[edward-sf]

Moves the trained model's bytes out of git into a GitHub Release, leaving a checksum-pinned lockfile in their place, with a build-time guard that makes shipping a bad artifact structurally impossible.

Implements docs/superpowers/plans/2026-09-01-creditboost-model-artifact-storage.md task-by-task, test-first, one commit per task.

What changed

• models/model.lock.json (349 bytes) is now the only tracked file in models/. It pins release tag model-v0.1.0 and a sha256 per asset.
• creditboost-artifact CLI with fetch, verify, and lock. Downloads via urllib, not curl, so the Docker builder needs no apt-get layer. Transient failures back off and retry; a 404 fails immediately, because a missing release is a defect and retrying only delays a truthful failure.
• The Docker builder fetches and verifies in a single RUN — a cached layer of fetched-but-unverified bytes would be a trap. docker build . still takes zero arguments and no credentials.
• file_sha256 moved to a dependency-free hashing.py, because data.py imports scikit-learn, which the builder stage does not install.
• The layering rule became an import-linter contract, replacing the hand-rolled sys.modules subprocess test: it is static analysis of a static rule, covers eight modules rather than one, and reports the offending chain. CI runs lint-imports.
• scripts/smoke.sh asserts /health reports provenance: production — the last gate before the GHCR push.
• The model itself is unchanged (roc_auc 0.7533); only where its bytes live is. History is deliberately not rewritten: the problem was future retrains appending copies, which deleting from HEAD solves.

Verification

Nine of the plan's ten success criteria were verified locally:

1. git ls-files models/ prints exactly models/model.lock.json, 349 bytes.
2. A clean clone carrying only the lockfile builds and serves — no arguments, no credentials.
3. That image's /health reports "provenance":"production", "model_version":"0.1.0".
4. 138 tests pass with no network access; no test references a non-loopback host.
5. Corrupting the lockfile digest fails the build with a ChecksumMismatchError naming both digests. Verified, not assumed.
6. ProvenanceError on a fixture artifact — covered in tests/test_artifact_cli.py; the Docker path is the same code.
7. The release exists with both assets; fetch-then-verify proven against it.
8. ruff, mypy, and lint-imports all clean.
9. smoke.sh exits 1 on a provenance mismatch, 0 on a match.

Criterion 7 — CI green on this PR, GHCR publish on merge — is what this PR exercises.

Deviations from the plan

• lockfile.read parses the JSON before validating it. The plan's model_validate_json with two except branches could not work: pydantic v2 folds a syntax error into ValidationError, which is itself a ValueError, so the second branch was unreachable and a malformed file reported as a schema problem.
• The model-v0.1.0 release already existed with both assets carrying exactly the digests the plan records, so only the lockfile half of scripts/release-model.sh was run. The script's guard rails were verified separately: it refuses a missing version and a version mismatch before calling gh.
• Two small lint-driven test fixes: pytest.raises(ValidationError) instead of blind Exception (ruff B017), and the loopback-server imports hoisted to the top of the test module (E402).

🤖 Generated with Claude Code

[edward-sf]

Phase 2 focused on removing the model artifact from our commits to reduce storage usage. This phase was intentionally narrow in scope to correct the original bad-practice, which was initially approved simply to facilitate a cleaner P1 thin-slice.

✅ Changes have been approved and planning for Phase 3 has started.