infra cleanups

.flox/env/manifest.lock

@@ -127,6 +127,9 @@
     "hook": {
       "on-activate": "if [[ -f .env ]]; then\n  set -a\n  source .env\n  set +a\nfi\n"
     },
+    "profile": {
+      "common": "if [[ -f .env ]]; then\n  set -a\n  source .env\n  set +a\nfi\n"
+    },
     "options": {
       "systems": [
         "aarch64-darwin",

.github/workflows/run_code_checks.yaml

@@ -3,10 +3,14 @@ name: Code checks
 run-name: Code checks
 on:
   pull_request:
+  push:
+    branches:
+      - master
 jobs:
   run_rust_code_checks:
     name: Run Rust code checks
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -20,6 +24,14 @@ jobs:
           sudo rm -rf "$AGENT_TOOLSDIRECTORY"
           echo "Disk space after cleanup:"
           df -h
+      - name: Install DuckDB system library
+        run: |
+          wget -q https://github.com/duckdb/duckdb/releases/download/v1.4.3/libduckdb-linux-amd64.zip
+          unzip libduckdb-linux-amd64.zip -d /tmp/duckdb
+          sudo mv /tmp/duckdb/libduckdb.so /usr/local/lib/
+          sudo mv /tmp/duckdb/*.h /usr/local/include/
+          sudo ldconfig
+          rm -rf /tmp/duckdb libduckdb-linux-amd64.zip
       - name: Install Flox
         uses: flox/install-flox-action@v2
       - name: Cache Rust dependencies
@@ -28,7 +40,7 @@ jobs:
           workspaces: .
           cache-on-failure: false
           shared-key: rust-continuous-integration
-          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+          save-if: ${{ github.ref == 'refs/heads/master' }}
       - name: Run Rust code checks
         uses: flox/activate-action@v1
         with:

applications/datamanager/Cargo.toml

@@ -34,7 +34,7 @@ tracing-subscriber = { version = "0.3.20", features = ["env-filter", "fmt"] }
 aws-config = "1.5"
 aws-sdk-s3 = "1.112"
 aws-credential-types = "1.2.6"
-duckdb = { version = "1.4.3", features = ["bundled", "r2d2", "chrono"] }
+duckdb = { version = "1.4.3", features = ["r2d2", "chrono"] }
 validator = { version = "0.20", features = ["derive"] }
 thiserror = "2.0.3"
 sentry = { version = "0.35", features = ["tracing", "reqwest", "rustls"] }

applications/datamanager/src/state.rs

@@ -38,7 +38,7 @@ impl State {
         let s3_client = S3Client::new(&config);
 
         let bucket_name =
-            std::env::var("AWS_S3_DATA_BUCKET_NAME").unwrap_or_else(|_| "oscm-data".to_string());
+            std::env::var("AWS_S3_DATA_BUCKET_NAME").unwrap_or_else(|_| "fund-data".to_string());
         info!("Using S3 bucket: {}", bucket_name);
 
         let massive_base_url = std::env::var("MASSIVE_BASE_URL")

applications/datamanager/tests/common/mod.rs

@@ -4,7 +4,7 @@ use aws_credential_types::Credentials;
 use aws_sdk_s3::{config::Region, primitives::ByteStream, Client as S3Client};
 use axum::Router;
 use std::{net::SocketAddr, sync::OnceLock, time::Duration};
-use testcontainers::runners::AsyncRunner;
+use testcontainers::{runners::AsyncRunner, ContainerAsync};
 use testcontainers_modules::localstack::LocalStack;
 use tokio::{net::TcpListener, sync::oneshot, task::JoinHandle};
 
