From c1944a53f092e1ce489149f6ee1520f64484d027 Mon Sep 17 00:00:00 2001 From: Logan Kleier Date: Fri, 6 Nov 2026 23:17:11 -0800 Subject: [PATCH 1/7] fix(aws-startup-advisor): refresh GPT-5.4/GPT-5.5 Bedrock endpoint metadata from the public model cards The plugin recorded GPT-5.4 and GPT-5.5 as bedrock-mantle-only (no CRIS, no inference profile, no bedrock-runtime surface) with Chat Completions "unconfirmed", a 272K context window and no long-context price tier, and the canonical catalog cited "internal reference" probes as provenance. The public model cards no longer say any of that. This PR corrects the metadata only; it does not change endpoint selection, dispatch, or add new code paths. Sources (read 2026-11-06 via the AWS Documentation MCP tools): - https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html - https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html What the cards state, now recorded verbatim in the catalog and prose: - Endpoints: bedrock-runtime supported (Responses, Chat Completions, Converse; not Messages/Invoke) and bedrock-mantle supported (Responses, Chat Completions). Runtime has no in-region form; requests name us.openai.gpt-5.4 / global.openai.gpt-5.4 and us.openai.gpt-5.5 / global.openai.gpt-5.5. Mantle in-region: 5.4 = us-east-1, us-east-2, us-west-2, us-gov-west-1; 5.5 = us-east-1, us-east-2. US Geo CRIS from 6 regions, Global CRIS from 33. - Context 1,050,000 tokens shared, 128,000 max output. - Pricing (Standard, In-Region only; Priority/Flex unsupported): 5.4 short 2.75 / 0.275 cache read / 16.50, long 5.50 / 0.55 / 24.75, GovCloud short 3.375 / 0.3375 / 20.25; 5.5 short 5.50 / 0.55 / 33.00, long 11.00 / 1.10 / 49.50. No Geo/Global price rows, so prose keeps the ~10% figure for these two on every inference option and never claims parity. - Runtime features: invocation logs, streaming, Guardrails and application inference profiles (Converse only), implicit prompt caching and structured outputs (Responses only); no server-side tool use. Changes: - skills/shared/ai/models/openai-bedrock.json: GPT-5.4/5.5 rows re-sourced to the public cards (no "internal reference"), mantle_openai_chat available, runtime_converse path with CRIS, inference_profiles (us/global), region_availability, pricing tiers, context/output limits; path-level constraints corrected. - Canonical shared docs: ai-openai-to-bedrock.md (Tier 0 table, region gate, caching, Bedrock-native section, volume guidance), ai-migration-guardrails.md, schema-design-aws-ai.md (ban is on BARE ids paired with converse/runtime, not on the models), bedrock-pricing-cache.md (rows, long-context table, caching note, GovCloud rate). - gcp-to-aws and azure-to-aws: references/shared/openai-on-bedrock.md, shared/schema-design-aws-ai.md (azure), design-ai.md, design.md/generate.md _assert lines (azure), generate-artifacts-ai.md (azure), generate-ai.md, discover-preview.md and clarify-ai-only.md (gcp), clarify-ai-only.md (azure). - bedrock-migration-assessment clarify-ai-only.md; agent-advisor model-recommend.md (documents the engine's current GPT-5.x reshape as an engine limitation, not a model fact). - llm-to-bedrock: resolve-bedrock-model-id.md (Case A/B), behavior-delta openai-to-bedrock.md, SKILL.md (two id-form sentences); docstrings/comments in preflight_bedrock.py, iam_policy.py, bedrock_pricing.py and the preflight 404 remedy string. The is_mantle_model / is_mantle_gpt ID-form logic is unchanged. - agents: llm2bedrock-code-rewriter.md (Converse rule is id-form-dependent), llm2bedrock-report-generator.md (cost text), llm2bedrock-prompt-evaluator.md. - openai_model_recommendation.py: only the chat_completions_to_responses block message text (dropped the "GPT-5.x on Mantle rejects Chat Completions" claim). - Tests: tests/test_gpt6_review_round2.py, test_gpt6_review_round5.py, test_gpt6_round4_findings.py and agent-advisor scripts/test_openai_model_recommendation.py now assert the corrected public facts (CRIS ids present, "mantle-only"/"no CRIS"/"unconfirmed" absent, catalog provenance is the public card). New regression tests in test_preflight_bedrock.py, test_iam_policy.py, test_bedrock_pricing.py prove us./global.openai.gpt-5.4|5.5 classify as runtime and bare ids as mantle in all three helpers. - Vendored copies under agent-advisor, gcp-to-aws, azure-to-aws re-synced with tools/sync-vendored.py. Validation (all run from the worktree with mise Python 3.12): - mise -C plugins/aws-startup-advisor run ci: PASS - lint:md 0 errors; lint:model-id OK (19 retired IDs enforced); lint:model-staleness fresh (4d old, 45d window); lint:model-catalog-drift OK (3 pre-existing warnings: sonnet-5-5, haiku-5-5, gpt-6.1-terra not in catalog; unrelated); lint:startup-model-pricing OK; lint:artifacts PASS (99 checked, 0 errors); lint:vendored-parity PASS (62 files byte-identical); lint:skill-refs PASS (1482 checked, 0 missing); lint:consent-disclosure OK; test: 1395 passed, 222 subtests passed; test:telemetry: 311 passed; test:heroku-source-review: 44 pass, 0 fail - agent-advisor pytest (skills/agent-advisor/scripts): 564 passed, 0 failed (562 at base + 2 new) - llm-to-bedrock pytest (skills/llm-to-bedrock/scripts): 418 passed, 0 failed (415 at base + 3 new; needs --with httpx --with aws-bedrock-token-generator) - root: python3 tools/validate.py "All validations passed"; mise run lint:md 0 issues / 2763 files; lint:manifests, lint:skill-parity, lint:spec all pass; test:tools 6 OK. mise run build's security step fails on a pre-existing gitleaks false positive in upstream commit f8d09fd1 (tests/test_bedrock_migration_assessment_discover.py:118, "claude-3.5-sonnet"); gitleaks protect over this change set: no leaks found. - grep over plugins/ for mantle-only / "no CRIS" / "no inference profile" / "no runtime path" / "unconfirmed" / "internal reference" / "no 1M tier" near GPT-5.4/5.5: no remaining claims (only negative test assertions and the bare-id rule "bare proprietary openai.gpt-* IDs use Mantle only"). Base: 0a218f8cc13220013f72147e2e0fdbe350b34ae2 (upstream/main) --- .../agents/llm2bedrock-code-rewriter.md | 2 +- .../agents/llm2bedrock-prompt-evaluator.md | 7 +- .../agents/llm2bedrock-report-generator.md | 2 +- .../phases/model-recommend/model-recommend.md | 16 +++- .../vendored/ai/bedrock-pricing-cache.md | 36 +++++--- .../vendored/ai/models/openai-bedrock.json | 89 ++++++++++++++---- .../scripts/openai_model_recommendation.py | 5 +- .../test_openai_model_recommendation.py | 42 ++++++++- .../phases/clarify/clarify-ai-only.md | 7 +- .../references/phases/design/design-ai.md | 28 ++++-- .../references/phases/design/design.md | 2 +- .../phases/generate/generate-artifacts-ai.md | 7 +- .../references/phases/generate/generate.md | 2 +- .../references/shared/openai-on-bedrock.md | 91 +++++++++++++------ .../references/shared/schema-design-aws-ai.md | 30 +++--- .../vendored/ai/ai-migration-guardrails.md | 8 +- .../vendored/ai/ai-openai-to-bedrock.md | 57 +++++++----- .../vendored/ai/bedrock-pricing-cache.md | 36 +++++--- .../vendored/ai/schema-design-aws-ai.md | 23 +++-- .../phases/clarify/clarify-ai-only.md | 4 +- .../phases/clarify/clarify-ai-only.md | 4 +- .../references/phases/design/design-ai.md | 35 ++++--- .../phases/discover/discover-preview.md | 4 +- .../references/phases/generate/generate-ai.md | 4 +- .../references/shared/openai-on-bedrock.md | 91 +++++++++++++------ .../vendored/ai/ai-migration-guardrails.md | 8 +- .../vendored/ai/ai-openai-to-bedrock.md | 57 +++++++----- .../vendored/ai/bedrock-pricing-cache.md | 36 +++++--- .../vendored/ai/schema-design-aws-ai.md | 23 +++-- .../skills/llm-to-bedrock/SKILL.md | 7 +- .../references/openai-to-bedrock.md | 4 +- .../resolve-bedrock-model-id.md | 39 ++++---- .../llm-to-bedrock/scripts/bedrock_pricing.py | 15 ++- .../llm-to-bedrock/scripts/iam_policy.py | 6 +- .../scripts/preflight_bedrock.py | 17 ++-- .../scripts/test_bedrock_pricing.py | 12 +++ .../llm-to-bedrock/scripts/test_iam_policy.py | 12 +++ .../scripts/test_preflight_bedrock.py | 25 ++++- .../shared/ai/ai-migration-guardrails.md | 8 +- .../skills/shared/ai/ai-openai-to-bedrock.md | 57 +++++++----- .../skills/shared/ai/bedrock-pricing-cache.md | 36 +++++--- .../shared/ai/models/openai-bedrock.json | 89 ++++++++++++++---- .../skills/shared/ai/schema-design-aws-ai.md | 23 +++-- .../tests/test_gpt6_review_round2.py | 29 ++++-- .../tests/test_gpt6_review_round5.py | 17 +++- .../tests/test_gpt6_round4_findings.py | 30 ++++-- 46 files changed, 794 insertions(+), 388 deletions(-) diff --git a/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md b/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md index 6cfdc6979..d4065c4a5 100644 --- a/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md +++ b/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md @@ -257,7 +257,7 @@ client = anthropic.Anthropic( Preserve compatible SDK request/response shapes. A model version change still requires §9 target checks, including typed response parsing for Opus 5.5. Apply the Chat Completions → Responses reshape only when that API change was selected. Preserve the exact validated runtime profile ID or ARN. After applying the changes above, skip the Converse-specific guidance in the rest of §8; the §9 behavior-delta application still applies normally. -**Converse for a proprietary GPT target is family-dependent.** GPT-5.5 / GPT-5.4 (`openai.gpt-5.5`, `openai.gpt-5.4`) have no `bedrock-runtime` surface — a boto3 `converse()` call against them fails at runtime; if your context pairs one with the Converse path, stop and report the contradiction. GPT-5.6 and GPT-6 (Astra, Sol, Luna, 6.1 Sol) DO have a `bedrock-runtime` path via CRIS ids (`us.`/`in.`/`global.` prefixed): when the plan says `migration_path: runtime_openai_cris`, a Converse or Responses rewrite against the CRIS id is valid (base URL `bedrock-runtime.{region}.amazonaws.com/openai/v1` for the OpenAI-compatible APIs; note Guardrails are Converse-only and prompt caching Responses-only on runtime). For a Responses-based source app, the mantle express lane above remains the default and smallest change. +**Converse for a proprietary GPT target is id-form-dependent, not family-dependent.** A **bare** proprietary GPT id (`openai.gpt-5.5`, `openai.gpt-5.4`, `openai.gpt-5.6-*`, `openai.gpt-6-*`) is a `bedrock-mantle` id with no `bedrock-runtime` in-region form — a boto3 `converse()` call against a bare id fails at runtime; if your context pairs a bare id with the Converse path, stop and report the contradiction. GPT-5.6, GPT-6 (Astra, Sol, Luna, 6.1 Sol) **and GPT-5.5 / GPT-5.4** (model cards read 2026-11-06: `us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`; Responses, Chat Completions and Converse on runtime, no Invoke) all have a `bedrock-runtime` path via CRIS ids (`us.`/`in.`/`global.` prefixed): when the plan says `migration_path: runtime_openai_cris`, a Converse, Responses or Chat Completions rewrite against the CRIS id is valid (base URL `bedrock-runtime.{region}.amazonaws.com/openai/v1` for the OpenAI-compatible APIs; note Guardrails are Converse-only and prompt caching Responses-only on runtime). For a Responses-based source app, the mantle express lane above remains the default and smallest change. ### Converse rewrite (default) diff --git a/plugins/aws-startup-advisor/agents/llm2bedrock-prompt-evaluator.md b/plugins/aws-startup-advisor/agents/llm2bedrock-prompt-evaluator.md index d18e1a13d..d933c4b3e 100644 --- a/plugins/aws-startup-advisor/agents/llm2bedrock-prompt-evaluator.md +++ b/plugins/aws-startup-advisor/agents/llm2bedrock-prompt-evaluator.md @@ -229,12 +229,13 @@ Interpret the result: region. These models are **in-region only**, so there is no cross-region inference profile to fall back to and `resolve-bedrock-model-id`'s inference-profile ranking does not apply. Return - `{ blocked: { reason: 'model_unresolvable', detail: ' — is not available on the bedrock-mantle endpoint in . Mantle is in-region only; for Astra use Virginia/Oregon Standard Mantle or a supported us./global. runtime profile with an explicit plan change; GPT-5.6 may use its us./in./global. CRIS forms, while GPT-5.5/5.4 need a supported region or a different model.' } }`. + `{ blocked: { reason: 'model_unresolvable', detail: ' — is not available on the bedrock-mantle endpoint in . Mantle is in-region only; for Astra use Virginia/Oregon Standard Mantle or a supported us./global. runtime profile with an explicit plan change; GPT-5.6 may use its us./in./global. CRIS forms and GPT-5.5/5.4 their us./global. CRIS forms with an explicit plan change, or pick a supported mantle region or a different model.' } }`. Use `model_unresolvable` rather than a new reason — its recovery path (user picks or pastes an ID, recorded in `resolved_model_overrides`) is exactly right here. Astra may use only supported `us.` / `global.` CRIS candidates; check its own region matrix. For GPT-5.6 a `us.`/`in.`/`global.`-prefixed CRIS candidate is legitimate - (it switches the run to the Converse path); for GPT-5.5 / GPT-5.4 no prefixed - form exists — do not offer one. + (it switches the run to the Converse path); for GPT-5.5 / GPT-5.4 the `us.`/`global.` + prefixed forms exist on `bedrock-runtime` (model cards read 2026-11-06) and are offered + the same way — never silently, always as an explicit plan change. - **HTTP 401 / 403** — distinguish the two causes from the message. If it names model access, return `{ blocked: { reason: 'model_access', ... } }` as in §6. Otherwise it is IAM: the principal needs the `bedrock-mantle:*` actions diff --git a/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md b/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md index 54d09601e..9b9de321e 100644 --- a/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md +++ b/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md @@ -143,7 +143,7 @@ The pricing script only covers Bedrock models. For the source provider (OpenAI, **Astra:** use its separately dated Bedrock rates and context/inference tier. Its source price is absent from the table below; verify that price or mark the source comparison unavailable. Do not estimate Astra from a lower GPT tier or assume GPT-5.x parity/premium. -**GPT-5.x same-model pair cost depends on the inference option — state it conditionally, never as a flat figure.** In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier (1.10x standard), so those moves cost ~10% more — quote the increase plainly and carry the non-cost justification (commitments, governance, residency, prompt caching, no behaviour delta). **GPT-5.6 on Global CRIS is priced at the standard rate — cost parity** — applicable only when the workload has no data-residency constraint; when the plan's `migration_path` is `runtime_openai_cris` with a `global.` id, report parity, not a premium. GPT-5.5/5.4 have no CRIS, so the ~10% figure always applies to them. **If a pair's workload exceeds 272K context**, price the Bedrock side at the GPT-5.6 long-context tier — 2.0x input, 1.5x output per option — and show that line separately; GPT-5.5/5.4 have no long-context tier so their usable window is 272K. +**GPT-5.x same-model pair cost depends on the inference option — state it conditionally, never as a flat figure.** In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier (1.10x standard), so those moves cost ~10% more — quote the increase plainly and carry the non-cost justification (commitments, governance, residency, prompt caching, no behaviour delta). **GPT-5.6 on Global CRIS is priced at the standard rate — cost parity** — applicable only when the workload has no data-residency constraint; when the plan's `migration_path` is `runtime_openai_cris` with a `global.` id, report parity, not a premium. GPT-5.5/5.4 do have `us.`/`global.` CRIS ids on `bedrock-runtime`, but their model cards (read 2026-11-06) publish In-Region pricing only — so the ~10% figure applies to them on every inference option until a Global rate is published; never report parity for them. **If a pair's workload exceeds 272K context**, price the Bedrock side at the long-context tier and show that line separately: GPT-5.6 is 2.0x input / 1.5x output per option; GPT-5.5 is 11.00 / 1.10 cache read / 49.50 and GPT-5.4 is 5.50 / 0.55 cache read / 24.75 per 1M tokens (In-Region, from their cards), applied to all tokens of the request, within a 1,050,000-token context window. If the source model is not in this table (likely for any model released after the table's last update — check the provider's public pricing page if you know current rates), note it as a gap in the Risk Assessment section, label the figure "(estimated from ``)", and estimate using the closest listed model's pricing. diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md b/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md index f3e4563cb..c418842ed 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md +++ b/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md @@ -94,17 +94,23 @@ reuse the Anthropic `preserve_messages_api` switch): OpenAI is handled by a dedicated provider module (`openai-bedrock.json` catalog). Recognized GPT-5.6 and GPT-6 source identities are evaluated against their exact same-model -catalog entry before capability/numeric fallbacks. GPT-5.x on Mantle is Responses-only, so a Chat -Completions source is reshaped rather than routed to `mantle_openai_chat`. GPT-6 Chat Completions -sources with required or preferred API continuity instead keep that surface through -`mantle_openai_chat`; GPT-6 Responses sources use `mantle_openai_responses`. Both Mantle paths are +catalog entry before capability/numeric fallbacks. The engine routes only recognized GPT-6 Chat +Completions sources to `mantle_openai_chat`; a GPT-5.x Chat Completions source is currently +reshaped to Responses. That reshape is a current engine limitation, not a model fact: the catalog +records Chat Completions as supported on Mantle for GPT-5.5 and GPT-5.4 (model cards read +2026-11-06) and as unchecked for GPT-5.6 Sol. GPT-6 Chat Completions sources with required or +preferred API continuity keep that surface through `mantle_openai_chat`; GPT-6 Responses sources +use `mantle_openai_responses`. Both Mantle paths are in-region only and enforce the selected model's cataloged `region_availability`: Astra reaches us-east-1 and us-west-2, while Sol, Luna, and 6.1 Sol reach us-east-1 only. Outside that footprint, the engine skips the same-model Mantle candidate and evaluates its existing capability/numeric fallbacks. Governance requirements select the exact same GPT-5.6 or GPT-6 model through `runtime_converse` only when the requested Global or geography-scoped CRIS profile is cataloged for that model and source region; an unsupported profile falls through to an eligible documented -runtime candidate or remains an explicit decision. GPT-5.5/5.4 remain mantle-only. GPT-6 Astra's +runtime candidate or remains an explicit decision. GPT-5.5/5.4 also carry a cataloged +`runtime_converse` path via `us.`/`global.` CRIS ids (model cards read 2026-11-06); the engine does +not yet recognize them as same-model source identities, so a GPT-5.5/5.4 source under governance +requirements still lands on the Claude Converse tier until that recognition is added. GPT-6 Astra's runtime surface lacks `Invoke` support (Responses/Chat Completions/Converse only), while Sol/Luna/6.1 Sol support all four APIs. Every selected path remains provisional until it is probed in the target account and region. Azure OpenAI remains an explicit `provider_module_pending` diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md index 18266733c..a4206583c 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle only; no 1M tier) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle only; no 1M tier) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 11.00/49.50; card read 2026-11-06) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 5.50/24.75; card read 2026-11-06) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | @@ -353,17 +353,24 @@ Regions (mantle): us-east-1 / us-east-2 for all five; us-west-2 additionally car | GPT-5.5 | 5.50 | 33.00 | — | 0.55 | | GPT-5.4 | 2.75 | 16.50 | — | 0.275 | -#### Long context (1M) — GPT-5.6 only, 2.0x input / 1.5x output - -| Model | Input $/1M | Output $/1M | -| ------------- | ---------- | ----------- | -| GPT-5.6 Sol | 8.80 | 33.00 | -| GPT-5.6 Terra | 4.40 | 19.80 | -| GPT-5.6 Luna | 0.44 | 1.98 | - -A workload above 272K context must be priced at the long-context tier. GPT-5.5 and GPT-5.4 have no such tier, so -their usable window is 272K. Global CRIS is published at OpenAI's standard list price (cost parity, GPT-5.6 only — -see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. +#### Long context (>272K input tokens) — GPT-5.6 at 2.0x input / 1.5x output; GPT-5.5 / GPT-5.4 per their model cards + +| Model | Input $/1M | Output $/1M | Cache read $/1M | +| ------------- | ---------- | ----------- | --------------- | +| GPT-5.6 Sol | 8.80 | 33.00 | — | +| GPT-5.6 Terra | 4.40 | 19.80 | — | +| GPT-5.6 Luna | 0.44 | 1.98 | — | +| GPT-5.5 | 11.00 | 49.50 | 1.10 | +| GPT-5.4 | 5.50 | 24.75 | 0.55 | + +A workload above 272K input tokens must be priced at the long-context tier, applied to all input and output tokens +of the request. GPT-5.5 and GPT-5.4 rows read from their model cards on 2026-11-06 +([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), +[GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)); both cards state a +1,050,000-token context window (128,000 max output) and list `us.`/`global.