237 lines
10 KiB
JavaScript
237 lines
10 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { test } from "node:test";
|
|
|
|
import {
|
|
WP7_02_CONTROLLED_REAL_LIMIT,
|
|
buildControlledExecutionPlan,
|
|
buildProviderRequest,
|
|
buildSanitizedResponseEvidence,
|
|
describeProviderResponseShape,
|
|
executeProviderRequest,
|
|
normalizeProviderResponse,
|
|
validateSanitizedEvidence,
|
|
} from "../../scripts/lib/wp7-02-controlled-executor.mjs";
|
|
import {
|
|
assembleControlledModelEvidence,
|
|
buildDeterministicExecutionEvidence,
|
|
createControlledReferencePng,
|
|
runControlledRealScenarios,
|
|
} from "../../scripts/lib/wp7-02-controlled-matrix.mjs";
|
|
|
|
const models = [
|
|
{
|
|
config_version: 2,
|
|
model_id: "gemini-3.1-flash-image-preview",
|
|
route_profile: {
|
|
endpoint: "https://oneapi.intelligrow.cn/v1/models/gemini-3.1-flash-image-preview:generateContent",
|
|
mode: "sync",
|
|
protocol_version: "gemini-native-v1",
|
|
},
|
|
},
|
|
{
|
|
config_version: 2,
|
|
model_id: "gemini-3-pro-image-preview",
|
|
route_profile: {
|
|
endpoint: "https://oneapi.intelligrow.cn/v1/models/gemini-3-pro-image-preview:generateContent",
|
|
mode: "sync",
|
|
protocol_version: "gemini-native-v1",
|
|
},
|
|
},
|
|
{
|
|
config_version: 1,
|
|
model_id: "gpt-image-2",
|
|
route_profile: {
|
|
endpoint: "https://oneapi.intelligrow.cn/v1/images/generations",
|
|
mode: "sync",
|
|
protocol_version: "openai-images-v1",
|
|
},
|
|
},
|
|
];
|
|
|
|
const onePixelPng = Buffer.from(
|
|
"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=",
|
|
"base64",
|
|
);
|
|
|
|
test("TDD-WP7-EXT-001 caps real calls and separates real from deterministic scenarios", () => {
|
|
const plans = models.map((model) => buildControlledExecutionPlan(model));
|
|
assert.equal(WP7_02_CONTROLLED_REAL_LIMIT, 120);
|
|
assert.equal(plans.reduce((total, plan) => total + plan.planned_real_calls, 0) <= WP7_02_CONTROLLED_REAL_LIMIT, true);
|
|
for (const plan of plans) {
|
|
assert.deepEqual(plan.real_scenarios.map((entry) => entry.ratio), ["3:4", "1:1", "4:3", "9:16", "1:1"]);
|
|
assert.deepEqual(plan.real_scenarios.map((entry) => entry.input), ["pure_text", "pure_text", "pure_text", "pure_text", "reference_image"]);
|
|
assert.deepEqual(plan.execution_modes, [
|
|
{ mode: "sync", source: "real_gateway" },
|
|
{ mode: "async", source: "deterministic_local" },
|
|
{ mode: "poll", source: "deterministic_local" },
|
|
]);
|
|
assert.equal(plan.error_scenarios.length, 9);
|
|
assert.equal(plan.error_scenarios.every((entry) => entry.source === "deterministic_local"), true);
|
|
assert.deepEqual(plan.state_scenarios.map((entry) => entry.name), [
|
|
"credit_commit_once",
|
|
"credit_release_once_per_terminal_failure",
|
|
"contract_change_invalidation",
|
|
"full_revalidation",
|
|
]);
|
|
}
|
|
});
|
|
|
|
test("TDD-WP7-EXT-001 builds protocol-specific requests without auth in arguments", () => {
|
|
const reference = { bytes: onePixelPng, mime_type: "image/png" };
|
|
const gemini = buildProviderRequest({ modelConfig: models[0], prompt: "controlled fixture prompt", ratio: "3:4", reference });
|
|
assert.equal(gemini.method, "POST");
|
|
assert.equal(gemini.body.contents[0].parts.some((part) => part.inlineData?.data), true);
|
|
assert.deepEqual(gemini.body.generationConfig.responseModalities, ["IMAGE"]);
|
|
assert.deepEqual(gemini.body.generationConfig.responseFormat, {
|
|
image: { aspectRatio: "3:4", imageSize: "1K" },
|
|
});
|
|
assert.equal("imageConfig" in gemini.body.generationConfig, false);
|
|
assert.equal("authorization" in gemini.headers, false);
|
|
|
|
const openai = buildProviderRequest({ modelConfig: models[2], prompt: "controlled fixture prompt", ratio: "9:16" });
