feat: provider api_formats 可空继承、OpenAI 图片 edit/variation 与用量配额多项补强

- 鉴权: provider_api_keys.api_formats 改为可空，OAuth 托管 key 自动继承 provider endpoints 激活格式，相关 handler/测试同步更新
- 图片 planner: OpenAI 图片路由新增 edit/variation 操作并完善参数校验、响应合并与流式处理
- 用量: user me usage 返回区分 client_requested_stream/upstream_is_stream，前端 usage 列表筛选与展示增强
- 统计: stats_daily_model 新增 cache_creation_ephemeral_5m/1h tokens 字段与回填链路
- 配额/observability: quota repository 新增内存与 SQL 扩展，admin observability usage 字段扩充
- 其它: OAuth 导入/轮询收敛、provider 汇总与 pool admin 读写链路小修、新增 system_config 缓存与 provider template handler

Closes #318

Co-authored-by: Entropy.Xu <53283266+Entropy-Xu@users.noreply.github.com>

apps/aether-gateway/src/tests/ai_execute/stream/image.rs

@@ -0,0 +1,427 @@
+use super::{
+    any, build_router_with_state, build_state_with_execution_runtime_override, json, start_server,
+    to_bytes, Arc, Body, Json, Mutex, Request, Router, StatusCode, TRACE_ID_HEADER,
+};
+use crate::ai_pipeline::CODEX_OPENAI_IMAGE_INTERNAL_MODEL;
+use aether_crypto::{encrypt_python_fernet_plaintext, DEVELOPMENT_ENCRYPTION_KEY};
+use aether_data::repository::auth::{
+    InMemoryAuthApiKeySnapshotRepository, StoredAuthApiKeySnapshot,
+};
+use aether_data::repository::candidate_selection::InMemoryMinimalCandidateSelectionReadRepository;
+use aether_data::repository::candidates::InMemoryRequestCandidateRepository;
+use aether_data::repository::provider_catalog::InMemoryProviderCatalogReadRepository;
+use aether_data_contracts::repository::candidate_selection::{
+    StoredMinimalCandidateSelectionRow, StoredProviderModelMapping,
+};
+use aether_data_contracts::repository::provider_catalog::{
+    StoredProviderCatalogEndpoint, StoredProviderCatalogKey, StoredProviderCatalogProvider,
+};
+use sha2::{Digest, Sha256};
+
+#[tokio::test]
+async fn gateway_executes_codex_image_stream_via_local_decision_gate_after_oauth_refresh() {
+    #[derive(Debug, Clone)]
+    struct SeenExecutionRuntimeStreamRequest {
+        trace_id: String,
+        url: String,
+        model: String,
+        authorization: String,
+        x_client_request_id: String,
+        tool_type: String,
+        tool_partial_images: Option<u64>,
+        request_stream: bool,
+        plan_stream: bool,
+    }
+
+    #[derive(Debug, Clone)]
+    struct SeenRefreshRequest {
+        content_type: String,
+        body: String,
+    }
+
+    fn hash_api_key(value: &str) -> String {
+        let mut hasher = Sha256::new();
+        hasher.update(value.as_bytes());
+        format!("{:x}", hasher.finalize())
+    }
+
+    fn sample_auth_snapshot(api_key_id: &str, user_id: &str) -> StoredAuthApiKeySnapshot {
+        StoredAuthApiKeySnapshot::new(
+            user_id.to_string(),
+            "alice".to_string(),
+            Some("alice@example.com".to_string()),
+            "user".to_string(),
+            "local".to_string(),
+            true,
+            false,
+            Some(serde_json::json!(["openai", "codex"])),
+            Some(serde_json::json!(["openai:image"])),
+            Some(serde_json::json!(["gpt-image-2"])),
+            api_key_id.to_string(),
+            Some("default".to_string()),
+            true,
+            false,
+            false,
+            Some(60),
+            Some(5),
+            Some(4_102_444_800_i64),
+            Some(serde_json::json!(["openai", "codex"])),
+            Some(serde_json::json!(["openai:image"])),
+            Some(serde_json::json!(["gpt-image-2"])),
+        )
+        .expect("auth snapshot should build")
+    }
+
+    fn sample_candidate_row() -> StoredMinimalCandidateSelectionRow {
+        StoredMinimalCandidateSelectionRow {
+            provider_id: "provider-codex-image-stream-local-1".to_string(),
+            provider_name: "codex".to_string(),
+            provider_type: "codex".to_string(),
+            provider_priority: 10,
+            provider_is_active: true,
+            endpoint_id: "endpoint-codex-image-stream-local-1".to_string(),
+            endpoint_api_format: "openai:image".to_string(),
+            endpoint_api_family: Some("openai".to_string()),
+            endpoint_kind: Some("image".to_string()),
+            endpoint_is_active: true,
+            key_id: "key-codex-image-stream-local-1".to_string(),
+            key_name: "oauth".to_string(),
+            key_auth_type: "oauth".to_string(),
+            key_is_active: true,
+            key_api_formats: Some(vec!["openai:image".to_string()]),
+            key_allowed_models: None,
+            key_capabilities: None,
+            key_internal_priority: 5,
+            key_global_priority_by_format: Some(serde_json::json!({"openai:image": 1})),
+            model_id: "model-codex-image-stream-local-1".to_string(),
+            global_model_id: "global-model-codex-image-stream-local-1".to_string(),
