feat(llm-helper): the classic Bedrock runtime as a second surface (llm.aws.api), the SDK's credential error mapped, and the live drive's record

[acn-ericlaw]

What

Two things the live drive on AWS Bedrock (2026-10-14) asked of the helper's Bedrock backend:

• The classic Bedrock runtime as a second surface. llm.aws.api selects mantle (the default: the SDK's AsyncAnthropicBedrockMantle, the Anthropic-shaped endpoint, a bare model id prefixed anthropic.) or runtime (AsyncAnthropicBedrock, the classic endpoint, every model id sent exactly as written - an inference profile id as the account lists it, such as us.anthropic.claude-haiku-4-5-20251001-v1:0, since those carry dates and versions no rule can derive). llm.health names the surface beside the backend, model and region; no region on either surface is 503 AWS region missing before any call; a bad value is a 500 by name. Two shared vectors (68) pin the runtime surface's id rule in both packs.
• The SDK's own credential error mapped. The Mantle client raises RuntimeError("Could not resolve AWS credentials from session") while signing a call whose chain is empty; the merged backend matched the legacy wording and let it through as a bare 500. The match is now case-insensitive on the words both wordings carry; the test pins the live message.

The README, the configuration and the CHANGELOG document the two surfaces and the sign that an account lacks the default one: a 403 ... is not available for this account on a model the console's playground runs. This pack's test report gains the live drive.

Why

Found by the live drive, negative controls first: a corrupted secret came back as a 401 by name, no credential as the 503 by name (the Python call's mapping gap the second item fixes), and then every positive call on the default surface was refused for the account while the classic runtime served Haiku 4.5. With the surface switch, both packs answered a chat, a structured verdict and a progressive stream on Bedrock through IAM with no vendor key, and the Java engine's shipped support-triage graph and streaming relay ran in front of each helper. The Node twin is mercury-nodejs' sibling PR; the engines' certification report records the drive as Scenario 8.

Gates

• ruff check ., basedpyright 0 errors, pytest -q 202 green - no token spent, no credential needed

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com

🤖 Generated with Claude Code