@@ -14,6 +14,7 @@ const TEST_SECRET_KEY: &str = "test";
 const TEST_REGION: &str = "us-east-1";
 
 static LOCALSTACK_ENDPOINT: OnceLock<String> = OnceLock::new();
+static LOCALSTACK_CONTAINER: OnceLock<&'static ContainerAsync<LocalStack>> = OnceLock::new();
 static TRACING_INIT: std::sync::Once = std::sync::Once::new();
 
 pub struct EnvironmentVariableGuard {
@@ -107,14 +108,14 @@ pub async fn get_localstack_endpoint() -> String {
     // - Tests use #[serial] for sequential execution within this process
     // - All tests share the same LocalStack container for performance
     // - Container cleanup happens automatically when process exits
-    // - Alternative (proper Drop cleanup) requires complex lifetime management
-    //   across static OnceLock, creating more complexity than benefit
+    // - Storing container reference prevents testcontainers from losing port mapping
     //
     // Trade-off: Small memory leak during test execution vs architectural complexity
     // Impact: Container memory is reclaimed when test process terminates
-    Box::leak(Box::new(container));
-
+    let leaked_container: &'static ContainerAsync<LocalStack> = Box::leak(Box::new(container));
+    let _ = LOCALSTACK_CONTAINER.set(leaked_container);
     let _ = LOCALSTACK_ENDPOINT.set(endpoint.clone());
+
     endpoint
 }
 

applications/datamanager/tests/test_state_and_health.rs

@@ -85,7 +85,7 @@ async fn test_state_from_env_uses_defaults_when_variables_are_missing() {
 
     let state = State::from_env().await;
 
-    assert_eq!(state.bucket_name, "oscm-data");
+    assert_eq!(state.bucket_name, "fund-data");
     assert_eq!(state.massive.base, "https://api.massive.io");
     assert!(state.massive.key.is_empty());
 }

applications/equitypricemodel/src/equitypricemodel/server.py

@@ -58,7 +58,7 @@
 
 logger = structlog.get_logger()
 
-DATAMANAGER_BASE_URL = os.getenv("OSCM_DATAMANAGER_BASE_URL", "http://datamanager:8080")
+DATAMANAGER_BASE_URL = os.getenv("FUND_DATAMANAGER_BASE_URL", "http://datamanager:8080")
 
 
 def find_latest_artifact_key(
@@ -314,14 +314,24 @@ def create_predictions(request: Request) -> Response:
         )
     )
 
-    processed_predictions = predictions_schema.validate(processed_predictions)
+    try:
+        validated_result = predictions_schema.validate(processed_predictions)
+        validated_predictions = cast(
+            "pl.DataFrame",
+            validated_result.collect()
+            if isinstance(validated_result, pl.LazyFrame)
+            else validated_result,
+        )
+    except Exception:
+        logger.exception("Predictions failed schema validation")
+        return Response(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR)
 
     try:
         save_predictions_response = requests.post(
             url=f"{DATAMANAGER_BASE_URL}/predictions",
             json={
                 "timestamp": current_timestamp.isoformat(),
-                "data": processed_predictions.to_dicts(),
+                "data": validated_predictions.to_dicts(),
             },
             timeout=60,
         )
@@ -339,7 +349,7 @@ def create_predictions(request: Request) -> Response:
     logger.info("Successfully generated and saved predictions")
 
     return Response(
-        content=json.dumps({"data": processed_predictions.to_dicts()}).encode("utf-8"),
+        content=json.dumps({"data": validated_predictions.to_dicts()}).encode("utf-8"),
         status_code=status.HTTP_200_OK,
     )
 

applications/portfoliomanager/src/portfoliomanager/risk_management.py

@@ -9,7 +9,7 @@
 
 logger = structlog.get_logger()
 
-UNCERTAINTY_THRESHOLD = float(os.getenv("OSCM_UNCERTAINTY_THRESHOLD", "0.1"))
+UNCERTAINTY_THRESHOLD = float(os.getenv("FUND_UNCERTAINTY_THRESHOLD", "0.1"))
 REQUIRED_PORTFOLIO_SIZE = 20  # 10 long + 10 short
 SIDE_SIZE = REQUIRED_PORTFOLIO_SIZE // 2
 

applications/portfoliomanager/src/portfoliomanager/server.py

@@ -56,11 +56,11 @@
 
 application: FastAPI = FastAPI()
 
