test: configure WP7-02 OneAPI model routes

tests/package/wp7-02-external-contract.test.mjs

@@ -1,4 +1,5 @@
 import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
 import { test } from "node:test";
 
 import {
@@ -95,6 +96,20 @@ test("TDD-WP7-EXT-001 remains externally blocked without confirmation, config an
   assert.equal("verified" in readiness, false);
 });
 
+test("TDD-WP7-EXT-001 fixes independent OneAPI routes without embedding credentials", () => {
+  const manifest = JSON.parse(readFileSync("config/wp7-02-oneapi-test.json", "utf8"));
+  assert.equal(manifest.config_set_version, 1);
+  assert.equal(manifest.gateway_account_ref, "oneapi-intelligrow-test");
+  assert.deepEqual(manifest.models.map((entry) => entry.model_id), WP7_02_MODEL_IDS);
+  assert.deepEqual(manifest.models.map((entry) => entry.route_profile.protocol_version), [
+    "gemini-native-v1beta",
+    "gemini-native-v1beta",
+    "openai-images-v1",
+  ]);
+  assert.equal(manifest.models.every((entry) => entry.route_profile.endpoint.startsWith("https://oneapi.intelligrow.cn/")), true);
+  assert.doesNotMatch(JSON.stringify(manifest), /api[_-]?key|authorization|bearer|sk-[A-Za-z0-9]/i);
+});
+
 test("TDD-WP7-EXT-001 writes blocked evidence without mock or sensitive payloads", () => {
   const evidence = WP7_02_MODEL_IDS.map((modelId) => buildBlockedModelEvidence({
     blockers: ["real_gateway_credentials_absent", "real_model_config_absent"],