fix: persist embedded Hatchet Postgres in a fixed dir instead of leaking temp dirs

Each uvx run created a fresh tempfile.mkdtemp() for the embedded Postgres
cluster and never removed it, leaking ~218M per run (37 runs ≈ 8GB found
in $TMPDIR). Use a persistent cluster at ~/.simpleaudit-studio/embedded-pg/
(override with SIMPLEAUDIT_EMBEDDED_PG_DIR) so initdb runs once, and
register an atexit hook so the engine stops cleanly even if the caller
forgets. Also align demo bootstrap username assertions with the studio
default.

.env.example

@@ -19,7 +19,7 @@ DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1
 LOG_LEVEL=INFO
 
 # --- Bootstrap (idempotent; run automatically by the web container) ----------
-BOOTSTRAP_ADMIN_USERNAME=admin
+BOOTSTRAP_ADMIN_USERNAME=studio
 BOOTSTRAP_ADMIN_EMAIL=admin@example.local
 BOOTSTRAP_ADMIN_PASSWORD=change-me
 BOOTSTRAP_PROJECT_NAME=Default

.env.local.example

@@ -22,7 +22,7 @@ LOG_LEVEL=DEBUG
 
 # --- Bootstrap ----------------------------------------------------------------
 # `python manage.py bootstrap_platform` reads these on first run (idempotent).
-BOOTSTRAP_ADMIN_USERNAME=admin
+BOOTSTRAP_ADMIN_USERNAME=studio
 BOOTSTRAP_ADMIN_EMAIL=admin@example.local
 BOOTSTRAP_ADMIN_PASSWORD=localdevpass123
 BOOTSTRAP_PROJECT_NAME=Default

config/settings.py

@@ -237,7 +237,7 @@ WORKOS_ENABLED = bool(WORKOS_CLIENT_ID and WORKOS_API_KEY)
 APP_BASE_URL = os.environ.get("APP_BASE_URL", "http://localhost:8000").rstrip("/")
 
 DEMO_MODE = env_bool("DEMO_MODE", False)
-DEMO_USERNAME = os.environ.get("DEMO_USERNAME", "admin")
+DEMO_USERNAME = os.environ.get("DEMO_USERNAME", "studio")
 DEMO_PASSWORD = os.environ.get("DEMO_PASSWORD", "admin123")
 
 # Framing policy:

deploy/e2e_smoke.py

@@ -70,7 +70,7 @@ class Client:
 def main():
     base_url = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8000"
     env = _load_env()
-    username = env.get("BOOTSTRAP_ADMIN_USERNAME", "admin")
+    username = env.get("BOOTSTRAP_ADMIN_USERNAME", "studio")
     password = env.get("BOOTSTRAP_ADMIN_PASSWORD", "")
     if not password:
         print("FATAL: BOOTSTRAP_ADMIN_PASSWORD not set in .env")

deploy/seed_bulk.py

@@ -133,7 +133,7 @@ RUN_STATUS_DISTRIBUTION = (
 
 def main():
     project = Project.objects.get(id=1)
-    admin = User.objects.get(username="admin")
+    admin = User.objects.get(username="studio")
 
     # ─── 1. Model Endpoints (15) ───────────────────────────────────────────────
     print(f"Model endpoints before: {ModelEndpoint.objects.count()}")

docker-compose.yml

@@ -177,7 +177,7 @@ services:
     # collection, then serve with gunicorn. The seed is safe on every start:
     # it skips anything already present. Set SEED_ON_BOOT=false to opt out.
     # Set SEED_DEMO_AUDITS=false to skip demo audit runs only.
-    command: 'sh -c "python manage.py migrate --noinput && python manage.py bootstrap_platform --username ${BOOTSTRAP_ADMIN_USERNAME:-admin} --email ${BOOTSTRAP_ADMIN_EMAIL:-admin@example.local} --password ${BOOTSTRAP_ADMIN_PASSWORD:?Set BOOTSTRAP_ADMIN_PASSWORD in .env} --project-name ${BOOTSTRAP_PROJECT_NAME:-Default} && if [ "${SEED_ON_BOOT:-true}" != "false" ]; then SEED_ARGS=\"\"; if [ \"${SEED_DEMO_AUDITS:-true}\" = \"false\" ]; then SEED_ARGS=\"--skip-demo-audits\"; fi; python manage.py seed_platform $SEED_ARGS || echo ''WARNING: seed_platform failed - continuing without seed data''; fi && python manage.py collectstatic --noinput && gunicorn config.wsgi:application --bind 0.0.0.0:8000 --workers 2"'
+    command: 'sh -c "python manage.py migrate --noinput && python manage.py bootstrap_platform --username ${BOOTSTRAP_ADMIN_USERNAME:-studio} --email ${BOOTSTRAP_ADMIN_EMAIL:-admin@example.local} --password ${BOOTSTRAP_ADMIN_PASSWORD:?Set BOOTSTRAP_ADMIN_PASSWORD in .env} --project-name ${BOOTSTRAP_PROJECT_NAME:-Default} && if [ "${SEED_ON_BOOT:-true}" != "false" ]; then SEED_ARGS=\"\"; if [ \"${SEED_DEMO_AUDITS:-true}\" = \"false\" ]; then SEED_ARGS=\"--skip-demo-audits\"; fi; python manage.py seed_platform $SEED_ARGS || echo ''WARNING: seed_platform failed - continuing without seed data''; fi && python manage.py collectstatic --noinput && gunicorn config.wsgi:application --bind 0.0.0.0:8000 --workers 2"'
     healthcheck:
       test: ["CMD", "curl", "-fsS", "http://localhost:8000/healthz"]
       interval: 30s

