runledger-cli 0.1.6__tar.gz → 0.2.1__tar.gz

runledger_cli-0.2.1/PKG-INFO

@@ -0,0 +1,224 @@
+Metadata-Version: 2.4
+Name: runledger-cli
+Version: 0.2.1
+Summary: Self-hosted SQL-style query engine over your team's experiment JSON
+Author: Ahmed Rafat
+License: MIT
+Project-URL: Repository, https://github.com/ahmedrafatcse/run-ledger
+Project-URL: Documentation, https://github.com/ahmedrafatcse/run-ledger/tree/master/docs
+Project-URL: Issues, https://github.com/ahmedrafatcse/run-ledger/issues
+Project-URL: Changelog, https://github.com/ahmedrafatcse/run-ledger/releases
+Keywords: experiments,json,postgresql,sql,ml,research,cli
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Science/Research
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Java
+Classifier: Topic :: Scientific/Engineering
+Classifier: Topic :: Database
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests
+Requires-Dist: rich
+Dynamic: license-file
+
+
+# RunLedger
+
+[![PyPI version](https://img.shields.io/pypi/v/runledger-cli)](https://pypi.org/project/runledger-cli/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+**A self-hosted, SQL-style query engine over your team's experiment JSON.**
+
+Point it at the JSON your runs produce. Query nested fields, aggregate across runs, and pull back the exact array element that matched. Every submission is a version — never an overwrite — so you can see who submitted it, when, and whether the file has changed since.
+
+> *How do you query JSON with no schema?*
+> 
+> *Who on your team ran this? Has it changed since?*
+
+*Built for labs, thesis groups, and small research teams.*
+
+<!-- Add a 15-second GIF here: search nested JSON → inspect matching array element → aggregate → compare versions. -->
+
+---
+
+## Query your JSON like a database
+
+Experiment output nests metrics inside configs, arrays, and per-sample results. RunLedger provides a purpose-built query interface over those fields — structured comparisons, full-text with stemming, fuzzy matching, compound conditions, aggregation — without a predefined schema or prior metric registration.
+
+```bash
+# Comparison operators over any dot-path
+runledger search --metric accuracy --op gt --value 0.9 --batch sweep-42
+
+# Reach inside an array — and get back the exact matching element
+runledger search --metric results[].sst2_cacc --op lt --value 0.7 --batch sweep-42
+
+# Compound AND/OR across nested paths
+runledger search \
+  --metric accuracy --op gt --value 0.9 \
+  --metric loss     --op lt --value 0.2 \
+  --combine and --batch sweep-42
+
+# Aggregate and group, including over arrays
+runledger aggregate --metric accuracy          --agg AVG --group-by experiment --batch sweep-42
+runledger aggregate --metric results[].accuracy --agg AVG --group-by experiment --batch sweep-42
+```
+
+**Exact array-element pointers.** When an array query matches, RunLedger returns *which field matched and where* — the specific element, not just "this run matched":
+
+```
+sweep-42/run-7.json
+  results[3].sst2_cacc = 0.62
+  results[9].sst2_cacc = 0.68
+```
+
+That's the difference between "some array element passed your filter" and "element 3 and element 9 passed, and here are their values."
+
+The same query capabilities are available through the web UI — rendered as tables, with the same inline pointers.
+
+---
+
+## What the shared record gives you
+
+**Version history.** Resubmitting the same `_source.file` and `_source.index` creates a new version — never an overwrite. The old version stays. The run detail page links to `/runs/{id}/history` (every version of a run identity) and `/runs/compare?id1=X&id2=Y` (field-by-field diff between two versions).
+
+**Team isolation.** Only your team sees your team's runs. A foreign team's rows are invisible, not forbidden — `SELECT` returns nothing, `/runs/{id}` returns 404. This is enforced at the database layer, so it holds even if a service method forgets to filter.
+
+**Change detection.** Every submission stores a fingerprint of its payload. Open a run and RunLedger recomputes and compares — if the payload was modified after upload, the badge goes red. States: **Verified** / **Tampered** / **Stale** / **Cannot verify**.
+
+---
+
+## Stack
+
+**PostgreSQL 16** with JSONB and GIN indexes. **Spring Boot 3.4** for the REST API and the server-rendered Thymeleaf UI. **Python 3.10+** for the CLI, which manages the Docker stack for you.
+
+Team isolation is enforced by Row-Level Security in the database. The application connects as a non-owner role; every request runs under a session identity Postgres validates. Access rules live in RLS policies, not in application code.
+
+---
+
+## Install
+
+```bash
+pip install runledger-cli
+runledger guided
+```
+
+**You need Docker** — the only required dependency beyond Python. The backend (Postgres + the Java app) runs entirely inside containers. The CLI starts and stops them automatically. If Docker isn't installed, the CLI detects that on first run and links you to the installer.
+
+---