+            global_model_name: "gpt-image-2".to_string(),
+            global_model_mappings: None,
+            global_model_supports_streaming: Some(true),
+            model_provider_model_name: "gpt-image-2".to_string(),
+            model_provider_model_mappings: Some(vec![StoredProviderModelMapping {
+                name: "gpt-image-2".to_string(),
+                priority: 1,
+                api_formats: Some(vec!["openai:image".to_string()]),
+            }]),
+            model_supports_streaming: Some(true),
+            model_is_active: true,
+            model_is_available: true,
+        }
+    }
+
+    fn sample_provider_catalog_provider() -> StoredProviderCatalogProvider {
+        StoredProviderCatalogProvider::new(
+            "provider-codex-image-stream-local-1".to_string(),
+            "codex".to_string(),
+            Some("https://chatgpt.com".to_string()),
+            "codex".to_string(),
+        )
+        .expect("provider should build")
+        .with_transport_fields(
+            true,
+            false,
+            false,
+            None,
+            Some(2),
+            None,
+            Some(20.0),
+            None,
+            None,
+        )
+    }
+
+    fn sample_provider_catalog_endpoint() -> StoredProviderCatalogEndpoint {
+        StoredProviderCatalogEndpoint::new(
+            "endpoint-codex-image-stream-local-1".to_string(),
+            "provider-codex-image-stream-local-1".to_string(),
+            "openai:image".to_string(),
+            Some("openai".to_string()),
+            Some("image".to_string()),
+            true,
+        )
+        .expect("endpoint should build")
+        .with_transport_fields(
+            "https://chatgpt.com/backend-api/codex".to_string(),
+            None,
+            None,
+            Some(2),
+            None,
+            Some(serde_json::json!({"upstream_stream_policy":"force_stream"})),
+            None,
+            None,
+        )
+        .expect("endpoint transport should build")
+    }
+
+    fn sample_provider_catalog_key() -> StoredProviderCatalogKey {
+        let encrypted_auth_config = encrypt_python_fernet_plaintext(
+            DEVELOPMENT_ENCRYPTION_KEY,
+            r#"{"provider_type":"codex","refresh_token":"rt-codex-image-stream-local-123"}"#,
+        )
+        .expect("auth config should encrypt");
+        StoredProviderCatalogKey::new(
+            "key-codex-image-stream-local-1".to_string(),
+            "provider-codex-image-stream-local-1".to_string(),
+            "oauth".to_string(),
+            "oauth".to_string(),
+            None,
+            true,
+        )
+        .expect("key should build")
+        .with_transport_fields(
+            Some(serde_json::json!(["openai:image"])),
+            encrypt_python_fernet_plaintext(DEVELOPMENT_ENCRYPTION_KEY, "__placeholder__")
+                .expect("placeholder api key should encrypt"),
+            Some(encrypted_auth_config),
+            None,
+            Some(serde_json::json!({"openai:image": 1})),
+            None,
+            None,
+            None,
+            None,
+        )
+        .expect("key transport should build")
+    }
+
+    let seen_execution_runtime = Arc::new(Mutex::new(None::<SeenExecutionRuntimeStreamRequest>));
+    let seen_execution_runtime_clone = Arc::clone(&seen_execution_runtime);
+    let seen_refresh = Arc::new(Mutex::new(None::<SeenRefreshRequest>));
+    let seen_refresh_clone = Arc::clone(&seen_refresh);
+
+    let refresh = Router::new().route(
+        "/oauth/token",
+        any(move |request: Request| {
+            let seen_refresh_inner = Arc::clone(&seen_refresh_clone);
+            async move {
+                let (parts, body) = request.into_parts();
+                let raw_body = to_bytes(body, usize::MAX).await.expect("body should read");
+                *seen_refresh_inner.lock().expect("mutex should lock") = Some(SeenRefreshRequest {
+                    content_type: parts
+                        .headers
+                        .get(http::header::CONTENT_TYPE)
+                        .and_then(|value| value.to_str().ok())
+                        .unwrap_or_default()
+                        .to_string(),
+                    body: String::from_utf8(raw_body.to_vec())
+                        .expect("refresh body should be utf8"),
+                });
+                Json(json!({
+                    "access_token": "refreshed-codex-image-stream-access-token",
+                    "refresh_token": "rt-codex-image-stream-local-456",
+                    "token_type": "Bearer",
+                    "expires_in": 3600
+                }))
+            }
+        }),
+    );
+
+    let execution_runtime = Router::new().route(
+        "/v1/execute/stream",
+        any(move |request: Request| {