e2e/test_ui.py

@@ -7,7 +7,7 @@ with bootstrap_platform already run.
 Run locally:
     docker compose up -d
     docker compose exec web python manage.py bootstrap_platform \
-        --username admin --email admin@example.com --password e2etestpass123 \
+        --username studio --email studio@example.local --password e2etestpass123 \
         --project-name Research
     .venv/bin/python e2e/test_ui.py
 """
@@ -22,7 +22,7 @@ except ImportError:
     sys.exit(1)
 
 BASE_URL = "http://localhost:8000"
-ADMIN_USER = "admin"
+ADMIN_USER = "studio"
 ADMIN_PASS = "e2etestpass123"
 
 

infra/management/commands/bootstrap_platform.py

@@ -11,7 +11,7 @@ class Command(BaseCommand):
     help = "Create initial admin user and default project if missing."
 
     def add_arguments(self, parser):
-        parser.add_argument("--username", default=os.environ.get("BOOTSTRAP_ADMIN_USERNAME", "admin"))
+        parser.add_argument("--username", default=os.environ.get("BOOTSTRAP_ADMIN_USERNAME", "studio"))
         parser.add_argument("--email", default=os.environ.get("BOOTSTRAP_ADMIN_EMAIL", "admin@example.local"))
         parser.add_argument("--password", default=os.environ.get("BOOTSTRAP_ADMIN_PASSWORD", ""))
         parser.add_argument("--project-name", default=os.environ.get("BOOTSTRAP_PROJECT_NAME", "Default"))

infra/minimal_config.py

@@ -10,9 +10,9 @@ config:
 
 from __future__ import annotations
 
+import atexit
 import logging
 import os
-import tempfile
 import threading
 from typing import Any
 
@@ -28,11 +28,25 @@ def is_minimal_config() -> bool:
     return os.environ.get("SIMPLEAUDIT_MINIMAL", "").strip() == "1"
 
 
+def _data_dir() -> str:
+    """Return (and create) the persistent data dir for the embedded Postgres.
+
+    A fixed location avoids re-running initdb (~218M, ~15s) on every start.
+    Override with SIMPLEAUDIT_EMBEDDED_PG_DIR if needed.
+    """
+    d = os.path.expanduser(
+        os.environ.get("SIMPLEAUDIT_EMBEDDED_PG_DIR", "~/.simpleaudit-studio/embedded-pg")
+    )
+    os.makedirs(d, exist_ok=True)
+    return d
+
+
 def start_embedded_hatchet() -> Any:
     """Start an embedded Hatchet engine and return the client.
 
     The sidecar binary downloads on first use (~53 MB) and caches at
-    ~/.hatchet/embedded/. Subsequent starts are faster.
+    ~/.hatchet/embedded/. The Postgres cluster persists in
+    ~/.simpleaudit-studio/embedded-pg/, so only the first start is slow.
 
     Returns the Hatchet client instance. Raises on failure.
     """
@@ -43,8 +57,7 @@ def start_embedded_hatchet() -> Any:
 
         from hatchet_sdk import ClientConfig, EmbeddedHatchetConfig, Hatchet
 
-        # Use a fresh temp dir per session to avoid stale postmaster.pid locks
-        data_dir = tempfile.mkdtemp(prefix="simpleaudit-hatchet-pg-")
+        data_dir = _data_dir()
         logger.info("Embedded Hatchet data dir: %s", data_dir)
 
         config = ClientConfig(
@@ -76,3 +89,7 @@ def stop_embedded_hatchet() -> None:
 def get_embedded_client() -> Any | None:
     """Return the running embedded Hatchet client, or None."""
     return _embedded_client
+
+
+# Best-effort clean shutdown even if the caller forgets to stop explicitly.
+atexit.register(stop_embedded_hatchet)

infra/tests/test_bootstrap.py

@@ -39,7 +39,7 @@ class BootstrapTests(TestCase):
             for _ in range(2):
                 call_command(
                     "bootstrap_platform",
-                    username="admin",
+                    username="studio",
                     email="admin@example.local",
                     password="admin-pass-123",
                     project_name="Default",
@@ -57,12 +57,12 @@ class BootstrapTests(TestCase):
         with _safe_env():
             call_command(
                 "bootstrap_platform",
-                username="admin",
+                username="studio",
                 email="admin@example.local",
                     password="admin-pass-123",
                 project_name="Default",
             )
 