` CRIS ids on `bedrock-runtime`, but +publish the In-Region inference option only. Global CRIS is published at OpenAI's standard list price (cost parity, +GPT-5.6 only — see `openai-on-bedrock.md`). GovCloud (US-West) GPT-5.4 short-context is 3.375 / 20.25 (cache read +0.3375) per the 2026-11-06 card; an earlier revision recorded 3.30 / 19.80. > **One source conflict.** These models are absent > from the AWS Price List API entirely: querying `AmazonBedrock` returns only `gpt-oss` and GPT OSS Safeguard, and @@ -373,7 +380,8 @@ see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. **Prompt caching (GPT-5.6 only):** cached input read at a 90% discount, cache write at 1.25x uncached input, minimum 1,024-token prefix, up to 4 breakpoints, ≥30-minute retention. Cached input is exempt from the input-TPM quota. -GPT-5.5 and GPT-5.4 do not list prompt caching support. +GPT-5.5 and GPT-5.4 list only implicit prompt caching on `bedrock-runtime` Responses (automatic, no request +parameters; cache-read rate above, no cache-write rate) and none on mantle (model cards read 2026-11-06). #### Open-weight gpt-oss diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json index a6bb34385..bed2a584b 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json +++ b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json @@ -3,8 +3,8 @@ "provider": "openai", "verified_at": "2026-09-24", "verified_region": "us-east-2", - "source": "Opus 5.5 cross-family target: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-5-5.html (retrieved 2026-09-24). OpenAI and other unchanged entries retain their evidence from the superseded 2026-08-21 catalog (removed; see git history).", - "disclaimer": "The Opus cross-family target is updated to Opus 5.5; same-model OpenAI paths and their earlier evidence remain unchanged. This is a migration target catalog, not an account-availability claim. Verify the chosen model, API, region and CRIS profile before implementation. Opus 5.5 uses CRIS on runtime outside eu-west-2, has 1M context/128K output, always-on adaptive thinking, and no Batch tier. Fable and Mythos remain excluded from default selection. Opus 5.5 is the only Opus model in the automatic selection pool; older Opus snapshots and pricing records are historical references. The runtime in-region exception in eu-west-2 was verified 2026-10-03; the original catalog and other model evidence dates remain unchanged.", + "source": "Opus 5.5 cross-family target: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-5-5.html (retrieved 2026-09-24). GPT-5.5 and GPT-5.4 rows re-read from their public model cards on 2026-11-06 (https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html, https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html): both now list bedrock-runtime (Responses, Chat Completions, Converse via us./global. CRIS ids) and Chat Completions on bedrock-mantle. Other OpenAI entries retain their evidence from the superseded 2026-08-21 catalog (removed; see git history).", + "disclaimer": "The Opus cross-family target is updated to Opus 5.5; the GPT-5.5 and GPT-5.4 entries were re-read from their public model cards on 2026-11-06 (runtime CRIS paths, Chat Completions on mantle, 1.05M context, long-context pricing); the other same-model OpenAI paths and their earlier evidence remain unchanged. This is a migration target catalog, not an account-availability claim. Verify the chosen model, API, region and CRIS profile before implementation. Opus 5.5 uses CRIS on runtime outside eu-west-2, has 1M context/128K output, always-on adaptive thinking, and no Batch tier. Fable and Mythos remain excluded from default selection. Opus 5.5 is the only Opus model in the automatic selection pool; older Opus snapshots and pricing records are historical references. The runtime in-region exception in eu-west-2 was verified 2026-10-03; the original catalog and other model evidence dates remain unchanged.", "paths": { "mantle_openai_responses": { "sdk": "openai", @@ -19,8 +19,8 @@ "GPT-5.x on Bedrock Mantle is served through the Responses API" ], "constraints": [ - "Mantle itself has no cross-region form for any GPT model (in-region only); for GPT-5.6 the bedrock-runtime CRIS path covers additional regions instead (see runtime_converse)", - "GPT-5.x on Mantle rejects Chat Completions; a Chat Completions source must reshape to Responses (reference-verified on gpt-5.4; the 5.6 cards list Chat Completions as a supported API but its mantle-side availability is unprobed — verify in the target account)", + "Mantle itself has no cross-region form for any GPT model (in-region only); for GPT-5.6, GPT-5.5 and GPT-5.4 the bedrock-runtime CRIS path covers additional regions instead (see runtime_converse)", + "Chat Completions support on Mantle is model-specific: the GPT-5.4 and GPT-5.5 model cards list Chat Completions as supported on bedrock-mantle (read 2026-11-06); the GPT-5.6 Sol card does not. A Chat Completions source reshapes to Responses only when the selected model's card does not list Chat Completions — verify in the target account", "Availability must be probed in the target account and region" ] }, @@ -36,7 +36,7 @@ "OpenAI-compatible Chat Completions surface for models that accept it" ], "constraints": [ - "Not available for the GPT-5.x models listed here: rejected on gpt-5.4 (internal reference probe) and unsupported on the gpt-5.6-sol model card", + "Model-specific: listed as supported on bedrock-mantle by the GPT-5.4 and GPT-5.5 model cards (https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html, https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html, read 2026-11-06) and by the GPT-6 cards; unsupported on the gpt-5.6-sol model card. Uses /openai/v1/chat/completions", "Availability and model support must be probed in the target account and region" ] }, @@ -51,10 +51,10 @@ "strengths": [ "Bedrock-native multi-model request surface", "Supports Bedrock Guardrails (Converse API only), invocation logging, and CloudWatch", - "For GPT-5.6 this is a SAME-MODEL governance path via CRIS (us./in./global. ids; base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs); the model cards recommend runtime for new applications, and Global CRIS is priced at OpenAI's standard rate (cost parity)" + "For GPT-5.6, GPT-5.5 and GPT-5.4 this is a SAME-MODEL governance path via CRIS (us./in./global. ids; base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs); the model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" ], "constraints": [ - "GPT-5.5 / GPT-5.4 have NO runtime path — a Converse target for them means a Bedrock-native model and a boto3 rewrite of the OpenAI integration", + "GPT-5.5 / GPT-5.4 on runtime are CRIS-only (us. and global. ids; no in-region form) per their model cards (read 2026-11-06); the cards publish In-Region (1.10x) pricing only, so do not assume Global CRIS price parity for them", "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. Runtime does not support server-side tool use, structured outputs, or application inference profiles for these models; prompt caching is Responses-only", "Bedrock-native models generally require a Global or geography-scoped CRIS inference profile", "Availability must be probed in the target account and region" @@ -111,19 +111,47 @@ "generation": "reasoning", "version": "5.5", "class": "reasoning", - "context_window": 272000, - "output_token_ceiling": "unknown", + "context_window": 1050000, + "output_token_ceiling": 128000, + "inference_profiles": { + "us": ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "ca-central-1", "ca-west-1"], + "global": ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "ca-central-1", "ca-west-1", "mx-central-1", "eu-central-1", "eu-central-2", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-2", "eu-west-3", "ap-east-2", "ap-northeast-1", "ap-northeast-2", "ap-northeast-3", "ap-south-1", "ap-south-2", "ap-southeast-1", "ap-southeast-2", "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", "ap-southeast-6", "ap-southeast-7", "il-central-1", "me-central-1", "me-south-1", "af-south-1", "sa-east-1"] + }, + "region_availability": { + "commercial": ["us-east-1", "us-east-2"], + "govcloud": [], + "evidence": "bedrock-mantle in-region rows of the GPT-5.5 model card, read 2026-11-06: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html" + }, + "pricing": { + "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html (read 2026-11-06); USD per 1M tokens, Standard tier; the card lists the In-Region inference option only", + "commercial_short_context_le_272k": {"input": 5.50, "cache_read": 0.55, "output": 33.00}, + "commercial_long_context_gt_272k": {"input": 11.00, "cache_read": 1.10, "output": 49.50}, + "service_tiers": {"standard": true, "priority": false, "flex": false, "reserved": false} + }, "capabilities": [ "reasoning", - "tool_or_function_calling" + "tool_or_function_calling", + "image_input_vision" ], - "capability_source": "AWS model card 2026-07-21 (launch 2026-06-01, Active): advanced coding/agentic tasks; tool calling via the Responses API's built-in tool use. Feature-level Mantle behavior not probed — verify before relying. Re-verified 2026-08-21: still mantle-only, in-region only; no CRIS, no runtime path, no long-context tier.", + "capability_source": "AWS model card https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html (read 2026-11-06; launch 2026-06-01, Active, EOL no sooner than 2027-06-01): text+image input, text output; 1,050,000-token context shared between input and output, 128,000 max output. Mantle lists server-side and client-side tool calling; runtime lists invocation logs, streaming, Guardrails (Converse only), application inference profiles (Converse only), implicit prompt caching (Responses only), structured outputs (Responses) and reasoning summaries; server-side tool use is unsupported on runtime. Documentation claims, not account probes — verify before relying.", "paths": { "mantle_openai_responses": { "available": true, "model_id": "openai.gpt-5.5", "requires_cris": false, - "evidence": "AWS model card model-card-openai-gpt-55 (2026-07-21): bedrock-mantle Programmatic Access with Responses sample code; Geo/Global inference not supported" + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): bedrock-mantle supports Responses at /openai/v1/responses; in-region us-east-1 and us-east-2 only; Geo/Global not supported on mantle" + }, + "mantle_openai_chat": { + "available": true, + "model_id": "openai.gpt-5.5", + "requires_cris": false, + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): Chat Completions listed as supported on bedrock-mantle at /openai/v1/chat/completions, with sample code" + }, + "runtime_converse": { + "available": true, + "model_id": "openai.gpt-5.5", + "requires_cris": true, + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): bedrock-runtime supported with Responses, Chat Completions and Converse (Messages and Invoke unsupported); no in-region form — requests must name us.openai.gpt-5.5 (Geo) or global.openai.gpt-5.5 (Global); base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs" } } }, @@ -213,27 +241,50 @@ "generation": "reasoning", "version": "5.4", "class": "reasoning", - "context_window": "unknown", - "output_token_ceiling": "unknown", + "context_window": 1050000, + "output_token_ceiling": 128000, + "inference_profiles": { + "us": ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "ca-central-1", "ca-west-1"], + "global": ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "ca-central-1", "ca-west-1", "mx-central-1", "eu-central-1", "eu-central-2", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-2", "eu-west-3", "ap-east-2", "ap-northeast-1", "ap-northeast-2", "ap-northeast-3", "ap-south-1", "ap-south-2", "ap-southeast-1", "ap-southeast-2", "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", "ap-southeast-6", "ap-southeast-7", "il-central-1", "me-central-1", "me-south-1", "af-south-1", "sa-east-1"] + }, + "region_availability": { + "commercial": ["us-east-1", "us-east-2", "us-west-2"], + "govcloud": ["us-gov-west-1"], + "evidence": "bedrock-mantle in-region rows of the GPT-5.4 model card, read 2026-11-06: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html" + }, + "pricing": { + "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html (read 2026-11-06); USD per 1M tokens, Standard tier; the card lists the In-Region inference option only", + "commercial_short_context_le_272k": {"input": 2.75, "cache_read": 0.275, "output": 16.50}, + "commercial_long_context_gt_272k": {"input": 5.50, "cache_read": 0.55, "output": 24.75}, + "govcloud_us_west_short_context_le_272k": {"input": 3.375, "cache_read": 0.3375, "output": 20.25}, + "service_tiers": {"standard": true, "priority": false, "flex": false, "reserved": false} + }, "capabilities": [ "tool_or_function_calling", "structured_output_json", "reasoning", - "streaming" + "streaming", + "image_input_vision" ], - "capability_source": "internal reference smoke tests and its reasoning-API migration notebook (Responses path, 2026-06 probes) — the only entry with feature-level Mantle behavior probes (tools, structured output, sampling); limits not stated Re-verified 2026-08-21: still mantle-only, in-region only; no CRIS, no runtime path, no long-context tier.", + "capability_source": "AWS model card https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html (read 2026-11-06; launch 2026-06-01, Active, EOL no sooner than 2027-06-01): text+image input, text output; 1,050,000-token context shared between input and output, 128,000 max output. Mantle lists server-side and client-side tool calling; runtime lists invocation logs, response streaming, Guardrails (Converse only), application inference profiles (Converse only), implicit prompt caching (Responses only), structured outputs (JSON Schema; Responses API) and reasoning summaries; server-side tool use is unsupported on runtime. Documentation claims, not account probes — verify before relying.", "paths": { "mantle_openai_responses": { "available": true, "model_id": "openai.gpt-5.4", "requires_cris": false, - "evidence": "internal reference smoke-test default Mantle model id; client.responses.create verified live" + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): bedrock-mantle supports Responses at /openai/v1/responses; in-region us-east-1, us-east-2, us-west-2 and us-gov-west-1; Geo/Global not supported on mantle" }, "mantle_openai_chat": { - "available": false, + "available": true, "model_id": "openai.gpt-5.4", "requires_cris": false, - "evidence": "internal reference verified gotcha: GPT-5.x on Mantle is Responses-only; Chat Completions rejected" + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): Chat Completions listed as supported on bedrock-mantle at /openai/v1/chat/completions, with sample code" + }, + "runtime_converse": { + "available": true, + "model_id": "openai.gpt-5.4", + "requires_cris": true, + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): bedrock-runtime supported with Responses, Chat Completions and Converse (Messages and Invoke unsupported); no in-region form — requests must name us.openai.gpt-5.4 (Geo) or global.openai.gpt-5.4 (Global); base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs" } } }, diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py index a7f1289cf..e3b1a07e0 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py +++ b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py @@ -1271,8 +1271,9 @@ def _unresolved( ( "The selected Astra Responses path requires reshaping the Chat source." if model_key == "openai_gpt_6_astra" - else "GPT-5.x on Mantle rejects Chat Completions; the source must reshape " - "to the Responses API." + else "The selected Mantle Responses path requires reshaping the Chat source " + "to the Responses API (Chat Completions support is per-model: see the " + "selected model's mantle_openai_chat catalog entry)." ), "Apply the request/response/tool/state reshape deltas before cutover.", ) diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py index ef92d7291..7d22b84a7 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py +++ b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py @@ -64,18 +64,58 @@ def test_responses_source_with_continuity_recommends_mantle_responses(): assert rec["primary_model"] == "openai.gpt-5.6-sol" -def test_chat_completions_gpt5_target_selects_responses_not_chat(): +def test_chat_completions_unrecognized_gpt5_source_lands_on_sol_responses(): + # The default workload's source is `gpt-5.4`, which the engine does not yet + # recognize as a same-model identity (see _SOURCE_MODEL_KEYS), so it lands on + # the first catalog candidate — GPT-5.6 Sol — whose card leaves Chat + # Completions unchecked on Mantle. The reshape here follows from THAT model's + # card, not from a blanket "GPT-5.x on Mantle is Responses-only" rule: the + # GPT-5.4 card itself lists Chat Completions on Mantle (see the catalog test + # below). rec = _recommend( _workload( source={"api_surface": "chat_completions"}, requirements={"api_continuity": "required"}, ) ) + assert rec["primary_model"] == "openai.gpt-5.6-sol" + assert OPENAI_CATALOG["models"]["openai_gpt_5_6_sol"]["paths"]["mantle_openai_chat"]["available"] is False assert rec["api_path"] == "mantle_openai_responses" assert rec["api_path"] != "mantle_openai_chat" assert "chat_completions_to_responses_required" in _codes(rec["blocks"]) +@pytest.mark.parametrize( + ("catalog_key", "model_id", "card"), + [ + ("openai_gpt_5_4", "openai.gpt-5.4", "model-card-openai-gpt-54.html"), + ("openai_gpt_5_5", "openai.gpt-5.5", "model-card-openai-gpt-55.html"), + ], +) +def test_catalog_gpt54_gpt55_record_public_runtime_and_chat_facts(catalog_key, model_id, card): + # Public model cards (read 2026-11-06): both models list bedrock-runtime + # (Responses, Chat Completions, Converse via us./global. CRIS ids; no in-region + # form), Chat Completions on bedrock-mantle, a 1,050,000-token context window + # and 128,000 max output. Provenance must be the public card, never an + # internal reference. + model = OPENAI_CATALOG["models"][catalog_key] + paths = model["paths"] + assert paths["mantle_openai_responses"]["available"] is True + assert paths["mantle_openai_chat"]["available"] is True + assert paths["runtime_converse"]["available"] is True + assert paths["runtime_converse"]["requires_cris"] is True + assert paths["runtime_converse"]["model_id"] == model_id + assert f"us.{model_id}" in paths["runtime_converse"]["evidence"] + assert f"global.{model_id}" in paths["runtime_converse"]["evidence"] + assert set(model["inference_profiles"]) == {"us", "global"} + assert model["context_window"] == 1050000 + assert model["output_token_ceiling"] == 128000 + assert card in model["capability_source"] + for path in paths.values(): + assert "internal reference" not in path["evidence"] + assert "internal reference" not in model["capability_source"] + + def test_chat_completions_case_includes_full_reshape_deltas(): rec = _recommend( _workload( diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md index 9dd6a3cb4..760e5e5bb 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md @@ -129,9 +129,10 @@ running). → `ai_constraints.cross_cloud`. Default `"latency-acceptable"`. | Claude (Anthropic SDK) | Same model on Bedrock | client swap only — no model change | | Other / multiple / don't know | ask / infer | — | -**Same-model rows first.** GPT-5.6/5.5/5.4 run on Bedrock via `bedrock-mantle` (Responses, -in-region only) — the case is AWS commitments/governance/residency, not savings, and not parity -(~10% above OpenAI standard). For sources with no Bedrock equivalent, present a same-vendor +**Same-model rows first.** GPT-5.6/5.5/5.4 run on Bedrock via `bedrock-mantle` (Responses or +Chat Completions, in-region only) or via `bedrock-runtime` CRIS ids (`us.`/`global.`) — the case +is AWS commitments/governance/residency, not savings, and not parity (~10% above OpenAI standard +in-region; GPT-5.6 Global CRIS is at the standard rate). For sources with no Bedrock equivalent, present a same-vendor upgrade AND a cross-family option. → `ai_model_baseline`. **After Batch 1:** interpret answers, write `preferences-draft.json` (`metadata.draft: true`, diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md index 1d05cd4a5..7b4564837 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md @@ -155,7 +155,9 @@ data-residency-tier premium, while supported Global CRIS uses standard-rate pari Report the actual option; do not downgrade solely for the modest verified premium. **GPT-5.6/GPT-6 only:** above 272K context, apply 2.0x input and 1.5x output rates only when the selected model and inference option support that tier; the resulting gap may change -the assessment. GPT-5.5/5.4 have no 1M tier. **Opus 5.5:** use the selected region/profile's +the assessment. GPT-5.5/5.4 have their own long-context (>272K) rates on their model cards +(read 2026-11-06; see `openai-on-bedrock.md` § Pricing) — use those, not the GPT-5.6 +multiplier. **Opus 5.5:** use the selected region/profile's flat rates from `references/vendored/ai/bedrock-pricing-cache.md` throughout the full 1M context; do not apply the GPT multiplier. Verify other models' tiers individually. @@ -216,15 +218,21 @@ key/token provider), model ID, and IAM (`bedrock-mantle:*`) change. Read `references/shared/openai-on-bedrock.md` for exact values. **A Chat Completions source is a supported near-drop-in for GPT-6 and GPT-5.6** (both list Chat Completions on mantle and runtime CRIS per their model cards) — keep `chat.completions.create` unless a Responses-only feature or -demonstrated constraint drives a reshape. **GPT-5.5 and GPT-5.4 are the exception**: Chat -Completions support is unconfirmed on their model cards, so a Chat Completions source on either -still needs a planned reshape to `responses.create`. **No Converse fallback for GPT-5.5/GPT-5.4 — GPT-5.6 and -GPT-6 differ.