diff --git a/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md b/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md index cdfbf6cc0..b79746f62 100644 --- a/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md +++ b/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md @@ -257,7 +257,7 @@ client = anthropic.Anthropic( Preserve compatible SDK request/response shapes. A model version change still requires §9 target checks, including typed response parsing for Opus 5.5. Apply the Chat Completions → Responses reshape only when that API change was selected. Preserve the exact validated runtime profile ID or ARN. After applying the changes above, skip the Converse-specific guidance in the rest of §8; the §9 behavior-delta application still applies normally. -**Converse for a proprietary GPT target is family-dependent.** GPT-5.5 / GPT-5.4 (`openai.gpt-5.5`, `openai.gpt-5.4`) have no `bedrock-runtime` surface — a boto3 `converse()` call against them fails at runtime; if your context pairs one with the Converse path, stop and report the contradiction. GPT-5.6 and GPT-6 (Astra, Sol, Luna, 6.1 Sol) DO have a `bedrock-runtime` path via CRIS ids (`us.`/`in.`/`global.` prefixed): when the plan says `migration_path: runtime_openai_cris`, a Converse or Responses rewrite against the CRIS id is valid (base URL `bedrock-runtime.{region}.amazonaws.com/openai/v1` for the OpenAI-compatible APIs; note Guardrails are Converse-only and prompt caching Responses-only on runtime). For a Responses-based source app, the mantle express lane above remains the default and smallest change. +**Converse for a proprietary GPT target is id-form-dependent, not family-dependent.** A **bare** proprietary GPT id (`openai.gpt-5.5`, `openai.gpt-5.4`, `openai.gpt-5.6-*`, `openai.gpt-6-*`) is a `bedrock-mantle` id with no `bedrock-runtime` in-region form — a boto3 `converse()` call against a bare id fails at runtime; if your context pairs a bare id with the Converse path, stop and report the contradiction. GPT-5.6, GPT-6 (Astra, Sol, Luna, 6.1 Sol) **and GPT-5.5 / GPT-5.4** (model cards read 2026-11-06: `us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`; Responses, Chat Completions and Converse on runtime, no Invoke) all have a `bedrock-runtime` path via CRIS ids (`us.`/`in.`/`global.` prefixed for GPT-5.6 Terra and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4 — those cards publish no `in.` profile): when the plan says `migration_path: runtime_openai_cris`, a Converse, Responses or Chat Completions rewrite against the CRIS id is valid (base URL `bedrock-runtime.{region}.amazonaws.com/openai/v1` for the OpenAI-compatible APIs; note Guardrails are Converse-only and prompt caching Responses-only on runtime). For a Responses-based source app, the mantle express lane above remains the default and smallest change. ### Converse rewrite (default) diff --git a/plugins/aws-startup-advisor/agents/llm2bedrock-prompt-evaluator.md b/plugins/aws-startup-advisor/agents/llm2bedrock-prompt-evaluator.md index d18e1a13d..d933c4b3e 100644 --- a/plugins/aws-startup-advisor/agents/llm2bedrock-prompt-evaluator.md +++ b/plugins/aws-startup-advisor/agents/llm2bedrock-prompt-evaluator.md @@ -229,12 +229,13 @@ Interpret the result: region. These models are **in-region only**, so there is no cross-region inference profile to fall back to and `resolve-bedrock-model-id`'s inference-profile ranking does not apply. Return - `{ blocked: { reason: 'model_unresolvable', detail: ' — is not available on the bedrock-mantle endpoint in . Mantle is in-region only; for Astra use Virginia/Oregon Standard Mantle or a supported us./global. runtime profile with an explicit plan change; GPT-5.6 may use its us./in./global. CRIS forms, while GPT-5.5/5.4 need a supported region or a different model.' } }`. + `{ blocked: { reason: 'model_unresolvable', detail: ' — is not available on the bedrock-mantle endpoint in . Mantle is in-region only; for Astra use Virginia/Oregon Standard Mantle or a supported us./global. runtime profile with an explicit plan change; GPT-5.6 may use its us./in./global. CRIS forms and GPT-5.5/5.4 their us./global. CRIS forms with an explicit plan change, or pick a supported mantle region or a different model.' } }`. Use `model_unresolvable` rather than a new reason — its recovery path (user picks or pastes an ID, recorded in `resolved_model_overrides`) is exactly right here. Astra may use only supported `us.` / `global.` CRIS candidates; check its own region matrix. For GPT-5.6 a `us.`/`in.`/`global.`-prefixed CRIS candidate is legitimate - (it switches the run to the Converse path); for GPT-5.5 / GPT-5.4 no prefixed - form exists — do not offer one. + (it switches the run to the Converse path); for GPT-5.5 / GPT-5.4 the `us.`/`global.` + prefixed forms exist on `bedrock-runtime` (model cards read 2026-11-06) and are offered + the same way — never silently, always as an explicit plan change. - **HTTP 401 / 403** — distinguish the two causes from the message. If it names model access, return `{ blocked: { reason: 'model_access', ... } }` as in §6. Otherwise it is IAM: the principal needs the `bedrock-mantle:*` actions diff --git a/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md b/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md index 54d09601e..9dd8b8107 100644 --- a/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md +++ b/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md @@ -143,7 +143,7 @@ The pricing script only covers Bedrock models. For the source provider (OpenAI, **Astra:** use its separately dated Bedrock rates and context/inference tier. Its source price is absent from the table below; verify that price or mark the source comparison unavailable. Do not estimate Astra from a lower GPT tier or assume GPT-5.x parity/premium. -**GPT-5.x same-model pair cost depends on the inference option — state it conditionally, never as a flat figure.** In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier (1.10x standard), so those moves cost ~10% more — quote the increase plainly and carry the non-cost justification (commitments, governance, residency, prompt caching, no behaviour delta). **GPT-5.6 on Global CRIS is priced at the standard rate — cost parity** — applicable only when the workload has no data-residency constraint; when the plan's `migration_path` is `runtime_openai_cris` with a `global.` id, report parity, not a premium. GPT-5.5/5.4 have no CRIS, so the ~10% figure always applies to them. **If a pair's workload exceeds 272K context**, price the Bedrock side at the GPT-5.6 long-context tier — 2.0x input, 1.5x output per option — and show that line separately; GPT-5.5/5.4 have no long-context tier so their usable window is 272K. +**GPT-5.x same-model pair cost depends on the inference option — state it conditionally, never as a flat figure.** In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier (1.10x standard), so those moves cost ~10% more — quote the increase plainly and carry the non-cost justification (commitments, governance, residency, prompt caching, no behaviour delta). **GPT-5.6 on Global CRIS is priced at the standard rate — cost parity** — applicable only when the workload has no data-residency constraint; when the plan's `migration_path` is `runtime_openai_cris` with a `global.` id, report parity, not a premium. GPT-5.5/5.4 do have `us.`/`global.` CRIS ids on `bedrock-runtime`, but their model cards (read 2026-11-07) publish **commercial In-Region prices only** ("Commercial In-Region prices include a 10% fee over OpenAI rates") — the ~10% premium is verified for their In-Region (mantle) option alone; nothing establishes a Geo or Global CRIS price. For a `runtime_openai_cris` plan on GPT-5.5/5.4, `bedrock_pricing.lookup()` returns `available: false` for the CRIS id and that is correct: do not substitute the In-Region row as a verified rate. Either source the Geo/Global price separately (URL + read date) and add it to `STATIC_FALLBACK`, or take the §6.3 fallback (`Cost comparison unavailable`, `cost_savings_percent: 0`). If you still show an In-Region proxy, label it an **unverified planning assumption** and report no verified premium or savings percentage from it. Never report parity for them. **If a pair's workload exceeds 272K context**, price the Bedrock side at the long-context tier and show that line separately: GPT-5.6 is 2.0x input / 1.5x output per option; GPT-5.5 is 11.00 / 1.10 cache read / 49.50 and GPT-5.4 is 5.50 / 0.55 cache read / 24.75 per 1M tokens (In-Region, from their cards), applied to all tokens of the request, within a 1,050,000-token context window. If the source model is not in this table (likely for any model released after the table's last update — check the provider's public pricing page if you know current rates), note it as a gap in the Risk Assessment section, label the figure "(estimated from ``)", and estimate using the closest listed model's pricing. @@ -571,7 +571,7 @@ uv run --project python /iam_policy.py \ --output /.saws-migrate/iam-policy.json ``` -The script handles the dual-ARN pattern: foundation-model ARNs for plain model IDs and inference-profile ARNs for geo-prefixed IDs (e.g. `us.anthropic.claude-sonnet-4-6`). The output is a ready-to-use IAM policy JSON file. +The script handles the dual-ARN pattern: foundation-model ARNs for plain model IDs and inference-profile ARNs for geo-prefixed IDs (e.g. `us.anthropic.claude-sonnet-4-6`). For a GPT-6 CRIS id and for the GPT-5.5 / GPT-5.4 CRIS ids (`us.`/`global.openai.gpt-5.5`, `us.`/`global.openai.gpt-5.4`, or their `inference-profile/` ARNs) it adds a third resource, `arn:aws:bedrock:::project/default`, because those model cards (GPT-5.4 / GPT-5.5 read 2026-11-07) require `bedrock:InvokeModel` on the default project in addition to the inference profile; do not strip it from the report's policy excerpt. The output is a ready-to-use IAM policy JSON file. **Mantle targets get different actions.** When any target is a bare proprietary OpenAI GPT model (GPT-5.x or `openai.gpt-6-astra`), the script also emits `bedrock-mantle:CreateInference` / `Get*` / `List*` scoped to `arn:aws:bedrock-mantle:::project/*`, plus `bedrock-mantle:CallWithBearerToken` on `*` (AWS does not permit narrowing that one). `bedrock:InvokeModel` alone does **not** authorize these models. Two consequences to carry into the report: diff --git a/plugins/aws-startup-advisor/scripts/contracts/model-registry.schema.json b/plugins/aws-startup-advisor/scripts/contracts/model-registry.schema.json index 2bd225c3c..eb8874611 100644 --- a/plugins/aws-startup-advisor/scripts/contracts/model-registry.schema.json +++ b/plugins/aws-startup-advisor/scripts/contracts/model-registry.schema.json @@ -100,6 +100,7 @@ "evidence": { "type": "string" } } }, + "pricing": { "type": "object" }, "paths": { "type": "object", "minProperties": 1, diff --git a/plugins/aws-startup-advisor/scripts/contracts/model-selection-catalog.schema.json b/plugins/aws-startup-advisor/scripts/contracts/model-selection-catalog.schema.json index 1cfad791f..49b4b3a0e 100644 --- a/plugins/aws-startup-advisor/scripts/contracts/model-selection-catalog.schema.json +++ b/plugins/aws-startup-advisor/scripts/contracts/model-selection-catalog.schema.json @@ -152,6 +152,7 @@ "evidence": { "type": "string" } } }, + "pricing": { "type": "object" }, "paths": { "type": "object", "minProperties": 1, diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md b/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md index 0e52039c2..97c65ce2a 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md +++ b/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md @@ -94,17 +94,30 @@ reuse the Anthropic `preserve_messages_api` switch): OpenAI is handled by a dedicated provider module (`openai-bedrock.json` catalog). Recognized GPT-5.6 and GPT-6 source identities are evaluated against their exact same-model -catalog entry before capability/numeric fallbacks. GPT-5.x on Mantle is Responses-only, so a Chat -Completions source is reshaped rather than routed to `mantle_openai_chat`. GPT-6 Chat Completions -sources with required or preferred API continuity instead keep that surface through -`mantle_openai_chat`; GPT-6 Responses sources use `mantle_openai_responses`. Both Mantle paths are +catalog entry before capability/numeric fallbacks. The engine routes only recognized GPT-6 Chat +Completions sources to `mantle_openai_chat`; a GPT-5.x Chat Completions source is currently +reshaped to Responses. That reshape is a current engine limitation, not a model fact: the catalog +records Chat Completions as supported on Mantle for GPT-5.5 and GPT-5.4 (model cards read +2026-11-06) and as unchecked for GPT-5.6 Sol. GPT-6 Chat Completions sources with required or +preferred API continuity keep that surface through `mantle_openai_chat`; GPT-6 Responses sources +use `mantle_openai_responses`. Both Mantle paths are in-region only and enforce the selected model's cataloged `region_availability`: Astra reaches us-east-1 and us-west-2, while Sol, Luna, and 6.1 Sol reach us-east-1 only. Outside that footprint, the engine skips the same-model Mantle candidate and evaluates its existing capability/numeric -fallbacks. Governance requirements select the exact same GPT-5.6 or GPT-6 model through +fallbacks. Those fallbacks walk candidates in catalog order, and GPT-5.5 and GPT-5.4 (both +cataloged with Chat Completions on Mantle; GPT-5.5 reaches us-east-1/us-east-2, GPT-5.4 reaches +us-east-1/us-east-2/us-west-2 and us-gov-west-1) precede GPT-6 Astra in that order. A GPT-6 Sol or +6.1 Sol Chat Completions source outside us-east-1 therefore lands on GPT-5.5 in us-east-2 or GPT-5.4 +in us-west-2 through `mantle_openai_chat`, not on Astra. That is a current engine ordering +limitation (a newer-generation source falls back to an older-generation model); treat such a +recommendation as a prompt for the Chat-vs-Converse decision, not as a model endorsement. +Governance requirements select the exact same GPT-5.6 or GPT-6 model through `runtime_converse` only when the requested Global or geography-scoped CRIS profile is cataloged for that model and source region; an unsupported profile falls through to an eligible documented -runtime candidate or remains an explicit decision. GPT-5.5/5.4 remain mantle-only. GPT-6 Astra's +runtime candidate or remains an explicit decision. GPT-5.5/5.4 also carry a cataloged +`runtime_converse` path via `us.`/`global.` CRIS ids (model cards read 2026-11-06); the engine does +not yet recognize them as same-model source identities, so a GPT-5.5/5.4 source under governance +requirements still lands on the Claude Converse tier until that recognition is added. GPT-6 Astra's runtime surface lacks `Invoke` support (Responses/Chat Completions/Converse only), while Sol/Luna/6.1 Sol support all four APIs. Every selected path remains provisional until it is probed in the target account and region. Azure OpenAI remains an explicit `provider_module_pending` diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md index 5256f8977..a4ec1d447 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle only; no 1M tier) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle only; no 1M tier) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 11.00/49.50; card read 2026-11-07) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 5.50/24.75; card read 2026-11-07) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | @@ -353,17 +353,24 @@ Regions (mantle): us-east-1 / us-east-2 for all five; us-west-2 additionally car | GPT-5.5 | 5.50 | 33.00 | — | 0.55 | | GPT-5.4 | 2.75 | 16.50 | — | 0.275 | -#### Long context (1M) — GPT-5.6 only, 2.0x input / 1.5x output - -| Model | Input $/1M | Output $/1M | -| ------------- | ---------- | ----------- | -| GPT-5.6 Sol | 8.80 | 33.00 | -| GPT-5.6 Terra | 4.40 | 19.80 | -| GPT-5.6 Luna | 0.44 | 1.98 | - -A workload above 272K context must be priced at the long-context tier. GPT-5.5 and GPT-5.4 have no such tier, so -their usable window is 272K. Global CRIS is published at OpenAI's standard list price (cost parity, GPT-5.6 only — -see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. +#### Long context (>272K input tokens) — GPT-5.6 at 2.0x input / 1.5x output; GPT-5.5 / GPT-5.4 per their model cards + +| Model | Input $/1M | Output $/1M | Cache read $/1M | +| ------------- | ---------- | ----------- | --------------- | +| GPT-5.6 Sol | 8.80 | 33.00 | — | +| GPT-5.6 Terra | 4.40 | 19.80 | — | +| GPT-5.6 Luna | 0.44 | 1.98 | — | +| GPT-5.5 | 11.00 | 49.50 | 1.10 | +| GPT-5.4 | 5.50 | 24.75 | 0.55 | + +A workload above 272K input tokens must be priced at the long-context tier, applied to all input and output tokens +of the request. GPT-5.5 and GPT-5.4 rows read from their model cards on 2026-11-06 +([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), +[GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)); both cards state a +1,050,000-token context window (128,000 max output) and list `us.`/`global.` CRIS ids on `bedrock-runtime`, but +publish the In-Region inference option only. Global CRIS is published at OpenAI's standard list price (cost parity, +GPT-5.6 only — see `openai-on-bedrock.md`). GovCloud (US-West) GPT-5.4 short-context is 3.375 / 20.25 (cache read +0.3375) per the 2026-11-06 card; an earlier revision recorded 3.30 / 19.80. > **One source conflict.** These models are absent > from the AWS Price List API entirely: querying `AmazonBedrock` returns only `gpt-oss` and GPT OSS Safeguard, and @@ -373,7 +380,8 @@ see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. **Prompt caching (GPT-5.6 only):** cached input read at a 90% discount, cache write at 1.25x uncached input, minimum 1,024-token prefix, up to 4 breakpoints, ≥30-minute retention. Cached input is exempt from the input-TPM quota. -GPT-5.5 and GPT-5.4 do not list prompt caching support. +GPT-5.5 and GPT-5.4 list only implicit prompt caching on `bedrock-runtime` Responses (automatic, no request +parameters; cache-read rate above, no cache-write rate) and none on mantle (model cards read 2026-11-06). #### Open-weight gpt-oss diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json index 939f1bbeb..de3460daa 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json +++ b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json @@ -4,8 +4,8 @@ "generated_from": "bedrock-model-registry.json (rendered by tools/build-model-catalogs.py; edit the registry, not this file)", "verified_at": "2026-11-10", "verified_region": "us-east-2", - "source": "Haiku 5.5 Converse tier: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-haiku-5-5.html (read 2026-11-09). Opus 5.5 cross-family target: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-5-5.html (retrieved 2026-09-24). OpenAI and other unchanged entries retain their evidence from the superseded 2026-08-21 catalog (removed; see git history). Claude Sonnet 5.5 and OpenAI GPT-6.1 Terra: AWS model cards read 2026-11-10.", - "disclaimer": "Haiku 5.5 is the fast/low-cost Converse tier (the GPT-5.6 Luna cross-family fallback); Haiku 4.5 remains an explicit alternative, not an automatic fallback. The Opus cross-family target is updated to Opus 5.5; same-model OpenAI paths and their earlier evidence remain unchanged. This is a migration target catalog, not an account-availability claim. Verify the chosen model, API, region and CRIS profile before implementation. Opus 5.5 uses CRIS on runtime outside eu-west-2, has 1M context/128K output, always-on adaptive thinking, and no Batch tier. Fable and Mythos remain excluded from default selection. Opus 5.5 is the only Opus model in the automatic selection pool; older Opus snapshots and pricing records are historical references. The runtime in-region exception in eu-west-2 was verified 2026-10-03; the original catalog and other model evidence dates remain unchanged.", + "source": "Haiku 5.5 Converse tier: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-haiku-5-5.html (read 2026-11-09). Opus 5.5 cross-family target: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-5-5.html (retrieved 2026-09-24). GPT-5.5 and GPT-5.4 rows re-read from their public model cards on 2026-11-06 (https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html, https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html): both now list bedrock-runtime (Responses, Chat Completions, Converse via us./global. CRIS ids) and Chat Completions on bedrock-mantle. Other OpenAI and other unchanged entries retain their evidence from the superseded 2026-08-21 catalog (removed; see git history). Claude Sonnet 5.5 and OpenAI GPT-6.1 Terra: AWS model cards read 2026-11-10.", + "disclaimer": "Haiku 5.5 is the fast/low-cost Converse tier (the GPT-5.6 Luna cross-family fallback); Haiku 4.5 remains an explicit alternative, not an automatic fallback. The Opus cross-family target is updated to Opus 5.5; the GPT-5.5 and GPT-5.4 entries were re-read from their public model cards on 2026-11-06 (runtime CRIS paths, Chat Completions on mantle, 1.05M context, long-context pricing); the other same-model OpenAI paths and their earlier evidence remain unchanged. This is a migration target catalog, not an account-availability claim. Verify the chosen model, API, region and CRIS profile before implementation. Opus 5.5 uses CRIS on runtime outside eu-west-2, has 1M context/128K output, always-on adaptive thinking, and no Batch tier. Fable and Mythos remain excluded from default selection. Opus 5.5 is the only Opus model in the automatic selection pool; older Opus snapshots and pricing records are historical references. The runtime in-region exception in eu-west-2 was verified 2026-10-03; the original catalog and other model evidence dates remain unchanged.", "paths": { "mantle_openai_responses": { "sdk": "openai", @@ -20,8 +20,8 @@ "GPT-5.x on Bedrock Mantle is served through the Responses API" ], "constraints": [ - "Mantle itself has no cross-region form for any GPT model (in-region only); for GPT-5.6 the bedrock-runtime CRIS path covers additional regions instead (see runtime_converse)", - "GPT-5.x on Mantle rejects Chat Completions; a Chat Completions source must reshape to Responses (reference-verified on gpt-5.4; the 5.6 cards list Chat Completions as a supported API but its mantle-side availability is unprobed — verify in the target account)", + "Mantle itself has no cross-region form for any GPT model (in-region only); for GPT-5.6, GPT-5.5 and GPT-5.4 the bedrock-runtime CRIS path covers additional regions instead (see runtime_converse)", + "Chat Completions support on Mantle is model-specific: the GPT-5.4 and GPT-5.5 model cards list Chat Completions as supported on bedrock-mantle (read 2026-11-06); the GPT-5.6 Sol card does not. A Chat Completions source reshapes to Responses only when the selected model's card does not list Chat Completions — verify in the target account", "Availability must be probed in the target account and region" ] }, @@ -37,7 +37,7 @@ "OpenAI-compatible Chat Completions surface for models that accept it" ], "constraints": [ - "Not available for the GPT-5.x models listed here: rejected on gpt-5.4 (internal reference probe) and unsupported on the gpt-5.6-sol model card", + "Model-specific: listed as supported on bedrock-mantle by the GPT-5.4 and GPT-5.5 model cards (https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html, https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html, read 2026-11-06) and by the GPT-6 cards; unsupported on the gpt-5.6-sol model card. Uses /openai/v1/chat/completions", "Availability and model support must be probed in the target account and region" ] }, @@ -52,11 +52,12 @@ "strengths": [ "Bedrock-native multi-model request surface", "Supports Bedrock Guardrails (Converse API only), invocation logging, and CloudWatch", - "For GPT-5.6 this is a SAME-MODEL governance path via CRIS (us./in./global. ids; base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs); the model cards recommend runtime for new applications, and Global CRIS is priced at OpenAI's standard rate (cost parity)" + "This is a SAME-MODEL governance path via CRIS. GPT-5.6 Terra and Luna publish us./in./global. ids; us./global. only for GPT-5.6 Sol, GPT-5.5 and GPT-5.4 (their model cards list no in. profile; cards read 2026-11-07). The base URL for the OpenAI-compatible APIs is bedrock-runtime.{region}.amazonaws.com/openai/v1. The model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" ], "constraints": [ - "GPT-5.5 / GPT-5.4 have NO runtime path — a Converse target for them means a Bedrock-native model and a boto3 rewrite of the OpenAI integration", - "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. Runtime does not support server-side tool use, structured outputs, or application inference profiles for these models; prompt caching is Responses-only", + "GPT-5.5 / GPT-5.4 on runtime are CRIS-only (us. and global. ids; no in-region form) per their model cards (read 2026-11-06); the cards publish In-Region (1.10x) pricing only, so do not assume Global CRIS price parity for them", + "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. For GPT-5.6, runtime does not support server-side tool use, structured outputs, or application inference profiles; prompt caching is Responses-only", + "GPT-5.5 / GPT-5.4 on runtime (per their model cards, read 2026-11-07): server-side tool use is unsupported; structured outputs and implicit prompt caching are Responses-only; Guardrails and application inference profiles are Converse-only", "Bedrock-native models generally require a Global or geography-scoped CRIS inference profile", "Availability must be probed in the target account and region" ] @@ -114,19 +115,104 @@ "generation": "reasoning", "version": "5.5", "class": "reasoning", - "context_window": 272000, - "output_token_ceiling": "unknown", + "context_window": 1050000, + "output_token_ceiling": 128000, "capabilities": [ "reasoning", - "tool_or_function_calling" + "tool_or_function_calling", + "image_input_vision" ], - "capability_source": "AWS model card 2026-07-21 (launch 2026-06-01, Active): advanced coding/agentic tasks; tool calling via the Responses API's built-in tool use. Feature-level Mantle behavior not probed — verify before relying. Re-verified 2026-08-21: still mantle-only, in-region only; no CRIS, no runtime path, no long-context tier.", + "capability_source": "AWS model card https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html (read 2026-11-06; launch 2026-06-01, Active, EOL no sooner than 2027-06-01): text+image input, text output; 1,050,000-token context shared between input and output, 128,000 max output. Mantle lists server-side and client-side tool calling; runtime lists invocation logs, streaming, Guardrails (Converse only), application inference profiles (Converse only), implicit prompt caching (Responses only), structured outputs (Responses) and reasoning summaries; server-side tool use is unsupported on runtime. Documentation claims, not account probes — verify before relying.", + "inference_profiles": { + "us": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1" + ], + "global": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1", + "mx-central-1", + "eu-central-1", + "eu-central-2", + "eu-north-1", + "eu-south-1", + "eu-south-2", + "eu-west-1", + "eu-west-2", + "eu-west-3", + "ap-east-2", + "ap-northeast-1", + "ap-northeast-2", + "ap-northeast-3", + "ap-south-1", + "ap-south-2", + "ap-southeast-1", + "ap-southeast-2", + "ap-southeast-3", + "ap-southeast-4", + "ap-southeast-5", + "ap-southeast-6", + "ap-southeast-7", + "il-central-1", + "me-central-1", + "me-south-1", + "af-south-1", + "sa-east-1" + ] + }, + "region_availability": { + "commercial": [ + "us-east-1", + "us-east-2" + ], + "govcloud": [], + "evidence": "bedrock-mantle in-region rows of the GPT-5.5 model card, read 2026-11-06: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html" + }, + "pricing": { + "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html (read 2026-11-06); USD per 1M tokens, Standard tier; the card lists the In-Region inference option only", + "commercial_short_context_le_272k": { + "input": 5.5, + "cache_read": 0.55, + "output": 33.0 + }, + "commercial_long_context_gt_272k": { + "input": 11.0, + "cache_read": 1.1, + "output": 49.5 + }, + "service_tiers": { + "standard": true, + "priority": false, + "flex": false, + "reserved": false + } + }, "paths": { "mantle_openai_responses": { "available": true, "model_id": "openai.gpt-5.5", "requires_cris": false, - "evidence": "AWS model card model-card-openai-gpt-55 (2026-07-21): bedrock-mantle Programmatic Access with Responses sample code; Geo/Global inference not supported" + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): bedrock-mantle supports Responses at /openai/v1/responses; in-region us-east-1 and us-east-2 only; Geo/Global not supported on mantle" + }, + "mantle_openai_chat": { + "available": true, + "model_id": "openai.gpt-5.5", + "requires_cris": false, + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): Chat Completions listed as supported on bedrock-mantle at /openai/v1/chat/completions, with sample code" + }, + "runtime_converse": { + "available": true, + "model_id": "openai.gpt-5.5", + "requires_cris": true, + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): bedrock-runtime supported with Responses, Chat Completions and Converse (Messages and Invoke unsupported); no in-region form — requests must name us.openai.gpt-5.5 (Geo) or global.openai.gpt-5.5 (Global); base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs" } } }, @@ -219,27 +305,114 @@ "generation": "reasoning", "version": "5.4", "class": "reasoning", - "context_window": "unknown", - "output_token_ceiling": "unknown", + "context_window": 1050000, + "output_token_ceiling": 128000, "capabilities": [ "tool_or_function_calling", "structured_output_json", "reasoning", - "streaming" + "streaming", + "image_input_vision" ], - "capability_source": "internal reference smoke tests and its reasoning-API migration notebook (Responses path, 2026-06 probes) — the only entry with feature-level Mantle behavior probes (tools, structured output, sampling); limits not stated Re-verified 2026-08-21: still mantle-only, in-region only; no CRIS, no runtime path, no long-context tier.", + "capability_source": "AWS model card https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html (read 2026-11-06; launch 2026-06-01, Active, EOL no sooner than 2027-06-01): text+image input, text output; 1,050,000-token context shared between input and output, 128,000 max output. Mantle lists server-side and client-side tool calling; runtime lists invocation logs, response streaming, Guardrails (Converse only), application inference profiles (Converse only), implicit prompt caching (Responses only), structured outputs (JSON Schema; Responses API) and reasoning summaries; server-side tool use is unsupported on runtime. Documentation claims, not account probes — verify before relying.", + "inference_profiles": { + "us": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1" + ], + "global": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1", + "mx-central-1", + "eu-central-1", + "eu-central-2", + "eu-north-1", + "eu-south-1", + "eu-south-2", + "eu-west-1", + "eu-west-2", + "eu-west-3", + "ap-east-2", + "ap-northeast-1", + "ap-northeast-2", + "ap-northeast-3", + "ap-south-1", + "ap-south-2", + "ap-southeast-1", + "ap-southeast-2", + "ap-southeast-3", + "ap-southeast-4", + "ap-southeast-5", + "ap-southeast-6", + "ap-southeast-7", + "il-central-1", + "me-central-1", + "me-south-1", + "af-south-1", + "sa-east-1" + ] + }, + "region_availability": { + "commercial": [ + "us-east-1", + "us-east-2", + "us-west-2" + ], + "govcloud": [ + "us-gov-west-1" + ], + "evidence": "bedrock-mantle in-region rows of the GPT-5.4 model card, read 2026-11-06: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html" + }, + "pricing": { + "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html (read 2026-11-06); USD per 1M tokens, Standard tier; the card lists the In-Region inference option only", + "commercial_short_context_le_272k": { + "input": 2.75, + "cache_read": 0.275, + "output": 16.5 + }, + "commercial_long_context_gt_272k": { + "input": 5.5, + "cache_read": 0.55, + "output": 24.75 + }, + "govcloud_us_west_short_context_le_272k": { + "input": 3.375, + "cache_read": 0.3375, + "output": 20.25 + }, + "service_tiers": { + "standard": true, + "priority": false, + "flex": false, + "reserved": false + } + }, "paths": { "mantle_openai_responses": { "available": true, "model_id": "openai.gpt-5.4", "requires_cris": false, - "evidence": "internal reference smoke-test default Mantle model id; client.responses.create verified live" + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): bedrock-mantle supports Responses at /openai/v1/responses; in-region us-east-1, us-east-2, us-west-2 and us-gov-west-1; Geo/Global not supported on mantle" }, "mantle_openai_chat": { - "available": false, + "available": true, "model_id": "openai.gpt-5.4", "requires_cris": false, - "evidence": "internal reference verified gotcha: GPT-5.x on Mantle is Responses-only; Chat Completions rejected" + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): Chat Completions listed as supported on bedrock-mantle at /openai/v1/chat/completions, with sample code" + }, + "runtime_converse": { + "available": true, + "model_id": "openai.gpt-5.4", + "requires_cris": true, + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): bedrock-runtime supported with Responses, Chat Completions and Converse (Messages and Invoke unsupported); no in-region form — requests must name us.openai.gpt-5.4 (Geo) or global.openai.gpt-5.4 (Global); base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs" } } }, diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py index e5cc588f2..2ec4611b5 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py +++ b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py @@ -116,7 +116,10 @@ def _delta(code, category, description): # Converse tier map: a governance workload keeps its capability tier when moving -# from the (Mantle-only) GPT-5.x family to Claude on runtime Converse. +# from a GPT-5.x source the engine does not recognize as a same-model runtime +# identity (see _SOURCE_MODEL_KEYS) to Claude on runtime Converse. This is an +# engine recognition gap, not an endpoint fact: GPT-5.5 and GPT-5.4 do carry a +# cataloged runtime_converse path via us./global. CRIS ids. # GPT-5.6 Sol (frontier) -> Claude Opus 5.5 # GPT-5.6 Terra / 6.1 Terra / 5.5 / 5.4 -> Claude Sonnet 5.5 (also the default tier; Sonnet 5 # follows it as the forced tool_choice / Batch alternative) @@ -1390,8 +1393,9 @@ def _unresolved( ( "The selected Astra Responses path requires reshaping the Chat source." if model_key == "openai_gpt_6_astra" - else "GPT-5.x on Mantle rejects Chat Completions; the source must reshape " - "to the Responses API." + else "The selected Mantle Responses path requires reshaping the Chat source " + "to the Responses API (Chat Completions support is per-model: see the " + "selected model's mantle_openai_chat catalog entry)." ), "Apply the request/response/tool/state reshape deltas before cutover.", ) diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py index 93f51f074..d965e556b 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py +++ b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py @@ -79,18 +79,78 @@ def test_responses_source_with_continuity_recommends_mantle_responses(): assert rec["primary_model"] == "openai.gpt-5.6-sol" -def test_chat_completions_gpt5_target_selects_responses_not_chat(): +def test_chat_completions_unrecognized_gpt5_source_lands_on_sol_responses(): + # The default workload's source is `gpt-5.4`, which the engine does not yet + # recognize as a same-model identity (see _SOURCE_MODEL_KEYS), so it lands on + # the first catalog candidate — GPT-5.6 Sol — whose card leaves Chat + # Completions unchecked on Mantle. The reshape here follows from THAT model's + # card, not from a blanket "GPT-5.x on Mantle is Responses-only" rule: the + # GPT-5.4 card itself lists Chat Completions on Mantle (see the catalog test + # below). rec = _recommend( _workload( source={"api_surface": "chat_completions"}, requirements={"api_continuity": "required"}, ) ) + assert rec["primary_model"] == "openai.gpt-5.6-sol" + assert OPENAI_CATALOG["models"]["openai_gpt_5_6_sol"]["paths"]["mantle_openai_chat"]["available"] is False assert rec["api_path"] == "mantle_openai_responses" assert rec["api_path"] != "mantle_openai_chat" assert "chat_completions_to_responses_required" in _codes(rec["blocks"]) +@pytest.mark.parametrize( + ("catalog_key", "model_id", "card"), + [ + ("openai_gpt_5_4", "openai.gpt-5.4", "model-card-openai-gpt-54.html"), + ("openai_gpt_5_5", "openai.gpt-5.5", "model-card-openai-gpt-55.html"), + ], +) +def test_catalog_gpt54_gpt55_record_public_runtime_and_chat_facts(catalog_key, model_id, card): + # Public model cards (read 2026-11-06): both models list bedrock-runtime + # (Responses, Chat Completions, Converse via us./global. CRIS ids; no in-region + # form), Chat Completions on bedrock-mantle, a 1,050,000-token context window + # and 128,000 max output. Provenance must be the public card, never an + # internal reference. + model = OPENAI_CATALOG["models"][catalog_key] + paths = model["paths"] + assert paths["mantle_openai_responses"]["available"] is True + assert paths["mantle_openai_chat"]["available"] is True + assert paths["runtime_converse"]["available"] is True + assert paths["runtime_converse"]["requires_cris"] is True + assert paths["runtime_converse"]["model_id"] == model_id + assert f"us.