Scope

• Add a shared, host-gated OpenSquilla application-attribution helper for OpenRouter and TokenRhythm.
• Send HTTP-Referer: https://opensquilla.ai and X-Title: OpenSquilla on TokenRhythm chat, model-list, naming, compaction, live-catalog, pricing, embedding, image, and model-catalog request paths.
• Preserve the existing OpenRouter-only compatibility API and reject non-HTTP, lookalike, malformed, and scoped-IPv6 hosts.
• Keep the public TokenRhythm catalog request unauthenticated.

Branch target

• Base: main
• Head: fix/tokenrhythm-app-attribution
• Commits: one

Linked issue

None.

Release note status

Include as a provider-integration reliability improvement in the next release notes.

Test results

• 228 passed — focused attribution/provider/session tests.
• 609 passed — broader provider regressions.
• Ruff: passed.
• mypy: passed for changed source modules.
• Live TokenRhythm validation: 5 single-model runs plus 5 static B5 ensemble runs; all 30 Chat Completions requests carried both attribution headers and completed successfully.
• Full-suite note: an earlier broad run was stopped at 17% after 9 real-terminal TUI failures in paths untouched by this change; 2,270 tests had passed at that point.

Safety notes

• Attribution values are fixed public application metadata; no user, account, session, prompt, machine, or workspace identifiers are added.
• Header injection is limited to exact official hosts and their subdomains over HTTP(S).
• TokenRhythm public catalog traffic receives no Authorization header.
• No credentials or live transcripts are committed.

Third-party origin

None. The implementation and tests are original OpenSquilla work; no external source code or fixtures were copied.