RaresKeYandStressTestor
7026cf40b5
* docs(specs): restore bootstrap after dev rewrite
* docs(specs): remove runtime inventory snapshot
* docs(specs): reconcile current dev truth
* docs(specs): document scheduled task actions as an owner-attribution source
Owner Attribution covered cookie, bearer-token and internal-loopback
requests. Scheduled task actions are a fourth source and behave
differently: _execute_action passes owner=task.owner off the stored
ScheduledTask row, so no request and no resolved principal are in
flight, and route-level require_user() never runs.
Webhook triggers are the sharp case. They are unauthenticated by
design with the token as the only credential and execute under the
stored task.owner.
Paths cite routes/task/task_routes.py, the canonical location after
the task subpackage move (#6081); routes/task_routes.py on current dev
is the backward-compat shim.
* docs(specs): add chained tasks to the trigger list, refresh dev stamp
Review feedback from RaresKeY on the previous commit.
"Every trigger path" was too broad: success-chained tasks are another
path into _execute_action. Added them with their own citation, and
noted that chaining additionally requires the target task to share
task.owner and rejects cycles, which is stricter than the trigger-side
checks. Softened the lead-in to "these trigger paths".
Line 56 still pointed at routes/task_routes.py for webhook credential
validation. That path is the backward-compat shim on current dev after
the task subpackage move (#6081); repointed to the canonical
routes/task/task_routes.py.
Stamp moved to dev@2a6b09b. Inspection backing that bump was scoped:
every file path cited in this spec was mechanically checked to resolve
on 2a6b09b, and every file:line in the Owner Attribution additions was
read against it. Behavioral claims elsewhere in the file were not
re-audited.
* docs(specs): correct SECURE_COOKIES description to match current behavior
Third of the stale details RaresKeY enumerated. The cookie section
described SECURE_COOKIES as purely opt-in, which stopped being true.
_secure_cookie() (routes/auth_routes.py:89) treats an explicit true or
false as authoritative and derives the Secure attribute from the
request otherwise, including when the variable is unset and when
docker-compose injects it present-but-empty. Either the connection
scheme or the first X-Forwarded-Proto hop being https is enough.
* docs(specs): refresh current dev truth
---------
Co-authored-by: StressTestor <212606152+StressTestor@users.noreply.github.com>
2.3 KiB
Cohere Provider Shape
Last updated: dev@e57f60b | 2026-07-20
Scope
Documented provider identity cohere; native Chat v2 plus the OpenAI
Compatibility API. Current dev has no dedicated Cohere capability reader or
direct Cohere request adapter; compatible endpoints use the general runtime
path when explicitly configured.
Catalog Shape
GET /v1/models returns a paginated models[] envelope. Each model can carry
name, endpoints, default_endpoints, context_length, features, and
sampling_defaults; the root can carry next_page_token.
These are candidate fields for a future dedicated reader:
- a single canonical family from
endpoints:chat/generate,embed,rerank, orclassify; context_lengthto the endpoint/model context limit;- known sampling-default keys to deterministic controls.
Current canonical normalization does not map them. When the generic reader is
explicitly selected with vendor cohere, it preserves only item identity plus
the raw item; family, context, features, and sampling controls stay unknown.
Request And Response Shape
Native POST /v2/chat uses messages, structured content blocks, tools,
response_format, sampling fields, and an optional structured thinking
object. Text lives in message.content[type=text].text; reasoning-capable
models use message.content[type=thinking].thinking. Streaming uses typed
events rather than one generic text delta.
The OpenAI compatibility base is /compatibility/v1. Its current chat subset
includes tools, structured output, sampling, and reasoning_effort, but model
support remains per-model. In the compatibility dialect only none and high
currently map to native thinking off/on; do not assume low/medium support.
Fallback And Safety
No Cohere host or payload-shape detection exists in the canonical reader registry. The caller must supply provider/endpoint configuration. Marketing pages and provider-wide endpoint features do not grant every listed model tools, vision, or reasoning.
Evidence And Gaps
- Official List/Get Models resources define the catalog fields.
- Official Chat v2, Reasoning, and Compatibility API resources define the transport and thinking controls.
- Odysseus has no direct Cohere request adapter, canonical reader, or sanitized canonical fixtures yet; both normalization and runtime integration remain follow-up work.