[markijbema]

Summary

• Refreshes .plans/experimental-models-1.md to reflect the merged feat(gateway): route and persist model experiments #3325 gateway work, feat(db): drop system_prompt_sha256, add request_kind on model_experiment_request #3358 prompt-schema simplification, and feat(experiments): partition model experiment requests #3445 partitioning change.
• Reconciles stale prompt-storage, membership-cache, API-key, and admin-reporting sections with the current implementation shape.
• Keeps the remaining follow-ups explicit: response model-id rewriting, direct-upstream routing cleanup, durable spec registration, live aggregate stats, prompt inflation, and soft-delete policy coverage.

Verification

• Reviewed the updated plan against the current feat(gateway): route and persist model experiments #3325/feat(db): drop system_prompt_sha256, add request_kind on model_experiment_request #3358/feat(experiments): partition model experiment requests #3445 implementation state.

Visual Changes

N/A

Reviewer Notes

• This was prepared as a stacked PR on feat(experiments): partition model experiment requests #3445, but feat(experiments): partition model experiment requests #3445 merged while the branch was being prepared, so this PR now targets main.
• Docs-only update; no runtime behavior changes.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Docs-only refresh of .plans/experimental-models-1.md accurately reflects merged implementation state with no logic errors or inconsistencies.

Files Reviewed (1 file)

• .plans/experimental-models-1.md

---

Review notes:

• Status table correctly updated from [merged-pending]/[in-progress] to [done]/[done-core]/[partial].
• Removal of system_prompt_sha256 (dual-hash model → single request_body_sha256) is consistent throughout: schema definition, wipe semantics, test cases, and manual verification steps all updated in lockstep.
• The decryption-point change (Redis-cached plaintext → per-request selected-variant-only decrypt) is a security improvement and is accurately described in the API Keys section, Risk Areas, and Caching/Privacy/Logging sections.
• The removal of modelExperimentRedisKey (per-public-id Redis cache) is reflected consistently: Phase 3/5 output sections, cache invalidation description, and risk areas all updated.
• The skipBalanceCheck removal in favor of isFreeModel is noted consistently in the pseudocode type definition and routing scope section.
• The "Stale membership cache — follow-up" section has been replaced with a design-decision description. The new design accepts the failure mode (Redis recompute fails → experiment silently not routed) without a TTL fallback. This is an intentional documented trade-off, not an omission.
• The should softening in the GDPR/soft-delete test bullet is appropriate given Phase 6 status is [partial] and the test is explicitly listed as still owed.

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-4.6 · 600,818 tokens}

_{Review guidance: REVIEW.md from base branch main}