[aviggiano]

Summary

• add a first-class Codex-backed OpenRouterAgent using OPENROUTER_API_KEY and https://openrouter.ai/api/v1
• preserve arbitrary OpenRouter catalogue model identifiers end to end without a static allowlist
• support local, Modal, benchmark, eval-history, schema, init, doctor, and workflow surfaces
• document configuration and credential isolation, with deterministic tests and no live paid calls

Validation

• pnpm -w format:check
• pnpm --filter @ultrafuzz/config test (62 tests)
• pnpm --filter @ultrafuzz/runtime typecheck
• full pre-rebase release validation passed; current-main runtime and GitHub release gates are running

Closes #584.

Greptile Summary

The PR adds first-class OpenRouter support across configuration, generated runtime adapters, local and Modal execution, benchmark provenance, schemas, workflows, and documentation.

• Preserves arbitrary validated OpenRouter catalogue identifiers without a static allowlist.
• Adds API-key isolation and routes Codex-backed requests through the official OpenRouter endpoint.
• Extends benchmark, publication, smoke-test, initialization, validation, and diagnostic surfaces.

Confidence Score: 4/5

The PR is not yet safe to merge because Doctor can still approve credential posture for a configured topology while a run-time OpenRouter topology override immediately fails preflight.

Doctor has no input for the run’s --topology-path and derives credential requirements from the configured topology, whereas start-run validates credentials against the override-expanded graph; the existing topology-override diagnostic mismatch therefore remains.

Files Needing Attention: packages/runtime/src/doctor.ts, packages/runtime/src/types.ts

Important Files Changed

Filename	Overview
packages/runtime/src/doctor.ts	Adds OpenRouter credential diagnostics, but the previously reported mismatch with run-time topology overrides remains.
packages/runtime/src/start-run.ts	Adds expanded-graph-based OpenRouter credential preflight before run creation.
packages/runtime/src/templates/smithers/agents/openrouter.tsx	Adds the isolated Codex-backed OpenRouter adapter, fixed provider endpoint, and managed credential configuration.
packages/config/src/model-profiles.ts	Validates opaque OpenRouter catalogue identifiers while preserving supported punctuation and aliases.
packages/modal/src/benchmark-config-zod.ts	Extends Modal benchmark contracts with matching OpenRouter provider, agent, authentication, and model constraints.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Config[OpenRouter model profile] --> Validate[Config and topology validation]
  Validate --> Graph[Expanded run graph]
  Graph --> Preflight[Credential and command preflight]
  Preflight --> Agent[Generated OpenRouterAgent]
  Agent --> Codex[Codex CLI]
  Codex --> Router[OpenRouter API]
  Graph --> Modal[Modal benchmark execution]
  Modal --> Evidence[Benchmark and publication evidence]

Loading

_{Reviews (12): Last reviewed commit: "fix(benchmarks): serialize the OpenRoute..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Config (@ultrafuzz/config)
• Knowledge Base — Runtime: Run Orchestration Lifecycle

[aviggiano]

v0.1.0 integration policy — 2026-08-14

OpenRouter is an explicitly approved exception to the v0.1.0 feature freeze. This PR remains targeted to and must merge directly into main; do not retarget it to release/v0.1.0 or route it through PR #366. The final v0.1.0 candidate will be constructed from stabilized main and will inherit this merge.

This is a scope clarification, not merge authorization. Current blockers include the conflict with main, failing required release validation, and the unresolved Doctor versus runtime --topology-path credential-preflight concern. Resolve or explicitly disposition those blockers and obtain human review before merge.

Merging this PR would not itself authorize a live paid OpenRouter run, the v0.1.0 benchmark, tagging, or publishing.

[aviggiano]

Note: we're waiting on OpenRouter admin to remove sensitive filters, otherwise we can't test this