`OpenAgents.Inference.ModelsTest`, `OpenAgents.Providers.Test`,

`OpenAgents.TurnProviderEventsTest`, and `OpenAgents.DependencyBoundaryTest`.

### PROVIDER-002 — Model selection is honest: no silent substitution

Status: Current

A turn is never answered by a different model than the one requested without

the caller being told. `OpenAgents.Inference.Models` is the one config-driven

catalog (`config :openagents, :model_catalog`) of the models this deployment

serves, `GET /api/v3/models` publishes it — id, provider lane, context and

output ceilings, availability — and every admission checks the same list, so

the offered set and the refused-against set cannot drift.

Concretely:

- A model outside the catalog is refused with a typed error naming the served

  set — a field-level `422` at `POST /api/v3/threads`, `model_not_served` at

  the inference proxy — never replaced by a default.

- A model in the catalog whose provider credential is not configured is

  **listed as unavailable rather than omitted**, and selecting it is refused

  with `model_unavailable` at thread admission and at the proxy, before any

  provider is called. Availability is the adapter's own report

  (`configured?/0`); it says only that a credential is present, never what it

  is.

- A proxy body naming a served model other than the grant's is refused with

  `model_mismatch` naming both, rather than silently answered by the grant's.

- Every successful proxy response attributes the effective model — the

  `x-openagents-model` header and each SSE chunk's `model` field — so a

  client renders what answered rather than what it assumed. Because a

  mismatch is refused, requested and effective agree on every `200`.

The chat lane keeps the same law through `OpenAgents.Chat.Backends`: an

unsupported `model` on `POST /api/v3/chat/turns` is a typed `422`, and

`GET /api/v3` publishes the supported enum from the same list.

Evidence: `OpenAgents.Inference.Models`, `OpenAgentsWeb.ModelCatalogController`,

`OpenAgentsWeb.InferenceProxyController`, `OpenAgentsWeb.ThreadController`,

`OpenAgents.Inference.ModelsTest`, `OpenAgentsWeb.ModelCatalogControllerTest`,

`OpenAgentsWeb.InferenceProxyControllerTest`, and

`OpenAgentsWeb.ThreadControllerTest`.

## Tool authority and execution

### TOOL-001 — A turn uses one immutable tool catalog

| TURN-005 | `test/openagents/turn_tool_loop_test.exs` |

| PROVENANCE-001 | `test/openagents/turn_provenance_test.exs` |

| PROVIDER-001 | `test/openagents/providers/provider_contract_test.exs`, `test/openagents/turn_provider_events_test.exs`, `test/openagents/dependency_boundary_test.exs` |

| PROVIDER-002 | `test/openagents/inference/models_test.exs`, `test/openagents_web/controllers/model_catalog_controller_test.exs`, `test/openagents_web/controllers/inference_proxy_controller_test.exs`, `test/openagents_web/controllers/thread_controller_test.exs` |

| TOOL-001 | `test/openagents/tools/registry_and_runner_test.exs` |

| COLLECTIVE-001 | `test/openagents/collective_test.exs` |

| COLLECTIVE-002 | `test/openagents/collective_generalizer_test.exs` |

  openai_api_key: nil,

  openrouter_api_key: nil,

  openrouter_model: "stealth/ox-alpha",

  # The typed model catalog (`OpenAgents.Inference.Models`, PROVIDER-002):

  # every model this deployment serves, in the order a client should offer

  # them; the first entry is the default. `id` is the public name a caller

  # asks for, `provider_model` the string the vendor is called with, and

  # either may be `{:config, key}` to follow a runtime-configurable value.

  # `provider` names a lane whose adapter module and credential are configured

  # separately, so no secret lives here; a lane whose credential is absent is

  # listed as unavailable, never silently substituted. `max_output` is the

  # per-call output cap the proxy's adapters actually send (4,096 tokens);

  # `context_window` is the ceiling this deployment publishes for the lane.

  model_catalog: [

    %{

      id: {:config, :openai_model},

      provider: :openai,

      provider_model: {:config, :openai_model},

      context_window: 272_000,

      max_output: 4_096

    },

    %{

      id: "ox-alpha",

      provider: :openrouter,

      provider_model: {:config, :openrouter_model},

      context_window: 256_000,

      max_output: 4_096

    }

  ],

  gemini_api_key: nil,

  gemini_model: "gemini-3.7-flash",

  box_api_key: nil,

defmodule OpenAgents.Inference.Models do

  @moduledoc """

  The models a grant may pin, and the provider that serves each.

