test(wp7-02): enforce exact image dimensions

tests/package/wp7-02-controlled-executor.test.mjs

@@ -6,6 +6,7 @@ import {
   buildControlledExecutionPlan,
   buildProviderRequest,
   buildSanitizedResponseEvidence,
+  describeProviderResponseShape,
   executeProviderRequest,
   normalizeProviderResponse,
   validateSanitizedEvidence,
@@ -161,11 +162,29 @@ test("TDD-WP7-EXT-001 executes only five real success probes per model and keeps
   assert.equal(fetchCalls, 5);
   assert.equal(execution.real_calls, 5);
   assert.equal(execution.status, "externally_blocked");
-  assert.equal(execution.calls.filter((call) => call.status === "passed").length, 2);
+  assert.equal(execution.calls.filter((call) => call.status === "passed").length, 0);
   assert.doesNotMatch(JSON.stringify(execution), /controlled-secret|fixture prompt|iVBOR/i);
   await assert.rejects(() => runControlledRealScenarios({ maxRealCalls: 121, modelConfig: models[0], token: "not-used" }), /WP7_02_REAL_CALL_LIMIT_INVALID/);
 });
 
+test("TDD-WP7-EXT-001 describes only protocol structure and stops repeated contract-shape calls", async () => {
+  let fetchCalls = 0;
+  const execution = await runControlledRealScenarios({
+    fetchImpl: async () => {
+      fetchCalls += 1;
+      return new Response(JSON.stringify({ envelope: { outputs: [{ binary: "private-response-value" }] } }), { status: 200 });
+    },
+    maxRealCalls: 120,
+    modelConfig: models[0],
+    token: "controlled-secret-value-for-test-only",
+  });
+  assert.equal(fetchCalls, 1);
+  assert.equal(execution.real_calls, 1);
+  assert.equal(execution.calls[0].error_code, "WP7_02_RESPONSE_SINGLE_IMAGE_REQUIRED");
+  assert.deepEqual(execution.calls[0].response_shape, describeProviderResponseShape({ envelope: { outputs: [{ binary: "different-private-value" }] } }));
+  assert.doesNotMatch(JSON.stringify(execution.calls[0].response_shape), /private-response-value|different-private-value/);
+});
+
 test("TDD-WP7-EXT-001 assembles independent complete evidence without retaining reference bytes", () => {
   const reference = createControlledReferencePng();
   assert.equal(reference.subarray(0, 8).toString("hex"), "89504e470d0a1a0a");