OpenAI-compatible image APIs normalize transport, not fallback routing

A dev.to post on Node.js provider fallback makes a narrow and useful claim: an OpenAI-compatible image generation contract can normalize transport across multiple providers behind one API key, but it cannot define safe fallback model routing, which leaves the routing ledger, the idempotency key, the fallback policy and output validation to the application owner ^[1]. For teams rendering candidate scorecards, that gap is exactly where a silent failure lives, because according to the post a polished image can conceal a malformed score, a stale rubric version, or a retry that quietly selected another model ^[3].

The structural fix in the piece is unglamorous: keep the structured score as the system of record and treat every generated scorecard image as a replaceable projection ^[2]. The pipeline starts only after scoring has produced schema-valid JSON, with stable identifiers for the candidate, the rubric version, the scoring run and the renderer request, and the prompt is derived from that immutable record rather than reassembled from mutable application state ^[4]. Reconciliation then compares the visual job against the original score record, never against a later copy of the prompt ^[5].

The boundary the author draws around the renderer is the part most teams will violate first. A renderer may lay out criteria, scores and permitted explanatory text, but it must not infer a missing score or repair an invalid rubric; if a required field is absent, the job stops before image generation, and a second model call is not validation ^[6].

The post ships a Go envelope as an executable specification. A Job carries CandidateID, RubricVersion, ScoringRunID, Prompt, Model and IdempotencyKey, the constructor rejects an incomplete job outright, and the key is the hex-encoded SHA-256 of those five inputs joined by NUL separators ^[7]. That is five validated inputs producing one computed sixth field ^[13]. The returned Asset records URI, content digest, provider and model ^[8]. The author is explicit that the hash is a deduplication identity, not encryption and not licence to put candidate data in logs, and that retention, access control and the applicable compliance boundary stay with counsel ^[9].

Worth noticing: Model is inside the hash ^[7], while check four says bind the idempotency key to the semantic request rather than a single network attempt ^[11]. A fallback that switches provider-model pairs therefore changes the key, which is the opposite of what a semantic key is for ^[14]. If you copy the snippet as written, you are copying that tension too.

On routing, the argument holds up. One familiar client shape and one internal API key do not establish that two providers accept the same model name, dimensions, output representation, moderation behaviour or request limits, so the gateway needs a versioned catalog mapping a logical model class to eligible provider-model pairs without leaking those pairs through application code ^[10]. The seven pre-dispatch checks follow from that: schema and domain validation, prompt provenance, catalog resolution instead of user-supplied provider models, semantic idempotency, recording route and policy version before dispatch, fallback only for named failure classes, and verification of media type, digest, size and provenance before publication ^[11]. The stated payoff is exactly-once effects without pretending the network delivers exactly-once: attempts may repeat, the durable publication record does not ^[12].

Watch two things in your own stack. Whether the route and policy version are written before dispatch rather than inferred afterwards from provider metadata ^[11], and whether your idempotency key survives a model substitution ^[14].