{model_id}" in paths["runtime_converse"]["evidence"] + assert f"global.{model_id}" in paths["runtime_converse"]["evidence"] + assert set(model["inference_profiles"]) == {"us", "global"} + assert model["context_window"] == 1050000 + assert model["output_token_ceiling"] == 128000 + assert card in model["capability_source"] + for path in paths.values(): + assert "internal reference" not in path["evidence"] + assert "internal reference" not in model["capability_source"] + + +def test_runtime_converse_path_text_does_not_grant_in_profile_to_gpt54_gpt55(): + # The GPT-5.4 / GPT-5.5 cards publish only us. and global. CRIS ids; only + # GPT-5.6 has an in. profile. The shared runtime_converse path text must not + # attach the in. prefix to the 5.4/5.5 models, and its feature constraints + # must be stated per model (5.4/5.5 cards list structured outputs on Responses + # and application inference profiles on Converse, which the GPT-5.6 sentence + # denies). + path = OPENAI_CATALOG["paths"]["runtime_converse"] + strengths = "\n".join(path["strengths"]) + constraints = "\n".join(path["constraints"]) + assert "For GPT-5.6, GPT-5.5 and GPT-5.4" not in strengths + # in. exists for GPT-5.6 Terra/Luna only; Sol, 5.5 and 5.4 are us./global. + assert "GPT-5.6 Terra and Luna publish us./in./global. ids" in strengths + assert "us./global. only for GPT-5.6 Sol, GPT-5.5 and GPT-5.4" in strengths + assert "For GPT-5.6, runtime does not support server-side tool use" in constraints + assert "GPT-5.5 / GPT-5.4 on runtime" in constraints + assert "structured outputs and implicit prompt caching are Responses-only" in constraints + assert "Guardrails and application inference profiles are Converse-only" in constraints + + def test_chat_completions_case_includes_full_reshape_deltas(): rec = _recommend( _workload( @@ -283,6 +343,57 @@ def test_gpt6_mantle_skips_exact_model_outside_cataloged_region(): assert "exact same model" not in rec["rationale"][0] +# Deliberate consequence of recording the public GPT-5.5/GPT-5.4 facts (Chat +# Completions available on Mantle, cataloged region_availability): the Mantle Chat +# fallback walks candidates in catalog order, and GPT-5.5 / GPT-5.4 sit ahead of +# GPT-6 Astra in that order. A GPT-6 Sol / 6.1 Sol Chat source outside its own +# footprint therefore lands on GPT-5.5 (us-east-2) or GPT-5.4 (us-west-2) instead +# of Astra / a blocking decision. Pinned here so the shift is visible; reordering +# the candidate walk is engine work tracked for the follow-up PR. +@pytest.mark.parametrize("source_id", ["gpt-6-sol", "gpt-6.1-sol"]) +@pytest.mark.parametrize( + ("region", "fallback_id", "fallback_key"), + [ + ("us-east-2", "openai.gpt-5.5", "openai_gpt_5_5"), + ("us-west-2", "openai.gpt-5.4", "openai_gpt_5_4"), + ], +) +def test_gpt6_chat_outside_own_footprint_falls_back_to_in_region_gpt5_chat( + source_id, region, fallback_id, fallback_key +): + rec = _recommend( + _workload( + source={"model_ids": [source_id], "api_surface": "chat_completions"}, + requirements={"api_continuity": "required"}, + ), + region=region, + ) + assert rec["decision_status"] == "recommended" + assert rec["primary_model"] == fallback_id + assert rec["api_path"] == "mantle_openai_chat" + assert "mantle_region_unavailable" not in _codes(rec["blocks"]) + assert "chat_completions_to_responses_required" not in _codes(rec["blocks"]) + assert "fallback" in rec["rationale"][0] + assert region in OPENAI_CATALOG["models"][fallback_key]["region_availability"]["commercial"] + + +def test_gpt56_sol_responses_outside_us_east_skips_gpt55_for_in_region_terra(): + # GPT-5.5's cataloged footprint is us-east-1/us-east-2 only, so in us-west-2 + # the Responses fallback now skips it and lands on GPT-5.6 Terra (base + # catalog, with no GPT-5.5 region data, selected GPT-5.5 here). + rec = _recommend( + _workload( + source={"model_ids": ["gpt-5.6-sol"]}, + requirements={"api_continuity": "required"}, + ), + region="us-west-2", + ) + assert rec["decision_status"] == "recommended" + assert rec["primary_model"] == "openai.gpt-5.6-terra" + assert rec["api_path"] == "mantle_openai_responses" + assert "us-west-2" not in OPENAI_CATALOG["models"]["openai_gpt_5_5"]["region_availability"]["commercial"] + + def test_gpt6_chat_outside_every_mantle_footprint_returns_blocking_decision(): workload = _workload( source={"model_ids": ["gpt-6-sol"], "api_surface": "chat_completions"}, diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md index f0ff4ed72..c9adf0d5d 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md @@ -119,8 +119,8 @@ running). → `ai_constraints.cross_cloud`. Default `"latency-acceptable"`. | GPT-6 (Astra/Sol/Luna) / GPT-6.1 Sol | **Same model on Bedrock** | ~10% over OpenAI std (data-residency tier); Astra/6.1 Sol also support Ultrafast (6x) | | GPT-6.1 Terra | **Same model on Bedrock** | Use the model-specific endpoint and context-tier prices in `references/shared/openai-on-bedrock.md`; compare against measured source spend or verified source rates. | | GPT-5.6 (Sol/Terra/Luna) | **Same model on Bedrock** | ~10% over OpenAI std (data-residency tier) | -| GPT-5.5 | **Same model on Bedrock** | ~10% over std | -| GPT-5.4 | **Same model on Bedrock** | ~10% over std | +| GPT-5.5 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | +| GPT-5.4 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | | GPT-4o | GPT-5.6 Terra; or Claude Sonnet 5 | not on Bedrock — offer both | | GPT-4 / 4 Turbo | GPT-5.6 Terra; or Sonnet 5 | not on Bedrock — offer both | | GPT-4.1 / mini / nano | GPT-5.6 Terra/Luna; or Nova Lite/Micro | not on Bedrock — offer both | @@ -129,9 +129,10 @@ running). → `ai_constraints.cross_cloud`. Default `"latency-acceptable"`. | Claude (Anthropic SDK) | Same model on Bedrock | client swap only — no model change | | Other / multiple / don't know | ask / infer | — | -**Same-model rows first.** GPT-5.6/5.5/5.4 run on Bedrock via `bedrock-mantle` (Responses, -in-region only) — the case is AWS commitments/governance/residency, not savings, and not parity -(~10% above OpenAI standard). For sources with no Bedrock equivalent, present a same-vendor +**Same-model rows first.** GPT-5.6/5.5/5.4 run on Bedrock via `bedrock-mantle` (Responses or +Chat Completions, in-region only) or via `bedrock-runtime` CRIS ids (`us.`/`global.`) — the case +is AWS commitments/governance/residency, not savings, and not parity (~10% above OpenAI standard +in-region; GPT-5.6 Global CRIS is at the standard rate). For sources with no Bedrock equivalent, present a same-vendor upgrade AND a cross-family option. → `ai_model_baseline`. **After Batch 1:** interpret answers, write `preferences-draft.json` (`metadata.draft: true`, diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md index 1d05cd4a5..0314ff6ca 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md @@ -155,7 +155,9 @@ data-residency-tier premium, while supported Global CRIS uses standard-rate pari Report the actual option; do not downgrade solely for the modest verified premium. **GPT-5.6/GPT-6 only:** above 272K context, apply 2.0x input and 1.5x output rates only when the selected model and inference option support that tier; the resulting gap may change -the assessment. GPT-5.5/5.4 have no 1M tier. **Opus 5.5:** use the selected region/profile's +the assessment. GPT-5.5/5.4 have their own long-context (>272K) rates on their model cards +(read 2026-11-06; see `openai-on-bedrock.md` § Pricing) — use those, not the GPT-5.6 +multiplier. **Opus 5.5:** use the selected region/profile's flat rates from `references/vendored/ai/bedrock-pricing-cache.md` throughout the full 1M context; do not apply the GPT multiplier. Verify other models' tiers individually. @@ -216,15 +218,21 @@ key/token provider), model ID, and IAM (`bedrock-mantle:*`) change. Read `references/shared/openai-on-bedrock.md` for exact values. **A Chat Completions source is a supported near-drop-in for GPT-6 and GPT-5.6** (both list Chat Completions on mantle and runtime CRIS per their model cards) — keep `chat.completions.create` unless a Responses-only feature or -demonstrated constraint drives a reshape. **GPT-5.5 and GPT-5.4 are the exception**: Chat -Completions support is unconfirmed on their model cards, so a Chat Completions source on either -still needs a planned reshape to `responses.create`. **No Converse fallback for GPT-5.5/GPT-5.4 — GPT-5.6 and -GPT-6 differ.** GPT-5.5 and GPT-5.4 are mantle-only, in-region only: needing Guardrails/Knowledge -Bases/logging/an unsupported region forces a `converse` path with `model_change: true` to a -Bedrock-native model (or `gpt-oss`). GPT-5.6 Sol/Terra/Luna and all five GPT-6 models (Astra, Sol, -Luna, 6.1 Sol, 6.1 Terra) DO have a `bedrock-runtime` CRIS path (`us.`/`global.` prefixed IDs) — for these -models the same need is satisfied by switching endpoint, not model: record -`migration_path: "runtime_openai_cris"` with `model_change: false`. Note: `runtime_openai_cris` +demonstrated constraint drives a reshape. **GPT-5.5 and GPT-5.4 follow the same rule**: their +model cards (read 2026-11-06) list Chat Completions as supported on both `bedrock-mantle` and +`bedrock-runtime`, so a Chat Completions source on either may keep `chat.completions.create`; the +reshape to `responses.create` is optional for them too. Plan a reshape only when the selected +model's card leaves Chat Completions unchecked on the selected endpoint. **Every proprietary GPT +model on Bedrock has a `bedrock-runtime` CRIS path — including GPT-5.5 and GPT-5.4.** GPT-5.6 +Sol/Terra/Luna, all five GPT-6 models (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra), and GPT-5.5 / +GPT-5.4 (`us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / +`global.openai.gpt-5.4`; Responses, Chat Completions and Converse on runtime, no runtime +in-region form) have a `bedrock-runtime` CRIS path (`us.`/`global.` prefixed IDs) — for all of +them a Guardrails/logging/application-inference-profile/unsupported-region need is satisfied by +switching endpoint, not model: record `migration_path: "runtime_openai_cris"` with +`model_change: false`. Reserve `converse` with `model_change: true` to a Bedrock-native model (or +`gpt-oss`) for a need the same-model CRIS path cannot serve (Knowledge Bases, intelligent prompt +routing). Note: `runtime_openai_cris` for GPT-6 Astra is valid only via Responses/Chat Completions/Converse — Astra does not support `Invoke`, so verify per-feature against Astra's model card before assuming parity with Sol/Luna/6.1 Sol. **When Guardrails is the driving need and the design keeps @@ -233,7 +241,23 @@ Sol/Luna/6.1 Sol. **When Guardrails is the driving need and the design keeps surface — `converse` for Astra and 6.1 Terra; `converse` / `chat_completions` / `invoke` (never `responses`) for 6.1 Sol and the other GPT-6/5.6 CRIS models except Astra and 6.1 Terra. Do not leave the client on `responses` when Guardrails is required.** `Responses` stays the default for a region-only -CRIS move with no Guardrails need. +CRIS move with no Guardrails or application-inference-profile need. + +**Application inference profiles are Converse-only on GPT-5.5, GPT-5.4, GPT-6.1 Terra and Astra — +the requirement MUST reach `required_client_api`.** The GPT-5.4 / GPT-5.5 model cards (read 2026-11-07) +list "Application inference profiles (Converse API only; not supported with Responses or Chat +Completions APIs)" on `bedrock-runtime`. When application inference profiles (cost attribution by +app/environment) are the driving need and the design keeps `runtime_openai_cris`, record +`bedrock_models[].required_client_api: "converse"` for GPT-5.5 / GPT-5.4 and for any other model +whose card or catalog `runtime_converse` path entry lists the feature as Converse-only. Do not leave +the field absent or on `responses` / `chat_completions`: Generate defaults an absent field to +Responses and omits the application profile for an unsupported model/API pair, so the endpoint +switch alone does not deliver the feature. If the same workload also needs a Responses-only +feature on that model (GPT-5.5 / GPT-5.4: structured outputs, implicit prompt caching — see +`openai-on-bedrock.md` § Access Paths), one client API cannot serve both: record the conflict as an +explicit decision in the plan and the Present Summary — name which feature the plan keeps and +which is dropped, or split the workload into two `bedrock_models[]` rows with their own +`required_client_api` — never silently drop either requirement. **GPT-6.1 Terra API constraints:** Guardrails and application inference profiles require `required_client_api: "converse"`. Converse rejects document blocks and images in tool diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design.md index 382da53e4..60dda47b0 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design.md @@ -82,7 +82,7 @@ _postconditions: _on_failure: _halt_and_inform - _assert: "WHEN aws-design-ai.json exists: every design_blocks[] row has exactly one of target_bedrock_model / target_aws_service non-null (XOR), and every document_extraction/image_analysis/speech_transcription row has target_bedrock_model null, a non-null target_aws_service, and honest_assessment 'not_applicable' — per references/shared/schema-design-aws-ai.md" _on_failure: _halt_and_inform - - _assert: "WHEN aws-design-ai.json exists AND summary.ai_source is azure_openai or openai: every source model that is available on Bedrock and carried by the target region maps to itself with model_change false — not to a Claude/Nova substitute; and no proprietary GPT-5.5 or GPT-5.4 model ID is paired with a converse/bedrock-runtime migration path (bare proprietary openai.gpt-* IDs use Mantle only; runtime_openai_cris accepts documented Astra us./global. and GPT-5.6/GPT-6 profiles with caller-region checks and the selected API; GPT-5.6 and GPT-6 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation)" + - _assert: "WHEN aws-design-ai.json exists AND summary.ai_source is azure_openai or openai: every source model that is available on Bedrock and carried by the target region maps to itself with model_change false — not to a Claude/Nova substitute; and no bare proprietary openai.gpt-* model ID (including bare openai.gpt-5.5 or openai.gpt-5.4) is paired with a converse/bedrock-runtime migration path (bare proprietary openai.gpt-* IDs use Mantle only; runtime_openai_cris accepts documented Astra us./global., GPT-5.6/GPT-6 and GPT-5.5/GPT-5.4 us./global. profiles with caller-region checks and the selected API; GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation)" _on_failure: _halt_and_inform - _assert: "WHEN aws-design-ai.json exists: regional_warnings[] and multi_model_warnings[] are present (empty is fine); agentic_design is present only when agentic_profile.is_agentic is true; and App Runner appears nowhere" _on_failure: _halt_and_inform diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md index 646840dd2..b3f83648e 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md @@ -80,10 +80,14 @@ diffs outputs, so the user validates behavior before cutover. ## Step 3: `setup_bedrock.sh` Enables the chosen Bedrock model(s), sets up IAM, and (mantle path) the Bedrock API key. For a -`runtime_openai_cris` target whose CRIS id is a GPT-6 model (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra), the IAM +`runtime_openai_cris` target whose CRIS id is a GPT-6 model (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra) or +GPT-5.5 / GPT-5.4 (`us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / +`global.openai.gpt-5.4`, or their `inference-profile/` ARNs), the IAM policy must grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default` -in addition to the CRIS inference-profile ARN — both required per the GPT-6 model cards; the -mantle `bedrock-mantle:*` policy is unaffected. +in addition to the CRIS inference-profile ARN — both required per the GPT-6 model cards and the +GPT-5.5 / GPT-5.4 cards (read 2026-11-07); `iam_policy.py` emits the third ARN for exactly these +ids. The mantle `bedrock-mantle:*` policy (bare `openai.gpt-5.5` / `openai.gpt-5.4` ids included) +is unaffected. ## Step 3B: `gateway_config.{yaml,py,json}` (gateway users) @@ -155,9 +159,11 @@ is AWS-only and ports from gcp unchanged. - [ ] No secret VALUE in any emitted file; credentials are env-var references. - [ ] Bare proprietary GPT ids use Mantle; Astra runtime calls retain the validated `us.` / `global.` CRIS id. Chat/Responses and runtime artifact selection match the saved design. -- [ ] No **GPT-5.5 or GPT-5.4** model ID paired with a Converse/`bedrock-runtime` path (those two - models only — mantle-only, no CRIS). GPT-5.6 and GPT-6 models MAY use - `migration_path: "runtime_openai_cris"` on `bedrock-runtime` — this is NOT a violation. +- [ ] No **bare** proprietary GPT model ID (including bare `openai.gpt-5.5` / `openai.gpt-5.4`) + paired with a Converse/`bedrock-runtime` path. GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use + `migration_path: "runtime_openai_cris"` on `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` + for GPT-5.6 Terra and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4) — + this is NOT a violation. - [ ] Plugin attribution strings say "Azure-to-AWS". - [ ] `generation-ai.json` validates; `rollback_plan.mechanism == "feature_flag"`. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate.md index be0ac3018..94730ad32 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate.md @@ -73,7 +73,7 @@ _postconditions: _on_failure: _halt_and_inform - _assert: "no secret VALUE from the inventory appears in any generated artifact; secrets are emitted as Secrets Manager references" _on_failure: _halt_and_inform - - _assert: "WHEN aws-design-ai.json exists AND run_mode is decide_and_execute: generation-ai.json exists and validates, its rollback_plan.mechanism is 'feature_flag' with flag_name 'AI_PROVIDER' and default_value 'azure_openai'; an ai-migration/ directory was produced (setup_bedrock.sh, test_comparison.py, bedrock_monitoring.tf on every path; migrate_to_mantle.sh for the mantle path OR provider_adapter.* for the direct/gpt-oss path, not both); and no proprietary GPT-5.5 or GPT-5.4 model ID is paired with a converse/bedrock-runtime path (bare proprietary openai.gpt-* IDs use Mantle only; runtime_openai_cris accepts documented Astra us./global. and GPT-5.6/GPT-6 profiles with caller-region checks and the selected API; GPT-5.6 and GPT-6 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation). When aws-design-ai.json is absent this is vacuously satisfied" + - _assert: "WHEN aws-design-ai.json exists AND run_mode is decide_and_execute: generation-ai.json exists and validates, its rollback_plan.mechanism is 'feature_flag' with flag_name 'AI_PROVIDER' and default_value 'azure_openai'; an ai-migration/ directory was produced (setup_bedrock.sh, test_comparison.py, bedrock_monitoring.tf on every path; migrate_to_mantle.sh for the mantle path OR provider_adapter.* for the direct/gpt-oss path, not both); and no bare proprietary openai.gpt-* model ID (including bare openai.gpt-5.5 or openai.gpt-5.4) is paired with a converse/bedrock-runtime path (bare proprietary openai.gpt-* IDs use Mantle only; runtime_openai_cris accepts documented Astra us./global., GPT-5.6/GPT-6 and GPT-5.5/GPT-5.4 us./global. profiles with caller-region checks and the selected API; GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation). When aws-design-ai.json is absent this is vacuously satisfied" _on_failure: _halt_and_inform _forbids_files: - azure-resource-inventory.json diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md index 3b7b1e153..ffe3ec488 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md @@ -2,6 +2,7 @@ **Last verified:** 2026-10-10 **GPT-6.1 Terra verified:** 2026-10-27 +**GPT-5.5 / GPT-5.4 re-verified:** 2026-11-06 against their model cards ([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) — both now list `bedrock-runtime` (Responses, Chat Completions, Converse via `us.`/`global.` CRIS ids), Chat Completions on mantle, a 1.05M context window and a long-context price tier **Sources:** [OpenAI model cards](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards-openai.html) (per-model cards linked below), [GPT-5.6 launch post](https://aws.amazon.com/blogs/machine-learning/get-started-with-openai-gpt-5-6-sol-terra-and-luna-on-amazon-bedrock/), [GPT-5.6 GA announcement](https://aws.amazon.com/about-aws/whats-new/2026/07/openai-gpt-sol-terra/), @@ -32,8 +33,8 @@ risk) all defer to it. Do not restate model IDs, regions, or endpoint paths else | GPT-5.6 Sol | `openai.gpt-5.6-sol` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-sol.html) | | GPT-5.6 Terra | `openai.gpt-5.6-terra` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-terra.html) | | GPT-5.6 Luna | `openai.gpt-5.6-luna` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-luna.html) | -| GPT-5.5 | `openai.gpt-5.5` | Jun 1, 2026 | 272K | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html) | -| GPT-5.4 | `openai.gpt-5.4` | Jun 1, 2026 | 272K | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html) | +| GPT-5.5 | `openai.gpt-5.5` | Jun 1, 2026 | 1.05M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html) | +| GPT-5.4 | `openai.gpt-5.4` | Jun 1, 2026 | 1.05M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html) | | gpt-oss-120b | `openai.gpt-oss-120b` | Aug 5, 2025 | 128K | Active | open-weight; also on `bedrock-runtime` as `openai.gpt-oss-120b-1:0` | | gpt-oss-20b | `openai.gpt-oss-20b` | Aug 5, 2025 | 128K | Active | open-weight; also on `bedrock-runtime` as `openai.gpt-oss-20b-1:0` | | GPT OSS Safeguard | `openai.gpt-oss-safeguard-120b` / `-20b` | — | — | Active | content-moderation / guardrail enforcement, not general chat | @@ -47,8 +48,10 @@ share a generation with a future `Sol`. **GPT-6** carries forward `Sol` and `Lun discount) — not a new tier name (cite [openai.com/index/introducing-gpt-6-1-sol/](https://openai.com/index/introducing-gpt-6-1-sol/)). > **Context-window conflict (resolved):** the GPT-5.6 launch blog states 272K for all three variants; all three -> model cards state 1M. **The model cards are authoritative** — use 1M for GPT-5.6. GPT-5.5 and GPT-5.4 are 272K on -> both sources. Re-check on refresh; if AWS corrects the blog, the cards still win. +> model cards state 1M. **The model cards are authoritative** — use 1M for GPT-5.6. The GPT-5.5 and GPT-5.4 cards +> (read 2026-11-06) state 1,050,000 tokens shared between input and output with 128,000 max output; the 272K figure +> recorded earlier is now only their short-/long-context pricing breakpoint. Re-check on refresh; if AWS corrects +> the blog, the cards still win. **Not on Bedrock (as of this refresh):** GPT-4o, GPT-4.1, GPT-4 / GPT-4 Turbo, GPT-3.5 Turbo, the o-series (o1/o3/o4-mini), GPT-5 / GPT-5.1 / GPT-5.2, and the `*-Pro` variants (GPT-5.5 Pro, GPT-5.4 Pro). Sources whose model @@ -112,8 +115,12 @@ input and text output. The launch announcement rounds the input context to 1M; u exact limits for capacity checks. Browser/computer-use capability does not establish parity with OpenAI-hosted tools; probe the application's specific tool flow. -**GPT-5.5 and GPT-5.4 are `bedrock-mantle`-only and in-region only.** Their model cards list a single -Programmatic Access row (`bedrock-mantle`, Geo/Global "Not supported") and In-Region pricing only. +**GPT-5.5 and GPT-5.4 have TWO endpoints** (re-verified 2026-11-06 against their model cards; earlier revisions of +this file recorded them as `bedrock-mantle`-only). Both Programmatic Access tables now carry a `bedrock-runtime` +row (In-Region "Not supported"; Geo `us.openai.gpt-5.5` / `us.openai.gpt-5.4`; Global `global.openai.gpt-5.5` / +`global.openai.gpt-5.4`) and a `bedrock-mantle` row (bare id, in-region only). Supported APIs: `Responses`, +`Chat Completions` and `Converse` on `bedrock-runtime`; `Responses` and `Chat Completions` on `bedrock-mantle`; +`Messages` and `Invoke` on neither. The pricing tables still publish the In-Region inference option only. **GPT-5.6 Sol / Terra / Luna have TWO endpoints** (verified 2026-08-21 — this changed after this file's original 2026-08-10 verification; the Refresh Checklist predicted it): @@ -132,13 +139,16 @@ Constraints that still break naive assumptions: mantle path explicitly, and the runtime example gives `bedrock-runtime.{region}.amazonaws.com/openai/v1`. 2. **The endpoints take different model-id forms.** Mantle takes the bare `openai.gpt-5.6-*` id and has no CRIS; `bedrock-runtime` takes ONLY a CRIS inference-profile id (`us.` / `in.` / `global.` prefixed) and has no - in-region form. `bedrock:ListInferenceProfiles` returns the 5.6 CRIS profiles; it never returns the bare mantle - ids, and it returns nothing for GPT-5.5 / GPT-5.4. + in-region form. `bedrock:ListInferenceProfiles` returns the CRIS profiles (5.6, and `us.`/`global.` for + GPT-5.5 / GPT-5.4 per their cards); it never returns the bare mantle ids. 3. **API surfaces differ by endpoint.** The 5.6 cards list `Responses`, `Chat Completions`, `Invoke`, and `Converse` as supported APIs, with runtime-side feature splits: **Guardrails are Converse-only; prompt caching is Responses-only on runtime**; server-side tool use, structured outputs, and application inference profiles are NOT - supported on runtime (server-side tool calling IS supported on mantle). For GPT-5.5 / GPT-5.4 treat Responses on - mantle as the only verified surface. + supported on runtime (server-side tool calling IS supported on mantle). The GPT-5.5 / GPT-5.4 cards (read + 2026-11-06) list `Responses`, `Chat Completions` and `Converse` on runtime (no `Invoke`) and `Responses` and + `Chat Completions` on mantle; on runtime they list Guardrails and application inference profiles as + Converse-only, and implicit prompt caching and structured outputs as Responses-only. Chat Completions is a + documented surface for GPT-5.5 / GPT-5.4 on both endpoints — probe it in the target account like any other. ### GPT-6 family: Ultrafast tier @@ -189,8 +199,10 @@ that expires within 12 hours and is not refreshed. Do not recommend it for produ **IAM:** on the mantle path, the managed policy `AmazonBedrockMantleInferenceAccess` grants what inference needs, including `bedrock-mantle:CreateInference` and `bedrock-mantle:CallWithBearerToken` — `bedrock:InvokeModel` does not -authorize mantle calls. On the GPT-5.6 `bedrock-runtime` path the usual `bedrock:InvokeModel*` against the CRIS -inference-profile ARN applies, as for any other runtime model. +authorize mantle calls. On the GPT-5.6 / GPT-5.5 / GPT-5.4 `bedrock-runtime` path the usual `bedrock:InvokeModel*` +against the CRIS inference-profile ARN applies, as for any other runtime model; the GPT-5.5 / GPT-5.4 cards add +that the identity also needs `bedrock:InvokeModel` on the account's default project +(`arn:aws:bedrock:{region}:{account-id}:project/default`). **Reasoning effort:** the five GPT-5.x models accept `none`, `low`, `medium`, `high`, `xhigh`, `max`. Because these models reason before responding, the model's output items (which may include reasoning items) must be passed back in the next @@ -200,7 +212,8 @@ request for multi-turn and tool-calling flows. ## Regional Availability — Endpoint-Aware -**The mantle in-region matrix** (the only reach for GPT-5.5 / GPT-5.4, and the in-region option for GPT-5.6): +**The mantle in-region matrix** (the in-region option for every proprietary GPT model; GPT-5.5 / GPT-5.4 rows +re-verified 2026-11-06): | Model | us-east-1 | us-east-2 | us-west-2 | us-gov-west-1 | us-gov-east-1 | | ------------- | --------- | --------- | --------- | ------------- | ------------- | @@ -230,8 +243,16 @@ any GPT-6 model, it just means using the runtime endpoint with a CRIS id. **GPT-5.6 additionally reaches most commercial regions via `bedrock-runtime` CRIS** (Geo `us.` / `in.`, Global `global.` inference profiles; the Sol card's runtime footprint spans 30+ regions). So a region outside the mantle matrix does NOT make the same-model path unavailable for GPT-5.6 — it means using the runtime endpoint with a CRIS -id, with the data-residency implications of cross-region routing. For GPT-5.5 / GPT-5.4 the mantle matrix is a hard -gate: no CRIS, no fallback. +id, with the data-residency implications of cross-region routing. + +**GPT-5.5 / GPT-5.4 runtime availability** (model cards read 2026-11-06): US Geo CRIS (`us.openai.gpt-5.5` / +`us.openai.gpt-5.4`) can be called from `us-east-1`, `us-east-2`, `us-west-1`, `us-west-2`, `ca-central-1` and +`ca-west-1`. Global CRIS (`global.openai.gpt-5.5` / `global.openai.gpt-5.4`) is listed in those six plus +`mx-central-1`, every EU region (`eu-central-1/2`, `eu-north-1`, `eu-south-1/2`, `eu-west-1/2/3`), `ap-east-2`, +`ap-northeast-1/2/3`, `ap-south-1/2`, `ap-southeast-1` through `-7`, `il-central-1`, `me-central-1`, `me-south-1`, +`af-south-1` and `sa-east-1` (33 regions). No runtime in-region form, no EU/India Geo profile, and no GovCloud +runtime row. So the mantle matrix is no longer a hard gate for GPT-5.5 / GPT-5.4; only a strictly in-region +requirement outside the mantle matrix blocks the same-model path. Verify current footprints per model card / `aws___get_regional_availability` (AWS MCP Server) — the CRIS lists move faster than this file. @@ -242,13 +263,19 @@ for these models). Sol rates reflect the Aug 21, 2026 reduction (−20% input / the AWS What's New announcement lists as promotional through at least Nov 21, 2026. **Pricing now has an inference-option dimension:** -- **GPT-5.x In-Region and Geo CRIS: 1.10x OpenAI's standard list price** (parity with OpenAI's _data residency_ tier). +- **GPT-5.6 In-Region and Geo CRIS: 1.10x OpenAI's standard list price** (parity with OpenAI's _data residency_ tier). - **Global CRIS: OpenAI's standard list price** — cost parity for the recorded GPT-5.6 rates, and only when the workload has no data-residency constraint. So the honest cost statement is conditional, not flat: a same-model GPT-5.6 move on Global CRIS is -**cost-neutral**; the same move in-region or Geo (and any GPT-5.5 / GPT-5.4 move) is **~10% more expensive**. The -same Global-CRIS-is-cost-neutral / in-Region-and-Geo-is-~10%-more pattern applies to the GPT-6 family below. +**cost-neutral**; the same move in-region or Geo is **~10% more expensive**. The GPT-5.5 / GPT-5.4 cards publish +**commercial In-Region pricing only** (no Geo/Global rows as of 2026-11-07; the cards say "Commercial In-Region +prices include a 10% fee over OpenAI rates"), so for them the ~10% premium is verified for the In-Region (mantle) +option alone — nothing establishes a Geo (`us.`) or Global CRIS price. For a GPT-5.5 / GPT-5.4 CRIS plan, source the +Geo/Global rate separately (the card's inference-option table or the Bedrock pricing page, with URL and read date) +or report the comparison unavailable; an In-Region rate used as a proxy is an **unverified planning assumption**, +labelled as such, and must not be turned into a verified premium or savings percentage. Never report parity for +them. The same Global-CRIS-is-cost-neutral / in-Region-and-Geo-is-~10%-more pattern applies to the GPT-6 family below. Never state either number without stating the inference option it belongs to. ### GPT-6 Astra / Sol / Luna / 6.1 Sol — short context (≤272K) @@ -302,12 +329,17 @@ provider rate before claiming savings or parity for the selected context tier. A workload above 272K context must be priced at the long-context tier. -### GPT-5.5 / GPT-5.4 — In-Region only (no CRIS, no long-context tier; usable window 272K) +### GPT-5.5 / GPT-5.4 — In-Region pricing only; short- and long-context tiers (model cards read 2026-11-06) + +The cards publish only the commercial In-Region inference option (the `us.` / `global.