|
|
assert.deepEqual(openai.body, {
|
|
model: "gpt-image-2",
|
|
prompt: "controlled fixture prompt",
|
|
response_format: "b64_json",
|
|
size: "1008x1792",
|
|
});
|
|
assert.equal("authorization" in openai.headers, false);
|
|
});
|
|
|
|
test("TDD-WP7-EXT-001 retains only response metadata and hashes", () => {
|
|
const geminiResponse = {
|
|
candidates: [{ content: { parts: [{ inlineData: { data: onePixelPng.toString("base64"), mimeType: "image/png" } }] } }],
|
|
usageMetadata: { candidatesTokenCount: 7, promptTokenCount: 5, totalTokenCount: 12 },
|
|
};
|
|
const normalized = normalizeProviderResponse(models[0], geminiResponse);
|
|
const evidence = buildSanitizedResponseEvidence(normalized);
|
|
assert.deepEqual(evidence.dimensions, { height: 1, width: 1 });
|
|
assert.equal(evidence.mime, "image/png");
|
|
assert.match(evidence.evidence_hash, /^sha256:[A-F0-9]{64}$/);
|
|
assert.deepEqual(evidence.usage_summary, { input_units: 5, output_units: 7, total_units: 12 });
|
|
assert.doesNotMatch(JSON.stringify(evidence), /iVBOR|bytes|data|prompt|authorization|token/i);
|
|
assert.equal(validateSanitizedEvidence(evidence), evidence);
|
|
});
|
|
|
|
test("TDD-WP7-EXT-001 rejects sensitive or shared evidence fields", () => {
|
|
for (const key of ["raw_prompt", "raw_provider_payload", "credential_value", "authorization", "absolute_path"]) {
|
|
assert.throws(() => validateSanitizedEvidence({ [key]: "forbidden", status: "passed" }), /WP7_02_SENSITIVE_EVIDENCE_FORBIDDEN/);
|
|
}
|
|
assert.throws(() => validateSanitizedEvidence({ status: "passed", verified: true }), /WP7_02_SHARED_VERIFIED_FORBIDDEN/);
|
|
});
|
|
|
|
test("TDD-WP7-EXT-001 confines the credential to the request header and discards provider error bodies", async () => {
|
|
const credentialMarker = "controlled-secret-value-for-test-only";
|
|
const success = await executeProviderRequest({
|
|
fetchImpl: async (_url, init) => {
|
|
assert.equal(init.headers.authorization, `Bearer ${credentialMarker}`);
|
|
return new Response(JSON.stringify({
|
|
candidates: [{ content: { parts: [{ inlineData: { data: onePixelPng.toString("base64"), mimeType: "image/png" } }] } }],
|
|
}), { headers: { "content-type": "application/json" }, status: 200 });
|
|
},
|
|
modelConfig: models[0],
|
|
prompt: "controlled fixture prompt",
|
|
ratio: "1:1",
|
|
token: credentialMarker,
|
|
});
|
|
assert.equal(success.http_status, 200);
|
|
assert.deepEqual(success.response_evidence.dimensions, { height: 1080, width: 1080 });
|
|
assert.deepEqual(success.response_evidence.normalization, {
|
|
applied: true,
|
|
upstream_dimensions: { height: 1, width: 1 },
|
|
});
|
|
assert.doesNotMatch(JSON.stringify({ ...success, normalized: undefined }), new RegExp(credentialMarker));
|
|
|
|
await assert.rejects(() => executeProviderRequest({
|
|
fetchImpl: async () => new Response(JSON.stringify({ provider_body: credentialMarker }), { status: 502 }),
|
|
modelConfig: models[0],
|
|
prompt: "controlled fixture prompt",
|
|
ratio: "1:1",
|
|
token: credentialMarker,
|
|
}), (error) => {
|
|
assert.equal(error.message, "WP7_02_UPSTREAM_HTTP_502");
|
|
assert.doesNotMatch(error.message, new RegExp(credentialMarker));
|
|
return true;
|
|
});
|
|
});
|
|
|
|
test("TDD-WP7-EXT-001 executes only five real success probes per model and keeps failed ratios blocking", async () => {
|
|
let fetchCalls = 0;
|
|
const execution = await runControlledRealScenarios({
|
|
fetchImpl: async () => {
|
|
fetchCalls += 1;
|
|
return new Response(JSON.stringify({
|
|
candidates: [{ content: { parts: [{ inlineData: { data: onePixelPng.toString("base64"), mimeType: "image/png" } }] } }],
