Scope

• Add a fail-closed selector policy for live model catalogs: only OpenRouter and TokenRhythm are trusted, and only on their official hosts. Other providers and custom endpoints keep manual model-id entry.
• Keep raw model discovery available for CLI diagnostics while routing the Web UI and interactive onboarding picker through the trusted selector boundary.
• Discover router-tier catalogs lazily and per provider, so mixed OpenRouter/TokenRhythm routes use the correct list without blocking settings load or sharing unsaved credentials across providers.
• Preserve one stable model input while an asynchronous catalog arrives, retaining focus, cursor input, and the free-text escape hatch.
• Improve the existing RC3 picker with a readable 480px catalog, model count, selected state, friendly names and capability summaries, complete-id hover text, keyboard visibility, corrected listbox semantics, reduced-motion support, and six-locale copy.
• Rebuild the bundled Web UI from the current main baseline.

Why

The RC3 UI already had a basic discovered-model picker, but any non-empty adapter listing could be presented as authoritative. Some compatibility providers expose static protocol-family rows that do not describe the configured service, and the router UI held only one provider catalog. Discovery was also able to delay settings loading and replace an input after the user started typing.

This change makes selection an optional, verified accelerator: trusted live data becomes selectable, and every uncertain case stays editable as free text.

User impact

• OpenRouter and TokenRhythm model fields can use verified live lists.
• Mixed-provider router tiers use separate provider-scoped catalogs.
• Other providers and custom OpenRouter/TokenRhythm endpoints remain manual entry instead of showing potentially wrong data.
• Settings render immediately while catalogs load in the background.
• Keyboard, screen-reader, long-id, narrow-table, and mobile interactions are more robust.

Branch target

• Base: main
• Head: fix/trusted-model-picker
• Commits: three

Linked issue

None.

Release note status

Include as a Web UI model-selection reliability and usability improvement in the next release notes.

Test results

• 695 passed, 1 skipped — complete onboarding suite.
• 57 passed — gateway RPC, wire-contract, and provider registry coverage.
• 822 passed — complete Web UI unit suite.
• 13 passed — public release hygiene.
• Ruff: passed for changed Python and tests.
• mypy: passed for the five changed Python source modules.
• Web UI architecture, security, theme, motion, radius, i18n, locale parity, and Vue type checks: passed.
• Production Web UI build and theme bundle guard: passed.
• In-app browser QA: OpenRouter rendered a 346-model live catalog; keyboard navigation scrolled the active option into view; Anthropic remained a plain manual textbox after discovery; desktop and 390×844 mobile layouts rendered without an error overlay.
• Manual live provider validation with operator-supplied credentials: OpenRouter listed 346 models and completed a one-token chat; TokenRhythm listed 12 models and completed a one-token chat.

Safety notes

• Unverified providers and non-official base URLs return an empty selector catalog before credential resolution, provider construction, or network access.
• Unsaved credentials and endpoint settings are sent only for the currently selected provider; other tier-provider requests contain only that provider id.
• Stale discovery responses are discarded and concurrent requests are deduplicated.
• Free-text model entry remains available in every state and is never gated on discovery.
• No API keys, live transcripts, user prompts, local runtime data, or machine-specific artifacts are committed.
• The existing admin scope and wire envelope for onboarding.models.discover are unchanged.

Third-party origin

None. The implementation, tests, and copy are original OpenSquilla work; no external source code or fixtures were copied.