Add dedicated transparent OpenRouter passthrough host on agentgateway

Date: 2026-06-20 Status: Accepted Decision: hl-v4vo Deciders: Sean Brandt

Context

The curated llm-gw.fzymgc.house lane (ADR hl-hv3, hl-6nm) gates access to specific aliased endpoints (/v1/chat/completions, /v1/embeddings, /v1/models) and cannot serve arbitrary OpenRouter paths such as /v1/responses or future extensions. Clients needing the full OpenRouter OpenAI-compatible surface (any model slug, any endpoint, no alias registration) have no cluster-sanctioned lane.

Decision

Deploy a dedicated Gateway listener and host (openrouter-gw.fzymgc.house) serving only the transparent passthrough lane, leaving llm-gw untouched.

Rationale

• Avoids Gateway-API prefix-precedence ambiguity with the curated routes on llm-gw.
• Unambiguous mental model: openrouter-gw = raw OpenRouter, llm-gw = curated aliases.
• Independently revertible by removing one file from kustomization.yaml without touching any curated route.

Alternatives Considered

• Dedicated host openrouter-gw.fzymgc.house (chosen): clean isolation; no longest-prefix interplay with curated routes; preserves llm-gw invariants. Cost: one cert SAN, one Gateway listener, one HostMapping alias.
• Catch-all path on the existing llm-gw host (rejected): no new DNS name or cert SAN, but creates longest-prefix ambiguity with the curated /v1/chat/completions and /v1/embeddings rules and gives no clean isolation boundary.

Consequences

• Positive: clients use openrouter-gw as a drop-in base URL for openrouter.ai/api/v1 with no per-model registration; future OpenRouter endpoints are reachable without config changes.
• Negative: additional cert SAN (visible in public CT logs), Gateway listener, and HostMapping alias to maintain.
• Neutral: existing llm-gw routes, aliases, and policies are untouched.