+
+## Quick start
+
+```bash
+runledger scan ~/experiments --batch my-sweep
+runledger search --metric accuracy --op gt --value 0.9 --batch my-sweep
+runledger aggregate --metric accuracy --agg AVG --group-by experiment --batch my-sweep
+```
+
+New here? Run `runledger` with no arguments — the guided wizard walks you through your first scan and search.
+
+> **Tip:** `python -m cli.ledger` works interchangeably with `runledger` on any platform.
+
+### Web UI
+
+With the stack running, open `http://localhost:8080` and log in with a development user ID (see [Development identity](#development-identity)).
+
+| Page | What it does |
+|---|---|
+| **Runs** (`/`) | Everything you can see. Click a file for its payload, integrity badge, and version history. |
+| **Compare** (`/query/compare`) | N conditions with AND/OR. Match pointers show which array element hit. |
+| **Phrase** (`/query/phrase`) | Full-text search with stemming; optional fuzzy matching for typos. |
+| **Aggregate** (`/query/aggregate`) | `AVG` / `MAX` / `MIN` / `SUM` / `COUNT`, with optional group-by. Supervisors get a team selector. |
+| **Batches** (`/batches`) | Every batch you can see, grouped by team. Click through to browse its metric keys. |
+| **Saved** (`/saved`) | Named queries. Re-run opens the query page with params prefilled. Personal — no one else can see or delete yours. |
+| **Submit** (`/submit`) | Paste JSON or upload a file. Researchers only. Requires `_source.file` in the payload. |
+
+Server-rendered throughout. No SPA, no build step.
+
+---
+
+## Installing from source
+
+```bash
+git clone https://github.com/ahmedrafatcse/run-ledger.git
+cd run-ledger
+docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d --build
+pip install -e .
+```
+
+The dev override is required. It publishes port `8080`, which is what the browser UI and the Python tests expect. Starting with only `docker-compose.yml` doesn't expose `8080` and the UI will not be reachable.
+
+### Troubleshooting
+
+<details>
+<summary>Windows – <code>runledger</code> not recognized</summary>
+
+On some Windows systems the Python Scripts folder is not automatically added to PATH. Two options:
+
+1. **Add the Scripts folder to PATH permanently** (recommended):
+   - Find the install location: `pip show runledger-cli | findstr Location`
+   - Navigate to that folder, then up one level to the `Scripts` directory.
+   - Add that `Scripts` path to your system PATH via **System Properties > Environment Variables**.
+   - Restart your terminal.
+
+2. **Use the Python module fallback** (works immediately, no PATH changes):
+   ```bash
+   python -m cli.ledger
+   ```
+   All subcommands and the guided wizard work exactly the same way.
+</details>
+
+<details>
+<summary>Fedora / RHEL – Backend can't reach PostgreSQL (UnknownHostException)</summary>
+
+Fedora's `firewalld` can block Docker's internal bridge networking, causing the app container to fail DNS resolution for `postgres`. Fix:
+
+```bash
+sudo firewall-cmd --zone=trusted --add-interface=docker0 --permanent
+sudo firewall-cmd --reload
+sudo systemctl restart docker
+```
+
+If you still see a port conflict (`port is already allocated`), check whether another process is using 5432 (`sudo ss -tulpn | grep 5432`) and either stop it or change the host port mapping.
+</details>
+
+---
+
+## Metric paths
+
+Address any value with a dot-path — `accuracy`, `metrics.loss`, `results[].sst2_cacc`. Shorthand (`cacc`) resolves automatically when unambiguous. Run `runledger metrics --batch <batch>` to see everything discovered in a scan, or add `--verbose` for full paths.
+
+---
+
+## Development identity
+
+The browser login is a **development identity stub, not authentication**. There is no password, no OAuth, no SSO. You enter a user ID; the session is populated from `app_users`.
+
+**Do not expose this configuration to untrusted users or networks.** A network boundary does not turn a stub into authentication — every request that reaches the app carries whatever user ID the caller declares. A real deployment needs an authentication mechanism in front of this before relying on the identity model for access control.
+
+Demo users from `demo/seed.sql`:
+
+| ID | Role | Team |
+|---|---|---|
+| `aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa` | researcher | Team A |
+| `bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb` | researcher | Team B |
+| `cccccccc-cccc-cccc-cccc-cccccccccccc` | supervisor | assigned to both teams |
+
+Visit `http://localhost:8080/login` and paste an ID. For API access, pass the same ID in an `X-User-Id` header. Role and team are looked up server-side — the client cannot declare which team it belongs to, but it *can* declare which user it is, which is exactly why this stub isn't authentication
+
+---
+
+## Docs
+
+- [API reference](https://github.com/ahmedrafatcse/run-ledger/blob/master/docs/api.md)
+- [Usage examples](https://github.com/ahmedrafatcse/run-ledger/blob/master/docs/examples.md)
+
+---
+
+## License
+
+MIT

