The explicit, user-confirmed single-model completion test that complements the no-completion connectivity probe (POST /api/providers/test). It is served by src/server/management/provider-completion-test.ts, reached from src/cli/provider-runtime.ts (ocx provider test <name> --model <id>) and gui/src/components/provider-workspace/ProviderCompletionTest.tsx. Regression suites: tests/providers/provider-completion-test.test.ts, tests/providers/provider-completion-test-authority.test.ts, tests/providers/provider-completion-test-ingress.test.ts, gui/tests/provider-completion-test.test.tsx.
Provider routes lazily dispatch POST /api/providers/test-completion?name=... to the completion runner. The registry assigns the mutating route to src/server/management/provider-routes.ts; normal management authentication, Origin admission and dashboard CSRF apply. Exact input is { model, confirm: true }; invalid input, unknown providers and concurrent tests return 400, 404 and 409. A process-local slot is released in finally on every outcome.
Applicability checks disabled state, forwarded/OAuth auth, unsupported transports and effective per-model wire before credentials. TLS profiles, HTTP-version pins, enabled pacing and custom executors with provider proxy overrides are unsupported. Metadata routing removes stored keys/pools; destination policy precedes real key resolution. Only OpenAI Chat and Responses execute, through existing transport builders and providerOutboundPost, without redirects, retries or failover. Both applicability and authority derivation resolve aliases to native model ids before selecting per-model wires, then apply wire-model suffix stripping through existing helpers.
Local HTTP probes materialize the existing effective private-network policy (operator opt-in or a registry-local default) and enable providerOutboundPost's local-cleartext safeguard. Its narrow host/address allowlist, DNS-answer checks and proxy refusal still apply; public HTTP and private destinations without admission are refused. Chat probes resolve OpenRouter and Vercel AI Gateway routing with the same helpers as the chat adapter, keyed by the native model before suffix stripping, and serialize the resulting provider field. Responses does not synthesize that chat-only field.
A memory-only fingerprint captures wire, URL, wire model, computed gateway routing, local-cleartext admission, sorted headers, auth, key selection/resolved key, destination policy, egress and disabled state. Before physical send the same live row must reproduce it, with current key-selection authority for credentialed rows; changes return credential_changed with no send.
The prompt is Reply exactly OK., output cap 32, deadline 20 seconds and stream cap 64 KiB including partial frames. Shared SSE decoding records TTFT at the first non-empty text delta. Chat DONE or finish-reason plus EOF, and Responses completed/incomplete events, establish completion only with text. Every exit aborts, cancels and disposes the diagnostic's translator budget. Errors use fixed messages; HTTP failures include status without reading bodies. Raw model comparison precedes known-secret masking, control stripping, 256-character truncation and generic redaction. Missing/conflicting metadata is unknown; identityVerified is false. No output preview, config, health, history or catalog mutation is produced.