Answer

I diagnosed and verified this against the live OpenRouter API and the real gitreins 0.13.0 LLMClient code path. The solution is written to /workspace/solution.md:

---

GitReins tier2 INCOMPLETE — OpenRouter HTTP 400 from a bare model slug in ~/.hermes/.env

Problem class: gitreins-judge-openrouter-400-bare-model-slug-env-file Symptom: gitreins judge / gitreins task complete reports tier2 INCOMPLETE, with three HTTP 400 responses from https://openrouter.ai/api/v1/chat/completions (not 401). Tier 1 is already PASS.

1. Root cause

engine/llm.py resolves the model as:

self.model = model or os.getenv("GITREINS_LLM_MODEL") or _default_model()

The effective environment (sourced from ~/.hermes/.env) carried:

GITREINS_LLM_MODEL=deepseek-flash

deepseek-flash is a bare slug. OpenRouter requires vendor-qualified IDs (vendor/model). The request hits the correct base with a valid sk-or-v1-… key, so OpenRouter rejects the body, not the auth:

{"error":{"message":"deepseek-flash is not a valid model ID","code":400}}

LLMClient.chat() never retries 4xx (only 429/5xx/network), so tier2 fails immediately; the x3 is the evaluator's stage retries all rejected identically.

Two traps: - The built-in default GitReinsDefaults.model = "deepseek-v4-flash" is also bare — unsetting the env var without a qualified replacement reproduces the 400. - GitReins has no dotenv loader; ~/.hermes/.env is sourced by the invoking shell/scheduler and inherited. The override belongs on the judge invocation, not in the file.

Signature discrimination

Case	Base URL in log	HTTP	Meaning	Fix
this problem	openrouter.ai/api/v1	400	right base, wrong model slug	vendor-qualify the model
t615	openrouter.ai/api/v1	401	right base, wrong key	correct sk-or-… key
t637	api.deepseek.com	401	wrong base	set base + key together

OpenRouter base + 400 ⇒ model-slug bug, not a key bug. Never assume the t637 values; read the file.

2. Diagnosis (run first)

# effectiveslug — the source of truth
grep -n '^GITREINS_LLM_MODEL' ~/.hermes/.env
printenv GITREINS_LLM_MODEL GITREINS_LLM_BASE_URL GITREINS_LLM_API_KEY
# Expect: GITREINS_LLM_MODEL=deepseek-flash  (bare)

# prove bare slug is the fault against the live API
BASE=https://openrouter.ai/api/v1; KEY="$OPENROUTER_API_KEY"
curl -s -o /dev/null -w '%{http_code}\n' "$BASE/chat/completions" \
  -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' \
  -d '{"model":"deepseek-flash","messages":[{"role":"user","content":"ping"}],"max_tokens":5}'
# -> 400

# list accepted qualified DeepSeek IDs
curl -s "$BASE/models" -H "Authorization: Bearer $KEY" \
  | python3 -c "import sys,json; print([m['id'] for m in json.load(sys.stdin)['data'] if 'deepseek' in m['id']])"
# includes deepseek/deepseek-v4-flash-0731

3. Exact fix — one idempotent judge retry, no config churn

cd /path/to/checkout

GITREINS_LLM_BASE_URL="https://openrouter.ai/api/v1" \
GITREINS_LLM_MODEL="deepseek/deepseek-v4-flash-0731" \
GITREINS_LLM_API_KEY="$OPENROUTER_API_KEY" \
gitreins judge <task-id>

Or, if via completion:

GITREINS_LLM_BASE_URL="https://openrouter.ai/api/v1" \
GITREINS_LLM_MODEL="deepseek/deepseek-v4-flash-0731" \
GITREINS_LLM_API_KEY="$OPENROUTER_API_KEY" \
gitreins task complete <task-id>

Correctness/idempotency: - GITREINS_LLM_MODEL is read once at LLMClient() construction, so the inline value wins over the inherited deepseek-flash; ~/.hermes/.env is untouched. - GITREINS_LLM_API_KEY is checked before the provider-key fallback, pinning the sk-or-… key. - Re-running gitreins judge <task-id> is the documented idempotent retry — it re-evaluates and re-persists, doesn't mutate task state; the built-in single-flight guard blocks a duplicate concurrent run. If a background job is alive: gitreins judge --status <job-id>. - Optional durable fix only (not required): edit ~/.hermes/.env to the full slug.

4. Verification (executed)

API level:

bare  "deepseek-flash"                 -> 400 {"message":"deepseek-flash is not a valid model ID"}
full  "deepseek/deepseek-v4-flash-0731"-> 200 {"object":"chat.completion","model":"deepseek/deepseek-v4-flash-0731",...}
wrong sk-or key                        -> 401 {"message":"User not found."}

Real GitReins code path (engine.llm.LLMClient):

$ GITREINS_LLM_BASE_URL=https://openrouter.ai/api/v1 \
  GITREINS_LLM_API_KEY=$OPENROUTER_API_KEY \
  GITREINS_LLM_MODEL=deepseek/deepseek-v4-flash-0731 \
  python -c "from engine.llm import LLMClient; c=LLMClient(max_retries=1); r=c.chat([...],max_tokens=5); print(c.model, c._chat_url, r.usage)"
deepseek/deepseek-v4-flash-0731 https://openrouter.ai/api/v1/chat/completions LLMUsage(prompt_tokens=6, ..., total_tokens=11)

The bare slug through the same client logs 400 Client Error: Bad Request for url: https://openrouter.ai/api/v1/chat/completions; the qualified slug returns a valid usage. This isolates the fix to the model string.

Post-retry acceptance:

gitreins report   # latest verdict: PASS (tier1 PASS unchanged, tier2 PASS on first retry)

Success criteria: no more 400 from openrouter.ai/api/v1; PASS summary persisted; grep '^GITREINS_LLM_MODEL' ~/.hermes/.env unchanged while the run's effective slug was deepseek/deepseek-v4-flash-0731.

5. One-line takeaway

OpenRouter 400 at the correct base means the model slug is wrong, not the key — read grep GITREINS_LLM_MODEL ~/.hermes/.env, then re-run one idempotent gitreins judge <task-id> with GITREINS_LLM_MODEL=deepseek/deepseek-v4-flash-0731 plus the OpenRouter base and sk-or key, instead of editing the env file.

# Evidence
- Problem class: gitreins-judge-openrouter-400-bare-model-slug-env-file
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-16T19:21:03.131Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "GitReins tier2 INCOMPLETE with HTTP 400 (not 401) x3 from openrouter.ai/api/v1: the effective GITREINS_LLM_MODEL was the bare slug deepseek-flash (sitting in ~/.hermes/.env as GITREINS_LLM_MODEL), which OpenRouter rejects as an unknown model - vendor-qualified slugs are required. The t615 401 signature means wrong KEY at wrong base; the 400 signature means wrong MODEL SLUG at right base. Fix without config churn: env-override GITREINS_LLM_MODEL=deepseek/deepseek-v4-flash-0731 (full vendor slug) + GITREINS_LLM_BASE_URL=https://openrouter.ai/api/v1 + the sk-or key on ONE idempotent gitreins judge retry; tier2 then PASSes first-retry (tier1 already PASS). Distinguish from t637 sourced-and-forgot: there the base was api.deepseek.com (401 url in the log); here the base was already openrouter (400 url in the log). Check the effective slug with grep GITREINS_LLM_MODEL on the env file, never assume the t637 values are what the env carries.", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "gitreins-judge-openrouter-400-bare-model-slug-env-file", "provider": "openrouter", "solved_at": "2026-09-16T19:21:03.131Z", "version": ""}