runledger_cli-0.2.1/README.md

@@ -0,0 +1,196 @@
+
+# RunLedger
+
+[![PyPI version](https://img.shields.io/pypi/v/runledger-cli)](https://pypi.org/project/runledger-cli/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+**A self-hosted, SQL-style query engine over your team's experiment JSON.**
+
+Point it at the JSON your runs produce. Query nested fields, aggregate across runs, and pull back the exact array element that matched. Every submission is a version — never an overwrite — so you can see who submitted it, when, and whether the file has changed since.
+
+> *How do you query JSON with no schema?*
+> 
+> *Who on your team ran this? Has it changed since?*
+
+*Built for labs, thesis groups, and small research teams.*
+
+<!-- Add a 15-second GIF here: search nested JSON → inspect matching array element → aggregate → compare versions. -->
+
+---
+
+## Query your JSON like a database
+
+Experiment output nests metrics inside configs, arrays, and per-sample results. RunLedger provides a purpose-built query interface over those fields — structured comparisons, full-text with stemming, fuzzy matching, compound conditions, aggregation — without a predefined schema or prior metric registration.
+
+```bash
+# Comparison operators over any dot-path
+runledger search --metric accuracy --op gt --value 0.9 --batch sweep-42
+
+# Reach inside an array — and get back the exact matching element
+runledger search --metric results[].sst2_cacc --op lt --value 0.7 --batch sweep-42
+
+# Compound AND/OR across nested paths
+runledger search \
+  --metric accuracy --op gt --value 0.9 \
+  --metric loss     --op lt --value 0.2 \
+  --combine and --batch sweep-42
+
+# Aggregate and group, including over arrays
+runledger aggregate --metric accuracy          --agg AVG --group-by experiment --batch sweep-42
+runledger aggregate --metric results[].accuracy --agg AVG --group-by experiment --batch sweep-42
+```
+
+**Exact array-element pointers.** When an array query matches, RunLedger returns *which field matched and where* — the specific element, not just "this run matched":
+
+```
+sweep-42/run-7.json
+  results[3].sst2_cacc = 0.62
+  results[9].sst2_cacc = 0.68
+```
+
+That's the difference between "some array element passed your filter" and "element 3 and element 9 passed, and here are their values."
+
+The same query capabilities are available through the web UI — rendered as tables, with the same inline pointers.
+
+---
+
+## What the shared record gives you
+
+**Version history.** Resubmitting the same `_source.file` and `_source.index` creates a new version — never an overwrite. The old version stays. The run detail page links to `/runs/{id}/history` (every version of a run identity) and `/runs/compare?id1=X&id2=Y` (field-by-field diff between two versions).
+
+**Team isolation.** Only your team sees your team's runs. A foreign team's rows are invisible, not forbidden — `SELECT` returns nothing, `/runs/{id}` returns 404. This is enforced at the database layer, so it holds even if a service method forgets to filter.
+
+**Change detection.** Every submission stores a fingerprint of its payload. Open a run and RunLedger recomputes and compares — if the payload was modified after upload, the badge goes red. States: **Verified** / **Tampered** / **Stale** / **Cannot verify**.
+
+---
+
+## Stack
+
+**PostgreSQL 16** with JSONB and GIN indexes. **Spring Boot 3.4** for the REST API and the server-rendered Thymeleaf UI. **Python 3.10+** for the CLI, which manages the Docker stack for you.
+
+Team isolation is enforced by Row-Level Security in the database. The application connects as a non-owner role; every request runs under a session identity Postgres validates. Access rules live in RLS policies, not in application code.
+
+---
+
+## Install
+
+```bash
+pip install runledger-cli
+runledger guided
+```
+
+**You need Docker** — the only required dependency beyond Python. The backend (Postgres + the Java app) runs entirely inside containers. The CLI starts and stops them automatically. If Docker isn't installed, the CLI detects that on first run and links you to the installer.
+
+---
+
+## Quick start
+
+```bash
+runledger scan ~/experiments --batch my-sweep
+runledger search --metric accuracy --op gt --value 0.9 --batch my-sweep
+runledger aggregate --metric accuracy --agg AVG --group-by experiment --batch my-sweep
+```
+
+New here? Run `runledger` with no arguments — the guided wizard walks you through your first scan and search.
+
+> **Tip:** `python -m cli.ledger` works interchangeably with `runledger` on any platform.
