fix: harden runtime API and simulation handling

[CyrusAuyeung]

Summary

Fixes #717.

This PR hardens the remaining runtime paths exposed by an end-to-end run with an OpenAI-compatible provider, Zep Cloud, and dual-platform simulation.

Provider and API compatibility

• Pass the configured API key, base URL, and provider-safe headers to direct OpenAI SDK clients and CAMEL simulation clients.
• Return validation-style 400 responses for malformed JSON request bodies instead of surfacing 500 errors.
• Read persisted simulation state with UTF-8 BOM tolerance.

Simulation lifecycle and IPC safety

• Verify real process liveness before accepting interview or deep-interaction IPC commands.
• Preserve completed simulation state during shutdown cleanup.
• Clean terminal-run logs before an explicit restart while refusing to discard pending graph-memory updates.
• Recognize reusable prepared configuration after a paused run, with regression coverage for the generated-config guard.
• Declare psutil as a direct backend dependency because simulation liveness imports it directly.

Action integrity and presentation

• Advance action cursors after initial seed posts so those posts are not replayed in the next round.
• Preserve multiple initial Twitter posts assigned to the same agent.
• Suppress idle and empty action cards while retaining meaningful like, dislike, comment, and follow activity.

Scope coordination

• fix: modernize Zep Cloud integration and dependency security #740 owns shared Zep query normalization; the duplicate query-limit implementation was removed from this PR.
• fix: harden ontology JSON generation across LLM providers #742 owns ontology structured-output validation, truncation retry, and safe provider-error handling; this PR preserves that implementation.
• fix(simulation): stop discarding an existing run when Step 3 remounts #758 independently covers Step 3 remount and existing-run recovery. To keep both PRs independently mergeable, the overlapping recovery and force hunk was removed from fix: harden runtime API and simulation handling #718. fix: harden runtime API and simulation handling #718 remains intended for merge for its independent runtime fixes; its remaining Step3Simulation.vue diff only concerns action filtering, counts, and display details.

Validation

• uv run python -m pytest -q: 135 passed
• npm run build: passed
• git diff --check: passed

The frontend build emits the existing warnings about a large JavaScript chunk and a module that is both statically and dynamically imported. No new warning is introduced here.

[666ghj]

Note

🤖 Automated maintainer response — Generated by the MiroFish triage agent and checked against main@d641759 on 2026-07-23. Posted with maintainer authorization; a maintainer may revise it.

Reviewed against current main. The Zep 400-character query cap in this PR has now landed through #740 at the shared service boundary with regression tests for both graph search and profile enrichment.

The provider configuration, IPC liveness, completed-state cleanup, initial-post handling, malformed JSON, BOM state, and psutil changes remain separate runtime work and have not been closed by #740. Please rebase and remove the now-duplicated Zep query change; this PR stays open for review of the remaining scope.

[CyrusAuyeung]

Addressed in the force-updated head 690a6a2:

• rebased fix: harden runtime API and simulation handling #718 onto main@d641759 (the fix: modernize Zep Cloud integration and dependency security #740 merge)
• removed the duplicated local Zep 400-character slicing from both graph search and profile enrichment; the PR now relies on fix: modernize Zep Cloud integration and dependency security #740's shared normalization boundary
• reconciled the simulation restart path with fix: modernize Zep Cloud integration and dependency security #740's graph lifecycle and pending-ingestion safeguards
• added regression coverage for terminal restart cleanup, pending graph updates, and preserving completed state during shutdown

Validation after the rebase: backend 113 passed, frontend production build passed, and git diff --check passed.

[666ghj]

Note

🤖 Automated maintainer response — Generated by the MiroFish maintenance agent after reviewing this PR against main@60757b3c on 2026-07-23. Posted with maintainer authorization; a maintainer may revise it.

Current main has advanced again through #742, which resolves the ontology structured-output, truncation, and opaque 500 path referenced in this PR and #717.

The remaining provider request/header handling, IPC liveness, completed-state cleanup, initial-post behavior, malformed request handling, BOM state, and simulation UI changes are independent and remain eligible for review. Please rebase onto main@60757b3c and reconcile any llm_client.py or ontology-error overlap with #742; do not reintroduce the superseded ontology path.

This PR stays open for the remaining runtime scope.

[CyrusAuyeung]

Addressed in the force-updated head d426d6b:

• rebased fix: harden runtime API and simulation handling #718 onto main@60757b3c after fix: harden ontology JSON generation across LLM providers #742
• preserved fix: harden ontology JSON generation across LLM providers #742's ontology structured-output parsing, truncation retry, and safe 502 error path without reintroducing the superseded implementation
• reconciled the remaining llm_client.py change so it only adds the provider-safe User-Agent header to fix: harden ontology JSON generation across LLM providers #742's new client constructor
• retained malformed graph request handling as an independent validation-path fix

Validation after the rebase: backend 133 passed, frontend production build passed, git diff --check passed, and origin/main is an ancestor of the updated head.

[kemo04]

AI Code Review (PR Review Agent)

• [Test Coverage · High] — backend/app/api/simulation.py (diff line 92): New simulation prepared status 'paused' is added to prepared_statuses without corresponding test coverage.

[CyrusAuyeung]

Addressed the test-coverage review in 747c6a0:

• added a parameterized regression test for persisted paused simulations
• verifies paused is reusable when all required files exist and config_generated=true
• verifies the same state is not treated as prepared when config_generated=false
• asserts the prepared result includes the persisted status and profile count

Validation: the focused module passes 4 tests, the full backend suite passes 135 tests, and git diff --check passes.

[CyrusAuyeung]

Scope reduced after the #758 cross-reference in bd4babb:

• removed only the overlapping Step 3 remount/existing-run recovery hunk to avoid duplicate code and future merge conflicts
• fix: harden runtime API and simulation handling #718 remains the original broader runtime-hardening PR and is still intended for merge on its independent provider, IPC, state, initial-post, and action-integrity fixes
• retained the independent Step 3 action filtering, counting, and display changes in fix: harden runtime API and simulation handling #718
• rewrote the PR description with proper Markdown formatting and explicit ownership boundaries for fix: modernize Zep Cloud integration and dependency security #740, fix: harden ontology JSON generation across LLM providers #742, and fix(simulation): stop discarding an existing run when Step 3 remounts #758

This is overlap coordination, not withdrawal of #718. Validation after the scope reduction: backend 135 passed, frontend production build passed, and git diff --check passed. GitHub reports the PR mergeable against current main; the commits added to main since #742 only affect Star History automation/assets/tests and do not overlap these runtime files.

[CyrusAuyeung]

@666ghj #718 is ready for maintainer review. I have addressed the prior maintainer and review feedback, added regression coverage for the persisted paused state, reconciled the merged #740/#742 changes, and removed only the duplicate Step 3 remount hunk that overlaps #758 to avoid a merge conflict. #718 remains intended for merge for its independent provider compatibility, IPC liveness, state handling, initial-post integrity, malformed-request handling, and action presentation fixes.

Current validation: backend 135 passed, frontend production build passed, and git diff --check passed. GitHub reports the branch as mergeable against current main. Please review the remaining #718 scope when convenient.