bugfixes; research subproc; higher sandbox limits

deploy/k8s/base/gateway-rbac.yaml

@@ -1,6 +1,6 @@
-# RBAC for gateway to CREATE sandbox deployments only
-# Principle of least privilege: gateway can ONLY create deployments/services/PVCs
-# in the sandbox namespace. Deletion is handled by the lifecycle sidecar.
+# RBAC for gateway to manage sandbox deployments
+# Principle of least privilege: gateway can create/delete deployments in the
+# sandbox namespace. PVC deletion is still handled by the lifecycle sidecar.
 # No pods, secrets, exec, or cross-namespace access.
 ---
 apiVersion: v1
@@ -15,10 +15,10 @@ metadata:
   name: sandbox-creator
   namespace: sandbox
 rules:
-  # Deployments: create and read only (deletion handled by sidecar)
+  # Deployments: full management (delete used for license tier changes; PVC deletion still via sidecar)
   - apiGroups: ["apps"]
     resources: ["deployments"]
-    verbs: ["create", "get", "list", "watch", "patch", "update"]
+    verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
 
   # PVCs: create and read (deletion handled by sidecar)
   - apiGroups: [""]
@@ -41,7 +41,6 @@ rules:
     verbs: ["get"]
 
   # Explicitly NOT included:
-  # - deployments/delete - handled by lifecycle sidecar
   # - pvc/delete - handled by lifecycle sidecar
   # - services/delete - handled by lifecycle sidecar
   # - pods (create/delete) - must go through deployments

deploy/k8s/base/gateway.yaml

@@ -83,10 +83,10 @@ spec:
 
           resources:
             requests:
-              memory: "256Mi"
+              memory: "512Mi"
               cpu: "100m"
             limits:
-              memory: "512Mi"
+              memory: "2Gi"
               cpu: "500m"
 
           livenessProbe:

deploy/k8s/base/sandbox-quotas.yaml

@@ -19,8 +19,8 @@ spec:
         cpu: "100m"
       # Maximum any single container can request
       max:
-        memory: "2Gi"
-        cpu: "2000m"
+        memory: "8Gi"
+        cpu: "4000m"
       min:
         memory: "32Mi"
         cpu: "10m"

deploy/k8s/dev/configs/ingestor-config.yaml

@@ -4,18 +4,32 @@
 flink_hostname: flink-jobmanager
 ingestor_broker_port: 5567
 
-# Supported exchanges (subscribe to these prefixes)
+# Supported exchanges (used for symbol metadata generation)
 supported_exchanges:
   - BINANCE
   - COINBASE
   - KRAKEN
 
+# Per-exchange work slot capacity.
+# Each slot is one concurrent job. historical_slots limits parallel OHLC fetches;
+# realtime_slots limits concurrent tick subscriptions. Set based on exchange rate
+# limits and connection constraints — these are conservative starting values.
+exchange_capacity:
+  BINANCE:
+    historical_slots: 1
+    realtime_slots: 5
+  COINBASE:
+    historical_slots: 1
+    realtime_slots: 4
+  KRAKEN:
+    historical_slots: 1
+    realtime_slots: 3
+
 # Kafka configuration
 kafka_brokers:
   - kafka:9092
 
 # Worker configuration
-max_concurrent: 10
 poll_interval_ms: 10000
 
 # Logging

deploy/k8s/dev/sandbox-config.yaml

@@ -46,6 +46,11 @@ data:
     alerts:
       max_active: 100
 
+    # Memory guard: soft RLIMIT_AS limit as a fraction of the cgroup memory.max.
+    # Set below 1.0 so Python raises MemoryError before the kernel OOM-kills the pod.
+    memory:
+      limit_fraction: 0.85
+
     # Logging
     logging:
       level: "INFO"