` runtime CRIS ids exist but +carry no separate price row). A `runtime_openai_cris` plan priced from this table is an unverified planning +assumption, not a verified rate — `bedrock_pricing.lookup()` returns `available: false` for these CRIS ids on +purpose. Long-context rates apply to all input and output tokens of a request above 272K input tokens. -| Model | In-Region (in · out) | Cache read | Notes | -| ------- | -------------------- | ---------- | -------------------------------- | -| GPT-5.5 | 5.50 · 33.00 | 0.55 | no cache-write rate published | -| GPT-5.4 | 2.75 · 16.50 | 0.275 | GovCloud (US-West): 3.30 · 19.80 | +| Model | Short context ≤272K (in · cache read · out) | Long context >272K (in · cache read · out) | Notes | +| ------- | ------------------------------------------- | ------------------------------------------ | ---------------------------------------- | +| GPT-5.5 | 5.50 · 0.55 · 33.00 | 11.00 · 1.10 · 49.50 | no cache-write rate published | +| GPT-5.4 | 2.75 · 0.275 · 16.50 | 5.50 · 0.55 · 24.75 | GovCloud (US-West) short: 3.375 · 0.3375 · 20.25 | > **The Luna "blog discrepancy" resolved differently than first recorded.** The AWS News Blog's 0.20 / 1.20 is not > an error — it is the **Global CRIS** rate, now published on the Luna card. An earlier revision of this file said @@ -323,8 +355,10 @@ Astra has separate Responses-only caching evidence above. Do not inherit GPT-5.6 Listed as a supported feature on the GPT-5.6 Sol/Terra/Luna model cards and on all five GPT-6 model cards (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra — confirmed by the cache-write/cache-read columns in the GPT-6 pricing tables above). The -GPT-5.5 and GPT-5.4 cards list client-side tool calling in that slot instead and do **not** list prompt caching. -Do not assume caching on 5.5/5.4. +GPT-5.5 and GPT-5.4 cards (read 2026-11-06) list **implicit prompt caching on `bedrock-runtime` Responses only** +(automatic, no request parameters) with a cache-read rate and no cache-write rate; explicit caching is unsupported +and the mantle feature list carries client-side tool calling in that slot instead. Do not assume caching on +5.5/5.4 mantle, and do not inherit the GPT-5.6 prefix/breakpoint rules below for them. | Property | Value | | ----------------- | ------------------------------------------------------------ | @@ -352,10 +386,10 @@ This corrects two claims that were previously applied to all Mantle traffic in t - There is **no shared 10,000 RPM account limit** governing these models — the quota dimension is TPM, per model, per region. -- "Switch to `bedrock-runtime`" is **not a throughput remedy for GPT-5.5 / GPT-5.4** — they have no - `bedrock-runtime` path at all. For GPT-5.6 the runtime path DOES exist (CRIS only; see Access Paths above), so - moving there is a legitimate option — but treat it as an endpoint/architecture choice with its own quota family - and residency implications, not a free throughput escape hatch. +- "Switch to `bedrock-runtime`" is **not a free throughput escape hatch**. For GPT-5.6, GPT-5.5 and GPT-5.4 the + runtime path exists (CRIS only; see Access Paths above — GPT-5.5 / GPT-5.4 re-verified 2026-11-06), so moving + there is a legitimate option — but treat it as an endpoint/architecture choice with its own quota family and + residency implications. The supported mitigations are: exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK), spreading load across minutes rather than bursting, ramping request rate gradually, and prompt caching (cached input @@ -396,8 +430,8 @@ This model family is moving fast (two GA waves and a repricing inside 10 weeks). 1. Re-read the [OpenAI model card index](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards-openai.html) for models added or removed, and each per-model card for lifecycle state and EOL date. -2. Recheck the region matrix AND the GPT-5.6 CRIS footprints — for 5.5/5.4 a region change is migration-blocking; - for 5.6 the runtime/CRIS path usually covers the region instead. +2. Recheck the region matrix AND the CRIS footprints for every proprietary GPT model — the runtime/CRIS path + usually covers a region outside the mantle matrix; only a strictly in-region requirement there is blocking. 3. Recheck rates on the Bedrock pricing page OpenAI tab, and resolve any row still marked _unverified_. 4. Recheck whether the Price List API has gained GPT-5.x coverage; if it has, drop the caveat above and let `estimate-ai.md` price these models from the MCP. @@ -412,3 +446,9 @@ This model family is moving fast (two GA waves and a repricing inside 10 weeks). 2026), and GPT-6.1 Sol (GA Sep 29, 2026) are all confirmed on Bedrock with their own model cards and pricing tables. New discovery this refresh: a 6x-Standard **Ultrafast** service tier on Astra and 6.1 Sol only (Sol and Luna remain Standard-only) — the first new tier shape since this file started tracking the family. +9. **2026-11-06 refresh — GPT-5.5 / GPT-5.4 re-read.** Item 5 fired again: both cards now list `bedrock-runtime` + (Responses, Chat Completions, Converse via `us.` / `global.` CRIS ids; no in-region runtime form), Chat + Completions on `bedrock-mantle`, a 1,050,000-token context window with 128,000 max output, a long-context + (>272K) price tier, implicit prompt caching on runtime Responses, and a GovCloud (US-West) GPT-5.4 rate of + 3.375 · 20.25. Earlier "mantle-only / no CRIS / 272K / no long-context tier" claims for these two models were + stale and are corrected throughout this file. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md index 811b7c92e..a78a20e33 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md @@ -123,17 +123,20 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` ## migration_path vocabulary -`mantle_openai_chat` preserves a selected GPT-6 Chat Completions API on Mantle. +`mantle_openai_chat` preserves a selected Chat Completions API on Mantle for a model whose card +lists it there (GPT-6, GPT-5.5, GPT-5.4). `mantle_openai_responses` (Azure OpenAI / OpenAI source, model on Bedrock, region carries it — -keep the SDK, `model_change: false`) · `runtime_openai_cris` (GPT-5.6/GPT-6 same-model move -served via `bedrock-runtime` CRIS, `us.`/`global.` prefixed, `model_change: false`) · `converse` -(Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when **GPT-5.5 or GPT-5.4 -specifically** must move off mantle for Guardrails / Knowledge Bases / logging / an unsupported -region, or when the GPT-6/5.6 CRIS path itself cannot serve the need) · `gpt-oss` (OpenAI-lineage -model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK swap). **GPT-5.5 -and GPT-5.4** are NEVER paired with a `converse`/`bedrock-runtime` path — those two models only -are mantle-only, no CRIS. GPT-5.6 and GPT-6 models MAY use `runtime_openai_cris` on -`bedrock-runtime` — this is not a violation. Note: `runtime_openai_cris` for GPT-6 Astra is valid +keep the SDK, `model_change: false`) · `runtime_openai_cris` (GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 +same-model move served via `bedrock-runtime` CRIS — `us.`/`in.`/`global.` prefixed for GPT-5.6 +Terra / Luna, `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4 — `model_change: false`) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set +`model_change: true` when the workload needs Knowledge Bases, intelligent prompt routing, or +another feature the same-model CRIS path itself cannot serve) · `gpt-oss` (OpenAI-lineage model +on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK swap). A **bare** +proprietary `openai.gpt-*` id (including bare `openai.gpt-5.5` / `openai.gpt-5.4`) is NEVER paired +with a `converse`/`bedrock-runtime` path — bare ids are mantle ids. GPT-5.6, GPT-6, **GPT-5.5 and +GPT-5.4** MAY use `runtime_openai_cris` on `bedrock-runtime` with a CRIS-prefixed id — this is +not a violation (GPT-5.5 / GPT-5.4 runtime support: model cards read 2026-11-06, `us.`/`global.` +ids only, no runtime in-region form). Note: `runtime_openai_cris` for GPT-6 Astra is valid only via Responses/Chat Completions/Converse — Astra does not support `Invoke`, so a design that needs Guardrails or Application Inference Profiles (Converse-only features that also require Invoke-adjacent plumbing on some other models) must verify against Astra's model card @@ -147,7 +150,12 @@ move (no Guardrails or other client-surface need). A Guardrails-requiring worklo `runtime_openai_cris` sets it to the surface that is actually Guardrails-capable for that model: `converse` for GPT-6 Astra and GPT-6.1 Terra, or `converse`/`chat_completions`/`invoke` — never `responses` — for GPT-6.1 Sol and the other -GPT-6/5.6 CRIS models except Astra and GPT-6.1 Terra. Terra also requires `converse` for application inference profiles. `generate-artifacts-ai.md`'s CRIS Step 1M reads this field and +GPT-6/5.6 CRIS models except Astra and GPT-6.1 Terra. Application inference profiles also require +`converse` on every model whose card lists them as Converse-only — GPT-6.1 Terra, Astra, and GPT-5.5 / +GPT-5.4 (cards read 2026-11-07: "Converse API only; not supported with Responses or Chat Completions +APIs") — so a workload needing them on `runtime_openai_cris` sets `converse`, never leaves the field +absent; a same-workload Responses-only need (GPT-5.5 / GPT-5.4 structured outputs, implicit caching) +is an explicit design decision, not a silent drop. `generate-artifacts-ai.md`'s CRIS Step 1M reads this field and emits that surface instead of defaulting to `responses.create`. Keep the existing Astra-no-Invoke migration_path note above — `required_client_api` never sets `invoke` for Astra. @@ -201,9 +209,17 @@ rubric file (`ai.md`, `ai-azure-openai-to-bedrock.md`, or a `vendored/ai/*` ref) `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. - [ ] Bare proprietary GPT ids use Mantle; runtime Astra uses a supported `us.` / `global.` CRIS id and its caller-region gate. The recorded API and `model_change` match the design. -- [ ] No `bedrock_models[]` entry pairs **GPT-5.5 or GPT-5.4** with a `converse`/`bedrock-runtime` - migration path (those two models only — mantle-only, no CRIS). GPT-5.6 and GPT-6 models MAY - use `migration_path: "runtime_openai_cris"` on `bedrock-runtime` — this is NOT a violation. +- [ ] No `bedrock_models[]` entry pairs a **bare** proprietary GPT id (including bare + `openai.gpt-5.5` / `openai.gpt-5.4`) with a `converse`/`bedrock-runtime` migration path. + GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on + `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` for GPT-5.6 Terra / Luna, `us.`/`global.` + only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4) — this is NOT a violation. +- [ ] Every `runtime_openai_cris` entry whose driving need includes application inference profiles, + on a model whose card lists them as Converse-only (GPT-5.5, GPT-5.4, GPT-6.1 Terra, Astra), + records `required_client_api: "converse"` — not absent, `responses` or `chat_completions`. + A same-workload Responses-only need (GPT-5.5 / GPT-5.4 structured outputs or implicit + caching) is recorded as an explicit decision, not silently dropped. A region-only CRIS + move keeps the `responses` default. - [ ] If `ai_source` is `azure_openai` or `openai`: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md index a819dc895..d457a12a9 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md @@ -48,9 +48,9 @@ Inference on `bedrock-mantle` for these models is governed by **two per-model, p | Medium | Medium | Monitor 429s against **token** throughput, not request rate; enable prompt caching | | High | High | Enable prompt caching first (cached input is exempt from input TPM), then request a quota increase | -**The `bedrock-runtime` fallback exists only for GPT-5.6 and GPT-6 (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra).** GPT-5.5 and GPT-5.4 are `bedrock-mantle` only and in-region only — for them, "switch to `bedrock-runtime`" requires moving to a different model (Bedrock-native or `gpt-oss`), a model change with its own eval cost. GPT-5.6 Sol/Terra/Luna and GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra DO have a `bedrock-runtime` path via CRIS inference profiles (GPT-5.6 `us.`/`in.`/`global.`, GPT-6 `us.`/`global.` prefixed ids; the model cards recommend runtime for new applications) — a legitimate endpoint option with its own quota family, and on Global CRIS it is also the cost-parity option. Scaling levers on the mantle path, in order: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Terra and Luna (`us.`/`in.`/`global.`), and `us.`/`global.` only for GPT-5.6 Sol, GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra, and GPT-5.5 / GPT-5.4 (the GPT-5.6 Sol card lists no `in.` profile; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: -1. Prompt caching (GPT-5.6 and GPT-6 only) — 90% off cached input and exempt from the input-TPM quota +1. Prompt caching (GPT-5.6 and GPT-6 on mantle; GPT-5.5 / GPT-5.4 list implicit caching on `bedrock-runtime` Responses only) — 90% off cached input and exempt from the input-TPM quota 2. Exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK) 3. Spreading load across minutes and ramping request rate gradually rather than bursting 4. A Service Quotas increase for that model's input/output TPM in that region @@ -108,8 +108,8 @@ Claude models on Mantle have an additional **output TPM cap** that differs by mo - For Claude migrations at medium/high volume: the 2M output TPM cap on Claude 4.7+ is the binding constraint - For OpenAI proprietary GPT targets: this Claude cap does not apply. Use the GPT-5.x mantle quotas or - Astra-specific verification above. Astra / GPT-5.6 have runtime CRIS alternatives with their own - quotas; GPT-5.5/5.4 have no runtime path + Astra-specific verification above. Astra / GPT-5.6 / GPT-5.5 / GPT-5.4 all have runtime CRIS alternatives + with their own quotas (`us.`/`global.` prefixed ids; no runtime in-region form) - For `gpt-oss` targets: these do run on `bedrock-runtime`, so standard account TPM limits and the Converse-path mitigations apply - When output-heavy workloads (long JSON, tool outputs, multi-step reasoning) are detected, flag the relevant cap prominently; recommend `bedrock-runtime` for production **only** when the target model actually has a `bedrock-runtime` path diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md index 36ff7072d..b1a32c0d4 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md @@ -39,11 +39,18 @@ Two consequences that invert the previous decision logic: 1. **When the source model is on Bedrock, keep it.** A same-model move has no behavior delta to validate, no prompt re-engineering, and no eval regression risk — the migration is an endpoint and credential change, not a model change. This is the default recommendation. -2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.x In-Region and Geo +2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.6 In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when - the workload has no data-residency constraint (GPT-5.5 / GPT-5.4 have no CRIS at all). See - `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, + the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on + `bedrock-runtime`, but their model cards (read 2026-11-07) publish **commercial In-Region prices only** + ("Commercial In-Region prices include a 10% fee over OpenAI rates") — nothing on either card establishes a + Geo or Global CRIS price. So the verified ~10% premium for GPT-5.5 / GPT-5.4 is scoped to the commercial + In-Region (mantle) option. For a GPT-5.5 / GPT-5.4 CRIS plan, either source the Geo/Global rate separately + (the card's inference-option table or [aws.amazon.com/bedrock/pricing](https://aws.amazon.com/bedrock/pricing/), + with URL and read date) or report the comparison unavailable; an In-Region rate used as a proxy is an + **unverified planning assumption**, labelled as such, and yields no verified premium or savings percentage. + Never report parity for them. See `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, prompt caching, one vendor relationship — carries the in-region path; never present that path as free or neutral. For Astra, use its separately dated Bedrock rates and verify the source provider's rate before comparing. @@ -72,14 +79,15 @@ GPT-5.4, the target is **the same model on Bedrock**. | GPT-5.6 Sol | GPT-5.6 Sol | `openai.gpt-5.6-sol` / `us.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Terra | GPT-5.6 Terra | `openai.gpt-5.6-terra` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Luna | GPT-5.6 Luna | `openai.gpt-5.6-luna` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | -| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | -| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | +| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | Then apply the **region gate** below. Record `model_change: false` and the chosen path in `aws-design-ai.json` → `ai_architecture.code_migration`: `migration_path: "mantle_openai_chat"` for -Astra sources using Chat Completions, or `"mantle_openai_responses"` for a selected Mantle Responses -path. Use `migration_path: "runtime_openai_cris"` when a GPT-6 / GPT-5.6 target is served via -`bedrock-runtime` with a CRIS id (the model cards recommend runtime for new applications). +sources using Chat Completions on a model whose card lists it on mantle (GPT-6, GPT-5.5, GPT-5.4), or +`"mantle_openai_responses"` for a selected Mantle Responses path. Use `migration_path: "runtime_openai_cris"` +when a GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 target is served via `bedrock-runtime` with a CRIS id (the model +cards recommend runtime for new applications). Report the assessment honestly: `strong_migrate` here means "low-risk, well-supported move", not "cheaper". @@ -105,14 +113,16 @@ regions — offer it, stating the data-residency implication of cross-region rou Global routes anywhere and is the cost-parity option). Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through to Tier 1. -**GPT-5.5 / GPT-5.4:** hard gate. Mantle in-region only, no CRIS, no fallback. If the target region is not in the -matrix: +**GPT-5.5 / GPT-5.4:** same shape as GPT-5.6, with a narrower mantle matrix (GPT-5.5: us-east-1, us-east-2; +GPT-5.4: us-east-1, us-east-2, us-west-2, us-gov-west-1 — per their model cards, read 2026-11-06). If the target +region is in that matrix, either endpoint works. Otherwise the `bedrock-runtime` CRIS path (`us.openai.gpt-5.5` / +`global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`) reaches it, with the same data-residency +caveat as GPT-5.6 (Geo stays within the geography, Global routes anywhere). There is no runtime in-region form. +Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through: -1. Prefer offering a **region change** to a supported region, if no data-residency constraint pins the workload. - This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. -2. If the region is fixed, also offer **upgrading within the vendor to GPT-5.6** (which reaches the region via - CRIS) alongside the cross-family option — a generation change, but same vendor and prompt idioms. -3. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. +1. Prefer offering a **region change** to a supported mantle region, if no data-residency constraint pins the + workload. This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. +2. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. Record the outcome in `regional_warnings[]`. @@ -236,10 +246,11 @@ model on price. ### Open-weight gpt-oss -`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and, unlike the -proprietary GPT models, **do** support `bedrock-runtime` / Converse. They sit a capability class below the GPT-5.x -frontier tier. Recommend them when the user wants OpenAI-architecture models on the Bedrock-native runtime surface -(for Guardrails, invocation logging, or Converse-based tooling) rather than through mantle. +`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and support +`bedrock-runtime` / Converse with a bare model ID (no CRIS profile needed) and `Invoke`, which the proprietary GPT +models do not. They sit a capability class below the GPT-5.x frontier tier. Recommend them when the user wants +OpenAI-architecture models on the Bedrock-native runtime surface (for Guardrails, invocation logging, or +Converse-based tooling) at the lowest price rather than through mantle. --- @@ -285,7 +296,7 @@ rather than dismissing it. For a long-context (>272K) workload the gap is much w | Chat Completions | Preserve supported Chat when selected | Reshape only for a selected API change; verify the model and endpoint | | Function calling | Supported on GPT-5.x via mantle; Claude tools via Converse | Same-model keeps tool semantics identical | | Reasoning effort | `reasoning={"effort": ...}` on mantle | `none` / `low` / `medium` / `high` / `xhigh` / `max` | -| Prompt caching | GPT-5.6 only (90% off cached input) | Not listed for GPT-5.5 / 5.4; Claude has its own caching | +| Prompt caching | GPT-5.6 (90% off cached input); GPT-5.5 / 5.4 implicit caching on `bedrock-runtime` Responses only | GPT-5.5 / 5.4 cards (read 2026-11-06) list a cache-read rate and implicit caching on runtime, none on mantle; Claude has its own caching | | Streaming | Supported | Verify per surface | | Vision | GPT-5.x (image input) or Claude / Nova | Same-model preserves behavior | | JSON mode | Claude (excellent), Nova Pro (good) | Most models via prompt | @@ -340,11 +351,12 @@ and closed to new customers as of July 30, 2026. ### When to prefer a Bedrock-native model over the mantle GPT path Choose Claude / Nova via Converse when the workload needs Knowledge Bases, intelligent prompt routing, structured -outputs, or application inference profiles — none of which the GPT path offers. Note what no longer forces a family -switch for GPT-5.6: its `bedrock-runtime` CRIS path provides cross-region inference, invocation logs, and -Guardrails (Converse API only; prompt caching is Responses-only on runtime). For GPT-5.5 / GPT-5.4, Guardrails, -logging, and cross-region reach still require a different model. The mantle GPT path is the smallest change; the -Bedrock-native path remains the most feature-complete. +outputs, or application inference profiles — none of which the mantle GPT path offers. Note what no longer forces +a family switch for GPT-5.6, GPT-5.5 and GPT-5.4: their `bedrock-runtime` CRIS paths provide cross-region +inference, invocation logs, Guardrails and application inference profiles (both Converse API only), and +structured outputs and implicit prompt caching (both Responses API only) — per the GPT-5.4 / GPT-5.5 model cards +read 2026-11-06. Knowledge Bases and intelligent prompt routing still require a Bedrock-native model. The mantle +GPT path is the smallest change; the Bedrock-native path remains the most feature-complete. ### High-spend tiering @@ -365,8 +377,8 @@ alternative, not against the source provider. cheaper and exempt from the input-TPM quota, which relieves the binding constraint on mantle. **Very high (>100M tokens/day):** tiering plus caching. Check TPM headroom per model per region early; there is no -RPM quota and no `bedrock-runtime` fallback for GPT models, so quota increases are the scaling lever. See -`shared/ai-migration-guardrails.md`. +RPM quota, and the `bedrock-runtime` CRIS path for GPT-5.6 / 5.5 / 5.4 / GPT-6 carries its own quotas rather than +adding headroom to mantle, so quota increases are the scaling lever. See `shared/ai-migration-guardrails.md`. --- diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md index 5256f8977..a4ec1d447 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle only; no 1M tier) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle only; no 1M tier) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 11.00/49.50; card read 2026-11-07) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 5.50/24.75; card read 2026-11-07) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | @@ -353,17 +353,24 @@ Regions (mantle): us-east-1 / us-east-2 for all five; us-west-2 additionally car | GPT-5.5 | 5.50 | 33.00 | — | 0.55 | | GPT-5.4 | 2.75 | 16.50 | — | 0.275 | -#### Long context (1M) — GPT-5.6 only, 2.0x input / 1.5x output - -| Model | Input $/1M | Output $/1M | -| ------------- | ---------- | ----------- | -| GPT-5.6 Sol | 8.80 | 33.00 | -| GPT-5.6 Terra | 4.40 | 19.80 | -| GPT-5.6 Luna | 0.44 | 1.98 | - -A workload above 272K context must be priced at the long-context tier. GPT-5.5 and GPT-5.4 have no such tier, so -their usable window is 272K. Global CRIS is published at OpenAI's standard list price (cost parity, GPT-5.6 only — -see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. +#### Long context (>272K input tokens) — GPT-5.6 at 2.0x input / 1.5x output; GPT-5.5 / GPT-5.4 per their model cards + +| Model | Input $/1M | Output $/1M | Cache read $/1M | +| ------------- | ---------- | ----------- | --------------- | +| GPT-5.6 Sol | 8.80 | 33.00 | — | +| GPT-5.6 Terra | 4.40 | 19.80 | — | +| GPT-5.6 Luna | 0.44 | 1.98 | — | +| GPT-5.5 | 11.00 | 49.50 | 1.10 | +| GPT-5.4 | 5.50 | 24.75 | 0.55 | + +A workload above 272K input tokens must be priced at the long-context tier, applied to all input and output tokens +of the request. GPT-5.5 and GPT-5.4 rows read from their model cards on 2026-11-06 +([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), +[GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)); both cards state a +1,050,000-token context window (128,000 max output) and list `us.`/`global.` CRIS ids on `bedrock-runtime`, but +publish the In-Region inference option only. Global CRIS is published at OpenAI's standard list price (cost parity, +GPT-5.6 only — see `openai-on-bedrock.md`). GovCloud (US-West) GPT-5.4 short-context is 3.375 / 20.25 (cache read +0.3375) per the 2026-11-06 card; an earlier revision recorded 3.30 / 19.80. > **One source conflict.** These models are absent > from the AWS Price List API entirely: querying `AmazonBedrock` returns only `gpt-oss` and GPT OSS Safeguard, and @@ -373,7 +380,8 @@ see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. **Prompt caching (GPT-5.6 only):** cached input read at a 90% discount, cache write at 1.25x uncached input, minimum 1,024-token prefix, up to 4 breakpoints, ≥30-minute retention. Cached input is exempt from the input-TPM quota. -GPT-5.5 and GPT-5.4 do not list prompt caching support. +GPT-5.5 and GPT-5.4 list only implicit prompt caching on `bedrock-runtime` Responses (automatic, no request +parameters; cache-read rate above, no cache-write rate) and none on mantle (model cards read 2026-11-06). #### Open-weight gpt-oss diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md index cdf8ced55..c82a8eebc 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md @@ -190,12 +190,18 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` ## migration_path vocabulary `mantle_openai_responses` (an OpenAI-protocol source — direct or Azure-fronted — with the model -on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `converse` -(Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when a proprietary GPT -model must move off mantle for Guardrails / Knowledge Bases / logging / an unsupported region) · -`gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic -Bedrock SDK swap). A proprietary `openai.gpt-*` model ID is NEVER paired with a -`converse`/`bedrock-runtime` path — those models are mantle-only. +on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` +(same, preserving a Chat Completions source on a model whose card lists Chat Completions on +mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via +`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-5.6 Terra +and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native +Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, +intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` +(OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK +swap). A **bare** proprietary `openai.gpt-*` model ID is NEVER paired with a +`converse`/`bedrock-runtime` path — bare ids are mantle ids; every proprietary GPT target on +`bedrock-runtime` carries a CRIS-prefixed id (there is no runtime in-region form for GPT-6, +GPT-5.6, GPT-5.5 or GPT-5.4). ## regional_validation @@ -255,8 +261,10 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `price_comparison`. - [ ] `honest_assessment` overall is the weakest across `bedrock_models[]`; if `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. -- [ ] No `bedrock_models[]` entry pairs a proprietary `openai.gpt-*` model ID with a - `converse`/`bedrock-runtime` migration path (mantle-only). +- [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a + `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` + target carries a CRIS id: `us.`/`in.`/`global.` for GPT-5.6 Terra / Luna; `us.`/`global.` only + for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md b/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md index e82c7485e..c37b6c936 100644 --- a/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md +++ b/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md @@ -223,8 +223,8 @@ _Skip when:_ the validator summary reports `models_extractable: true` — every | GPT-6/6.1 (Astra/Sol/Luna) | **Same model on Bedrock** | ~10% over OpenAI std (DR tier); Astra/6.1 Sol also support Ultrafast | | GPT-6.1 Terra | **Same model on Bedrock** | Use the model-specific endpoint and context-tier prices in the [GPT-6.1 Terra model card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-6-1-terra.html); compare against measured source spend or verified source rates. | | GPT-5.6 (any) | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | -| GPT-5.5 | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | -| GPT-5.4 | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | +| GPT-5.5 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | +| GPT-5.4 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | | GPT-3.5 Turbo | GPT-5.6 Luna; or Claude Haiku 5.5 | At equal billed volumes and 2:1 input/output, Haiku US Geo is 56.25% cheaper up to 100K prompt tokens; Luna is 54.29% cheaper above 100K while Luna remains within 272K. Recount target tokens; if request size is unknown, present both Haiku tiers. | | GPT-4/4 Turbo | GPT-5.6 Terra; or Sonnet 5 | Not on Bedrock — offer both | | GPT-4o | GPT-5.6 Terra; or Sonnet 5 | Not on Bedrock — offer both | @@ -237,8 +237,8 @@ _Skip when:_ the validator summary reports `models_extractable: true` — every **Same-model rows first.** GPT-6 Astra / GPT-5.6 / 5.5 / 5.4 sources map to themselves. Design applies the model-specific API and region gate; Clarify records the baseline only. -Astra Standard mantle supports `us-east-1` and `us-west-2`; runtime uses US Geo / Global CRIS. GPT-5.6 also has runtime CRIS; -GPT-5.5 / 5.4 remain mantle-only. GPT-5.x in-region costs about 10% above OpenAI standard, +Astra Standard mantle supports `us-east-1` and `us-west-2`; runtime uses US Geo / Global CRIS. GPT-5.6, GPT-5.5 +and GPT-5.4 also have runtime CRIS (`us.` / `global.`). GPT-5.x in-region costs about 10% above OpenAI standard, while GPT-5.6 Global CRIS uses the standard rate. For Astra, compare its separately dated inference/context tier against the source price before claiming savings or parity. For sources without a Bedrock equivalent, present a same-vendor upgrade and a cross-family option. diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md index 494919052..833a430f9 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md @@ -190,8 +190,8 @@ _Skip when:_ `models[].model_id` is populated in `ai-workload-profile.json` **wi | GPT-6/6.1 (Astra/Sol/Luna) | **Same model on Bedrock** | ~10% over OpenAI std (DR tier); Astra/6.1 Sol also support Ultrafast | | GPT-6.1 Terra | **Same model on Bedrock** | Use the model-specific endpoint and context-tier prices in `references/shared/openai-on-bedrock.md`; compare against measured source spend or verified source rates. | | GPT-5.6 (any) | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | -| GPT-5.5 | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | -| GPT-5.4 | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | +| GPT-5.5 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | +| GPT-5.4 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | | GPT-3.5 Turbo | GPT-5.6 Luna; or Claude Haiku 5.5 | At equal billed volumes and 2:1 input/output, Haiku US Geo is 56.25% cheaper up to 100K prompt tokens; Luna is 54.29% cheaper above 100K while Luna remains within 272K. Recount target tokens; if request size is unknown, present both Haiku tiers. | | GPT-4/4 Turbo | GPT-5.6 Terra; or Sonnet 5 | Not on Bedrock — offer both | | GPT-4o | GPT-5.6 Terra; or Sonnet 5 | Not on Bedrock — offer both | @@ -204,8 +204,8 @@ _Skip when:_ `models[].model_id` is populated in `ai-workload-profile.json` **wi **Same-model rows first.** GPT-6 Astra / GPT-5.6 / 5.5 / 5.4 sources map to themselves. Apply the model-specific API and region gate in `references/shared/openai-on-bedrock.md`. -Astra Standard mantle supports `us-east-1` and `us-west-2`; runtime uses US Geo / Global CRIS. GPT-5.6 also has runtime CRIS; -GPT-5.5 / 5.4 remain mantle-only. GPT-5.x in-region costs about 10% above OpenAI standard, +Astra Standard mantle supports `us-east-1` and `us-west-2`; runtime uses US Geo / Global CRIS. GPT-5.6, GPT-5.5 +and GPT-5.4 also have runtime CRIS (`us.` / `global.`). GPT-5.x in-region costs about 10% above OpenAI standard, while GPT-5.6 Global CRIS uses the standard rate. For Astra, compare its separately dated inference/context tier against the source price before claiming savings or parity. For sources without a Bedrock equivalent, present a same-vendor upgrade and a cross-family option. diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md index 60f916a7e..edee21099 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md @@ -238,7 +238,9 @@ data-residency-tier premium, while supported Global CRIS uses standard-rate pari Report the actual option; do not downgrade solely for the modest verified premium. **GPT-5.6/GPT-6 only:** above 272K context, apply 2.0x input and 1.5x output rates only when the selected model and inference option support that tier; the resulting gap may change -the assessment. GPT-5.5/5.4 have no 1M tier. **Opus 5.5:** use the selected region/profile's +the assessment. GPT-5.5/5.4 have their own long-context (>272K) rates on their model cards +(read 2026-11-06; see `openai-on-bedrock.md` § Pricing) — use those, not the GPT-5.6 +multiplier. **Opus 5.5:** use the selected region/profile's flat rates from `references/vendored/ai/bedrock-pricing-cache.md` throughout the full 1M context; do not apply the GPT multiplier. Verify other models' tiers individually. @@ -407,23 +409,25 @@ Astra Chat solely because it is proprietary GPT. Record `model_change: false` on the exact source model is retained; a Pro-to-Astra upgrade is a model change requiring eval. GPT-5.x retains its separately dated API evidence and any selected Chat-to-Responses reshape. -**A Chat Completions source is a supported near-drop-in for GPT-6 and GPT-5.6 — not a mandatory reshape.