[markijbema]

Summary

• Exposes active model experiments as selectable OpenRouter-style models in the model list endpoints.
• Makes active preview IDs available to every caller, independent of organization model restrictions, so local/preview experiment IDs can be selected by clients.
• Adds focused coverage that active experiments are listed while draft and paused experiments stay hidden.

Verification

• Activated a local kilo/preview-henk experiment and confirmed it appeared in the local model selector.

Visual Changes

N/A

Reviewer Notes

• This is extracted from feat(gateway): route and persist model experiments #3325 so the model-listing behavior can land independently of the larger routing/persistence PR.
• The actual experiment routing implementation remains in feat(gateway): route and persist model experiments #3325; this PR only affects model discovery/listing.

[kilo-code-bot]

WARNING: Experiment models bypass enterprise model restrictions

Experiment models are appended to filteredModels after the hasActiveModelRestrictions block (lines 31–39), meaning they are never evaluated against modelDenyList or providerAllowList. This is consistent with the PR description ("independent of organization model restrictions"), but it means enterprise customers with a strict provider allow-list or model deny-list will still see and can select active experiment models.

If this is intentional, a comment here would make the policy explicit for future maintainers — e.g.:

// Experiment models are intentionally exempt from org-level restrictions so
// preview experiments are always reachable during the experiment period.

If it is not intentional, the isAllowed predicate should be applied to experiment models the same way it is applied to the main responseData.data.

[markijbema]

I'll look into it, for now i dont think it matters much either way , model usage is enforced when using

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The previously flagged WARNING — experiment models bypassing enterprise modelDenyList/providerAllowList restrictions — has been resolved. Experiment models are now included in restrictionCandidates before policy filtering in getAvailableModelsForOrganization, and a new integration test verifies that a denied experiment model is correctly excluded.

Resolved Issues

File	Line	Issue	Status
apps/web/src/lib/organizations/organization-models.ts	44 (old)	Experiment models bypassed enterprise model restrictions	✅ Fixed

Files Reviewed (5 files)

• apps/web/src/app/api/openrouter/models/route.ts
• apps/web/src/lib/ai-gateway/experiments/list-available-experiment-models.ts
• apps/web/src/lib/ai-gateway/experiments/list-available-experiment-models.test.ts
• apps/web/src/lib/organizations/organization-models.ts
• apps/web/src/routers/organizations/organization-settings-router.test.ts

---

_{Reviewed by claude-sonnet-4.6 · 241,536 tokens}

_{Review guidance: REVIEW.md from base branch main}