** GPT-5.5 and GPT-5.4 are mantle-only, in-region only: needing Guardrails/Knowledge -Bases/logging/an unsupported region forces a `converse` path with `model_change: true` to a -Bedrock-native model (or `gpt-oss`). GPT-5.6 Sol/Terra/Luna and all five GPT-6 models (Astra, Sol, -Luna, 6.1 Sol, 6.1 Terra) DO have a `bedrock-runtime` CRIS path (`us.`/`global.` prefixed IDs) — for these -models the same need is satisfied by switching endpoint, not model: record -`migration_path: "runtime_openai_cris"` with `model_change: false`. Note: `runtime_openai_cris` +demonstrated constraint drives a reshape. **GPT-5.5 and GPT-5.4 follow the same rule**: their +model cards (read 2026-11-06) list Chat Completions as supported on both `bedrock-mantle` and +`bedrock-runtime`, so a Chat Completions source on either may keep `chat.completions.create`; the +reshape to `responses.create` is optional for them too. Plan a reshape only when the selected +model's card leaves Chat Completions unchecked on the selected endpoint. **Every proprietary GPT +model on Bedrock has a `bedrock-runtime` CRIS path — including GPT-5.5 and GPT-5.4.** GPT-5.6 +Sol/Terra/Luna, all five GPT-6 models (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra), and GPT-5.5 / +GPT-5.4 (`us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / +`global.openai.gpt-5.4`; Responses, Chat Completions and Converse on runtime, no runtime +in-region form) have a `bedrock-runtime` CRIS path (`us.`/`global.` prefixed IDs) — for all of +them a Guardrails/logging/application-inference-profile/unsupported-region need is satisfied by +switching endpoint, not model: record `migration_path: "runtime_openai_cris"` with +`model_change: false`. Reserve `converse` with `model_change: true` to a Bedrock-native model (or +`gpt-oss`) for a need the same-model CRIS path cannot serve (Knowledge Bases, intelligent prompt +routing). Note: `runtime_openai_cris` for GPT-6 Astra is valid only via Responses/Chat Completions/Converse — Astra does not support `Invoke`, so verify per-feature against Astra's model card before assuming parity with Sol/Luna/6.1 Sol. **When Guardrails is the driving need and the design keeps diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design.md index 382da53e4..60dda47b0 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design.md @@ -82,7 +82,7 @@ _postconditions: _on_failure: _halt_and_inform - _assert: "WHEN aws-design-ai.json exists: every design_blocks[] row has exactly one of target_bedrock_model / target_aws_service non-null (XOR), and every document_extraction/image_analysis/speech_transcription row has target_bedrock_model null, a non-null target_aws_service, and honest_assessment 'not_applicable' — per references/shared/schema-design-aws-ai.md" _on_failure: _halt_and_inform - - _assert: "WHEN aws-design-ai.json exists AND summary.ai_source is azure_openai or openai: every source model that is available on Bedrock and carried by the target region maps to itself with model_change false — not to a Claude/Nova substitute; and no proprietary GPT-5.5 or GPT-5.4 model ID is paired with a converse/bedrock-runtime migration path (bare proprietary openai.gpt-* IDs use Mantle only; runtime_openai_cris accepts documented Astra us./global. and GPT-5.6/GPT-6 profiles with caller-region checks and the selected API; GPT-5.6 and GPT-6 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation)" + - _assert: "WHEN aws-design-ai.json exists AND summary.ai_source is azure_openai or openai: every source model that is available on Bedrock and carried by the target region maps to itself with model_change false — not to a Claude/Nova substitute; and no bare proprietary openai.gpt-* model ID (including bare openai.gpt-5.5 or openai.gpt-5.4) is paired with a converse/bedrock-runtime migration path (bare proprietary openai.gpt-* IDs use Mantle only; runtime_openai_cris accepts documented Astra us./global., GPT-5.6/GPT-6 and GPT-5.5/GPT-5.4 us./global. profiles with caller-region checks and the selected API; GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation)" _on_failure: _halt_and_inform - _assert: "WHEN aws-design-ai.json exists: regional_warnings[] and multi_model_warnings[] are present (empty is fine); agentic_design is present only when agentic_profile.is_agentic is true; and App Runner appears nowhere" _on_failure: _halt_and_inform diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md index 646840dd2..109a9a003 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md @@ -155,9 +155,10 @@ is AWS-only and ports from gcp unchanged. - [ ] No secret VALUE in any emitted file; credentials are env-var references. - [ ] Bare proprietary GPT ids use Mantle; Astra runtime calls retain the validated `us.` / `global.` CRIS id. Chat/Responses and runtime artifact selection match the saved design. -- [ ] No **GPT-5.5 or GPT-5.4** model ID paired with a Converse/`bedrock-runtime` path (those two - models only — mantle-only, no CRIS). GPT-5.6 and GPT-6 models MAY use - `migration_path: "runtime_openai_cris"` on `bedrock-runtime` — this is NOT a violation. +- [ ] No **bare** proprietary GPT model ID (including bare `openai.gpt-5.5` / `openai.gpt-5.4`) + paired with a Converse/`bedrock-runtime` path. GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use + `migration_path: "runtime_openai_cris"` on `bedrock-runtime` with a `us.`/`in.`/`global.` + CRIS id — this is NOT a violation. - [ ] Plugin attribution strings say "Azure-to-AWS". - [ ] `generation-ai.json` validates; `rollback_plan.mechanism == "feature_flag"`. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate.md index be0ac3018..94730ad32 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate.md @@ -73,7 +73,7 @@ _postconditions: _on_failure: _halt_and_inform - _assert: "no secret VALUE from the inventory appears in any generated artifact; secrets are emitted as Secrets Manager references" _on_failure: _halt_and_inform - - _assert: "WHEN aws-design-ai.json exists AND run_mode is decide_and_execute: generation-ai.json exists and validates, its rollback_plan.mechanism is 'feature_flag' with flag_name 'AI_PROVIDER' and default_value 'azure_openai'; an ai-migration/ directory was produced (setup_bedrock.sh, test_comparison.py, bedrock_monitoring.tf on every path; migrate_to_mantle.sh for the mantle path OR provider_adapter.* for the direct/gpt-oss path, not both); and no proprietary GPT-5.5 or GPT-5.4 model ID is paired with a converse/bedrock-runtime path (bare proprietary openai.gpt-* IDs use Mantle only; runtime_openai_cris accepts documented Astra us./global. and GPT-5.6/GPT-6 profiles with caller-region checks and the selected API; GPT-5.6 and GPT-6 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation). When aws-design-ai.json is absent this is vacuously satisfied" + - _assert: "WHEN aws-design-ai.json exists AND run_mode is decide_and_execute: generation-ai.json exists and validates, its rollback_plan.mechanism is 'feature_flag' with flag_name 'AI_PROVIDER' and default_value 'azure_openai'; an ai-migration/ directory was produced (setup_bedrock.sh, test_comparison.py, bedrock_monitoring.tf on every path; migrate_to_mantle.sh for the mantle path OR provider_adapter.* for the direct/gpt-oss path, not both); and no bare proprietary openai.gpt-* model ID (including bare openai.gpt-5.5 or openai.gpt-5.4) is paired with a converse/bedrock-runtime path (bare proprietary openai.gpt-* IDs use Mantle only; runtime_openai_cris accepts documented Astra us./global., GPT-5.6/GPT-6 and GPT-5.5/GPT-5.4 us./global. profiles with caller-region checks and the selected API; GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation). When aws-design-ai.json is absent this is vacuously satisfied" _on_failure: _halt_and_inform _forbids_files: - azure-resource-inventory.json diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md index 3b7b1e153..7c9cddaa9 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md @@ -2,6 +2,7 @@ **Last verified:** 2026-10-10 **GPT-6.1 Terra verified:** 2026-10-27 +**GPT-5.5 / GPT-5.4 re-verified:** 2026-11-06 against their model cards ([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) — both now list `bedrock-runtime` (Responses, Chat Completions, Converse via `us.`/`global.` CRIS ids), Chat Completions on mantle, a 1.05M context window and a long-context price tier **Sources:** [OpenAI model cards](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards-openai.html) (per-model cards linked below), [GPT-5.6 launch post](https://aws.amazon.com/blogs/machine-learning/get-started-with-openai-gpt-5-6-sol-terra-and-luna-on-amazon-bedrock/), [GPT-5.6 GA announcement](https://aws.amazon.com/about-aws/whats-new/2026/07/openai-gpt-sol-terra/), @@ -32,8 +33,8 @@ risk) all defer to it. Do not restate model IDs, regions, or endpoint paths else | GPT-5.6 Sol | `openai.gpt-5.6-sol` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-sol.html) | | GPT-5.6 Terra | `openai.gpt-5.6-terra` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-terra.html) | | GPT-5.6 Luna | `openai.gpt-5.6-luna` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-luna.html) | -| GPT-5.5 | `openai.gpt-5.5` | Jun 1, 2026 | 272K | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html) | -| GPT-5.4 | `openai.gpt-5.4` | Jun 1, 2026 | 272K | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html) | +| GPT-5.5 | `openai.gpt-5.5` | Jun 1, 2026 | 1.05M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html) | +| GPT-5.4 | `openai.gpt-5.4` | Jun 1, 2026 | 1.05M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html) | | gpt-oss-120b | `openai.gpt-oss-120b` | Aug 5, 2025 | 128K | Active | open-weight; also on `bedrock-runtime` as `openai.gpt-oss-120b-1:0` | | gpt-oss-20b | `openai.gpt-oss-20b` | Aug 5, 2025 | 128K | Active | open-weight; also on `bedrock-runtime` as `openai.gpt-oss-20b-1:0` | | GPT OSS Safeguard | `openai.gpt-oss-safeguard-120b` / `-20b` | — | — | Active | content-moderation / guardrail enforcement, not general chat | @@ -47,8 +48,10 @@ share a generation with a future `Sol`. **GPT-6** carries forward `Sol` and `Lun discount) — not a new tier name (cite [openai.com/index/introducing-gpt-6-1-sol/](https://openai.com/index/introducing-gpt-6-1-sol/)). > **Context-window conflict (resolved):** the GPT-5.6 launch blog states 272K for all three variants; all three -> model cards state 1M. **The model cards are authoritative** — use 1M for GPT-5.6. GPT-5.5 and GPT-5.4 are 272K on -> both sources. Re-check on refresh; if AWS corrects the blog, the cards still win. +> model cards state 1M. **The model cards are authoritative** — use 1M for GPT-5.6. The GPT-5.5 and GPT-5.4 cards +> (read 2026-11-06) state 1,050,000 tokens shared between input and output with 128,000 max output; the 272K figure +> recorded earlier is now only their short-/long-context pricing breakpoint. Re-check on refresh; if AWS corrects +> the blog, the cards still win. **Not on Bedrock (as of this refresh):** GPT-4o, GPT-4.1, GPT-4 / GPT-4 Turbo, GPT-3.5 Turbo, the o-series (o1/o3/o4-mini), GPT-5 / GPT-5.1 / GPT-5.2, and the `*-Pro` variants (GPT-5.5 Pro, GPT-5.4 Pro). Sources whose model @@ -112,8 +115,12 @@ input and text output. The launch announcement rounds the input context to 1M; u exact limits for capacity checks. Browser/computer-use capability does not establish parity with OpenAI-hosted tools; probe the application's specific tool flow. -**GPT-5.5 and GPT-5.4 are `bedrock-mantle`-only and in-region only.** Their model cards list a single -Programmatic Access row (`bedrock-mantle`, Geo/Global "Not supported") and In-Region pricing only. +**GPT-5.5 and GPT-5.4 have TWO endpoints** (re-verified 2026-11-06 against their model cards; earlier revisions of +this file recorded them as `bedrock-mantle`-only). Both Programmatic Access tables now carry a `bedrock-runtime` +row (In-Region "Not supported"; Geo `us.openai.gpt-5.5` / `us.openai.gpt-5.4`; Global `global.openai.gpt-5.5` / +`global.openai.gpt-5.4`) and a `bedrock-mantle` row (bare id, in-region only). Supported APIs: `Responses`, +`Chat Completions` and `Converse` on `bedrock-runtime`; `Responses` and `Chat Completions` on `bedrock-mantle`; +`Messages` and `Invoke` on neither. The pricing tables still publish the In-Region inference option only. **GPT-5.6 Sol / Terra / Luna have TWO endpoints** (verified 2026-08-21 — this changed after this file's original 2026-08-10 verification; the Refresh Checklist predicted it): @@ -132,13 +139,16 @@ Constraints that still break naive assumptions: mantle path explicitly, and the runtime example gives `bedrock-runtime.{region}.amazonaws.com/openai/v1`. 2. **The endpoints take different model-id forms.** Mantle takes the bare `openai.gpt-5.6-*` id and has no CRIS; `bedrock-runtime` takes ONLY a CRIS inference-profile id (`us.` / `in.` / `global.` prefixed) and has no - in-region form. `bedrock:ListInferenceProfiles` returns the 5.6 CRIS profiles; it never returns the bare mantle - ids, and it returns nothing for GPT-5.5 / GPT-5.4. + in-region form. `bedrock:ListInferenceProfiles` returns the CRIS profiles (5.6, and `us.`/`global.` for + GPT-5.5 / GPT-5.4 per their cards); it never returns the bare mantle ids. 3. **API surfaces differ by endpoint.** The 5.6 cards list `Responses`, `Chat Completions`, `Invoke`, and `Converse` as supported APIs, with runtime-side feature splits: **Guardrails are Converse-only; prompt caching is Responses-only on runtime**; server-side tool use, structured outputs, and application inference profiles are NOT - supported on runtime (server-side tool calling IS supported on mantle). For GPT-5.5 / GPT-5.4 treat Responses on - mantle as the only verified surface. + supported on runtime (server-side tool calling IS supported on mantle). The GPT-5.5 / GPT-5.4 cards (read + 2026-11-06) list `Responses`, `Chat Completions` and `Converse` on runtime (no `Invoke`) and `Responses` and + `Chat Completions` on mantle; on runtime they list Guardrails and application inference profiles as + Converse-only, and implicit prompt caching and structured outputs as Responses-only. Chat Completions is a + documented surface for GPT-5.5 / GPT-5.4 on both endpoints — probe it in the target account like any other. ### GPT-6 family: Ultrafast tier @@ -189,8 +199,10 @@ that expires within 12 hours and is not refreshed. Do not recommend it for produ **IAM:** on the mantle path, the managed policy `AmazonBedrockMantleInferenceAccess` grants what inference needs, including `bedrock-mantle:CreateInference` and `bedrock-mantle:CallWithBearerToken` — `bedrock:InvokeModel` does not -authorize mantle calls. On the GPT-5.6 `bedrock-runtime` path the usual `bedrock:InvokeModel*` against the CRIS -inference-profile ARN applies, as for any other runtime model. +authorize mantle calls. On the GPT-5.6 / GPT-5.5 / GPT-5.4 `bedrock-runtime` path the usual `bedrock:InvokeModel*` +against the CRIS inference-profile ARN applies, as for any other runtime model; the GPT-5.5 / GPT-5.4 cards add +that the identity also needs `bedrock:InvokeModel` on the account's default project +(`arn:aws:bedrock:{region}:{account-id}:project/default`). **Reasoning effort:** the five GPT-5.x models accept `none`, `low`, `medium`, `high`, `xhigh`, `max`. Because these models reason before responding, the model's output items (which may include reasoning items) must be passed back in the next @@ -200,7 +212,8 @@ request for multi-turn and tool-calling flows. ## Regional Availability — Endpoint-Aware -**The mantle in-region matrix** (the only reach for GPT-5.5 / GPT-5.4, and the in-region option for GPT-5.6): +**The mantle in-region matrix** (the in-region option for every proprietary GPT model; GPT-5.5 / GPT-5.4 rows +re-verified 2026-11-06): | Model | us-east-1 | us-east-2 | us-west-2 | us-gov-west-1 | us-gov-east-1 | | ------------- | --------- | --------- | --------- | ------------- | ------------- | @@ -230,8 +243,16 @@ any GPT-6 model, it just means using the runtime endpoint with a CRIS id. **GPT-5.6 additionally reaches most commercial regions via `bedrock-runtime` CRIS** (Geo `us.` / `in.`, Global `global.` inference profiles; the Sol card's runtime footprint spans 30+ regions). So a region outside the mantle matrix does NOT make the same-model path unavailable for GPT-5.6 — it means using the runtime endpoint with a CRIS -id, with the data-residency implications of cross-region routing. For GPT-5.5 / GPT-5.4 the mantle matrix is a hard -gate: no CRIS, no fallback. +id, with the data-residency implications of cross-region routing. + +**GPT-5.5 / GPT-5.4 runtime availability** (model cards read 2026-11-06): US Geo CRIS (`us.openai.gpt-5.5` / +`us.openai.gpt-5.4`) can be called from `us-east-1`, `us-east-2`, `us-west-1`, `us-west-2`, `ca-central-1` and +`ca-west-1`. Global CRIS (`global.openai.gpt-5.5` / `global.openai.gpt-5.4`) is listed in those six plus +`mx-central-1`, every EU region (`eu-central-1/2`, `eu-north-1`, `eu-south-1/2`, `eu-west-1/2/3`), `ap-east-2`, +`ap-northeast-1/2/3`, `ap-south-1/2`, `ap-southeast-1` through `-7`, `il-central-1`, `me-central-1`, `me-south-1`, +`af-south-1` and `sa-east-1` (33 regions). No runtime in-region form, no EU/India Geo profile, and no GovCloud +runtime row. So the mantle matrix is no longer a hard gate for GPT-5.5 / GPT-5.4; only a strictly in-region +requirement outside the mantle matrix blocks the same-model path. Verify current footprints per model card / `aws___get_regional_availability` (AWS MCP Server) — the CRIS lists move faster than this file. @@ -247,7 +268,8 @@ inference-option dimension:** workload has no data-residency constraint. So the honest cost statement is conditional, not flat: a same-model GPT-5.6 move on Global CRIS is -**cost-neutral**; the same move in-region or Geo (and any GPT-5.5 / GPT-5.4 move) is **~10% more expensive**. The +**cost-neutral**; the same move in-region or Geo is **~10% more expensive**. The GPT-5.5 / GPT-5.4 cards publish +In-Region pricing only (no Geo/Global rows as of 2026-11-06), so quote ~10% for them on every inference option. The same Global-CRIS-is-cost-neutral / in-Region-and-Geo-is-~10%-more pattern applies to the GPT-6 family below. Never state either number without stating the inference option it belongs to. @@ -302,12 +324,15 @@ provider rate before claiming savings or parity for the selected context tier. A workload above 272K context must be priced at the long-context tier. -### GPT-5.5 / GPT-5.4 — In-Region only (no CRIS, no long-context tier; usable window 272K) +### GPT-5.5 / GPT-5.4 — In-Region pricing only; short- and long-context tiers (model cards read 2026-11-06) + +The cards publish only the In-Region inference option (the `us.` / `global.` runtime CRIS ids exist but carry no +separate price row). Long-context rates apply to all input and output tokens of a request above 272K input tokens. -| Model | In-Region (in · out) | Cache read | Notes | -| ------- | -------------------- | ---------- | -------------------------------- | -| GPT-5.5 | 5.50 · 33.00 | 0.55 | no cache-write rate published | -| GPT-5.4 | 2.75 · 16.50 | 0.275 | GovCloud (US-West): 3.30 · 19.80 | +| Model | Short context ≤272K (in · cache read · out) | Long context >272K (in · cache read · out) | Notes | +| ------- | ------------------------------------------- | ------------------------------------------ | ---------------------------------------- | +| GPT-5.5 | 5.50 · 0.55 · 33.00 | 11.00 · 1.10 · 49.50 | no cache-write rate published | +| GPT-5.4 | 2.75 · 0.275 · 16.50 | 5.50 · 0.55 · 24.75 | GovCloud (US-West) short: 3.375 · 0.3375 · 20.25 | > **The Luna "blog discrepancy" resolved differently than first recorded.** The AWS News Blog's 0.20 / 1.20 is not > an error — it is the **Global CRIS** rate, now published on the Luna card. An earlier revision of this file said @@ -323,8 +348,10 @@ Astra has separate Responses-only caching evidence above. Do not inherit GPT-5.6 Listed as a supported feature on the GPT-5.6 Sol/Terra/Luna model cards and on all five GPT-6 model cards (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra — confirmed by the cache-write/cache-read columns in the GPT-6 pricing tables above). The -GPT-5.5 and GPT-5.4 cards list client-side tool calling in that slot instead and do **not** list prompt caching. -Do not assume caching on 5.5/5.4. +GPT-5.5 and GPT-5.4 cards (read 2026-11-06) list **implicit prompt caching on `bedrock-runtime` Responses only** +(automatic, no request parameters) with a cache-read rate and no cache-write rate; explicit caching is unsupported +and the mantle feature list carries client-side tool calling in that slot instead. Do not assume caching on +5.5/5.4 mantle, and do not inherit the GPT-5.6 prefix/breakpoint rules below for them. | Property | Value | | ----------------- | ------------------------------------------------------------ | @@ -352,10 +379,10 @@ This corrects two claims that were previously applied to all Mantle traffic in t - There is **no shared 10,000 RPM account limit** governing these models — the quota dimension is TPM, per model, per region. -- "Switch to `bedrock-runtime`" is **not a throughput remedy for GPT-5.5 / GPT-5.4** — they have no - `bedrock-runtime` path at all. For GPT-5.6 the runtime path DOES exist (CRIS only; see Access Paths above), so - moving there is a legitimate option — but treat it as an endpoint/architecture choice with its own quota family - and residency implications, not a free throughput escape hatch. +- "Switch to `bedrock-runtime`" is **not a free throughput escape hatch**. For GPT-5.6, GPT-5.5 and GPT-5.4 the + runtime path exists (CRIS only; see Access Paths above — GPT-5.5 / GPT-5.4 re-verified 2026-11-06), so moving + there is a legitimate option — but treat it as an endpoint/architecture choice with its own quota family and + residency implications. The supported mitigations are: exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK), spreading load across minutes rather than bursting, ramping request rate gradually, and prompt caching (cached input @@ -396,8 +423,8 @@ This model family is moving fast (two GA waves and a repricing inside 10 weeks). 