mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-09-18 06:02:21 +02:00
RaresKeYandStressTestor
7026cf40b5
* docs(specs): restore bootstrap after dev rewrite
* docs(specs): remove runtime inventory snapshot
* docs(specs): reconcile current dev truth
* docs(specs): document scheduled task actions as an owner-attribution source
Owner Attribution covered cookie, bearer-token and internal-loopback
requests. Scheduled task actions are a fourth source and behave
differently: _execute_action passes owner=task.owner off the stored
ScheduledTask row, so no request and no resolved principal are in
flight, and route-level require_user() never runs.
Webhook triggers are the sharp case. They are unauthenticated by
design with the token as the only credential and execute under the
stored task.owner.
Paths cite routes/task/task_routes.py, the canonical location after
the task subpackage move (#6081); routes/task_routes.py on current dev
is the backward-compat shim.
* docs(specs): add chained tasks to the trigger list, refresh dev stamp
Review feedback from RaresKeY on the previous commit.
"Every trigger path" was too broad: success-chained tasks are another
path into _execute_action. Added them with their own citation, and
noted that chaining additionally requires the target task to share
task.owner and rejects cycles, which is stricter than the trigger-side
checks. Softened the lead-in to "these trigger paths".
Line 56 still pointed at routes/task_routes.py for webhook credential
validation. That path is the backward-compat shim on current dev after
the task subpackage move (#6081); repointed to the canonical
routes/task/task_routes.py.
Stamp moved to dev@2a6b09b. Inspection backing that bump was scoped:
every file path cited in this spec was mechanically checked to resolve
on 2a6b09b, and every file:line in the Owner Attribution additions was
read against it. Behavioral claims elsewhere in the file were not
re-audited.
* docs(specs): correct SECURE_COOKIES description to match current behavior
Third of the stale details RaresKeY enumerated. The cookie section
described SECURE_COOKIES as purely opt-in, which stopped being true.
_secure_cookie() (routes/auth_routes.py:89) treats an explicit true or
false as authoritative and derives the Secure attribute from the
request otherwise, including when the variable is unset and when
docker-compose injects it present-but-empty. Either the connection
scheme or the first X-Forwarded-Proto hop being https is enough.
* docs(specs): refresh current dev truth
---------
Co-authored-by: StressTestor <212606152+StressTestor@users.noreply.github.com>
40 lines
2.1 KiB
Markdown
40 lines
2.1 KiB
Markdown
# Anthropic Provider Shape
|
|
|
|
Last updated: dev@e71f8ce | 2026-08-25
|
|
|
|
## Scope
|
|
|
|
Canonical placeholder vendor ID `anthropic`; Anthropic Messages runtime
|
|
adapter in `src/llm_core.py`. There is no dedicated Anthropic capability-reader
|
|
module; explicit/auto-detected Anthropic payloads use the generic identity-only
|
|
reader.
|
|
|
|
## Catalog Shape
|
|
|
|
`GET /v1/models` returns `data[]` model resources with `id`, `type: model`,
|
|
`display_name`, and `created_at`, plus pagination metadata. These fields prove
|
|
identity/availability only. Do not assume all listed Claude models share
|
|
vision, tools, reasoning, sampling, or context limits.
|
|
|
|
## Request And Response Shape
|
|
|
|
Native Messages uses a top-level `system`, alternating `messages`, content
|
|
blocks, `tools[].input_schema`, `tool_use` assistant blocks, and `tool_result`
|
|
user blocks. Text, thinking, signatures, server-tool blocks, and tool calls are
|
|
typed content rather than OpenAI roles/fields. Preserve block IDs/signatures
|
|
needed for continuation.
|
|
|
|
Sampling and thinking support can be version/model specific. The Opus 4.7+ sampling omission is a model-scoped runtime observation, not an Anthropic-wide rule. Runtime version parsing accepts explicit major/minor IDs and later major-only IDs such as `claude-opus-5`, treats a missing minor as `.0`, caps both components so date stamps cannot be misread as versions, and keeps legacy Claude 3 Opus sampling intact. Anthropic-compatible proxies are Anthropic dialect only when configured or their exact payload/endpoint shape proves it (#3110).
|
|
|
|
## Fallback And Safety
|
|
|
|
Runtime and canonical reader detection use label-bounded Anthropic host matching or an explicit endpoint kind. A provider using Anthropic Messages through another host must be explicit. Identity-only model cards remain unknown.
|
|
|
|
## Current Gaps
|
|
|
|
- The public model list does not provide per-model canonical capability data.
|
|
- There is no dedicated Anthropic canonical reader; only `id`, `name`, or
|
|
`model` identity survives generic normalization.
|
|
- Runtime model-version parsing needs structured identity before a later
|
|
consumer can centralize sampling exceptions without another name matcher.
|