+            let seen_execution_runtime_inner = Arc::clone(&seen_execution_runtime_clone);
+            async move {
+                let (parts, body) = request.into_parts();
+                let raw_body = to_bytes(body, usize::MAX).await.expect("body should read");
+                let payload: serde_json::Value = serde_json::from_slice(&raw_body)
+                    .expect("execution runtime payload should parse");
+                *seen_execution_runtime_inner
+                    .lock()
+                    .expect("mutex should lock") = Some(SeenExecutionRuntimeStreamRequest {
+                    trace_id: parts
+                        .headers
+                        .get(TRACE_ID_HEADER)
+                        .and_then(|value| value.to_str().ok())
+                        .unwrap_or_default()
+                        .to_string(),
+                    url: payload
+                        .get("url")
+                        .and_then(|value| value.as_str())
+                        .unwrap_or_default()
+                        .to_string(),
+                    model: payload
+                        .get("body")
+                        .and_then(|value| value.get("json_body"))
+                        .and_then(|value| value.get("model"))
+                        .and_then(|value| value.as_str())
+                        .unwrap_or_default()
+                        .to_string(),
+                    authorization: payload
+                        .get("headers")
+                        .and_then(|value| value.get("authorization"))
+                        .and_then(|value| value.as_str())
+                        .unwrap_or_default()
+                        .to_string(),
+                    x_client_request_id: payload
+                        .get("headers")
+                        .and_then(|value| value.get("x-client-request-id"))
+                        .and_then(|value| value.as_str())
+                        .unwrap_or_default()
+                        .to_string(),
+                    tool_type: payload
+                        .get("body")
+                        .and_then(|value| value.get("json_body"))
+                        .and_then(|value| value.get("tools"))
+                        .and_then(|value| value.get(0))
+                        .and_then(|value| value.get("type"))
+                        .and_then(|value| value.as_str())
+                        .unwrap_or_default()
+                        .to_string(),
+                    tool_partial_images: payload
+                        .get("body")
+                        .and_then(|value| value.get("json_body"))
+                        .and_then(|value| value.get("tools"))
+                        .and_then(|value| value.get(0))
+                        .and_then(|value| value.get("partial_images"))
+                        .and_then(|value| value.as_u64()),
+                    request_stream: payload
+                        .get("body")
+                        .and_then(|value| value.get("json_body"))
+                        .and_then(|value| value.get("stream"))
+                        .and_then(|value| value.as_bool())
+                        .unwrap_or(false),
+                    plan_stream: payload
+                        .get("stream")
+                        .and_then(|value| value.as_bool())
+                        .unwrap_or(false),
+                });
+                let frames = concat!(
+                    "{\"type\":\"headers\",\"payload\":{\"kind\":\"headers\",\"status_code\":200,\"headers\":{\"content-type\":\"text/event-stream\"}}}\n",
+                    "{\"type\":\"data\",\"payload\":{\"kind\":\"data\",\"text\":\"event: response.output_item.done\\ndata: {\\\"type\\\":\\\"response.output_item.done\\\",\\\"output_index\\\":0,\\\"item\\\":{\\\"id\\\":\\\"ig_123\\\",\\\"type\\\":\\\"image_generation_call\\\",\\\"result\\\":\\\"aGVsbG8=\\\"}}\\n\\n\"}}\n",
+                    "{\"type\":\"data\",\"payload\":{\"kind\":\"data\",\"text\":\"event: response.completed\\ndata: {\\\"type\\\":\\\"response.completed\\\",\\\"response\\\":{\\\"tool_usage\\\":{\\\"image_gen\\\":{\\\"input_tokens\\\":11,\\\"output_tokens\\\":22,\\\"total_tokens\\\":33}}}}\\n\\n\"}}\n",
+                    "{\"type\":\"telemetry\",\"payload\":{\"kind\":\"telemetry\",\"telemetry\":{\"elapsed_ms\":41}}}\n",
+                    "{\"type\":\"eof\",\"payload\":{\"kind\":\"eof\"}}\n"
+                );
+                let mut response = http::Response::builder()
+                    .status(StatusCode::OK)
+                    .body(Body::from(frames))
+                    .expect("response should build");
+                response.headers_mut().insert(
+                    http::header::CONTENT_TYPE,
+                    http::HeaderValue::from_static("application/x-ndjson"),
+                );