1. Re-read the [OpenAI model card index](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards-openai.html) for models added or removed, and each per-model card for lifecycle state and EOL date. -2. Recheck the region matrix AND the GPT-5.6 CRIS footprints — for 5.5/5.4 a region change is migration-blocking; - for 5.6 the runtime/CRIS path usually covers the region instead. +2. Recheck the region matrix AND the CRIS footprints for every proprietary GPT model — the runtime/CRIS path + usually covers a region outside the mantle matrix; only a strictly in-region requirement there is blocking. 3. Recheck rates on the Bedrock pricing page OpenAI tab, and resolve any row still marked _unverified_. 4. Recheck whether the Price List API has gained GPT-5.x coverage; if it has, drop the caveat above and let `estimate-ai.md` price these models from the MCP. @@ -412,3 +439,9 @@ This model family is moving fast (two GA waves and a repricing inside 10 weeks). 2026), and GPT-6.1 Sol (GA Sep 29, 2026) are all confirmed on Bedrock with their own model cards and pricing tables. New discovery this refresh: a 6x-Standard **Ultrafast** service tier on Astra and 6.1 Sol only (Sol and Luna remain Standard-only) — the first new tier shape since this file started tracking the family. +9. **2026-11-06 refresh — GPT-5.5 / GPT-5.4 re-read.** Item 5 fired again: both cards now list `bedrock-runtime` + (Responses, Chat Completions, Converse via `us.` / `global.` CRIS ids; no in-region runtime form), Chat + Completions on `bedrock-mantle`, a 1,050,000-token context window with 128,000 max output, a long-context + (>272K) price tier, implicit prompt caching on runtime Responses, and a GovCloud (US-West) GPT-5.4 rate of + 3.375 · 20.25. Earlier "mantle-only / no CRIS / 272K / no long-context tier" claims for these two models were + stale and are corrected throughout this file. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md index 811b7c92e..36a049656 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md @@ -123,17 +123,20 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` ## migration_path vocabulary -`mantle_openai_chat` preserves a selected GPT-6 Chat Completions API on Mantle. +`mantle_openai_chat` preserves a selected Chat Completions API on Mantle for a model whose card +lists it there (GPT-6, GPT-5.5, GPT-5.4). `mantle_openai_responses` (Azure OpenAI / OpenAI source, model on Bedrock, region carries it — -keep the SDK, `model_change: false`) · `runtime_openai_cris` (GPT-5.6/GPT-6 same-model move -served via `bedrock-runtime` CRIS, `us.`/`global.` prefixed, `model_change: false`) · `converse` -(Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when **GPT-5.5 or GPT-5.4 -specifically** must move off mantle for Guardrails / Knowledge Bases / logging / an unsupported -region, or when the GPT-6/5.6 CRIS path itself cannot serve the need) · `gpt-oss` (OpenAI-lineage -model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK swap). **GPT-5.5 -and GPT-5.4** are NEVER paired with a `converse`/`bedrock-runtime` path — those two models only -are mantle-only, no CRIS. GPT-5.6 and GPT-6 models MAY use `runtime_openai_cris` on -`bedrock-runtime` — this is not a violation. Note: `runtime_openai_cris` for GPT-6 Astra is valid +keep the SDK, `model_change: false`) · `runtime_openai_cris` (GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 +same-model move served via `bedrock-runtime` CRIS, `us.`/`in.`/`global.` prefixed, +`model_change: false`) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set +`model_change: true` when the workload needs Knowledge Bases, intelligent prompt routing, or +another feature the same-model CRIS path itself cannot serve) · `gpt-oss` (OpenAI-lineage model +on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK swap). A **bare** +proprietary `openai.gpt-*` id (including bare `openai.gpt-5.5` / `openai.gpt-5.4`) is NEVER paired +with a `converse`/`bedrock-runtime` path — bare ids are mantle ids. GPT-5.6, GPT-6, **GPT-5.5 and +GPT-5.4** MAY use `runtime_openai_cris` on `bedrock-runtime` with a CRIS-prefixed id — this is +not a violation (GPT-5.5 / GPT-5.4 runtime support: model cards read 2026-11-06, `us.`/`global.` +ids only, no runtime in-region form). Note: `runtime_openai_cris` for GPT-6 Astra is valid only via Responses/Chat Completions/Converse — Astra does not support `Invoke`, so a design that needs Guardrails or Application Inference Profiles (Converse-only features that also require Invoke-adjacent plumbing on some other models) must verify against Astra's model card @@ -201,9 +204,10 @@ rubric file (`ai.md`, `ai-azure-openai-to-bedrock.md`, or a `vendored/ai/*` ref) `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. - [ ] Bare proprietary GPT ids use Mantle; runtime Astra uses a supported `us.` / `global.` CRIS id and its caller-region gate. The recorded API and `model_change` match the design. -- [ ] No `bedrock_models[]` entry pairs **GPT-5.5 or GPT-5.4** with a `converse`/`bedrock-runtime` - migration path (those two models only — mantle-only, no CRIS). GPT-5.6 and GPT-6 models MAY - use `migration_path: "runtime_openai_cris"` on `bedrock-runtime` — this is NOT a violation. +- [ ] No `bedrock_models[]` entry pairs a **bare** proprietary GPT id (including bare + `openai.gpt-5.5` / `openai.gpt-5.4`) with a `converse`/`bedrock-runtime` migration path. + GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on + `bedrock-runtime` with a `us.`/`in.`/`global.` CRIS id — this is NOT a violation. - [ ] If `ai_source` is `azure_openai` or `openai`: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md index a819dc895..1ad1b0a09 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md @@ -48,9 +48,9 @@ Inference on `bedrock-mantle` for these models is governed by **two per-model, p | Medium | Medium | Monitor 429s against **token** throughput, not request rate; enable prompt caching | | High | High | Enable prompt caching first (cached input is exempt from input TPM), then request a quota increase | -**The `bedrock-runtime` fallback exists only for GPT-5.6 and GPT-6 (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra).** GPT-5.5 and GPT-5.4 are `bedrock-mantle` only and in-region only — for them, "switch to `bedrock-runtime`" requires moving to a different model (Bedrock-native or `gpt-oss`), a model change with its own eval cost. GPT-5.6 Sol/Terra/Luna and GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra DO have a `bedrock-runtime` path via CRIS inference profiles (GPT-5.6 `us.`/`in.`/`global.`, GPT-6 `us.`/`global.` prefixed ids; the model cards recommend runtime for new applications) — a legitimate endpoint option with its own quota family, and on Global CRIS it is also the cost-parity option. Scaling levers on the mantle path, in order: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Sol/Terra/Luna (`us.`/`in.`/`global.`), GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra (`us.`/`global.`), and GPT-5.5 / GPT-5.4 (`us.`/`global.`; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: -1. Prompt caching (GPT-5.6 and GPT-6 only) — 90% off cached input and exempt from the input-TPM quota +1. Prompt caching (GPT-5.6 and GPT-6 on mantle; GPT-5.5 / GPT-5.4 list implicit caching on `bedrock-runtime` Responses only) — 90% off cached input and exempt from the input-TPM quota 2. Exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK) 3. Spreading load across minutes and ramping request rate gradually rather than bursting 4. A Service Quotas increase for that model's input/output TPM in that region @@ -108,8 +108,8 @@ Claude models on Mantle have an additional **output TPM cap** that differs by mo - For Claude migrations at medium/high volume: the 2M output TPM cap on Claude 4.7+ is the binding constraint - For OpenAI proprietary GPT targets: this Claude cap does not apply. Use the GPT-5.x mantle quotas or - Astra-specific verification above. Astra / GPT-5.6 have runtime CRIS alternatives with their own - quotas; GPT-5.5/5.4 have no runtime path + Astra-specific verification above. Astra / GPT-5.6 / GPT-5.5 / GPT-5.4 all have runtime CRIS alternatives + with their own quotas (`us.`/`global.` prefixed ids; no runtime in-region form) - For `gpt-oss` targets: these do run on `bedrock-runtime`, so standard account TPM limits and the Converse-path mitigations apply - When output-heavy workloads (long JSON, tool outputs, multi-step reasoning) are detected, flag the relevant cap prominently; recommend `bedrock-runtime` for production **only** when the target model actually has a `bedrock-runtime` path diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md index cfc5158ee..78fb426c0 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md @@ -42,7 +42,9 @@ Two consequences that invert the previous decision logic: 2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.x In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when - the workload has no data-residency constraint (GPT-5.5 / GPT-5.4 have no CRIS at all). See + the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on + `bedrock-runtime`, but their model cards (read 2026-11-06) publish In-Region pricing only, so quote the ~10% + figure for them on every inference option until a Global rate is published. See `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, prompt caching, one vendor relationship — carries the in-region path; never present that path as free or neutral. For Astra, use its separately dated Bedrock rates and verify the source provider's rate before comparing. @@ -72,14 +74,15 @@ GPT-5.4, the target is **the same model on Bedrock**. | GPT-5.6 Sol | GPT-5.6 Sol | `openai.gpt-5.6-sol` / `us.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Terra | GPT-5.6 Terra | `openai.gpt-5.6-terra` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Luna | GPT-5.6 Luna | `openai.gpt-5.6-luna` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | -| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | -| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | Then apply the **region gate** below. Record `model_change: false` and the chosen path in `aws-design-ai.json` → `ai_architecture.code_migration`: `migration_path: "mantle_openai_chat"` for -Astra sources using Chat Completions, or `"mantle_openai_responses"` for a selected Mantle Responses -path. Use `migration_path: "runtime_openai_cris"` when a GPT-6 / GPT-5.6 target is served via -`bedrock-runtime` with a CRIS id (the model cards recommend runtime for new applications). +sources using Chat Completions on a model whose card lists it on mantle (GPT-6, GPT-5.5, GPT-5.4), or +`"mantle_openai_responses"` for a selected Mantle Responses path. Use `migration_path: "runtime_openai_cris"` +when a GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 target is served via `bedrock-runtime` with a CRIS id (the model +cards recommend runtime for new applications). Report the assessment honestly: `strong_migrate` here means "low-risk, well-supported move", not "cheaper". @@ -105,14 +108,16 @@ regions — offer it, stating the data-residency implication of cross-region rou Global routes anywhere and is the cost-parity option). Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through to Tier 1. -**GPT-5.5 / GPT-5.4:** hard gate. Mantle in-region only, no CRIS, no fallback. If the target region is not in the -matrix: +**GPT-5.5 / GPT-5.4:** same shape as GPT-5.6, with a narrower mantle matrix (GPT-5.5: us-east-1, us-east-2; +GPT-5.4: us-east-1, us-east-2, us-west-2, us-gov-west-1 — per their model cards, read 2026-11-06). If the target +region is in that matrix, either endpoint works. Otherwise the `bedrock-runtime` CRIS path (`us.openai.gpt-5.5` / +`global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`) reaches it, with the same data-residency +caveat as GPT-5.6 (Geo stays within the geography, Global routes anywhere). There is no runtime in-region form. +Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through: -1. Prefer offering a **region change** to a supported region, if no data-residency constraint pins the workload. - This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. -2. If the region is fixed, also offer **upgrading within the vendor to GPT-5.6** (which reaches the region via - CRIS) alongside the cross-family option — a generation change, but same vendor and prompt idioms. -3. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. +1. Prefer offering a **region change** to a supported mantle region, if no data-residency constraint pins the + workload. This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. +2. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. Record the outcome in `regional_warnings[]`. @@ -235,10 +240,11 @@ model on price. ### Open-weight gpt-oss -`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and, unlike the -proprietary GPT models, **do** support `bedrock-runtime` / Converse. They sit a capability class below the GPT-5.x -frontier tier. Recommend them when the user wants OpenAI-architecture models on the Bedrock-native runtime surface -(for Guardrails, invocation logging, or Converse-based tooling) rather than through mantle. +`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and support +`bedrock-runtime` / Converse with a bare model ID (no CRIS profile needed) and `Invoke`, which the proprietary GPT +models do not. They sit a capability class below the GPT-5.x frontier tier. Recommend them when the user wants +OpenAI-architecture models on the Bedrock-native runtime surface (for Guardrails, invocation logging, or +Converse-based tooling) at the lowest price rather than through mantle. --- @@ -284,7 +290,7 @@ rather than dismissing it. For a long-context (>272K) workload the gap is much w | Chat Completions | Preserve supported Chat when selected | Reshape only for a selected API change; verify the model and endpoint | | Function calling | Supported on GPT-5.x via mantle; Claude tools via Converse | Same-model keeps tool semantics identical | | Reasoning effort | `reasoning={"effort": ...}` on mantle | `none` / `low` / `medium` / `high` / `xhigh` / `max` | -| Prompt caching | GPT-5.6 only (90% off cached input) | Not listed for GPT-5.5 / 5.4; Claude has its own caching | +| Prompt caching | GPT-5.6 (90% off cached input); GPT-5.5 / 5.4 implicit caching on `bedrock-runtime` Responses only | GPT-5.5 / 5.4 cards (read 2026-11-06) list a cache-read rate and implicit caching on runtime, none on mantle; Claude has its own caching | | Streaming | Supported | Verify per surface | | Vision | GPT-5.x (image input) or Claude / Llama 4 | Same-model preserves behavior | | JSON mode | Claude (excellent), Nova Pro (good) | Most models via prompt | @@ -339,11 +345,12 @@ and closed to new customers as of July 30, 2026. ### When to prefer a Bedrock-native model over the mantle GPT path Choose Claude / Nova via Converse when the workload needs Knowledge Bases, intelligent prompt routing, structured -outputs, or application inference profiles — none of which the GPT path offers. Note what no longer forces a family -switch for GPT-5.6: its `bedrock-runtime` CRIS path provides cross-region inference, invocation logs, and -Guardrails (Converse API only; prompt caching is Responses-only on runtime). For GPT-5.5 / GPT-5.4, Guardrails, -logging, and cross-region reach still require a different model. The mantle GPT path is the smallest change; the -Bedrock-native path remains the most feature-complete. +outputs, or application inference profiles — none of which the mantle GPT path offers. Note what no longer forces +a family switch for GPT-5.6, GPT-5.5 and GPT-5.4: their `bedrock-runtime` CRIS paths provide cross-region +inference, invocation logs, Guardrails and application inference profiles (both Converse API only), and +structured outputs and implicit prompt caching (both Responses API only) — per the GPT-5.4 / GPT-5.5 model cards +read 2026-11-06. Knowledge Bases and intelligent prompt routing still require a Bedrock-native model. The mantle +GPT path is the smallest change; the Bedrock-native path remains the most feature-complete. ### High-spend tiering @@ -364,8 +371,8 @@ alternative, not against the source provider. cheaper and exempt from the input-TPM quota, which relieves the binding constraint on mantle. **Very high (>100M tokens/day):** tiering plus caching. Check TPM headroom per model per region early; there is no -RPM quota and no `bedrock-runtime` fallback for GPT models, so quota increases are the scaling lever. See -`shared/ai-migration-guardrails.md`. +RPM quota, and the `bedrock-runtime` CRIS path for GPT-5.6 / 5.5 / 5.4 / GPT-6 carries its own quotas rather than +adding headroom to mantle, so quota increases are the scaling lever. See `shared/ai-migration-guardrails.md`. --- diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md index 18266733c..a4206583c 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle only; no 1M tier) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle only; no 1M tier) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 11.00/49.50; card read 2026-11-06) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 5.50/24.75; card read 2026-11-06) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | @@ -353,17 +353,24 @@ Regions (mantle): us-east-1 / us-east-2 for all five; us-west-2 additionally car | GPT-5.5 | 5.50 | 33.00 | — | 0.55 | | GPT-5.4 | 2.75 | 16.50 | — | 0.275 | -#### Long context (1M) — GPT-5.6 only, 2.0x input / 1.5x output - -| Model | Input $/1M | Output $/1M | -| ------------- | ---------- | ----------- | -| GPT-5.6 Sol | 8.80 | 33.00 | -| GPT-5.6 Terra | 4.40 | 19.80 | -| GPT-5.6 Luna | 0.44 | 1.98 | - -A workload above 272K context must be priced at the long-context tier. GPT-5.5 and GPT-5.4 have no such tier, so -their usable window is 272K. Global CRIS is published at OpenAI's standard list price (cost parity, GPT-5.6 only — -see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. +#### Long context (>272K input tokens) — GPT-5.6 at 2.0x input / 1.5x output; GPT-5.5 / GPT-5.4 per their model cards + +| Model | Input $/1M | Output $/1M | Cache read $/1M | +| ------------- | ---------- | ----------- | --------------- | +| GPT-5.6 Sol | 8.80 | 33.00 | — | +| GPT-5.6 Terra | 4.40 | 19.80 | — | +| GPT-5.6 Luna | 0.44 | 1.98 | — | +| GPT-5.5 | 11.00 | 49.50 | 1.10 | +| GPT-5.4 | 5.50 | 24.75 | 0.55 | + +A workload above 272K input tokens must be priced at the long-context tier, applied to all input and output tokens +of the request. GPT-5.5 and GPT-5.4 rows read from their model cards on 2026-11-06 +([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), +[GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)); both cards state a +1,050,000-token context window (128,000 max output) and list `us.`/`global.` CRIS ids on `bedrock-runtime`, but +publish the In-Region inference option only. Global CRIS is published at OpenAI's standard list price (cost parity, +GPT-5.6 only — see `openai-on-bedrock.md`). GovCloud (US-West) GPT-5.4 short-context is 3.375 / 20.25 (cache read +0.3375) per the 2026-11-06 card; an earlier revision recorded 3.30 / 19.80. > **One source conflict.** These models are absent > from the AWS Price List API entirely: querying `AmazonBedrock` returns only `gpt-oss` and GPT OSS Safeguard, and @@ -373,7 +380,8 @@ see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. **Prompt caching (GPT-5.6 only):** cached input read at a 90% discount, cache write at 1.25x uncached input, minimum 1,024-token prefix, up to 4 breakpoints, ≥30-minute retention. Cached input is exempt from the input-TPM quota. -GPT-5.5 and GPT-5.4 do not list prompt caching support. +GPT-5.5 and GPT-5.4 list only implicit prompt caching on `bedrock-runtime` Responses (automatic, no request +parameters; cache-read rate above, no cache-write rate) and none on mantle (model cards read 2026-11-06). #### Open-weight gpt-oss diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md index cdf8ced55..7720d4b58 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md @@ -190,12 +190,18 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` ## migration_path vocabulary `mantle_openai_responses` (an OpenAI-protocol source — direct or Azure-fronted — with the model -on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `converse` -(Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when a proprietary GPT -model must move off mantle for Guardrails / Knowledge Bases / logging / an unsupported region) · -`gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic -Bedrock SDK swap). A proprietary `openai.gpt-*` model ID is NEVER paired with a -`converse`/`bedrock-runtime` path — those models are mantle-only. +on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` +(same, preserving a Chat Completions source on a model whose card lists Chat Completions on +mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via +`bedrock-runtime` with a `us.