feat(sandbox,providers): add aws-bedrock as a recognized inference provider

[st-gr]

Summary

Adds aws-bedrock as a recognized inference protocol in the supervisor's L7 router and the providers catalog so operators can register a Bedrock-shaped upstream as --type aws-bedrock and route Claude Code Bedrock-mode traffic (POST /model/{id}/invoke[-with-response-stream]) through inference.local. Without this, sandboxes hit 403 "connection not allowed by policy" because no L7 pattern matches Bedrock URLs. The canonical no-SigV4 use case is SAP AI Core deployed Bedrock models (Anthropic models behind a Bedrock-shape API with XSUAA bearer auth instead of SigV4); operators wanting real AWS Bedrock additionally need #1630's proxy-side SigV4 signing.

Related Issue

Complementary to #1630 ("Sigv4 credential signing"). #1630 adds proxy-side SigV4 re-signing as a credential_signing: sigv4 policy field. This PR is the URL-pattern half: the supervisor's L7 router needs to recognize Bedrock InvokeModel paths before anything can be signed, regardless of whether the upstream needs SigV4. The two patches don't touch the same files; they're complementary, not overlapping.

No upstream tracking issue filed — happy to file one if reviewers prefer.

Changes

• crates/openshell-sandbox/src/l7/inference.rs:
  • Adds two patterns to default_patterns(): POST /model/*/invoke (aws_bedrock_invoke) and POST /model/*/invoke-with-response-stream (aws_bedrock_invoke_stream).
  • Extends detect_inference_pattern to support a single middle /*/ glob in addition to the existing trailing /*. The middle wildcard matches exactly one non-empty path segment containing no / — /model//invoke and /model/a/b/invoke both no-match.
• providers/aws-bedrock.yaml: new YAML profile declaring four credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_REGION) and a default endpoint of bedrock-runtime.us-east-1.amazonaws.com:443. Operators in other regions or pointing at non-AWS Bedrock-compatible upstreams override per-deployment via the operator-supplied BEDROCK_BASE_URL config-key (mirroring how the anthropic provider accepts ANTHROPIC_BASE_URL).
• crates/openshell-providers/src/providers/aws_bedrock.rs: the ProviderDiscoverySpec so --auto-providers picks up AWS_* env vars from local credentials.
• crates/openshell-providers/src/{providers/mod.rs,lib.rs,profiles.rs}: register the new module + SPEC + YAML.

Testing

• mise run pre-commit passes — not run end-to-end (mise not on author's dev environment), but the equivalent rust pieces verified independently: cargo fmt --all -- --check clean; cargo clippy --no-deps -p openshell-providers -p openshell-sandbox --all-targets -- -D warnings clean.
• Unit tests added/updated — 7 new pattern-matcher tests in crates/openshell-sandbox/src/l7/inference.rs::tests cover positive path, query-string handling, GET rejection, empty-segment rejection, multi-segment rejection, unknown-action rejection. Provider-discovery test follows the existing test_discovers_env_credential! macro convention. cargo test -p openshell-sandbox --lib l7::inference: 40 passed; cargo test -p openshell-providers: 35 passed.
• E2E tests added/updated — none — running an aws-bedrock provider end-to-end requires either real AWS Bedrock with SigV4 (covered by Sigv4 credential signing #1630) or a Bedrock-compatible stub backend. Deferring the E2E test to whichever PR lands second so it can exercise the full URL-pattern + auth path together.

Checklist

• Follows Conventional Commits (feat(sandbox):, feat(providers):)
• Commits are signed off (DCO)
• Architecture docs updated — no surgical place to add a row that wouldn't pre-empt Sigv4 credential signing #1630's signing scope. The new patterns sit alongside the existing OpenAI/Anthropic ones in default_patterns(); the new YAML profile follows the same shape as claude-code.yaml / nvidia.yaml. Happy to add a paragraph to docs/sandboxes/manage-providers.mdx (or another spot reviewers prefer) in this PR rather than a doc-only follow-up.