+                response
+            }
+        }),
+    );
+
+    let client_api_key = "sk-client-codex-image-stream-local";
+    let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![(
+        Some(hash_api_key(client_api_key)),
+        sample_auth_snapshot(
+            "key-codex-image-stream-client-123",
+            "user-codex-image-stream-client-123",
+        ),
+    )]));
+    let candidate_selection_repository =
+        Arc::new(InMemoryMinimalCandidateSelectionReadRepository::seed(vec![
+            sample_candidate_row(),
+        ]));
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![sample_provider_catalog_provider()],
+        vec![sample_provider_catalog_endpoint()],
+        vec![sample_provider_catalog_key()],
+    ));
+
+    let (refresh_url, refresh_handle) = start_server(refresh).await;
+    let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await;
+    let oauth_refresh =
+        crate::provider_transport::LocalOAuthRefreshCoordinator::with_adapters_for_tests(vec![
+            Arc::new(
+                crate::provider_transport::oauth_refresh::GenericOAuthRefreshAdapter::default()
+                    .with_token_url_for_tests("codex", format!("{refresh_url}/oauth/token")),
+            ),
+        ]);
+    let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url.clone())
+        .with_data_state_for_tests(
+            crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests(
+                auth_repository,
+                candidate_selection_repository,
+                provider_catalog_repository,
+                Arc::new(InMemoryRequestCandidateRepository::default()),
+                DEVELOPMENT_ENCRYPTION_KEY,
+            ),
+        )
+        .with_oauth_refresh_coordinator_for_tests(oauth_refresh);
+    let gateway = build_router_with_state(gateway_state);
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let response = reqwest::Client::new()
+        .post(format!("{gateway_url}/v1/images/generations"))
+        .header(http::header::CONTENT_TYPE, "application/json")
+        .header(
+            http::header::AUTHORIZATION,
+            format!("Bearer {client_api_key}"),
+        )
+        .header(TRACE_ID_HEADER, "trace-codex-image-stream-local-123")
+        .body(
+            "{\"model\":\"gpt-image-2\",\"prompt\":\"生成一张中国历史视觉海报\",\"stream\":true,\"partial_images\":1}",
+        )
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(
+        response
+            .headers()
+            .get(http::header::CONTENT_TYPE)
+            .and_then(|value| value.to_str().ok()),
+        Some("text/event-stream")
+    );
+    let response_text = response.text().await.expect("body should read");
+    assert!(response_text.contains("event: image_generation.partial_image"));
+    assert!(response_text.contains("\"type\":\"image_generation.partial_image\""));
+    assert!(response_text.contains("\"b64_json\":\"aGVsbG8=\""));
+    assert!(response_text.contains("event: image_generation.completed"));
+    assert!(response_text.contains("\"type\":\"image_generation.completed\""));
+    assert!(response_text.contains("\"total_tokens\":33"));
+    assert!(!response_text.contains("response.completed"));
+
+    let seen_refresh_request = seen_refresh
+        .lock()
+        .expect("mutex should lock")
+        .clone()
+        .expect("refresh request should be captured");
+    assert_eq!(
+        seen_refresh_request.content_type,
+        "application/x-www-form-urlencoded"
+    );
+    assert!(seen_refresh_request
+        .body
+        .contains("refresh_token=rt-codex-image-stream-local-123"));
+
+    let seen_execution_runtime_request = seen_execution_runtime
+        .lock()
+        .expect("mutex should lock")
+        .clone()
+        .expect("execution runtime stream should be captured");
+    assert_eq!(
+        seen_execution_runtime_request.trace_id,
+        "trace-codex-image-stream-local-123"
+    );
+    assert_eq!(
+        seen_execution_runtime_request.url,
+        "https://chatgpt.com/backend-api/codex/responses"
+    );
+    assert_eq!(
+        seen_execution_runtime_request.model,
+        CODEX_OPENAI_IMAGE_INTERNAL_MODEL
+    );
+    assert_eq!(
+        seen_execution_runtime_request.authorization,
+        "Bearer refreshed-codex-image-stream-access-token"
+    );
+    assert_eq!(
+        seen_execution_runtime_request.x_client_request_id,
+        "trace-codex-image-stream-local-123"
+    );
+    assert_eq!(seen_execution_runtime_request.tool_type, "image_generation");
+    assert_eq!(seen_execution_runtime_request.tool_partial_images, Some(1));
+    assert!(seen_execution_runtime_request.request_stream);
+    assert!(seen_execution_runtime_request.plan_stream);
+
+    gateway_handle.abort();
+    execution_runtime_handle.abort();
+    refresh_handle.abort();
+}

