[edward-sf]

Milestone 1: a thin end-to-end slice from Home Credit training data through an
XGBoost model to a containerised FastAPI scoring service published to GHCR.

Implements Tasks 1–10 of docs/superpowers/plans/2026-08-30-creditboost-thin-slice.md.
Task 11 (the credentialed production training run) is not included.

What's here

config.py	21 model features, 19 request fields, thresholds, AUC floor
features.py	the single shared transform imported by both training and serving
schema.py / banding.py	Pydantic contracts and risk bands
artifact.py	save/load plus the feature-order gate
data.py / train.py	CSV loading, stratified split, training CLI
serve/	FastAPI app, fail-fast startup
Dockerfile / smoke.sh	702MB runtime image and its smoke test

101 tests, 99% coverage. The committed artifact is fixture-trained
(provenance: "fixture") so everything here is verifiable without Kaggle
credentials.

Deviations from the plan, and why

• Python 3.12 only (plan said 3.11 + 3.12). numpy and xgboost both now
  require ≥3.12, so a 3.11 job would resolve an older ML stack than the shipped
  image and could fail loading an artifact serialised by xgboost 3.4.1.
• GHCR image name. The plan's ghcr.io/${{ github.repository }} resolves to
  a name containing capitals, which GHCR rejects — every publish would have
  failed. Now built from the lowercased owner plus creditboost, which is what
  the plan's own Task 11 verification step expects.
• xgboost-cpu on Linux. Cuts ~650MB of NVIDIA CUDA libraries unused by CPU
  inference. Scoring verified bit-exact against the full build. macOS keeps
  plain xgboost, the only variant shipping a wheel there.
• CNT_CHILDREN defaults to None, not 0. An unanswered field must not be
  imputed at the API boundary, where the distinction cannot be recovered.
• Dependency-direction test rewritten. The plan's assert 'sklearn' not in sys.modules was broken — import xgboost pulls sklearn in regardless. Now
  checks creditboost.data / creditboost.train directly, which also catches a
  guarded import the original would have missed.
• Artifact hardening beyond the plan: the feature-order mismatch error names
  the first disagreeing index, an xgboost major-version check was added, and
  ArtifactError unifies the failure taxonomy.

Not included

Task 11 needs data/application_train.csv from Kaggle (gitignored, never in CI)
and will replace the fixture artifact with a production one.

🤖 Generated with Claude Code

[edward-sf]

Review

Task level reviews were done between each commit with minor changes needed after certain tasks.

A final branch-level review caught a number of issues that couldn't be properly observed at the task level reviews we did previously.

CI returns clean for test, lint, and build. Through Milestone 1, we match the project specs.

Merge approved. I'll begin planning Milestone 2.