|
|
}), { status: 200 });
|
|
},
|
|
maxRealCalls: 120,
|
|
modelConfig: models[0],
|
|
token: "controlled-secret-value-for-test-only",
|
|
});
|
|
assert.equal(fetchCalls, 5);
|
|
assert.equal(execution.real_calls, 5);
|
|
assert.equal(execution.status, "externally_blocked");
|
|
assert.equal(execution.calls.filter((call) => call.status === "passed").length, 2);
|
|
assert.doesNotMatch(JSON.stringify(execution), /controlled-secret|fixture prompt|iVBOR/i);
|
|
await assert.rejects(() => runControlledRealScenarios({ maxRealCalls: 121, modelConfig: models[0], token: "not-used" }), /WP7_02_REAL_CALL_LIMIT_INVALID/);
|
|
});
|
|
|
|
test("TDD-WP7-EXT-001 describes only protocol structure and stops repeated contract-shape calls", async () => {
|
|
let fetchCalls = 0;
|
|
const execution = await runControlledRealScenarios({
|
|
fetchImpl: async () => {
|
|
fetchCalls += 1;
|
|
return new Response(JSON.stringify({ envelope: { outputs: [{ binary: "private-response-value" }] } }), { status: 200 });
|
|
},
|
|
maxRealCalls: 120,
|
|
modelConfig: models[0],
|
|
token: "controlled-secret-value-for-test-only",
|
|
});
|
|
assert.equal(fetchCalls, 1);
|
|
assert.equal(execution.real_calls, 1);
|
|
assert.equal(execution.calls[0].error_code, "WP7_02_RESPONSE_SINGLE_IMAGE_REQUIRED");
|
|
assert.deepEqual(execution.calls[0].response_shape, describeProviderResponseShape({ envelope: { outputs: [{ binary: "different-private-value" }] } }));
|
|
assert.doesNotMatch(JSON.stringify(execution.calls[0].response_shape), /private-response-value|different-private-value/);
|
|
});
|
|
|
|
test("TDD-WP7-EXT-001 assembles independent complete evidence without retaining reference bytes", () => {
|
|
const reference = createControlledReferencePng();
|
|
assert.equal(reference.subarray(0, 8).toString("hex"), "89504e470d0a1a0a");
|
|
const calls = ["3:4", "1:1", "4:3", "9:16"].map((ratio, index) => ({
|
|
duration_ms: 1,
|
|
http_status: 200,
|
|
input: "pure_text",
|
|
requested_ratio: ratio,
|
|
response: { dimensions: { height: 1, width: 1 }, evidence_hash: `sha256:${"A".repeat(64)}`, mime: "image/png", usage_summary: { input_units: 0, output_units: 0, total_units: 0 } },
|
|
scenario_id: `real-${index + 1}`,
|
|
source: "real_gateway",
|
|
status: "passed",
|
|
}));
|
|
calls.push({ ...calls[1], input: "reference_image", scenario_id: "real-5" });
|
|
const deterministicState = {
|
|
contract_change: { full_matrix_reapplied: true },
|
|
error_scenarios: Array.from({ length: 9 }, (_, index) => ({ category: `category-${index}`, status: "passed" })),
|
|
model_id: models[0].model_id,
|
|
settlements: ["succeeded", "failed", "rejected"].map((outcome) => ({ outcome })),
|
|
status: "passed",
|
|
};
|
|
const evidence = assembleControlledModelEvidence({
|
|
deterministicState,
|
|
modelConfig: models[0],
|
|
realExecution: { calls, planned_real_calls: 5, real_calls: 5, status: "passed" },
|
|
runId: "wp7-02-assembly-test",
|
|
});
|
|
assert.equal(evidence.status, "passed");
|
|
assert.equal(evidence.manual_review.status, "pending");
|
|
assert.equal(evidence.matrix.error_scenarios.length, 9);
|
|
assert.doesNotMatch(JSON.stringify(evidence), /iVBOR|image_bytes|raw_prompt|authorization/i);
|
|
const execution = buildDeterministicExecutionEvidence(models[0].model_id, "wp7-02-assembly-test");
|
|
assert.deepEqual(execution.modes.map((entry) => entry.mode), ["sync", "async", "poll"]);
|
|
assert.deepEqual(execution.trace.map((entry) => `${entry.action}:${entry.before}->${entry.after}`), [
|
|
"start:created->pending",
|
|
"poll:pending->completed",
|
|
"poll:completed->completed",
|
|
]);
|
|
assert.equal(execution.trace[2].replay, true);
|
|
});
|