rangebar 11.6.0__tar.gz → 11.6.1__tar.gz

{rangebar-11.6.0 → rangebar-11.6.1}/.mise.toml

@@ -17,12 +17,11 @@ GH_TOKEN = "{{ read_file(path=env.HOME ~ '/.claude/.secrets/gh-token-terrylica')
 GITHUB_TOKEN = "{{ read_file(path=env.HOME ~ '/.claude/.secrets/gh-token-terrylica') | trim }}"
 
 # =============================================================================
-# Doppler Configuration (SSoT for secrets)
+# 1Password Configuration (SSoT for secrets)
 # =============================================================================
-# PyPI: doppler secrets get PYPI_TOKEN --project claude-config --config prd
-# GitHub PAT: doppler secrets get GH_TOKEN_TERRYLICA --project main --config dev
-DOPPLER_PYPI_PROJECT = "claude-config"
-DOPPLER_PYPI_CONFIG = "prd"
+# PyPI: op item get djevteztvbcqgcm3yl4njkawjq --fields credential --reveal
+# GitHub PAT: stored in gh-token-terrylica file
+OP_PYPI_ITEM = "djevteztvbcqgcm3yl4njkawjq"
 
 # =============================================================================
 # ClickHouse Cache Configuration (SSoT for cache hosts)
@@ -435,7 +434,7 @@ description = "Preview what semantic-release would do (no changes)"
 run = "bun install --silent 2>/dev/null && GH_CONFIG_DIR=$HOME/.config/gh/profiles/terrylica GITHUB_TOKEN=$(gh auth token) bun run semantic-release --dry-run --no-ci"
 
 [tasks."release:pypi"]
-description = "Publish to PyPI using Doppler credentials (local-only, ADR-0027)"
+description = "Publish to PyPI using 1Password credentials (local-only, ADR-0027)"
 depends = ["release:build-all"]
 run = "./scripts/publish-to-pypi.sh"
 

{rangebar-11.6.0 → rangebar-11.6.1}/CHANGELOG.md

@@ -1,3 +1,12 @@
+## [11.6.1](https://github.com/terrylica/rangebar-py/compare/v11.6.0...v11.6.1) (2026-02-02)
+
+
+### Bug Fixes
+
+* **ci:** correct rust-toolchain action name ([fa252ce](https://github.com/terrylica/rangebar-py/commit/fa252ceeb1b2f3d4216fceb3e0eaf3fbdc4bed6a))
+* **ci:** simplify workflow to match working configuration ([5128fd6](https://github.com/terrylica/rangebar-py/commit/5128fd6a5ade367dbde371c186de0512095c0116))
+* **resource:** make auto_memory_guard() multiprocessing-safe (Issue [#61](https://github.com/terrylica/rangebar-py/issues/61)) ([b55057a](https://github.com/terrylica/rangebar-py/commit/b55057afb3a10f530ec8d1ac1520d81169ad5fcc))
+
 # [11.6.0](https://github.com/terrylica/rangebar-py/compare/v11.5.0...v11.6.0) (2026-02-02)
 
 

{rangebar-11.6.0 → rangebar-11.6.1}/Cargo.lock

@@ -3430,7 +3430,7 @@ dependencies = [
 
 [[package]]
 name = "rangebar"
-version = "11.6.0"
+version = "11.6.1"
 dependencies = [
  "chrono",
  "insta",
@@ -3452,7 +3452,7 @@ dependencies = [
 
 [[package]]
 name = "rangebar-batch"
-version = "11.6.0"
+version = "11.6.1"
 dependencies = [
  "polars",
  "rangebar-core",
@@ -3464,7 +3464,7 @@ dependencies = [
 
 [[package]]
 name = "rangebar-cli"
-version = "11.6.0"
+version = "11.6.1"
 dependencies = [
  "chrono",
  "clap",
@@ -3489,7 +3489,7 @@ dependencies = [
 