  The typed model catalog: every model this deployment serves, and the

  provider lane that serves each.

  A grant carries one model and the proxy pins it, so the set of models a

  caller may be granted is the set the proxy can route. This module is that

  single list: `OpenAgents.Threads` admits a thread's model against it,

  `OpenAgents.Inference.mint/1` refuses a grant naming anything else, and

  `OpenAgentsWeb.InferenceProxyController` asks it which provider to call.

  caller may be granted is the set the proxy can route. This module reads that

  set from one config-driven list, `config :openagents, :model_catalog`:

  `OpenAgents.Threads` admits a thread's model against it, `OpenAgents.Inference.mint/1`

  refuses a grant naming anything else, `OpenAgentsWeb.InferenceProxyController`

  asks it which adapter to call, and `GET /api/v3/models` publishes it so a

  client selects from what is actually served instead of guessing.

  Two names appear per model and they are not the same name. The `id` is what a

  client asks for and what the grant publishes — `ox-alpha`. The

  Two names appear per model and they are not the same name. The `id` is what

  a client asks for and what the grant publishes — `ox-alpha`. The

  `provider_model` is what the provider is called with — `stealth/ox-alpha`.

  Keeping them apart is what lets the routed vendor string change without

  invalidating grants that already name the model.

  invalidating grants that already name the model. A catalog entry may write

  either name as `{:config, key}` to follow a runtime-configurable value.

  The provider module for each lane is read from configuration rather than

  compiled in, so `config/test.exs` substitutes `OpenAgents.Providers.Test` for

  both lanes and no test reaches a vendor.

  A catalog entry names a provider lane, not a module: the adapter module for

  each lane is read from configuration (`@provider_lanes`), so

  `config/test.exs` substitutes `OpenAgents.Providers.Test` and no test

  reaches a vendor. Adding a provider is one lane here, one adapter module,

  and one credential in runtime configuration — no catalog entry carries a

  secret.

  Availability is the adapter's own report: an adapter that exports

  `configured?/0` is asked whether its credential is configured, and a lane

  whose credential is absent is **listed as unavailable rather than omitted**,

  so a client can tell "not served here" from "served here, not currently

  configured". An unavailable model is refused at thread admission and at the

  proxy (`model_unavailable`), never silently substituted (PROVIDER-002).

  """

  @ox_alpha "ox-alpha"

  # Lane name → the application-config key that holds the lane's adapter

  # module. Modules stay out of `:model_catalog` so the catalog is pure data

  # and the test environment swaps adapters without touching it.

  @provider_lanes %{

    openai: :provider,

    openrouter: :openrouter_provider

  }

  @type t :: %{id: String.t(), provider: module(), provider_model: String.t()}

  @type t :: %{

          id: String.t(),

          provider: atom(),

          adapter: module(),

          provider_model: String.t(),

          context_window: pos_integer(),

          max_output: pos_integer()

        }

  @doc "Every model a grant may pin, in the order a client should offer them."

  @doc "Every model in the catalog, in the order a client should offer them."

  @spec all() :: [t()]

  def all do

    [default(), ox_alpha()]

    :openagents

    |> Application.fetch_env!(:model_catalog)

    |> Enum.map(&resolve/1)

    |> Enum.uniq_by(& &1.id)

  end

  @spec ids() :: [String.t()]

  def ids, do: Enum.map(all(), & &1.id)

  @doc "The model a grant pins when its caller names none."

  @doc "The model a grant pins when its caller names none: the catalog's first entry."

  @spec default() :: t()

  def default do

    model = Application.fetch_env!(:openagents, :openai_model)

    %{

      id: model,

      provider: Application.fetch_env!(:openagents, :provider),

      provider_model: model

    }

  end

  def default, do: hd(all())

  @doc "The id of the model a grant pins when its caller names none."

  @spec default_id() :: String.t()

  The model with this id, or `:error`.

  A thread opened before this list existed carries the vendor string

  `stealth/ox-alpha` in its `model` column, so that spelling resolves to the

  same model rather than leaving those threads unable to mint.

  (`stealth/ox-alpha`) in its `model` column, so a vendor spelling resolves to

  the model it routes rather than leaving those threads unable to mint.

  """

  @spec fetch(String.t() | nil) :: {:ok, t()} | :error

  def fetch(id) when is_binary(id) do

    normalized = if id == ox_alpha().provider_model, do: @ox_alpha, else: id

    models = all()

    case Enum.find(all(), &(&1.id == normalized)) do

    case Enum.find(models, &(&1.id == id)) || Enum.find(models, &(&1.provider_model == id)) do

      nil -> :error

      model -> {:ok, model}

    end

  def fetch(_id), do: :error

  defp ox_alpha do

  @doc """

  Whether this model's adapter reports its credential configured.

