[sjungwon03]

Summary

Closes #515
Refs #116; runtime #514 / merged PR #516

• Add a separate version1 fifth structural pin for GET /model/{author}/{slug}, getModel identity, complete author/slug required path parameter objects, HTTP200 JSON root and whole ModelResponse/Model definitions.
• Keep existing four pin bytes unchanged. Referenced metadata bodies remain monitored by the existing model-response guard; selected shared Model drift reports both guards, while metadata-body-only drift reports the existing response subset.
• Validate all five pins before one optional fixed official bounded credential-free fetch. Compute every comparison before success output, report each subset independently and never write pins.
• Extend independent shape, invalid/rehashed pin/source, controlled CLI and offline expectations. Update contracts/README/compatibility to describe bounded five-pin coverage accurately.

Plan: docs/plans/515-single-model-schema.md
Contract: contracts/single-model-schema.md

TDD and validation

• Red: new boundary test failed with expected missing-module error; isolated offline CLI case failed on the missing fifth result before implementation.
• Green: nine schema/CLI/single-model-runtime/audit suites pass 555 tests.
• Controlled CLI covers single-only parameter/root/reference changes, shared Model changes, metadata-only existing-response changes, simultaneous five-subset drift, invalid fifth pins before fetch and invalid fifth source without partial success. All fixture pin bytes remain unchanged; one fixed-host fetch omits credentials and supplied headers.
• Fresh npm run compatibility:drift: all five selected subsets match.
• Previous four pin files and migrations are unchanged. Strict type/lint settings remain enabled; CLAUDE.md remains a symlink.
• Clean env -u NODE_NO_WARNINGS -u NODE_OPTIONS PATH="/home/ubuntu/.local/bin:$PATH" npm run check passed: 6,937 cases,6,936 passed, one optional external PostgreSQL skip, zero failures/cancellations. Strict types, lint, planning/link/contract/fixture-secret checks and all five offline pin integrity checks passed. Local evidence: /tmp/opengranter-515-check.log.
• Fixture correction: an empty optional inherited parameter list is valid, so it is now a positive case; the malformed-entry case remains a private failure test. No source validation was weakened to satisfy the mistaken fixture expectation.

Source and limitations

Official source: https://openrouter.ai/openapi.json, retrieved2026-10-18.
Canonical source SHA-256: e14bcc1e02453bff8807cc79d03170ce7d229a9d0836e253ff49b764b8aa811d.
Single-model projection SHA-256: de4f732c32b47607cd875b2dd5d4eb000365b232a9d855ee5ae5f91106689d8c.

This is selected structural tracking, not full OpenAPI/JSON Schema semantic/instance validation, a source signature or live provider certification. References are retained as strings; selected metadata bodies are covered by the paired model-response guard, and future/unselected targets/status/media/headers remain outside detection. Runtime path bounds, exact-publication/IAM rules, alias resolution, audit, usage, secrets and limits are unchanged. Broad alias resolution, endpoint inventory, full #116 and unresolved #7 remain open.

Assisted-by: Codex
Signed-off-by: sjungwon03 sjungwon03@gmail.com

[sjungwon03-ai]

Review summary

Verdict: Approved

• Reviewed: single-model OpenRouter schema pin, projection validation, CLI integration, and regression coverage
• Checks: all three CI checks passed; local npm run check passed (6,936 passed, 1 skipped)