mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-09-13 19:52:20 +02:00
RaresKeYandStressTestor
7026cf40b5
* docs(specs): restore bootstrap after dev rewrite
* docs(specs): remove runtime inventory snapshot
* docs(specs): reconcile current dev truth
* docs(specs): document scheduled task actions as an owner-attribution source
Owner Attribution covered cookie, bearer-token and internal-loopback
requests. Scheduled task actions are a fourth source and behave
differently: _execute_action passes owner=task.owner off the stored
ScheduledTask row, so no request and no resolved principal are in
flight, and route-level require_user() never runs.
Webhook triggers are the sharp case. They are unauthenticated by
design with the token as the only credential and execute under the
stored task.owner.
Paths cite routes/task/task_routes.py, the canonical location after
the task subpackage move (#6081); routes/task_routes.py on current dev
is the backward-compat shim.
* docs(specs): add chained tasks to the trigger list, refresh dev stamp
Review feedback from RaresKeY on the previous commit.
"Every trigger path" was too broad: success-chained tasks are another
path into _execute_action. Added them with their own citation, and
noted that chaining additionally requires the target task to share
task.owner and rejects cycles, which is stricter than the trigger-side
checks. Softened the lead-in to "these trigger paths".
Line 56 still pointed at routes/task_routes.py for webhook credential
validation. That path is the backward-compat shim on current dev after
the task subpackage move (#6081); repointed to the canonical
routes/task/task_routes.py.
Stamp moved to dev@2a6b09b. Inspection backing that bump was scoped:
every file path cited in this spec was mechanically checked to resolve
on 2a6b09b, and every file:line in the Owner Attribution additions was
read against it. Behavioral claims elsewhere in the file were not
re-audited.
* docs(specs): correct SECURE_COOKIES description to match current behavior
Third of the stale details RaresKeY enumerated. The cookie section
described SECURE_COOKIES as purely opt-in, which stopped being true.
_secure_cookie() (routes/auth_routes.py:89) treats an explicit true or
false as authoritative and derives the Secure attribute from the
request otherwise, including when the variable is unset and when
docker-compose injects it present-but-empty. Either the connection
scheme or the first X-Forwarded-Proto hop being https is enough.
* docs(specs): refresh current dev truth
---------
Co-authored-by: StressTestor <212606152+StressTestor@users.noreply.github.com>
57 lines
2.3 KiB
Markdown
57 lines
2.3 KiB
Markdown
# Cohere Provider Shape
|
|
|
|
Last updated: dev@e57f60b | 2026-07-20
|
|
|
|
## Scope
|
|
|
|
Documented provider identity `cohere`; native Chat v2 plus the OpenAI
|
|
Compatibility API. Current `dev` has no dedicated Cohere capability reader or
|
|
direct Cohere request adapter; compatible endpoints use the general runtime
|
|
path when explicitly configured.
|
|
|
|
## Catalog Shape
|
|
|
|
`GET /v1/models` returns a paginated `models[]` envelope. Each model can carry
|
|
`name`, `endpoints`, `default_endpoints`, `context_length`, `features`, and
|
|
`sampling_defaults`; the root can carry `next_page_token`.
|
|
|
|
These are candidate fields for a future dedicated reader:
|
|
|
|
- a single canonical family from `endpoints`: `chat`/`generate`, `embed`,
|
|
`rerank`, or `classify`;
|
|
- `context_length` to the endpoint/model context limit;
|
|
- known sampling-default keys to deterministic controls.
|
|
|
|
Current canonical normalization does not map them. When the generic reader is
|
|
explicitly selected with vendor `cohere`, it preserves only item identity plus
|
|
the raw item; family, context, features, and sampling controls stay unknown.
|
|
|
|
## Request And Response Shape
|
|
|
|
Native `POST /v2/chat` uses `messages`, structured content blocks, tools,
|
|
`response_format`, sampling fields, and an optional structured `thinking`
|
|
object. Text lives in `message.content[type=text].text`; reasoning-capable
|
|
models use `message.content[type=thinking].thinking`. Streaming uses typed
|
|
events rather than one generic text delta.
|
|
|
|
The OpenAI compatibility base is `/compatibility/v1`. Its current chat subset
|
|
includes tools, structured output, sampling, and `reasoning_effort`, but model
|
|
support remains per-model. In the compatibility dialect only `none` and `high`
|
|
currently map to native thinking off/on; do not assume low/medium support.
|
|
|
|
## Fallback And Safety
|
|
|
|
No Cohere host or payload-shape detection exists in the canonical reader
|
|
registry. The caller must supply provider/endpoint configuration. Marketing
|
|
pages and provider-wide endpoint features do not grant every listed model
|
|
tools, vision, or reasoning.
|
|
|
|
## Evidence And Gaps
|
|
|
|
- Official List/Get Models resources define the catalog fields.
|
|
- Official Chat v2, Reasoning, and Compatibility API resources define the
|
|
transport and thinking controls.
|
|
- Odysseus has no direct Cohere request adapter, canonical reader, or sanitized
|
|
canonical fixtures yet; both normalization and runtime integration remain
|
|
follow-up work.
|