Harden public ownership and diagnostic contracts

engine_test.go

@@ -203,26 +203,44 @@ func TestPreparedRunJSONDoesNotExposeSecretOrTargetPresence(t *testing.T) {
 }
 
 func TestRunRequestFormattingRedactsDirectAPIKey(t *testing.T) {
-	const secret = "run-request-secret"
+	const (
+		secret        = "run-request-api-key-sentinel"
+		inputURI      = "memory://run-request-uri-sentinel"
+		inputBody     = "run-request-body-sentinel"
+		variableValue = "run-request-variable-sentinel"
+	)
 	req := promptkit.RunRequest{
 		PromptID:  frameworkMarkdownSummaryPromptID,
 		ProfileID: frameworkFastProfileID,
 		APIKey:    secret,
 		Inputs: map[string]promptkit.ArtifactRef{
-			"transcript": promptkit.Inline("Rin opens the gate."),
+			"transcript": promptkit.InlineWithURI(inputURI, inputBody),
 		},
+		Vars: map[string]string{"audience": variableValue},
 	}
 
 	for _, formatted := range []string{
-		fmt.Sprint(req),
+		req.String(),
+		req.GoString(),
+		fmt.Sprintf("%v", req),
 		fmt.Sprintf("%+v", req),
 		fmt.Sprintf("%#v", req),
 	} {
-		if strings.Contains(formatted, secret) {
-			t.Fatalf("formatted RunRequest leaked API key: %s", formatted)
+		for _, privateValue := range []string{secret, inputURI, inputBody, variableValue} {
+			if strings.Contains(formatted, privateValue) {
+				t.Fatalf("formatted RunRequest leaked private value %q: %s", privateValue, formatted)
+			}
 		}
-		if !strings.Contains(formatted, "APIKeySet:true") {
-			t.Fatalf("formatted RunRequest should indicate an API key is set, got %s", formatted)
+		for _, summary := range []string{
+			`PromptID:"` + frameworkMarkdownSummaryPromptID + `"`,
+			`ProfileID:"` + frameworkFastProfileID + `"`,
+			"APIKeySet:true",
+			"Inputs:1",
+			"Vars:1",
+		} {
+			if !strings.Contains(formatted, summary) {
+				t.Fatalf("formatted RunRequest omitted structural summary %q: %s", summary, formatted)
+			}
 		}
 	}
 
@@ -1868,6 +1886,46 @@ func TestOpenAICompatibleProfileRunsThroughNormalProfilePath(t *testing.T) {
 	}
 }
 
+func TestOpenAICompatibleProfileMapsEveryField(t *testing.T) {
+	extraParams := map[string]any{"provider_option": "distinct-extra-params"}
+	got := promptkit.OpenAICompatibleProfile(promptkit.OpenAICompatibleProfileConfig{
+		ID:              "distinct-id",
+		BackendID:       "distinct-backend",
+		Endpoint:        "https://distinct.example/v1",
+		Model:           "distinct-model",
+		APIKeyRequired:  true,
+		Temperature:     0.25,
+		MaxTokens:       321,
+		TopP:            0.75,
+		TimeoutSeconds:  43,
+		ServiceTier:     "distinct-service-tier",
+		ReasoningEffort: "distinct-reasoning-effort",
+		ExtraParams:     extraParams,
+	})
+	want := promptkit.Profile{
+		ID:              "distinct-id",
+		BackendID:       "distinct-backend",
+		Endpoint:        "https://distinct.example/v1",
+		Model:           "distinct-model",
+		Temperature:     0.25,
+		MaxTokens:       321,
+		TopP:            0.75,
+		TimeoutSeconds:  43,
+		ServiceTier:     "distinct-service-tier",
+		ReasoningEffort: "distinct-reasoning-effort",
+		APIKeyRequired:  true,
+		ExtraParams:     map[string]any{"provider_option": "distinct-extra-params"},
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("profile mapping:\ngot  %#v\nwant %#v", got, want)
+	}
+
+	extraParams["added_after_construction"] = true
+	if _, ok := got.ExtraParams["added_after_construction"]; ok {
+		t.Fatal("profile retained the configuration map")
+	}
+}
+
 func TestEngineRunLayersTransportAndGenerationTimeouts(t *testing.T) {
 	intPointer := func(value int) *int {
 		return &value