 [[package]]
 name = "rangebar-config"
-version = "11.6.0"
+version = "11.6.1"
 dependencies = [
  "chrono",
  "config",
@@ -3501,7 +3501,7 @@ dependencies = [
 
 [[package]]
 name = "rangebar-core"
-version = "11.6.0"
+version = "11.6.1"
 dependencies = [
  "ahash",
  "arrow",
@@ -3518,7 +3518,7 @@ dependencies = [
 
 [[package]]
 name = "rangebar-io"
-version = "11.6.0"
+version = "11.6.1"
 dependencies = [
  "polars",
  "rangebar-core",
@@ -3528,7 +3528,7 @@ dependencies = [
 
 [[package]]
 name = "rangebar-providers"
-version = "11.6.0"
+version = "11.6.1"
 dependencies = [
  "chrono",
  "csv",
@@ -3548,7 +3548,7 @@ dependencies = [
 
 [[package]]
 name = "rangebar-py"
-version = "11.6.0"
+version = "11.6.1"
 dependencies = [
  "arrow",
  "arrow-array",
@@ -3567,7 +3567,7 @@ dependencies = [
 
 [[package]]
 name = "rangebar-streaming"
-version = "11.6.0"
+version = "11.6.1"
 dependencies = [
  "async-trait",
  "chrono",

{rangebar-11.6.0 → rangebar-11.6.1}/Cargo.toml

@@ -10,7 +10,7 @@ resolver = "2"
 [workspace.package]
 # CRITICAL: Prevent crates.io publishing - this is a PyPI-only project
 publish = false
-version = "11.6.0"
+version = "11.6.1"
 authors = ["Terry Li <terry@eonlabs.com>"]
 categories = ["algorithms", "data-structures", "finance"]
 documentation = "https://docs.rs/rangebar"
@@ -97,7 +97,7 @@ criterion = { version = "0.5", features = ["html_reports"] }
 
 [package]
 name = "rangebar-py"
-version = "11.6.0"
+version = "11.6.1"
 edition = "2021"
 authors = ["Terry Li"]
 license = "MIT"

{rangebar-11.6.0 → rangebar-11.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rangebar
-Version: 11.6.0
+Version: 11.6.1
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Financial and Insurance Industry
 Classifier: License :: OSI Approved :: MIT License

{rangebar-11.6.0 → rangebar-11.6.1}/python/rangebar/resource_guard.py

@@ -6,6 +6,7 @@ using only stdlib modules (no psutil dependency).
 MEM-009: Process-level RLIMIT_AS cap (MemoryError instead of OOM kill)
 MEM-010: Pre-flight memory estimation before tick loading
 MEM-011: Environment variable default (RANGEBAR_MAX_MEMORY_GB)
+MEM-012: Multiprocessing-safe memory guard (Issue #61)
 
 Environment Variables
 ---------------------
@@ -18,7 +19,23 @@ RANGEBAR_MAX_MEMORY_PCT : float
     Default memory limit as fraction of total RAM (0.0-1.0).
     Example: RANGEBAR_MAX_MEMORY_PCT=0.7 (for 70% of RAM)
 
-If both are set, the smaller limit is used.
+RANGEBAR_NO_MEMORY_GUARD : str
+    Set to "1" to disable automatic memory guard entirely.
+    Useful for multiprocessing workers or when RLIMIT_AS conflicts
+    with Polars/Rust memory allocators.
+
+If both GB and PCT are set, the smaller limit is used.
+
+Multiprocessing Safety (Issue #61)
+----------------------------------
+On Linux, RLIMIT_AS (virtual address space) conflicts with mmap-based
+allocators used by Polars and Rust. This can cause "Cannot allocate memory"
+errors even when physical RAM is available.
+
+The auto_memory_guard() function:
+1. Skips if RANGEBAR_NO_MEMORY_GUARD=1
+2. Skips if running in a multiprocessing child (detected via _RANGEBAR_GUARD_PID)
+3. On Linux, uses RLIMIT_DATA instead of RLIMIT_AS to avoid mmap conflicts
 """
 
 from __future__ import annotations
@@ -120,6 +137,7 @@ def set_memory_limit(
     limit_bytes = min(limits)
 
