Model Providers

OpenRouter is recommended. OpenAI direct, Anthropic direct and Codex CLI are alternatives. The provider abstraction supports exactly openrouter, openai, anthropic and codex; Codex is a CLI marker rather than an HTTP chat() implementation (son-of-anton-review/src/model-provider.js:15,169-325).

All R/ paths below mean son-of-anton-review on feat/cloudflare-native. Operator settings APIs on son-of-anton-operator-parity (feat/greptile-operator-parity) are a separate, unmerged tree. The two dashboard trees are also distinct.

Configure the runtime you actually run

Native Cloudflare

The container entrypoint reads GILF_MODEL_PROVIDER, then GILF_CODEX_PROVIDER, then defaults to openrouter. It passes GILF_MODEL, then GILF_CODEX_MODEL, to the runner. Only the former model name survives the Worker-to-container projection.

The checked-in manifest selects these deployment values, not library defaults:

GILF_CODEX_PROVIDER=openrouter
GILF_MODEL=z-ai/glm-5.3-flash
GILF_OPENROUTER_REQUIRE_FREE=0

Provide the matching OPENROUTER_API_KEY Worker secret. HTTP OpenRouter, OpenAI and Anthropic do not need an interactive model CLI login. OpenRouter is not the only headless alternative.

Sources: R/cloudflare-native/container/entrypoint.mjs:314-348; R/cloudflare-native/src/container-env.js:15-86; R/cloudflare-native/wrangler.jsonc:151-161. Model slug availability and current provider prices are external facts; a checked-in slug is not a guarantee of continued availability.

Node worker.mjs

This entrypoint constructs CodexReviewRunner without a provider/model argument. The runner reads legacy provider/model names. Set both naming pairs if you also need dashboard status to agree:

export GILF_MODEL_PROVIDER=openrouter
export GILF_CODEX_PROVIDER=openrouter
export GILF_MODEL=z-ai/glm-5.3-flash
export GILF_CODEX_MODEL="$GILF_MODEL"
# Supply OPENROUTER_API_KEY securely in this process's environment.
export GILF_OPENROUTER_REQUIRE_FREE=0

The final line deliberately permits paid models. Omit it only when using a model whose catalog pricing passes the free-only guard. This config does not install credentials or start a worker.

GILF_MODEL_PROVIDER and GILF_MODEL alone do not configure this Node runner. Its fallback is codex / gpt-5.5, regardless of the generic resolver's provider-specific model defaults.

Sources: R/worker.mjs:43-54; R/src/codex-review-runner.js:2320-2337.

Generic resolver versus active runner

resolveModelConfig is an exported library helper, not the resolver used by either entrypoint above.

Do not assume those role overrides or model defaults affect a deployed review. Explicit model selection avoids the actual runner's generic gpt-5.5 fallback being sent to a different provider. Source: R/src/model-provider.js:327-358; compare the entrypoints cited above.

Keys, endpoints and headers

The application resolves each HTTP provider's nonblank bare key first, then its GILF_ alias. These names are configuration inputs, not a promise that credentials never leave the process: HTTP clients send them in authentication headers.

The native projection forwards only bare provider keys. Its startup check asks whether any supported key is present; that does not prove the selected provider has a valid key. Codex's configured: true status likewise does not validate its installation or authentication.

OpenRouter sends HTTP-Referer, X-Title and X-OpenRouter-Metadata: enabled. These base URL, cap and attribution overrides are not forwarded by the native manifest's container projection.

Sources: R/src/model-provider.js:24-37,169-307; R/src/codex-review-runner.js:2215-2221,2327-2332; R/cloudflare-native/container/entrypoint.mjs:319-324; R/cloudflare-native/src/container-env.js:15-70.

Free-only guard

The runner enables the OpenRouter guard unless GILF_OPENROUTER_REQUIRE_FREE is exactly 0. It fetches the configured base URL's GET /models, finds the exact model id and requires numeric zero prompt and completion prices. Missing models or missing/nonzero prices fail closed.

Representative source-defined errors include OpenRouter model is required, OpenRouter model list returned invalid JSON, and OpenRouter model MODEL was not found, where MODEL is substituted by the runner. A nonfree model error includes the actual prompt/completion prices.

Planner guard failure records openrouter_model_not_free and falls back to static planning; inversion guard failure retains the configured review provider. The guard does not obtain a billing quote and does not make a rate-card override authoritative. GILF_MODEL_PRICES cannot make a paid model pass it.

Sources: R/src/codex-review-runner.js:2022-2057,2329,3385-3388,3493-3496. See Troubleshooting.

Shadow model and planner

To enable a Node runner's shadow model, set GILF_CODEX_SHADOW_MODEL and optionally GILF_CODEX_SHADOW_PROVIDER. GILF_MODEL_SHADOW alone does not start it. The default shadow timeout is the smaller of the primary timeout and 120000 ms; override with GILF_CODEX_SHADOW_TIMEOUT_MS.

The shadow call runs after successful primary semantic analysis. It is skipped on deterministic fast paths or when no shadow model is selected. The result is stored as shadowReview; it is not a second published review. It still consumes provider time and tokens. None of these shadow model selectors are forwarded on native Cloudflare.

The planner uses GILF_HYPOTHESIS_PLANNER=1, with GILF_PLANNER_PROVIDER / GILF_PLANNER_MODEL defaulting to the actual runner's provider/model. It also requires a hypothesis worker; Codex cannot serve as its HTTP planner. Swarm and planner flags are not forwarded on native Cloudflare. See Roadmap and flags.

Sources: R/src/codex-review-runner.js:2324-2337,2361-2362,2650-2691,3198-3246,3342-3353.

Costs and dashboard status

Known token usage multiplied by a rate card produces costUsd. OpenAI and Anthropic have built-in tables; OpenRouter and Codex tables are empty. GILF_MODEL_PRICES overrides rates in USD per million input/output tokens. Unknown price or absent usage yields null. This is calculated telemetry, not an invoice; enter real applicable rates, not zero merely to remove an unknown-cost display.

describeConfiguredProviders returns provider, selected, configured and known/public model names, not key material. It reflects its own environment, not a probe of the review container. Both dashboard Models views let you browse these values without persisting model selection. On the parity branch policy /operator/api/settings is a policy document, not this provider-status response.

Sources: R/src/model-provider.js:39-93,363-385; anton-ui/src/views/Settings.tsx:58-181; anton-ui-trace-parity/src/views/Settings.tsx:50-173; son-of-anton-operator-parity/cloudflare/src/review-policy-api.js:48-63.

There are no separate Gemini, Bedrock, Vertex or Ollama provider implementations in the supported-provider switch. OpenRouter may route a model from another family when that model is offered by its catalog. An advertised model id in source is not evidence that a direct provider or external model is available today.