---

Notes for reviewers

Use cases (which PRs you need for which upstream):

Upstream	What you need	Why
SAP AI Core deployed Bedrock (XSUAA bearer; no SigV4)	This PR alone	The bridge ignores inbound auth and mints XSUAA outbound; the supervisor's L7 router only needs to recognize Bedrock URL patterns, which this PR adds.
In-cluster translating bridge (LiteLLM in Bedrock-emulation mode, custom Bedrock-compatible proxy that authenticates separately)	This PR alone	Same shape as SAP — operator's bridge handles upstream auth; the proxy just needs URL-pattern recognition.
Real AWS Bedrock (SigV4 enforced at AWS)	This PR plus #1630	This PR adds the URL-pattern recognition; #1630 adds proxy-side SigV4 signing via the credential_signing: sigv4 policy field. The two are complementary; this PR is the prerequisite that makes #1630's signing applicable to Bedrock paths.

In all three cases, provider create --type aws-bedrock requires --no-verify until a Bedrock-aware arm is added to validation_probe() in crates/openshell-router/src/backend.rs. That extension is left for a follow-up PR to keep this one focused on the URL-pattern + provider-registration changes.

Out of scope (intentional):

• SigV4 signing. Already addressed in Sigv4 credential signing #1630.
• {region} placeholder substitution in the YAML loader. Operators override per-deployment via BEDROCK_BASE_URL config-key the same way ANTHROPIC_BASE_URL works for the anthropic provider.
• Body translation between Bedrock InvokeModel and other inference shapes. The router treats matched requests as opaque pass-through.
• CLI / TUI surface updates. Operators can already create the provider via openshell provider create --type aws-bedrock because the registry recognizes the new id; surfacing it in the TUI's provider-type picker is a follow-up.

Operator context:

The st-gr/openshell-driver-kyma Helm chart currently registers its SAP AI Core ↔ Bedrock translation bridge as --type anthropic with /v1/messages on the inside, because aws-bedrock isn't a recognized provider type. The chart therefore carries a server-side Anthropic→Bedrock body translator and a denylist for Anthropic-API-only fields the SAP gateway rejects. After this PR, the bridge becomes a path-translating + auth-substituting pass-through with no body work — the chart's translator code goes away.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[st-gr]

I have read the DCO document and I hereby sign the DCO.

[st-gr]

recheck

[johntmyers]

gator-agent

PR Review Status

Validation: this PR remains project-valid as a concentrated Bedrock-compatible provider/profile and sandbox L7 routing update. The prior legacy ProviderDiscoverySpec blocker is resolved at head 508a4e6c1fb88c7c1550f2cebb50c24301116db6.

Head SHA: 508a4e6c1fb88c7c1550f2cebb50c24301116db6

Review findings:

• Blocking: aws-bedrock still is not wired into the managed inference.local route registry. openshell_core::inference::profile_for only registers openai, anthropic, and nvidia, so openshell inference set --provider <aws-bedrock-provider> will reject this provider before the new sandbox L7 patterns can be used. Please add the aws-bedrock inference profile/route support or narrow the PR so it does not advertise managed inference.local support.
• Major: providers/aws-bedrock.yaml declares AWS_SESSION_TOKEN, but discovery.credentials omits aws_session_token. Providers v2 discovery only scans listed credentials, so --from-existing will silently drop temporary AWS credentials. Please include aws_session_token in discovery.credentials.
• Major: direct user-facing docs are still missing. If this PR exposes aws-bedrock as a provider/profile and adds Bedrock request patterns, please update the existing provider and inference routing docs. No new docs/index.yml entry appears necessary.
• Test gap: add coverage that an aws-bedrock provider can be created from the built-in profile and either successfully used by upsert_cluster_inference_route or intentionally rejected with a clear documented error.

Docs: missing for direct provider and inference-routing behavior.

Checks: DCO is passing. Branch Checks and Helm Lint are still waiting for /ok to test; I am not posting /ok to test while blocking review feedback is outstanding.