apps/aether-gateway/src/tests/ai_execute/stream/mod.rs

@@ -24,3 +24,4 @@ use super::{
 };
 
 mod decision;
+mod image;

apps/aether-gateway/src/tests/ai_execute/sync/image.rs

@@ -2,6 +2,7 @@ use super::{
     any, build_router_with_state, build_state_with_execution_runtime_override, json, start_server,
     to_bytes, Arc, Body, Json, Mutex, Request, Router, StatusCode, TRACE_ID_HEADER,
 };
+use crate::ai_pipeline::CODEX_OPENAI_IMAGE_INTERNAL_MODEL;
 use aether_crypto::{encrypt_python_fernet_plaintext, DEVELOPMENT_ENCRYPTION_KEY};
 use aether_data::repository::auth::{
     InMemoryAuthApiKeySnapshotRepository, StoredAuthApiKeySnapshot,
@@ -27,13 +28,13 @@ async fn gateway_executes_codex_image_sync_via_local_decision_gate_after_oauth_r
         model: String,
         authorization: String,
         x_client_request_id: String,
-        user_agent: String,
-        version: String,
-        originator: String,
         prompt: String,
         content_is_string: bool,
         tool_type: String,
         tool_size: String,
+        tool_quality: String,
+        tool_background: String,
+        tool_choice_type: String,
         tool_has_n: bool,
         request_stream: bool,
         plan_stream: bool,
@@ -268,24 +269,6 @@ async fn gateway_executes_codex_image_sync_via_local_decision_gate_after_oauth_r
                         .and_then(|value| value.as_str())
                         .unwrap_or_default()
                         .to_string(),
-                    user_agent: payload
-                        .get("headers")
-                        .and_then(|value| value.get("user-agent"))
-                        .and_then(|value| value.as_str())
-                        .unwrap_or_default()
-                        .to_string(),
-                    version: payload
-                        .get("headers")
-                        .and_then(|value| value.get("version"))
-                        .and_then(|value| value.as_str())
-                        .unwrap_or_default()
-                        .to_string(),
-                    originator: payload
-                        .get("headers")
-                        .and_then(|value| value.get("originator"))
-                        .and_then(|value| value.as_str())
-                        .unwrap_or_default()
-                        .to_string(),
                     prompt: payload
                         .get("body")
                         .and_then(|value| value.get("json_body"))
@@ -320,6 +303,32 @@ async fn gateway_executes_codex_image_sync_via_local_decision_gate_after_oauth_r
                         .and_then(|value| value.as_str())
                         .unwrap_or_default()
                         .to_string(),
+                    tool_quality: payload
+                        .get("body")
+                        .and_then(|value| value.get("json_body"))
+                        .and_then(|value| value.get("tools"))
+                        .and_then(|value| value.get(0))
+                        .and_then(|value| value.get("quality"))
+                        .and_then(|value| value.as_str())
+                        .unwrap_or_default()
+                        .to_string(),
+                    tool_background: payload
+                        .get("body")
+                        .and_then(|value| value.get("json_body"))
+                        .and_then(|value| value.get("tools"))
+                        .and_then(|value| value.get(0))
+                        .and_then(|value| value.get("background"))
+                        .and_then(|value| value.as_str())
+                        .unwrap_or_default()
+                        .to_string(),
+                    tool_choice_type: payload
+                        .get("body")
+                        .and_then(|value| value.get("json_body"))
+                        .and_then(|value| value.get("tool_choice"))
+                        .and_then(|value| value.get("type"))
+                        .and_then(|value| value.as_str())
+                        .unwrap_or_default()
+                        .to_string(),
                     tool_has_n: payload
                         .get("body")
                         .and_then(|value| value.get("json_body"))
@@ -349,9 +358,13 @@ async fn gateway_executes_codex_image_sync_via_local_decision_gate_after_oauth_r
                             concat!(
                                 "data: {\"type\":\"response.created\",\"response\":{\"id\":\"resp_img_123\",\"created_at\":1776839946}}\n\n",
                                 "data: {\"type\":\"response.output_item.done\",\"output_index\":0,\"item\":{\"id\":\"ig_123\",\"type\":\"image_generation_call\",\"status\":\"generating\",\"output_format\":\"png\",\"quality\":\"medium\",\"size\":\"1024x1024\",\"revised_prompt\":\"中国历史视觉海报\",\"result\":\"aGVsbG8=\"}}\n\n",
-                                "data: {\"type\":\"response.completed\",\"response\":{\"id\":\"resp_img_123\",\"object\":\"response\",\"model\":\"gpt-5.4\",\"status\":\"completed\",\"output\":[],\"usage\":{\"input_tokens\":2440,\"output_tokens\":184,\"total_tokens\":2624},\"tool_usage\":{\"image_gen\":{\"input_tokens\":171,\"input_tokens_details\":{\"image_tokens\":0,\"text_tokens\":171},\"output_tokens\":1372,\"output_tokens_details\":{\"image_tokens\":1372,\"text_tokens\":0},\"total_tokens\":1543}}}}\n\n",
+                                "data: {\"type\":\"response.completed\",\"response\":{\"id\":\"resp_img_123\",\"object\":\"response\",\"model\":\"__CODEX_IMAGE_MODEL__\",\"status\":\"completed\",\"output\":[],\"usage\":{\"input_tokens\":2440,\"output_tokens\":184,\"total_tokens\":2624},\"tool_usage\":{\"image_gen\":{\"input_tokens\":171,\"input_tokens_details\":{\"image_tokens\":0,\"text_tokens\":171},\"output_tokens\":1372,\"output_tokens_details\":{\"image_tokens\":1372,\"text_tokens\":0},\"total_tokens\":1543}}}}\n\n",
                                 "data: [DONE]\n\n"
                             )
+                            .replace(
+                                "__CODEX_IMAGE_MODEL__",
+                                CODEX_OPENAI_IMAGE_INTERNAL_MODEL,
+                            )
                         )
                     },
                     "telemetry": {
@@ -457,7 +470,10 @@ async fn gateway_executes_codex_image_sync_via_local_decision_gate_after_oauth_r
         seen_execution_runtime_request.url,
         "https://chatgpt.com/backend-api/codex/responses"
     );
-    assert_eq!(seen_execution_runtime_request.model, "gpt-5.4");
+    assert_eq!(
+        seen_execution_runtime_request.model,
+        CODEX_OPENAI_IMAGE_INTERNAL_MODEL
+    );
     assert_eq!(
         seen_execution_runtime_request.authorization,
         "Bearer refreshed-codex-image-access-token"
@@ -466,11 +482,6 @@ async fn gateway_executes_codex_image_sync_via_local_decision_gate_after_oauth_r
         seen_execution_runtime_request.x_client_request_id,
         "trace-codex-image-local-123"
     );
-    assert!(seen_execution_runtime_request
-        .user_agent
-        .starts_with("codex-tui/0.122.0"));
-    assert_eq!(seen_execution_runtime_request.version, "0.122.0");
-    assert_eq!(seen_execution_runtime_request.originator, "codex_cli_rs");
     assert_eq!(
         seen_execution_runtime_request.prompt,
         "生成一张中国历史视觉海报"
@@ -478,6 +489,12 @@ async fn gateway_executes_codex_image_sync_via_local_decision_gate_after_oauth_r
     assert!(seen_execution_runtime_request.content_is_string);
     assert_eq!(seen_execution_runtime_request.tool_type, "image_generation");
     assert_eq!(seen_execution_runtime_request.tool_size, "1024x1024");
+    assert_eq!(seen_execution_runtime_request.tool_quality, "high");
+    assert_eq!(seen_execution_runtime_request.tool_background, "auto");
+    assert_eq!(
+        seen_execution_runtime_request.tool_choice_type,
+        "image_generation"
+    );
     assert!(!seen_execution_runtime_request.tool_has_n);
     assert!(seen_execution_runtime_request.request_stream);
     assert!(!seen_execution_runtime_request.plan_stream);

