Fix blocking bugs: temporary-run 400 and Anthropic 401

[imphillip]

Summary

Two independent, currently-blocking bugs in the core verification flows. Both fixes are small and isolated, each with a regression test.

1. Temporary verification against a real gateway always returns HTTP 400

The web UI's temporary flow posts only claimed_model (no model), but live_report required a model field via require_text and raised Missing required field: model. As a result every temporary verification against a real gateway failed — only the hardcoded gateway.example.test demo path worked, because it substitutes claimed_model for model.

Fix: make model optional, defaulting to claimed_model (matching the demo path and the frontend payload contract).

2. Anthropic-protocol verification always returns HTTP 401

Requests to /v1/messages only sent Authorization: Bearer + anthropic-version, never the x-api-key header the native Anthropic Messages API requires. Verifying api.anthropic.com (or any native Anthropic endpoint) always failed auth, all probes errored, and an honest Claude deployment was reported as unreachable/inconclusive.

Fix: add an anthropic_auth_headers helper that sends x-api-key while keeping Authorization: Bearer, so Anthropic-compatible gateways that expect a bearer token keep working.

Testing

pytest -q — all 48 pass, including two new regression tests:

• test_temporary_live_run_defaults_model_to_claimed_model
• test_call_model_anthropic_sends_x_api_key_header

Notes

• Both commits are DCO Signed-off-by.
• For bug 2 I send both x-api-key and Authorization: Bearer to maximize gateway compatibility while fixing native Anthropic. If you'd rather send only x-api-key in anthropic mode, happy to adjust.

🤖 Generated with Claude Code