`/`in.`/`global.` CRIS id, `model_change: false`; available for +GPT-6, GPT-5.6, GPT-5.5 and GPT-5.4 per their model cards) · `converse` (Bedrock-native +Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, +intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` +(OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK +swap). A **bare** proprietary `openai.gpt-*` model ID is NEVER paired with a +`converse`/`bedrock-runtime` path — bare ids are mantle ids; every proprietary GPT target on +`bedrock-runtime` carries a CRIS-prefixed id (there is no runtime in-region form for GPT-6, +GPT-5.6, GPT-5.5 or GPT-5.4). ## regional_validation @@ -255,8 +261,9 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `price_comparison`. - [ ] `honest_assessment` overall is the weakest across `bedrock_models[]`; if `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. -- [ ] No `bedrock_models[]` entry pairs a proprietary `openai.gpt-*` model ID with a - `converse`/`bedrock-runtime` migration path (mantle-only). +- [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a + `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` + target for GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 carries a `us.`/`in.`/`global.` CRIS id). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md b/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md index 299aae03f..1b5c2c4e5 100644 --- a/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md +++ b/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md @@ -225,8 +225,8 @@ _Skip when:_ the validator summary reports `models_extractable: true` — every **Same-model rows first.** GPT-6 Astra / GPT-5.6 / 5.5 / 5.4 sources map to themselves. Design applies the model-specific API and region gate; Clarify records the baseline only. -Astra Standard mantle supports `us-east-1` and `us-west-2`; runtime uses US Geo / Global CRIS. GPT-5.6 also has runtime CRIS; -GPT-5.5 / 5.4 remain mantle-only. GPT-5.x in-region costs about 10% above OpenAI standard, +Astra Standard mantle supports `us-east-1` and `us-west-2`; runtime uses US Geo / Global CRIS. GPT-5.6, GPT-5.5 +and GPT-5.4 also have runtime CRIS (`us.` / `global.`). GPT-5.x in-region costs about 10% above OpenAI standard, while GPT-5.6 Global CRIS uses the standard rate. For Astra, compare its separately dated inference/context tier against the source price before claiming savings or parity. For sources without a Bedrock equivalent, present a same-vendor upgrade and a cross-family option. diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md index 0890b0e15..8634efdc5 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md @@ -204,8 +204,8 @@ _Skip when:_ `models[].model_id` is populated in `ai-workload-profile.json` **wi **Same-model rows first.** GPT-6 Astra / GPT-5.6 / 5.5 / 5.4 sources map to themselves. Apply the model-specific API and region gate in `references/shared/openai-on-bedrock.md`. -Astra Standard mantle supports `us-east-1` and `us-west-2`; runtime uses US Geo / Global CRIS. GPT-5.6 also has runtime CRIS; -GPT-5.5 / 5.4 remain mantle-only. GPT-5.x in-region costs about 10% above OpenAI standard, +Astra Standard mantle supports `us-east-1` and `us-west-2`; runtime uses US Geo / Global CRIS. GPT-5.6, GPT-5.5 +and GPT-5.4 also have runtime CRIS (`us.` / `global.`). GPT-5.x in-region costs about 10% above OpenAI standard, while GPT-5.6 Global CRIS uses the standard rate. For Astra, compare its separately dated inference/context tier against the source price before claiming savings or parity. For sources without a Bedrock equivalent, present a same-vendor upgrade and a cross-family option. diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md index 944d109dd..a744a6faf 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md @@ -238,7 +238,9 @@ data-residency-tier premium, while supported Global CRIS uses standard-rate pari Report the actual option; do not downgrade solely for the modest verified premium. **GPT-5.6/GPT-6 only:** above 272K context, apply 2.0x input and 1.5x output rates only when the selected model and inference option support that tier; the resulting gap may change -the assessment. GPT-5.5/5.4 have no 1M tier. **Opus 5.5:** use the selected region/profile's +the assessment. GPT-5.5/5.4 have their own long-context (>272K) rates on their model cards +(read 2026-11-06; see `openai-on-bedrock.md` § Pricing) — use those, not the GPT-5.6 +multiplier. **Opus 5.5:** use the selected region/profile's flat rates from `references/vendored/ai/bedrock-pricing-cache.md` throughout the full 1M context; do not apply the GPT multiplier. Verify other models' tiers individually. @@ -407,23 +409,25 @@ Astra Chat solely because it is proprietary GPT. Record `model_change: false` on the exact source model is retained; a Pro-to-Astra upgrade is a model change requiring eval. GPT-5.x retains its separately dated API evidence and any selected Chat-to-Responses reshape. -**A Chat Completions source is a supported near-drop-in for GPT-6 and GPT-5.6 — not a mandatory reshape.** All five GPT-6 models and the GPT-5.6 family list Chat Completions as a supported API on both mantle and runtime CRIS (per `openai-on-bedrock.md` § Access Paths); if `integration` evidence shows `chat.completions.create` for one of these models, the design may keep `chat.completions.create`/`choices[0].message` parsing — reshape to `responses.create` is optional, only for a Responses-only feature (runtime explicit prompt caching, reasoning-item round-trips) or a demonstrated constraint. **GPT-5.5 and GPT-5.4 are the exception**: Chat Completions support is unconfirmed on their model cards (Responses on mantle is the only verified surface), so a Chat Completions source on either model still needs a planned reshape, probed against the target account before committing. +**A Chat Completions source is a supported near-drop-in for GPT-6 and GPT-5.6 — not a mandatory reshape.** All five GPT-6 models and the GPT-5.6 family list Chat Completions as a supported API on both mantle and runtime CRIS (per `openai-on-bedrock.md` § Access Paths); if `integration` evidence shows `chat.completions.create` for one of these models, the design may keep `chat.completions.create`/`choices[0].message` parsing — reshape to `responses.create` is optional, only for a Responses-only feature (runtime explicit prompt caching, reasoning-item round-trips) or a demonstrated constraint. **GPT-5.5 and GPT-5.4 follow the same rule**: their model cards (read 2026-11-06) list Chat Completions as supported on both `bedrock-mantle` and `bedrock-runtime`, so a Chat Completions source on either model may keep Chat Completions; the reshape is optional for them too. A planned reshape is required only when the selected model's card leaves Chat Completions unchecked on the selected endpoint (check the per-model path entries in the canonical catalog). Probe the selected API against the target account before committing, as for any model. **Terra caching depends on the endpoint and mode.** On runtime, implicit caching supports Responses, Chat Completions, InvokeModel, and Converse. It does not require a Chat client reshape and can be combined with Converse Guardrails. Runtime explicit caching requires Responses. On Mantle, both implicit and explicit caching are Responses-only. -**No Converse fallback for GPT-5.5/GPT-5.4 — GPT-5.6 and GPT-6 differ.** GPT-5.5 and GPT-5.4 are -`bedrock-mantle` only and in-region only — there is no `bedrock-runtime` path and no cross-region -inference profile for these two models. GPT-5.6 Sol/Terra/Luna and all five GPT-6 models (Astra, -Sol, Luna, 6.1 Sol, 6.1 Terra) DO have a `bedrock-runtime` CRIS path (`us.`/`global.` prefixed IDs, per -`openai-on-bedrock.md` § Access Paths) — for these models, a region or feature need (Guardrails, -Knowledge Bases, invocation logging, or a region outside the mantle matrix) is satisfied by -**switching endpoint, not model**: record `migration_path: "runtime_openai_cris"` with -`model_change: false`. Reserve `migration_path: "converse"` with `model_change: true` for -GPT-5.5/GPT-5.4 only, or when the GPT-6/5.6 CRIS path itself cannot serve the need (e.g. a feature -CRIS does not support — see the runtime-side feature splits in `openai-on-bedrock.md`). Note: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` CRIS path — including GPT-5.5 and +GPT-5.4.** GPT-5.6 Sol/Terra/Luna, all five GPT-6 models (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra), and +GPT-5.5 / GPT-5.4 (model cards read 2026-11-06: `us.openai.gpt-5.5` / `global.openai.gpt-5.5`, +`us.openai.gpt-5.4` / `global.openai.gpt-5.4`; Responses, Chat Completions and Converse on runtime) +have a `bedrock-runtime` CRIS path (`us.`/`global.` prefixed IDs, per `openai-on-bedrock.md` +§ Access Paths). No proprietary GPT model has a runtime in-region form. For all of them, a region +or feature need (Guardrails, invocation logging, application inference profiles, or a region +outside the mantle matrix) is satisfied by **switching endpoint, not model**: record +`migration_path: "runtime_openai_cris"` with `model_change: false`. Reserve +`migration_path: "converse"` with `model_change: true` for a need the same-model CRIS path itself +cannot serve (Knowledge Bases, intelligent prompt routing, or a feature CRIS does not support — +see the runtime-side feature splits in `openai-on-bedrock.md`). Note: `runtime_openai_cris` for GPT-6 Astra is valid only via Responses/Chat Completions/Converse — Astra does not support `Invoke`, so a design that needs Guardrails or Application Inference Profiles (Converse-only features that also require Invoke-adjacent plumbing on some other models) @@ -511,9 +515,10 @@ Write `aws-design-ai.json` to `$MIGRATION_DIR/`. - [ ] `honest_assessment` logic is consistent (weakest model drives overall) - [ ] If `ai_source` includes `"openai"`: every model that `shared/openai-on-bedrock.md` lists as available on Bedrock, and whose target region carries it, is mapped to **itself** with `model_change: false` — not to a Claude/Nova substitute - [ ] If `honest_assessment == "recommend_stay"`: `honest_assessment_reason` names a non-cost blocker (cost parity alone is never sufficient for an OpenAI source) -- [ ] No `bedrock_models[]` entry pairs **GPT-5.5 or GPT-5.4** with a Converse/`bedrock-runtime` - migration path (those two models only — mantle-only, no CRIS). GPT-5.6 and GPT-6 models MAY - use `migration_path: "runtime_openai_cris"` on `bedrock-runtime` — this is NOT a violation. +- [ ] No `bedrock_models[]` entry pairs a **bare** proprietary GPT id (including bare + `openai.gpt-5.5` / `openai.gpt-5.4`) with a Converse/`bedrock-runtime` migration path. + GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on + `bedrock-runtime` with a `us.`/`in.`/`global.` CRIS id — this is NOT a violation. - [ ] `regional_warnings` is present (empty array `[]` if no issues; populated if any service unavailable in target region) - [ ] `multi_model_warnings` is present (empty array `[]` if single model or no coordination issues) - [ ] If `agentic_profile.is_agentic == true`: `agentic_design` object is present with `migration_approach` matching `preferences.json` diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md index dd54a54e9..25f024e7a 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md @@ -104,8 +104,8 @@ See `references/shared/openai-on-bedrock.md` for the model-specific pricing rule For the GPT-5.x rows, the mantle endpoint is in-region only (us-east-1, us-east-2; us-west-2 additionally for Terra, Luna, and GPT-5.4; AWS GovCloud us-gov-west-1 / us-gov-east-1 for Terra and Luna, us-gov-west-1 also for -GPT-5.4). GPT-5.6 additionally reaches most commercial regions via `bedrock-runtime` CRIS ids; GPT-5.5 / GPT-5.4 -have no CRIS. +GPT-5.4). GPT-5.6, GPT-5.5 and GPT-5.4 additionally reach most commercial regions via `bedrock-runtime` CRIS ids +(`us.` / `global.`; GPT-5.5 / GPT-5.4 per their model cards read 2026-11-06). For the GPT-6 rows, mantle is us-east-1 only, except GPT-6 Astra which is also available in us-west-2. All five GPT-6 models additionally reach a broad set of commercial regions via `bedrock-runtime` CRIS (`us.` / `global.` diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md index 2571e0def..5fbeb17bc 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md @@ -32,7 +32,7 @@ Check `preferences.json` → `ai_constraints.ai_framework` to determine the migr - `mantle` / `mantle_openai_responses`: point the client at `https://bedrock-mantle.{region}.api.aws/openai/v1` — note the `openai/v1` segment for proprietary GPT models; a bare `/v1` 404s. Swap the credential for a Bedrock API key or the auto-refreshing token provider — **not** the existing OpenAI key. Update the model string to the bare Bedrock model ID (`openai.gpt-*` for a same-model move). Grant the `bedrock-mantle:*` actions; `bedrock:InvokeModel` does not authorize these models. - `runtime_openai_cris` (GPT-5.6/GPT-6 via `bedrock-runtime` CRIS): point the client at `https://bedrock-runtime.{region}.amazonaws.com/openai/v1` instead — **not** the mantle URL. Update the model string to the `us.`/`in.`/`global.`-prefixed CRIS inference-profile ID, not the bare ID. Grant standard `bedrock:InvokeModel*` actions against the CRIS inference-profile ARN — **not** `bedrock-mantle:*`. For a GPT-6 CRIS id, also grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default` alongside the inference-profile ARN (per the GPT-6 model cards). Check `aws-design-ai.json` → `ai_architecture.bedrock_models[].required_client_api`: if non-Responses, emit that surface (e.g. Converse) instead of defaulting to `responses.create` — absent/`responses` keeps the Responses surface for a region-only move. -- **Config-only if the source already calls `responses.create`.** A Chat Completions source for GPT-6 or GPT-5.6 may keep `chat.completions.create`/`choices[0].message` parsing unchanged — Chat Completions is supported on both mantle and runtime CRIS for these models, so reshape to Responses is optional (only for a Responses-only feature or demonstrated constraint). For GPT-5.5/GPT-5.4, Chat Completions support is unconfirmed, so still plan a reshape to Responses and probe the target account before committing. +- **Config-only if the source already calls `responses.create`.** A Chat Completions source for GPT-6 or GPT-5.6 may keep `chat.completions.create`/`choices[0].message` parsing unchanged — Chat Completions is supported on both mantle and runtime CRIS for these models, so reshape to Responses is optional (only for a Responses-only feature or demonstrated constraint). GPT-5.5/GPT-5.4 follow the same rule — their model cards (read 2026-11-06) list Chat Completions on both mantle and runtime, so the reshape is optional for them too; probe the selected API against the target account before committing, as for any model. - Test in staging, validate responses Match the `migration_path` prefix, not the exact string: Design writes the more specific `mantle_openai_responses` for a same-model OpenAI migration, and an equality test against `mantle` would misroute those runs into the adapter path below. `runtime_openai_cris` (GPT-5.6/GPT-6 served via `bedrock-runtime` CRIS instead of `bedrock-mantle`) is matched explicitly alongside the `mantle*` prefix — it does not start with `mantle`, so it needs its own check to avoid falling through to the adapter path below. @@ -55,7 +55,7 @@ Based on `ai-workload-profile.json` → `integration.pattern` and `integration.l | Source SDK | Target | Key Change | | ----------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| OpenAI SDK (same model) | Mantle Responses API | Base URL → `.../openai/v1`, Bedrock token/API key (not an OpenAI key), `openai.gpt-*` model ID. Config-only **if** already on `responses.create`; a Chat Completions source may keep Chat Completions for GPT-6/GPT-5.6 (reshape to Responses optional); GPT-5.5/GPT-5.4 still need a reshape. | +| OpenAI SDK (same model) | Mantle Responses API | Base URL → `.../openai/v1`, Bedrock token/API key (not an OpenAI key), `openai.gpt-*` model ID. Config-only **if** already on `responses.create`; a Chat Completions source may keep Chat Completions for GPT-6/GPT-5.6/GPT-5.5/GPT-5.4 (reshape to Responses optional; plan it only when the selected model's card leaves Chat Completions unchecked on the selected endpoint). | | Vertex AI (Python) | boto3 Bedrock Converse API | `GenerativeModel.generate_content()` → `bedrock.converse()` | | Vertex AI (JS) | @aws-sdk/client-bedrock-runtime | `model.generateContent()` → `client.send(new ConverseCommand())` | | Vertex AI (Go) | aws-sdk-go-v2 bedrockruntime | `aiplatform` → `bedrockruntime.Converse()` | diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md index eb6969816..492bced1e 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md @@ -2,6 +2,7 @@ **Last verified:** 2026-10-10 **GPT-6.1 Terra verified:** 2026-10-27 +**GPT-5.5 / GPT-5.4 re-verified:** 2026-11-06 against their model cards ([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) — both now list `bedrock-runtime` (Responses, Chat Completions, Converse via `us.`/`global.` CRIS ids), Chat Completions on mantle, a 1.05M context window and a long-context price tier **Sources:** [OpenAI model cards](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards-openai.html) (per-model cards linked below), [GPT-5.6 launch post](https://aws.amazon.com/blogs/machine-learning/get-started-with-openai-gpt-5-6-sol-terra-and-luna-on-amazon-bedrock/), [GPT-5.6 GA announcement](https://aws.amazon.com/about-aws/whats-new/2026/07/openai-gpt-sol-terra/), @@ -32,8 +33,8 @@ risk) all defer to it. Do not restate model IDs, regions, or endpoint paths else | GPT-5.6 Sol | `openai.gpt-5.6-sol` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-sol.html) | | GPT-5.6 Terra | `openai.gpt-5.6-terra` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-terra.html) | | GPT-5.6 Luna | `openai.gpt-5.6-luna` | Jul 13, 2026 | 1M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-luna.html) | -| GPT-5.5 | `openai.gpt-5.5` | Jun 1, 2026 | 272K | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html) | -| GPT-5.4 | `openai.gpt-5.4` | Jun 1, 2026 | 272K | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html) | +| GPT-5.5 | `openai.gpt-5.5` | Jun 1, 2026 | 1.05M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html) | +| GPT-5.4 | `openai.gpt-5.4` | Jun 1, 2026 | 1.05M | Active | [card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html) | | gpt-oss-120b | `openai.gpt-oss-120b` | Aug 5, 2025 | 128K | Active | open-weight; also on `bedrock-runtime` as `openai.gpt-oss-120b-1:0` | | gpt-oss-20b | `openai.gpt-oss-20b` | Aug 5, 2025 | 128K | Active | open-weight; also on `bedrock-runtime` as `openai.gpt-oss-20b-1:0` | | GPT OSS Safeguard | `openai.gpt-oss-safeguard-120b` / `-20b` | — | — | Active | content-moderation / guardrail enforcement, not general chat | @@ -50,8 +51,10 @@ GPT-6 Astra is the newest, most capable OpenAI model in this catalog. Sol remain lower-cost reasoning alternative; Astra does not make existing GPT-5.x sources require a model upgrade. > **Context-window conflict (resolved):** the GPT-5.6 launch blog states 272K for all three variants; all three -> model cards state 1M. **The model cards are authoritative** — use 1M for GPT-5.6. GPT-5.5 and GPT-5.4 are 272K on -> both sources. Re-check on refresh; if AWS corrects the blog, the cards still win. +> model cards state 1M. **The model cards are authoritative** — use 1M for GPT-5.6. The GPT-5.5 and GPT-5.4 cards +> (read 2026-11-06) state 1,050,000 tokens shared between input and output with 128,000 max output; the 272K figure +> recorded earlier is now only their short-/long-context pricing breakpoint. Re-check on refresh; if AWS corrects +> the blog, the cards still win. **Not on Bedrock (as of this refresh):** GPT-4o, GPT-4.1, GPT-4 / GPT-4 Turbo, GPT-3.5 Turbo, the o-series (o1/o3/o4-mini), GPT-5 / GPT-5.1 / GPT-5.2, Codex (unverified — see the Codex note below), and the `*-Pro` variants @@ -116,8 +119,12 @@ input and text output. The launch announcement rounds the input context to 1M; u exact limits for capacity checks. Browser/computer-use capability does not establish parity with OpenAI-hosted tools; probe the application's specific tool flow. -**GPT-5.5 and GPT-5.4 are `bedrock-mantle`-only and in-region only.** Their model cards list a single -Programmatic Access row (`bedrock-mantle`, Geo/Global "Not supported") and In-Region pricing only. +**GPT-5.5 and GPT-5.4 have TWO endpoints** (re-verified 2026-11-06 against their model cards; earlier revisions of +this file recorded them as `bedrock-mantle`-only). Both Programmatic Access tables now carry a `bedrock-runtime` +row (In-Region "Not supported"; Geo `us.openai.gpt-5.5` / `us.openai.gpt-5.4`; Global `global.openai.gpt-5.5` / +`global.openai.gpt-5.4`) and a `bedrock-mantle` row (bare id, in-region only). Supported APIs: `Responses`, +`Chat Completions` and `Converse` on `bedrock-runtime`; `Responses` and `Chat Completions` on `bedrock-mantle`; +`Messages` and `Invoke` on neither. The pricing tables still publish the In-Region inference option only. **GPT-5.6 Sol / Terra / Luna have TWO endpoints** (verified 2026-08-21 — this changed after this file's original 2026-08-10 verification; the Refresh Checklist predicted it): @@ -136,13 +143,16 @@ Constraints that still break naive assumptions: mantle path explicitly, and the runtime example gives `bedrock-runtime.{region}.amazonaws.com/openai/v1`. 2. **The endpoints take different model-id forms.