apps/aether-gateway/src/tests/architecture/admin_provider.rs

@@ -985,9 +985,11 @@ fn admin_provider_write_uses_specific_local_owners() {
     for pattern in [
         "mod create;",
         "mod endpoint;",
+        "mod template;",
         "mod update;",
         "pub(crate) use self::create::build_admin_create_provider_record;",
         "pub(crate) use self::endpoint::build_admin_fixed_provider_endpoint_record;",
+        "pub(crate) use self::template::{",
         "pub(crate) use self::update::build_admin_update_provider_record;",
     ] {
         assert!(
@@ -1044,7 +1046,7 @@ fn admin_provider_write_uses_specific_local_owners() {
     for pattern in [
         "pub(crate) fn build_admin_fixed_provider_endpoint_record(",
         "admin_endpoint_signature_parts(",
-        "normalize_admin_base_url(base_url)?",
+        "normalize_admin_base_url(template.base_url)?",
     ] {
         assert!(
             write_provider_endpoint.contains(pattern),
@@ -1052,6 +1054,20 @@ fn admin_provider_write_uses_specific_local_owners() {
         );
     }
 
+    let write_provider_template = read_workspace_file(
+        "apps/aether-gateway/src/handlers/admin/provider/write/provider/template.rs",
+    );
+    for pattern in [
+        "pub(crate) async fn reconcile_admin_fixed_provider_template_endpoints(",
+        "pub(crate) fn apply_admin_fixed_provider_endpoint_template_overrides(",
+        "const FIXED_PROVIDER_TEMPLATE_METADATA_KEY: &str = \"_aether_fixed_provider_template\";",
+    ] {
+        assert!(
+            write_provider_template.contains(pattern),
+            "handlers/admin/provider/write/provider/template.rs should own {pattern}"
+        );
+    }
+
     let write_key_create =
         read_workspace_file("apps/aether-gateway/src/handlers/admin/provider/write/keys/create.rs");
     for pattern in [

apps/aether-gateway/src/tests/control/admin/pool.rs

@@ -1481,6 +1481,83 @@ async fn gateway_marks_exhausted_codex_pool_key_as_blocked_when_flag_enabled() {
     assert_eq!(keys[0]["account_quota"], json!("5H剩余 0.0%"));
 }
 
+#[tokio::test]
+async fn gateway_lists_inherited_fixed_provider_api_formats_for_pool_keys() {
+    let mut provider = sample_provider("provider-codex", "codex", 10).with_transport_fields(
+        true,
+        false,
+        true,
+        None,
+        None,
+        None,
+        None,
+        None,
+        Some(json!({
+            "pool_advanced": {
+                "enabled": true
+            }
+        })),
+    );
+    provider.provider_type = "codex".to_string();
+
+    let mut key = sample_key(
+        "key-codex-inherited",
+        "provider-codex",
+        "openai:cli",
+        "oauth-placeholder",
+    );
+    key.name = "codex inherited".to_string();
+    key.auth_type = "oauth".to_string();
+    key.api_formats = Some(json!(["openai:cli", "openai:compact"]));
+
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![provider],
+        vec![
+            sample_endpoint(
+                "endpoint-codex-cli",
+                "provider-codex",
+                "openai:cli",
+                "https://chatgpt.com/backend-api/codex",
+            ),
+            sample_endpoint(
+                "endpoint-codex-image",
+                "provider-codex",
+                "openai:image",
+                "https://chatgpt.com/backend-api/codex",
+            ),
+        ],
+        vec![key],
+    ));
+    let state = AppState::new()
+        .expect("gateway should build")
+        .with_data_state_for_tests(GatewayDataState::with_provider_catalog_reader_for_tests(
+            provider_catalog_repository,
+        ));
+
+    let response = local_admin_pool_response(
+        &state,
+        http::Method::GET,
+        "/api/admin/pool/provider-codex/keys?page=1&page_size=50&status=all",
+        None,
+    )
+    .await;
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = serde_json::from_slice(
+        &to_bytes(response.into_body(), usize::MAX)
+            .await
+            .expect("body should read"),
+    )
+    .expect("json body should parse");
+    let keys = payload["keys"].as_array().expect("keys should be array");
+
+    assert_eq!(keys.len(), 1);
+    assert_eq!(
+        keys[0]["api_formats"],
+        json!(["openai:cli", "openai:image"])
+    );
+}
+
 #[tokio::test]
 async fn gateway_prefers_status_snapshot_codex_quota_over_stale_metadata() {
     let mut provider = sample_provider("provider-codex", "codex", 10).with_transport_fields(

apps/aether-gateway/src/tests/control/admin/provider_query.rs

@@ -1564,7 +1564,7 @@ async fn gateway_handles_openai_cli_test_model_locally() {
                     .json_body
                     .as_ref()
                     .and_then(|body| body.get("instructions")),
-                Some(&json!("You are GPT-5."))
+                Some(&json!("You are ChatGPT."))
             );
             assert_eq!(
                 plan.body