  An adapter that does not export `configured?/0` is taken as configured: the

  test adapters need no credential, and an adapter that cannot say is refused

  at call time by its own `missing_api_key` rather than guessed at here.

  """

  @spec available?(t()) :: boolean()

  def available?(%{adapter: adapter}) do

    if Code.ensure_loaded?(adapter) and function_exported?(adapter, :configured?, 0) do

      adapter.configured?()

    else

      true

    end

  end

  @doc """

  The public projection of the catalog, for `GET /api/v3/models`.

  No adapter module and no credential state beyond the availability word: a

  client learns what it can select and what each selection can carry, nothing

  about how the server is wired.

  """

  @spec catalog() :: [map()]

  def catalog do

    default_id = default_id()

    Enum.map(all(), fn model ->

      %{

        "id" => model.id,

        "provider" => Atom.to_string(model.provider),

        "context_window" => model.context_window,

        "max_output" => model.max_output,

        "availability" => if(available?(model), do: "available", else: "unavailable"),

        "default" => model.id == default_id

      }

    end)

  end

  @doc "The ids currently available to serve, for a refusal that names what is."

  @spec available_ids() :: [String.t()]

  def available_ids do

    all() |> Enum.filter(&available?/1) |> Enum.map(& &1.id)

  end

  defp resolve(entry) do

    %{

      id: @ox_alpha,

      provider: Application.fetch_env!(:openagents, :openrouter_provider),

      provider_model: OpenAgents.Chat.OpenRouter.default_model()

      id: value(entry.id),

      provider: entry.provider,

      adapter: Application.fetch_env!(:openagents, Map.fetch!(@provider_lanes, entry.provider)),

      provider_model: value(entry.provider_model),

      context_window: entry.context_window,

      max_output: entry.max_output

    }

  end

  defp value({:config, key}) when is_atom(key), do: Application.fetch_env!(:openagents, key)

  defp value(literal) when is_binary(literal), do: literal

end

  @impl true

  def capabilities, do: [:text, :tool_calls, :usage]

  @impl true

  def configured? do

    match?({:ok, _key}, OpenAgents.RuntimeConfig.fetch_secret(:openai_api_key))

  end

  @impl true

  def stream(%Request{} = request, on_event) when is_function(on_event, 1) do

    stream(request, on_event, [])

  @impl true

  def capabilities, do: [:text, :tool_calls, :usage]

  @impl true

  def configured? do

    match?({:ok, _key}, OpenAgents.RuntimeConfig.fetch_secret(:openrouter_api_key))

  end

  @impl true

  def stream(%Request{} = request, on_event) when is_function(on_event, 1) do

    stream(request, on_event, [])

  @type capability :: :text | :tool_calls | :usage

  @callback capabilities() :: [capability()]

  @doc """

  Whether this adapter's credential is configured on this deployment.

  Optional. `OpenAgents.Inference.Models` asks it to publish availability in

  the model catalog and to refuse an unavailable model before a call is made

  (PROVIDER-002). An adapter that does not export it is taken as configured —

  the test adapters need no credential. The answer says only that a secret is

  present, never what it is.

  """

  @callback configured?() :: boolean()

  @optional_callbacks configured?: 0

  @callback stream(

              OpenAgents.Providers.Request.t(),

              (OpenAgents.Providers.ProviderEvent.t() -> any())

    # malformed request and not a forbidden one: the same call succeeds once

    # the caller revokes one, so it is the rate-limit status and its own code.

    "thread_quota_reached" => {429, "This account holds the maximum number of open threads"},

    # Model availability (PROVIDER-002). The model is in the catalog but its

    # provider credential is not configured on this deployment, which is the

    # server's condition and not the caller's mistake: the same call succeeds

    # once the operator configures the lane, so it is the unavailable status

    # and its own code — never a silent substitution.

    "model_unavailable" => {503, "The model's provider is not configured on this deployment"},

    "thread_terminal" => {422, "This thread is terminal and its transcript is closed"},