** Mantle takes the bare `openai.gpt-5.6-*` id and has no CRIS; `bedrock-runtime` takes ONLY a CRIS inference-profile id (`us.` / `in.` / `global.` prefixed) and has no - in-region form. `bedrock:ListInferenceProfiles` returns the 5.6 CRIS profiles; it never returns the bare mantle - ids, and it returns nothing for GPT-5.5 / GPT-5.4. + in-region form. `bedrock:ListInferenceProfiles` returns the CRIS profiles (5.6, and `us.`/`global.` for + GPT-5.5 / GPT-5.4 per their cards); it never returns the bare mantle ids. 3. **API surfaces differ by endpoint.** The 5.6 cards list `Responses`, `Chat Completions`, `Invoke`, and `Converse` as supported APIs, with runtime-side feature splits: **Guardrails are Converse-only; prompt caching is Responses-only on runtime**; server-side tool use, structured outputs, and application inference profiles are NOT - supported on runtime (server-side tool calling IS supported on mantle). For GPT-5.5 / GPT-5.4 treat Responses on - mantle as the only verified surface. + supported on runtime (server-side tool calling IS supported on mantle). The GPT-5.5 / GPT-5.4 cards (read + 2026-11-06) list `Responses`, `Chat Completions` and `Converse` on runtime (no `Invoke`) and `Responses` and + `Chat Completions` on mantle; on runtime they list Guardrails and application inference profiles as + Converse-only, and implicit prompt caching and structured outputs as Responses-only. Chat Completions is a + documented surface for GPT-5.5 / GPT-5.4 on both endpoints — probe it in the target account like any other. ### GPT-6 family: Ultrafast tier @@ -193,8 +203,10 @@ that expires within 12 hours and is not refreshed. Do not recommend it for produ **IAM:** on the mantle path, the managed policy `AmazonBedrockMantleInferenceAccess` grants what inference needs, including `bedrock-mantle:CreateInference` and `bedrock-mantle:CallWithBearerToken` — `bedrock:InvokeModel` does not -authorize mantle calls. On the GPT-5.6 `bedrock-runtime` path the usual `bedrock:InvokeModel*` against the CRIS -inference-profile ARN applies, as for any other runtime model. +authorize mantle calls. On the GPT-5.6 / GPT-5.5 / GPT-5.4 `bedrock-runtime` path the usual `bedrock:InvokeModel*` +against the CRIS inference-profile ARN applies, as for any other runtime model; the GPT-5.5 / GPT-5.4 cards add +that the identity also needs `bedrock:InvokeModel` on the account's default project +(`arn:aws:bedrock:{region}:{account-id}:project/default`). **Reasoning effort:** the five GPT-5.x models accept `none`, `low`, `medium`, `high`, `xhigh`, `max`. Astra's card does not enumerate these values; verify its accepted settings rather than inheriting the GPT-5.x list. Because these models reason @@ -205,7 +217,8 @@ request for multi-turn and tool-calling flows. ## Regional Availability — Endpoint-Aware -**The mantle in-region matrix** (the only reach for GPT-5.5 / GPT-5.4, and the in-region option for GPT-6 Astra / GPT-5.6): +**The mantle in-region matrix** (the in-region option for every proprietary GPT model; GPT-5.5 / GPT-5.4 rows +re-verified 2026-11-06): | Model | us-east-1 | us-east-2 | us-west-2 | us-gov-west-1 | us-gov-east-1 | | ------------- | --------- | --------- | --------- | ------------- | ------------- | @@ -235,8 +248,16 @@ any GPT-6 model, it just means using the runtime endpoint with a CRIS id. **GPT-5.6 additionally reaches most commercial regions via `bedrock-runtime` CRIS** (Geo `us.` / `in.`, Global `global.` inference profiles; the Sol card's runtime footprint spans 30+ regions). So a region outside the mantle matrix does NOT make the same-model path unavailable for GPT-5.6 — it means using the runtime endpoint with a CRIS -id, with the data-residency implications of cross-region routing. For GPT-5.5 / GPT-5.4 the mantle matrix is a hard -gate: no CRIS, no fallback. +id, with the data-residency implications of cross-region routing. + +**GPT-5.5 / GPT-5.4 runtime availability** (model cards read 2026-11-06): US Geo CRIS (`us.openai.gpt-5.5` / +`us.openai.gpt-5.4`) can be called from `us-east-1`, `us-east-2`, `us-west-1`, `us-west-2`, `ca-central-1` and +`ca-west-1`. Global CRIS (`global.openai.gpt-5.5` / `global.openai.gpt-5.4`) is listed in those six plus +`mx-central-1`, every EU region (`eu-central-1/2`, `eu-north-1`, `eu-south-1/2`, `eu-west-1/2/3`), `ap-east-2`, +`ap-northeast-1/2/3`, `ap-south-1/2`, `ap-southeast-1` through `-7`, `il-central-1`, `me-central-1`, `me-south-1`, +`af-south-1` and `sa-east-1` (33 regions). No runtime in-region form, no EU/India Geo profile, and no GovCloud +runtime row. So the mantle matrix is no longer a hard gate for GPT-5.5 / GPT-5.4; only a strictly in-region +requirement outside the mantle matrix blocks the same-model path. Verify current footprints per model card / `aws___get_regional_availability` (AWS MCP Server) — the CRIS lists move faster than this file. @@ -252,7 +273,8 @@ inference-option dimension:** workload has no data-residency constraint. So the honest cost statement is conditional, not flat: a same-model GPT-5.6 move on Global CRIS is -**cost-neutral**; the same move in-region or Geo (and any GPT-5.5 / GPT-5.4 move) is **~10% more expensive**. The +**cost-neutral**; the same move in-region or Geo is **~10% more expensive**. The GPT-5.5 / GPT-5.4 cards publish +In-Region pricing only (no Geo/Global rows as of 2026-11-06), so quote ~10% for them on every inference option. The same Global-CRIS-is-cost-neutral / in-Region-and-Geo-is-~10%-more pattern applies to the GPT-6 family below. Never state either number without stating the inference option it belongs to. @@ -307,12 +329,15 @@ provider rate before claiming savings or parity for the selected context tier. A workload above 272K context must be priced at the long-context tier. -### GPT-5.5 / GPT-5.4 — In-Region only (no CRIS, no long-context tier; usable window 272K) +### GPT-5.5 / GPT-5.4 — In-Region pricing only; short- and long-context tiers (model cards read 2026-11-06) + +The cards publish only the In-Region inference option (the `us.` / `global.` runtime CRIS ids exist but carry no +separate price row). Long-context rates apply to all input and output tokens of a request above 272K input tokens. -| Model | In-Region (in · out) | Cache read | Notes | -| ------- | -------------------- | ---------- | -------------------------------- | -| GPT-5.5 | 5.50 · 33.00 | 0.55 | no cache-write rate published | -| GPT-5.4 | 2.75 · 16.50 | 0.275 | GovCloud (US-West): 3.30 · 19.80 | +| Model | Short context ≤272K (in · cache read · out) | Long context >272K (in · cache read · out) | Notes | +| ------- | ------------------------------------------- | ------------------------------------------ | ---------------------------------------- | +| GPT-5.5 | 5.50 · 0.55 · 33.00 | 11.00 · 1.10 · 49.50 | no cache-write rate published | +| GPT-5.4 | 2.75 · 0.275 · 16.50 | 5.50 · 0.55 · 24.75 | GovCloud (US-West) short: 3.375 · 0.3375 · 20.25 | > **The Luna "blog discrepancy" resolved differently than first recorded.** The AWS News Blog's 0.20 / 1.20 is not > an error — it is the **Global CRIS** rate, now published on the Luna card. An earlier revision of this file said @@ -329,8 +354,10 @@ Its card does not establish the GPT-5.6 minimum-prefix, breakpoint, or quota-exe Listed as a supported feature on the GPT-5.6 Sol/Terra/Luna model cards and on all five GPT-6 model cards (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra — confirmed by the cache-write/cache-read columns in the GPT-6 pricing tables above). The -GPT-5.5 and GPT-5.4 cards list client-side tool calling in that slot instead and do **not** list prompt caching. -Do not assume caching on 5.5/5.4. +GPT-5.5 and GPT-5.4 cards (read 2026-11-06) list **implicit prompt caching on `bedrock-runtime` Responses only** +(automatic, no request parameters) with a cache-read rate and no cache-write rate; explicit caching is unsupported +and the mantle feature list carries client-side tool calling in that slot instead. Do not assume caching on +5.5/5.4 mantle, and do not inherit the GPT-5.6 prefix/breakpoint rules below for them. | Property | Value | | ----------------- | ------------------------------------------------------------ | @@ -359,10 +386,10 @@ This corrects two claims that were previously applied to all Mantle traffic in t - There is **no shared 10,000 RPM account limit** governing these models — the quota dimension is TPM, per model, per region. -- "Switch to `bedrock-runtime`" is **not a throughput remedy for GPT-5.5 / GPT-5.4** — they have no - `bedrock-runtime` path at all. For GPT-5.6 the runtime path DOES exist (CRIS only; see Access Paths above), so - moving there is a legitimate option — but treat it as an endpoint/architecture choice with its own quota family - and residency implications, not a free throughput escape hatch. +- "Switch to `bedrock-runtime`" is **not a free throughput escape hatch**. For GPT-5.6, GPT-5.5 and GPT-5.4 the + runtime path exists (CRIS only; see Access Paths above — GPT-5.5 / GPT-5.4 re-verified 2026-11-06), so moving + there is a legitimate option — but treat it as an endpoint/architecture choice with its own quota family and + residency implications. The supported mitigations are: exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK), spreading load across minutes rather than bursting, ramping request rate gradually, and prompt caching (cached input @@ -409,8 +436,8 @@ This model family is moving fast (two GA waves and a repricing inside 10 weeks). 1. Re-read the [OpenAI model card index](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards-openai.html) for models added or removed, and each per-model card for lifecycle state and EOL date. -2. Recheck the region matrix AND the GPT-5.6 CRIS footprints — for 5.5/5.4 a region change is migration-blocking; - for 5.6 the runtime/CRIS path usually covers the region instead. +2. Recheck the region matrix AND the CRIS footprints for every proprietary GPT model — the runtime/CRIS path + usually covers a region outside the mantle matrix; only a strictly in-region requirement there is blocking. 3. Recheck rates on the Bedrock pricing page OpenAI tab, and resolve any row still marked _unverified_. 4. Recheck whether the Price List API has gained GPT-5.x coverage; if it has, drop the caveat above and let `estimate-ai.md` price these models from the MCP. @@ -424,3 +451,9 @@ This model family is moving fast (two GA waves and a repricing inside 10 weeks). 2026), and GPT-6.1 Sol (GA Sep 29, 2026) are all confirmed on Bedrock with their own model cards and pricing tables. New discovery this refresh: a 6x-Standard **Ultrafast** service tier on Astra and 6.1 Sol only (Sol and Luna remain Standard-only) — the first new tier shape since this file started tracking the family. +9. **2026-11-06 refresh — GPT-5.5 / GPT-5.4 re-read.** Item 5 fired again: both cards now list `bedrock-runtime` + (Responses, Chat Completions, Converse via `us.` / `global.` CRIS ids; no in-region runtime form), Chat + Completions on `bedrock-mantle`, a 1,050,000-token context window with 128,000 max output, a long-context + (>272K) price tier, implicit prompt caching on runtime Responses, and a GovCloud (US-West) GPT-5.4 rate of + 3.375 · 20.25. Earlier "mantle-only / no CRIS / 272K / no long-context tier" claims for these two models were + stale and are corrected throughout this file. diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md index a819dc895..1ad1b0a09 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md @@ -48,9 +48,9 @@ Inference on `bedrock-mantle` for these models is governed by **two per-model, p | Medium | Medium | Monitor 429s against **token** throughput, not request rate; enable prompt caching | | High | High | Enable prompt caching first (cached input is exempt from input TPM), then request a quota increase | -**The `bedrock-runtime` fallback exists only for GPT-5.6 and GPT-6 (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra).** GPT-5.5 and GPT-5.4 are `bedrock-mantle` only and in-region only — for them, "switch to `bedrock-runtime`" requires moving to a different model (Bedrock-native or `gpt-oss`), a model change with its own eval cost. GPT-5.6 Sol/Terra/Luna and GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra DO have a `bedrock-runtime` path via CRIS inference profiles (GPT-5.6 `us.`/`in.`/`global.`, GPT-6 `us.`/`global.` prefixed ids; the model cards recommend runtime for new applications) — a legitimate endpoint option with its own quota family, and on Global CRIS it is also the cost-parity option. Scaling levers on the mantle path, in order: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Sol/Terra/Luna (`us.`/`in.`/`global.`), GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra (`us.`/`global.`), and GPT-5.5 / GPT-5.4 (`us.`/`global.`; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: -1. Prompt caching (GPT-5.6 and GPT-6 only) — 90% off cached input and exempt from the input-TPM quota +1. Prompt caching (GPT-5.6 and GPT-6 on mantle; GPT-5.5 / GPT-5.4 list implicit caching on `bedrock-runtime` Responses only) — 90% off cached input and exempt from the input-TPM quota 2. Exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK) 3. Spreading load across minutes and ramping request rate gradually rather than bursting 4. A Service Quotas increase for that model's input/output TPM in that region @@ -108,8 +108,8 @@ Claude models on Mantle have an additional **output TPM cap** that differs by mo - For Claude migrations at medium/high volume: the 2M output TPM cap on Claude 4.7+ is the binding constraint - For OpenAI proprietary GPT targets: this Claude cap does not apply. Use the GPT-5.x mantle quotas or - Astra-specific verification above. Astra / GPT-5.6 have runtime CRIS alternatives with their own - quotas; GPT-5.5/5.4 have no runtime path + Astra-specific verification above. Astra / GPT-5.6 / GPT-5.5 / GPT-5.4 all have runtime CRIS alternatives + with their own quotas (`us.`/`global.` prefixed ids; no runtime in-region form) - For `gpt-oss` targets: these do run on `bedrock-runtime`, so standard account TPM limits and the Converse-path mitigations apply - When output-heavy workloads (long JSON, tool outputs, multi-step reasoning) are detected, flag the relevant cap prominently; recommend `bedrock-runtime` for production **only** when the target model actually has a `bedrock-runtime` path diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md index cfc5158ee..78fb426c0 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md @@ -42,7 +42,9 @@ Two consequences that invert the previous decision logic: 2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.x In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when - the workload has no data-residency constraint (GPT-5.5 / GPT-5.4 have no CRIS at all). See + the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on + `bedrock-runtime`, but their model cards (read 2026-11-06) publish In-Region pricing only, so quote the ~10% + figure for them on every inference option until a Global rate is published. See `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, prompt caching, one vendor relationship — carries the in-region path; never present that path as free or neutral. For Astra, use its separately dated Bedrock rates and verify the source provider's rate before comparing. @@ -72,14 +74,15 @@ GPT-5.4, the target is **the same model on Bedrock**. | GPT-5.6 Sol | GPT-5.6 Sol | `openai.gpt-5.6-sol` / `us.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Terra | GPT-5.6 Terra | `openai.gpt-5.6-terra` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Luna | GPT-5.6 Luna | `openai.gpt-5.6-luna` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | -| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | -| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | Then apply the **region gate** below. Record `model_change: false` and the chosen path in `aws-design-ai.json` → `ai_architecture.code_migration`: `migration_path: "mantle_openai_chat"` for -Astra sources using Chat Completions, or `"mantle_openai_responses"` for a selected Mantle Responses -path. Use `migration_path: "runtime_openai_cris"` when a GPT-6 / GPT-5.6 target is served via -`bedrock-runtime` with a CRIS id (the model cards recommend runtime for new applications). +sources using Chat Completions on a model whose card lists it on mantle (GPT-6, GPT-5.5, GPT-5.4), or +`"mantle_openai_responses"` for a selected Mantle Responses path. Use `migration_path: "runtime_openai_cris"` +when a GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 target is served via `bedrock-runtime` with a CRIS id (the model +cards recommend runtime for new applications). Report the assessment honestly: `strong_migrate` here means "low-risk, well-supported move", not "cheaper". @@ -105,14 +108,16 @@ regions — offer it, stating the data-residency implication of cross-region rou Global routes anywhere and is the cost-parity option). Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through to Tier 1. -**GPT-5.5 / GPT-5.4:** hard gate. Mantle in-region only, no CRIS, no fallback. If the target region is not in the -matrix: +**GPT-5.5 / GPT-5.4:** same shape as GPT-5.6, with a narrower mantle matrix (GPT-5.5: us-east-1, us-east-2; +GPT-5.4: us-east-1, us-east-2, us-west-2, us-gov-west-1 — per their model cards, read 2026-11-06). If the target +region is in that matrix, either endpoint works. Otherwise the `bedrock-runtime` CRIS path (`us.openai.gpt-5.5` / +`global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`) reaches it, with the same data-residency +caveat as GPT-5.6 (Geo stays within the geography, Global routes anywhere). There is no runtime in-region form. +Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through: -1. Prefer offering a **region change** to a supported region, if no data-residency constraint pins the workload. - This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. -2. If the region is fixed, also offer **upgrading within the vendor to GPT-5.6** (which reaches the region via - CRIS) alongside the cross-family option — a generation change, but same vendor and prompt idioms. -3. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. +1. Prefer offering a **region change** to a supported mantle region, if no data-residency constraint pins the + workload. This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. +2. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. Record the outcome in `regional_warnings[]`. @@ -235,10 +240,11 @@ model on price. ### Open-weight gpt-oss -`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and, unlike the -proprietary GPT models, **do** support `bedrock-runtime` / Converse. They sit a capability class below the GPT-5.x -frontier tier. Recommend them when the user wants OpenAI-architecture models on the Bedrock-native runtime surface -(for Guardrails, invocation logging, or Converse-based tooling) rather than through mantle. +`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and support +`bedrock-runtime` / Converse with a bare model ID (no CRIS profile needed) and `Invoke`, which the proprietary GPT +models do not. They sit a capability class below the GPT-5.x frontier tier. Recommend them when the user wants +OpenAI-architecture models on the Bedrock-native runtime surface (for Guardrails, invocation logging, or +Converse-based tooling) at the lowest price rather than through mantle. --- @@ -284,7 +290,7 @@ rather than dismissing it. For a long-context (>272K) workload the gap is much w | Chat Completions | Preserve supported Chat when selected | Reshape only for a selected API change; verify the model and endpoint | | Function calling | Supported on GPT-5.x via mantle; Claude tools via Converse | Same-model keeps tool semantics identical | | Reasoning effort | `reasoning={"effort": ...