apps/aether-gateway/src/tests/control/admin/providers.rs

@@ -942,7 +942,7 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
         .list_endpoints_by_provider_ids(std::slice::from_ref(&created.id))
         .await
         .expect("endpoints should list");
-    assert_eq!(endpoints.len(), 2);
+    assert_eq!(endpoints.len(), 3);
     let cli_endpoint = endpoints
         .iter()
         .find(|endpoint| endpoint.api_format == "openai:cli")
@@ -951,6 +951,10 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
         .iter()
         .find(|endpoint| endpoint.api_format == "openai:compact")
         .expect("compact endpoint should exist");
+    let image_endpoint = endpoints
+        .iter()
+        .find(|endpoint| endpoint.api_format == "openai:image")
+        .expect("image endpoint should exist");
     assert_eq!(
         cli_endpoint.base_url,
         "https://chatgpt.com/backend-api/codex"
@@ -959,8 +963,13 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
         compact_endpoint.base_url,
         "https://chatgpt.com/backend-api/codex"
     );
+    assert_eq!(
+        image_endpoint.base_url,
+        "https://chatgpt.com/backend-api/codex"
+    );
     assert_eq!(cli_endpoint.max_retries, Some(7));
     assert_eq!(compact_endpoint.max_retries, Some(7));
+    assert_eq!(image_endpoint.max_retries, Some(7));
     assert_eq!(
         cli_endpoint
             .config
@@ -969,14 +978,220 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
             .and_then(serde_json::Value::as_str),
         Some("force_stream")
     );
+    assert_eq!(
+        image_endpoint
+            .config
+            .as_ref()
+            .and_then(|value| value.get("upstream_stream_policy"))
+            .and_then(serde_json::Value::as_str),
+        Some("force_stream")
+    );
     assert!(cli_endpoint.body_rules.is_none());
     assert!(compact_endpoint.body_rules.is_none());
+    assert!(image_endpoint.body_rules.is_none());
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_updates_fixed_provider_and_reconciles_template_managed_endpoints() {
+    let upstream_hits = Arc::new(Mutex::new(0usize));
+    let upstream_hits_clone = Arc::clone(&upstream_hits);
+    let upstream = Router::new().route(
+        "/api/admin/providers/provider-codex",
+        any(move |_request: Request| {
+            let upstream_hits_inner = Arc::clone(&upstream_hits_clone);
+            async move {
+                *upstream_hits_inner.lock().expect("mutex should lock") += 1;
+                (StatusCode::OK, Body::from("unexpected upstream hit"))
+            }
+        }),
+    );
+
+    let mut provider = sample_provider("provider-codex", "codex", 10).with_transport_fields(
+        true,
+        false,
+        true,
+        None,
+        Some(2),
+        None,
+        None,
+        None,
+        None,
+    );
+    provider.provider_type = "codex".to_string();
+    let mut cli_endpoint = sample_endpoint(
+        "endpoint-codex-cli",
+        "provider-codex",
+        "openai:cli",
+        "https://chatgpt.com/backend-api/codex",
+    );
+    cli_endpoint.max_retries = Some(2);
+    cli_endpoint.config = Some(json!({"upstream_stream_policy": "force_stream"}));
+    let mut key = sample_key(
+        "key-codex-oauth",
+        "provider-codex",
+        "openai:cli",
+        "oauth-placeholder",
+    );
+    key.auth_type = "oauth".to_string();
+    key.api_formats = Some(json!(["openai:cli"]));
+
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![provider],
+        vec![cli_endpoint],
+        vec![key],
+    ));
+
+    let (_upstream_url, upstream_handle) = start_server(upstream).await;
+    let gateway = build_router_with_state(
+        AppState::new()
+            .expect("gateway should build")
+            .with_data_state_for_tests(
+                GatewayDataState::with_provider_catalog_repository_for_tests(
+                    provider_catalog_repository.clone(),
+                ),
+            ),
+    );
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let response = reqwest::Client::new()
+        .patch(format!("{gateway_url}/api/admin/providers/provider-codex"))
+        .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({
+            "max_retries": 9
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    let status = response.status();
+    let body = response.text().await.expect("body should read");
+    assert_eq!(status, StatusCode::OK, "body={body}");
+
+    let endpoints = provider_catalog_repository
+        .list_endpoints_by_provider_ids(&["provider-codex".to_string()])
+        .await
+        .expect("endpoints should list");
+    assert_eq!(endpoints.len(), 3);
+    let cli_endpoint = endpoints
+        .iter()
+        .find(|endpoint| endpoint.api_format == "openai:cli")
+        .expect("cli endpoint should exist");
+    let compact_endpoint = endpoints
+        .iter()
+        .find(|endpoint| endpoint.api_format == "openai:compact")
+        .expect("compact endpoint should exist");
+    let image_endpoint = endpoints
+        .iter()
+        .find(|endpoint| endpoint.api_format == "openai:image")
+        .expect("image endpoint should exist");
+
+    assert_eq!(cli_endpoint.max_retries, Some(9));
+    assert_eq!(compact_endpoint.max_retries, Some(9));
+    assert_eq!(image_endpoint.max_retries, Some(9));
+    assert_eq!(
+        cli_endpoint
+            .config
+            .as_ref()
+            .and_then(|value| value.get("_aether_fixed_provider_template"))
+            .and_then(|value| value.get("managed"))
+            .and_then(serde_json::Value::as_bool),
+        Some(true)
+    );
+    assert_eq!(
+        image_endpoint
+            .config
+            .as_ref()
+            .and_then(|value| value.get("upstream_stream_policy"))
+            .and_then(serde_json::Value::as_str),
+        Some("force_stream")
+    );
+    let keys = provider_catalog_repository
+        .list_keys_by_provider_ids(&["provider-codex".to_string()])
+        .await
+        .expect("keys should list");
+    assert_eq!(keys.len(), 1);
+    assert!(keys[0].api_formats.is_none());
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+}
+
+#[tokio::test]
+async fn gateway_lists_effective_api_formats_for_fixed_oauth_provider_keys() {
+    let mut provider = sample_provider("provider-codex", "codex", 10)
+        .with_transport_fields(true, false, true, None, None, None, None, None, None);
+    provider.provider_type = "codex".to_string();
+
+    let mut key = sample_key(
+        "key-codex-legacy",
+        "provider-codex",
+        "openai:cli",
+        "oauth-placeholder",
+    );
+    key.name = "codex legacy".to_string();
+    key.auth_type = "oauth".to_string();
+    key.api_formats = Some(json!(["openai:cli", "openai:compact"]));
+
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![provider],
+        vec![
+            sample_endpoint(
+                "endpoint-codex-cli",
+                "provider-codex",
+                "openai:cli",
+                "https://chatgpt.com/backend-api/codex",
+            ),
+            sample_endpoint(
+                "endpoint-codex-image",
+                "provider-codex",
+                "openai:image",
+                "https://chatgpt.com/backend-api/codex",
+            ),
+        ],
+        vec![key],
+    ));
+    let gateway = build_router_with_state(
+        AppState::new()
+            .expect("gateway should build")
+            .with_data_state_for_tests(GatewayDataState::with_provider_catalog_reader_for_tests(
+                provider_catalog_repository,
+            )),
+    );
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let response = reqwest::Client::new()
+        .get(format!(
+            "{gateway_url}/api/admin/endpoints/providers/provider-codex/keys?skip=0&limit=100"
+        ))
+        .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    let keys = payload.as_array().expect("keys payload should be array");
+
+    assert_eq!(keys.len(), 1);
+    assert_eq!(
+        keys[0]["api_formats"],
+        json!(["openai:cli", "openai:image"])
+    );
+
+    gateway_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_handles_admin_provider_health_monitor_locally_with_trusted_admin_principal() {
     let upstream_hits = Arc::new(Mutex::new(0usize));

