fix(moa): preserve provider identity for anthropic + bedrock slots

[hashbender]

Summary

MoA reference/aggregator slots for anthropic and bedrock now keep their provider identity instead of being flattened to a generic custom endpoint — so OAuth-token / SigV4-signed auth actually fires.

Salvages two external PRs (NousResearch#54609 by @jackroofan, NousResearch#54912 by @iizotov), both extending the _slot_runtime name-preservation set. Closes NousResearch#55452 (duplicate of NousResearch#54609's anthropic fix).

Root cause

agent/moa_loop.py::_slot_runtime resolves a slot through resolve_runtime_provider and forwards base_url/api_key to call_llm. call_llm treats an explicit base_url as a custom endpoint, which skips the provider branch that adds auth headers / request signing. That's correct for plain OpenAI-compatible targets but wrong for two providers:

• anthropic — subscription OAuth setup-tokens (sk-ant-oat*) require Bearer auth plus the anthropic-beta: oauth-* header, added only by the anthropic provider branch. Forwarded → the token is sent as x-api-key → Anthropic returns a bare 429.
• bedrock — the provider branch builds an AWS-SigV4-signed client; resolve_runtime_provider returns a placeholder api_key ("aws-sdk"), not a real bearer. Forwarded → unsigned POST → empty/malformed ChatCompletion.

This is the same class already handled for {nous, openai-codex, xai-oauth}.

Changes

• agent/moa_loop.py: add anthropic and bedrock to the _slot_runtime name-preservation set (union of the two PRs), with rationale comments for each.
• tests/run_agent/test_moa_loop_mode.py: anthropic's dedicated name-preserve test (from fix(moa): route native anthropic OAuth references through provider branch NousResearch/hermes-agent#54609) lands; drop anthropic from the pre-existing test_moa_provider_backed_slot_survives_aux_resolution parametrize (it asserted the old forward path — now superseded; minimax-oauth/qwen-oauth still forward and remain).
• scripts/release.py: AUTHOR_MAP entries for both contributors.

Validation

	Before	After
anthropic OAuth MoA slot	bare 429 (token sent as x-api-key)	routed through provider branch (Bearer + oauth-beta)
bedrock MoA slot	empty/malformed response (unsigned POST)	routed through signed bedrock branch
tests/run_agent/test_moa_loop_mode.py	—	20/20 pass

Contributor authorship preserved (rebase-merge).

Infographic

---

Mirror-of: NousResearch#55897
NousResearch#55897

[tenki-reviewer]

Review Complete
No issues found!

Risk: 🟢 Low (8/100) — no findings · 68 LOC across 3 files

---

No issues found. The three changed files (moa_loop.py, release.py, test) pass review with no regressions or security concerns.

Files Reviewed (3 files)

agent/moa_loop.py
scripts/release.py
tests/run_agent/test_moa_loop_mode.py