+
+### Web UI
+
+With the stack running, open `http://localhost:8080` and log in with a development user ID (see [Development identity](#development-identity)).
+
+| Page | What it does |
+|---|---|
+| **Runs** (`/`) | Everything you can see. Click a file for its payload, integrity badge, and version history. |
+| **Compare** (`/query/compare`) | N conditions with AND/OR. Match pointers show which array element hit. |
+| **Phrase** (`/query/phrase`) | Full-text search with stemming; optional fuzzy matching for typos. |
+| **Aggregate** (`/query/aggregate`) | `AVG` / `MAX` / `MIN` / `SUM` / `COUNT`, with optional group-by. Supervisors get a team selector. |
+| **Batches** (`/batches`) | Every batch you can see, grouped by team. Click through to browse its metric keys. |
+| **Saved** (`/saved`) | Named queries. Re-run opens the query page with params prefilled. Personal — no one else can see or delete yours. |
+| **Submit** (`/submit`) | Paste JSON or upload a file. Researchers only. Requires `_source.file` in the payload. |
+
+Server-rendered throughout. No SPA, no build step.
+
+---
+
+## Installing from source
+
+```bash
+git clone https://github.com/ahmedrafatcse/run-ledger.git
+cd run-ledger
+docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d --build
+pip install -e .
+```
+
+The dev override is required. It publishes port `8080`, which is what the browser UI and the Python tests expect. Starting with only `docker-compose.yml` doesn't expose `8080` and the UI will not be reachable.
+
+### Troubleshooting
+
+<details>
+<summary>Windows – <code>runledger</code> not recognized</summary>
+
+On some Windows systems the Python Scripts folder is not automatically added to PATH. Two options:
+
+1. **Add the Scripts folder to PATH permanently** (recommended):
+   - Find the install location: `pip show runledger-cli | findstr Location`
+   - Navigate to that folder, then up one level to the `Scripts` directory.
+   - Add that `Scripts` path to your system PATH via **System Properties > Environment Variables**.
+   - Restart your terminal.
+
+2. **Use the Python module fallback** (works immediately, no PATH changes):
+   ```bash
+   python -m cli.ledger
+   ```
+   All subcommands and the guided wizard work exactly the same way.
+</details>
+
+<details>
+<summary>Fedora / RHEL – Backend can't reach PostgreSQL (UnknownHostException)</summary>
+
+Fedora's `firewalld` can block Docker's internal bridge networking, causing the app container to fail DNS resolution for `postgres`. Fix:
+
+```bash
+sudo firewall-cmd --zone=trusted --add-interface=docker0 --permanent
+sudo firewall-cmd --reload
+sudo systemctl restart docker
+```
+
+If you still see a port conflict (`port is already allocated`), check whether another process is using 5432 (`sudo ss -tulpn | grep 5432`) and either stop it or change the host port mapping.
+</details>
+
+---
+
+## Metric paths
+
+Address any value with a dot-path — `accuracy`, `metrics.loss`, `results[].sst2_cacc`. Shorthand (`cacc`) resolves automatically when unambiguous. Run `runledger metrics --batch <batch>` to see everything discovered in a scan, or add `--verbose` for full paths.
+
+---
+
+## Development identity
+
+The browser login is a **development identity stub, not authentication**. There is no password, no OAuth, no SSO. You enter a user ID; the session is populated from `app_users`.
+
+**Do not expose this configuration to untrusted users or networks.** A network boundary does not turn a stub into authentication — every request that reaches the app carries whatever user ID the caller declares. A real deployment needs an authentication mechanism in front of this before relying on the identity model for access control.
+
+Demo users from `demo/seed.sql`:
+
+| ID | Role | Team |
+|---|---|---|
+| `aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa` | researcher | Team A |
+| `bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb` | researcher | Team B |
+| `cccccccc-cccc-cccc-cccc-cccccccccccc` | supervisor | assigned to both teams |
+
+Visit `http://localhost:8080/login` and paste an ID. For API access, pass the same ID in an `X-User-Id` header. Role and team are looked up server-side — the client cannot declare which team it belongs to, but it *can* declare which user it is, which is exactly why this stub isn't authentication
+
+---
+
+## Docs
+
+- [API reference](https://github.com/ahmedrafatcse/run-ledger/blob/master/docs/api.md)
+- [Usage examples](https://github.com/ahmedrafatcse/run-ledger/blob/master/docs/examples.md)
+
+---
+
+## License
+
+MIT

