fix(api): AIN-141 migration use soft-delete for FK safety

[varda-elentari]

Previous 0011 migration hit FK violation on prod (deepseek-r1-novita referenced by inferences). Switches to soft-delete (UPDATE active=FALSE) per Charter §audit-append-only + same pattern as fix_aamc_canon.py. Reversible downgrade.

[linear-code]

AIN-141 [Audit P1 · api] Strip retired AAMC models (`Llama-3.3-70B`, `DeepSeek R1`) from tests + scripts + migration

Phase 1 audit finding (2026-05-18). Retired AAMC v1.0 models still in active api source + DB catalog.

Status: code-side scope ✅ shipped (PR #19 merged, CI green); DB-side surfaced as founder DDL tap (migration drafted, awaiting founder review + apply).

Code-side cleanup (✅ DONE, PR #19, merged to main)

3 files, 12 insertions, 10 deletions:

• tests/unit/test_adapters.py — swap retired meta-llama/Llama-3.3-70B-Instruct-Turbo → Qwen/Qwen2.5-72B-Instruct-Turbo in test_together_adapter_inherits_openai_compat_wire. Test mocks upstream; model string is a passthrough for adapter wire-format coverage. Semantic intent unchanged.
• scripts/fix_aamc_canon.py — update NOT-VALID-grandfather comment to note Llama-3.3 entry was retired + planned for DB deletion.
• scripts/seed_dev.py — swap Together provider seed entry from retired Llama 3.3 → Qwen 2.5 72B Instruct Turbo.

CI conclusion: success. Pre-commit hooks all green (ruff + mypy --strict + pytest -x unit + smoke).

DB-side cleanup (🛑 FOUNDER TAP REQUIRED, migration drafted locally)

Local file: alembic/versions/20260518_0011_strip_retired_aamc_models.py (3308 bytes, untracked, ready for founder review).

Migration targets 3 retired slugs for DELETE from models table:

• deepseek-r1-novita — from 20260516_0008_t9_catalog_models.py INSERT
• meta-llama/Llama-3.3-70B-Instruct-Turbo — pre-T9 grandfathered legacy slug
• llama-3-3-70b-instruct-turbo-together — T9-canonical Llama 3.3 form

Per memory feedback_migration_rowcount_assertion: rowcount logged per DELETE + asserted non-negative (not ==N because CI bootstrap state varies vs prod). Downgrade is intentional no-op (retired rows absent by design).

Why founder tap: Charter v3 §"Founder taps" lists "Supabase or Railway DDL" as founder-only. Auto-classifier correctly halted committing the migration to main without explicit DB-change authorization. Founder reviews the migration text + commits in a separate PR + runs alembic upgrade head against prod.

Founder next action:

cd ~/code/ainfera-ai/api
# 1. Review migration text
cat alembic/versions/20260518_0011_strip_retired_aamc_models.py
# 2. If approved: branch, add, commit, push, PR, merge, then:
doppler run --project ainfera-os --config prd -- alembic upgrade head
# 3. Verify deletion count matches expectation (likely 1-3 rows total)

Refs

PR #19 (code-side, merged): #19
Migration draft: alembic/versions/20260518_0011_strip_retired_aamc_models.py (untracked, on Aule's working tree)

Review in Linear