** All five GPT-6 models and the GPT-5.6 family list Chat Completions as a supported API on both mantle and runtime CRIS (per `openai-on-bedrock.md` § Access Paths); if `integration` evidence shows `chat.completions.create` for one of these models, the design may keep `chat.completions.create`/`choices[0].message` parsing — reshape to `responses.create` is optional, only for a Responses-only feature (runtime explicit prompt caching, reasoning-item round-trips) or a demonstrated constraint. **GPT-5.5 and GPT-5.4 are the exception**: Chat Completions support is unconfirmed on their model cards (Responses on mantle is the only verified surface), so a Chat Completions source on either model still needs a planned reshape, probed against the target account before committing. +**A Chat Completions source is a supported near-drop-in for GPT-6 and GPT-5.6 — not a mandatory reshape.** All five GPT-6 models and the GPT-5.6 family list Chat Completions as a supported API on both mantle and runtime CRIS (per `openai-on-bedrock.md` § Access Paths); if `integration` evidence shows `chat.completions.create` for one of these models, the design may keep `chat.completions.create`/`choices[0].message` parsing — reshape to `responses.create` is optional, only for a Responses-only feature (runtime explicit prompt caching, reasoning-item round-trips) or a demonstrated constraint. **GPT-5.5 and GPT-5.4 follow the same rule**: their model cards (read 2026-11-06) list Chat Completions as supported on both `bedrock-mantle` and `bedrock-runtime`, so a Chat Completions source on either model may keep Chat Completions; the reshape is optional for them too. A planned reshape is required only when the selected model's card leaves Chat Completions unchecked on the selected endpoint (check the per-model path entries in the canonical catalog). Probe the selected API against the target account before committing, as for any model. **Terra caching depends on the endpoint and mode.** On runtime, implicit caching supports Responses, Chat Completions, InvokeModel, and Converse. It does not require a Chat client reshape and can be combined with Converse Guardrails. Runtime explicit caching requires Responses. On Mantle, both implicit and explicit caching are Responses-only. -**No Converse fallback for GPT-5.5/GPT-5.4 — GPT-5.6 and GPT-6 differ.** GPT-5.5 and GPT-5.4 are -`bedrock-mantle` only and in-region only — there is no `bedrock-runtime` path and no cross-region -inference profile for these two models. GPT-5.6 Sol/Terra/Luna and all five GPT-6 models (Astra, -Sol, Luna, 6.1 Sol, 6.1 Terra) DO have a `bedrock-runtime` CRIS path (`us.`/`global.` prefixed IDs, per -`openai-on-bedrock.md` § Access Paths) — for these models, a region or feature need (Guardrails, -Knowledge Bases, invocation logging, or a region outside the mantle matrix) is satisfied by -**switching endpoint, not model**: record `migration_path: "runtime_openai_cris"` with -`model_change: false`. Reserve `migration_path: "converse"` with `model_change: true` for -GPT-5.5/GPT-5.4 only, or when the GPT-6/5.6 CRIS path itself cannot serve the need (e.g. a feature -CRIS does not support — see the runtime-side feature splits in `openai-on-bedrock.md`). Note: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` CRIS path — including GPT-5.5 and +GPT-5.4.** GPT-5.6 Sol/Terra/Luna, all five GPT-6 models (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra), and +GPT-5.5 / GPT-5.4 (model cards read 2026-11-06: `us.openai.gpt-5.5` / `global.openai.gpt-5.5`, +`us.openai.gpt-5.4` / `global.openai.gpt-5.4`; Responses, Chat Completions and Converse on runtime) +have a `bedrock-runtime` CRIS path (`us.`/`global.` prefixed IDs, per `openai-on-bedrock.md` +§ Access Paths). No proprietary GPT model has a runtime in-region form. For all of them, a region +or feature need (Guardrails, invocation logging, application inference profiles, or a region +outside the mantle matrix) is satisfied by **switching endpoint, not model**: record +`migration_path: "runtime_openai_cris"` with `model_change: false`. Reserve +`migration_path: "converse"` with `model_change: true` for a need the same-model CRIS path itself +cannot serve (Knowledge Bases, intelligent prompt routing, or a feature CRIS does not support — +see the runtime-side feature splits in `openai-on-bedrock.md`). Note: `runtime_openai_cris` for GPT-6 Astra is valid only via Responses/Chat Completions/Converse — Astra does not support `Invoke`, so a design that needs Guardrails or Application Inference Profiles (Converse-only features that also require Invoke-adjacent plumbing on some other models) @@ -432,7 +436,23 @@ must verify against Astra's model card per-feature, not assume parity with Sol/L switch, not model switch), it MUST also record `bedrock_models[].required_client_api` so the generated client uses a Guardrails-capable surface — `converse` for Astra and 6.1 Terra; `converse` / `chat_completions` / `invoke` (never `responses`) for 6.1 Sol and the other GPT-6/5.6 CRIS models except Astra and 6.1 Terra. Do not leave the client on `responses` when Guardrails is required.** `Responses` -stays the default for a region-only CRIS move with no Guardrails need. +stays the default for a region-only CRIS move with no Guardrails or application-inference-profile need. + +**Application inference profiles are Converse-only on GPT-5.5, GPT-5.4, GPT-6.1 Terra and Astra — +the requirement MUST reach `required_client_api`.** The GPT-5.4 / GPT-5.5 model cards (read 2026-11-07) +list "Application inference profiles (Converse API only; not supported with Responses or Chat +Completions APIs)" on `bedrock-runtime`. When application inference profiles (cost attribution by +app/environment) are the driving need and the design keeps `runtime_openai_cris`, record +`bedrock_models[].required_client_api: "converse"` for GPT-5.5 / GPT-5.4 and for any other model +whose card or catalog `runtime_converse` path entry lists the feature as Converse-only. Do not leave +the field absent or on `responses` / `chat_completions`: Generate defaults an absent field to +Responses and omits the application profile for an unsupported model/API pair, so the endpoint +switch alone does not deliver the feature. If the same workload also needs a Responses-only +feature on that model (GPT-5.5 / GPT-5.4: structured outputs, implicit prompt caching — see +`openai-on-bedrock.md` § Access Paths), one client API cannot serve both: record the conflict as an +explicit decision in the Part 5 plan and the Present Summary — name which feature the plan keeps +and which is dropped, or split the workload into two `bedrock_models[]` rows with their own +`required_client_api` — never silently drop either requirement. **GPT-6.1 Terra API constraints:** Guardrails and application inference profiles require `required_client_api: "converse"`. Converse rejects document blocks and images in tool @@ -511,9 +531,17 @@ Write `aws-design-ai.json` to `$MIGRATION_DIR/`. - [ ] `honest_assessment` logic is consistent (weakest model drives overall) - [ ] If `ai_source` includes `"openai"`: every model that `shared/openai-on-bedrock.md` lists as available on Bedrock, and whose target region carries it, is mapped to **itself** with `model_change: false` — not to a Claude/Nova substitute - [ ] If `honest_assessment == "recommend_stay"`: `honest_assessment_reason` names a non-cost blocker (cost parity alone is never sufficient for an OpenAI source) -- [ ] No `bedrock_models[]` entry pairs **GPT-5.5 or GPT-5.4** with a Converse/`bedrock-runtime` - migration path (those two models only — mantle-only, no CRIS). GPT-5.6 and GPT-6 models MAY - use `migration_path: "runtime_openai_cris"` on `bedrock-runtime` — this is NOT a violation. +- [ ] No `bedrock_models[]` entry pairs a **bare** proprietary GPT id (including bare + `openai.gpt-5.5` / `openai.gpt-5.4`) with a Converse/`bedrock-runtime` migration path. + GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on + `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` for GPT-5.6 Terra and Luna; + `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4) — this is NOT a violation. +- [ ] Every `runtime_openai_cris` entry whose driving need includes application inference profiles, + on a model whose card lists them as Converse-only (GPT-5.5, GPT-5.4, GPT-6.1 Terra, Astra), + records `required_client_api: "converse"` — not absent, `responses` or `chat_completions`. + A same-workload Responses-only need (GPT-5.5 / GPT-5.4 structured outputs or implicit + caching) is recorded as an explicit decision in the Part 5 plan, not silently dropped. + A region-only CRIS move keeps the `responses` default. - [ ] `regional_warnings` is present (empty array `[]` if no issues; populated if any service unavailable in target region) - [ ] `multi_model_warnings` is present (empty array `[]` if single model or no coordination issues) - [ ] If `agentic_profile.is_agentic == true`: `agentic_design` object is present with `migration_approach` matching `preferences.json` diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md index cf2631248..24ee8b972 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md @@ -104,8 +104,8 @@ See `references/shared/openai-on-bedrock.md` for the model-specific pricing rule For the GPT-5.x rows, the mantle endpoint is in-region only (us-east-1, us-east-2; us-west-2 additionally for Terra, Luna, and GPT-5.4; AWS GovCloud us-gov-west-1 / us-gov-east-1 for Terra and Luna, us-gov-west-1 also for -GPT-5.4). GPT-5.6 additionally reaches most commercial regions via `bedrock-runtime` CRIS ids; GPT-5.5 / GPT-5.4 -have no CRIS. +GPT-5.4). GPT-5.6, GPT-5.5 and GPT-5.4 additionally reach most commercial regions via `bedrock-runtime` CRIS ids +(`us.` / `global.`; GPT-5.5 / GPT-5.4 per their model cards read 2026-11-06). For the GPT-6 rows, mantle is us-east-1 only, except GPT-6 Astra which is also available in us-west-2. All five GPT-6 models additionally reach a broad set of commercial regions via `bedrock-runtime` CRIS (`us.` / `global.` diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md index 2571e0def..5fa5c23ee 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md @@ -31,8 +31,8 @@ Check `preferences.json` → `ai_constraints.ai_framework` to determine the migr **OpenAI SDK users via Mantle (config path for a Responses source; small reshape for a Chat Completions source)** — `ai_framework` = `direct` AND `ai_source` = `openai` AND (`migration_path` **starts with** `mantle` (`mantle`, `mantle_openai_responses`, `mantle_openai_chat`) OR `migration_path` == `"runtime_openai_cris"`): - `mantle` / `mantle_openai_responses`: point the client at `https://bedrock-mantle.{region}.api.aws/openai/v1` — note the `openai/v1` segment for proprietary GPT models; a bare `/v1` 404s. Swap the credential for a Bedrock API key or the auto-refreshing token provider — **not** the existing OpenAI key. Update the model string to the bare Bedrock model ID (`openai.gpt-*` for a same-model move). Grant the `bedrock-mantle:*` actions; `bedrock:InvokeModel` does not authorize these models. -- `runtime_openai_cris` (GPT-5.6/GPT-6 via `bedrock-runtime` CRIS): point the client at `https://bedrock-runtime.{region}.amazonaws.com/openai/v1` instead — **not** the mantle URL. Update the model string to the `us.`/`in.`/`global.`-prefixed CRIS inference-profile ID, not the bare ID. Grant standard `bedrock:InvokeModel*` actions against the CRIS inference-profile ARN — **not** `bedrock-mantle:*`. For a GPT-6 CRIS id, also grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default` alongside the inference-profile ARN (per the GPT-6 model cards). Check `aws-design-ai.json` → `ai_architecture.bedrock_models[].required_client_api`: if non-Responses, emit that surface (e.g. Converse) instead of defaulting to `responses.create` — absent/`responses` keeps the Responses surface for a region-only move. -- **Config-only if the source already calls `responses.create`.** A Chat Completions source for GPT-6 or GPT-5.6 may keep `chat.completions.create`/`choices[0].message` parsing unchanged — Chat Completions is supported on both mantle and runtime CRIS for these models, so reshape to Responses is optional (only for a Responses-only feature or demonstrated constraint). For GPT-5.5/GPT-5.4, Chat Completions support is unconfirmed, so still plan a reshape to Responses and probe the target account before committing. +- `runtime_openai_cris` (GPT-5.6/GPT-6/GPT-5.5/GPT-5.4 via `bedrock-runtime` CRIS): point the client at `https://bedrock-runtime.{region}.amazonaws.com/openai/v1` instead — **not** the mantle URL. Update the model string to the CRIS inference-profile ID the selected model's card lists (`us.`/`global.`; `in.` exists for GPT-5.6 Terra and Luna only), not the bare ID. Grant standard `bedrock:InvokeModel*` actions against the CRIS inference-profile ARN — **not** `bedrock-mantle:*`. For a GPT-6 CRIS id, and for the GPT-5.5 / GPT-5.4 CRIS ids (`us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`, or their `inference-profile/` ARNs), also grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default` alongside the inference-profile ARN (per the GPT-6 model cards and the GPT-5.5 / GPT-5.4 cards, read 2026-11-07); `iam_policy.py` emits this third ARN for exactly those ids. Check `aws-design-ai.json` → `ai_architecture.bedrock_models[].required_client_api`: if non-Responses, emit that surface (e.g. Converse) instead of defaulting to `responses.create` — absent/`responses` keeps the Responses surface for a region-only move. +- **Config-only if the source already calls `responses.create`.** A Chat Completions source for GPT-6 or GPT-5.6 may keep `chat.completions.create`/`choices[0].message` parsing unchanged — Chat Completions is supported on both mantle and runtime CRIS for these models, so reshape to Responses is optional (only for a Responses-only feature or demonstrated constraint). GPT-5.5/GPT-5.4 follow the same rule — their model cards (read 2026-11-06) list Chat Completions on both mantle and runtime, so the reshape is optional for them too; probe the selected API against the target account before committing, as for any model. - Test in staging, validate responses Match the `migration_path` prefix, not the exact string: Design writes the more specific `mantle_openai_responses` for a same-model OpenAI migration, and an equality test against `mantle` would misroute those runs into the adapter path below. `runtime_openai_cris` (GPT-5.6/GPT-6 served via `bedrock-runtime` CRIS instead of `bedrock-mantle`) is matched explicitly alongside the `mantle*` prefix — it does not start with `mantle`, so it needs its own check to avoid falling through to the adapter path below. @@ -55,7 +55,7 @@ Based on `ai-workload-profile.json` → `integration.pattern` and `integration.l | Source SDK | Target | Key Change | | ----------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| OpenAI SDK (same model) | Mantle Responses API | Base URL → `.../openai/v1`, Bedrock token/API key (not an OpenAI key), `openai.gpt-*` model ID. Config-only **if** already on `responses.create`; a Chat Completions source may keep Chat Completions for GPT-6/GPT-5.6 (reshape to Responses optional); GPT-5.5/GPT-5.4 still need a reshape. | +| OpenAI SDK (same model) | Mantle Responses API | Base URL → `.../openai/v1`, Bedrock token/API key (not an OpenAI key), `openai.gpt-*` model ID. Config-only **if** already on `responses.create`; a Chat Completions source may keep Chat Completions for GPT-6/GPT-5.6/GPT-5.5/GPT-5.4 (reshape to Responses optional; plan it only when the selected model's card leaves Chat Completions unchecked on the selected endpoint). | | Vertex AI (Python) | boto3 Bedrock Converse API | `GenerativeModel.generate_content()` → `bedrock.converse()` | | Vertex AI (JS) | @aws-sdk/client-bedrock-runtime | `model.generateContent()` → `client.send(new ConverseCommand())` | | Vertex AI (Go) | aws-sdk-go-v2 bedrockruntime | `aiplatform` → `bedrockruntime.Converse()` | diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-artifacts-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-artifacts-ai.md index c2303a9c2..9ef33ae64 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-artifacts-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-artifacts-ai.md @@ -209,7 +209,7 @@ Generate `ai-migration/setup_bedrock.sh`. - Dry-run by default (`--execute` flag to run for real) - Step 1 — Request model access: List each model from `aws-design-ai.json` → `bedrock_models[].aws_model_id` and the embedding model -- Step 2 — Create IAM role: Trust policy for the compute platform (Lambda, ECS, or EC2 based on `aws-design.json` if present). Match inference permissions to the selected endpoint. Mantle needs `bedrock-mantle:CreateInference` scoped to `arn:aws:bedrock-mantle:{region}:{account_id}:project/*`, plus `bedrock-mantle:CallWithBearerToken` on `*` when using bearer credentials. Runtime needs `bedrock:InvokeModel` / `bedrock:InvokeModelWithResponseStream` against the selected foundation-model ARN and, for CRIS, the exact inference-profile ARN. For GPT-6 CRIS, also grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default`. Runtime actions do not authorize Mantle. +- Step 2 — Create IAM role: Trust policy for the compute platform (Lambda, ECS, or EC2 based on `aws-design.json` if present). Match inference permissions to the selected endpoint. Mantle needs `bedrock-mantle:CreateInference` scoped to `arn:aws:bedrock-mantle:{region}:{account_id}:project/*`, plus `bedrock-mantle:CallWithBearerToken` on `*` when using bearer credentials. Runtime needs `bedrock:InvokeModel` / `bedrock:InvokeModelWithResponseStream` against the selected foundation-model ARN and, for CRIS, the exact inference-profile ARN. For GPT-6 CRIS, and for the GPT-5.5 / GPT-5.4 CRIS ids (`us.`/`global.openai.gpt-5.5`, `us.`/`global.openai.gpt-5.4`, or their `inference-profile/` ARNs — their cards, read 2026-11-07, require it "in addition to the inference profile"), also grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default`. A bare `openai.gpt-5.5` / `openai.gpt-5.4` id is a mantle target and gets no such grant. Runtime actions do not authorize Mantle. - If the runtime client uses `BEDROCK_INFERENCE_PROFILE_ARN` from the generated monitoring output, also authorize that exact `application-inference-profile/…` ARN, retaining the backing model/CRIS resources needed for the selected model and fallback. Resolve it from the same output used by the client; do not grant every application profile. Re-run setup after enabling or changing this override so the effective invocation target and IAM remain aligned. See [inference-profile IAM prerequisites](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-prereq.html). - Compliance carry-through: if `preferences.json` → `design_constraints.compliance` is set and not `none`/`unknown` (full-flow Q2 / AI-only Q1.5), the script and its printed notes MUST reflect the design's Step 0.7 constraints — `AWS_REGION` from the compliance-constrained region (GovCloud for fedramp, EU for gdpr), `eu.` inference-profile model IDs for gdpr, and for hipaa a printed warning that Bedrock invocation logs retain original content (KMS-encrypt + restrict IAM on the log group before enabling) - Step 3 — Print required environment variables: `AWS_REGION`, `AI_PROVIDER=bedrock`, model IDs diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md index eb6969816..b669556ad 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md @@ -2,6 +2,7 @@ **Last verified:** 2026-10-10 **GPT-6.1 Terra verified:** 2026-10-27 +**GPT-5.5 / GPT-5.4 re-verified:** 2026-11-06 against their model cards ([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) — both now list `bedrock-runtime` (Responses, Chat Completions, Converse via `us.`/`global.` CRIS ids), Chat Completions on mantle, a 1.05M context window and a long-context price tier **Sources:** [OpenAI model cards](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards-openai.html) (per-model cards linked below), [GPT-5.6 launch post](https://aws.amazon.com/blogs/machine-learning/get-started-with-openai-gpt-5-6-sol-terra-and-luna-on-amazon-bedrock/), [GPT-5.6 GA announcement](https://aws.amazon.com/about-aws/whats-new/2026/07/openai-gpt-sol-terra/), @@ -32,8 +33,8 @@ risk) all defer to it. Do not restate model IDs, regions, or endpoint paths else | GPT-5.6 Sol | `openai.gpt-5.6-sol` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-sol.html) | | GPT-5.6 Terra | `openai.gpt-5.6-terra` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-terra.html) | | GPT-5.6 Luna | `openai.gpt-5.6-luna` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-luna.html) | -| GPT-5.5 | `openai.gpt-5.5` | Jun 1, 2026 | 272K | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html) | -| GPT-5.4 | `openai.gpt-5.4` | Jun 1, 2026 | 272K | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html) | +| GPT-5.5 | `openai.gpt-5.5` | Jun 1, 2026 | 1.05M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html) | +| GPT-5.4 | `openai.gpt-5.4` | Jun 1, 2026 | 1.05M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html) | | gpt-oss-120b | `openai.gpt-oss-120b` | Aug 5, 2025 | 128K | Active | open-weight; also on `bedrock-runtime` as `openai.gpt-oss-120b-1:0` | | gpt-oss-20b | `openai.gpt-oss-20b` | Aug 5, 2025 | 128K | Active | open-weight; also on `bedrock-runtime` as `openai.gpt-oss-20b-1:0` | | GPT OSS Safeguard | `openai.gpt-oss-safeguard-120b` / `-20b` | — | — | Active | content-moderation / guardrail enforcement, not general chat | @@ -50,8 +51,10 @@ GPT-6 Astra is the newest, most capable OpenAI model in this catalog. Sol remain lower-cost reasoning alternative; Astra does not make existing GPT-5.x sources require a model upgrade. > **Context-window conflict (resolved):** the GPT-5.6 launch blog states 272K for all three variants; all three -> model cards state 1M. **The model cards are authoritative** — use 1M for GPT-5.6. GPT-5.5 and GPT-5.4 are 272K on -> both sources. Re-check on refresh; if AWS corrects the blog, the cards still win. +> model cards state 1M. **The model cards are authoritative** — use 1M for GPT-5.6. The GPT-5.5 and GPT-5.4 cards +> (read 2026-11-06) state 1,050,000 tokens shared between input and output with 128,000 max output; the 272K figure +> recorded earlier is now only their short-/long-context pricing breakpoint. Re-check on refresh; if AWS corrects +> the blog, the cards still win. **Not on Bedrock (as of this refresh):** GPT-4o, GPT-4.1, GPT-4 / GPT-4 Turbo, GPT-3.5 Turbo, the o-series (o1/o3/o4-mini), GPT-5 / GPT-5.1 / GPT-5.2, Codex (unverified — see the Codex note below), and the `*-Pro` variants @@ -116,8 +119,12 @@ input and text output. The launch announcement rounds the input context to 1M; u exact limits for capacity checks. Browser/computer-use capability does not establish parity with OpenAI-hosted tools; probe the application's specific tool flow. -**GPT-5.5 and GPT-5.4 are `bedrock-mantle`-only and in-region only.** Their model cards list a single -Programmatic Access row (`bedrock-mantle`, Geo/Global "Not supported") and In-Region pricing only. +**GPT-5.5 and GPT-5.4 have TWO endpoints** (re-verified 2026-11-06 against their model cards; earlier revisions of +this file recorded them as `bedrock-mantle`-only). Both Programmatic Access tables now carry a `bedrock-runtime` +row (In-Region "Not supported"; Geo `us.openai.gpt-5.5` / `us.openai.gpt-5.4`; Global `global.openai.gpt-5.5` / +`global.openai.gpt-5.4`) and a `bedrock-mantle` row (bare id, in-region only). Supported APIs: `Responses`, +`Chat Completions` and `Converse` on `bedrock-runtime`; `Responses` and `Chat Completions` on `bedrock-mantle`; +`Messages` and `Invoke` on neither. The pricing tables still publish the In-Region inference option only. **GPT-5.6 Sol / Terra / Luna have TWO endpoints** (verified 2026-08-21 — this changed after this file's original 2026-08-10 verification; the Refresh Checklist predicted it): @@ -136,13 +143,16 @@ Constraints that still break naive assumptions: mantle path explicitly, and the runtime example gives `bedrock-runtime.{region}.amazonaws.com/openai/v1`. 2. **The endpoints take different model-id forms.** Mantle takes the bare `openai.gpt-5.6-*` id and has no CRIS; `bedrock-runtime` takes ONLY a CRIS inference-profile id (`us.` / `in.` / `global.` prefixed) and has no - in-region form. `bedrock:ListInferenceProfiles` returns the 5.6 CRIS profiles; it never returns the bare mantle - ids, and it returns nothing for GPT-5.5 / GPT-5.4. + in-region form. `bedrock:ListInferenceProfiles` returns the CRIS profiles (5.6, and `us.`/`global.` for + GPT-5.5 / GPT-5.4 per their cards); it never returns the bare mantle ids. 3. **API surfaces differ by endpoint.** The 5.6 cards list `Responses`, `Chat Completions`, `Invoke`, and `Converse` as supported APIs, with runtime-side feature splits: **Guardrails are Converse-only; prompt caching is Responses-only on runtime**; server-side tool use, structured outputs, and application inference profiles are NOT - supported on runtime (server-side tool calling IS supported on mantle). For GPT-5.5 / GPT-5.4 treat Responses on - mantle as the only verified surface. + supported on runtime (server-side tool calling IS supported on mantle). The GPT-5.5 / GPT-5.4 cards (read + 2026-11-06) list `Responses`, `Chat Completions` and `Converse` on runtime (no `Invoke`) and `Responses` and + `Chat Completions` on mantle; on runtime they list Guardrails and application inference profiles as + Converse-only, and implicit prompt caching and structured outputs as Responses-only. Chat Completions is a + documented surface for GPT-5.5 / GPT-5.4 on both endpoints — probe it in the target account like any other. ### GPT-6 family: Ultrafast tier @@ -193,8 +203,10 @@ that expires within 12 hours and is not refreshed. Do not recommend it for produ **IAM:** on the mantle path, the managed policy `AmazonBedrockMantleInferenceAccess` grants what inference needs, including `bedrock-mantle:CreateInference` and `bedrock-mantle:CallWithBearerToken` — `bedrock:InvokeModel` does not -authorize mantle calls. On the GPT-5.6 `bedrock-runtime` path the usual `bedrock:InvokeModel*` against the CRIS -inference-profile ARN applies, as for any other runtime model. +authorize mantle calls. On the GPT-5.6 / GPT-5.5 / GPT-5.4 `bedrock-runtime` path the usual `bedrock:InvokeModel*` +against the CRIS inference-profile ARN applies, as for any other runtime model; the GPT-5.5 / GPT-5.4 cards add +that the identity also needs `bedrock:InvokeModel` on the account's default project +(`arn:aws:bedrock:{region}:{account-id}:project/default`). **Reasoning effort:** the five GPT-5.x models accept `none`, `low`, `medium`, `high`, `xhigh`, `max`. Astra's card does not enumerate these values; verify its accepted settings rather than inheriting the GPT-5.x list. Because these models reason @@ -205,7 +217,8 @@ request for multi-turn and tool-calling flows. ## Regional Availability — Endpoint-Aware -**The mantle in-region matrix** (the only reach for GPT-5.5 / GPT-5.4, and the in-region option for GPT-6 Astra / GPT-5.6): +**The mantle in-region matrix** (the in-region option for every proprietary GPT model; GPT-5.5 / GPT-5.4 rows +re-verified 2026-11-06): | Model | us-east-1 | us-east-2 | us-west-2 | us-gov-west-1 | us-gov-east-1 | | ------------- | --------- | --------- | --------- | ------------- | ------------- | @@ -235,8 +248,16 @@ any GPT-6 model, it just means using the runtime endpoint with a CRIS id. **GPT-5.6 additionally reaches most commercial regions via `bedrock-runtime` CRIS** (Geo `us.` / `in.`, Global `global.` inference profiles; the Sol card's runtime footprint spans 30+ regions). So a region outside the mantle matrix does NOT make the same-model path unavailable for GPT-5.6 — it means using the runtime endpoint with a CRIS -id, with the data-residency implications of cross-region routing. For GPT-5.5 / GPT-5.4 the mantle matrix is a hard -gate: no CRIS, no fallback. +id, with the data-residency implications of cross-region routing. + +**GPT-5.5 / GPT-5.4 runtime availability** (model cards read 2026-11-06): US Geo CRIS (`us.openai.gpt-5.5` / +`us.openai.gpt-5.4`) can be called from `us-east-1`, `us-east-2`, `us-west-1`, `us-west-2`, `ca-central-1` and +`ca-west-1`. Global CRIS (`global.openai.gpt-5.5` / `global.openai.gpt-5.4`) is listed in those six plus +`mx-central-1`, every EU region (`eu-central-1/2`, `eu-north-1`, `eu-south-1/2`, `eu-west-1/2/3`), `ap-east-2`, +`ap-northeast-1/2/3`, `ap-south-1/2`, `ap-southeast-1` through `-7`, `il-central-1`, `me-central-1`, `me-south-1`, +`af-south-1` and `sa-east-1` (33 regions). No runtime in-region form, no EU/India Geo profile, and no GovCloud +runtime row. So the mantle matrix is no longer a hard gate for GPT-5.5 / GPT-5.4; only a strictly in-region +requirement outside the mantle matrix blocks the same-model path. Verify current footprints per model card / `aws___get_regional_availability` (AWS MCP Server) — the CRIS lists move faster than this file. @@ -247,13 +268,19 @@ for these models). Sol rates reflect the Aug 21, 2026 reduction (−20% input / the AWS What's New announcement lists as promotional through at least Nov 21, 2026. **Pricing now has an inference-option dimension:** -- **GPT-5.x In-Region and Geo CRIS: 1.10x OpenAI's standard list price** (parity with OpenAI's _data residency_ tier). +- **GPT-5.6 In-Region and Geo CRIS: 1.10x OpenAI's standard list price** (parity with OpenAI's _data residency_ tier). - **Global CRIS: OpenAI's standard list price** — cost parity for the GPT-5.6 rates verified above, and only when the workload has no data-residency constraint. So the honest cost statement is conditional, not flat: a same-model GPT-5.6 move on Global CRIS is -**cost-neutral**; the same move in-region or Geo (and any GPT-5.5 / GPT-5.4 move) is **~10% more expensive**. The -same Global-CRIS-is-cost-neutral / in-Region-and-Geo-is-~10%-more pattern applies to the GPT-6 family below. +**cost-neutral**; the same move in-region or Geo is **~10% more expensive**. The GPT-5.5 / GPT-5.4 cards publish +**commercial In-Region pricing only** (no Geo/Global rows as of 2026-11-07; the cards say "Commercial In-Region +prices include a 10% fee over OpenAI rates"), so for them the ~10% premium is verified for the In-Region (mantle) +option alone — nothing establishes a Geo (`us.`) or Global CRIS price. For a GPT-5.5 / GPT-5.4 CRIS plan, source the +Geo/Global rate separately (the card's inference-option table or the Bedrock pricing page, with URL and read date) +or report the comparison unavailable; an In-Region rate used as a proxy is an **unverified planning assumption**, +labelled as such, and must not be turned into a verified premium or savings percentage. Never report parity for +them. The same Global-CRIS-is-cost-neutral / in-Region-and-Geo-is-~10%-more pattern applies to the GPT-6 family below. Never state either number without stating the inference option it belongs to. ### GPT-6 Astra / Sol / Luna / 6.1 Sol — short context (≤272K) @@ -307,12 +334,17 @@ provider rate before claiming savings or parity for the selected context tier. A workload above 272K context must be priced at the long-context tier. -### GPT-5.5 / GPT-5.4 — In-Region only (no CRIS, no long-context tier; usable window 272K) +### GPT-5.5 / GPT-5.4 — In-Region pricing only; short- and long-context tiers (model cards read 2026-11-06) + +The cards publish only the commercial In-Region inference option (the `us.` / `global.` runtime CRIS ids exist but +carry no separate price row). A `runtime_openai_cris` plan priced from this table is an unverified planning +assumption, not a verified rate — `bedrock_pricing.lookup()` returns `available: false` for these CRIS ids on +purpose. Long-context rates apply to all input and output tokens of a request above 272K input tokens. -| Model | In-Region (in · out) | Cache read | Notes | -| ------- | -------------------- | ---------- | -------------------------------- | -| GPT-5.5 | 5.50 · 33.00 | 0.55 | no cache-write rate published | -| GPT-5.4 | 2.75 · 16.50 | 0.275 | GovCloud (US-West): 3.30 · 19.80 | +| Model | Short context ≤272K (in · cache read · out) | Long context >272K (in · cache read · out) | Notes | +| ------- | ------------------------------------------- | ------------------------------------------ | ---------------------------------------- | +| GPT-5.5 | 5.50 · 0.55 · 33.00 | 11.00 · 1.10 · 49.50 | no cache-write rate published | +| GPT-5.4 | 2.75 · 0.275 · 16.50 | 5.50 · 0.55 · 24.75 | GovCloud (US-West) short: 3.375 · 0.3375 · 20.25 | > **The Luna "blog discrepancy" resolved differently than first recorded.** The AWS News Blog's 0.20 / 1.20 is not > an error — it is the **Global CRIS** rate, now published on the Luna card. An earlier revision of this file said @@ -329,8 +361,10 @@ Its card does not establish the GPT-5.6 minimum-prefix, breakpoint, or quota-exe Listed as a supported feature on the GPT-5.6 Sol/Terra/Luna model cards and on all five GPT-6 model cards (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra — confirmed by the cache-write/cache-read columns in the GPT-6 pricing tables above). The -GPT-5.5 and GPT-5.4 cards list client-side tool calling in that slot instead and do **not** list prompt caching. -Do not assume caching on 5.5/5.4. +GPT-5.5 and GPT-5.4 cards (read 2026-11-06) list **implicit prompt caching on `bedrock-runtime` Responses only** +(automatic, no request parameters) with a cache-read rate and no cache-write rate; explicit caching is unsupported +and the mantle feature list carries client-side tool calling in that slot instead. Do not assume caching on +5.5/5.4 mantle, and do not inherit the GPT-5.6 prefix/breakpoint rules below for them. | Property | Value | | ----------------- | ------------------------------------------------------------ | @@ -359,10 +393,10 @@ This corrects two claims that were previously applied to all Mantle traffic in t - There is **no shared 10,000 RPM account limit** governing these models — the quota dimension is TPM, per model, per region. -- "Switch to `bedrock-runtime`" is **not a throughput remedy for GPT-5.5 / GPT-5.4** — they have no - `bedrock-runtime` path at all. For GPT-5.6 the runtime path DOES exist (CRIS only; see Access Paths above), so - moving there is a legitimate option — but treat it as an endpoint/architecture choice with its own quota family - and residency implications, not a free throughput escape hatch. +- "Switch to `bedrock-runtime`" is **not a free throughput escape hatch**. For GPT-5.6, GPT-5.5 and GPT-5.4 the + runtime path exists (CRIS only; see Access Paths above — GPT-5.5 / GPT-5.4 re-verified 2026-11-06), so moving + there is a legitimate option — but treat it as an endpoint/architecture choice with its own quota family and + residency implications. The supported mitigations are: exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK), spreading load across minutes rather than bursting, ramping request rate gradually, and prompt caching (cached input @@ -409,8 +443,8 @@ This model family is moving fast (two GA waves and a repricing inside 10 weeks). 