feat(bedrock): support OpenAI Responses models

[natebransc]

Summary

• Add Bedrock Mantle/OpenAI Responses routing for allowlisted Bedrock OpenAI models, starting with openai.gpt-5.5.
• Surface openai.gpt-5.5 in the AWS Bedrock model picker even though it is not returned by native Bedrock Converse discovery.
• Add SigV4 signing for OpenAI SDK requests to https://bedrock-mantle.<region>.api.aws/openai/v1, while preserving existing Claude-on-Bedrock and native Converse routing.
• Preserve Bedrock provider identity inside MoA slots so MoA presets can use Bedrock GPT-5.5 as a reference and/or aggregator without downgrading the call to a generic bearer-token custom endpoint.

Why

Bedrock-hosted GPT-5.5 is served through the Bedrock Mantle OpenAI-compatible Responses endpoint, not bedrock-runtime Converse. Without a separate route, Hermes can discover/use Converse models under AWS Bedrock but cannot select or call openai.gpt-5.5 from the Bedrock provider.

MoA slots also need provider-aware runtime handling. If a Bedrock GPT-5.5 MoA slot forwards base_url + api_key="aws-sdk" as a generic custom OpenAI endpoint, the sentinel is sent as an invalid bearer token. Keeping provider=bedrock lets the auxiliary provider router attach the SigV4 Responses client.

Conflict resolution

• Rebased onto current origin/main (23021be26e66e26e1b9893eda2dc943849ede03d).
• Resolved the agent/moa_loop.py conflict by keeping upstream's provider-preservation guard for nous and adding bedrock to the same preserved-provider set.

Testing

• scripts/run_tests.sh tests/run_agent/test_moa_loop_mode.py tests/hermes_cli/test_bedrock_model_picker.py tests/agent/test_bedrock_integration.py tests/run_agent/test_callable_api_key.py tests/test_empty_model_fallback.py
  • 127 passed, 0 failed
• PYTHONPATH="$WT" /Users/nathaniel/.hermes/hermes-agent/venv/bin/python -m py_compile agent/agent_init.py agent/auxiliary_client.py agent/bedrock_adapter.py agent/moa_loop.py hermes_cli/models.py hermes_cli/runtime_provider.py tests/agent/test_bedrock_integration.py tests/hermes_cli/test_bedrock_model_picker.py tests/run_agent/test_moa_loop_mode.py
• git diff --check origin/main...HEAD
• /Users/nathaniel/.hermes/hermes-agent/venv/bin/python scripts/check-windows-footguns.py agent/agent_init.py agent/auxiliary_client.py agent/bedrock_adapter.py agent/moa_loop.py hermes_cli/models.py hermes_cli/runtime_provider.py tests/agent/test_bedrock_integration.py tests/hermes_cli/test_bedrock_model_picker.py tests/run_agent/test_moa_loop_mode.py
  • ✓ No Windows footguns found (9 file(s) scanned).
• Manual live Bedrock GPT-5.5 smoke test on macOS 26.2 after refreshing AWS SSO:
  • PYTHONPATH="$WT" AWS_REGION=us-east-2 /Users/nathaniel/.hermes/hermes-agent/venv/bin/hermes -z 'Reply exactly: rebase-bedrock-gpt55-ok' --provider bedrock -m openai.gpt-5.5 --toolsets ''
  • Output: rebase-bedrock-gpt55-ok
• Manual live auxiliary Bedrock GPT-5.5 call through call_llm(provider="bedrock", model="openai.gpt-5.5"):
  • Output: aux-bedrock-rebase-ok
• Manual live MoA-over-Bedrock GPT-5.5 smoke test:
  • MoA preset with Bedrock GPT-5.5 as both reference and aggregator
  • HERMES_HOME=/private/tmp/hermes-moa-bedrock-home PYTHONPATH="$WT" AWS_REGION=us-east-2 /Users/nathaniel/.hermes/hermes-agent/venv/bin/hermes -z 'Reply exactly: rebase-moa-bedrock-ok' --provider moa -m bedrock-gpt55 --toolsets ''
  • Output: rebase-moa-bedrock-ok

Duplicate check

• Searched open issues for Bedrock GPT-5.5.
• Searched open and closed PRs for Bedrock OpenAI Responses.
• No duplicate issue/PR found.

[tonydwb]

Code Review Summary

Verdict: Approved

Bedrock OpenAI Responses model support (7 files). Well-scoped provider extension:

• New is_openai_bedrock_model and bedrock_openai_base_url functions in bedrock_adapter
• OpenAI SDK client configuration via SigV4-signing httpx client
• Proper fallback: if the OpenAI path fails for non-Bedrock providers, the exception is swallowed gracefully
• configure_bedrock_openai_client_kwargs centralizes client setup
• Changes in agent_init.py and auxiliary_client.py are additive, not destructive

Test coverage is reasonable for a provider integration. The except Exception with re-raise guard for actual Bedrock providers is a good pattern.

[tonydwb]

Code Review Summary

Verdict: Approved

Well-scoped Bedrock OpenAI Responses model support (7 files). Key features:

• New is_openai_bedrock_model and bedrock_openai_base_url functions in bedrock_adapter
• BedrockOpenAISigV4Auth for httpx SigV4-signing
• OpenAI SDK client configuration via SigV4-signing httpx client
• Proper fallback: if the OpenAI path fails for non-Bedrock providers, the exception is swallowed gracefully
• configure_bedrock_openai_client_kwargs centralizes client setup
• Changes in agent_init.py and auxiliary_client.py are additive, not destructive

Test coverage is reasonable for a provider integration. The except Exception with re-raise guard for actual Bedrock providers is a good pattern.

No concerns. Ready to merge.

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the focused Mantle/IAM implementation. The core premise remains valid: current main routes non-Claude Bedrock models through Converse at hermes_cli/runtime_provider.py:1991, while AWS documents GPT-5.5 as Responses-only on bedrock-mantle.

Problems

• agent/auxiliary_client.py:4473 reconstructs the endpoint from resolve_bedrock_region() and ignores the explicit main-runtime URL forwarded by auto resolution (agent/auxiliary_client.py:4222-4251). That disagrees with the main resolver, which honors bedrock.region (hermes_cli/runtime_provider.py:1958-1962), so auxiliary requests can move to the wrong region.
• The added picker tests snapshot a model name and counts, contrary to AGENTS.md:1309-1355.

Suggested changes

• Preserve/parse the explicit Mantle URL for auxiliary calls and add a config-region-vs-environment regression.
• Salvage the MoA coverage onto the current centralized preservation path: a653bb0c removed the whitelist this PR edits.
• Update website/docs/guides/aws-bedrock.md:9, which currently says Hermes does not use the OpenAI-compatible endpoint.

Automated hermes-sweeper review.

[teknium1]

This rebuilds the endpoint from the ambient AWS region and ignores explicit_base_url forwarded from the active main runtime. Please preserve/parse that Mantle URL (or reuse runtime resolution), otherwise bedrock.region can select one region for the main agent and another for auxiliary calls.