    # Spending the account's inference credit is not a rate limit: no amount of

    # waiting or revoking makes the same call succeed, so it is the payment

      # Scoped bearer pipelines require the route-specific token authority.

      "get /api/v3/chat/events" => {:required_bearer, :chat, :legacy},

      "post /api/v3/chat/turns" => {:required_bearer, :chat, :legacy},

      "get /api/v3/models" => {:required_bearer, :model, :envelope},

      "post /api/v3/threads" => {:required_bearer, :thread, :envelope},

      "get /api/v3/threads" => {:required_bearer, :thread, :envelope},

      "get /api/v3/threads/:thread_id" => {:required_bearer, :thread, :envelope},

          "conversation, and a grant names one or the other, never both " <>

          "(THREAD-001).",

      "endpoints" => [

        "GET /api/v3/models",

        "POST /api/v3/threads",

        "GET /api/v3/threads/{thread_id}",

        "DELETE /api/v3/threads/{thread_id}"

          "default" => OpenAgents.Inference.Models.default_id(),

          "description" =>

            "The model the thread's grant pins, and therefore the model every " <>

              "call at the inference proxy reaches. A value outside this enum " <>

              "is refused with a field-level 422 naming `model`. Open a second " <>

              "thread to run other work on another model."

              "call at the inference proxy reaches. GET /api/v3/models is the " <>

              "typed catalog behind this enum, with each model's provider, " <>

              "ceilings, and availability. A value outside this enum is " <>

              "refused with a field-level 422 naming `model`; a listed model " <>

              "whose provider is not configured is refused with " <>

              "`model_unavailable`. It is never replaced silently. Open a " <>

              "second thread to run other work on another model."

        },

        "reasoning" => %{

          "endpoint" => "POST /api/v3/threads",

  back as chat-completions SSE that probe's parser consumes. Provider JSON,

  credentials, and raw errors never cross this boundary.

  Model selection is honest (PROVIDER-002): a body that names a model the

  catalog does not serve, or a served model other than the grant's, is refused

  with a typed error naming the served set, never answered by another model.

  Every 200 attributes the effective model — the `x-openagents-model` header

  and each chunk's `model` field — so a client renders what answered.

  The probe→proxy hop is buffered (the provider still streams from the vendor

  internally); probe's transport reads the whole body before parsing, so this

  matches its consumer and keeps failure handling honest.

    with {:ok, token} <- bearer(conn),

         {:ok, grant} <- resolve(token),

         {:ok, model} <- route(grant),

         :ok <- serving(model),

         :ok <- requested_model(model, conn.body_params),

         {:ok, request} <- build_request(model, conn.body_params) do

      run(conn, grant, model.provider, request)

      run(conn, grant, model, request)

    else

      {:error, reason} -> refuse(conn, reason)

    end

    end

  end

  # A routed model whose adapter reports no credential is refused before the

  # call, not answered by another lane (PROVIDER-002).

  defp serving(model) do

    if Models.available?(model), do: :ok, else: {:error, :model_unavailable}

  end

  # The grant pins the model, and a body that names one must name the same

  # model. Ignoring the field would answer a request that asked for one model

  # with another and say nothing — the silent substitution of issue #160 —

  # so a disagreement is a typed refusal that names the served set

  # (PROVIDER-002). Either spelling of the granted model (public id or vendor

  # string) is the same name.

  defp requested_model(model, body) do

    case Map.get(body, "model") do

      absent when absent in [nil, ""] ->

        :ok

      requested when is_binary(requested) ->

        case Models.fetch(requested) do

          {:ok, %{id: id}} when id == model.id -> :ok

          {:ok, %{id: other}} -> {:error, {:model_mismatch, other, model.id}}

          :error -> {:error, {:model_not_served, requested}}

        end

      _not_a_string ->

        {:error, :invalid_request}

    end

  end

  defp build_request(model, %{"messages" => messages} = body) when is_list(messages) do

    {system, turns} = Enum.split_with(messages, &(role(&1) == "system"))

  # ── run + translate ─────────────────────────────────────────────────────

  defp run(conn, grant, provider, request) do

  defp run(conn, grant, model, request) do

    parent = self()

    # The provider pushes events synchronously; capture them to this process's

    # mailbox and drain in order once the call returns.

    result = provider.stream(request, fn event -> send(parent, {:proxy_event, event}) end)

    result = model.adapter.stream(request, fn event -> send(parent, {:proxy_event, event}) end)

    events = drain_events([])

    case result do

        usage = usage_of(events)

        _ = meter(grant, usage)

        # The effective model is attributed on the response itself — the

        # header and every chunk's `model` field — so a client renders what

        # answered, not what it assumed (PROVIDER-002). Because a mismatched

        # request was refused above, requested and effective are the same

        # name on every 200.

        conn

        |> put_resp_content_type("text/event-stream")

        |> put_resp_header("cache-control", "no-store")

        |> send_resp(200, sse_body(events))

        |> put_resp_header("x-openagents-model", model.id)

        |> send_resp(200, sse_body(events, model.id))

