mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-09-16 21:22:20 +02:00
RaresKeYandStressTestor
7026cf40b5
* docs(specs): restore bootstrap after dev rewrite
* docs(specs): remove runtime inventory snapshot
* docs(specs): reconcile current dev truth
* docs(specs): document scheduled task actions as an owner-attribution source
Owner Attribution covered cookie, bearer-token and internal-loopback
requests. Scheduled task actions are a fourth source and behave
differently: _execute_action passes owner=task.owner off the stored
ScheduledTask row, so no request and no resolved principal are in
flight, and route-level require_user() never runs.
Webhook triggers are the sharp case. They are unauthenticated by
design with the token as the only credential and execute under the
stored task.owner.
Paths cite routes/task/task_routes.py, the canonical location after
the task subpackage move (#6081); routes/task_routes.py on current dev
is the backward-compat shim.
* docs(specs): add chained tasks to the trigger list, refresh dev stamp
Review feedback from RaresKeY on the previous commit.
"Every trigger path" was too broad: success-chained tasks are another
path into _execute_action. Added them with their own citation, and
noted that chaining additionally requires the target task to share
task.owner and rejects cycles, which is stricter than the trigger-side
checks. Softened the lead-in to "these trigger paths".
Line 56 still pointed at routes/task_routes.py for webhook credential
validation. That path is the backward-compat shim on current dev after
the task subpackage move (#6081); repointed to the canonical
routes/task/task_routes.py.
Stamp moved to dev@2a6b09b. Inspection backing that bump was scoped:
every file path cited in this spec was mechanically checked to resolve
on 2a6b09b, and every file:line in the Owner Attribution additions was
read against it. Behavioral claims elsewhere in the file were not
re-audited.
* docs(specs): correct SECURE_COOKIES description to match current behavior
Third of the stale details RaresKeY enumerated. The cookie section
described SECURE_COOKIES as purely opt-in, which stopped being true.
_secure_cookie() (routes/auth_routes.py:89) treats an explicit true or
false as authoritative and derives the Secure attribute from the
request otherwise, including when the variable is unset and when
docker-compose injects it present-but-empty. Either the connection
scheme or the first X-Forwarded-Proto hop being https is enough.
* docs(specs): refresh current dev truth
---------
Co-authored-by: StressTestor <212606152+StressTestor@users.noreply.github.com>
49 lines
2.2 KiB
Markdown
49 lines
2.2 KiB
Markdown
# MiniMax Provider Shape
|
|
|
|
Last updated: dev@28d27ee | 2026-07-17
|
|
|
|
## Scope
|
|
|
|
Canonical provider ID `minimax`; international host `api.minimax.io`, China
|
|
host `api.minimaxi.com`; current OpenAI-compatible and recommended
|
|
Anthropic-compatible text transports. Odysseus contains MiniMax-oriented tool
|
|
output handling and local-serving guidance but no dedicated catalog reader.
|
|
|
|
## Catalog Shape
|
|
|
|
Current `GET /v1/models` is an OpenAI-compatible identity list:
|
|
`object: list`, `data[]`, and model cards containing `id`, `object: model`,
|
|
`created`, and `owned_by: minimax`. The `owned_by` discriminator identifies the
|
|
provider shape, but the card exposes no per-model capability or modality
|
|
fields. Keep these records unknown and preserve raw identity metadata.
|
|
|
|
Do not backfill current model capabilities, token limits, or modalities from
|
|
the platform overview into this list response. Those tables are useful scoped
|
|
registry evidence only after model/version identity and freshness are carried
|
|
explicitly.
|
|
|
|
## Request And Response Shape
|
|
|
|
- OpenAI compatibility uses `/v1/chat/completions` and structured
|
|
`reasoning_content` alongside normal message content.
|
|
- Anthropic compatibility uses `/anthropic/v1/messages`; the current M2.7
|
|
family supports typed thinking blocks and interleaved thinking, making this
|
|
the preferred reasoning/tool-continuation transport in provider guidance.
|
|
- Native audio, image, video, music, and file endpoints are separate product
|
|
shapes. They must not be inferred from presence in the text model list.
|
|
|
|
## Local Deployments
|
|
|
|
The current provider guide documents vLLM, SGLang, and MLX deployment. Those
|
|
instances retain serving-engine identity and configuration-derived capability;
|
|
the checkpoint name alone does not turn a vLLM/SGLang card into the hosted
|
|
MiniMax provider shape.
|
|
|
|
## Fallback And Current Gaps
|
|
|
|
Exact MiniMax hosts or the discriminating `owned_by: minimax` model-list shape
|
|
select provider identity. Unknown compatible proxies retain the general shape.
|
|
The identity list does not safely distinguish M2 reasoning behavior from
|
|
speech/image/video/music products, so exact model quirks remain documentation
|
|
until structured model-version evidence reaches runtime request builders.
|