     # MEM-009: Set process-level cap
+    # MEM-012: Use RLIMIT_DATA on Linux to avoid mmap conflicts (Issue #61)
     try:
         if sys.platform == "darwin":
             # macOS: RLIMIT_RSS is advisory (kernel doesn't enforce)
@@ -130,11 +148,19 @@ def set_memory_limit(
                 limit_bytes = hard_limit
             resource.setrlimit(resource.RLIMIT_RSS, (limit_bytes, limit_bytes))
         else:
-            # Linux: RLIMIT_AS is enforced by kernel
-            _, hard_limit = resource.getrlimit(resource.RLIMIT_AS)
+            # Linux: Use RLIMIT_DATA instead of RLIMIT_AS (Issue #61)
+            # RLIMIT_AS limits virtual address space including mmap regions,
+            # which conflicts with Polars/Rust allocators that use mmap().
+            # RLIMIT_DATA limits the data segment (heap) which is more
+            # appropriate for controlling actual memory allocation.
+            #
+            # Note: RLIMIT_DATA is less strict than RLIMIT_AS - it won't
+            # prevent mmap allocations, but it will limit malloc/brk usage.
+            # For full protection, users should rely on cgroups or systemd.
+            _, hard_limit = resource.getrlimit(resource.RLIMIT_DATA)
             if hard_limit != resource.RLIM_INFINITY and limit_bytes > hard_limit:
                 limit_bytes = hard_limit
-            resource.setrlimit(resource.RLIMIT_AS, (limit_bytes, limit_bytes))
+            resource.setrlimit(resource.RLIMIT_DATA, (limit_bytes, limit_bytes))
     except (ValueError, OSError):
         # Can't set limit (e.g., unprivileged user, macOS restrictions)
         return -1
@@ -149,6 +175,10 @@ def set_memory_limit(
 # Mutable container to track if memory limit was applied (avoids global stmt)
 _memory_limit_state: dict[str, bool] = {"applied": False}
 
+# MEM-012: Environment variable key for multiprocessing-safe state tracking
+# This survives fork() and allows child processes to detect parent's limit
+_GUARD_PID_KEY = "_RANGEBAR_GUARD_PID"
+
 
 def _parse_env_float(name: str) -> float | None:
     """Parse environment variable as float, returning None on failure."""
@@ -245,13 +275,42 @@ def ensure_memory_limit(
     return limit
 
 
+def _is_multiprocessing_child() -> bool:
+    """Check if we're in a multiprocessing child process (MEM-012).
+
+    Detects if memory guard was already applied by a parent process
+    by checking the _RANGEBAR_GUARD_PID environment variable.
+
+    Returns True if:
+    1. _RANGEBAR_GUARD_PID is set (parent applied the guard)
+    2. Current PID differs from stored PID (we're a child)
+    """
+    guard_pid = os.environ.get(_GUARD_PID_KEY)
+    if not guard_pid:
+        return False
+
+    try:
+        parent_pid = int(guard_pid)
+        # If our PID differs from the stored PID, we're a child
+        # The child inherits the RLIMIT from parent, no need to re-apply
+        return os.getpid() != parent_pid
+    except ValueError:
+        return False
+
+
 def auto_memory_guard() -> int:
-    """Automatically enable memory guard at module import (MEM-011).
+    """Automatically enable memory guard at module import (MEM-011, MEM-012).
 
     This function is called when `import rangebar` is executed.
     It ensures a memory limit is always set unless explicitly disabled
     via RANGEBAR_NO_MEMORY_GUARD=1.
 