      {:error, reason} ->

        # A failure that produced partial usage is still metered; the probe

  end

  # Translate the ordered provider events into a chat-completions SSE body.

  defp sse_body(events) do

  # Every chunk carries the effective model id, the field an OpenAI-compatible

  # parser already reads as "the model that answered".

  defp sse_body(events, model_id) do

    saw_tool_call = Enum.any?(events, &match?({:tool_call, _}, &1))

    finish_reason = if saw_tool_call, do: "tool_calls", else: "stop"

      |> Enum.with_index()

      |> Enum.flat_map(fn {event, index} -> event_chunks(event, index) end)

    finish = [

      data(%{"choices" => [%{"index" => 0, "delta" => %{}, "finish_reason" => finish_reason}]})

    ]

    finish = [%{"choices" => [%{"index" => 0, "delta" => %{}, "finish_reason" => finish_reason}]}]

    usage_chunk =

      case usage_of(events) do

        usage when usage == %{} -> []

        usage -> [data(%{"choices" => [], "usage" => wire_usage(usage)})]

        usage -> [%{"choices" => [], "usage" => wire_usage(usage)}]

      end

    IO.iodata_to_binary([chunks, finish, usage_chunk, "data: [DONE]\n\n"])

    frames =

      Enum.map(chunks ++ finish ++ usage_chunk, fn payload ->

        data(Map.put(payload, "model", model_id))

      end)

    IO.iodata_to_binary([frames, "data: [DONE]\n\n"])

  end

  defp event_chunks({:text_delta, text}, _index) when text != "" do

    [data(%{"choices" => [%{"index" => 0, "delta" => %{"content" => text}}]})]

    [%{"choices" => [%{"index" => 0, "delta" => %{"content" => text}}]}]

  end

  # Reasoning rides the OpenRouter chat-completions extension field —

  # `delta.reasoning` alongside `delta.content` — the shape the CLI's

  # OpenAI-compatible parser already expects from that vendor surface.

  defp event_chunks({:reasoning_delta, text}, _index) when text != "" do

    [data(%{"choices" => [%{"index" => 0, "delta" => %{"reasoning" => text}}]})]

    [%{"choices" => [%{"index" => 0, "delta" => %{"reasoning" => text}}]}]

  end

  defp event_chunks({:tool_call, tool_call}, index) do

    [

      data(%{

      %{

        "choices" => [

          %{

            "index" => 0,

            }

          }

        ]

      })

      }

    ]

  end

  end

  defp refuse(conn, reason) do

    {status, code} = status_for(reason)

    {status, error} = error_for(reason)

    conn

    |> put_resp_content_type("application/json")

    |> put_resp_header("cache-control", "no-store")

    |> send_resp(status, Jason.encode!(%{"error" => %{"code" => code}}))

    |> send_resp(status, Jason.encode!(%{"error" => error}))

  end

  # The model refusals name the served set, because the fix for either is to

  # ask for a model on that list.

  defp error_for({:model_not_served, requested}) do

    {422, %{"code" => "model_not_served", "requested" => requested, "served" => Models.ids()}}

  end

  defp error_for({:model_mismatch, requested, granted}) do

    {422,

     %{

       "code" => "model_mismatch",

       "requested" => requested,

       "granted" => granted,

       "served" => Models.ids()

     }}

  end

  defp error_for(reason) do

    {status, code} = status_for(reason)

    {status, %{"code" => code}}

  end

  defp status_for(:missing_grant), do: {401, "missing_grant"}

defmodule OpenAgentsWeb.ModelCatalogController do

  @moduledoc """

  `GET /api/v3/models`: the typed model catalog this deployment serves.

  The CLI renders model selection from this list instead of guessing, so it is

  the same list every admission checks against — `OpenAgents.Inference.Models`

  admits a thread's model, refuses a grant, and routes the proxy from the one

  catalog this endpoint publishes (PROVIDER-002). A model whose provider

  credential is not configured is listed with availability `unavailable`

  rather than omitted, so a client can tell "not served here" from "served

  here, not currently configured"; selecting it is refused with

  `model_unavailable`, never answered by another model.

  Behind the same bearer scope as threads: the catalog names what a thread

  grant can be minted for, so the caller who can open a thread is the caller

  who reads it.

