[sjungwon03]

Summary

Closes #514
Refs #116; structural guard follow-up #515

• Expose GET /api/v1/model/{author}/{slug} through the existing complete catalog snapshot, model/final-provider IAM and rich model projection.
• Match exact administrator-published aliases, including explicit variants and safe Unicode. Never resolve canonical_slug/alias_target or turn a path into an upstream destination.
• Return indistinguishable private404s for unknown/disabled/inaccessible aliases after required audit; fail safely on visible targets missing rich metadata and on dependency faults. Recognized lookup responses are no-store.
• Persist sanitized model-read count0/1 and empty model-read-unavailable events through the current PostgreSQL audit/history boundary. No migration or inference/secret/limit/usage calls.

Plan: docs/plans/514-single-model-discovery.md
Contract: contracts/single-model-discovery.md

TDD and validation

• Red before implementation:15 raw/installed SDK/audit cases,14 expected unsupported-route/unknown-audit-kind failures and one existing unsupported-method pass.
• Green: eleven focused discovery/count/price/audit/SDK suites pass 143 tests, including both route kinds, exact variants/Unicode, inclusive path bounds, current model/provider/implicit Deny, private404 equivalence, auth-before-validation, strict encoding/query rejection, hidden malformed catalog, required handoff faults, snapshot mutation and migrated principal-scoped history.
• All four existing pins and migrations are unchanged. CLAUDE.md remains a symlink to AGENTS.md. Strict type/lint settings remain enabled.
• Clean env -u NODE_NO_WARNINGS -u NODE_OPTIONS PATH="/home/ubuntu/.local/bin:$PATH" npm run check passed: 6,894 cases,6,893 passed, one optional external PostgreSQL skip, zero failures/cancellations. Strict types, lint, planning/link/contract/fixture-secret checks and all four offline pin integrity checks passed. Local evidence: /tmp/opengranter-514-check.log.

Source and remaining limits

Official lookup: https://openrouter.ai/docs/api/api-reference/models/get-a-model-by-its-slug; OpenAPI: https://openrouter.ai/openapi.json, inspected2026-10-18. Installed OpenRouter1.4.18 uses actual models.get socket requests and recognizes the compatible error envelope.

Only explicitly published rich aliases can produce a complete model. Local segment limits/encoding restrictions and proxy-token IAM differ from unrestricted upstream identifiers/management-key examples. No implicit slug-alias resolution, provider endpoint inventory or live metadata refresh/certification is added. Follow-up #515 tracks the new operation/path/root envelope, which is outside the current four structural pins. Complete #116 and unresolved #7 remain open.

Assisted-by: Codex
Signed-off-by: sjungwon03 sjungwon03@gmail.com

[sjungwon03-ai]

Review summary

Verdict: Approved

• Reviewed: authorized single-model lookup routing, IAM, audit projection, and regression coverage
• Checks: all reported CI checks passed; local npm run check passed with 6,893 tests passed and one optional skip