Next state: gator:in-review

[johntmyers]

gator-agent

Re-check After Reviewer Update

I re-evaluated latest head 508a4e6c1fb88c7c1550f2cebb50c24301116db6 after st-gr's June 5 responses on the legacy provider update and endpoint wildcard, and johntmyers's June 5 maintainer response accepting the fixed bedrock-runtime.us-east-1.amazonaws.com endpoint.

Disposition: partially resolved. The legacy ProviderDiscoverySpec update is removed, and the endpoint wildcard discussion is resolved. Blocking review feedback remains.

Remaining items:

• Blocking: providers/aws-bedrock.yaml marks the profile inference_capable: true, but openshell_core::inference::profile_for still only registers openai, anthropic, and nvidia; openshell inference set --provider <aws-bedrock-provider> will still reject this provider before the new sandbox L7 patterns can be used. Please add the aws-bedrock inference profile/route support with the intended auth semantics, or narrow the PR so it does not advertise managed inference.local support.
• Blocking/static test regression: crates/openshell-server/src/grpc/provider.rs still asserts the built-in profile list is exactly ['claude-code', 'github', 'nvidia']. Adding providers/aws-bedrock.yaml makes that assertion stale; please update the expected built-in profile list.
• Major: providers/aws-bedrock.yaml declares aws_session_token, but discovery.credentials omits it. Providers v2 discovery only scans listed credentials, so --from-existing will silently drop temporary AWS credentials. Please include aws_session_token in discovery.credentials.
• Major: direct user-facing docs are still missing for the new provider/profile and inference-routing behavior. No docs/index.yml navigation change appears necessary.
• Test gap: please add coverage that an aws-bedrock provider can be created from the built-in profile and either successfully used by upsert_cluster_inference_route or intentionally rejected with a clear documented error.

Checks: DCO is passing. Branch Checks and Helm Lint are still waiting for /ok to test; I am not posting /ok to test while blocking review feedback is outstanding.

Next state: gator:in-review

[st-gr]

@johntmyers — pushed 4ab587f1 addressing the remaining review items.

This push:

• Blocking (profile_for registration): registered aws-bedrock with a new AuthHeader::None variant — the router does not inject any auth header on outbound requests. The configured BEDROCK_BASE_URL is expected to point at a translating bridge or Bedrock-compatible proxy that handles auth in its own pod. This matches the pass-through architecture noted in the original commit message (8b30211a: "if the operator's upstream is real AWS Bedrock it speaks Bedrock natively, if it's a translating bridge the bridge does any conversion server-side"). openshell inference set --provider <aws-bedrock-provider> now resolves cleanly.
• Major (aws_session_token in discovery): added in 3d0ad1c6.
• Major (docs): updated docs/sandboxes/inference-routing.mdx (header forwarding row, new API-pattern tab, new provider-creation tab with the bridge-fronted note) and docs/sandboxes/manage-providers.mdx (Supported Provider Types and Supported Inference Providers tables).
• Test gap: added upsert_cluster_route_succeeds_for_aws_bedrock_without_api_key in crates/openshell-server/src/inference.rs. Creates an aws-bedrock provider with empty credentials + a BEDROCK_BASE_URL config-key, upserts the cluster route, and asserts the resolved route carries provider_type: "aws-bedrock", the bridge URL, and an empty api_key.
• Static profile assertion: updated in 3d0ad1c6 to include aws-bedrock.

Deferred to follow-up PRs (will file issues for tracking):

1. SigV4 router-side signer. Adds an AuthHeader::SigV4 { ... } variant + outbound request signing using the aws-sigv4 crate so aws-bedrock providers can authenticate against real AWS Bedrock directly (instead of via a bridge). The current PR's auth: None shape is one of two intended shapes; SigV4 is the other and is genuinely separable.
2. {region} placeholder substitution in YAML profile loader. So operators can use any AWS region without having to override the entire base URL via BEDROCK_BASE_URL. Today the YAML's host is a literal bedrock-runtime.us-east-1.amazonaws.com.

