From 5631ef80f9adb7ddd5881167c6682074b9a009db Mon Sep 17 00:00:00 2001
From: suyx <dada20041002@163.com>
Date: Tue, 4 Aug 2026 18:55:32 +0800
Subject: [PATCH] fix(wp7-02): route stable Gemini through secure broker

---
 scripts/lib/wp7-02-external-contract.mjs            | 10 ++++++++++
 .../ControlledExternalValidationLauncher.cs         |  3 +--
 tests/integration/wp7-02-controlled-state.test.ts   | 13 ++++++++-----
 3 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/scripts/lib/wp7-02-external-contract.mjs b/scripts/lib/wp7-02-external-contract.mjs
index adabc2a..ee60b4d 100644
--- a/scripts/lib/wp7-02-external-contract.mjs
+++ b/scripts/lib/wp7-02-external-contract.mjs
@@ -8,6 +8,11 @@ export const WP7_02_MODEL_IDS = Object.freeze([
   "gpt-image-2",
 ]);
 
+const controlledStateProductModelIds = Object.freeze({
+  "gemini-3.1-flash-image": "gemini-3.1-flash-image-preview",
+  "gpt-image-2": "gpt-image-2",
+});
+
 const expectedCandidateCommit = "623cad25b2a2a9a003502c9a92ebd318dad06248";
 const expectedBrowsers = Object.freeze({
   "Google Chrome": "150.0.7871.187",
@@ -49,6 +54,11 @@ function assertModelId(modelId) {
   return modelId;
 }
 
+export function productModelIdForControlledState(modelId) {
+  assertModelId(modelId);
+  return controlledStateProductModelIds[modelId];
+}
+
 export function buildModelContractPlan(modelId) {
   assertModelId(modelId);
   const plannedRequestBreakdown = {
diff --git a/supervisor/Dada.Supervisor/ControlledExternalValidationLauncher.cs b/supervisor/Dada.Supervisor/ControlledExternalValidationLauncher.cs
index 1bed7ab..aea1eaa 100644
--- a/supervisor/Dada.Supervisor/ControlledExternalValidationLauncher.cs
+++ b/supervisor/Dada.Supervisor/ControlledExternalValidationLauncher.cs
@@ -8,8 +8,7 @@ internal static partial class ControlledExternalValidationLauncher
 {
     private static readonly HashSet<string> AllowedModels =
     [
-        "gemini-3.1-flash-image-preview",
-        "gemini-3-pro-image-preview",
+        "gemini-3.1-flash-image",
         "gpt-image-2",
     ];
 
diff --git a/tests/integration/wp7-02-controlled-state.test.ts b/tests/integration/wp7-02-controlled-state.test.ts
index 598b5fc..2c99f13 100644
--- a/tests/integration/wp7-02-controlled-state.test.ts
+++ b/tests/integration/wp7-02-controlled-state.test.ts
@@ -13,6 +13,7 @@ import { RegistrationService } from "../../apps/api/src/registration.js";
 import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
 import { settleGenerationCredits } from "../../apps/worker/src/credit-settlement.js";
 import { generationErrorCategories, generationErrorRegistry } from "../../apps/worker/src/generation-error-registry.js";
+import { WP7_02_MODEL_IDS, productModelIdForControlledState } from "../../scripts/lib/wp7-02-external-contract.mjs";
 
 const now = Date.parse("2026-08-04T08:00:00.000Z");
 
@@ -42,7 +43,9 @@ function writeModelEvidence(modelId: string, value: unknown) {
 describe("TDD-WP7-EXT-001 controlled deterministic state boundaries", () => {
   it("proves nine errors, settlement replay, invalidation and full revalidation independently per model", () => {
     const evidenceIds = new Set<string>();
-    for (const modelId of modelIds) {
+    for (const externalModelId of WP7_02_MODEL_IDS) {
+      const modelId = productModelIdForControlledState(externalModelId);
+      expect(modelIds).toContain(modelId);
       const root = mkdtempSync(join(tmpdir(), "dada-wp7-02-state-"));
       const databasePath = join(root, "dada.sqlite3");
       const registration = new RegistrationService({
@@ -123,10 +126,10 @@ describe("TDD-WP7-EXT-001 controlled deterministic state boundaries", () => {
         expect(contracts.read(modelId, first.model.config_version)?.evidence_hash).toBe(firstEvidenceHash);
         expect(contracts.read(modelId, revalidated.model.config_version)?.evidence_hash).toBe(secondEvidenceHash);
 
-        const evidenceId = `sha256:${createHash("sha256").update(`${modelId}:deterministic-state`).digest("hex")}`;
+        const evidenceId = `sha256:${createHash("sha256").update(`${externalModelId}:deterministic-state`).digest("hex")}`;
         expect(evidenceIds.has(evidenceId)).toBe(false);
         evidenceIds.add(evidenceId);
-        writeModelEvidence(modelId, {
+        writeModelEvidence(externalModelId, {
           contract_change: {
             after_change: { config_set_version: 3, config_version: invalidated.config_version, status: invalidated.contract_validation_status },
             after_revalidation: { config_set_version: 4, config_version: revalidated.model.config_version, status: revalidated.model.contract_validation_status },
@@ -135,7 +138,7 @@ describe("TDD-WP7-EXT-001 controlled deterministic state boundaries", () => {
           },
           error_scenarios: generationErrorCategories.map((category) => ({ category, ...generationErrorRegistry[category], source: "deterministic_local", status: "passed" })),
           evidence_id: evidenceId,
-          model_id: modelId,
+          model_id: externalModelId,
           settlements,
           status: "passed",
         });
@@ -146,6 +149,6 @@ describe("TDD-WP7-EXT-001 controlled deterministic state boundaries", () => {
         rmSync(root, { force: true, recursive: true });
       }
     }
-    expect(evidenceIds.size).toBe(3);
+    expect(evidenceIds.size).toBe(WP7_02_MODEL_IDS.length);
   });
 });