",
+        }),
+      }),
+    );
+  });
 });
 
 describe("evolve::unregister", () => {
@@ -258,6 +357,7 @@ describe("evolve::unregister", () => {
 
     const stored: any = getScope("evolved_functions").get("evolved::rm_v1");
     expect(stored.status).toBe("killed");
+    expect(stored.metadata.rolloutState).toBe("killed");
   });
 
   it("rejects non-author agents", async () => {