{runledger_cli-0.1.6 → runledger_cli-0.2.1}/cli/guided.py

@@ -13,6 +13,31 @@ from rich.progress import Progress
 from rich.prompt import Prompt, Confirm
 from rich.table import Table
 
+# ---------------------------------------------------------------------------
+# Identity header — applied to every requests call in this file.
+#
+# The backend requires an X-User-Id header on every request (Slice 4). The
+# filter rejects requests without it. Until real authentication exists, the
+# CLI sends a development identity, overridable via RUNLEDGER_USER_ID.
+# ---------------------------------------------------------------------------
+import os as _os
+import requests as _requests
+
+_DEV_USER_ID = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"  # Alice, from dev seed
+
+def _install_identity_header():
+    _original_request = _requests.Session.request
+    def _request_with_identity(self, method, url, **kwargs):
+        headers = dict(kwargs.pop("headers", {}) or {})
+        headers.setdefault(
+            "X-User-Id",
+            _os.environ.get("RUNLEDGER_USER_ID", _DEV_USER_ID),
+        )
+        return _original_request(self, method, url, headers=headers, **kwargs)
+    _requests.Session.request = _request_with_identity
+
+_install_identity_header()
+
 # ------------------------------------------------------------
 # Configuration – must match backend settings
 # ------------------------------------------------------------

{runledger_cli-0.1.6 → runledger_cli-0.2.1}/cli/ledger.py

@@ -36,6 +36,31 @@ from rich.progress import Progress
 from rich.prompt import Prompt, Confirm
 from rich.table import Table
 
