RaresKeYandStressTestor
7026cf40b5
* docs(specs): restore bootstrap after dev rewrite
* docs(specs): remove runtime inventory snapshot
* docs(specs): reconcile current dev truth
* docs(specs): document scheduled task actions as an owner-attribution source
Owner Attribution covered cookie, bearer-token and internal-loopback
requests. Scheduled task actions are a fourth source and behave
differently: _execute_action passes owner=task.owner off the stored
ScheduledTask row, so no request and no resolved principal are in
flight, and route-level require_user() never runs.
Webhook triggers are the sharp case. They are unauthenticated by
design with the token as the only credential and execute under the
stored task.owner.
Paths cite routes/task/task_routes.py, the canonical location after
the task subpackage move (#6081); routes/task_routes.py on current dev
is the backward-compat shim.
* docs(specs): add chained tasks to the trigger list, refresh dev stamp
Review feedback from RaresKeY on the previous commit.
"Every trigger path" was too broad: success-chained tasks are another
path into _execute_action. Added them with their own citation, and
noted that chaining additionally requires the target task to share
task.owner and rejects cycles, which is stricter than the trigger-side
checks. Softened the lead-in to "these trigger paths".
Line 56 still pointed at routes/task_routes.py for webhook credential
validation. That path is the backward-compat shim on current dev after
the task subpackage move (#6081); repointed to the canonical
routes/task/task_routes.py.
Stamp moved to dev@2a6b09b. Inspection backing that bump was scoped:
every file path cited in this spec was mechanically checked to resolve
on 2a6b09b, and every file:line in the Owner Attribution additions was
read against it. Behavioral claims elsewhere in the file were not
re-audited.
* docs(specs): correct SECURE_COOKIES description to match current behavior
Third of the stale details RaresKeY enumerated. The cookie section
described SECURE_COOKIES as purely opt-in, which stopped being true.
_secure_cookie() (routes/auth_routes.py:89) treats an explicit true or
false as authoritative and derives the Secure attribute from the
request otherwise, including when the variable is unset and when
docker-compose injects it present-but-empty. Either the connection
scheme or the first X-Forwarded-Proto hop being https is enough.
* docs(specs): refresh current dev truth
---------
Co-authored-by: StressTestor <212606152+StressTestor@users.noreply.github.com>
2.2 KiB
MiniMax Provider Shape
Last updated: dev@28d27ee | 2026-07-17
Scope
Canonical provider ID minimax; international host api.minimax.io, China
host api.minimaxi.com; current OpenAI-compatible and recommended
Anthropic-compatible text transports. Odysseus contains MiniMax-oriented tool
output handling and local-serving guidance but no dedicated catalog reader.
Catalog Shape
Current GET /v1/models is an OpenAI-compatible identity list:
object: list, data[], and model cards containing id, object: model,
created, and owned_by: minimax. The owned_by discriminator identifies the
provider shape, but the card exposes no per-model capability or modality
fields. Keep these records unknown and preserve raw identity metadata.
Do not backfill current model capabilities, token limits, or modalities from the platform overview into this list response. Those tables are useful scoped registry evidence only after model/version identity and freshness are carried explicitly.
Request And Response Shape
- OpenAI compatibility uses
/v1/chat/completionsand structuredreasoning_contentalongside normal message content. - Anthropic compatibility uses
/anthropic/v1/messages; the current M2.7 family supports typed thinking blocks and interleaved thinking, making this the preferred reasoning/tool-continuation transport in provider guidance. - Native audio, image, video, music, and file endpoints are separate product shapes. They must not be inferred from presence in the text model list.
Local Deployments
The current provider guide documents vLLM, SGLang, and MLX deployment. Those instances retain serving-engine identity and configuration-derived capability; the checkpoint name alone does not turn a vLLM/SGLang card into the hosted MiniMax provider shape.
Fallback And Current Gaps
Exact MiniMax hosts or the discriminating owned_by: minimax model-list shape
select provider identity. Unknown compatible proxies retain the general shape.
The identity list does not safely distinguish M2 reasoning behavior from
speech/image/video/music products, so exact model quirks remain documentation
until structured model-version evidence reaches runtime request builders.