+    Multiprocessing Safety (Issue #61)
+    ----------------------------------
+    - Skips if RANGEBAR_NO_MEMORY_GUARD=1
+    - Skips if running in a multiprocessing child (limit inherited from parent)
+    - On Linux, uses RLIMIT_DATA instead of RLIMIT_AS to avoid mmap conflicts
+
     Returns
     -------
     int
@@ -266,9 +325,24 @@ def auto_memory_guard() -> int:
     RANGEBAR_MAX_MEMORY_PCT : float
         Override default limit as fraction of RAM.
     """
+    # Check explicit disable first
     if os.environ.get("RANGEBAR_NO_MEMORY_GUARD") == "1":
         return -1
-    return ensure_memory_limit()
+
+    # MEM-012: Skip in multiprocessing children (Issue #61)
+    # Child processes inherit RLIMIT from parent via fork()
+    if _is_multiprocessing_child():
+        _memory_limit_state["applied"] = True  # Mark as handled
+        return -1
+
+    # Apply the limit
+    limit = ensure_memory_limit()
+
+    # MEM-012: Store our PID so child processes can detect inheritance
+    if limit > 0:
+        os.environ[_GUARD_PID_KEY] = str(os.getpid())
+
+    return limit
 
 
 @dataclass(frozen=True)

{rangebar-11.6.0 → rangebar-11.6.1}/scripts/publish-to-pypi.sh

@@ -1,13 +1,13 @@
 #!/bin/bash
-# PyPI Publishing with Doppler Secret Management (Local-Only)
+# PyPI Publishing with 1Password Secret Management (Local-Only)
 #
 # WORKSPACE-WIDE POLICY: This script must ONLY run on local machines.
 # CI/CD publishing is forbidden - see ADR-0027 for rationale.
 #
 # Prerequisites:
-#   - Doppler CLI installed (brew install dopplerhq/cli/doppler)
+#   - 1Password CLI installed (brew install 1password-cli)
 #   - uv package manager installed (curl -LsSf https://astral.sh/uv/install.sh | sh)
-#   - PYPI_TOKEN stored in Doppler (project: claude-config, config: prd)
+#   - PyPI token stored in 1Password (item: djevteztvbcqgcm3yl4njkawjq)
 #   - pyproject.toml with name and version fields
 #
 # Usage:
@@ -20,13 +20,10 @@
 set -euo pipefail
 
 # ============================================================================
-# CONFIGURATION (ADR: 2025-12-08-mise-env-centralized-config)
+# CONFIGURATION
 # ============================================================================
-# Environment variables with defaults for backward compatibility.
-# These can be pre-set via mise [env] or exported manually.
-DOPPLER_PROJECT="${DOPPLER_PROJECT:-claude-config}"
-DOPPLER_CONFIG="${DOPPLER_CONFIG:-prd}"
-DOPPLER_PYPI_SECRET="${DOPPLER_PYPI_SECRET:-PYPI_TOKEN}"
+# 1Password item ID for PyPI token (project-scoped for rangebar)
+OP_PYPI_ITEM="${OP_PYPI_ITEM:-djevteztvbcqgcm3yl4njkawjq}"
 PYPI_VERIFY_DELAY="${PYPI_VERIFY_DELAY:-3}"
 
 # ============================================================================
@@ -217,26 +214,26 @@ echo ""
 echo "Publishing to PyPI (Local Workflow)"
 echo "======================================================"
 
-# Step 0: Verify Doppler token is available
-echo -e "\n Step 0: Verifying Doppler credentials..."
+# Step 0: Verify 1Password token is available
+echo -e "\n Step 0: Verifying 1Password credentials..."
 