-DATAMANAGER_BASE_URL = os.getenv("OSCM_DATAMANAGER_BASE_URL", "http://datamanager:8080")
+DATAMANAGER_BASE_URL = os.getenv("FUND_DATAMANAGER_BASE_URL", "http://datamanager:8080")
 HTTP_NOT_FOUND = 404
 HTTP_BAD_REQUEST = 400
 EQUITYPRICEMODEL_BASE_URL = os.getenv(
-    "OSCM_EQUITYPRICEMODEL_BASE_URL",
+    "FUND_EQUITYPRICEMODEL_BASE_URL",
     "http://equitypricemodel:8080",
 )
 

infrastructure/Pulumi.production.yaml

@@ -1,2 +1,25 @@
 config:
-  aws:region: us-east-1
+  aws:region:
+    secure: AAABAHZdRn/VT0csV4a+3PcpSKdeMfYLIAPSZxB5TBpYzC/qCrJDtfU=
+  fund:budgetAlertEmailAddresses:
+    secure: AAABAEVOj8Wk2uRR16QLK4GVV/0Q7NqIgcpgPSEGeWeIDeq2l9JANRiPzcqKk0HfPYnJ1+x+DR0GeVYwvSENSURnq/Or5Bc0pMqMYHyMFbXqXp45VE6J2XuyaUSF8WQK3IyNcJr7HAoK/9VtRrttbQ==
+  fund:githubActionsRoleName: fund-github-actions-infrastructure-role
+  fund:sagemakerExecutionRoleName: fund-sagemaker-execution-role
+  fund:githubRepository: oscmcompany/fund
+  fund:githubBranch: master
+  fund:monthlyBudgetLimitUsd: "25"
+  fund:githubWorkflowFiles:
+    - launch_infrastructure.yaml
+    - teardown_infrastructure.yaml
+  fund:datamanagerSecretName:
+    secure: AAABALDuCuT721er5Kxz4DeVhpYFYB1U2k87kWMSWiIxDWE9nTss9OeI4Nv+Tu0w39hdQlcquPbZ330=
+  fund:datamanagerSecretValue:
+    secure: AAABAChRujETi2wJ+Tw2jj64uVvght6AMW5E+nuePkXqKXWyrMSVEIVQ5o9NRIHRRQ0wh1F3WzRW+BysSZhpdH/fULYOz9gtMmKlcG01uAApHdy8cWBk
+  fund:portfoliomanagerSecretName:
+    secure: AAABAJatHFOp4tQTL8lf14JfSYVM1GlUyFASwA+eLhdZ9Fe/xwzYDe8LrkFwjW8H6Uc8heRdNdKOur7OplyrJA==
+  fund:portfoliomanagerSecretValue:
+    secure: AAABAKW6YZV5HEHJBO04eh9QW/woEl/cvAgoDiURRH5e+YUwr+Muw6IR4hny+NQXrftQhk0EGS/E6OA1n9nElWqvjycm23MV/xR4CTlvW60CRQoQrOSWZuDdqmwv4KUa7qxVEZqYrPO86qJDBfXDIDJ5lkW8R1XmDR/+ubIV3nrkgvkEnXEtZWx1hzeXSsgfR7759Q0QXbSs8AfhGT8hxztiDxwDsSFQOA==
+  fund:sharedSecretName:
+    secure: AAABAMd0Q1ggmUrYldoYecdCllBpZ30N8F4Wnfvla9iX8FNIfC+3b+plSxGcI3s+JvIMOpoo
+  fund:sharedSecretValue:
+    secure: AAABACKTBgsKXMGiDo/WXf5/WTwxHIKAKYUGOMhCecEe09+g/huViXxO1fYA+I2EdIcxBk8zerAoxkOGNUMkik+45skuj3vUYHraOLiKmzSt9h7Z1R56ixPoNMrTSbCMjpHOHZSji0G7lH2qCdCj6jGH/aouZjZRsnPLGa5/pxjhe+1aUtuvwLoqr6IlyuPEkw==

infrastructure/Pulumi.yaml

@@ -1,4 +1,4 @@
-name: oscm
+name: fund
 runtime:
   name: python
   options: