mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-09-15 04:32:23 +02:00
RaresKeYandStressTestor
7026cf40b5
* docs(specs): restore bootstrap after dev rewrite
* docs(specs): remove runtime inventory snapshot
* docs(specs): reconcile current dev truth
* docs(specs): document scheduled task actions as an owner-attribution source
Owner Attribution covered cookie, bearer-token and internal-loopback
requests. Scheduled task actions are a fourth source and behave
differently: _execute_action passes owner=task.owner off the stored
ScheduledTask row, so no request and no resolved principal are in
flight, and route-level require_user() never runs.
Webhook triggers are the sharp case. They are unauthenticated by
design with the token as the only credential and execute under the
stored task.owner.
Paths cite routes/task/task_routes.py, the canonical location after
the task subpackage move (#6081); routes/task_routes.py on current dev
is the backward-compat shim.
* docs(specs): add chained tasks to the trigger list, refresh dev stamp
Review feedback from RaresKeY on the previous commit.
"Every trigger path" was too broad: success-chained tasks are another
path into _execute_action. Added them with their own citation, and
noted that chaining additionally requires the target task to share
task.owner and rejects cycles, which is stricter than the trigger-side
checks. Softened the lead-in to "these trigger paths".
Line 56 still pointed at routes/task_routes.py for webhook credential
validation. That path is the backward-compat shim on current dev after
the task subpackage move (#6081); repointed to the canonical
routes/task/task_routes.py.
Stamp moved to dev@2a6b09b. Inspection backing that bump was scoped:
every file path cited in this spec was mechanically checked to resolve
on 2a6b09b, and every file:line in the Owner Attribution additions was
read against it. Behavioral claims elsewhere in the file were not
re-audited.
* docs(specs): correct SECURE_COOKIES description to match current behavior
Third of the stale details RaresKeY enumerated. The cookie section
described SECURE_COOKIES as purely opt-in, which stopped being true.
_secure_cookie() (routes/auth_routes.py:89) treats an explicit true or
false as authoritative and derives the Secure attribute from the
request otherwise, including when the variable is unset and when
docker-compose injects it present-but-empty. Either the connection
scheme or the first X-Forwarded-Proto hop being https is enough.
* docs(specs): refresh current dev truth
---------
Co-authored-by: StressTestor <212606152+StressTestor@users.noreply.github.com>
46 lines
1.9 KiB
Markdown
46 lines
1.9 KiB
Markdown
# LM Studio Provider Shape
|
|
|
|
Last updated: dev@e57f60b | 2026-07-20
|
|
|
|
## Scope
|
|
|
|
Canonical provider ID `lmstudio`; native LM Studio v1 plus OpenAI Chat and
|
|
Responses compatibility; reader `src/model_capability_readers/lmstudio.py`.
|
|
|
|
## Catalog Shapes
|
|
|
|
Preferred shape is `GET /api/v1/models` with root `models[]`. Current fields
|
|
include `key`, `type` (`llm` or `embedding`), display/publisher data,
|
|
`architecture`, quantization/format/size, `max_context_length`,
|
|
`loaded_instances[].config.context_length`, and a capability object containing
|
|
`vision`, `trained_for_tool_use`, and reasoning options/defaults.
|
|
|
|
Compatibility shape `GET /api/v0/models` uses `data[]` with `id`, `type`
|
|
(`llm`, `vlm`, or embeddings), `arch`, `compatibility_type`, state, and
|
|
context metadata. It is an explicit older shape, not a loose fallback.
|
|
OpenAI `/v1/models` is identity-only when native endpoints are unavailable.
|
|
|
|
Loaded-instance context is the effective runtime context; maximum context is a
|
|
separate limit. Model type maps family, explicit capability booleans map
|
|
vision/tools/reasoning, and architecture is provider-reported model family.
|
|
|
|
## Request And Response Shape
|
|
|
|
Native v1 chat is `/api/v1/chat` and can expose stateful/MCP-oriented output;
|
|
LM Studio also supports OpenAI Chat and Responses compatibility. Keep dialect
|
|
selection explicit because tool/MCP features differ between native and
|
|
compatible paths.
|
|
|
|
## Fallback And Safety
|
|
|
|
Current reader detection identifies port 1234 as LM Studio. Prefer pathless
|
|
native `/api/v1/models` discovery where configured (#1122, #3615), then v0,
|
|
then general identity. The port mapping is a normalization hint, not endpoint
|
|
trust. An error object from an unsupported native route is not a model list.
|
|
|
|
## Current Gaps
|
|
|
|
- Runtime discovery does not yet persist native capability records.
|
|
- LM Studio API capabilities continue to evolve; each new native version needs
|
|
an explicit shape fixture before promotion.
|