}` on mantle | `none` / `low` / `medium` / `high` / `xhigh` / `max` | -| Prompt caching | GPT-5.6 only (90% off cached input) | Not listed for GPT-5.5 / 5.4; Claude has its own caching | +| Prompt caching | GPT-5.6 (90% off cached input); GPT-5.5 / 5.4 implicit caching on `bedrock-runtime` Responses only | GPT-5.5 / 5.4 cards (read 2026-11-06) list a cache-read rate and implicit caching on runtime, none on mantle; Claude has its own caching | | Streaming | Supported | Verify per surface | | Vision | GPT-5.x (image input) or Claude / Llama 4 | Same-model preserves behavior | | JSON mode | Claude (excellent), Nova Pro (good) | Most models via prompt | @@ -339,11 +345,12 @@ and closed to new customers as of July 30, 2026. ### When to prefer a Bedrock-native model over the mantle GPT path Choose Claude / Nova via Converse when the workload needs Knowledge Bases, intelligent prompt routing, structured -outputs, or application inference profiles — none of which the GPT path offers. Note what no longer forces a family -switch for GPT-5.6: its `bedrock-runtime` CRIS path provides cross-region inference, invocation logs, and -Guardrails (Converse API only; prompt caching is Responses-only on runtime). For GPT-5.5 / GPT-5.4, Guardrails, -logging, and cross-region reach still require a different model. The mantle GPT path is the smallest change; the -Bedrock-native path remains the most feature-complete. +outputs, or application inference profiles — none of which the mantle GPT path offers. Note what no longer forces +a family switch for GPT-5.6, GPT-5.5 and GPT-5.4: their `bedrock-runtime` CRIS paths provide cross-region +inference, invocation logs, Guardrails and application inference profiles (both Converse API only), and +structured outputs and implicit prompt caching (both Responses API only) — per the GPT-5.4 / GPT-5.5 model cards +read 2026-11-06. Knowledge Bases and intelligent prompt routing still require a Bedrock-native model. The mantle +GPT path is the smallest change; the Bedrock-native path remains the most feature-complete. ### High-spend tiering @@ -364,8 +371,8 @@ alternative, not against the source provider. cheaper and exempt from the input-TPM quota, which relieves the binding constraint on mantle. **Very high (>100M tokens/day):** tiering plus caching. Check TPM headroom per model per region early; there is no -RPM quota and no `bedrock-runtime` fallback for GPT models, so quota increases are the scaling lever. See -`shared/ai-migration-guardrails.md`. +RPM quota, and the `bedrock-runtime` CRIS path for GPT-5.6 / 5.5 / 5.4 / GPT-6 carries its own quotas rather than +adding headroom to mantle, so quota increases are the scaling lever. See `shared/ai-migration-guardrails.md`. --- diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md index 18266733c..a4206583c 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle only; no 1M tier) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle only; no 1M tier) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 11.00/49.50; card read 2026-11-06) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 5.50/24.75; card read 2026-11-06) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | @@ -353,17 +353,24 @@ Regions (mantle): us-east-1 / us-east-2 for all five; us-west-2 additionally car | GPT-5.5 | 5.50 | 33.00 | — | 0.55 | | GPT-5.4 | 2.75 | 16.50 | — | 0.275 | -#### Long context (1M) — GPT-5.6 only, 2.0x input / 1.5x output - -| Model | Input $/1M | Output $/1M | -| ------------- | ---------- | ----------- | -| GPT-5.6 Sol | 8.80 | 33.00 | -| GPT-5.6 Terra | 4.40 | 19.80 | -| GPT-5.6 Luna | 0.44 | 1.98 | - -A workload above 272K context must be priced at the long-context tier. GPT-5.5 and GPT-5.4 have no such tier, so -their usable window is 272K. Global CRIS is published at OpenAI's standard list price (cost parity, GPT-5.6 only — -see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. +#### Long context (>272K input tokens) — GPT-5.6 at 2.0x input / 1.5x output; GPT-5.5 / GPT-5.4 per their model cards + +| Model | Input $/1M | Output $/1M | Cache read $/1M | +| ------------- | ---------- | ----------- | --------------- | +| GPT-5.6 Sol | 8.80 | 33.00 | — | +| GPT-5.6 Terra | 4.40 | 19.80 | — | +| GPT-5.6 Luna | 0.44 | 1.98 | — | +| GPT-5.5 | 11.00 | 49.50 | 1.10 | +| GPT-5.4 | 5.50 | 24.75 | 0.55 | + +A workload above 272K input tokens must be priced at the long-context tier, applied to all input and output tokens +of the request. GPT-5.5 and GPT-5.4 rows read from their model cards on 2026-11-06 +([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), +[GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)); both cards state a +1,050,000-token context window (128,000 max output) and list `us.`/`global.` CRIS ids on `bedrock-runtime`, but +publish the In-Region inference option only. Global CRIS is published at OpenAI's standard list price (cost parity, +GPT-5.6 only — see `openai-on-bedrock.md`). GovCloud (US-West) GPT-5.4 short-context is 3.375 / 20.25 (cache read +0.3375) per the 2026-11-06 card; an earlier revision recorded 3.30 / 19.80. > **One source conflict.** These models are absent > from the AWS Price List API entirely: querying `AmazonBedrock` returns only `gpt-oss` and GPT OSS Safeguard, and @@ -373,7 +380,8 @@ see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. **Prompt caching (GPT-5.6 only):** cached input read at a 90% discount, cache write at 1.25x uncached input, minimum 1,024-token prefix, up to 4 breakpoints, ≥30-minute retention. Cached input is exempt from the input-TPM quota. -GPT-5.5 and GPT-5.4 do not list prompt caching support. +GPT-5.5 and GPT-5.4 list only implicit prompt caching on `bedrock-runtime` Responses (automatic, no request +parameters; cache-read rate above, no cache-write rate) and none on mantle (model cards read 2026-11-06). #### Open-weight gpt-oss diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md index cdf8ced55..7720d4b58 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md @@ -190,12 +190,18 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` ## migration_path vocabulary `mantle_openai_responses` (an OpenAI-protocol source — direct or Azure-fronted — with the model -on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `converse` -(Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when a proprietary GPT -model must move off mantle for Guardrails / Knowledge Bases / logging / an unsupported region) · -`gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic -Bedrock SDK swap). A proprietary `openai.gpt-*` model ID is NEVER paired with a -`converse`/`bedrock-runtime` path — those models are mantle-only. +on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` +(same, preserving a Chat Completions source on a model whose card lists Chat Completions on +mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via +`bedrock-runtime` with a `us.`/`in.`/`global.` CRIS id, `model_change: false`; available for +GPT-6, GPT-5.6, GPT-5.5 and GPT-5.4 per their model cards) · `converse` (Bedrock-native +Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, +intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` +(OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK +swap). A **bare** proprietary `openai.gpt-*` model ID is NEVER paired with a +`converse`/`bedrock-runtime` path — bare ids are mantle ids; every proprietary GPT target on +`bedrock-runtime` carries a CRIS-prefixed id (there is no runtime in-region form for GPT-6, +GPT-5.6, GPT-5.5 or GPT-5.4). ## regional_validation @@ -255,8 +261,9 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `price_comparison`. - [ ] `honest_assessment` overall is the weakest across `bedrock_models[]`; if `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. -- [ ] No `bedrock_models[]` entry pairs a proprietary `openai.gpt-*` model ID with a - `converse`/`bedrock-runtime` migration path (mantle-only). +- [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a + `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` + target for GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 carries a `us.`/`in.`/`global.` CRIS id). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/SKILL.md b/plugins/aws-startup-advisor/skills/llm-to-bedrock/SKILL.md index db0f263c1..18f188d0b 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/SKILL.md +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/SKILL.md @@ -1189,7 +1189,7 @@ Tell the user, before collecting models: > - **OpenAI on Bedrock comes in a few forms, all real** — and which endpoint they use is per-ID, not one blanket rule: > - *Open-weight* `gpt-oss` (`openai.gpt-oss-20b-1:0`, `openai.gpt-oss-120b-1:0`) → `bedrock-runtime` via `bedrock:InvokeModel` / `Converse` (its Responses API is also offered on `bedrock-mantle`). > - *Bare proprietary* GPT ids (`openai.gpt-5*`, not `gpt-oss`) → probed on the `bedrock-mantle` endpoint (Responses API). -> - A *GPT-5.6 CRIS profile* id prefixed `us.` / `in.` / `global.` (e.g. `global.openai.gpt-5.6-sol`) → a `bedrock-runtime` target where Converse is supported. +> - A *CRIS profile* id prefixed `us.` / `in.` / `global.` (e.g. `global.openai.gpt-5.6-sol`, `us.openai.gpt-5.4`, `global.openai.gpt-6-astra`) → a `bedrock-runtime` target where Converse is supported; every proprietary GPT model on Bedrock (GPT-5.6, GPT-6, GPT-5.5, GPT-5.4) has this form, and none has a runtime in-region form. > - The `bedrock-mantle` path uses a **separate** action set — `bedrock-mantle:*` (e.g. the `AmazonBedrockMantleInferenceAccess` managed policy: `bedrock-mantle:CreateInference` + `CallWithBearerToken`) — distinct from `bedrock:InvokeModel`. The preflight decides per model; don't assume. > - What is **not** on Bedrock is calling OpenAI's own hosted API at api.openai.com — that stays with OpenAI. 'GPT on Bedrock' means the AWS-served models above, reached through AWS endpoints and IAM. > @@ -1277,8 +1277,9 @@ Then, per B4's branch table: after they enable it. This is the common, expected outcome for a user who came here to "get access." - `reason: authz` → access is enabled but IAM denies inference. Name the action to grant — for a - standard model `bedrock:InvokeModel`; for a mantle-only `openai.gpt-5*` target (bare proprietary - GPT, not `gpt-oss`) the `bedrock-mantle:*` set (see **B4a**). The `detail` says which — follow it + standard model `bedrock:InvokeModel`; for a bare `openai.gpt-5*` / `openai.gpt-6*` mantle target + (bare proprietary GPT, not `gpt-oss`, not a `us.`/`in.`/`global.` CRIS id) the `bedrock-mantle:*` + set (see **B4a**). The `detail` says which — follow it rather than guessing from the ID, since gpt-oss fails on `bedrock:InvokeModel`, not mantle. - `reason: model_unavailable` → the ID isn't offered in `$REGION`. Use the `resolve-bedrock-model-id` procedure to suggest a cross-region inference-profile ID or a diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/behavior-delta-detection/references/openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/behavior-delta-detection/references/openai-to-bedrock.md index 96ab4f4f7..44c32034d 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/behavior-delta-detection/references/openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/behavior-delta-detection/references/openai-to-bedrock.md @@ -29,7 +29,7 @@ for OpenAI-compatible runtime calls, CRIS ids, and runtime IAM permissions. Astr - `resolution_kind`: `ux_choice` - Source (OpenAI): `client.chat.completions.create(...)`, `messages=[...]`, reads `choices[0].message.content` - Target (mantle GPT): `client.responses.create(...)`, `input=...`, reads `output_text` -- Chat Completions support is **model-specific, not uniformly unverified.** All four GPT-6 models (Astra, Sol, Luna, 6.1 Sol) and the GPT-5.6 family (Sol, Terra, Luna) list `Chat Completions` as a supported API on both `bedrock-mantle` and `bedrock-runtime` CRIS (per their model cards — see `openai-on-bedrock.md` § Access Paths). For these models, a Chat Completions source MAY keep `chat.completions.create` and `choices[0].message` parsing unchanged — **reshape to Responses is OPTIONAL**, driven only by a Responses-only feature (runtime prompt caching, reasoning-item round-trips on `bedrock-runtime`) or a demonstrated account-specific constraint, not by a blanket assumption that Chat Completions is unsupported. For GPT-5.5 / GPT-5.4 (mantle-only, no CRIS) Chat Completions support is still unconfirmed on their model cards — treat those two as requiring a reshape to Responses, and probe the target account before committing. +- Chat Completions support is **model-specific, not uniformly unverified.** All four GPT-6 models (Astra, Sol, Luna, 6.1 Sol) and the GPT-5.6 family (Sol, Terra, Luna) list `Chat Completions` as a supported API on both `bedrock-mantle` and `bedrock-runtime` CRIS (per their model cards — see `openai-on-bedrock.md` § Access Paths). For these models, a Chat Completions source MAY keep `chat.completions.create` and `choices[0].message` parsing unchanged — **reshape to Responses is OPTIONAL**, driven only by a Responses-only feature (runtime prompt caching, reasoning-item round-trips on `bedrock-runtime`) or a demonstrated account-specific constraint, not by a blanket assumption that Chat Completions is unsupported. GPT-5.5 / GPT-5.4 follow the same rule: their model cards (read 2026-11-06 — [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) list `Chat Completions` as supported on both `bedrock-mantle` and `bedrock-runtime` (`us.`/`global.` CRIS ids), so the reshape is OPTIONAL for them too. Plan a reshape only when the selected model's card leaves Chat Completions unchecked on the selected endpoint, and probe the target account before committing, as for any model. ### detect_grep @@ -66,7 +66,7 @@ grep -rEn 'function_call_output|tool_call' --include="*.py" --include="*. ## prompt-caching-availability - `resolution_kind`: `impl_path` -- Prompt caching is listed as supported on GPT-5.6 and GPT-6 only. Do not emit caching configuration for `openai.gpt-5.5` or `openai.gpt-5.4`. +- Prompt caching with request parameters (explicit mode) is listed on GPT-5.6 and GPT-6 only. The GPT-5.5 / GPT-5.4 cards (read 2026-11-06) list only implicit caching on `bedrock-runtime` Responses (automatic, no request parameters) and none on mantle — do not emit caching configuration for `openai.gpt-5.5` or `openai.gpt-5.4` on either endpoint. - Astra lists implicit and explicit prompt caching on mantle Responses, with **30-minute cache-write** rates. Do not inherit GPT-5.6's minimum-prefix, breakpoint, or cached-input quota-exemption rules. diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/resolve-bedrock-model-id/resolve-bedrock-model-id.md b/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/resolve-bedrock-model-id/resolve-bedrock-model-id.md index f64dc9fef..f2da1fd11 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/resolve-bedrock-model-id/resolve-bedrock-model-id.md +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/references/helpers/resolve-bedrock-model-id/resolve-bedrock-model-id.md @@ -50,9 +50,13 @@ aws bedrock list-foundation-models \ **Check this before Step 1.** Route by family and endpoint (GPT-5 verified 2026-08-21; Astra regions verified 2026-09-30; see `gcp-to-aws/references/shared/openai-on-bedrock.md`): -**Case A — GPT-5.5 / GPT-5.4 (`openai.gpt-5.5`, `openai.gpt-5.4`): mantle-only, no inference profile.** The -inference-profile path below cannot resolve them — `list-inference-profiles` never returns them, and Step 3's token -ranking would end in a spurious `blocked` for a perfectly valid id. Validate against the model catalog instead: +**Case A — bare GPT-5.5 / GPT-5.4 ids (`openai.gpt-5.5`, `openai.gpt-5.4`) when the plan targets the mantle +endpoint: bare mantle id, not an inference profile.** The inference-profile path below cannot resolve the bare form — +`list-inference-profiles` returns only the CRIS-prefixed ids (`us.openai.gpt-5.5`, `global.openai.gpt-5.5`, +`us.openai.gpt-5.4`, `global.openai.gpt-5.4`, per the model cards read 2026-11-06), never the bare mantle id — and +Step 3's token ranking would end in a spurious `blocked` for a perfectly valid id. (When the plan targets +`bedrock-runtime` for GPT-5.5 / GPT-5.4, the CRIS id flows through Case B and Steps 1–5 like GPT-5.6.) Validate the +bare id against the model catalog instead: ```bash aws bedrock list-foundation-models \ @@ -69,7 +73,7 @@ aws bedrock list-foundation-models \ this catalog's `modelId` + `modelName` pairs instead of against inference profiles. **Do this check before falling through to Step 1** — a friendly name like `"OpenAI GPT-5.5"` (tokens `{openai, gpt, 5}`) has full token overlap with `openai.gpt-5.5`'s own id (`{openai, gpt, 5}`) and would otherwise fall through to Step 1's - `list-inference-profiles`, which never lists a mantle-only model — the free-text input would then reach Step 3's + `list-inference-profiles`, which never lists a bare mantle id — the free-text input would then reach Step 3's ranking with zero candidates and dead-end at `blocked` with no matches shown, even though the foundation catalog had the exact model the whole time. A single candidate with full token overlap on the model-identifying tokens (excluding generic tokens like a bare `gpt`) → surface it as the ONE candidate through Step 4 exactly as an @@ -78,24 +82,27 @@ aws bedrock list-foundation-models \ list alongside any inference-profile candidates Steps 1–3 separately produce; do not silently drop either source. - **No match at all (exact or token) and `plan_model_id` looked ID-shaped, not free-text** → not enabled or not available in this region. Return `blocked` with `reason: model_unresolvable`, putting the region and the - `openai.*` ids that _were_ returned in `detail`. These two models have no CRIS, so the remedy is a region change - or a different model — never an inference-profile prefix. + `openai.*` ids that _were_ returned in `detail`. Do not silently add an inference-profile prefix to rescue a + mantle plan: the remedy is a region change, a different model, or a plan change to the `bedrock-runtime` CRIS + path (`us.` / `global.` ids, Case B) — a decision for the plan, not for this resolver. - CLI failure / missing `bedrock:ListFoundationModels` → `blocked` with `reason: model_unresolvable` and the exact error in `detail`, rather than guessing. -These two need `bedrock-mantle:*` IAM actions (e.g. `AmazonBedrockMantleInferenceAccess`), not +The bare ids need `bedrock-mantle:*` IAM actions (e.g. `AmazonBedrockMantleInferenceAccess`), not `bedrock:InvokeModel`; resolution success does not imply invoke authorization. **A free-text name that does NOT token-match this catalog** (e.g. `"anthropic claude haiku"`, `"Nova Micro"`) -continues to Step 1 as before — this catalog check only short-circuits the specific case a mantle-only model would +continues to Step 1 as before — this catalog check only short-circuits the specific case a bare mantle id would otherwise be unreachable from free text; it is not a replacement for Step 1's inference-profile search for every other provider/model. -**Case B — GPT-5.6 and GPT-6 (`openai.gpt-5.6-sol` / `-terra` / `-luna`, `openai.gpt-6-astra` / `-sol` / `-luna`, -`openai.gpt-6.1-sol`, or already `us.` / `in.` / `global.` prefixed): BOTH paths exist.** The bare id is the mantle -form; `bedrock-runtime` serves these models through CRIS inference profiles (`us.openai.gpt-5.6-*` / -`us.openai.gpt-6-*`, `in.openai.gpt-5.6-*` in India Regions, `global.openai.gpt-5.6-*` / `global.openai.gpt-6-*`), -which `list-inference-profiles` DOES return. Route on the plan's intent: +**Case B — GPT-5.6, GPT-6, and GPT-5.5 / GPT-5.4 on `bedrock-runtime` (`openai.gpt-5.6-sol` / `-terra` / `-luna`, +`openai.gpt-6-astra` / `-sol` / `-luna`, `openai.gpt-6.1-sol`, `openai.gpt-5.5` / `openai.gpt-5.4` with a runtime +plan, or already `us.` / `in.` / `global.` prefixed): BOTH paths exist.** The bare id is the mantle form; +`bedrock-runtime` serves these models through CRIS inference profiles (`us.openai.gpt-5.6-*` / `us.openai.gpt-6-*` / +`us.openai.gpt-5.5` / `us.openai.gpt-5.4`, `in.openai.gpt-5.6-*` in India Regions, `global.openai.gpt-5.6-*` / +`global.openai.gpt-6-*` / `global.openai.gpt-5.5` / `global.openai.gpt-5.4`), which `list-inference-profiles` DOES +return. Route on the plan's intent: - Plan targets the mantle endpoint (`migration_path` starts with `mantle`, or the id is bare) → validate the bare id against the model catalog exactly as in Case A. @@ -217,9 +224,9 @@ stops on abort. - This skill is idempotent: calling it twice with the same already-validated ID will hit Step 0 (documented bare-ID route) or Step 2 (inference profile) and return immediately. - Steps 1–5 assume the target is a `bedrock-runtime` model reachable through an - inference profile. Mantle-only ids (GPT-5.5/5.4, and GPT-5.6 when the plan - targets the mantle endpoint), and London in-region Opus 5.5, are handled entirely in Step 0; GPT-5.6/GPT-6 CRIS ids - flow through Steps 1–5 like any other inference profile. See + inference profile. Bare mantle ids (any proprietary GPT model — GPT-5.5/5.4, GPT-5.6, GPT-6 — when the plan + targets the mantle endpoint), and London in-region Opus 5.5, are handled entirely in Step 0; GPT-5.6/GPT-6 and + GPT-5.5/5.4 CRIS ids flow through Steps 1–5 like any other inference profile. See `$ASSESS_BASE/references/shared/openai-on-bedrock.md` for the authoritative family split. - Output of this skill should replace the plan's `target_model_id` in the diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/bedrock_pricing.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/bedrock_pricing.py index 7ab37804b..6530c758b 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/bedrock_pricing.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/bedrock_pricing.py @@ -90,7 +90,11 @@ def parse_price_dimensions(price_item: dict) -> dict: # price — cost PARITY, for workloads with no residency constraint # The GPT-5.6 family also has a LONG-CONTEXT (1M) tier at 2.0x input / 1.5x # output per option, NOT represented here — a >272K workload priced from this - # table is understated. GPT-5.5 and GPT-5.4: mantle-only, no CRIS, no 1M tier. + # table is understated. GPT-5.5 and GPT-5.4 (model cards read 2026-11-06) also + # have a long-context (>272K) tier (5.5: 11.00/49.50; 5.4: 5.50/24.75 per 1M), + # likewise NOT represented here. Their cards publish the In-Region option only; + # the us./global. CRIS ids they list on bedrock-runtime carry no separate price + # row, so no prefixed GPT-5.5/5.4 entries are added below until one is published. "openai.gpt-5.6-sol": {"input_per_1k_usd": 0.0044, "output_per_1k_usd": 0.022}, "openai.gpt-5.6-terra": {"input_per_1k_usd": 0.0022, "output_per_1k_usd": 0.0132}, "openai.gpt-5.6-luna": {"input_per_1k_usd": 0.00022, "output_per_1k_usd": 0.00132}, @@ -135,9 +139,12 @@ def parse_price_dimensions(price_item: dict) -> dict: def is_mantle_gpt(model_id: str) -> bool: - """Pure: OpenAI's proprietary GPT models (GPT-5.5/5.4/5.6 and GPT-6 - Astra/Sol/Luna/6.1 Sol), which the AWS PriceList API does not carry. The - open-weight gpt-oss models ARE in the PriceList API and must not match.""" + """Pure: BARE ids of OpenAI's proprietary GPT models (GPT-5.5/5.4/5.6 and GPT-6 + Astra/Sol/Luna/6.1 Sol) — the bedrock-mantle id form — which the AWS PriceList + API does not carry. The `us.