1. Re-read the [OpenAI model card index](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards-openai.html) for models added or removed, and each per-model card for lifecycle state and EOL date. -2. Recheck the region matrix AND the GPT-5.6 CRIS footprints — for 5.5/5.4 a region change is migration-blocking; - for 5.6 the runtime/CRIS path usually covers the region instead. +2. Recheck the region matrix AND the CRIS footprints for every proprietary GPT model — the runtime/CRIS path + usually covers a region outside the mantle matrix; only a strictly in-region requirement there is blocking. 3. Recheck rates on the Bedrock pricing page OpenAI tab, and resolve any row still marked _unverified_. 4. Recheck whether the Price List API has gained GPT-5.x coverage; if it has, drop the caveat above and let `estimate-ai.md` price these models from the MCP. @@ -424,3 +458,9 @@ This model family is moving fast (two GA waves and a repricing inside 10 weeks). 2026), and GPT-6.1 Sol (GA Sep 29, 2026) are all confirmed on Bedrock with their own model cards and pricing tables. New discovery this refresh: a 6x-Standard **Ultrafast** service tier on Astra and 6.1 Sol only (Sol and Luna remain Standard-only) — the first new tier shape since this file started tracking the family. +9. **2026-11-06 refresh — GPT-5.5 / GPT-5.4 re-read.** Item 5 fired again: both cards now list `bedrock-runtime` + (Responses, Chat Completions, Converse via `us.` / `global.` CRIS ids; no in-region runtime form), Chat + Completions on `bedrock-mantle`, a 1,050,000-token context window with 128,000 max output, a long-context + (>272K) price tier, implicit prompt caching on runtime Responses, and a GovCloud (US-West) GPT-5.4 rate of + 3.375 · 20.25. Earlier "mantle-only / no CRIS / 272K / no long-context tier" claims for these two models were + stale and are corrected throughout this file. diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md index a819dc895..d457a12a9 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md @@ -48,9 +48,9 @@ Inference on `bedrock-mantle` for these models is governed by **two per-model, p | Medium | Medium | Monitor 429s against **token** throughput, not request rate; enable prompt caching | | High | High | Enable prompt caching first (cached input is exempt from input TPM), then request a quota increase | -**The `bedrock-runtime` fallback exists only for GPT-5.6 and GPT-6 (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra).** GPT-5.5 and GPT-5.4 are `bedrock-mantle` only and in-region only — for them, "switch to `bedrock-runtime`" requires moving to a different model (Bedrock-native or `gpt-oss`), a model change with its own eval cost. GPT-5.6 Sol/Terra/Luna and GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra DO have a `bedrock-runtime` path via CRIS inference profiles (GPT-5.6 `us.`/`in.`/`global.`, GPT-6 `us.`/`global.` prefixed ids; the model cards recommend runtime for new applications) — a legitimate endpoint option with its own quota family, and on Global CRIS it is also the cost-parity option. Scaling levers on the mantle path, in order: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Terra and Luna (`us.`/`in.`/`global.`), and `us.`/`global.` only for GPT-5.6 Sol, GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra, and GPT-5.5 / GPT-5.4 (the GPT-5.6 Sol card lists no `in.` profile; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: -1. Prompt caching (GPT-5.6 and GPT-6 only) — 90% off cached input and exempt from the input-TPM quota +1. Prompt caching (GPT-5.6 and GPT-6 on mantle; GPT-5.5 / GPT-5.4 list implicit caching on `bedrock-runtime` Responses only) — 90% off cached input and exempt from the input-TPM quota 2. Exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK) 3. Spreading load across minutes and ramping request rate gradually rather than bursting 4. A Service Quotas increase for that model's input/output TPM in that region @@ -108,8 +108,8 @@ Claude models on Mantle have an additional **output TPM cap** that differs by mo - For Claude migrations at medium/high volume: the 2M output TPM cap on Claude 4.7+ is the binding constraint - For OpenAI proprietary GPT targets: this Claude cap does not apply. Use the GPT-5.x mantle quotas or - Astra-specific verification above. Astra / GPT-5.6 have runtime CRIS alternatives with their own - quotas; GPT-5.5/5.4 have no runtime path + Astra-specific verification above. Astra / GPT-5.6 / GPT-5.5 / GPT-5.4 all have runtime CRIS alternatives + with their own quotas (`us.`/`global.` prefixed ids; no runtime in-region form) - For `gpt-oss` targets: these do run on `bedrock-runtime`, so standard account TPM limits and the Converse-path mitigations apply - When output-heavy workloads (long JSON, tool outputs, multi-step reasoning) are detected, flag the relevant cap prominently; recommend `bedrock-runtime` for production **only** when the target model actually has a `bedrock-runtime` path diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md index 36ff7072d..b1a32c0d4 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md @@ -39,11 +39,18 @@ Two consequences that invert the previous decision logic: 1. **When the source model is on Bedrock, keep it.** A same-model move has no behavior delta to validate, no prompt re-engineering, and no eval regression risk — the migration is an endpoint and credential change, not a model change. This is the default recommendation. -2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.x In-Region and Geo +2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.6 In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when - the workload has no data-residency constraint (GPT-5.5 / GPT-5.4 have no CRIS at all). See - `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, + the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on + `bedrock-runtime`, but their model cards (read 2026-11-07) publish **commercial In-Region prices only** + ("Commercial In-Region prices include a 10% fee over OpenAI rates") — nothing on either card establishes a + Geo or Global CRIS price. So the verified ~10% premium for GPT-5.5 / GPT-5.4 is scoped to the commercial + In-Region (mantle) option. For a GPT-5.5 / GPT-5.4 CRIS plan, either source the Geo/Global rate separately + (the card's inference-option table or [aws.amazon.com/bedrock/pricing](https://aws.amazon.com/bedrock/pricing/), + with URL and read date) or report the comparison unavailable; an In-Region rate used as a proxy is an + **unverified planning assumption**, labelled as such, and yields no verified premium or savings percentage. + Never report parity for them. See `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, prompt caching, one vendor relationship — carries the in-region path; never present that path as free or neutral. For Astra, use its separately dated Bedrock rates and verify the source provider's rate before comparing. @@ -72,14 +79,15 @@ GPT-5.4, the target is **the same model on Bedrock**. | GPT-5.6 Sol | GPT-5.6 Sol | `openai.gpt-5.6-sol` / `us.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Terra | GPT-5.6 Terra | `openai.gpt-5.6-terra` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Luna | GPT-5.6 Luna | `openai.gpt-5.6-luna` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | -| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | -| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | +| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | Then apply the **region gate** below. Record `model_change: false` and the chosen path in `aws-design-ai.json` → `ai_architecture.code_migration`: `migration_path: "mantle_openai_chat"` for -Astra sources using Chat Completions, or `"mantle_openai_responses"` for a selected Mantle Responses -path. Use `migration_path: "runtime_openai_cris"` when a GPT-6 / GPT-5.6 target is served via -`bedrock-runtime` with a CRIS id (the model cards recommend runtime for new applications). +sources using Chat Completions on a model whose card lists it on mantle (GPT-6, GPT-5.5, GPT-5.4), or +`"mantle_openai_responses"` for a selected Mantle Responses path. Use `migration_path: "runtime_openai_cris"` +when a GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 target is served via `bedrock-runtime` with a CRIS id (the model +cards recommend runtime for new applications). Report the assessment honestly: `strong_migrate` here means "low-risk, well-supported move", not "cheaper". @@ -105,14 +113,16 @@ regions — offer it, stating the data-residency implication of cross-region rou Global routes anywhere and is the cost-parity option). Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through to Tier 1. -**GPT-5.5 / GPT-5.4:** hard gate. Mantle in-region only, no CRIS, no fallback. If the target region is not in the -matrix: +**GPT-5.5 / GPT-5.4:** same shape as GPT-5.6, with a narrower mantle matrix (GPT-5.5: us-east-1, us-east-2; +GPT-5.4: us-east-1, us-east-2, us-west-2, us-gov-west-1 — per their model cards, read 2026-11-06). If the target +region is in that matrix, either endpoint works. Otherwise the `bedrock-runtime` CRIS path (`us.openai.gpt-5.5` / +`global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`) reaches it, with the same data-residency +caveat as GPT-5.6 (Geo stays within the geography, Global routes anywhere). There is no runtime in-region form. +Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through: -1. Prefer offering a **region change** to a supported region, if no data-residency constraint pins the workload. - This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. -2. If the region is fixed, also offer **upgrading within the vendor to GPT-5.6** (which reaches the region via - CRIS) alongside the cross-family option — a generation change, but same vendor and prompt idioms. -3. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. +1. Prefer offering a **region change** to a supported mantle region, if no data-residency constraint pins the + workload. This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. +2. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. Record the outcome in `regional_warnings[]`. @@ -236,10 +246,11 @@ model on price. ### Open-weight gpt-oss -`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and, unlike the -proprietary GPT models, **do** support `bedrock-runtime` / Converse. They sit a capability class below the GPT-5.x -frontier tier. Recommend them when the user wants OpenAI-architecture models on the Bedrock-native runtime surface -(for Guardrails, invocation logging, or Converse-based tooling) rather than through mantle. +`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and support +`bedrock-runtime` / Converse with a bare model ID (no CRIS profile needed) and `Invoke`, which the proprietary GPT +models do not. They sit a capability class below the GPT-5.x frontier tier. Recommend them when the user wants +OpenAI-architecture models on the Bedrock-native runtime surface (for Guardrails, invocation logging, or +Converse-based tooling) at the lowest price rather than through mantle. --- @@ -285,7 +296,7 @@ rather than dismissing it. For a long-context (>272K) workload the gap is much w | Chat Completions | Preserve supported Chat when selected | Reshape only for a selected API change; verify the model and endpoint | | Function calling | Supported on GPT-5.x via mantle; Claude tools via Converse | Same-model keeps tool semantics identical | | Reasoning effort | `reasoning={"effort": ...}` on mantle | `none` / `low` / `medium` / `high` / `xhigh` / `max` | -| Prompt caching | GPT-5.6 only (90% off cached input) | Not listed for GPT-5.5 / 5.4; Claude has its own caching | +| Prompt caching | GPT-5.6 (90% off cached input); GPT-5.5 / 5.4 implicit caching on `bedrock-runtime` Responses only | GPT-5.5 / 5.4 cards (read 2026-11-06) list a cache-read rate and implicit caching on runtime, none on mantle; Claude has its own caching | | Streaming | Supported | Verify per surface | | Vision | GPT-5.x (image input) or Claude / Nova | Same-model preserves behavior | | JSON mode | Claude (excellent), Nova Pro (good) | Most models via prompt | @@ -340,11 +351,12 @@ and closed to new customers as of July 30, 2026. ### When to prefer a Bedrock-native model over the mantle GPT path Choose Claude / Nova via Converse when the workload needs Knowledge Bases, intelligent prompt routing, structured -outputs, or application inference profiles — none of which the GPT path offers. Note what no longer forces a family -switch for GPT-5.6: its `bedrock-runtime` CRIS path provides cross-region inference, invocation logs, and -Guardrails (Converse API only; prompt caching is Responses-only on runtime). For GPT-5.5 / GPT-5.4, Guardrails, -logging, and cross-region reach still require a different model. The mantle GPT path is the smallest change; the -Bedrock-native path remains the most feature-complete. +outputs, or application inference profiles — none of which the mantle GPT path offers. Note what no longer forces +a family switch for GPT-5.6, GPT-5.5 and GPT-5.4: their `bedrock-runtime` CRIS paths provide cross-region +inference, invocation logs, Guardrails and application inference profiles (both Converse API only), and +structured outputs and implicit prompt caching (both Responses API only) — per the GPT-5.4 / GPT-5.5 model cards +read 2026-11-06. Knowledge Bases and intelligent prompt routing still require a Bedrock-native model. The mantle +GPT path is the smallest change; the Bedrock-native path remains the most feature-complete. ### High-spend tiering @@ -365,8 +377,8 @@ alternative, not against the source provider. cheaper and exempt from the input-TPM quota, which relieves the binding constraint on mantle. **Very high (>100M tokens/day):** tiering plus caching. Check TPM headroom per model per region early; there is no -RPM quota and no `bedrock-runtime` fallback for GPT models, so quota increases are the scaling lever. See -`shared/ai-migration-guardrails.md`. +RPM quota, and the `bedrock-runtime` CRIS path for GPT-5.6 / 5.5 / 5.4 / GPT-6 carries its own quotas rather than +adding headroom to mantle, so quota increases are the scaling lever. See `shared/ai-migration-guardrails.md`. --- diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md index 5256f8977..a4ec1d447 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle only; no 1M tier) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle only; no 1M tier) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 11.00/49.50; card read 2026-11-07) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 5.50/24.75; card read 2026-11-07) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | @@ -353,17 +353,24 @@ Regions (mantle): us-east-1 / us-east-2 for all five; us-west-2 additionally car | GPT-5.5 | 5.50 | 33.00 | — | 0.55 | | GPT-5.4 | 2.75 | 16.50 | — | 0.275 | -#### Long context (1M) — GPT-5.6 only, 2.0x input / 1.5x output - -| Model | Input $/1M | Output $/1M | -| ------------- | ---------- | ----------- | -| GPT-5.6 Sol | 8.80 | 33.00 | -| GPT-5.6 Terra | 4.40 | 19.80 | -| GPT-5.6 Luna | 0.44 | 1.98 | - -A workload above 272K context must be priced at the long-context tier. GPT-5.5 and GPT-5.4 have no such tier, so -their usable window is 272K. Global CRIS is published at OpenAI's standard list price (cost parity, GPT-5.6 only — -see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. +#### Long context (>272K input tokens) — GPT-5.6 at 2.0x input / 1.5x output; GPT-5.5 / GPT-5.4 per their model cards + +| Model | Input $/1M | Output $/1M | Cache read $/1M | +| ------------- | ---------- | ----------- | --------------- | +| GPT-5.6 Sol | 8.80 | 33.00 | — | +| GPT-5.6 Terra | 4.40 | 19.80 | — | +| GPT-5.6 Luna | 0.44 | 1.98 | — | +| GPT-5.5 | 11.00 | 49.50 | 1.10 | +| GPT-5.4 | 5.50 | 24.75 | 0.55 | + +A workload above 272K input tokens must be priced at the long-context tier, applied to all input and output tokens +of the request. GPT-5.5 and GPT-5.4 rows read from their model cards on 2026-11-06 +([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), +[GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)); both cards state a +1,050,000-token context window (128,000 max output) and list `us.`/`global.` CRIS ids on `bedrock-runtime`, but +publish the In-Region inference option only. Global CRIS is published at OpenAI's standard list price (cost parity, +GPT-5.6 only — see `openai-on-bedrock.md`). GovCloud (US-West) GPT-5.4 short-context is 3.375 / 20.25 (cache read +0.3375) per the 2026-11-06 card; an earlier revision recorded 3.30 / 19.80. > **One source conflict.** These models are absent > from the AWS Price List API entirely: querying `AmazonBedrock` returns only `gpt-oss` and GPT OSS Safeguard, and @@ -373,7 +380,8 @@ see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. **Prompt caching (GPT-5.6 only):** cached input read at a 90% discount, cache write at 1.25x uncached input, minimum 1,024-token prefix, up to 4 breakpoints, ≥30-minute retention. Cached input is exempt from the input-TPM quota. -GPT-5.5 and GPT-5.4 do not list prompt caching support. +GPT-5.5 and GPT-5.4 list only implicit prompt caching on `bedrock-runtime` Responses (automatic, no request +parameters; cache-read rate above, no cache-write rate) and none on mantle (model cards read 2026-11-06). #### Open-weight gpt-oss diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md index cdf8ced55..c82a8eebc 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md @@ -190,12 +190,18 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` ## migration_path vocabulary `mantle_openai_responses` (an OpenAI-protocol source — direct or Azure-fronted — with the model -on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `converse` -(Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when a proprietary GPT -model must move off mantle for Guardrails / Knowledge Bases / logging / an unsupported region) · -`gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic -Bedrock SDK swap). A proprietary `openai.gpt-*` model ID is NEVER paired with a -`converse`/`bedrock-runtime` path — those models are mantle-only. +on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` +(same, preserving a Chat Completions source on a model whose card lists Chat Completions on +mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via +`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-5.6 Terra +and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native +Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, +intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` +(OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK +swap). A **bare** proprietary `openai.gpt-*` model ID is NEVER paired with a +`converse`/`bedrock-runtime` path — bare ids are mantle ids; every proprietary GPT target on +`bedrock-runtime` carries a CRIS-prefixed id (there is no runtime in-region form for GPT-6, +GPT-5.6, GPT-5.5 or GPT-5.4). ## regional_validation @@ -255,8 +261,10 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `price_comparison`. - [ ] `honest_assessment` overall is the weakest across `bedrock_models[]`; if `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. -- [ ] No `bedrock_models[]` entry pairs a proprietary `openai.gpt-*` model ID with a - `converse`/`bedrock-runtime` migration path (mantle-only). +- [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a + `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` + target carries a CRIS id: `us.`/`in.`/`global.` for GPT-5.6 Terra / Luna; `us.`/`global.` only + for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/SKILL.md b/plugins/aws-startup-advisor/skills/llm-to-bedrock/SKILL.md index b9b85688c..469c4f3e9 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/SKILL.md +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/SKILL.md @@ -1197,7 +1197,7 @@ Tell the user, before collecting models: > - **OpenAI on Bedrock comes in a few forms, all real** — and which endpoint they use is per-ID, not one blanket rule: > - *Open-weight* `gpt-oss` (`openai.gpt-oss-20b-1:0`, `openai.gpt-oss-120b-1:0`) → `bedrock-runtime` via `bedrock:InvokeModel` / `Converse` (its Responses API is also offered on `bedrock-mantle`). > - *Bare proprietary* GPT ids (`openai.gpt-5*`, not `gpt-oss`) → probed on the `bedrock-mantle` endpoint (Responses API). -> - A *GPT-5.6 CRIS profile* id prefixed `us.` / `in.` / `global.` (e.g. `global.openai.gpt-5.6-sol`) → a `bedrock-runtime` target where Converse is supported. +> - A *CRIS profile* id prefixed `us.` / `in.` / `global.` (e.g. `global.openai.gpt-5.6-sol`, `us.openai.gpt-5.4`, `global.openai.gpt-6-astra`) → a `bedrock-runtime` target where Converse is supported; every proprietary GPT model on Bedrock (GPT-5.6, GPT-6, GPT-5.5, GPT-5.4) has this form, and none has a runtime in-region form. > - The `bedrock-mantle` path uses a **separate** action set — `bedrock-mantle:*` (e.g. the `AmazonBedrockMantleInferenceAccess` managed policy: `bedrock-mantle:CreateInference` + `CallWithBearerToken`) — distinct from `bedrock:InvokeModel`. The preflight decides per model; don't assume. > - What is **not** on Bedrock is calling OpenAI's own hosted API at api.openai.com — that stays with OpenAI. 'GPT on Bedrock' means the AWS-served models above, reached through AWS endpoints and IAM. > @@ -1285,8 +1285,9 @@ Then, per B4's branch table: after they enable it. This is the common, expected outcome for a user who came here to "get access." - `reason: authz` → access is enabled but IAM denies inference. Name the action to grant — for a - standard model `bedrock:InvokeModel`; for a mantle-only `openai.gpt-5*` target (bare proprietary - GPT, not `gpt-oss`) the `bedrock-mantle:*` set (see **B4a**). The `detail` says which — follow it + standard model `bedrock:InvokeModel`; for a bare `openai.gpt-5*` / `openai.gpt-6*` mantle target + (bare proprietary GPT, not `gpt-oss`, not a `us.`/`in.`/`global.` CRIS id) the `bedrock-mantle:*` + set (see **B4a**). The `detail` says which — follow it rather than guessing from the ID, since gpt-oss fails on `bedrock:InvokeModel`, not mantle. - `reason: model_unavailable` → the ID isn't offered in `$REGION`. Use the `resolve-bedrock-model-id` procedure to suggest a cross-region inference-profile ID or a diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/behavior-delta-detection/references/openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/behavior-delta-detection/references/openai-to-bedrock.md index 1e10c877f..b5f0418e3 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/behavior-delta-detection/references/openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/behavior-delta-detection/references/openai-to-bedrock.md @@ -29,7 +29,7 @@ for OpenAI-compatible runtime calls, CRIS ids, and runtime IAM permissions. Astr - `resolution_kind`: `ux_choice` - Source (OpenAI): `client.chat.completions.create(...)`, `messages=[...]`, reads `choices[0].message.content` - Target (mantle GPT): `client.responses.create(...)`, `input=...`, reads `output_text` -- Chat Completions support is **model-specific, not uniformly unverified.** All four GPT-6 models (Astra, Sol, Luna, 6.1 Sol) and the GPT-5.6 family (Sol, Terra, Luna) list `Chat Completions` as a supported API on both `bedrock-mantle` and `bedrock-runtime` CRIS (per their model cards — see `openai-on-bedrock.md` § Access Paths). For these models, a Chat Completions source MAY keep `chat.completions.create` and `choices[0].message` parsing unchanged — **reshape to Responses is OPTIONAL**, driven only by a Responses-only feature (runtime prompt caching, reasoning-item round-trips on `bedrock-runtime`) or a demonstrated account-specific constraint, not by a blanket assumption that Chat Completions is unsupported. For GPT-5.5 / GPT-5.4 (mantle-only, no CRIS) Chat Completions support is still unconfirmed on their model cards — treat those two as requiring a reshape to Responses, and probe the target account before committing. +- Chat Completions support is **model-specific, not uniformly unverified.** All four GPT-6 models (Astra, Sol, Luna, 6.1 Sol) and the GPT-5.6 family (Sol, Terra, Luna) list `Chat Completions` as a supported API on both `bedrock-mantle` and `bedrock-runtime` CRIS (per their model cards — see `openai-on-bedrock.md` § Access Paths). For these models, a Chat Completions source MAY keep `chat.completions.create` and `choices[0].message` parsing unchanged — **reshape to Responses is OPTIONAL**, driven only by a Responses-only feature (runtime prompt caching, reasoning-item round-trips on `bedrock-runtime`) or a demonstrated account-specific constraint, not by a blanket assumption that Chat Completions is unsupported. GPT-5.5 / GPT-5.4 follow the same rule: their model cards (read 2026-11-06 — [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) list `Chat Completions` as supported on both `bedrock-mantle` and `bedrock-runtime` (`us.`/`global.` CRIS ids), so the reshape is OPTIONAL for them too. Plan a reshape only when the selected model's card leaves Chat Completions unchecked on the selected endpoint, and probe the target account before committing, as for any model. ### detect_grep @@ -66,7 +66,7 @@ grep -rEn 'function_call_output|tool_call' --include="*.py" --include="*. ## prompt-caching-availability - `resolution_kind`: `impl_path` -- Prompt caching is listed as supported on GPT-5.6 and GPT-6 only. Do not emit caching configuration for `openai.gpt-5.5` or `openai.gpt-5.4`. +- Prompt caching with request parameters (explicit mode) is listed on GPT-5.6 and GPT-6 only. The GPT-5.5 / GPT-5.4 cards (read 2026-11-06) list only implicit caching on `bedrock-runtime` Responses (automatic, no request parameters) and none on mantle — do not emit caching configuration for `openai.gpt-5.5` or `openai.gpt-5.4` on either endpoint. - Astra lists implicit and explicit prompt caching on mantle Responses, with **30-minute cache-write** rates. Do not inherit GPT-5.6's minimum-prefix, breakpoint, or cached-input quota-exemption rules. diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/resolve-bedrock-model-id/resolve-bedrock-model-id.md b/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/resolve-bedrock-model-id/resolve-bedrock-model-id.md index f64dc9fef..f2da1fd11 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/resolve-bedrock-model-id/resolve-bedrock-model-id.md +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/resolve-bedrock-model-id/resolve-bedrock-model-id.md @@ -50,9 +50,13 @@ aws bedrock list-foundation-models \ **Check this before Step 1.** Route by family and endpoint (GPT-5 verified 2026-08-21; Astra regions verified 2026-09-30; see `gcp-to-aws/references/shared/openai-on-bedrock.md`): -**Case A — GPT-5.5 / GPT-5.4 (`openai.gpt-5.5`, `openai.gpt-5.4`): mantle-only, no inference profile.** The -inference-profile path below cannot resolve them — `list-inference-profiles` never returns them, and Step 3's token -ranking would end in a spurious `blocked` for a perfectly valid id. Validate against the model catalog instead: +**Case A — bare GPT-5.5 / GPT-5.4 ids (`openai.gpt-5.5`, `openai.gpt-5.4`) when the plan targets the mantle +endpoint: bare mantle id, not an inference profile.** The inference-profile path below cannot resolve the bare form — +`list-inference-profiles` returns only the CRIS-prefixed ids (`us.openai.gpt-5.5`, `global.openai.gpt-5.5`, +`us.openai.gpt-5.4`, `global.openai.gpt-5.4`, per the model cards read 2026-11-06), never the bare mantle id — and +Step 3's token ranking would end in a spurious `blocked` for a perfectly valid id. (When the plan targets +`bedrock-runtime` for GPT-5.5 / GPT-5.4, the CRIS id flows through Case B and Steps 1–5 like GPT-5.6.) Validate the +bare id against the model catalog instead: ```bash aws bedrock list-foundation-models \ @@ -69,7 +73,7 @@ aws bedrock list-foundation-models \ this catalog's `modelId` + `modelName` pairs instead of against inference profiles. **Do this check before falling through to Step 1** — a friendly name like `"OpenAI GPT-5.5"` (tokens `{openai, gpt, 5}`) has full token overlap with `openai.gpt-5.5`'s own id (`{openai, gpt, 5}`) and would otherwise fall through to Step 1's - `list-inference-profiles`, which never lists a mantle-only model — the free-text input would then reach Step 3's + `list-inference-profiles`, which never lists a bare mantle id — the free-text input would then reach Step 3's ranking with zero candidates and dead-end at `blocked` with no matches shown, even though the foundation catalog had the exact model the whole time. A single candidate with full token overlap on the model-identifying tokens (excluding generic tokens like a bare `gpt`) → surface it as the ONE candidate through Step 4 exactly as an @@ -78,24 +82,27 @@ aws bedrock list-foundation-models \ list alongside any inference-profile candidates Steps 1–3 separately produce; do not silently drop either source. - **No match at all (exact or token) and `plan_model_id` looked ID-shaped, not free-text** → not enabled or not available in this region. Return `blocked` with `reason: model_unresolvable`, putting the region and the - `openai.*` ids that _were_ returned in `detail`. These two models have no CRIS, so the remedy is a region change - or a different model — never an inference-profile prefix. + `openai.*` ids that _were_ returned in `detail`. Do not silently add an inference-profile prefix to rescue a + mantle plan: the remedy is a region change, a different model, or a plan change to the `bedrock-runtime` CRIS + path (`us.` / `global.` ids, Case B) — a decision for the plan, not for this resolver. - CLI failure / missing `bedrock:ListFoundationModels` → `blocked` with `reason: model_unresolvable` and the exact error in `detail`, rather than guessing. -These two need `bedrock-mantle:*` IAM actions (e.g. `AmazonBedrockMantleInferenceAccess`), not +The bare ids need `bedrock-mantle:*` IAM actions (e.g. `AmazonBedrockMantleInferenceAccess`), not `bedrock:InvokeModel`; resolution success does not imply invoke authorization. **A free-text name that does NOT token-match this catalog** (e.g. `"anthropic claude haiku"`, `"Nova Micro"`) -continues to Step 1 as before — this catalog check only short-circuits the specific case a mantle-only model would +continues to Step 1 as before — this catalog check only short-circuits the specific case a bare mantle id would otherwise be unreachable from free text; it is not a replacement for Step 1's inference-profile search for every other provider/model. -**Case B — GPT-5.6 and GPT-6 (`openai.gpt-5.6-sol` / `-terra` / `-luna`, `openai.gpt-6-astra` / `-sol` / `-luna`, -`openai.gpt-6.1-sol`, or already `us.` / `in.` / `global.` prefixed): BOTH paths exist.** The bare id is the mantle -form; `bedrock-runtime` serves these models through CRIS inference profiles (`us.openai.gpt-5.6-*` / -`us.openai.gpt-6-*`, `in.openai.gpt-5.6-*` in India Regions, `global.openai.gpt-5.6-*` / `global.openai.gpt-6-*`), -which `list-inference-profiles` DOES return. Route on the plan's intent: +**Case B — GPT-5.6, GPT-6, and GPT-5.5 / GPT-5.4 on `bedrock-runtime` (`openai.gpt-5.6-sol` / `-terra` / `-luna`, +`openai.gpt-6-astra` / `-sol` / `-luna`, `openai.gpt-6.1-sol`, `openai.gpt-5.5` / `openai.gpt-5.4` with a runtime +plan, or already `us.` / `in.` / `global.` prefixed): BOTH paths exist.** The bare id is the mantle form; +`bedrock-runtime` serves these models through CRIS inference profiles (`us.openai.gpt-5.6-*` / `us.openai.gpt-6-*` / +`us.openai.gpt-5.5` / `us.openai.gpt-5.4`, `in.openai.gpt-5.6-*` in India Regions, `global.openai.gpt-5.6-*` / +`global.openai.gpt-6-*` / `global.openai.gpt-5.5` / `global.openai.gpt-5.4`), which `list-inference-profiles` DOES +return. Route on the plan's intent: - Plan targets the mantle endpoint (`migration_path` starts with `mantle`, or the id is bare) → validate the bare id against the model catalog exactly as in Case A. @@ -217,9 +224,9 @@ stops on abort. - This skill is idempotent: calling it twice with the same already-validated ID will hit Step 0 (documented bare-ID route) or Step 2 (inference profile) and return immediately. - Steps 1–5 assume the target is a `bedrock-runtime` model reachable through an - inference profile. Mantle-only ids (GPT-5.5/5.4, and GPT-5.6 when the plan - targets the mantle endpoint), and London in-region Opus 5.5, are handled entirely in Step 0; GPT-5.6/GPT-6 CRIS ids - flow through Steps 1–5 like any other inference profile. See + inference profile. Bare mantle ids (any proprietary GPT model — GPT-5.5/5.4, GPT-5.6, GPT-6 — when the plan + targets the mantle endpoint), and London in-region Opus 5.5, are handled entirely in Step 0; GPT-5.6/GPT-6 and + GPT-5.5/5.4 CRIS ids flow through Steps 1–5 like any other inference profile. See `$ASSESS_BASE/references/shared/openai-on-bedrock.md` for the authoritative family split. - Output of this skill should replace the plan's `target_model_id` in the diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/bedrock_pricing.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/bedrock_pricing.py index 7ab37804b..6530c758b 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/bedrock_pricing.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/bedrock_pricing.py @@ -90,7 +90,11 @@ def parse_price_dimensions(price_item: dict) -> dict: # price — cost PARITY, for workloads with no residency constraint # The GPT-5.6 family also has a LONG-CONTEXT (1M) tier at 2.0x input / 1.5x # output per option, NOT represented here — a >272K workload priced from this - # table is understated. GPT-5.5 and GPT-5.4: mantle-only, no CRIS, no 1M tier. + # table is understated. GPT-5.5 and GPT-5.4 (model cards read 2026-11-06) also + # have a long-context (>272K) tier (5.5: 11.00/49.50; 5.4: 5.50/24.75 per 1M), + # likewise NOT represented here. Their cards publish the In-Region option only; + # the us./global. CRIS ids they list on bedrock-runtime carry no separate price + # row, so no prefixed GPT-5.5/5.4 entries are added below until one is published. "openai.gpt-5.6-sol": {"input_per_1k_usd": 0.0044, "output_per_1k_usd": 0.022}, "openai.gpt-5.6-terra": {"input_per_1k_usd": 0.0022, "output_per_1k_usd": 0.0132}, "openai.gpt-5.6-luna": {"input_per_1k_usd": 0.00022, "output_per_1k_usd": 0.00132}, @@ -135,9 +139,12 @@ def parse_price_dimensions(price_item: dict) -> dict: def is_mantle_gpt(model_id: str) -> bool: - """Pure: OpenAI's proprietary GPT models (GPT-5.5/5.4/5.6 and GPT-6 - Astra/Sol/Luna/6.1 Sol), which the AWS PriceList API does not carry. The - open-weight gpt-oss models ARE in the PriceList API and must not match.""" + """Pure: BARE ids of OpenAI's proprietary GPT models (GPT-5.5/5.4/5.6 and GPT-6 + Astra/Sol/Luna/6.1 Sol) — the bedrock-mantle id form — which the AWS PriceList + API does not carry. The `us.