-        user = User.objects.get(username="admin")
+        user = User.objects.get(username="studio")
         self.assertFalse(user.is_superuser)
         self.assertTrue(user.is_staff)

infra/tests/test_minimal_config.py

@@ -26,12 +26,12 @@ class TestDemoBootSequence(TestCase):
         from model_registry.models import ModelEndpoint
 
         user, project = bootstrap_admin_and_default_project(
-            username="admin",
+            username="studio",
             email="admin@localhost",
             password="admin12345",
             project_name="Demo Project",
         )
-        self.assertEqual(user.username, "admin")
+        self.assertEqual(user.username, "studio")
         self.assertEqual(project.name, "Demo Project")
 
         call_command("seed_platform", project=project.id, verbosity=0)
@@ -56,7 +56,7 @@ class TestDemoBootSequence(TestCase):
         from model_registry.models import ModelEndpoint
 
         _, project = bootstrap_admin_and_default_project(
-            username="admin", email="admin@localhost", password="admin12345",
+            username="studio", email="admin@localhost", password="admin12345",
             project_name="Demo Project",
         )
         call_command("seed_platform", project=project.id, verbosity=0)
@@ -85,6 +85,30 @@ class TestEmbeddedHatchetLifecycle(TestCase):
     (~15s first run) but verify the full lifecycle works.
     """
 
+    def test_data_dir_is_persistent(self):
+        """The embedded Postgres data dir is a fixed location, not a temp dir."""
+        from infra.minimal_config import _data_dir
+
+        d1 = _data_dir()
+        d2 = _data_dir()
+        self.assertEqual(d1, d2)
+        self.assertTrue(os.path.isdir(d1))
+        # Must not be a per-run temp dir (the old leak: 37 x 218M in $TMPDIR)
+        self.assertNotIn("simpleaudit-hatchet-pg-", os.path.basename(d1))
+
+    def test_data_dir_env_override(self):
+        """SIMPLEAUDIT_EMBEDDED_PG_DIR overrides the default location."""
+        import tempfile as _tempfile
+
+        from infra.minimal_config import _data_dir
+
+        with patch.dict(os.environ, {"SIMPLEAUDIT_EMBEDDED_PG_DIR": "/tmp/custom-pg-dir-test"}):
+            d = _data_dir()
+        self.assertEqual(d, "/tmp/custom-pg-dir-test")
+        self.assertTrue(os.path.isdir(d))
+        import shutil
+        shutil.rmtree("/tmp/custom-pg-dir-test", ignore_errors=True)
+
     def test_start_and_stop(self):
         from infra.minimal_config import start_embedded_hatchet, stop_embedded_hatchet
 

infra/tests/test_seed_platform.py

@@ -35,7 +35,7 @@ def _safe_env():
 class SeedPlatformTests(TestCase):
     def setUp(self):
         self.user = User.objects.create_superuser(
-            username="admin", email="admin@example.local", password="pass12345"
+            username="studio", email="admin@example.local", password="pass12345"
         )
         self.project = Project.objects.create(name="Default", slug="default")
         ProjectMembership.objects.create(

simpleaudit_studio/cli.py

@@ -99,7 +99,7 @@ def main() -> None:
     # Give the web server a moment to bind
     time.sleep(1)
 
-    username = os.environ.get("BOOTSTRAP_ADMIN_USERNAME", "admin")
+    username = os.environ.get("BOOTSTRAP_ADMIN_USERNAME", "studio")
     password = os.environ.get("BOOTSTRAP_ADMIN_PASSWORD", "admin12345")
 
     print("┌─────────────────────────────────────────────────────────┐")
@@ -140,7 +140,7 @@ def _seed_demo_data() -> None:
     from django.core.management import call_command
 
     # Respect env vars (set by Dockerfile for HF Space, or defaults for local)
-    username = os.environ.get("BOOTSTRAP_ADMIN_USERNAME", "admin")
+    username = os.environ.get("BOOTSTRAP_ADMIN_USERNAME", "studio")
     email = os.environ.get("BOOTSTRAP_ADMIN_EMAIL", "admin@localhost")
     password = os.environ.get("BOOTSTRAP_ADMIN_PASSWORD", "admin12345")
     project_name = os.environ.get("BOOTSTRAP_PROJECT_NAME", "Demo Project")