{
"id": "dev.cocore.inference.dispatch",
"defs": {
"main": {
"type": "procedure",
"input": {
"schema": {
"type": "object",
"required": [
"model",
"prompt",
"maxTokensOut",
"priceCeiling"
],
"properties": {
"model": {
"type": "string",
"minLength": 1
},
"nonce": {
"type": "string",
"maxLength": 64,
"minLength": 32,
"description": "Fresh lowercase-hex freshness challenge (>=16 random bytes) supplied by the caller when `requireConfidential` is set. The provider's enclave signs (ephemeralPubKey || nonce || attestationCid) so the caller can prove the ephemeral seal key was minted for THIS request and is not replayed. Required when requireConfidential is true; ignored otherwise."
},
"tools": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"function"
],
"properties": {
"type": {
"type": "string",
"knownValues": [
"function"
]
},
"function": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"maxLength": 256
},
"parameters": {
"type": "object",
"description": "JSON Schema for the function's arguments."
},
"description": {
"type": "string",
"maxLength": 4096
}
}
}
}
},
"maxLength": 128,
"description": "Optional list of tool/function definitions the model may call. Public (not encrypted). The published job record carries this list and the provider passes it to the inference engine."
},
"prompt": {
"type": "string",
"minLength": 1
},
"toolChoice": {
"type": "string",
"description": "Optional tool choice strategy. 'auto' (default), 'none', or 'required'. Additive.",
"knownValues": [
"auto",
"none",
"required"
]
},
"maxTokensOut": {
"type": "integer",
"minimum": 1
},
"outputSchema": {
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Schema name (maps to OpenAI response_format.json_schema.name)."
},
"schema": {
"type": "object",
"description": "The actual JSON Schema object that constrains the model output."
},
"strict": {
"type": "boolean",
"description": "Whether to enforce strict schema adherence."
}
},
"description": "Optional JSON Schema to constrain the model output. When present, the published job record carries this schema and the provider passes it to the inference engine as response_format guided decoding. The schema is public (not encrypted) — it describes the output shape, not the input."
},
"priceCeiling": {
"type": "object",
"required": [
"amount",
"currency"
],
"properties": {
"amount": {
"type": "integer",
"minimum": 0
},
"currency": {
"type": "string",
"minLength": 1
}
}
},
"targetProviderDid": {
"type": "string",
"format": "did",
"description": "Pin dispatch to a specific provider DID instead of letting the advisor route."
},
"toolChoiceFunction": {
"type": "string",
"maxLength": 256,
"description": "When toolChoice is 'required', force the model to call this specific function. Maps to OpenAI tool_choice object form. Additive."
},
"requireConfidential": {
"type": "boolean",
"description": "Demand the `attested-confidential` tier: the chosen provider must present a verified, signing-key-bound Apple MDA chain, a known-good measured cdHash, the hardened-runtime posture, and a fresh enclave-signed ephemeral session key bound to `nonce`. If no eligible provider is available the request fails closed with `ConfidentialUnavailable` rather than silently downgrading to best-effort. Optional / additive; absent or false means best-effort."
}
}
},
"encoding": "application/json"
},
"errors": [
{
"name": "AuthRequired",
"description": "The caller is not authenticated."
},
{
"name": "InvalidRequest",
"description": "The body failed validation."
},
{
"name": "ConfidentialUnavailable",
"description": "requireConfidential was set but no provider could satisfy the attested-confidential tier (no verified+bound MDA chain, cdHash not in the known-good set, posture failed, or the ephemeral session handshake did not verify). The request was NOT downgraded; no prompt was sealed."
}
],
"output": {
"encoding": "text/event-stream",
"description": "A Server-Sent Events stream of `meta`, `chunk`, `complete`, and `error` frames (see the method description for payloads)."
},
"description": "Submit an inference request and stream the result back as Server-Sent Events. Authenticates the requester, runs the dispatch core, and emits typed SSE frames. Unlike `submit` (which returns URIs to poll), `dispatch` drives the full request and streams plaintext output chunks until completion.\n\nConfidentiality: by default the AppView seals the prompt to the chosen provider on the caller's behalf (`best-effort` tier) — convenient, but the AppView is in the plaintext path. A caller that needs privacy FROM the provider sets `requireConfidential` and supplies a fresh `nonce`; the AppView then runs the verified, enclave-bound ephemeral handshake and either confirms an `attested-confidential` session or fails closed with the `ConfidentialUnavailable` error. For genuine end-to-end confidentiality the prompt is sealed at the client edge (SDK/browser) and the AppView forwards ciphertext only; this method's server-side seal path is always `best-effort`.\n\nSSE events:\n * `meta` — { jobUri, jobCid, authUri, inputCommitment, providerDid, sessionId, tier }\n * `sessionKey` — { ephemeralPubKey, nonce, attestationCid, signature } (only when `requireConfidential`; the enclave-signed fresh key the requester verifies before sealing)\n * `chunk` — { seq, text } (plaintext, decrypted)\n * `complete` — { tokensIn, tokensOut, receiptUri, tier, providerCredit? }\n * `error` — { reason, code }"
}
},
"$type": "com.atproto.lexicon.schema",
"lexicon": 1
}