`/`in.`/`global.` CRIS forms (bedrock-runtime; GPT-5.5 + and 5.4 have `us.`/`global.` ids too) do not match here; callers pair this with + an explicit prefixed-id regex. The open-weight gpt-oss models ARE in the + PriceList API and must not match.""" mid = model_id.lower() return (mid.startswith("openai.gpt-5") or mid.startswith("openai.gpt-6")) and "oss" not in mid diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py index 5b56d2fd2..ce486b3ae 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py @@ -20,12 +20,14 @@ def is_inference_profile(model_id: str) -> bool: def is_mantle_model(model_id: str, region: str = "") -> bool: """True for bare proprietary GPT-5/GPT-6 IDs and the bare Opus 5.5 ID, which use - bedrock-mantle (Responses and Messages respectively). They need + bedrock-mantle (Responses/Chat Completions and Messages respectively). They need `bedrock-mantle:*` actions — a policy granting only `bedrock:InvokeModel` against a foundation-model ARN cannot authorize these bare IDs. Opus 5.5 in eu-west-2 is a runtime in-region target (model card verified 2026-10-03); its other bare-ID regions use Mantle. - Their prefixed forms use runtime instead. + The `us.`/`in.`/`global.` prefixed forms use bedrock-runtime instead — for every + proprietary GPT model, GPT-5.5/5.4 included (their model cards list `us.`/`global.` + CRIS ids; none has a runtime in-region form), so a prefixed id must NOT match. The open-weight gpt-oss models DO use bedrock-runtime and must not match.""" mid = model_id.lower() return ((mid.startswith("openai.gpt-5") or mid.startswith("openai.gpt-6")) and "oss" not in mid) or ( @@ -59,8 +61,9 @@ def inference_profile_arn(model_id: str, region: str, account_id: str) -> str: def default_project_arn(region: str, account_id: str) -> str: """ARN for the default Bedrock project, scoped to the account/region. - Required alongside the inference-profile ARN for a GPT-6 CRIS id on - bedrock-runtime: every GPT-6 model card's "Call the model" section grants + Required alongside the inference-profile ARN for a GPT-6 CRIS id and for the + GPT-5.5 / GPT-5.4 CRIS ids on bedrock-runtime: every GPT-6 model card's "Call + the model" section, and the GPT-5.4 / GPT-5.5 cards (read 2026-11-07), grant `bedrock:InvokeModel` on both the inference-profile ARN and this ARN.""" return f"arn:{_partition(region)}:bedrock:{region}:{account_id}:project/default" @@ -75,6 +78,35 @@ def is_gpt6_cris_model(model_id: str) -> bool: return base_id.startswith("openai.gpt-6") +# The exact bedrock-runtime ids the GPT-5.4 / GPT-5.5 model cards list (read +# 2026-11-07: us. and global. only — no in. or in-region form). Both cards say the +# identity "also needs bedrock:InvokeModel on your account's default project +# (arn:aws:bedrock:{region}:{account-id}:project/default) in addition to the +# inference profile". +_GPT54_55_CRIS_IDS = frozenset({ + "us.openai.gpt-5.4", + "global.openai.gpt-5.4", + "us.openai.gpt-5.5", + "global.openai.gpt-5.5", +}) + + +def is_gpt54_55_cris_model(model_id: str) -> bool: + """True for exactly `us.`/`global.openai.gpt-5.4` / `-5.5`, as a short id or as + an `arn:...:inference-profile/` ARN. The bare `openai.gpt-5.4` / `-5.5` ids + (mantle) and every other model, GPT-5.6 CRIS ids included, do NOT match.""" + if not is_inference_profile(model_id): + return False + return model_id.rsplit("/", 1)[-1].lower() in _GPT54_55_CRIS_IDS + + +def requires_default_project_grant(model_id: str) -> bool: + """True when the model card for this runtime CRIS id requires + `bedrock:InvokeModel` on the default project ARN alongside the + inference-profile ARN: every GPT-6 CRIS id, and the GPT-5.5 / GPT-5.4 ones.""" + return is_gpt6_cris_model(model_id) or is_gpt54_55_cris_model(model_id) + + def generate_policy(model_ids: list[str], region: str, account_id: str) -> dict: """Build a scoped IAM policy covering exactly the given model IDs. @@ -100,11 +132,12 @@ def generate_policy(model_ids: list[str], region: str, account_id: str) -> dict: resources.append(inference_profile_arn(mid, region, account_id)) base_id = _GEO_PREFIX.sub("", mid.rsplit("/", 1)[-1]) resources.append(foundation_model_arn(base_id, region)) - # A GPT-6 CRIS id's model card "Call the model" section grants + # A GPT-6 CRIS id's model card "Call the model" section, and the + # GPT-5.5 / GPT-5.4 cards for their us./global. CRIS ids, grant # InvokeModel on the inference-profile ARN AND the default project # ARN — both are required, neither replaces the other. GPT-5.6 CRIS # ids and all other runtime targets keep the 2-ARN shape above. - if is_gpt6_cris_model(mid): + if requires_default_project_grant(mid): resources.append(default_project_arn(region, account_id)) else: resources.append(foundation_model_arn(mid, region)) diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/preflight_bedrock.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/preflight_bedrock.py index 2a4c031bb..fde343ece 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/preflight_bedrock.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/preflight_bedrock.py @@ -60,12 +60,15 @@ def is_embedding_model(model_id: str) -> bool: def is_mantle_model(model_id: str) -> bool: """Pure: ids that must be probed via the mantle Responses API rather than Converse/InvokeModel. Matches the BARE proprietary GPT ids (`openai.gpt-5*`, - `openai.gpt-6*` — covers GPT-5.5/5.4/5.6 and GPT-6 Astra/Sol/Luna/6.1 Sol), - which are mantle-served. Deliberately does NOT match: + `openai.gpt-6*` — covers GPT-5.5/5.4/5.6 and GPT-6 Astra/Sol/Luna/6.1 Sol). + The bare id is the bedrock-mantle form for every proprietary GPT model; none + of them has a bedrock-runtime in-region form. Deliberately does NOT match: - gpt-oss ids (Converse-capable on bedrock-runtime), and - - GPT-5.6/GPT-6 CRIS profile ids (`us.`/`in.`/`global.` prefixed) — those are - bedrock-runtime targets where Converse IS supported, so falling through to - the standard Converse probe is the correct behavior, not an accident.""" + - CRIS profile ids (`us.`/`in.`/`global.` prefixed) for any proprietary GPT + model, GPT-5.5/5.4 included (their model cards list `us.`/`global.` ids on + bedrock-runtime) — those are bedrock-runtime targets where Converse IS + supported, so falling through to the standard Converse probe is the + correct behavior, not an accident.""" mid = model_id.lower() return (mid.startswith("openai.gpt-5") or mid.startswith("openai.gpt-6")) and "oss" not in mid @@ -160,8 +163,8 @@ def classify_mantle_error(status: int | None, message: str) -> dict: f"Mantle is in-region only; for GPT-5.6 try a bedrock-runtime CRIS " f"id (us./in./global. prefixed); for GPT-6 Astra use us-east-1/us-west-2 " f"mantle or a supported us./global. runtime CRIS path. " - f"For GPT-5.5/5.4 switch to " - f"a supported region or a different model."} + f"For GPT-5.5/5.4 switch to a supported mantle region, a " + f"us./global. bedrock-runtime CRIS id, or a different model."} if status == 429: # Reaching a token-per-minute ceiling still proves we are authorized. return {"ok": True, "reason": "throttled_ok", diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py index 40be0ef0e..71533c209 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py @@ -295,6 +295,18 @@ def test_mantle_gpt_detection_excludes_gpt_oss(): assert bp.is_mantle_gpt("anthropic.claude-sonnet-4-6") is False +def test_mantle_gpt_detection_gpt54_55_bare_is_mantle_cris_is_runtime(): + # GPT-5.4 / GPT-5.5 model cards (read 2026-11-06) list us./global. CRIS ids on + # bedrock-runtime. is_mantle_gpt matches only the bare (mantle) id form; the + # prefixed runtime forms are handled by the callers' explicit CRIS regex. + assert bp.is_mantle_gpt("openai.gpt-5.4") is True + assert bp.is_mantle_gpt("openai.gpt-5.5") is True + assert bp.is_mantle_gpt("us.openai.gpt-5.4") is False + assert bp.is_mantle_gpt("global.openai.gpt-5.4") is False + assert bp.is_mantle_gpt("us.openai.gpt-5.5") is False + assert bp.is_mantle_gpt("global.openai.gpt-5.5") is False + + def test_mantle_gpt_detection_includes_bare_gpt6(): # Finding 1: bare GPT-6 ids must be recognized by the same detector that # routes GPT-5.x to the curated static table / mantle path. @@ -361,6 +373,29 @@ def test_all_five_proprietary_gpt_models_are_priced(): assert v["input_per_1k_usd"] > 0 and v["output_per_1k_usd"] > 0, mid +@pytest.mark.parametrize("model_id", [ + "us.openai.gpt-5.4", "global.openai.gpt-5.4", + "us.openai.gpt-5.5", "global.openai.gpt-5.5", + "arn:aws:bedrock:us-east-1:123456789012:inference-profile/us.openai.gpt-5.4", + "arn:aws:bedrock:us-east-1:123456789012:inference-profile/global.openai.gpt-5.5", +]) +def test_gpt54_55_cris_ids_are_unpriced_not_inferred_from_in_region(model_id, monkeypatch): + # PR 583 review: the GPT-5.4 / GPT-5.5 cards (read 2026-11-07) publish commercial + # In-Region prices only. Nothing establishes a Geo/Global CRIS rate, so a CRIS id + # must resolve to `available: false` — never to the bare In-Region row, and never + # via a live PriceList call that cannot carry these models. + import boto3 + + def boom(*a, **k): + raise AssertionError("must not call the PriceList API for a proprietary GPT CRIS id") + + monkeypatch.setattr(boto3, "client", boom) + v = bp.lookup("us-east-1", model_id) + assert v["available"] is False, model_id + assert v["input_per_1k_usd"] is None and v["output_per_1k_usd"] is None + assert "not in the static table" in v["note"] + + def test_all_four_gpt6_models_are_priced(): # Finding 4: GPT-6's bare ids previously had zero STATIC_FALLBACK entries, so # they fell through to the live Pricing API (which never carries OpenAI rows) diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py index 7544ad18c..bd1806ef2 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py @@ -12,10 +12,12 @@ foundation_model_arn, generate_policy, is_gpt6_cris_model, + is_gpt54_55_cris_model, is_mantle_model, mantle_project_arn, inference_profile_arn, is_inference_profile, + requires_default_project_grant, ) REGION = "us-east-1" @@ -126,6 +128,18 @@ def test_mantle_model_detection_excludes_gpt_oss(): assert is_mantle_model("anthropic.claude-sonnet-4-6") is False +def test_is_mantle_model_gpt54_55_cris_ids_are_runtime_not_mantle(): + # GPT-5.4 / GPT-5.5 model cards (read 2026-11-06) list us./global. CRIS ids on + # bedrock-runtime: the bare id needs bedrock-mantle:* actions, the prefixed id + # needs bedrock:InvokeModel against the inference-profile ARN. + assert is_mantle_model("openai.gpt-5.4") is True + assert is_mantle_model("openai.gpt-5.5") is True + assert is_mantle_model("us.openai.gpt-5.4") is False + assert is_mantle_model("global.openai.gpt-5.4") is False + assert is_mantle_model("us.openai.gpt-5.5") is False + assert is_mantle_model("global.openai.gpt-5.5") is False + + def test_is_mantle_model_matches_bare_gpt6_ids(): assert is_mantle_model("openai.gpt-6-astra") is True assert is_mantle_model("openai.gpt-6-sol") is True @@ -255,3 +269,91 @@ def test_bare_gpt6_mantle_id_still_yields_no_invoke_model_statement(self): pol = generate_policy(["openai.gpt-6-sol"], REGION, ACCOUNT) sids = {s["Sid"] for s in pol["Statement"]} assert "BedrockInvokeModelScoped" not in sids + + +_GPT54_55_CRIS_SHORT_IDS = [ + "us.openai.gpt-5.4", + "global.openai.gpt-5.4", + "us.openai.gpt-5.5", + "global.openai.gpt-5.5", +] + + +class TestGpt54Gpt55CrisProjectArn: + """PR 583 review: the GPT-5.4 / GPT-5.5 model cards (read 2026-11-07, + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html + and ...-gpt-55.html) say the IAM identity "also needs bedrock:InvokeModel on + your account's default project ... in addition to the inference profile" for + their us./global. runtime ids. The grant must cover exactly those ids.""" + + @pytest.mark.parametrize("model_id", _GPT54_55_CRIS_SHORT_IDS) + def test_predicates_match_short_ids(self, model_id): + assert is_gpt54_55_cris_model(model_id) + assert requires_default_project_grant(model_id) + assert not is_gpt6_cris_model(model_id) + + @pytest.mark.parametrize("model_id", _GPT54_55_CRIS_SHORT_IDS) + def test_predicates_match_system_profile_arns(self, model_id): + arn = f"arn:aws:bedrock:{REGION}:{ACCOUNT}:inference-profile/{model_id}" + assert is_gpt54_55_cris_model(arn) + assert requires_default_project_grant(arn) + + @pytest.mark.parametrize( + "model_id", + [ + "openai.gpt-5.4", # bare — mantle, not CRIS + "openai.gpt-5.5", + "us.openai.gpt-5.6-sol", # GPT-5.6 cards do not add the grant + "global.openai.gpt-5.6-terra", + "us.openai.gpt-5.4-pro", # not a published runtime id + "us.anthropic.claude-sonnet-5", + f"arn:aws:bedrock:{REGION}:{ACCOUNT}:inference-profile/us.anthropic.claude-sonnet-5", + ], + ) + def test_predicates_exclude_bare_mantle_gpt56_and_unrelated_ids(self, model_id): + assert not is_gpt54_55_cris_model(model_id) + assert not requires_default_project_grant(model_id) + + @pytest.mark.parametrize("model_id", _GPT54_55_CRIS_SHORT_IDS) + def test_generate_policy_grants_project_default_for_short_id(self, model_id): + pol = generate_policy([model_id], REGION, ACCOUNT) + assert [s["Sid"] for s in pol["Statement"]] == ["BedrockInvokeModelScoped"] + base = model_id.split(".", 1)[1] + assert set(pol["Statement"][0]["Resource"]) == { + f"arn:aws:bedrock:*::foundation-model/{base}", + f"arn:aws:bedrock:{REGION}:{ACCOUNT}:inference-profile/{model_id}", + default_project_arn(REGION, ACCOUNT), + } + + @pytest.mark.parametrize("model_id", _GPT54_55_CRIS_SHORT_IDS) + def test_generate_policy_grants_project_default_for_profile_arn(self, model_id): + arn = f"arn:aws:bedrock:{REGION}:{ACCOUNT}:inference-profile/{model_id}" + pol = generate_policy([arn], REGION, ACCOUNT) + resources = pol["Statement"][0]["Resource"] + assert arn in resources + assert default_project_arn(REGION, ACCOUNT) in resources + + @pytest.mark.parametrize("model_id", ["openai.gpt-5.4", "openai.gpt-5.5"]) + def test_bare_mantle_id_gets_mantle_statements_and_no_project_default(self, model_id): + pol = generate_policy([model_id], REGION, ACCOUNT) + sids = {s["Sid"] for s in pol["Statement"]} + assert "BedrockInvokeModelScoped" not in sids + assert "BedrockMantleInference" in sids + assert default_project_arn(REGION, ACCOUNT) not in json.dumps(pol) + + @pytest.mark.parametrize( + "model_id", + ["us.anthropic.claude-sonnet-5", "us.openai.gpt-5.6-sol", "global.openai.gpt-5.6-luna"], + ) + def test_unrelated_runtime_ids_do_not_get_project_default(self, model_id): + pol = generate_policy([model_id], REGION, ACCOUNT) + resources = pol["Statement"][0]["Resource"] + assert default_project_arn(REGION, ACCOUNT) not in resources + assert len(resources) == 2 + + def test_mixed_run_adds_project_default_once(self): + pol = generate_policy( + ["us.openai.gpt-5.4", "us.anthropic.claude-sonnet-5"], REGION, ACCOUNT + ) + resources = pol["Statement"][0]["Resource"] + assert resources.count(default_project_arn(REGION, ACCOUNT)) == 1 diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_preflight_bedrock.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_preflight_bedrock.py index 71f526976..3056e8b0a 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_preflight_bedrock.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_preflight_bedrock.py @@ -197,6 +197,18 @@ def test_mantle_model_detection_excludes_gpt_oss_and_cris_forms(): assert p.is_mantle_model("amazon.nova-lite-v1:0") is False +def test_is_mantle_model_gpt54_55_cris_ids_are_runtime_not_mantle(): + # GPT-5.4 / GPT-5.5 model cards (read 2026-11-06) list us./global. CRIS ids on + # bedrock-runtime. The ID-form rule already classifies them: bare id -> mantle + # probe, CRIS-prefixed id -> Converse probe. Lock that in for these two models. + assert p.is_mantle_model("openai.gpt-5.4") is True + assert p.is_mantle_model("openai.gpt-5.5") is True + assert p.is_mantle_model("us.openai.gpt-5.4") is False + assert p.is_mantle_model("global.openai.gpt-5.4") is False + assert p.is_mantle_model("us.openai.gpt-5.5") is False + assert p.is_mantle_model("global.openai.gpt-5.5") is False + + def test_is_mantle_model_matches_bare_gpt6_ids(): # Bare GPT-6 ids (Astra, Sol, Luna, 6.1 Sol) are mantle-served, same as the # bare GPT-5.x ids above. Their CRIS forms (us./global. prefixed) stay on the @@ -221,17 +233,20 @@ def test_mantle_authz_error_points_at_mantle_actions_not_invoke_model(): def test_mantle_model_unavailable_remedy_is_family_split(): - # Verified 2026-08-21: mantle itself is in-region only, but GPT-5.6 now has a - # bedrock-runtime CRIS path — so the 404 remedy must offer the CRIS form for - # 5.6 while making clear 5.5/5.4 have no prefixed form. An earlier version of - # this test asserted the opposite (never suggest a prefix), which matched the - # pre-2026-08-21 docs. + # Mantle itself is in-region only, but every proprietary GPT model has a + # bedrock-runtime CRIS path — GPT-5.6 (us./in./global., verified 2026-08-21) + # and GPT-5.5/5.4 (us./global., model cards read 2026-11-06). The 404 remedy + # must offer the CRIS form for all of them. An earlier version of this test + # asserted that 5.5/5.4 have no prefixed form, which matched the pre-2026-11-06 + # model cards. v = p.classify_mantle_error(404, "model not found") assert v["ok"] is False assert v["reason"] == "model_unavailable" assert "in-region only" in v["detail"] assert "CRIS" in v["detail"] and "us./in./global." in v["detail"] assert "GPT-5.5/5.4" in v["detail"] + assert "us./global. bedrock-runtime CRIS id" in v["detail"] + assert "different model" in v["detail"] def test_mantle_throttle_is_ok_for_preflight(): v = p.classify_mantle_error(429, "too many tokens per minute") diff --git a/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md b/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md index a819dc895..d457a12a9 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md @@ -48,9 +48,9 @@ Inference on `bedrock-mantle` for these models is governed by **two per-model, p | Medium | Medium | Monitor 429s against **token** throughput, not request rate; enable prompt caching | | High | High | Enable prompt caching first (cached input is exempt from input TPM), then request a quota increase | -**The `bedrock-runtime` fallback exists only for GPT-5.6 and GPT-6 (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra).** GPT-5.5 and GPT-5.4 are `bedrock-mantle` only and in-region only — for them, "switch to `bedrock-runtime`" requires moving to a different model (Bedrock-native or `gpt-oss`), a model change with its own eval cost. GPT-5.6 Sol/Terra/Luna and GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra DO have a `bedrock-runtime` path via CRIS inference profiles (GPT-5.6 `us.`/`in.`/`global.`, GPT-6 `us.`/`global.` prefixed ids; the model cards recommend runtime for new applications) — a legitimate endpoint option with its own quota family, and on Global CRIS it is also the cost-parity option. Scaling levers on the mantle path, in order: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Terra and Luna (`us.`/`in.`/`global.`), and `us.`/`global.` only for GPT-5.6 Sol, GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra, and GPT-5.5 / GPT-5.4 (the GPT-5.6 Sol card lists no `in.` profile; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: -1. Prompt caching (GPT-5.6 and GPT-6 only) — 90% off cached input and exempt from the input-TPM quota +1. Prompt caching (GPT-5.6 and GPT-6 on mantle; GPT-5.5 / GPT-5.4 list implicit caching on `bedrock-runtime` Responses only) — 90% off cached input and exempt from the input-TPM quota 2. Exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK) 3. Spreading load across minutes and ramping request rate gradually rather than bursting 4. A Service Quotas increase for that model's input/output TPM in that region @@ -108,8 +108,8 @@ Claude models on Mantle have an additional **output TPM cap** that differs by mo - For Claude migrations at medium/high volume: the 2M output TPM cap on Claude 4.7+ is the binding constraint - For OpenAI proprietary GPT targets: this Claude cap does not apply. Use the GPT-5.x mantle quotas or - Astra-specific verification above. Astra / GPT-5.6 have runtime CRIS alternatives with their own - quotas; GPT-5.5/5.4 have no runtime path + Astra-specific verification above. Astra / GPT-5.6 / GPT-5.5 / GPT-5.4 all have runtime CRIS alternatives + with their own quotas (`us.`/`global.` prefixed ids; no runtime in-region form) - For `gpt-oss` targets: these do run on `bedrock-runtime`, so standard account TPM limits and the Converse-path mitigations apply - When output-heavy workloads (long JSON, tool outputs, multi-step reasoning) are detected, flag the relevant cap prominently; recommend `bedrock-runtime` for production **only** when the target model actually has a `bedrock-runtime` path diff --git a/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md index 36ff7072d..b1a32c0d4 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md @@ -39,11 +39,18 @@ Two consequences that invert the previous decision logic: 1. **When the source model is on Bedrock, keep it.** A same-model move has no behavior delta to validate, no prompt re-engineering, and no eval regression risk — the migration is an endpoint and credential change, not a model change. This is the default recommendation. -2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.x In-Region and Geo +2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.6 In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when - the workload has no data-residency constraint (GPT-5.5 / GPT-5.4 have no CRIS at all). See - `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, + the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on + `bedrock-runtime`, but their model cards (read 2026-11-07) publish **commercial In-Region prices only** + ("Commercial In-Region prices include a 10% fee over OpenAI rates") — nothing on either card establishes a + Geo or Global CRIS price. So the verified ~10% premium for GPT-5.5 / GPT-5.4 is scoped to the commercial + In-Region (mantle) option. For a GPT-5.5 / GPT-5.4 CRIS plan, either source the Geo/Global rate separately + (the card's inference-option table or [aws.amazon.com/bedrock/pricing](https://aws.amazon.com/bedrock/pricing/), + with URL and read date) or report the comparison unavailable; an In-Region rate used as a proxy is an + **unverified planning assumption**, labelled as such, and yields no verified premium or savings percentage. + Never report parity for them. See `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, prompt caching, one vendor relationship — carries the in-region path; never present that path as free or neutral. For Astra, use its separately dated Bedrock rates and verify the source provider's rate before comparing. @@ -72,14 +79,15 @@ GPT-5.4, the target is **the same model on Bedrock**. | GPT-5.6 Sol | GPT-5.6 Sol | `openai.gpt-5.6-sol` / `us.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Terra | GPT-5.6 Terra | `openai.gpt-5.6-terra` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Luna | GPT-5.6 Luna | `openai.gpt-5.6-luna` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | -| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | -| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | +| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | Then apply the **region gate** below. Record `model_change: false` and the chosen path in `aws-design-ai.json` → `ai_architecture.code_migration`: `migration_path: "mantle_openai_chat"` for -Astra sources using Chat Completions, or `"mantle_openai_responses"` for a selected Mantle Responses -path. Use `migration_path: "runtime_openai_cris"` when a GPT-6 / GPT-5.6 target is served via -`bedrock-runtime` with a CRIS id (the model cards recommend runtime for new applications). +sources using Chat Completions on a model whose card lists it on mantle (GPT-6, GPT-5.5, GPT-5.4), or +`"mantle_openai_responses"` for a selected Mantle Responses path. Use `migration_path: "runtime_openai_cris"` +when a GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 target is served via `bedrock-runtime` with a CRIS id (the model +cards recommend runtime for new applications). Report the assessment honestly: `strong_migrate` here means "low-risk, well-supported move", not "cheaper". @@ -105,14 +113,16 @@ regions — offer it, stating the data-residency implication of cross-region rou Global routes anywhere and is the cost-parity option). Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through to Tier 1. -**GPT-5.5 / GPT-5.4:** hard gate. Mantle in-region only, no CRIS, no fallback. If the target region is not in the -matrix: +**GPT-5.5 / GPT-5.4:** same shape as GPT-5.6, with a narrower mantle matrix (GPT-5.5: us-east-1, us-east-2; +GPT-5.4: us-east-1, us-east-2, us-west-2, us-gov-west-1 — per their model cards, read 2026-11-06). If the target +region is in that matrix, either endpoint works. Otherwise the `bedrock-runtime` CRIS path (`us.openai.gpt-5.5` / +`global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`) reaches it, with the same data-residency +caveat as GPT-5.6 (Geo stays within the geography, Global routes anywhere). There is no runtime in-region form. +Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through: -1. Prefer offering a **region change** to a supported region, if no data-residency constraint pins the workload. - This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. -2. If the region is fixed, also offer **upgrading within the vendor to GPT-5.6** (which reaches the region via - CRIS) alongside the cross-family option — a generation change, but same vendor and prompt idioms. -3. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. +1. Prefer offering a **region change** to a supported mantle region, if no data-residency constraint pins the + workload. This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. +2. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. Record the outcome in `regional_warnings[]`. @@ -236,10 +246,11 @@ model on price. ### Open-weight gpt-oss -`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and, unlike the -proprietary GPT models, **do** support `bedrock-runtime` / Converse. They sit a capability class below the GPT-5.x -frontier tier. Recommend them when the user wants OpenAI-architecture models on the Bedrock-native runtime surface -(for Guardrails, invocation logging, or Converse-based tooling) rather than through mantle. +`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and support +`bedrock-runtime` / Converse with a bare model ID (no CRIS profile needed) and `Invoke`, which the proprietary GPT +models do not. They sit a capability class below the GPT-5.x frontier tier. Recommend them when the user wants +OpenAI-architecture models on the Bedrock-native runtime surface (for Guardrails, invocation logging, or +Converse-based tooling) at the lowest price rather than through mantle. --- @@ -285,7 +296,7 @@ rather than dismissing it. For a long-context (>272K) workload the gap is much w | Chat Completions | Preserve supported Chat when selected | Reshape only for a selected API change; verify the model and endpoint | | Function calling | Supported on GPT-5.x via mantle; Claude tools via Converse | Same-model keeps tool semantics identical | | Reasoning effort | `reasoning={"effort": ...}` on mantle | `none` / `low` / `medium` / `high` / `xhigh` / `max` | -| Prompt caching | GPT-5.6 only (90% off cached input) | Not listed for GPT-5.5 / 5.4; Claude has its own caching | +| Prompt caching | GPT-5.6 (90% off cached input); GPT-5.5 / 5.4 implicit caching on `bedrock-runtime` Responses only | GPT-5.5 / 5.4 cards (read 2026-11-06) list a cache-read rate and implicit caching on runtime, none on mantle; Claude has its own caching | | Streaming | Supported | Verify per surface | | Vision | GPT-5.x (image input) or Claude / Nova | Same-model preserves behavior | | JSON mode | Claude (excellent), Nova Pro (good) | Most models via prompt | @@ -340,11 +351,12 @@ and closed to new customers as of July 30, 2026. ### When to prefer a Bedrock-native model over the mantle GPT path Choose Claude / Nova via Converse when the workload needs Knowledge Bases, intelligent prompt routing, structured -outputs, or application inference profiles — none of which the GPT path offers. Note what no longer forces a family -switch for GPT-5.6: its `bedrock-runtime` CRIS path provides cross-region inference, invocation logs, and -Guardrails (Converse API only; prompt caching is Responses-only on runtime). For GPT-5.5 / GPT-5.4, Guardrails, -logging, and cross-region reach still require a different model. The mantle GPT path is the smallest change; the -Bedrock-native path remains the most feature-complete. +outputs, or application inference profiles — none of which the mantle GPT path offers. Note what no longer forces +a family switch for GPT-5.6, GPT-5.5 and GPT-5.4: their `bedrock-runtime` CRIS paths provide cross-region +inference, invocation logs, Guardrails and application inference profiles (both Converse API only), and +structured outputs and implicit prompt caching (both Responses API only) — per the GPT-5.4 / GPT-5.5 model cards +read 2026-11-06. Knowledge Bases and intelligent prompt routing still require a Bedrock-native model. The mantle +GPT path is the smallest change; the Bedrock-native path remains the most feature-complete. ### High-spend tiering @@ -365,8 +377,8 @@ alternative, not against the source provider. cheaper and exempt from the input-TPM quota, which relieves the binding constraint on mantle. **Very high (>100M tokens/day):** tiering plus caching. Check TPM headroom per model per region early; there is no -RPM quota and no `bedrock-runtime` fallback for GPT models, so quota increases are the scaling lever. See -`shared/ai-migration-guardrails.md`. +RPM quota, and the `bedrock-runtime` CRIS path for GPT-5.6 / 5.5 / 5.4 / GPT-6 carries its own quotas rather than +adding headroom to mantle, so quota increases are the scaling lever. See `shared/ai-migration-guardrails.md`. --- diff --git a/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md index 5256f8977..a4ec1d447 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle only; no 1M tier) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle only; no 1M tier) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 11.00/49.50; card read 2026-11-07) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 5.50/24.75; card read 2026-11-07) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | @@ -353,17 +353,24 @@ Regions (mantle): us-east-1 / us-east-2 for all five; us-west-2 additionally car | GPT-5.5 | 5.50 | 33.00 | — | 0.55 | | GPT-5.4 | 2.75 | 16.50 | — | 0.275 | -#### Long context (1M) — GPT-5.6 only, 2.0x input / 1.5x output - -| Model | Input $/1M | Output $/1M | -| ------------- | ---------- | ----------- | -| GPT-5.6 Sol | 8.80 | 33.00 | -| GPT-5.6 Terra | 4.40 | 19.80 | -| GPT-5.6 Luna | 0.44 | 1.98 | - -A workload above 272K context must be priced at the long-context tier. GPT-5.5 and GPT-5.4 have no such tier, so -their usable window is 272K. Global CRIS is published at OpenAI's standard list price (cost parity, GPT-5.6 only — -see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. +#### Long context (>272K input tokens) — GPT-5.6 at 2.0x input / 1.5x output; GPT-5.5 / GPT-5.4 per their model cards + +| Model | Input $/1M | Output $/1M | Cache read $/1M | +| ------------- | ---------- | ----------- | --------------- | +| GPT-5.6 Sol | 8.80 | 33.00 | — | +| GPT-5.6 Terra | 4.40 | 19.80 | — | +| GPT-5.6 Luna | 0.44 | 1.98 | — | +| GPT-5.5 | 11.00 | 49.50 | 1.10 | +| GPT-5.4 | 5.50 | 24.75 | 0.55 | + +A workload above 272K input tokens must be priced at the long-context tier, applied to all input and output tokens +of the request. GPT-5.5 and GPT-5.4 rows read from their model cards on 2026-11-06 +([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), +[GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)); both cards state a +1,050,000-token context window (128,000 max output) and list `us.`/`global.` CRIS ids on `bedrock-runtime`, but +publish the In-Region inference option only. Global CRIS is published at OpenAI's standard list price (cost parity, +GPT-5.6 only — see `openai-on-bedrock.md`). GovCloud (US-West) GPT-5.4 short-context is 3.375 / 20.25 (cache read +0.3375) per the 2026-11-06 card; an earlier revision recorded 3.30 / 19.80. > **One source conflict.