Verification (run locally in the rust-1.95 dev container): cargo check -p openshell-core -p openshell-router -p openshell-server, cargo test -p openshell-core --lib inference (14/14), cargo test -p openshell-server --lib inference::tests::upsert (6/6), cargo fmt --check, cargo clippy --all-targets -D warnings — all clean. Branch Checks / Helm Lint stand by for /ok to test whenever ready.

[johntmyers]

gator-agent

Re-check After Author Update

I re-evaluated latest head 4ab587f1bdab2c2565462fe5ed9cc6bb3a5d0c12 after @st-gr's June 7 comment saying the remaining review items were addressed.

Disposition: partially resolved. The previous profile_for registration, built-in profile list, aws_session_token discovery entry, and Fern docs update requests are addressed. Blocking review feedback remains on the public setup path and Bedrock route behavior.

Remaining items:

• Blocking: openshell inference set verifies routes by default, but the router validation probe does not support aws_bedrock_invoke / aws_bedrock_invoke_stream, so the documented Bedrock inference setup will fail unless users know to pass --no-verify. Please add a Bedrock validation strategy, or explicitly require/document --no-verify and add coverage for that public path.
• Blocking/security: Bedrock carries the model id in /model/{modelId}/invoke, but the router currently forwards the caller's original path and only rewrites JSON body model. That lets sandbox code choose a different upstream model than the operator-configured route model, and may also mutate native Bedrock request bodies incorrectly. Please rewrite or reject mismatched Bedrock model paths and skip body model injection for Bedrock protocols, with buffered and streaming router coverage.
• Blocking/docs or behavior mismatch: the docs show openshell provider create --type aws-bedrock --config BEDROCK_BASE_URL=... without credentials, but the CLI requires --from-existing or --credential and the server rejects empty credentials for non-refresh profiles. Please either make bridge-fronted aws-bedrock work as a config-only provider and test provider_create, or document the actual required command.
• Major: until SigV4 support exists, the core profile should not silently fall back to the real AWS Bedrock endpoint with auth: None; require BEDROCK_BASE_URL for bridge-fronted mode or otherwise prevent saving a route that forwards prompt bodies to AWS without usable auth.
• Major: the provider YAML marks AWS credentials required and discoverable even though bridge-fronted routing intentionally does not use them. Please avoid collecting required AWS credentials for the bridge-only shape, or explain and test why they must be stored before SigV4 lands.
• Docs polish: docs/sandboxes/inference-routing.mdx still says provider support is NVIDIA, OpenAI-compatible, and Anthropic; please include AWS Bedrock in that summary row if this PR keeps the provider.

Checks: DCO is passing. Branch Checks and Helm Lint are still waiting for /ok to test; I am not posting /ok to test while blocking review feedback is outstanding.

Next state: gator:in-review

[johntmyers]

gator-agent

Blocked

Gator is blocked by merge conflicts on the PR branch. GitHub currently reports mergeable=CONFLICTING and mergeStateStatus=DIRTY for head 4ab587f1bdab2c2565462fe5ed9cc6bb3a5d0c12.

Next action: @st-gr, please rebase or merge main into feat/aws-bedrock-provider and resolve the conflicts. After the branch is mergeable again, gator will re-check the outstanding review items before any /ok to test action.

[johntmyers]

gator-agent

Re-check After Author Update

I re-evaluated latest head 6373b4d2649f7fb36cbe75c34c96319f0120e439 after @st-gr pushed updates on June 8, 2026 to resolve the prior merge-conflict blocker and address the remaining review items.

Disposition: partially resolved. The merge-conflict blocker is resolved (mergeable=true), and the bridge-only Bedrock profile/docs/no-verify path is clearer. Blocking review feedback remains.