apps/aether-gateway/src/tests/frontdoor/ai.rs

@@ -578,7 +578,7 @@ async fn gateway_rejects_gpt_image_2_on_chat_completions_without_hitting_fallbac
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
     assert_eq!(
         payload["detail"],
-        "gpt-image-2 仅支持通过 /v1/images/generations 或 /v1/images/edits 调用"
+        "图片模型仅支持通过 /v1/images/generations、/v1/images/edits 或 /v1/images/variations 调用"
     );
     assert_eq!(*fallback_probe_hits.lock().expect("mutex should lock"), 0);
 
@@ -640,7 +640,66 @@ async fn gateway_rejects_image_request_with_n_greater_than_one_without_hitting_f
         Some(EXECUTION_PATH_LOCAL_AI_PUBLIC)
     );
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
-    assert_eq!(payload["detail"], "图片接口当前仅支持 n=1");
+    assert_eq!(payload["detail"], "当前 Codex 图片反代仅支持 n=1");
+    assert_eq!(*fallback_probe_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    fallback_probe_handle.abort();
+}
+
+#[tokio::test]
+async fn gateway_rejects_variation_request_without_image_without_hitting_fallback_probe() {
+    let fallback_probe_hits = Arc::new(Mutex::new(0usize));
+    let fallback_probe_hits_clone = Arc::clone(&fallback_probe_hits);
+    let fallback_probe = Router::new().route(
+        "/{*path}",
+        any(move |_request: Request| {
+            let fallback_probe_hits_inner = Arc::clone(&fallback_probe_hits_clone);
+            async move {
+                *fallback_probe_hits_inner.lock().expect("mutex should lock") += 1;
+                (StatusCode::OK, Json(json!({"proxied": true}))).into_response()
+            }
+        }),
+    );
+
+    let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![(
+        Some(hash_api_key("sk-openai-image-variation")),
+        unrestricted_models_snapshot("key-openai-image-variation", "user-openai-image-variation"),
+    )]));
+
+    let (_unused_fallback_probe_url, fallback_probe_handle) = start_server(fallback_probe).await;
+    let gateway = build_router_with_state(
+        AppState::new()
+            .expect("gateway should build")
+            .with_auth_api_key_data_reader_for_tests(auth_repository),
+    );
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let response = reqwest::Client::new()
+        .post(format!("{gateway_url}/v1/images/variations"))
+        .header("authorization", "Bearer sk-openai-image-variation")
+        .header(http::header::CONTENT_TYPE, "application/json")
+        .body(
+            serde_json::to_vec(&json!({
+                "model": "dall-e-2",
+                "response_format": "url"
+            }))
+            .expect("request body should encode"),
+        )
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        response
+            .headers()
+            .get(EXECUTION_PATH_HEADER)
+            .and_then(|value| value.to_str().ok()),
+        Some(EXECUTION_PATH_LOCAL_AI_PUBLIC)
+    );
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["detail"], "图片变体请求需要 image 文件");
     assert_eq!(*fallback_probe_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();