** These models are absent > from the AWS Price List API entirely: querying `AmazonBedrock` returns only `gpt-oss` and GPT OSS Safeguard, and @@ -373,7 +380,8 @@ see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. **Prompt caching (GPT-5.6 only):** cached input read at a 90% discount, cache write at 1.25x uncached input, minimum 1,024-token prefix, up to 4 breakpoints, ≥30-minute retention. Cached input is exempt from the input-TPM quota. -GPT-5.5 and GPT-5.4 do not list prompt caching support. +GPT-5.5 and GPT-5.4 list only implicit prompt caching on `bedrock-runtime` Responses (automatic, no request +parameters; cache-read rate above, no cache-write rate) and none on mantle (model cards read 2026-11-06). #### Open-weight gpt-oss diff --git a/plugins/aws-startup-advisor/skills/shared/ai/models/bedrock-model-registry.json b/plugins/aws-startup-advisor/skills/shared/ai/models/bedrock-model-registry.json index 2222805d4..4bd6d7006 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/models/bedrock-model-registry.json +++ b/plugins/aws-startup-advisor/skills/shared/ai/models/bedrock-model-registry.json @@ -303,7 +303,7 @@ "us-east-2" ], "govcloud": [], - "evidence": "Commercial set per this catalog's pricing cache (US East N. Virginia / Ohio). The 2026-08 GovCloud announcement names Terra and Luna only — Sol's GovCloud availability is not stated; treat as unknown, not absent." + "evidence": "Commercial set per this catalog's pricing cache (US East N. Virginia / Ohio). The 2026-08 GovCloud announcement names Terra and Luna only \u2014 Sol's GovCloud availability is not stated; treat as unknown, not absent." }, "capabilities": [ "reasoning", @@ -331,17 +331,100 @@ "openai_gpt_5_5": { "provider": "openai", "selection_status": "selectable", - "context_window": 272000, - "output_token_ceiling": "unknown", + "context_window": 1050000, + "output_token_ceiling": 128000, "capabilities": [ "reasoning", - "tool_calling" + "tool_calling", + "image_input" ], + "inference_profiles": { + "us": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1" + ], + "global": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1", + "mx-central-1", + "eu-central-1", + "eu-central-2", + "eu-north-1", + "eu-south-1", + "eu-south-2", + "eu-west-1", + "eu-west-2", + "eu-west-3", + "ap-east-2", + "ap-northeast-1", + "ap-northeast-2", + "ap-northeast-3", + "ap-south-1", + "ap-south-2", + "ap-southeast-1", + "ap-southeast-2", + "ap-southeast-3", + "ap-southeast-4", + "ap-southeast-5", + "ap-southeast-6", + "ap-southeast-7", + "il-central-1", + "me-central-1", + "me-south-1", + "af-south-1", + "sa-east-1" + ] + }, + "region_availability": { + "commercial": [ + "us-east-1", + "us-east-2" + ], + "govcloud": [], + "evidence": "bedrock-mantle in-region rows of the GPT-5.5 model card, read 2026-11-06: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html" + }, + "pricing": { + "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html (read 2026-11-06); USD per 1M tokens, Standard tier; the card lists the In-Region inference option only", + "commercial_short_context_le_272k": { + "input": 5.5, + "cache_read": 0.55, + "output": 33.0 + }, + "commercial_long_context_gt_272k": { + "input": 11.0, + "cache_read": 1.1, + "output": 49.5 + }, + "service_tiers": { + "standard": true, + "priority": false, + "flex": false, + "reserved": false + } + }, "paths": { "mantle_openai_responses": { "available": true, "model_id": "openai.gpt-5.5", "requires_cris": false + }, + "mantle_openai_chat": { + "available": true, + "model_id": "openai.gpt-5.5", + "requires_cris": false + }, + "runtime_converse": { + "available": true, + "model_id": "openai.gpt-5.5", + "requires_cris": true } } }, @@ -360,7 +443,7 @@ "us-gov-west-1", "us-gov-east-1" ], - "evidence": "AWS What's New 2026-08 (openai-gpt-terra-luna-govcloud): \"GPT-5.6 Terra and Luna are now generally available on Amazon Bedrock in AWS GovCloud (US-West) and AWS GovCloud (US-East)\"; commercial set per this catalog's pricing cache — verify against the pricing page before relying on it." + "evidence": "AWS What's New 2026-08 (openai-gpt-terra-luna-govcloud): \"GPT-5.6 Terra and Luna are now generally available on Amazon Bedrock in AWS GovCloud (US-West) and AWS GovCloud (US-East)\"; commercial set per this catalog's pricing cache \u2014 verify against the pricing page before relying on it." }, "capabilities": [ "reasoning", @@ -394,7 +477,7 @@ "us-gov-west-1", "us-gov-east-1" ], - "evidence": "AWS What's New 2026-08 (openai-gpt-terra-luna-govcloud): \"GPT-5.6 Terra and Luna are now generally available on Amazon Bedrock in AWS GovCloud (US-West) and AWS GovCloud (US-East)\"; commercial set per this catalog's pricing cache — verify against the pricing page before relying on it." + "evidence": "AWS What's New 2026-08 (openai-gpt-terra-luna-govcloud): \"GPT-5.6 Terra and Luna are now generally available on Amazon Bedrock in AWS GovCloud (US-West) and AWS GovCloud (US-East)\"; commercial set per this catalog's pricing cache \u2014 verify against the pricing page before relying on it." }, "capabilities": [ "reasoning", @@ -416,14 +499,95 @@ "openai_gpt_5_4": { "provider": "openai", "selection_status": "selectable", - "context_window": "unknown", - "output_token_ceiling": "unknown", + "context_window": 1050000, + "output_token_ceiling": 128000, "capabilities": [ "tool_calling", "structured_output_json", "reasoning", - "streaming" + "streaming", + "image_input" ], + "inference_profiles": { + "us": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1" + ], + "global": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1", + "mx-central-1", + "eu-central-1", + "eu-central-2", + "eu-north-1", + "eu-south-1", + "eu-south-2", + "eu-west-1", + "eu-west-2", + "eu-west-3", + "ap-east-2", + "ap-northeast-1", + "ap-northeast-2", + "ap-northeast-3", + "ap-south-1", + "ap-south-2", + "ap-southeast-1", + "ap-southeast-2", + "ap-southeast-3", + "ap-southeast-4", + "ap-southeast-5", + "ap-southeast-6", + "ap-southeast-7", + "il-central-1", + "me-central-1", + "me-south-1", + "af-south-1", + "sa-east-1" + ] + }, + "region_availability": { + "commercial": [ + "us-east-1", + "us-east-2", + "us-west-2" + ], + "govcloud": [ + "us-gov-west-1" + ], + "evidence": "bedrock-mantle in-region rows of the GPT-5.4 model card, read 2026-11-06: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html" + }, + "pricing": { + "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html (read 2026-11-06); USD per 1M tokens, Standard tier; the card lists the In-Region inference option only", + "commercial_short_context_le_272k": { + "input": 2.75, + "cache_read": 0.275, + "output": 16.5 + }, + "commercial_long_context_gt_272k": { + "input": 5.5, + "cache_read": 0.55, + "output": 24.75 + }, + "govcloud_us_west_short_context_le_272k": { + "input": 3.375, + "cache_read": 0.3375, + "output": 20.25 + }, + "service_tiers": { + "standard": true, + "priority": false, + "flex": false, + "reserved": false + } + }, "paths": { "mantle_openai_responses": { "available": true, @@ -431,9 +595,14 @@ "requires_cris": false }, "mantle_openai_chat": { - "available": false, + "available": true, "model_id": "openai.gpt-5.4", "requires_cris": false + }, + "runtime_converse": { + "available": true, + "model_id": "openai.gpt-5.4", + "requires_cris": true } } }, @@ -1038,7 +1207,7 @@ "family": "claude_haiku", "version": "5.5", "class": "fast", - "evidence": "AWS model card model-card-anthropic-claude-haiku-5-5 (read 2026-11-09): launch 2026-10-07, Active, EOL no sooner than 2027-10-07; Messages/Converse/Invoke on bedrock-runtime via Geo (us./ca./eu./au./jp.) and Global CRIS, Messages on bedrock-mantle with the bare id; 1M context, 128K max output; adaptive thinking on by default with configurable effort; image input; explicit prompt caching; tiered pricing above 100K prompt tokens (US Geo $0.11/$0.55 up to 100K, $0.55/$2.75 above; Global $0.10/$0.50 and $0.50/$2.50). Supersedes Haiku 4.5 as the fast/low-cost Claude tier; Haiku 4.5 (200K, no thinking) stays an explicit alternative for workloads that must keep pre-5.5 behavior — see ai-anthropic-to-bedrock.md for the ~30% tokenizer recount and thinking-history constraints. AWS model card model-card-anthropic-claude-haiku-5-5 (re-read 2026-11-10): Regional Availability lists bedrock-runtime in 35 commercial Regions plus us-gov-east-1/us-gov-west-1 and bedrock-mantle in us-gov-west-1 only; Geo source-region tables for us./ca./eu./au./jp. copied verbatim; Global profiles are unavailable in GovCloud. Service Tiers: Standard only (no Batch, Priority, Flex, or Reserved) per the Haiku 5.5 target contract in ai-anthropic-to-bedrock.md. Migration guide: omit temperature/top_p/top_k (including Converse temperature/topP); forced tool choice is accepted; adaptive thinking is on by default and can be turned off (not Opus 5.5's always-on rule).", + "evidence": "AWS model card model-card-anthropic-claude-haiku-5-5 (read 2026-11-09): launch 2026-10-07, Active, EOL no sooner than 2027-10-07; Messages/Converse/Invoke on bedrock-runtime via Geo (us./ca./eu./au./jp.) and Global CRIS, Messages on bedrock-mantle with the bare id; 1M context, 128K max output; adaptive thinking on by default with configurable effort; image input; explicit prompt caching; tiered pricing above 100K prompt tokens (US Geo $0.11/$0.55 up to 100K, $0.55/$2.75 above; Global $0.10/$0.50 and $0.50/$2.50). Supersedes Haiku 4.5 as the fast/low-cost Claude tier; Haiku 4.5 (200K, no thinking) stays an explicit alternative for workloads that must keep pre-5.5 behavior \u2014 see ai-anthropic-to-bedrock.md for the ~30% tokenizer recount and thinking-history constraints. AWS model card model-card-anthropic-claude-haiku-5-5 (re-read 2026-11-10): Regional Availability lists bedrock-runtime in 35 commercial Regions plus us-gov-east-1/us-gov-west-1 and bedrock-mantle in us-gov-west-1 only; Geo source-region tables for us./ca./eu./au./jp. copied verbatim; Global profiles are unavailable in GovCloud. Service Tiers: Standard only (no Batch, Priority, Flex, or Reserved) per the Haiku 5.5 target contract in ai-anthropic-to-bedrock.md. Migration guide: omit temperature/top_p/top_k (including Converse temperature/topP); forced tool choice is accepted; adaptive thinking is on by default and can be turned off (not Opus 5.5's always-on rule).", "paths": { "mantle_messages": {}, "runtime_converse": {}, @@ -1054,8 +1223,8 @@ "provider": "openai", "verified_at": "2026-11-10", "verified_region": "us-east-2", - "source": "Haiku 5.5 Converse tier: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-haiku-5-5.html (read 2026-11-09). Opus 5.5 cross-family target: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-5-5.html (retrieved 2026-09-24). OpenAI and other unchanged entries retain their evidence from the superseded 2026-08-21 catalog (removed; see git history). Claude Sonnet 5.5 and OpenAI GPT-6.1 Terra: AWS model cards read 2026-11-10.", - "disclaimer": "Haiku 5.5 is the fast/low-cost Converse tier (the GPT-5.6 Luna cross-family fallback); Haiku 4.5 remains an explicit alternative, not an automatic fallback. The Opus cross-family target is updated to Opus 5.5; same-model OpenAI paths and their earlier evidence remain unchanged. This is a migration target catalog, not an account-availability claim. Verify the chosen model, API, region and CRIS profile before implementation. Opus 5.5 uses CRIS on runtime outside eu-west-2, has 1M context/128K output, always-on adaptive thinking, and no Batch tier. Fable and Mythos remain excluded from default selection. Opus 5.5 is the only Opus model in the automatic selection pool; older Opus snapshots and pricing records are historical references. The runtime in-region exception in eu-west-2 was verified 2026-10-03; the original catalog and other model evidence dates remain unchanged." + "source": "Haiku 5.5 Converse tier: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-haiku-5-5.html (read 2026-11-09). Opus 5.5 cross-family target: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-5-5.html (retrieved 2026-09-24). GPT-5.5 and GPT-5.4 rows re-read from their public model cards on 2026-11-06 (https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html, https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html): both now list bedrock-runtime (Responses, Chat Completions, Converse via us./global. CRIS ids) and Chat Completions on bedrock-mantle. Other OpenAI and other unchanged entries retain their evidence from the superseded 2026-08-21 catalog (removed; see git history). Claude Sonnet 5.5 and OpenAI GPT-6.1 Terra: AWS model cards read 2026-11-10.", + "disclaimer": "Haiku 5.5 is the fast/low-cost Converse tier (the GPT-5.6 Luna cross-family fallback); Haiku 4.5 remains an explicit alternative, not an automatic fallback. The Opus cross-family target is updated to Opus 5.5; the GPT-5.5 and GPT-5.4 entries were re-read from their public model cards on 2026-11-06 (runtime CRIS paths, Chat Completions on mantle, 1.05M context, long-context pricing); the other same-model OpenAI paths and their earlier evidence remain unchanged. This is a migration target catalog, not an account-availability claim. Verify the chosen model, API, region and CRIS profile before implementation. Opus 5.5 uses CRIS on runtime outside eu-west-2, has 1M context/128K output, always-on adaptive thinking, and no Batch tier. Fable and Mythos remain excluded from default selection. Opus 5.5 is the only Opus model in the automatic selection pool; older Opus snapshots and pricing records are historical references. The runtime in-region exception in eu-west-2 was verified 2026-10-03; the original catalog and other model evidence dates remain unchanged." }, "capabilities": { "tool_calling": "tool_or_function_calling", @@ -1080,8 +1249,8 @@ "GPT-5.x on Bedrock Mantle is served through the Responses API" ], "constraints": [ - "Mantle itself has no cross-region form for any GPT model (in-region only); for GPT-5.6 the bedrock-runtime CRIS path covers additional regions instead (see runtime_converse)", - "GPT-5.x on Mantle rejects Chat Completions; a Chat Completions source must reshape to Responses (reference-verified on gpt-5.4; the 5.6 cards list Chat Completions as a supported API but its mantle-side availability is unprobed — verify in the target account)", + "Mantle itself has no cross-region form for any GPT model (in-region only); for GPT-5.6, GPT-5.5 and GPT-5.4 the bedrock-runtime CRIS path covers additional regions instead (see runtime_converse)", + "Chat Completions support on Mantle is model-specific: the GPT-5.4 and GPT-5.5 model cards list Chat Completions as supported on bedrock-mantle (read 2026-11-06); the GPT-5.6 Sol card does not. A Chat Completions source reshapes to Responses only when the selected model's card does not list Chat Completions \u2014 verify in the target account", "Availability must be probed in the target account and region" ] }, @@ -1097,7 +1266,7 @@ "OpenAI-compatible Chat Completions surface for models that accept it" ], "constraints": [ - "Not available for the GPT-5.x models listed here: rejected on gpt-5.4 (internal reference probe) and unsupported on the gpt-5.6-sol model card", + "Model-specific: listed as supported on bedrock-mantle by the GPT-5.4 and GPT-5.5 model cards (https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html, https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html, read 2026-11-06) and by the GPT-6 cards; unsupported on the gpt-5.6-sol model card. Uses /openai/v1/chat/completions", "Availability and model support must be probed in the target account and region" ] }, @@ -1112,11 +1281,12 @@ "strengths": [ "Bedrock-native multi-model request surface", "Supports Bedrock Guardrails (Converse API only), invocation logging, and CloudWatch", - "For GPT-5.6 this is a SAME-MODEL governance path via CRIS (us./in./global. ids; base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs); the model cards recommend runtime for new applications, and Global CRIS is priced at OpenAI's standard rate (cost parity)" + "This is a SAME-MODEL governance path via CRIS. GPT-5.6 Terra and Luna publish us./in./global. ids; us./global. only for GPT-5.6 Sol, GPT-5.5 and GPT-5.4 (their model cards list no in. profile; cards read 2026-11-07). The base URL for the OpenAI-compatible APIs is bedrock-runtime.{region}.amazonaws.com/openai/v1. The model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" ], "constraints": [ - "GPT-5.5 / GPT-5.4 have NO runtime path — a Converse target for them means a Bedrock-native model and a boto3 rewrite of the OpenAI integration", - "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. Runtime does not support server-side tool use, structured outputs, or application inference profiles for these models; prompt caching is Responses-only", + "GPT-5.5 / GPT-5.4 on runtime are CRIS-only (us. and global. ids; no in-region form) per their model cards (read 2026-11-06); the cards publish In-Region (1.10x) pricing only, so do not assume Global CRIS price parity for them", + "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere \u2014 pick by data-residency posture. For GPT-5.6, runtime does not support server-side tool use, structured outputs, or application inference profiles; prompt caching is Responses-only", + "GPT-5.5 / GPT-5.4 on runtime (per their model cards, read 2026-11-07): server-side tool use is unsupported; structured outputs and implicit prompt caching are Responses-only; Guardrails and application inference profiles are Converse-only", "Bedrock-native models generally require a Global or geography-scoped CRIS inference profile", "Availability must be probed in the target account and region" ] @@ -1130,7 +1300,7 @@ "generation": "reasoning", "version": "5.6", "class": "reasoning", - "capability_source": "AWS model card 2026-08-21 (launch 2026-07-13, Active): frontier reasoning/agentic, image+text input checked; tool calling via the Responses API's built-in tool use (models-api-compatibility). Structured output/streaming behavior not feature-probed on Mantle — verify before relying. Re-verified 2026-08-21: context window is 1M per the current card (272K was the 2026-07-21 value); long-context (>272K) is a separate price tier at 2.0x input / 1.5x output per inference option.", + "capability_source": "AWS model card 2026-08-21 (launch 2026-07-13, Active): frontier reasoning/agentic, image+text input checked; tool calling via the Responses API's built-in tool use (models-api-compatibility). Structured output/streaming behavior not feature-probed on Mantle \u2014 verify before relying. Re-verified 2026-08-21: context window is 1M per the current card (272K was the 2026-07-21 value); long-context (>272K) is a separate price tier at 2.0x input / 1.5x output per inference option.", "paths": { "mantle_openai_responses": { "evidence": "AWS model card (2026-08-21): bedrock-mantle at /openai/v1, in-region only; Responses supported; In-Region pricing at 1.10x OpenAI standard" @@ -1150,10 +1320,16 @@ "generation": "reasoning", "version": "5.5", "class": "reasoning", - "capability_source": "AWS model card 2026-07-21 (launch 2026-06-01, Active): advanced coding/agentic tasks; tool calling via the Responses API's built-in tool use. Feature-level Mantle behavior not probed — verify before relying. Re-verified 2026-08-21: still mantle-only, in-region only; no CRIS, no runtime path, no long-context tier.", + "capability_source": "AWS model card https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html (read 2026-11-06; launch 2026-06-01, Active, EOL no sooner than 2027-06-01): text+image input, text output; 1,050,000-token context shared between input and output, 128,000 max output. Mantle lists server-side and client-side tool calling; runtime lists invocation logs, streaming, Guardrails (Converse only), application inference profiles (Converse only), implicit prompt caching (Responses only), structured outputs (Responses) and reasoning summaries; server-side tool use is unsupported on runtime. Documentation claims, not account probes \u2014 verify before relying.", "paths": { "mantle_openai_responses": { - "evidence": "AWS model card model-card-openai-gpt-55 (2026-07-21): bedrock-mantle Programmatic Access with Responses sample code; Geo/Global inference not supported" + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): bedrock-mantle supports Responses at /openai/v1/responses; in-region us-east-1 and us-east-2 only; Geo/Global not supported on mantle" + }, + "mantle_openai_chat": { + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): Chat Completions listed as supported on bedrock-mantle at /openai/v1/chat/completions, with sample code" + }, + "runtime_converse": { + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): bedrock-runtime supported with Responses, Chat Completions and Converse (Messages and Invoke unsupported); no in-region form \u2014 requests must name us.openai.gpt-5.5 (Geo) or global.openai.gpt-5.5 (Global); base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs" } } }, @@ -1164,7 +1340,7 @@ "generation": "reasoning", "version": "5.6", "class": "reasoning", - "capability_source": "AWS model card 2026-08-21: balanced performance at half GPT-5.5 cost; tool calling via the Responses API's built-in tool use. Re-verified 2026-08-21: context window is 1M per the current card (the 2026-07-21 card did not state it — cataloged as unknown then); long-context (>272K) is a separate price tier at 2.0x input / 1.5x output per inference option.", + "capability_source": "AWS model card 2026-08-21: balanced performance at half GPT-5.5 cost; tool calling via the Responses API's built-in tool use. Re-verified 2026-08-21: context window is 1M per the current card (the 2026-07-21 card did not state it \u2014 cataloged as unknown then); long-context (>272K) is a separate price tier at 2.0x input / 1.5x output per inference option.", "paths": { "mantle_openai_responses": { "evidence": "AWS model card (2026-08-21): bedrock-mantle at /openai/v1, in-region only; Responses supported; In-Region pricing at 1.10x OpenAI standard" @@ -1181,7 +1357,7 @@ "generation": "reasoning", "version": "5.6", "class": "reasoning", - "capability_source": "AWS model card 2026-08-21: fastest/lowest-cost OpenAI tier for high-volume tasks; tool calling via the Responses API's built-in tool use. Re-verified 2026-08-21: context window is 1M per the current card (the 2026-07-21 card did not state it — cataloged as unknown then); long-context (>272K) is a separate price tier at 2.0x input / 1.5x output per inference option.", + "capability_source": "AWS model card 2026-08-21: fastest/lowest-cost OpenAI tier for high-volume tasks; tool calling via the Responses API's built-in tool use. Re-verified 2026-08-21: context window is 1M per the current card (the 2026-07-21 card did not state it \u2014 cataloged as unknown then); long-context (>272K) is a separate price tier at 2.0x input / 1.5x output per inference option.", "paths": { "mantle_openai_responses": { "evidence": "AWS model card (2026-08-21): bedrock-mantle at /openai/v1, in-region only; Responses supported; In-Region pricing at 1.10x OpenAI standard" @@ -1198,13 +1374,16 @@ "generation": "reasoning", "version": "5.4", "class": "reasoning", - "capability_source": "internal reference smoke tests and its reasoning-API migration notebook (Responses path, 2026-06 probes) — the only entry with feature-level Mantle behavior probes (tools, structured output, sampling); limits not stated Re-verified 2026-08-21: still mantle-only, in-region only; no CRIS, no runtime path, no long-context tier.", + "capability_source": "AWS model card https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html (read 2026-11-06; launch 2026-06-01, Active, EOL no sooner than 2027-06-01): text+image input, text output; 1,050,000-token context shared between input and output, 128,000 max output. Mantle lists server-side and client-side tool calling; runtime lists invocation logs, response streaming, Guardrails (Converse only), application inference profiles (Converse only), implicit prompt caching (Responses only), structured outputs (JSON Schema; Responses API) and reasoning summaries; server-side tool use is unsupported on runtime. Documentation claims, not account probes \u2014 verify before relying.", "paths": { "mantle_openai_responses": { - "evidence": "internal reference smoke-test default Mantle model id; client.responses.create verified live" + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): bedrock-mantle supports Responses at /openai/v1/responses; in-region us-east-1, us-east-2, us-west-2 and us-gov-west-1; Geo/Global not supported on mantle" }, "mantle_openai_chat": { - "evidence": "internal reference verified gotcha: GPT-5.x on Mantle is Responses-only; Chat Completions rejected" + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): Chat Completions listed as supported on bedrock-mantle at /openai/v1/chat/completions, with sample code" + }, + "runtime_converse": { + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): bedrock-runtime supported with Responses, Chat Completions and Converse (Messages and Invoke unsupported); no in-region form \u2014 requests must name us.openai.gpt-5.4 (Geo) or global.openai.gpt-5.4 (Global); base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs" } } }, @@ -1329,7 +1508,7 @@ "generation": "bedrock_native", "version": "5", "class": "runtime_native", - "capability_source": "AWS model card model-card-anthropic-claude-sonnet-5 (2026-07-21): Converse checked, 1M context / 128K output, adaptive thinking always on, image input checked (tool_use/thinking/vision mapped to this provider's feature vocabulary). Balanced Claude tier — the Converse target for GPT-5.6 Terra, GPT-5.5, GPT-5.4, and unmatched/legacy sources.", + "capability_source": "AWS model card model-card-anthropic-claude-sonnet-5 (2026-07-21): Converse checked, 1M context / 128K output, adaptive thinking always on, image input checked (tool_use/thinking/vision mapped to this provider's feature vocabulary). Balanced Claude tier \u2014 the Converse target for GPT-5.6 Terra, GPT-5.5, GPT-5.4, and unmatched/legacy sources.", "paths": { "runtime_converse": { "evidence": "AWS model card (2026-07-21): Converse on bedrock-runtime checked; Geo (us/eu/au) and Global CRIS supported" @@ -1357,7 +1536,7 @@ "generation": "bedrock_native", "version": "5.5", "class": "runtime_native", - "capability_source": "AWS model card model-card-anthropic-claude-haiku-5-5 (read 2026-11-09): launch 2026-10-07, Active, EOL no sooner than 2027-10-07; Messages/Converse/Invoke on bedrock-runtime via Geo (us./ca./eu./au./jp.) and Global CRIS, Messages on bedrock-mantle with the bare id; 1M context, 128K max output; adaptive thinking on by default with configurable effort; image input; explicit prompt caching; tiered pricing above 100K prompt tokens (US Geo $0.11/$0.55 up to 100K, $0.55/$2.75 above; Global $0.10/$0.50 and $0.50/$2.50). Supersedes Haiku 4.5 as the fast/low-cost Claude tier; Haiku 4.5 (200K, no thinking) stays an explicit alternative for workloads that must keep pre-5.5 behavior — see ai-anthropic-to-bedrock.md for the ~30% tokenizer recount and thinking-history constraints. AWS model card model-card-anthropic-claude-haiku-5-5 (re-read 2026-11-10): Regional Availability lists bedrock-runtime in 35 commercial Regions plus us-gov-east-1/us-gov-west-1 and bedrock-mantle in us-gov-west-1 only; Geo source-region tables for us./ca./eu./au./jp. copied verbatim; Global profiles are unavailable in GovCloud. Service Tiers: Standard only (no Batch, Priority, Flex, or Reserved) per the Haiku 5.5 target contract in ai-anthropic-to-bedrock.md. Migration guide: omit temperature/top_p/top_k (including Converse temperature/topP); forced tool choice is accepted; adaptive thinking is on by default and can be turned off (not Opus 5.5's always-on rule).", + "capability_source": "AWS model card model-card-anthropic-claude-haiku-5-5 (read 2026-11-09): launch 2026-10-07, Active, EOL no sooner than 2027-10-07; Messages/Converse/Invoke on bedrock-runtime via Geo (us./ca./eu./au./jp.) and Global CRIS, Messages on bedrock-mantle with the bare id; 1M context, 128K max output; adaptive thinking on by default with configurable effort; image input; explicit prompt caching; tiered pricing above 100K prompt tokens (US Geo $0.11/$0.55 up to 100K, $0.55/$2.75 above; Global $0.10/$0.50 and $0.50/$2.50). Supersedes Haiku 4.5 as the fast/low-cost Claude tier; Haiku 4.5 (200K, no thinking) stays an explicit alternative for workloads that must keep pre-5.5 behavior \u2014 see ai-anthropic-to-bedrock.md for the ~30% tokenizer recount and thinking-history constraints. AWS model card model-card-anthropic-claude-haiku-5-5 (re-read 2026-11-10): Regional Availability lists bedrock-runtime in 35 commercial Regions plus us-gov-east-1/us-gov-west-1 and bedrock-mantle in us-gov-west-1 only; Geo source-region tables for us./ca./eu./au./jp. copied verbatim; Global profiles are unavailable in GovCloud. Service Tiers: Standard only (no Batch, Priority, Flex, or Reserved) per the Haiku 5.5 target contract in ai-anthropic-to-bedrock.md. Migration guide: omit temperature/top_p/top_k (including Converse temperature/topP); forced tool choice is accepted; adaptive thinking is on by default and can be turned off (not Opus 5.5's always-on rule).", "paths": { "runtime_converse": { "evidence": "AWS model card (read 2026-11-09): Converse on bedrock-runtime via us./ca./eu./au./jp. Geo or global. CRIS; the bare id is the Mantle Messages id" diff --git a/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json b/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json index 939f1bbeb..de3460daa 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json +++ b/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json @@ -4,8 +4,8 @@ "generated_from": "bedrock-model-registry.json (rendered by tools/build-model-catalogs.py; edit the registry, not this file)", "verified_at": "2026-11-10", "verified_region": "us-east-2", - "source": "Haiku 5.5 Converse tier: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-haiku-5-5.html (read 2026-11-09). Opus 5.5 cross-family target: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-5-5.html (retrieved 2026-09-24). OpenAI and other unchanged entries retain their evidence from the superseded 2026-08-21 catalog (removed; see git history). Claude Sonnet 5.5 and OpenAI GPT-6.1 Terra: AWS model cards read 2026-11-10.", - "disclaimer": "Haiku 5.5 is the fast/low-cost Converse tier (the GPT-5.6 Luna cross-family fallback); Haiku 4.5 remains an explicit alternative, not an automatic fallback. The Opus cross-family target is updated to Opus 5.5; same-model OpenAI paths and their earlier evidence remain unchanged. This is a migration target catalog, not an account-availability claim. Verify the chosen model, API, region and CRIS profile before implementation. Opus 5.5 uses CRIS on runtime outside eu-west-2, has 1M context/128K output, always-on adaptive thinking, and no Batch tier. Fable and Mythos remain excluded from default selection. Opus 5.5 is the only Opus model in the automatic selection pool; older Opus snapshots and pricing records are historical references. The runtime in-region exception in eu-west-2 was verified 2026-10-03; the original catalog and other model evidence dates remain unchanged.", + "source": "Haiku 5.5 Converse tier: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-haiku-5-5.html (read 2026-11-09). Opus 5.5 cross-family target: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-5-5.html (retrieved 2026-09-24). GPT-5.5 and GPT-5.4 rows re-read from their public model cards on 2026-11-06 (https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html, https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html): both now list bedrock-runtime (Responses, Chat Completions, Converse via us./global. CRIS ids) and Chat Completions on bedrock-mantle. Other OpenAI and other unchanged entries retain their evidence from the superseded 2026-08-21 catalog (removed; see git history). Claude Sonnet 5.5 and OpenAI GPT-6.1 Terra: AWS model cards read 2026-11-10.", + "disclaimer": "Haiku 5.5 is the fast/low-cost Converse tier (the GPT-5.6 Luna cross-family fallback); Haiku 4.5 remains an explicit alternative, not an automatic fallback. The Opus cross-family target is updated to Opus 5.5; the GPT-5.5 and GPT-5.4 entries were re-read from their public model cards on 2026-11-06 (runtime CRIS paths, Chat Completions on mantle, 1.05M context, long-context pricing); the other same-model OpenAI paths and their earlier evidence remain unchanged. This is a migration target catalog, not an account-availability claim. Verify the chosen model, API, region and CRIS profile before implementation. Opus 5.5 uses CRIS on runtime outside eu-west-2, has 1M context/128K output, always-on adaptive thinking, and no Batch tier. Fable and Mythos remain excluded from default selection. Opus 5.5 is the only Opus model in the automatic selection pool; older Opus snapshots and pricing records are historical references. The runtime in-region exception in eu-west-2 was verified 2026-10-03; the original catalog and other model evidence dates remain unchanged.", "paths": { "mantle_openai_responses": { "sdk": "openai", @@ -20,8 +20,8 @@ "GPT-5.x on Bedrock Mantle is served through the Responses API" ], "constraints": [ - "Mantle itself has no cross-region form for any GPT model (in-region only); for GPT-5.6 the bedrock-runtime CRIS path covers additional regions instead (see runtime_converse)", - "GPT-5.x on Mantle rejects Chat Completions; a Chat Completions source must reshape to Responses (reference-verified on gpt-5.4; the 5.6 cards list Chat Completions as a supported API but its mantle-side availability is unprobed — verify in the target account)", + "Mantle itself has no cross-region form for any GPT model (in-region only); for GPT-5.6, GPT-5.5 and GPT-5.4 the bedrock-runtime CRIS path covers additional regions instead (see runtime_converse)", + "Chat Completions support on Mantle is model-specific: the GPT-5.4 and GPT-5.5 model cards list Chat Completions as supported on bedrock-mantle (read 2026-11-06); the GPT-5.6 Sol card does not. A Chat Completions source reshapes to Responses only when the selected model's card does not list Chat Completions — verify in the target account", "Availability must be probed in the target account and region" ] }, @@ -37,7 +37,7 @@ "OpenAI-compatible Chat Completions surface for models that accept it" ], "constraints": [ - "Not available for the GPT-5.x models listed here: rejected on gpt-5.4 (internal reference probe) and unsupported on the gpt-5.6-sol model card", + "Model-specific: listed as supported on bedrock-mantle by the GPT-5.4 and GPT-5.5 model cards (https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html, https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html, read 2026-11-06) and by the GPT-6 cards; unsupported on the gpt-5.6-sol model card. Uses /openai/v1/chat/completions", "Availability and model support must be probed in the target account and region" ] }, @@ -52,11 +52,12 @@ "strengths": [ "Bedrock-native multi-model request surface", "Supports Bedrock Guardrails (Converse API only), invocation logging, and CloudWatch", - "For GPT-5.6 this is a SAME-MODEL governance path via CRIS (us./in./global. ids; base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs); the model cards recommend runtime for new applications, and Global CRIS is priced at OpenAI's standard rate (cost parity)" + "This is a SAME-MODEL governance path via CRIS. GPT-5.6 Terra and Luna publish us./in./global. ids; us./global. only for GPT-5.6 Sol, GPT-5.5 and GPT-5.4 (their model cards list no in. profile; cards read 2026-11-07). The base URL for the OpenAI-compatible APIs is bedrock-runtime.