  """

  use OpenAgentsWeb, :controller

  alias OpenAgents.Inference.Models

  def index(conn, _params) do

    json(conn, %{

      "models" => Models.catalog(),

      "default" => Models.default_id()

    })

  end

end

      open(conn, objective, options)

    else

      {:refused, field, message} -> ApiError.validation_failed(conn, %{field => [message]})

      {:unavailable, model_id} -> unavailable_model(conn, model_id)

    end

  end

  defp execution_shape(params) do

    with {:ok, model} <- admitted(params, "model", Models.ids(), Models.default_id()),

         :ok <- serving(model),

         {:ok, reasoning} <-

           admitted(params, "reasoning", Thread.reasoning_efforts(), Threads.default_reasoning()),

         {:ok, profile} <-

    end

  end

  # An admitted model whose provider credential is not configured is refused

  # here rather than minted into a grant that can only fail at its first call

  # (PROVIDER-002): the catalog lists it as unavailable, and opening a thread

  # on it would be authority for work the deployment cannot do.

  defp serving(model_id) do

    case Models.fetch(model_id) do

      {:ok, model} ->

        if Models.available?(model), do: :ok, else: {:unavailable, model_id}

      # `admitted/4` has already bound the id to the catalog.

      :error ->

        {:unavailable, model_id}

    end

  end

  defp unavailable_model(conn, model_id) do

    sentence =

      "#{inspect(model_id)} is in the catalog but its provider is not configured " <>

        "on this deployment. Currently available: " <>

        "#{Enum.join(Models.available_ids(), ", ")}. See GET /api/v3/models."

    ApiError.refuse(conn, "model_unavailable",

      message: sentence,

      errors: %{"model" => [sentence]}

    )

  end

  # A value outside the enum is refused rather than replaced by the default: a

  # caller that asked for one execution shape and was given another has no way

  # to tell.

  scope "/api/v3", OpenAgentsWeb do

    pipe_through :chat_account_api

    # The typed model catalog the thread admission checks against. It sits in

    # the thread scope because it names what a thread grant can be minted for.

    get "/models", ModelCatalogController, :index

    post "/threads", ThreadController, :create

    get "/threads", ThreadController, :index

    get "/threads/:thread_id", ThreadController, :show

  alias OpenAgents.Chat.OpenRouter

  alias OpenAgents.Inference.Models

  test "the default model is the configured one, served by the configured provider" do

  test "the default model is the configured one, served by the configured adapter" do

    default = Models.default()

    assert default.id == Application.fetch_env!(:openagents, :openai_model)

    assert default.provider_model == default.id

    assert default.provider == Application.fetch_env!(:openagents, :provider)

    assert default.adapter == Application.fetch_env!(:openagents, :provider)

    assert Models.default_id() == default.id

  end

    assert model.id == "ox-alpha"

    assert model.provider_model == OpenRouter.default_model()

    refute model.id == model.provider_model

    assert model.adapter == Application.fetch_env!(:openagents, :openrouter_provider)

  end

  test "the vendor spelling resolves to the same model" do

    assert Models.fetch("attacker/gpt-9-ultra") == :error

    assert Models.fetch(nil) == :error

  end

  test "every catalog entry carries the typed ceilings and a provider lane" do

    for model <- Models.all() do

      assert is_binary(model.id) and model.id != ""

      assert is_atom(model.provider)

      assert is_atom(model.adapter)

      assert is_binary(model.provider_model) and model.provider_model != ""

      assert is_integer(model.context_window) and model.context_window > 0

      assert is_integer(model.max_output) and model.max_output > 0

    end

  end

  test "the public catalog projects each model without its adapter module" do

    catalog = Models.catalog()

    assert Enum.map(catalog, & &1["id"]) == Models.ids()

    for entry <- catalog do

      assert Enum.sort(Map.keys(entry)) ==

               ~w(availability context_window default id max_output provider)

      assert entry["availability"] in ["available", "unavailable"]

      refute entry["provider"] =~ "Elixir."

    end

    assert Enum.count(catalog, & &1["default"]) == 1

    assert Enum.find(catalog, & &1["default"])["id"] == Models.default_id()

  end

  # The test adapters export `configured?/0` returning true, so in this

  # environment every lane is available; PROVIDER-002's unavailable branch is

  # driven by the controller tests, which swap in an adapter that reports

  # false.

  test "a lane whose adapter reports a configured credential is available" do

    for model <- Models.all() do

      assert Models.available?(model)

    end

    assert Models.available_ids() == Models.ids()