Remaining items:

• Blocking/security: Bedrock still does not enforce the configured route model. aws-bedrock resolves with model_in_path: false and no path override, so sandbox code can call /model/other-model/invoke and the bridge receives that caller-selected model in the URL. The generic body rewrite also injects "model": route.model, which is not Bedrock's selector and can mutate native Bedrock bodies. Please either build/rewrite Bedrock upstream paths from route.model or reject mismatched caller model paths, and skip generic body model insertion for aws_bedrock_* protocols.
• Blocking/scope: the PR currently carries unrelated fork infrastructure and external compute driver changes (.github/workflows/release-gateway.yml, .github/workflows/rust-lint.yml, .github/workflows/smoke-self-hosted-kyma.yml, Dockerfile.gateway, README-FORK.md, and external-driver hunks). Please remove those from this Bedrock provider PR or split them into maintainer-scoped PRs.
• Warning: Bedrock InvokeModel should be buffered while InvokeModelWithResponseStream is streaming. Please add framing/coverage so /model/{id}/invoke cannot be corrupted by the streaming proxy's truncation/error-frame behavior.
• Warning/docs: the bridge-only profile still declares AWS secret fields while discovery is empty and the router does not consume them. Please avoid encouraging real AWS secrets for the current bridge-only shape, or label them clearly as future SigV4 fields in the docs table.

Checks: DCO is passing. Branch Checks and Helm Lint are still waiting for /ok to test; I am not posting /ok to test while blocking review feedback is outstanding.

Next state: gator:in-review

[johntmyers]

gator-agent

Re-check After Author Update

I re-evaluated latest head 36c6c20508e91c8fd4415dbb3fa1c1a875650a67 after @st-gr's June 16, 2026 comment asking whether the current gator findings should remain blockers. I also ran the required independent code-only review for the current diff and response.

Disposition: partially resolved.

Remaining items:

• Blocking/security: the AWS credential schema/docs issue remains a blocker unless a maintainer explicitly accepts the risk. providers/aws-bedrock.yaml and docs/sandboxes/manage-providers.mdx still expose real AWS credential names, including AWS_SECRET_ACCESS_KEY, for a bridge-fronted provider shape that does not consume them today. Because the docs describe these as injected environment variables, this creates unnecessary sandbox-visible secret surface for no current runtime benefit. Recommended fix: use a neutral bridge placeholder credential such as BEDROCK_BRIDGE_PLACEHOLDER, keep discovery empty, and update the provider docs/table so real AWS secrets are not presented as injected for this bridge-only release. Security mapping: CWE-200 / CWE-269 / OWASP LLM06.
• Non-blocking follow-up: the provider-create/gRPC path coverage request is valid test hardening, but I am downgrading it from a merge blocker. The current diff covers the route-resolution/router behavior, profile registration, BEDROCK_BASE_URL requirement, auth-none behavior, and Bedrock model-id validation. Public create-path coverage would still be useful to catch docs/profile drift.

Checks: DCO and the CI gate publisher are passing, but OpenShell / Branch Checks, OpenShell / Helm Lint, and OpenShell / E2E are still waiting for /ok to test on this head. I am not posting /ok to test while the credential-schema blocker remains unresolved or unwaived by a maintainer.

Next state: gator:in-review

[johntmyers]

1. We can keep as-is knowing there is a follow-up coming.

2. File as a follow-up.

@st-gr looks like we need a re-base and then we can merge. Let's get the follow-ups ticketed and then can keep going.

[johntmyers]

gator-agent

Re-check After Maintainer Update

I re-evaluated latest head 36c6c20508e91c8fd4415dbb3fa1c1a875650a67 after @johntmyers's June 16, 2026 maintainer comment accepting the AWS credential schema as-is with a follow-up and asking for the provider-create coverage to be filed as a follow-up.

Disposition: partially resolved. The remaining gator review feedback is waived or downgraded by maintainer decision, so those items no longer block gator review for this PR. The current blocker is mergeability: GitHub REST reports mergeable_state=dirty for this head.

Remaining items:

• Blocking/process: the branch has merge conflicts against main and must be rebased or merged again before CI can be re-authorized and the PR can return to approval readiness.
• Follow-up: file the provider-create/gRPC path coverage item separately as requested by the maintainer.
• Follow-up: keep the AWS credential schema/SigV4/direct-Bedrock work in the planned follow-up scope accepted by the maintainer.

Next action: @st-gr, please rebase or merge main into feat/aws-bedrock-provider and resolve the conflicts. After the branch is mergeable again, gator will re-check the head, authorize CI if no new blockers appear, and continue from approval readiness.