{region}.amazonaws.com/openai/v1. The model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" ], "constraints": [ - "GPT-5.5 / GPT-5.4 have NO runtime path — a Converse target for them means a Bedrock-native model and a boto3 rewrite of the OpenAI integration", - "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. Runtime does not support server-side tool use, structured outputs, or application inference profiles for these models; prompt caching is Responses-only", + "GPT-5.5 / GPT-5.4 on runtime are CRIS-only (us. and global. ids; no in-region form) per their model cards (read 2026-11-06); the cards publish In-Region (1.10x) pricing only, so do not assume Global CRIS price parity for them", + "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. For GPT-5.6, runtime does not support server-side tool use, structured outputs, or application inference profiles; prompt caching is Responses-only", + "GPT-5.5 / GPT-5.4 on runtime (per their model cards, read 2026-11-07): server-side tool use is unsupported; structured outputs and implicit prompt caching are Responses-only; Guardrails and application inference profiles are Converse-only", "Bedrock-native models generally require a Global or geography-scoped CRIS inference profile", "Availability must be probed in the target account and region" ] @@ -114,19 +115,104 @@ "generation": "reasoning", "version": "5.5", "class": "reasoning", - "context_window": 272000, - "output_token_ceiling": "unknown", + "context_window": 1050000, + "output_token_ceiling": 128000, "capabilities": [ "reasoning", - "tool_or_function_calling" + "tool_or_function_calling", + "image_input_vision" ], - "capability_source": "AWS model card 2026-07-21 (launch 2026-06-01, Active): advanced coding/agentic tasks; tool calling via the Responses API's built-in tool use. Feature-level Mantle behavior not probed — verify before relying. Re-verified 2026-08-21: still mantle-only, in-region only; no CRIS, no runtime path, no long-context tier.", + "capability_source": "AWS model card https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html (read 2026-11-06; launch 2026-06-01, Active, EOL no sooner than 2027-06-01): text+image input, text output; 1,050,000-token context shared between input and output, 128,000 max output. Mantle lists server-side and client-side tool calling; runtime lists invocation logs, streaming, Guardrails (Converse only), application inference profiles (Converse only), implicit prompt caching (Responses only), structured outputs (Responses) and reasoning summaries; server-side tool use is unsupported on runtime. Documentation claims, not account probes — verify before relying.", + "inference_profiles": { + "us": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1" + ], + "global": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1", + "mx-central-1", + "eu-central-1", + "eu-central-2", + "eu-north-1", + "eu-south-1", + "eu-south-2", + "eu-west-1", + "eu-west-2", + "eu-west-3", + "ap-east-2", + "ap-northeast-1", + "ap-northeast-2", + "ap-northeast-3", + "ap-south-1", + "ap-south-2", + "ap-southeast-1", + "ap-southeast-2", + "ap-southeast-3", + "ap-southeast-4", + "ap-southeast-5", + "ap-southeast-6", + "ap-southeast-7", + "il-central-1", + "me-central-1", + "me-south-1", + "af-south-1", + "sa-east-1" + ] + }, + "region_availability": { + "commercial": [ + "us-east-1", + "us-east-2" + ], + "govcloud": [], + "evidence": "bedrock-mantle in-region rows of the GPT-5.5 model card, read 2026-11-06: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html" + }, + "pricing": { + "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html (read 2026-11-06); USD per 1M tokens, Standard tier; the card lists the In-Region inference option only", + "commercial_short_context_le_272k": { + "input": 5.5, + "cache_read": 0.55, + "output": 33.0 + }, + "commercial_long_context_gt_272k": { + "input": 11.0, + "cache_read": 1.1, + "output": 49.5 + }, + "service_tiers": { + "standard": true, + "priority": false, + "flex": false, + "reserved": false + } + }, "paths": { "mantle_openai_responses": { "available": true, "model_id": "openai.gpt-5.5", "requires_cris": false, - "evidence": "AWS model card model-card-openai-gpt-55 (2026-07-21): bedrock-mantle Programmatic Access with Responses sample code; Geo/Global inference not supported" + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): bedrock-mantle supports Responses at /openai/v1/responses; in-region us-east-1 and us-east-2 only; Geo/Global not supported on mantle" + }, + "mantle_openai_chat": { + "available": true, + "model_id": "openai.gpt-5.5", + "requires_cris": false, + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): Chat Completions listed as supported on bedrock-mantle at /openai/v1/chat/completions, with sample code" + }, + "runtime_converse": { + "available": true, + "model_id": "openai.gpt-5.5", + "requires_cris": true, + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): bedrock-runtime supported with Responses, Chat Completions and Converse (Messages and Invoke unsupported); no in-region form — requests must name us.openai.gpt-5.5 (Geo) or global.openai.gpt-5.5 (Global); base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs" } } }, @@ -219,27 +305,114 @@ "generation": "reasoning", "version": "5.4", "class": "reasoning", - "context_window": "unknown", - "output_token_ceiling": "unknown", + "context_window": 1050000, + "output_token_ceiling": 128000, "capabilities": [ "tool_or_function_calling", "structured_output_json", "reasoning", - "streaming" + "streaming", + "image_input_vision" ], - "capability_source": "internal reference smoke tests and its reasoning-API migration notebook (Responses path, 2026-06 probes) — the only entry with feature-level Mantle behavior probes (tools, structured output, sampling); limits not stated Re-verified 2026-08-21: still mantle-only, in-region only; no CRIS, no runtime path, no long-context tier.", + "capability_source": "AWS model card https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html (read 2026-11-06; launch 2026-06-01, Active, EOL no sooner than 2027-06-01): text+image input, text output; 1,050,000-token context shared between input and output, 128,000 max output. Mantle lists server-side and client-side tool calling; runtime lists invocation logs, response streaming, Guardrails (Converse only), application inference profiles (Converse only), implicit prompt caching (Responses only), structured outputs (JSON Schema; Responses API) and reasoning summaries; server-side tool use is unsupported on runtime. Documentation claims, not account probes — verify before relying.", + "inference_profiles": { + "us": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1" + ], + "global": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2", + "ca-central-1", + "ca-west-1", + "mx-central-1", + "eu-central-1", + "eu-central-2", + "eu-north-1", + "eu-south-1", + "eu-south-2", + "eu-west-1", + "eu-west-2", + "eu-west-3", + "ap-east-2", + "ap-northeast-1", + "ap-northeast-2", + "ap-northeast-3", + "ap-south-1", + "ap-south-2", + "ap-southeast-1", + "ap-southeast-2", + "ap-southeast-3", + "ap-southeast-4", + "ap-southeast-5", + "ap-southeast-6", + "ap-southeast-7", + "il-central-1", + "me-central-1", + "me-south-1", + "af-south-1", + "sa-east-1" + ] + }, + "region_availability": { + "commercial": [ + "us-east-1", + "us-east-2", + "us-west-2" + ], + "govcloud": [ + "us-gov-west-1" + ], + "evidence": "bedrock-mantle in-region rows of the GPT-5.4 model card, read 2026-11-06: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html" + }, + "pricing": { + "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html (read 2026-11-06); USD per 1M tokens, Standard tier; the card lists the In-Region inference option only", + "commercial_short_context_le_272k": { + "input": 2.75, + "cache_read": 0.275, + "output": 16.5 + }, + "commercial_long_context_gt_272k": { + "input": 5.5, + "cache_read": 0.55, + "output": 24.75 + }, + "govcloud_us_west_short_context_le_272k": { + "input": 3.375, + "cache_read": 0.3375, + "output": 20.25 + }, + "service_tiers": { + "standard": true, + "priority": false, + "flex": false, + "reserved": false + } + }, "paths": { "mantle_openai_responses": { "available": true, "model_id": "openai.gpt-5.4", "requires_cris": false, - "evidence": "internal reference smoke-test default Mantle model id; client.responses.create verified live" + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): bedrock-mantle supports Responses at /openai/v1/responses; in-region us-east-1, us-east-2, us-west-2 and us-gov-west-1; Geo/Global not supported on mantle" }, "mantle_openai_chat": { - "available": false, + "available": true, "model_id": "openai.gpt-5.4", "requires_cris": false, - "evidence": "internal reference verified gotcha: GPT-5.x on Mantle is Responses-only; Chat Completions rejected" + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): Chat Completions listed as supported on bedrock-mantle at /openai/v1/chat/completions, with sample code" + }, + "runtime_converse": { + "available": true, + "model_id": "openai.gpt-5.4", + "requires_cris": true, + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): bedrock-runtime supported with Responses, Chat Completions and Converse (Messages and Invoke unsupported); no in-region form — requests must name us.openai.gpt-5.4 (Geo) or global.openai.gpt-5.4 (Global); base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs" } } }, diff --git a/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md index cdf8ced55..c82a8eebc 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md @@ -190,12 +190,18 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` ## migration_path vocabulary `mantle_openai_responses` (an OpenAI-protocol source — direct or Azure-fronted — with the model -on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `converse` -(Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when a proprietary GPT -model must move off mantle for Guardrails / Knowledge Bases / logging / an unsupported region) · -`gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic -Bedrock SDK swap). A proprietary `openai.gpt-*` model ID is NEVER paired with a -`converse`/`bedrock-runtime` path — those models are mantle-only. +on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` +(same, preserving a Chat Completions source on a model whose card lists Chat Completions on +mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via +`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-5.6 Terra +and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native +Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, +intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` +(OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK +swap). A **bare** proprietary `openai.gpt-*` model ID is NEVER paired with a +`converse`/`bedrock-runtime` path — bare ids are mantle ids; every proprietary GPT target on +`bedrock-runtime` carries a CRIS-prefixed id (there is no runtime in-region form for GPT-6, +GPT-5.6, GPT-5.5 or GPT-5.4). ## regional_validation @@ -255,8 +261,10 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `price_comparison`. - [ ] `honest_assessment` overall is the weakest across `bedrock_models[]`; if `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. -- [ ] No `bedrock_models[]` entry pairs a proprietary `openai.gpt-*` model ID with a - `converse`/`bedrock-runtime` migration path (mantle-only). +- [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a + `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` + target carries a CRIS id: `us.`/`in.`/`global.` for GPT-5.6 Terra / Luna; `us.`/`global.` only + for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py b/plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py new file mode 100644 index 000000000..d1d71ba10 --- /dev/null +++ b/plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py @@ -0,0 +1,97 @@ +"""Guard: the `in.` CRIS prefix belongs to GPT-5.6 Terra and Luna only. +Public model cards (read 2026-11-07): + GPT-5.6 Terra / Luna us. / in. / us-gov. / global. + GPT-5.6 Sol us. / global. + GPT-5.4, GPT-5.5 us. / global. + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-sol.html + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-terra.html + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-luna.html + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html +This test makes sure no prose consumer of the catalog (design/generate +checklists, the code-rewriter agent, the shared schema, the catalog strength +text) hands GPT-5.4 / GPT-5.5 a grouped `us.`/`in.`/`global.` grant, and that +any `in.` grant to "GPT-5.6" names Terra/Luna rather than the whole family, +so an agent cannot record `in.openai.gpt-5.6-sol`, `in.openai.gpt-5.4` or +`in.openai.gpt-5.5` as a runtime id. +""" +from __future__ import annotations +import json +import re +from pathlib import Path +PLUGIN_ROOT = Path(__file__).resolve().parent.parent +CATALOG = PLUGIN_ROOT / "skills" / "shared" / "ai" / "models" / "openai-bedrock.json" +# Every file that names GPT-5.4 / GPT-5.5 alongside a CRIS-prefix grant. +CONSUMERS = [ + PLUGIN_ROOT / "agents" / "llm2bedrock-code-rewriter.md", + PLUGIN_ROOT / "skills" / "gcp-to-aws" / "references" / "phases" / "design" / "design-ai.md", + PLUGIN_ROOT / "skills" / "azure-to-aws" / "references" / "phases" / "generate" / "generate-artifacts-ai.md", + PLUGIN_ROOT / "skills" / "shared" / "ai" / "schema-design-aws-ai.md", + PLUGIN_ROOT / "skills" / "azure-to-aws" / "references" / "shared" / "schema-design-aws-ai.md", + PLUGIN_ROOT / "skills" / "shared" / "ai" / "ai-migration-guardrails.md", +] +_GROUPED_PREFIX = re.compile(r"`?us\.`?\s*/\s*`?in\.`?\s*/\s*`?global\.`?") +_GPT_54_55 = re.compile(r"GPT-5\.[45]|gpt-5\.[45]", re.IGNORECASE) +_TERRA_LUNA_SCOPED = re.compile(r"GPT-5\.6\s+Terra\s*(and|/)\s*(GPT-5\.6\s+)?Luna", re.IGNORECASE) +_SOL_EXCLUDED = re.compile(r"`?us\.`?\s*/\s*`?global\.`?\s*(only\s+)?for[^.;)]*GPT-5\.6\s+Sol", re.IGNORECASE) +_US_GLOBAL_GRANT = re.compile(r"`?us\.`?\s*/\s*`?global\.`?\s*(only|for|;)") +def _bad_in_grants(text: str) -> list[str]: + """Return windows around a grouped us./in./global. grant that either + (a) cover GPT-5.4/5.5 without giving them their own us./global. grant, or + (b) grant `in.` to "GPT-5.6" family-wide instead of to Terra/Luna with Sol + explicitly in the us./global.-only set.""" + hits: list[str] = [] + for m in _GROUPED_PREFIX.finditer(text): + window = text[max(0, m.start() - 360) : m.end() + 360] + mentions_54_55 = bool(_GPT_54_55.search(window)) + mentions_56 = bool(re.search(r"GPT-5\.6", window)) + if not (mentions_54_55 or mentions_56): + continue + ok = True + if mentions_54_55 and not _US_GLOBAL_GRANT.search(window): + ok = False + if mentions_56 and not (_TERRA_LUNA_SCOPED.search(window) and _SOL_EXCLUDED.search(window)): + ok = False + if not ok: + hits.append(" ".join(window.split())) + return hits +def test_catalog_inference_profiles_for_gpt54_55_are_us_and_global_only() -> None: + catalog = json.loads(CATALOG.read_text()) + for key in ("openai_gpt_5_4", "openai_gpt_5_5"): + assert set(catalog["models"][key]["inference_profiles"]) == {"us", "global"}, key +def test_no_prose_consumer_grants_in_prefix_to_gpt54_55_or_gpt56_sol() -> None: + offenders: dict[str, list[str]] = {} + # The catalog's runtime_converse path strength is prose an agent reads too. + catalog = json.loads(CATALOG.read_text()) + strength_text = "\n".join(catalog["paths"]["runtime_converse"]["strengths"]) + hits = _bad_in_grants(strength_text) + if hits: + offenders["skills/shared/ai/models/openai-bedrock.json (runtime_converse.strengths)"] = hits + for path in CONSUMERS: + assert path.exists(), path + hits = _bad_in_grants(path.read_text()) + if hits: + offenders[str(path.relative_to(PLUGIN_ROOT))] = hits + assert not offenders, ( + "A grouped us./in./global. CRIS grant covers GPT-5.4 / GPT-5.5 or the whole GPT-5.6 " + "family. Cards (2026-11-07): in. exists for GPT-5.6 Terra/Luna only; GPT-5.6 Sol, " + "GPT-5.4 and GPT-5.5 publish us./global. only:\n" + + "\n".join(f" {k}: {v[0][:200]}" for k, v in offenders.items()) + ) +def test_vendored_copies_match_canonical_for_edited_files() -> None: + pairs = [ + ( + PLUGIN_ROOT / "skills" / "shared" / "ai" / "schema-design-aws-ai.md", + PLUGIN_ROOT / "skills" / "gcp-to-aws" / "references" / "vendored" / "ai" / "schema-design-aws-ai.md", + ), + ( + PLUGIN_ROOT / "skills" / "shared" / "ai" / "schema-design-aws-ai.md", + PLUGIN_ROOT / "skills" / "azure-to-aws" / "references" / "vendored" / "ai" / "schema-design-aws-ai.md", + ), + ( + CATALOG, + PLUGIN_ROOT / "skills" / "agent-advisor" / "references" / "vendored" / "ai" / "models" / "openai-bedrock.json", + ), + ] + for canonical, vendored in pairs: + assert canonical.read_bytes() == vendored.read_bytes(), f"{vendored} drifted from {canonical}" diff --git a/plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py b/plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py new file mode 100644 index 000000000..e45e852fe --- /dev/null +++ b/plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py @@ -0,0 +1,193 @@ +"""Guards for the three PR 583 review findings on the GPT-5.4 / GPT-5.5 runtime path. + +Public model cards (read 2026-11-07): + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html + +1. IAM: on bedrock-runtime the identity "also needs bedrock:InvokeModel on your + account's default project (arn:aws:bedrock:{region}:{account-id}:project/default) + in addition to the inference profile". The setup recipes must say so for the + GPT-5.5 / GPT-5.4 CRIS ids, not only for GPT-6. +2. Application inference profiles are "Converse API only; not supported with + Responses or Chat Completions APIs". A Design that selects runtime_openai_cris + for that need must carry required_client_api: "converse" and surface a + conflicting Responses-only need as an explicit decision. +3. The cards publish commercial In-Region prices only. No file may infer a Geo or + Global CRIS price (or a premium / savings percentage) for GPT-5.4 / GPT-5.5 from + the In-Region row; an In-Region proxy is an unverified planning assumption. +""" +from __future__ import annotations + +import re +from pathlib import Path + +PLUGIN_ROOT = Path(__file__).resolve().parent.parent +SKILLS = PLUGIN_ROOT / "skills" +AGENTS = PLUGIN_ROOT / "agents" + +GCP_GENERATE_AI = SKILLS / "gcp-to-aws" / "references" / "phases" / "generate" / "generate-ai.md" +GCP_GENERATE_ARTIFACTS = SKILLS / "gcp-to-aws" / "references" / "phases" / "generate" / "generate-artifacts-ai.md" +AZURE_GENERATE_ARTIFACTS = SKILLS / "azure-to-aws" / "references" / "phases" / "generate" / "generate-artifacts-ai.md" +GCP_DESIGN_AI = SKILLS / "gcp-to-aws" / "references" / "phases" / "design" / "design-ai.md" +AZURE_DESIGN_AI = SKILLS / "azure-to-aws" / "references" / "phases" / "design" / "design-ai.md" +AZURE_SCHEMA = SKILLS / "azure-to-aws" / "references" / "shared" / "schema-design-aws-ai.md" +REPORT_GENERATOR = AGENTS / "llm2bedrock-report-generator.md" + +CANONICAL_GUIDE = SKILLS / "shared" / "ai" / "ai-openai-to-bedrock.md" +VENDORED_GUIDES = [ + SKILLS / "gcp-to-aws" / "references" / "vendored" / "ai" / "ai-openai-to-bedrock.md", + SKILLS / "azure-to-aws" / "references" / "vendored" / "ai" / "ai-openai-to-bedrock.md", +] +FACT_BASES = [ + SKILLS / "gcp-to-aws" / "references" / "shared" / "openai-on-bedrock.md", + SKILLS / "azure-to-aws" / "references" / "shared" / "openai-on-bedrock.md", +] + +_GPT_54_55 = re.compile(r"GPT-5\.[45]|gpt-5\.[45]", re.IGNORECASE) + + +def _windows(text: str, pattern: re.Pattern[str], radius: int = 700) -> list[str]: + return [text[max(0, m.start() - radius): m.end() + radius] for m in pattern.finditer(text)] + + +# --- Finding 1: default-project grant reaches the GPT-5.5 / GPT-5.4 CRIS ids --- + +def test_setup_recipes_grant_project_default_for_gpt54_55_cris_ids() -> None: + for path in (GCP_GENERATE_AI, GCP_GENERATE_ARTIFACTS, AZURE_GENERATE_ARTIFACTS, REPORT_GENERATOR): + text = path.read_text() + windows = _windows(text, re.compile(r"project/default")) + assert windows, f"{path}: no project/default grant sentence" + assert any(_GPT_54_55.search(w) and "global.openai.gpt-5." in w for w in windows), ( + f"{path}: the project/default grant must name the GPT-5.5 / GPT-5.4 " + "us./global. CRIS ids, not only GPT-6" + ) + # The grant is still a runtime-CRIS grant: the recipe must not hand it to bare mantle ids. + assert not re.search(r"bare `?openai\.gpt-5\.[45]`?[^.]*(gets|needs|requires) (the )?project/default", text), path + + +def test_no_recipe_still_scopes_project_default_to_gpt6_only() -> None: + gpt6_only = re.compile(r"For (a )?GPT-6 CRIS( id)?, (also )?grant `bedrock:InvokeModel` on `arn:aws:bedrock:\{region\}:\{account\}:project/default`\.") + for path in (GCP_GENERATE_AI, GCP_GENERATE_ARTIFACTS): + assert not gpt6_only.search(path.read_text()), f"{path}: project/default grant is still GPT-6-only" + + +# --- Finding 2: application inference profiles force required_client_api: "converse" --- + +_CONVERSE_FIELD = re.compile(r"required_client_api(`)?:?\s*`?\"?converse\"?") + + +def test_design_rule_requires_converse_for_application_profiles_on_gpt54_55() -> None: + for path in (GCP_DESIGN_AI, AZURE_DESIGN_AI, AZURE_SCHEMA): + text = path.read_text() + windows = [w for w in _windows(text, re.compile(r"application inference profiles", re.IGNORECASE)) + if _GPT_54_55.search(w) and _CONVERSE_FIELD.search(w)] + assert windows, ( + f"{path}: no rule ties application inference profiles on GPT-5.5 / GPT-5.4 " + "to required_client_api: \"converse\"" + ) + joined = " ".join(" ".join(w.split()) for w in windows) + assert re.search(r"Converse(-| )only|Converse API only", joined), path + # Generate's absent-field default and the unsupported-pair omission are the failure mode. + assert re.search(r"absent", joined), f"{path}: must forbid leaving required_client_api absent" + # A conflicting Responses-only need is a decision, not a silent drop. + assert re.search(r"explicit (design )?decision", joined), path + assert re.search(r"silent", joined), path + assert re.search(r"structured outputs", joined), path + + +def test_region_only_cris_move_keeps_responses_default() -> None: + for path in (GCP_DESIGN_AI, AZURE_DESIGN_AI, AZURE_SCHEMA): + text = path.read_text() + assert re.search(r"default[^.]*region-only|region-only[^.]*default", text), ( + f"{path}: the responses default for a region-only CRIS move must remain" + ) + + +def test_design_checklists_assert_the_application_profile_rule() -> None: + for path in (GCP_DESIGN_AI, AZURE_SCHEMA): + text = path.read_text() + checklist = text[text.index("## Validation Checklist"):] + item = [w for w in _windows(checklist, re.compile(r"application inference profiles"), 500) + if _CONVERSE_FIELD.search(w) and _GPT_54_55.search(w)] + assert item, f"{path}: Validation Checklist has no application-profile → converse item" + assert "explicit decision" in " ".join(item), path + + +# --- Finding 3: no Geo/Global CRIS price inferred from the In-Region row --- + +_INFERRED_CRIS_PRICE = re.compile( + r"(every inference option|until a Global rate is published|on every inference option)", + re.IGNORECASE, +) + + +def test_the_1_10x_geo_rate_names_gpt56_not_the_gpt5x_family() -> None: + """The GPT-5.4 and GPT-5.5 cards publish no Geo or Global price. A GPT-5.x + In-Region-and-Geo 1.10x bullet would price those CRIS ids at the In-Region rate. + """ + for path in [CANONICAL_GUIDE, *VENDORED_GUIDES, *FACT_BASES]: + text = path.read_text() + assert "GPT-5.x In-Region and Geo" not in text, path + assert "GPT-5.6 In-Region and Geo" in text, path + + +CLARIFY_AI_ONLY = [ + SKILLS / "gcp-to-aws" / "references" / "phases" / "clarify" / "clarify-ai-only.md", + SKILLS / "azure-to-aws" / "references" / "phases" / "clarify" / "clarify-ai-only.md", + SKILLS / "bedrock-migration-assessment" / "references" / "phases" / "clarify" / "clarify-ai-only.md", +] + + +def test_clarify_ai_only_scopes_the_gpt54_55_premium_to_in_region() -> None: + for path in CLARIFY_AI_ONLY: + rows = [ + line for line in path.read_text().splitlines() + if re.match(r"\| GPT-5\.5\s+\|", line) or re.match(r"\| GPT-5\.4\s+\|", line) + ] + assert len(rows) == 2, f"{path}: expected two GPT-5.5 / GPT-5.4 rows, got {rows}" + for line in rows: + assert "In-Region (mantle)" in line, line + assert "no Geo or Global price published" in line, line + + +def test_no_file_infers_a_cris_price_for_gpt54_55_from_in_region() -> None: + offenders = {} + for path in [CANONICAL_GUIDE, *VENDORED_GUIDES, *FACT_BASES, REPORT_GENERATOR]: + text = path.read_text() + hits = [m.group(0) for m in _INFERRED_CRIS_PRICE.finditer(text) + if _GPT_54_55.search(text[max(0, m.start() - 400): m.end() + 400])] + if hits: + offenders[str(path.relative_to(PLUGIN_ROOT))] = hits + assert not offenders, f"GPT-5.5 / GPT-5.4 CRIS price inferred from the In-Region row: {offenders}" + + +def test_premium_is_scoped_to_commercial_in_region_and_proxy_is_labelled() -> None: + for path in [CANONICAL_GUIDE, *VENDORED_GUIDES, *FACT_BASES, REPORT_GENERATOR]: + text = path.read_text() + windows = [" ".join(w.split()) for w in _windows(text, re.compile(r"In-Region\s+pric(?:es?|ing)\s+(?:only|include)", re.IGNORECASE)) + if _GPT_54_55.search(w)] + assert windows, f"{path}: no GPT-5.5 / GPT-5.4 In-Region-only pricing statement" + joined = " ".join(windows) + assert re.search(r"commercial In-Region", joined, re.IGNORECASE), path + assert re.search(r"Geo( \(`us\.`\))? or Global CRIS price|Geo/Global (rate|price|rows)", joined), path + assert "unverified planning assumption" in joined, path + assert re.search(r"(no|not .*?)(verified )?(premium or savings|premium|savings) percentage", joined), ( + f"{path}: a CRIS plan with only card prices must yield no verified premium/savings percentage" + ) + assert re.search(r"unavailable", joined), f"{path}: must allow reporting the comparison unavailable" + + +def test_tier0_table_scopes_gpt54_55_premium_to_in_region() -> None: + for path in [CANONICAL_GUIDE, *VENDORED_GUIDES]: + rows = [ + line for line in path.read_text().splitlines() + if (line.startswith("| GPT-5.5 ") or line.startswith("| GPT-5.4 ")) and "strong_migrate" in line + ] + assert len(rows) == 2, f"{path}: expected the two Tier 0 GPT-5.5 / GPT-5.4 rows, got {rows}" + for line in rows: + assert "In-Region only" in line and "no Geo/Global price published" in line, line + + +def test_vendored_guides_match_canonical() -> None: + for vendored in VENDORED_GUIDES: + assert vendored.read_bytes() == CANONICAL_GUIDE.read_bytes(), vendored diff --git a/plugins/aws-startup-advisor/tests/test_gpt6_review_round2.py b/plugins/aws-startup-advisor/tests/test_gpt6_review_round2.py index 7af115742..2309b54cb 100644 --- a/plugins/aws-startup-advisor/tests/test_gpt6_review_round2.py +++ b/plugins/aws-startup-advisor/tests/test_gpt6_review_round2.py @@ -70,15 +70,25 @@ def test_both_estimate_ai_files_require_matching_context_tiers() -> None: # --- Finding 2: runtime_openai_cris gate/dispatch --- -def test_design_ai_scopes_mantle_only_to_gpt55_gpt54() -> None: +def test_design_ai_gives_gpt55_gpt54_the_runtime_cris_path() -> None: + # GPT-5.5 / GPT-5.4 model cards (read 2026-11-06) list us./global. CRIS ids on + # bedrock-runtime, so the runtime_openai_cris carve-out must name them alongside + # GPT-6/5.6 and the old "mantle-only, no CRIS" scoping must be gone. for f in DESIGN_AI_FILES: - text = f.read_text(encoding="utf-8") + text = re.sub(r"\s+", " ", f.read_text(encoding="utf-8")) assert "runtime_openai_cris" in text, ( - f"{f}: no runtime_openai_cris carve-out for GPT-6/5.6 (Finding 2)" + f"{f}: no runtime_openai_cris carve-out (Finding 2)" ) assert "GPT-5.5" in text and "GPT-5.4" in text, ( - f"{f}: mantle-only scoping must name GPT-5.5/GPT-5.4 specifically (Finding 2)" + f"{f}: the runtime_openai_cris rule must name GPT-5.5/GPT-5.4 specifically" + ) + assert "us.openai.gpt-5.5" in text and "us.openai.gpt-5.4" in text, ( + f"{f}: must record the GPT-5.5/GPT-5.4 us. CRIS ids" ) + assert "GPT-5.5 and GPT-5.4 are mantle-only" not in text + assert "GPT-5.5 and GPT-5.4 are `bedrock-mantle` only" not in text + assert "no CRIS" not in text + assert "No Converse fallback for GPT-5.5/GPT-5.4" not in text def test_generate_artifacts_ai_dispatches_runtime_openai_cris() -> None: @@ -102,9 +112,16 @@ def test_schema_design_aws_ai_vocabulary_includes_runtime_openai_cris() -> None: "schema-design-aws-ai.md: migration_path vocabulary missing runtime_openai_cris (Finding 2)" ) assert "GPT-5.5" in text and "GPT-5.4" in text, ( - "schema-design-aws-ai.md: mantle-only scoping must name GPT-5.5/GPT-5.4 specifically, " - "not blanket 'proprietary GPT' (Finding 2)" + "schema-design-aws-ai.md: runtime_openai_cris vocabulary must name GPT-5.5/GPT-5.4 " + "specifically, not blanket 'proprietary GPT' (Finding 2)" ) + # The ban is on BARE proprietary GPT ids paired with converse/bedrock-runtime, + # not on the GPT-5.5/GPT-5.4 models — their cards list us./global. CRIS ids. + normalized = re.sub(r"\s+", " ", text) + assert "those models are mantle-only" not in normalized + assert "mantle-only, no CRIS" not in normalized + assert "**bare** proprietary `openai.gpt-*`" in normalized + assert "us.openai.gpt-5.5" in normalized or "GPT-5.5 / GPT-5.4 runtime support" in normalized # --- Finding 3: Astra Invoke-support correction --- diff --git a/plugins/aws-startup-advisor/tests/test_gpt6_review_round5.py b/plugins/aws-startup-advisor/tests/test_gpt6_review_round5.py index c73b08235..187601bd6 100644 --- a/plugins/aws-startup-advisor/tests/test_gpt6_review_round5.py +++ b/plugins/aws-startup-advisor/tests/test_gpt6_review_round5.py @@ -114,6 +114,12 @@ def test_behavior_delta_no_longer_claims_chat_completions_unverified() -> None: assert "OPTIONAL" in text, ( "openai-to-bedrock.md must make the Responses reshape optional, not mandatory" ) + # GPT-5.5 / GPT-5.4 model cards (read 2026-11-06) list Chat Completions on both + # bedrock-mantle and bedrock-runtime — the reshape is optional for them too. + assert "GPT-5.5 / GPT-5.4 follow the same rule" in text + assert "model-card-openai-gpt-54.html" in text and "model-card-openai-gpt-55.html" in text + assert "mantle-only, no CRIS" not in text + assert "still unconfirmed" not in text def test_both_design_ai_no_longer_force_gpt6_chat_completions_reshape() -> None: @@ -122,12 +128,17 @@ def test_both_design_ai_no_longer_force_gpt6_chat_completions_reshape() -> None: assert "near-drop-in" in text.lower() or "optional" in text.lower(), ( f"{f}: a GPT-6/GPT-5.6 Chat Completions source must not be forced to reshape" ) - assert "GPT-5.5" in text and "GPT-5.4" in text, ( - f"{f}: the mandatory-reshape exception must still be scoped to GPT-5.5/GPT-5.4" + assert "GPT-5.5 and GPT-5.4 follow the same rule" in text, ( + f"{f}: GPT-5.5/GPT-5.4 Chat Completions is listed on both endpoints (cards read " + "2026-11-06); they must not be the mandatory-reshape exception" ) + assert "GPT-5.5 and GPT-5.4 are the exception" not in text + assert "unconfirmed" not in text def test_gcp_generate_ai_no_longer_forces_gpt6_chat_completions_reshape() -> None: text = _norm(GCP_GENERATE_AI_MD.read_text(encoding="utf-8")) assert "optional" in text.lower() - assert "GPT-5.5" in text and "GPT-5.4" in text + assert "GPT-5.5/GPT-5.4 follow the same rule" in text + assert "still need a reshape" not in text + assert "unconfirmed" not in text diff --git a/plugins/aws-startup-advisor/tests/test_gpt6_round4_findings.py b/plugins/aws-startup-advisor/tests/test_gpt6_round4_findings.py index f375e2ef2..46e2ac3a8 100644 --- a/plugins/aws-startup-advisor/tests/test_gpt6_round4_findings.py +++ b/plugins/aws-startup-advisor/tests/test_gpt6_round4_findings.py @@ -2,8 +2,9 @@ GPT-6 recognition, report pricing bugs). Finding 0 — runtime_openai_cris carve-out gaps: - (a) Azure design.md / generate.md _assert blocks must scope the GPT-ban to - GPT-5.5/GPT-5.4 and explicitly carve out GPT-5.6/GPT-6 on runtime_openai_cris. + (a) Azure design.md / generate.md _assert blocks must scope the GPT-ban to BARE + proprietary ids and explicitly carve out GPT-5.6/GPT-6 — and, since the + 2026-11-06 model-card re-read, GPT-5.5/GPT-5.4 — on runtime_openai_cris. (b) GCP generate-ai.md Part 1 must route runtime_openai_cris through bedrock-runtime, not the mantle URL/IAM. (c) Canonical model-selection guide + vendored guardrails must name the full @@ -79,21 +80,30 @@ def _norm(text: str) -> str: # --- Finding 0.1: Azure design.md / generate.md assert carve-out --- -def test_azure_design_assert_scopes_gpt_ban_to_55_54_and_carves_out_cris() -> None: +def test_azure_design_assert_scopes_gpt_ban_to_bare_ids_and_carves_out_cris() -> None: + # GPT-5.5 / GPT-5.4 model cards (read 2026-11-06) list us./global. CRIS ids on + # bedrock-runtime, so the ban is on BARE proprietary ids paired with + # converse/bedrock-runtime — not on the GPT-5.5/GPT-5.4 models themselves. text = _norm(AZURE_DESIGN_MD.read_text(encoding="utf-8")) - assert "no proprietary GPT-5.5 or GPT-5.4 model ID is paired" in text, ( - "design.md _assert must scope the ban to GPT-5.5/GPT-5.4, not blanket 'openai.gpt-*'" + assert "no bare proprietary openai.gpt-* model ID (including bare openai.gpt-5.5 or openai.gpt-5.4) is paired" in text, ( + "design.md _assert must ban bare proprietary ids on converse/bedrock-runtime, " + "naming bare openai.gpt-5.5/openai.gpt-5.4 explicitly" ) - assert "runtime_openai_cris on bedrock-runtime — this is not a violation" in text + assert "GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation" in text + assert "GPT-5.5/GPT-5.4 us./global. profiles" in text + assert "no proprietary GPT-5.5 or GPT-5.4 model ID is paired" not in text assert "no proprietary openai.gpt-* model ID is paired" not in text -def test_azure_generate_assert_scopes_gpt_ban_to_55_54_and_carves_out_cris() -> None: +def test_azure_generate_assert_scopes_gpt_ban_to_bare_ids_and_carves_out_cris() -> None: text = _norm(AZURE_GENERATE_MD.read_text(encoding="utf-8")) - assert "no proprietary GPT-5.5 or GPT-5.4 model ID is paired" in text, ( - "generate.md _assert must scope the ban to GPT-5.5/GPT-5.4, not blanket 'openai.gpt-*'" + assert "no bare proprietary openai.gpt-* model ID (including bare openai.gpt-5.5 or openai.gpt-5.4) is paired" in text, ( + "generate.md _assert must ban bare proprietary ids on converse/bedrock-runtime, " + "naming bare openai.gpt-5.5/openai.gpt-5.4 explicitly" ) - assert "runtime_openai_cris on bedrock-runtime — this is not a violation" in text + assert "GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation" in text + assert "GPT-5.5/GPT-5.4 us./global. profiles" in text + assert "no proprietary GPT-5.5 or GPT-5.4 model ID is paired" not in text assert "no proprietary openai.gpt-* model ID is paired" not in text diff --git a/plugins/aws-startup-advisor/tools/build-model-catalogs.py b/plugins/aws-startup-advisor/tools/build-model-catalogs.py index 5b1f8137d..772cea693 100644 --- a/plugins/aws-startup-advisor/tools/build-model-catalogs.py +++ b/plugins/aws-startup-advisor/tools/build-model-catalogs.py @@ -59,7 +59,7 @@ "forced_tool_choice_supported", "native_structured_output_supported", "sampling_parameters_supported", "runtime_in_region_regions", "runtime_in_region_verified_at", "mantle_regions", "service_tiers", - "inference_profiles", "region_availability", + "inference_profiles", "region_availability", "pricing", "paths") PATH_ORDER = ("available", "model_id", "requires_cris", "evidence", "capabilities", "regions", "supported_regions", "inference_profile_regions") REGISTRY_ONLY = ("provider",) # registry bookkeeping, never rendered