  end

end

    OpenAgents.Providers.OpenRouter => :outbound_http,

    OpenAgents.Providers.RecordingTestProvider => :in_process,

    OpenAgents.Providers.Test => :in_process,

    OpenAgents.Providers.UnconfiguredTestProvider => :in_process,

    OpenAgents.Voice.OpenAI.CallClient => :outbound_http,

    OpenAgents.Voice.OpenAI.Sideband => :outbound_socket,

    OpenAgents.Voice.TestCallProvider => :in_process,

    conn =

      post_chat(conn, token, %{

        "model" => "ignored-by-proxy",

        "model" => OpenAgents.Inference.Models.default_id(),

        "messages" => [

          %{"role" => "system", "content" => "You are helpful."},

          %{"role" => "user", "content" => "hello there"}

    assert conn.status == 200

    assert get_resp_header(conn, "content-type") |> hd() =~ "text/event-stream"

    # The effective model is attributed on the response itself (PROVIDER-002):

    # the header and every chunk name the model that answered.

    assert get_resp_header(conn, "x-openagents-model") ==

             [OpenAgents.Inference.Models.default_id()]

    events = sse_events(conn.resp_body)

    assert List.last(events) == "[DONE]"

    for chunk <- events, chunk != "[DONE]" do

      assert Jason.decode!(chunk)["model"] == OpenAgents.Inference.Models.default_id()

    end

    # The Test provider's default path streams "I hear you. You said: <prompt>".

    text =

      events

           )

  end

  test "the model is pinned by the grant, not the request body", %{conn: conn} do

    %{grant: grant, token: token} = grant("model-pin")

  test "a body naming a model outside the catalog is refused, naming the served set",

       %{conn: conn} do

    %{grant: grant, token: token} = grant("model-not-served")

    _conn =

    conn =

      post_chat(conn, token, %{

        "model" => "attacker/gpt-9-ultra",

        "messages" => [%{"role" => "user", "content" => "hello"}]

      })

    # The grant's model_id is Sarah's configured model, never the body's.

    # Never a 202-and-answer-from-another-model (#160): the refusal is typed,

    # echoes what was asked, and names what is served.

    assert conn.status == 422

    error = Jason.decode!(conn.resp_body)["error"]

    assert error["code"] == "model_not_served"

    assert error["requested"] == "attacker/gpt-9-ultra"

    assert error["served"] == OpenAgents.Inference.Models.ids()

    # The grant's model_id stays Sarah's configured model, never the body's.

    assert grant.model_id == Application.fetch_env!(:openagents, :openai_model)

  end

  test "a body naming a served model other than the grant's is refused, never substituted",

       %{conn: conn} do

    %{token: token} = grant("model-mismatch")

    conn =

      post_chat(conn, token, %{

        "model" => "ox-alpha",

        "messages" => [%{"role" => "user", "content" => "hello"}]

      })

    assert conn.status == 422

    error = Jason.decode!(conn.resp_body)["error"]

    assert error["code"] == "model_mismatch"

    assert error["requested"] == "ox-alpha"

    assert error["granted"] == OpenAgents.Inference.Models.default_id()

    assert error["served"] == OpenAgents.Inference.Models.ids()

  end

  test "the vendor spelling of the grant's model is the same name, not a mismatch",

       %{conn: conn} do

    %{token: token} = grant("model-vendor-spelling", model_id: "ox-alpha")

    conn =

      post_chat(conn, token, %{

        "model" => OpenAgents.Chat.OpenRouter.default_model(),

        "messages" => [%{"role" => "user", "content" => "hi"}]

      })

    assert conn.status == 200

    assert get_resp_header(conn, "x-openagents-model") == ["ox-alpha"]

  end

  test "a grant on a lane without a credential is refused before any provider call",

       %{conn: conn} do

    # Minted while the lane was configured; the credential goes away under a

    # live grant. The UnconfiguredTestProvider raises from `stream/2`, so a

    # 503 here also proves no provider was called.

    %{token: token} = grant("model-lane-unavailable", model_id: "ox-alpha")

    previous = Application.get_env(:openagents, :openrouter_provider)

    Application.put_env(

      :openagents,

      :openrouter_provider,

      OpenAgents.Providers.UnconfiguredTestProvider

    )

    on_exit(fn -> Application.put_env(:openagents, :openrouter_provider, previous) end)

    conn = post_chat(conn, token, %{"messages" => [%{"role" => "user", "content" => "hi"}]})

    assert conn.status == 503

    assert Jason.decode!(conn.resp_body)["error"]["code"] == "model_unavailable"

  end

  test "missing bearer is rejected", %{conn: conn} do

    conn =

      conn

defmodule OpenAgentsWeb.ModelCatalogControllerTest do

  @moduledoc """

  `GET /api/v3/models`: the typed catalog a client selects from (PROVIDER-002).

