fix(moa): preserve provider identity for anthropic + bedrock slots - #55897
Merged
Merged
Conversation
alt-glitch
added
type/bug
…anch MoA's _slot_runtime() whitelists providers that must keep their provider identity (so call_llm runs their provider branch) instead of being treated as a plain custom endpoint via forwarded base_url/api_key. Native anthropic was missing from this set. Native anthropic subscription OAuth setup-tokens (sk-ant-oat*) require Bearer auth plus the 'anthropic-beta: oauth-*' header, which only the anthropic provider branch adds. Without the whitelist entry, the slot's base_url/api_key were forwarded and call_llm sent the OAuth token as x-api-key, which Anthropic rejects with a bare 429 (rate_limit_error with no quota details). This made anthropic references in MoA presets fail every time. Add 'anthropic' to the whitelist so native anthropic reference/aggregator slots route through the provider branch. Extends upstream 9229d0d which added 'nous' for the same reason.
_slot_runtime() resolved a bedrock slot to its bedrock-runtime base_url plus the placeholder api_key "aws-sdk" and forwarded both to call_llm. call_llm then treated it as a plain OpenAI-compatible endpoint and issued an UNSIGNED bearer POST (no AWS SigV4 / IAM signing), so Bedrock returned an empty/malformed ChatCompletion (choices=None) and the MoA aggregator turn failed validation. Add 'bedrock' to the name-preserve set alongside nous/openai-codex/ xai-oauth so bedrock slots are passed by provider name only, routing through call_llm's dedicated SigV4-signed bedrock branch. Affects any MoA preset using a bedrock aggregator or bedrock reference.
…e-preserve #54609 moves anthropic into the _slot_runtime name-preservation set (it must NOT forward base_url/api_key — OAuth sk-ant-oat* needs the provider branch's Bearer + anthropic-beta header). The pre-existing parametrized test_moa_provider_backed_slot_survives_aux_resolution still listed anthropic asserting the forward path, contradicting the new behavior. anthropic is now covered by test_slot_runtime_anthropic_oauth_routes_through_provider_branch; drop it from the forward-path parametrize (minimax-oauth/qwen-oauth remain).
teknium1
force-pushed
the
hermes/hermes-21bc0d78
branch
from
July 1, 2026 00:35
9f14e60 to
288c8f7
Compare
This was referenced Jul 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
MoA reference/aggregator slots for
anthropicandbedrocknow keep their provider identity instead of being flattened to a generic custom endpoint — so OAuth-token / SigV4-signed auth actually fires.Salvages two external PRs (#54609 by @jackroofan, #54912 by @iizotov), both extending the
_slot_runtimename-preservation set. Closes #55452 (duplicate of #54609's anthropic fix).Root cause
agent/moa_loop.py::_slot_runtimeresolves a slot throughresolve_runtime_providerand forwardsbase_url/api_keytocall_llm.call_llmtreats an explicitbase_urlas acustomendpoint, which skips the provider branch that adds auth headers / request signing. That's correct for plain OpenAI-compatible targets but wrong for two providers:sk-ant-oat*) requireBearerauth plus theanthropic-beta: oauth-*header, added only by the anthropic provider branch. Forwarded → the token is sent asx-api-key→ Anthropic returns a bare 429.resolve_runtime_providerreturns a placeholderapi_key("aws-sdk"), not a real bearer. Forwarded → unsigned POST → empty/malformedChatCompletion.This is the same class already handled for
{nous, openai-codex, xai-oauth}.Changes
agent/moa_loop.py: addanthropicandbedrockto the_slot_runtimename-preservation set (union of the two PRs), with rationale comments for each.tests/run_agent/test_moa_loop_mode.py: anthropic's dedicated name-preserve test (from fix(moa): route native anthropic OAuth references through provider branch #54609) lands; dropanthropicfrom the pre-existingtest_moa_provider_backed_slot_survives_aux_resolutionparametrize (it asserted the old forward path — now superseded;minimax-oauth/qwen-oauthstill forward and remain).scripts/release.py: AUTHOR_MAP entries for both contributors.Validation
tests/run_agent/test_moa_loop_mode.pyContributor authorship preserved (rebase-merge).
Infographic