mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-09-13 19:52:20 +02:00
RaresKeYandStressTestor
7026cf40b5
* docs(specs): restore bootstrap after dev rewrite
* docs(specs): remove runtime inventory snapshot
* docs(specs): reconcile current dev truth
* docs(specs): document scheduled task actions as an owner-attribution source
Owner Attribution covered cookie, bearer-token and internal-loopback
requests. Scheduled task actions are a fourth source and behave
differently: _execute_action passes owner=task.owner off the stored
ScheduledTask row, so no request and no resolved principal are in
flight, and route-level require_user() never runs.
Webhook triggers are the sharp case. They are unauthenticated by
design with the token as the only credential and execute under the
stored task.owner.
Paths cite routes/task/task_routes.py, the canonical location after
the task subpackage move (#6081); routes/task_routes.py on current dev
is the backward-compat shim.
* docs(specs): add chained tasks to the trigger list, refresh dev stamp
Review feedback from RaresKeY on the previous commit.
"Every trigger path" was too broad: success-chained tasks are another
path into _execute_action. Added them with their own citation, and
noted that chaining additionally requires the target task to share
task.owner and rejects cycles, which is stricter than the trigger-side
checks. Softened the lead-in to "these trigger paths".
Line 56 still pointed at routes/task_routes.py for webhook credential
validation. That path is the backward-compat shim on current dev after
the task subpackage move (#6081); repointed to the canonical
routes/task/task_routes.py.
Stamp moved to dev@2a6b09b. Inspection backing that bump was scoped:
every file path cited in this spec was mechanically checked to resolve
on 2a6b09b, and every file:line in the Owner Attribution additions was
read against it. Behavioral claims elsewhere in the file were not
re-audited.
* docs(specs): correct SECURE_COOKIES description to match current behavior
Third of the stale details RaresKeY enumerated. The cookie section
described SECURE_COOKIES as purely opt-in, which stopped being true.
_secure_cookie() (routes/auth_routes.py:89) treats an explicit true or
false as authoritative and derives the Secure attribute from the
request otherwise, including when the variable is unset and when
docker-compose injects it present-but-empty. Either the connection
scheme or the first X-Forwarded-Proto hop being https is enough.
* docs(specs): refresh current dev truth
---------
Co-authored-by: StressTestor <212606152+StressTestor@users.noreply.github.com>
55 lines
2.2 KiB
Markdown
55 lines
2.2 KiB
Markdown
# Google Gemini Provider Shape
|
|
|
|
Last updated: dev@e71f8ce | 2026-08-25
|
|
|
|
## Scope
|
|
|
|
Canonical provider ID `google`; native GenerateContent plus optional Google
|
|
OpenAI-compatible chat; readers `google.py` and
|
|
`google_ai_studio_mapping.py`; catalog/probe ownership in
|
|
`routes/model_routes.py`.
|
|
|
|
## Catalog Shape
|
|
|
|
Use the native paginated `GET /v1beta/models` endpoint, including
|
|
`nextPageToken`, with `x-goog-api-key` when configured. `models[]` can contain:
|
|
|
|
- `name`, `baseModelId`, `version`, and `displayName`;
|
|
- `inputTokenLimit` and `outputTokenLimit`;
|
|
- `supportedGenerationMethods`;
|
|
- `thinking`, `temperature`, `maxTemperature`, `topP`, and `topK`.
|
|
|
|
Embedding-only methods map to embedding. Generation methods prove a native
|
|
method, not chat/image/video/audio modality, so those records remain unknown
|
|
unless stronger structured evidence exists. `thinking: true` and explicit
|
|
sampling fields map to a reasoning claim and controls. Model IDs such as
|
|
Imagen, Veo, or TTS names are not parsed.
|
|
|
|
## Request And Response Shape
|
|
|
|
Native generation uses `contents`, `systemInstruction`,
|
|
`generationConfig`, `tools[].functionDeclarations`, and
|
|
`models/{model}:generateContent|streamGenerateContent`. Responses use
|
|
`candidates[].content.parts[]` for `text`, `functionCall`, `functionResponse`,
|
|
`thought`, and `thoughtSignature`; token accounting is in `usageMetadata`.
|
|
Native Google tool/thought continuity must not be flattened through an
|
|
OpenAI-only history shape.
|
|
|
|
## Fallback And Safety
|
|
|
|
Prefer native model metadata even when chat is configured through Google's
|
|
OpenAI compatibility URL. Pagination parameters must remain stable between
|
|
pages. The route probe activates only for the exact
|
|
`generativelanguage.googleapis.com` hostname, filters the picker list to
|
|
content-generation methods, returns no curated fallback after probe failure,
|
|
and defaults those endpoints to manual catalog refresh unless explicitly
|
|
overridden. The canonical Google reader is not yet called by that probe.
|
|
Unknown methods and fields stay raw; unrecognized prediction models remain
|
|
unknown.
|
|
|
|
## Current Gaps
|
|
|
|
- The Models resource does not expose full modalities for every Google media
|
|
family.
|
|
- Native Gemini request/response support is not yet the only runtime path.
|