-if ! command -v doppler &> /dev/null; then
-    echo "   ERROR: Doppler CLI not installed"
-    echo "   Install: brew install dopplerhq/cli/doppler"
+if ! command -v op &> /dev/null; then
+    echo "   ERROR: 1Password CLI not installed"
+    echo "   Install: brew install 1password-cli"
     exit 1
 fi
 
-# Try to get PYPI_TOKEN from Doppler (configurable via env vars)
-if ! PYPI_TOKEN=$(doppler secrets get "$DOPPLER_PYPI_SECRET" --project "$DOPPLER_PROJECT" --config "$DOPPLER_CONFIG" --plain 2>/dev/null); then
-    echo "   ERROR: $DOPPLER_PYPI_SECRET not found in Doppler"
+# Try to get PyPI token from 1Password
+if ! PYPI_TOKEN=$(op item get "$OP_PYPI_ITEM" --fields credential --reveal 2>/dev/null); then
+    echo "   ERROR: PyPI token not found in 1Password (item: $OP_PYPI_ITEM)"
     echo ""
-    echo "   To fix, run:"
-    echo "     doppler secrets set $DOPPLER_PYPI_SECRET='your-token' --project $DOPPLER_PROJECT --config $DOPPLER_CONFIG"
+    echo "   To fix, create a PyPI token and save to 1Password:"
+    echo "     1. Get token from: https://pypi.org/manage/account/token/"
+    echo "     2. Save to 1Password with: op item create --category='API Credential' --title='PyPI Token' 'credential=pypi-xxx'"
     echo ""
-    echo "   Get token from: https://pypi.org/manage/account/token/"
     exit 1
 fi
-echo "   Doppler token verified"
+echo "   1Password token verified"
 
 # Step 1: Verify pyproject.toml exists
 echo -e "\n Step 1: Reading package info from pyproject.toml..."
@@ -309,18 +306,28 @@ else
     echo "   Built: dist/${PACKAGE_NAME}-${CURRENT_VERSION}*"
 fi
 
-# Step 4: Publish to PyPI using Doppler token
-echo -e "\n Step 4: Publishing to PyPI..."
-echo "   Using $DOPPLER_PYPI_SECRET from Doppler ($DOPPLER_PROJECT/$DOPPLER_CONFIG)"
-
-# Use UV_PUBLISH_TOKEN environment variable for security (no token in process list)
-UV_PUBLISH_TOKEN="${PYPI_TOKEN}" $UV_CMD publish 2>&1 | grep -E "(Uploading|succeeded|Failed)" || \
-    UV_PUBLISH_TOKEN="${PYPI_TOKEN}" $UV_CMD publish
+# Step 3: Publish to PyPI using twine (more reliable for maturin projects)
+echo -e "\n Step 3: Publishing to PyPI..."
+echo "   Using PyPI token from 1Password"
+
+# Use twine for maturin projects (uv publish has issues with pre-built wheels)
+if grep -q '\[tool.maturin\]' pyproject.toml; then
+    # Publish all wheels and sdist for current version
+    TWINE_USERNAME=__token__ TWINE_PASSWORD="${PYPI_TOKEN}" twine upload \
+        "dist/${PACKAGE_NAME}-${CURRENT_VERSION}"-*.whl \
+        "target/wheels/${PACKAGE_NAME}-${CURRENT_VERSION}.tar.gz" 2>&1 || \
+    TWINE_USERNAME=__token__ TWINE_PASSWORD="${PYPI_TOKEN}" twine upload \
+        "dist/${PACKAGE_NAME}-${CURRENT_VERSION}"-*.whl
+else
+    # Use UV_PUBLISH_TOKEN environment variable for security (no token in process list)
+    UV_PUBLISH_TOKEN="${PYPI_TOKEN}" $UV_CMD publish 2>&1 | grep -E "(Uploading|succeeded|Failed)" || \
+        UV_PUBLISH_TOKEN="${PYPI_TOKEN}" $UV_CMD publish
+fi
 
 echo "   Published to PyPI"
 
-# Step 5: Verify publication on PyPI
-echo -e "\n Step 5: Verifying on PyPI..."
+# Step 4: Verify publication on PyPI
+echo -e "\n Step 4: Verifying on PyPI..."
 sleep "$PYPI_VERIFY_DELAY"
 
 # Check if package version is live on PyPI