+# ---------------------------------------------------------------------------
+# Identity header — applied to every requests call in this file.
+#
+# The backend requires an X-User-Id header on every request (Slice 4). The
+# filter rejects requests without it. Until real authentication exists, the
+# CLI sends a development identity, overridable via RUNLEDGER_USER_ID.
+# ---------------------------------------------------------------------------
+import os as _os
+import requests as _requests
+
+_DEV_USER_ID = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"  # Alice, from dev seed
+
+def _install_identity_header():
+    _original_request = _requests.Session.request
+    def _request_with_identity(self, method, url, **kwargs):
+        headers = dict(kwargs.pop("headers", {}) or {})
+        headers.setdefault(
+            "X-User-Id",
+            _os.environ.get("RUNLEDGER_USER_ID", _DEV_USER_ID),
+        )
+        return _original_request(self, method, url, headers=headers, **kwargs)
+    _requests.Session.request = _request_with_identity
+
+_install_identity_header()
+
 # ------------------------------------------------------------
 # Force UTF‑8 output so Rich can render box‑drawing characters
 # ------------------------------------------------------------

runledger_cli-0.2.1/cli/tests/conftest.py

@@ -0,0 +1,21 @@
+"""
+Test session configuration.
+
+The CLI reads RUNLEDGER_BASE_URL at import time to compute API_BASE and
+HEALTH_URL. Setting it here — before pytest imports any test module — makes
+the tests deterministic regardless of the developer's shell environment.
+
+Without this, running the tests in a shell where RUNLEDGER_BASE_URL is set
+(e.g. pointing at a dev stack on :8081) causes tests that assert on
+:8080 to fail for reasons unrelated to the code under test.
+"""
+import os
+
+# Force the CLI module to compute against the default port when the test
+# suite imports it. This must run before any test module is collected.
+os.environ["RUNLEDGER_BASE_URL"] = "http://localhost:8080"
+
+# RUNLEDGER_NO_DOCKER is honored by ensure_backend() but not by the CLI's
+# top-level main() — leaving it set would produce different behavior on
+# a developer's machine than in CI.
+os.environ.pop("RUNLEDGER_NO_DOCKER", None)

{runledger_cli-0.1.6 → runledger_cli-0.2.1}/cli/tests/test_integration.py

@@ -4,16 +4,20 @@ import tempfile
 import time
 import uuid
 import os
+import sys
 from pathlib import Path
 
 import pytest
 import requests
 
+
 # ------------------------------------------------------------
 # Global settings – will be overridden dynamically by the fixture
 # ------------------------------------------------------------
 PROJECT_ROOT = Path(__file__).parent.parent.parent
 COMPOSE_FILE = PROJECT_ROOT / "docker-compose.test.yml"
+COMPOUND_DIR = PROJECT_ROOT / "test-data" / "sample-compound-runs"
+LEDGER_SCRIPT = PROJECT_ROOT / "cli" / "ledger.py"
 
 # Prevent CLI from ever auto‑starting Docker
 os.environ["RUNLEDGER_NO_DOCKER"] = "1"
@@ -71,18 +75,50 @@ def docker_stack():
     else:
         pytest.fail("Backend did not become healthy")
 
