docs: bootstrap specs ground truth (#5794)

* docs(specs): restore bootstrap after dev rewrite

* docs(specs): remove runtime inventory snapshot

* docs(specs): reconcile current dev truth

* docs(specs): document scheduled task actions as an owner-attribution source

Owner Attribution covered cookie, bearer-token and internal-loopback
requests. Scheduled task actions are a fourth source and behave
differently: _execute_action passes owner=task.owner off the stored
ScheduledTask row, so no request and no resolved principal are in
flight, and route-level require_user() never runs.

Webhook triggers are the sharp case. They are unauthenticated by
design with the token as the only credential and execute under the
stored task.owner.

Paths cite routes/task/task_routes.py, the canonical location after
the task subpackage move (#6081); routes/task_routes.py on current dev
is the backward-compat shim.

* docs(specs): add chained tasks to the trigger list, refresh dev stamp

Review feedback from RaresKeY on the previous commit.

"Every trigger path" was too broad: success-chained tasks are another
path into _execute_action. Added them with their own citation, and
noted that chaining additionally requires the target task to share
task.owner and rejects cycles, which is stricter than the trigger-side
checks. Softened the lead-in to "these trigger paths".

Line 56 still pointed at routes/task_routes.py for webhook credential
validation. That path is the backward-compat shim on current dev after
the task subpackage move (#6081); repointed to the canonical
routes/task/task_routes.py.

Stamp moved to dev@2a6b09b. Inspection backing that bump was scoped:
every file path cited in this spec was mechanically checked to resolve
on 2a6b09b, and every file:line in the Owner Attribution additions was
read against it. Behavioral claims elsewhere in the file were not
re-audited.

* docs(specs): correct SECURE_COOKIES description to match current behavior

Third of the stale details RaresKeY enumerated. The cookie section
described SECURE_COOKIES as purely opt-in, which stopped being true.

_secure_cookie() (routes/auth_routes.py:89) treats an explicit true or
false as authoritative and derives the Secure attribute from the
request otherwise, including when the variable is unset and when
docker-compose injects it present-but-empty. Either the connection
scheme or the first X-Forwarded-Proto hop being https is enough.

* docs(specs): refresh current dev truth

---------

Co-authored-by: StressTestor <212606152+StressTestor@users.noreply.github.com>

specs/model-providers/github-copilot.md

@@ -0,0 +1,46 @@
+# GitHub Copilot Provider Shape
+
+Last updated: dev@e57f60b | 2026-07-20
+
+## Scope
+
+Canonical provider ID `copilot`; OpenAI-compatible chat with Copilot headers
+and OAuth; runtime adapter `src/copilot.py` and routes in
+`routes/copilot_routes.py`. There is no dedicated Copilot canonical reader on
+current `dev`.
+
+## Catalog Shape
+
+The observed Copilot `/models` response uses `data[]` entries with:
+
+- `id`;
+- `model_picker_enabled`;
+- `capabilities.supports.tool_calls` and `.vision`;
+- optional limit/family metadata.
+
+Runtime model discovery uses picker state for availability. The canonical
+reader package does not map the nested support fields; an explicitly supplied
+`copilot` vendor currently uses generic identity-only normalization, and
+`model_picker_enabled` does not become canonical capability.
+
+## Request And Response Shape
+
+Chat is OpenAI-compatible but requires Copilot/GitHub API version, editor/plugin
+identity, intent, integration, and initiator headers; image requests add the
+vision request flag. Header derivation must tolerate malformed message entries.
+OAuth token exchange and access policies are provider authentication, not model
+capability.
+
+## Fallback And Safety
+
+Use exact GitHub Copilot host or explicit kind, including the constrained
+enterprise `copilot-api.*.ghe.com` form. Do not treat arbitrary `ghe.com` hosts
+as Copilot. Official model availability tables are useful registry context but
+do not replace the account-scoped catalog response.
+
+## Current Gaps
+
+- The catalog shape is implementation-observed and needs ongoing fixture
+  comparison with current Copilot clients.
+- Copilot catalog capability fields are not normalized by current `dev`.
+- Account/plan/policy availability must remain endpoint-user scoped.