Wire AWS Bedrock into research-run routing (main-process)#154
Merged
Conversation
Bedrock providers previously worked only for `keys test`/`doctor`; a Nova model id set on a stage fell through to xAI and could not be priced. This makes Bedrock genuinely routable: - Register Amazon Nova Micro/Lite/Pro (us.* inference-profile ids) with real verified prices so the mandatory cost gate can price them. - Route `provider=bedrock|foundry` through the registry builder in get_provider_for_model, and add bedrock/foundry to the llm() cross-provider dispatch tuple (they no longer fall through to Gemini/xAI). - Guard the credential boundary: refuse bedrock/foundry routing when PRIMR_SUPERVISED_WORKER=1 (workers never inherit AWS/Azure secrets); a test pins that the env allowlist stays closed. - Recognize bedrock/foundry in stage_routing._provider_configured. Foundry routing is a follow-up (its model id is a user deployment name, needing a deployment-pricing mechanism). Verified with mocked tests (no spend); BedrockProvider itself was validated live earlier this session.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Delivers the on-mission capability from the architecture investigation: AWS Bedrock now actually runs research stages, not just
keys test/doctor. Foundry is a scoped follow-up (see below).Before → after
Previously a Bedrock model id set on a stage fell through to the xAI path and the mandatory cost estimate
KeyError'd (no registry price). Now:us.amazon.nova-*-v1:0inference-profile ids) with prices verified July 2026 against the AWS Bedrock pricing page — so the cost gate prices them correctly.get_provider_for_modelroutesprovider=bedrock|foundrythrough the registry builder;llm()'s cross-provider dispatch tuple now includes them (no more fall-through to Gemini/xAI).AI_REASONING_MODEL=us.amazon.nova-pro-v1:0,AI_REPORT_MODEL=…,AI_FAST_MODEL=us.amazon.nova-lite-v1:0.Security boundary (the key decision)
Bedrock/Foundry routing is main-process only. A supervised MCP worker deliberately never inherits AWS/Azure secrets (
config/env.py), so routing refuses with a clear error whenPRIMR_SUPERVISED_WORKER=1. No allowlist was widened, and a regression test pins thatAWS_*/AZURE_OPENAI_API_KEYstay stripped from workers. Worker-side Bedrock (scoped short-lived STS tokens) is a separate, larger design, intentionally not bundled.Foundry follow-up
Foundry's model id is the user's arbitrary deployment name, so a fixed-price registry entry doesn't fit — it needs a small deployment→pricing mechanism. Routing is plumbed for
provider=foundry; registering priced Foundry entries is the next step (no guessed prices in the cost gate).Verified — $0
tests/test_ai/test_bedrock_routing.py(9): models priced, main-process routing reaches the provider, worker routing refused, allowlist pins closed.BedrockProvideritself was validated live earlier this session (Nova Microconverse→ "PRIMR-BEDROCK-OK"). No new spend here — logic is covered by mocked tests.