-    yield api_base   # tests that need it can receive it, but most use globals
+    # Seed dev users so the identity filter accepts CLI requests.
+    SEED_SQL = """
+    INSERT INTO teams (id, name) VALUES
+      ('11111111-1111-1111-1111-111111111111', 'Team A'),
+      ('22222222-2222-2222-2222-222222222222', 'Team B')
+    ON CONFLICT (id) DO NOTHING;
+    INSERT INTO app_users (id, email, display_name, app_role, team_id) VALUES
+      ('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', 'alice@example.com', 'Alice', 'researcher', '11111111-1111-1111-1111-111111111111'),
+      ('bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb', 'bob@example.com',   'Bob',   'researcher', '22222222-2222-2222-2222-222222222222'),
+      ('cccccccc-cccc-cccc-cccc-cccccccccccc', 'sup@example.com',   'Sup',   'supervisor', NULL)
+    ON CONFLICT (id) DO NOTHING;
+    INSERT INTO supervisor_team_assignments (supervisor_id, team_id) VALUES
+      ('cccccccc-cccc-cccc-cccc-cccccccccccc', '11111111-1111-1111-1111-111111111111'),
+      ('cccccccc-cccc-cccc-cccc-cccccccccccc', '22222222-2222-2222-2222-222222222222')
+    ON CONFLICT DO NOTHING;
+    """
+
+    pg_container = subprocess.run(
+        ["docker", "compose", "-f", str(COMPOSE_FILE), "-p", project,
+         "ps", "-q", "postgres"],
+        capture_output=True, text=True, cwd=str(PROJECT_ROOT)
+    ).stdout.strip()
+
+    subprocess.run(
+        ["docker", "exec", "-i", pg_container,
+         "psql", "-U", "runledger", "-d", "runledger", "-c", SEED_SQL],
+        check=True, cwd=str(PROJECT_ROOT)
+    )
+
+    yield api_base
 
     # Tear everything down
     subprocess.run(
         ["docker", "compose", "-f", str(COMPOSE_FILE), "-p", project, "down", "-v"],
         cwd=str(PROJECT_ROOT), capture_output=True
     )
+    # Restore env so subsequent test files don't inherit the dead port.
+    os.environ.pop("RUNLEDGER_BASE_URL", None)
+    os.environ.pop("RUNLEDGER_PORT", None)
 
 
 def run_cli(*args):
     """Run the CLI in a subprocess, inheriting the environment (port, no-docker)."""
-    cmd = ["python", str(PROJECT_ROOT / "cli" / "ledger.py"), *args]
+    cmd = [sys.executable, str(LEDGER_SCRIPT), *args]
     return subprocess.run(
         cmd,
         capture_output=True,
@@ -152,7 +188,8 @@ def test_full_golden_path(docker_stack, sample_folder):
     assert "running" in result.stdout.lower()
 
     # 6. deep API verification (uses dynamic API_BASE)
-    resp = requests.get(API_BASE, params={"batch": batch})
+    resp = requests.get(API_BASE, params={"batch": batch},
+                        headers={"X-User-Id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"})
     assert resp.status_code == 200
     runs = resp.json()["content"]
     assert len(runs) == 4
@@ -196,19 +233,21 @@ def test_search_no_results(docker_stack, sample_folder):
 
 
 def test_multi_filter_and_returns_results():
-    compound_dir = "test-data/sample-compound-runs"
-    if not os.path.isdir(compound_dir):
-        pytest.skip(f"Folder {compound_dir} not found")
+    if not COMPOUND_DIR.is_dir():
+        pytest.skip(f"Folder {COMPOUND_DIR} not found")
 
     scan_result = subprocess.run(
-        ["python", "cli/ledger.py", "scan", compound_dir, "--batch", "compound-int"],
+        [sys.executable, str(LEDGER_SCRIPT), "scan", str(COMPOUND_DIR),
+         "--batch", "compound-int"],
         capture_output=True, text=True, encoding="utf-8", errors="replace"
     )
     assert scan_result.returncode == 0, f"Scan failed: {scan_result.stderr}"
 
     result = subprocess.run(
-        ["python", "cli/ledger.py", "search", "--metric", "accuracy", "--op", "gt", "--value", "0.9",
-         "--metric", "loss", "--op", "lt", "--value", "0.2", "--combine", "and", "--batch", "compound-int"],
+        [sys.executable, str(LEDGER_SCRIPT), "search",
+         "--metric", "accuracy", "--op", "gt", "--value", "0.9",
+         "--metric", "loss", "--op", "lt", "--value", "0.2",
+         "--combine", "and", "--batch", "compound-int"],
         capture_output=True, text=True, encoding="utf-8", errors="replace"
     )
     assert result.returncode == 0, f"Search failed: {result.stderr}"