  The catalog is what makes model selection honest: the CLI renders this list,

  the thread admission refuses against the same list, and a lane whose

  credential is not configured is listed as unavailable rather than omitted or

  silently substituted.

  """

  use OpenAgentsWeb.ConnCase, async: false

  alias OpenAgents.Inference.Models

  test "the catalog lists every served model in its typed shape", %{conn: conn} do

    body =

      conn

      |> put_chat_api_token("model-catalog")

      |> get(~p"/api/v3/models")

      |> json_response(200)

    assert body["default"] == Models.default_id()

    assert Enum.map(body["models"], & &1["id"]) == Models.ids()

    for entry <- body["models"] do

      assert Enum.sort(Map.keys(entry)) ==

               ~w(availability context_window default id max_output provider)

      assert is_binary(entry["provider"]) and entry["provider"] != ""

      assert is_integer(entry["context_window"]) and entry["context_window"] > 0

      assert is_integer(entry["max_output"]) and entry["max_output"] > 0

      # Every test lane's adapter reports a configured credential.

      assert entry["availability"] == "available"

    end

    assert [default_entry] = Enum.filter(body["models"], & &1["default"])

    assert default_entry["id"] == body["default"]

  end

  test "a lane without a configured credential is listed unavailable, not omitted", %{conn: conn} do

    previous = Application.get_env(:openagents, :openrouter_provider)

    Application.put_env(

      :openagents,

      :openrouter_provider,

      OpenAgents.Providers.UnconfiguredTestProvider

    )

    on_exit(fn -> Application.put_env(:openagents, :openrouter_provider, previous) end)

    body =

      conn

      |> put_chat_api_token("model-catalog-unavailable")

      |> get(~p"/api/v3/models")

      |> json_response(200)

    # The model stays in the list — "served here, not currently configured"

    # is different information from "not served here" — and only its

    # availability changes.

    assert Enum.map(body["models"], & &1["id"]) == Models.ids()

    ox_alpha = Enum.find(body["models"], &(&1["id"] == "ox-alpha"))

    assert ox_alpha["availability"] == "unavailable"

    default_entry = Enum.find(body["models"], &(&1["id"] == body["default"]))

    assert default_entry["availability"] == "available"

  end

  test "the catalog requires the same bearer as threads", %{conn: conn} do

    body =

      conn

      |> get(~p"/api/v3/models")

      |> json_response(401)

    assert body["code"] == "unauthenticated"

  end

end

      assert body["grant"]["model"] == OpenAgents.Inference.Models.default_id()

    end

    test "a catalog model whose provider is not configured is refused, never substituted",

         %{conn: conn} do

      previous = Application.get_env(:openagents, :openrouter_provider)

      Application.put_env(

        :openagents,

        :openrouter_provider,

        OpenAgents.Providers.UnconfiguredTestProvider

      )

      on_exit(fn -> Application.put_env(:openagents, :openrouter_provider, previous) end)

      body =

        conn

        |> put_chat_api_token("thread-unavailable-model")

        |> post(~p"/api/v3/threads", %{

          "objective" => "Ask for the unconfigured lane.",

          "model" => "ox-alpha"

        })

        |> json_response(503)

      assert body["code"] == "model_unavailable"

      assert Map.has_key?(body["errors"], "model")

      # The refusal names what is currently available.

      assert body["message"] =~ OpenAgents.Inference.Models.default_id()

    end

    test "a model the proxy cannot route is refused, naming the field", %{conn: conn} do

      body =

        conn

        |> post(

          ~p"/api/inference/proxy",

          Jason.encode!(%{

            "model" => "ignored-by-proxy",

            "model" => created["grant"]["model"],

            "messages" => [%{"role" => "user", "content" => "hello there"}],

            "stream" => true

          })

  @impl true

  def capabilities, do: [:text, :tool_calls, :usage]

  # The test lane needs no credential, so it is always configured.

  @impl true

  def configured?, do: true

  @impl true

  def stream(%Request{} = request, on_event) do

    if request.previous_response_id do

defmodule OpenAgents.Providers.UnconfiguredTestProvider do

  @moduledoc """

  A provider whose credential is not configured, for PROVIDER-002 tests.

  Swapped into a lane's configuration to drive the unavailable branch: the

  catalog must list the lane's models as `unavailable`, and admission and the

  proxy must refuse them with `model_unavailable` before any call is made —

  which is why `stream/2` raises rather than answers.

  """