Next state: gator:blocked

[st-gr]

@johntmyers — done.

Rebase: rebased feat/aws-bedrock-provider onto current upstream/main (now at 36bb9e3e). Three new commits since the prior 36c6c205:

• b1db5577 style(server): silence unused-variable lint on first shutdown_tx — drive-by fix; the rebase re-touches lib.rs and clippy now flags an unused shutdown_tx introduced by upstream feat(gateway): add reconciler lease for HA multi-replica deployments #1577. Prefixed with _ to keep workspace lint clean. No behavior change.
• Re-resolved two conflicts on crates/openshell-{core,server}/src/inference.rs against feat(providers): add DeepInfra as a built-in inference provider #1902 (DeepInfra provider added entries to the same registries the Bedrock profile touches); both registrations now coexist.
• All earlier Bedrock commits preserved with their semantics intact (only SHAs differ).

New HEAD: b1db5577. Diff vs upstream/main: same 9 Bedrock-scoped files plus the one-line lib.rs lint fix.

Verified inside rust:1.95-slim:

• cargo fmt --all -- --check ✅
• cargo clippy --workspace --all-targets -- -D warnings ✅
• cargo test -p openshell-core -p openshell-router -p openshell-server -p openshell-supervisor-network --lib → 1,870/1,870 ✅

Follow-up issues, per your direction:

• feat(inference): AWS Bedrock direct/SigV4 support + non-bridge profile #1940 — feat(inference): AWS Bedrock direct/SigV4 support + non-bridge profile. Covers the deferred SigV4 signer, aws_bedrock_invoke_stream re-enablement with protocol-aware event-stream error framing, profile repopulation, and {region} substitution.
• test(inference): add gRPC provider-create-path coverage for built-in profiles #1941 — test(inference): add gRPC provider-create-path coverage for built-in profiles. Covers the test gap gator flagged.

Ready for /ok to test b1db5577 and merge.

[johntmyers]

gator-agent

Re-check After Author Update

I re-evaluated latest head b1db5577d0487f55004e755da4a31b7a847b3eb1 after @st-gr's June 17, 2026 comment saying the branch was rebased, the follow-up issues were filed, and the branch is ready for /ok to test.

Disposition: resolved for gator review. GitHub REST reports mergeable=true with mergeable_state=blocked, which is the normal review/check gate rather than a merge-conflict blocker. The required independent code-only review for the current diff found no blocking findings.

Remaining items:

• No blocking gator review items remain.
• Follow-up feat(inference): AWS Bedrock direct/SigV4 support + non-bridge profile #1940 tracks direct AWS Bedrock/SigV4 and non-bridge profile work.
• Follow-up test(inference): add gRPC provider-create-path coverage for built-in profiles #1941 tracks provider-create/gRPC path coverage requested by the maintainer.

Checks: DCO and the CI gate publisher are passing. OpenShell / Branch Checks, OpenShell / Helm Lint, and OpenShell / E2E are waiting for /ok to test on this head, so I am authorizing CI and moving gator back to pipeline watch.

Next state: gator:watch-pipeline

[johntmyers]

/ok to test b1db557

[johntmyers]

gator-agent

Maintainer Approval Needed

Gator validation and PR monitoring are complete.

Validation: this PR remains project-valid as concentrated initial plumbing for bridge-fronted AWS Bedrock inference/provider support.
Review: no blocking gator review findings remain at head b1db5577d0487f55004e755da4a31b7a847b3eb1; follow-up #1940 tracks direct AWS Bedrock/SigV4 and non-bridge profile work, and follow-up #1941 tracks provider-create/gRPC path coverage.
Docs: updated for the new provider and inference-routing behavior.
Checks: OpenShell / Branch Checks, OpenShell / Helm Lint, and OpenShell / E2E are passing for the current head.
E2E: test:e2e is applied and the core E2E gate is passing; GPU and Kubernetes HA E2E are not required for this PR.

Human maintainer approval or merge decision is now required.