`/`in.`/`global.` CRIS forms (bedrock-runtime; GPT-5.5 + and 5.4 have `us.`/`global.` ids too) do not match here; callers pair this with + an explicit prefixed-id regex. The open-weight gpt-oss models ARE in the + PriceList API and must not match.""" mid = model_id.lower() return (mid.startswith("openai.gpt-5") or mid.startswith("openai.gpt-6")) and "oss" not in mid diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py index 5b56d2fd2..0ceaa4f1e 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py @@ -20,12 +20,14 @@ def is_inference_profile(model_id: str) -> bool: def is_mantle_model(model_id: str, region: str = "") -> bool: """True for bare proprietary GPT-5/GPT-6 IDs and the bare Opus 5.5 ID, which use - bedrock-mantle (Responses and Messages respectively). They need + bedrock-mantle (Responses/Chat Completions and Messages respectively). They need `bedrock-mantle:*` actions — a policy granting only `bedrock:InvokeModel` against a foundation-model ARN cannot authorize these bare IDs. Opus 5.5 in eu-west-2 is a runtime in-region target (model card verified 2026-10-03); its other bare-ID regions use Mantle. - Their prefixed forms use runtime instead. + The `us.`/`in.`/`global.` prefixed forms use bedrock-runtime instead — for every + proprietary GPT model, GPT-5.5/5.4 included (their model cards list `us.`/`global.` + CRIS ids; none has a runtime in-region form), so a prefixed id must NOT match. The open-weight gpt-oss models DO use bedrock-runtime and must not match.""" mid = model_id.lower() return ((mid.startswith("openai.gpt-5") or mid.startswith("openai.gpt-6")) and "oss" not in mid) or ( diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/preflight_bedrock.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/preflight_bedrock.py index 2a4c031bb..fde343ece 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/preflight_bedrock.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/preflight_bedrock.py @@ -60,12 +60,15 @@ def is_embedding_model(model_id: str) -> bool: def is_mantle_model(model_id: str) -> bool: """Pure: ids that must be probed via the mantle Responses API rather than Converse/InvokeModel. Matches the BARE proprietary GPT ids (`openai.gpt-5*`, - `openai.gpt-6*` — covers GPT-5.5/5.4/5.6 and GPT-6 Astra/Sol/Luna/6.1 Sol), - which are mantle-served. Deliberately does NOT match: + `openai.gpt-6*` — covers GPT-5.5/5.4/5.6 and GPT-6 Astra/Sol/Luna/6.1 Sol). + The bare id is the bedrock-mantle form for every proprietary GPT model; none + of them has a bedrock-runtime in-region form. Deliberately does NOT match: - gpt-oss ids (Converse-capable on bedrock-runtime), and - - GPT-5.6/GPT-6 CRIS profile ids (`us.`/`in.`/`global.` prefixed) — those are - bedrock-runtime targets where Converse IS supported, so falling through to - the standard Converse probe is the correct behavior, not an accident.""" + - CRIS profile ids (`us.`/`in.`/`global.` prefixed) for any proprietary GPT + model, GPT-5.5/5.4 included (their model cards list `us.`/`global.` ids on + bedrock-runtime) — those are bedrock-runtime targets where Converse IS + supported, so falling through to the standard Converse probe is the + correct behavior, not an accident.""" mid = model_id.lower() return (mid.startswith("openai.gpt-5") or mid.startswith("openai.gpt-6")) and "oss" not in mid @@ -160,8 +163,8 @@ def classify_mantle_error(status: int | None, message: str) -> dict: f"Mantle is in-region only; for GPT-5.6 try a bedrock-runtime CRIS " f"id (us./in./global. prefixed); for GPT-6 Astra use us-east-1/us-west-2 " f"mantle or a supported us./global. runtime CRIS path. " - f"For GPT-5.5/5.4 switch to " - f"a supported region or a different model."} + f"For GPT-5.5/5.4 switch to a supported mantle region, a " + f"us./global. bedrock-runtime CRIS id, or a different model."} if status == 429: # Reaching a token-per-minute ceiling still proves we are authorized. return {"ok": True, "reason": "throttled_ok", diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py index 40be0ef0e..55161d2a7 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py @@ -295,6 +295,18 @@ def test_mantle_gpt_detection_excludes_gpt_oss(): assert bp.is_mantle_gpt("anthropic.claude-sonnet-4-6") is False +def test_mantle_gpt_detection_gpt54_55_bare_is_mantle_cris_is_runtime(): + # GPT-5.4 / GPT-5.5 model cards (read 2026-11-06) list us./global. CRIS ids on + # bedrock-runtime. is_mantle_gpt matches only the bare (mantle) id form; the + # prefixed runtime forms are handled by the callers' explicit CRIS regex. + assert bp.is_mantle_gpt("openai.gpt-5.4") is True + assert bp.is_mantle_gpt("openai.gpt-5.5") is True + assert bp.is_mantle_gpt("us.openai.gpt-5.4") is False + assert bp.is_mantle_gpt("global.openai.gpt-5.4") is False + assert bp.is_mantle_gpt("us.openai.gpt-5.5") is False + assert bp.is_mantle_gpt("global.openai.gpt-5.5") is False + + def test_mantle_gpt_detection_includes_bare_gpt6(): # Finding 1: bare GPT-6 ids must be recognized by the same detector that # routes GPT-5.x to the curated static table / mantle path. diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py index 7544ad18c..b3f6449ab 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py @@ -126,6 +126,18 @@ def test_mantle_model_detection_excludes_gpt_oss(): assert is_mantle_model("anthropic.claude-sonnet-4-6") is False +def test_is_mantle_model_gpt54_55_cris_ids_are_runtime_not_mantle(): + # GPT-5.4 / GPT-5.5 model cards (read 2026-11-06) list us./global. CRIS ids on + # bedrock-runtime: the bare id needs bedrock-mantle:* actions, the prefixed id + # needs bedrock:InvokeModel against the inference-profile ARN. + assert is_mantle_model("openai.gpt-5.4") is True + assert is_mantle_model("openai.gpt-5.5") is True + assert is_mantle_model("us.openai.gpt-5.4") is False + assert is_mantle_model("global.openai.gpt-5.4") is False + assert is_mantle_model("us.openai.gpt-5.5") is False + assert is_mantle_model("global.openai.gpt-5.5") is False + + def test_is_mantle_model_matches_bare_gpt6_ids(): assert is_mantle_model("openai.gpt-6-astra") is True assert is_mantle_model("openai.gpt-6-sol") is True diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_preflight_bedrock.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_preflight_bedrock.py index 71f526976..3056e8b0a 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_preflight_bedrock.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_preflight_bedrock.py @@ -197,6 +197,18 @@ def test_mantle_model_detection_excludes_gpt_oss_and_cris_forms(): assert p.is_mantle_model("amazon.nova-lite-v1:0") is False +def test_is_mantle_model_gpt54_55_cris_ids_are_runtime_not_mantle(): + # GPT-5.4 / GPT-5.5 model cards (read 2026-11-06) list us./global. CRIS ids on + # bedrock-runtime. The ID-form rule already classifies them: bare id -> mantle + # probe, CRIS-prefixed id -> Converse probe. Lock that in for these two models. + assert p.is_mantle_model("openai.gpt-5.4") is True + assert p.is_mantle_model("openai.gpt-5.5") is True + assert p.is_mantle_model("us.openai.gpt-5.4") is False + assert p.is_mantle_model("global.openai.gpt-5.4") is False + assert p.is_mantle_model("us.openai.gpt-5.5") is False + assert p.is_mantle_model("global.openai.gpt-5.5") is False + + def test_is_mantle_model_matches_bare_gpt6_ids(): # Bare GPT-6 ids (Astra, Sol, Luna, 6.1 Sol) are mantle-served, same as the # bare GPT-5.x ids above. Their CRIS forms (us./global. prefixed) stay on the @@ -221,17 +233,20 @@ def test_mantle_authz_error_points_at_mantle_actions_not_invoke_model(): def test_mantle_model_unavailable_remedy_is_family_split(): - # Verified 2026-08-21: mantle itself is in-region only, but GPT-5.6 now has a - # bedrock-runtime CRIS path — so the 404 remedy must offer the CRIS form for - # 5.6 while making clear 5.5/5.4 have no prefixed form. An earlier version of - # this test asserted the opposite (never suggest a prefix), which matched the - # pre-2026-08-21 docs. + # Mantle itself is in-region only, but every proprietary GPT model has a + # bedrock-runtime CRIS path — GPT-5.6 (us./in./global., verified 2026-08-21) + # and GPT-5.5/5.4 (us./global., model cards read 2026-11-06). The 404 remedy + # must offer the CRIS form for all of them. An earlier version of this test + # asserted that 5.5/5.4 have no prefixed form, which matched the pre-2026-11-06 + # model cards. v = p.classify_mantle_error(404, "model not found") assert v["ok"] is False assert v["reason"] == "model_unavailable" assert "in-region only" in v["detail"] assert "CRIS" in v["detail"] and "us./in./global." in v["detail"] assert "GPT-5.5/5.4" in v["detail"] + assert "us./global. bedrock-runtime CRIS id" in v["detail"] + assert "different model" in v["detail"] def test_mantle_throttle_is_ok_for_preflight(): v = p.classify_mantle_error(429, "too many tokens per minute") diff --git a/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md b/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md index a819dc895..1ad1b0a09 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md @@ -48,9 +48,9 @@ Inference on `bedrock-mantle` for these models is governed by **two per-model, p | Medium | Medium | Monitor 429s against **token** throughput, not request rate; enable prompt caching | | High | High | Enable prompt caching first (cached input is exempt from input TPM), then request a quota increase | -**The `bedrock-runtime` fallback exists only for GPT-5.6 and GPT-6 (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra).** GPT-5.5 and GPT-5.4 are `bedrock-mantle` only and in-region only — for them, "switch to `bedrock-runtime`" requires moving to a different model (Bedrock-native or `gpt-oss`), a model change with its own eval cost. GPT-5.6 Sol/Terra/Luna and GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra DO have a `bedrock-runtime` path via CRIS inference profiles (GPT-5.6 `us.`/`in.`/`global.`, GPT-6 `us.`/`global.` prefixed ids; the model cards recommend runtime for new applications) — a legitimate endpoint option with its own quota family, and on Global CRIS it is also the cost-parity option. Scaling levers on the mantle path, in order: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Sol/Terra/Luna (`us.`/`in.`/`global.`), GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra (`us.`/`global.`), and GPT-5.5 / GPT-5.4 (`us.`/`global.`; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: -1. Prompt caching (GPT-5.6 and GPT-6 only) — 90% off cached input and exempt from the input-TPM quota +1. Prompt caching (GPT-5.6 and GPT-6 on mantle; GPT-5.5 / GPT-5.4 list implicit caching on `bedrock-runtime` Responses only) — 90% off cached input and exempt from the input-TPM quota 2. Exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK) 3. Spreading load across minutes and ramping request rate gradually rather than bursting 4. A Service Quotas increase for that model's input/output TPM in that region @@ -108,8 +108,8 @@ Claude models on Mantle have an additional **output TPM cap** that differs by mo - For Claude migrations at medium/high volume: the 2M output TPM cap on Claude 4.7+ is the binding constraint - For OpenAI proprietary GPT targets: this Claude cap does not apply. Use the GPT-5.x mantle quotas or - Astra-specific verification above. Astra / GPT-5.6 have runtime CRIS alternatives with their own - quotas; GPT-5.5/5.4 have no runtime path + Astra-specific verification above. Astra / GPT-5.6 / GPT-5.5 / GPT-5.4 all have runtime CRIS alternatives + with their own quotas (`us.`/`global.` prefixed ids; no runtime in-region form) - For `gpt-oss` targets: these do run on `bedrock-runtime`, so standard account TPM limits and the Converse-path mitigations apply - When output-heavy workloads (long JSON, tool outputs, multi-step reasoning) are detected, flag the relevant cap prominently; recommend `bedrock-runtime` for production **only** when the target model actually has a `bedrock-runtime` path diff --git a/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md index cfc5158ee..78fb426c0 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md @@ -42,7 +42,9 @@ Two consequences that invert the previous decision logic: 2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.x In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when - the workload has no data-residency constraint (GPT-5.5 / GPT-5.4 have no CRIS at all). See + the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on + `bedrock-runtime`, but their model cards (read 2026-11-06) publish In-Region pricing only, so quote the ~10% + figure for them on every inference option until a Global rate is published. See `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, prompt caching, one vendor relationship — carries the in-region path; never present that path as free or neutral. For Astra, use its separately dated Bedrock rates and verify the source provider's rate before comparing. @@ -72,14 +74,15 @@ GPT-5.4, the target is **the same model on Bedrock**. | GPT-5.6 Sol | GPT-5.6 Sol | `openai.gpt-5.6-sol` / `us.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Terra | GPT-5.6 Terra | `openai.gpt-5.6-terra` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Luna | GPT-5.6 Luna | `openai.gpt-5.6-luna` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | -| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | -| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` (mantle only) | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | Then apply the **region gate** below. Record `model_change: false` and the chosen path in `aws-design-ai.json` → `ai_architecture.code_migration`: `migration_path: "mantle_openai_chat"` for -Astra sources using Chat Completions, or `"mantle_openai_responses"` for a selected Mantle Responses -path. Use `migration_path: "runtime_openai_cris"` when a GPT-6 / GPT-5.6 target is served via -`bedrock-runtime` with a CRIS id (the model cards recommend runtime for new applications). +sources using Chat Completions on a model whose card lists it on mantle (GPT-6, GPT-5.5, GPT-5.4), or +`"mantle_openai_responses"` for a selected Mantle Responses path. Use `migration_path: "runtime_openai_cris"` +when a GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 target is served via `bedrock-runtime` with a CRIS id (the model +cards recommend runtime for new applications). Report the assessment honestly: `strong_migrate` here means "low-risk, well-supported move", not "cheaper". @@ -105,14 +108,16 @@ regions — offer it, stating the data-residency implication of cross-region rou Global routes anywhere and is the cost-parity option). Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through to Tier 1. -**GPT-5.5 / GPT-5.4:** hard gate. Mantle in-region only, no CRIS, no fallback. If the target region is not in the -matrix: +**GPT-5.5 / GPT-5.4:** same shape as GPT-5.6, with a narrower mantle matrix (GPT-5.5: us-east-1, us-east-2; +GPT-5.4: us-east-1, us-east-2, us-west-2, us-gov-west-1 — per their model cards, read 2026-11-06). If the target +region is in that matrix, either endpoint works. Otherwise the `bedrock-runtime` CRIS path (`us.openai.gpt-5.5` / +`global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`) reaches it, with the same data-residency +caveat as GPT-5.6 (Geo stays within the geography, Global routes anywhere). There is no runtime in-region form. +Only a workload that requires strictly in-region processing in a region outside the mantle matrix falls through: -1. Prefer offering a **region change** to a supported region, if no data-residency constraint pins the workload. - This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. -2. If the region is fixed, also offer **upgrading within the vendor to GPT-5.6** (which reaches the region via - CRIS) alongside the cross-family option — a generation change, but same vendor and prompt idioms. -3. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. +1. Prefer offering a **region change** to a supported mantle region, if no data-residency constraint pins the + workload. This preserves the zero-behavior-delta benefit, which is the whole point of Tier 0. +2. Otherwise fall through to Tier 1 and say why explicitly — a region constraint, not a model judgment. Record the outcome in `regional_warnings[]`. @@ -235,10 +240,11 @@ model on price. ### Open-weight gpt-oss -`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and, unlike the -proprietary GPT models, **do** support `bedrock-runtime` / Converse. They sit a capability class below the GPT-5.x -frontier tier. Recommend them when the user wants OpenAI-architecture models on the Bedrock-native runtime surface -(for Guardrails, invocation logging, or Converse-based tooling) rather than through mantle. +`openai.gpt-oss-120b` (0.15 / 0.60) and `openai.gpt-oss-20b` (0.07 / 0.30) remain available and support +`bedrock-runtime` / Converse with a bare model ID (no CRIS profile needed) and `Invoke`, which the proprietary GPT +models do not. They sit a capability class below the GPT-5.x frontier tier. Recommend them when the user wants +OpenAI-architecture models on the Bedrock-native runtime surface (for Guardrails, invocation logging, or +Converse-based tooling) at the lowest price rather than through mantle. --- @@ -284,7 +290,7 @@ rather than dismissing it. For a long-context (>272K) workload the gap is much w | Chat Completions | Preserve supported Chat when selected | Reshape only for a selected API change; verify the model and endpoint | | Function calling | Supported on GPT-5.x via mantle; Claude tools via Converse | Same-model keeps tool semantics identical | | Reasoning effort | `reasoning={"effort": ...}` on mantle | `none` / `low` / `medium` / `high` / `xhigh` / `max` | -| Prompt caching | GPT-5.6 only (90% off cached input) | Not listed for GPT-5.5 / 5.4; Claude has its own caching | +| Prompt caching | GPT-5.6 (90% off cached input); GPT-5.5 / 5.4 implicit caching on `bedrock-runtime` Responses only | GPT-5.5 / 5.4 cards (read 2026-11-06) list a cache-read rate and implicit caching on runtime, none on mantle; Claude has its own caching | | Streaming | Supported | Verify per surface | | Vision | GPT-5.x (image input) or Claude / Llama 4 | Same-model preserves behavior | | JSON mode | Claude (excellent), Nova Pro (good) | Most models via prompt | @@ -339,11 +345,12 @@ and closed to new customers as of July 30, 2026. ### When to prefer a Bedrock-native model over the mantle GPT path Choose Claude / Nova via Converse when the workload needs Knowledge Bases, intelligent prompt routing, structured -outputs, or application inference profiles — none of which the GPT path offers. Note what no longer forces a family -switch for GPT-5.6: its `bedrock-runtime` CRIS path provides cross-region inference, invocation logs, and -Guardrails (Converse API only; prompt caching is Responses-only on runtime). For GPT-5.5 / GPT-5.4, Guardrails, -logging, and cross-region reach still require a different model. The mantle GPT path is the smallest change; the -Bedrock-native path remains the most feature-complete. +outputs, or application inference profiles — none of which the mantle GPT path offers. Note what no longer forces +a family switch for GPT-5.6, GPT-5.5 and GPT-5.4: their `bedrock-runtime` CRIS paths provide cross-region +inference, invocation logs, Guardrails and application inference profiles (both Converse API only), and +structured outputs and implicit prompt caching (both Responses API only) — per the GPT-5.4 / GPT-5.5 model cards +read 2026-11-06. Knowledge Bases and intelligent prompt routing still require a Bedrock-native model. The mantle +GPT path is the smallest change; the Bedrock-native path remains the most feature-complete. ### High-spend tiering @@ -364,8 +371,8 @@ alternative, not against the source provider. cheaper and exempt from the input-TPM quota, which relieves the binding constraint on mantle. **Very high (>100M tokens/day):** tiering plus caching. Check TPM headroom per model per region early; there is no -RPM quota and no `bedrock-runtime` fallback for GPT models, so quota increases are the scaling lever. See -`shared/ai-migration-guardrails.md`. +RPM quota, and the `bedrock-runtime` CRIS path for GPT-5.6 / 5.5 / 5.4 / GPT-6 carries its own quotas rather than +adding headroom to mantle, so quota increases are the scaling lever. See `shared/ai-migration-guardrails.md`. --- diff --git a/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md index 18266733c..a4206583c 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle only; no 1M tier) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle only; no 1M tier) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 11.00/49.50; card read 2026-11-06) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 5.50/24.75; card read 2026-11-06) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | @@ -353,17 +353,24 @@ Regions (mantle): us-east-1 / us-east-2 for all five; us-west-2 additionally car | GPT-5.5 | 5.50 | 33.00 | — | 0.55 | | GPT-5.4 | 2.75 | 16.50 | — | 0.275 | -#### Long context (1M) — GPT-5.6 only, 2.0x input / 1.5x output - -| Model | Input $/1M | Output $/1M | -| ------------- | ---------- | ----------- | -| GPT-5.6 Sol | 8.80 | 33.00 | -| GPT-5.6 Terra | 4.40 | 19.80 | -| GPT-5.6 Luna | 0.44 | 1.98 | - -A workload above 272K context must be priced at the long-context tier. GPT-5.5 and GPT-5.4 have no such tier, so -their usable window is 272K. Global CRIS is published at OpenAI's standard list price (cost parity, GPT-5.6 only — -see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. +#### Long context (>272K input tokens) — GPT-5.6 at 2.0x input / 1.5x output; GPT-5.5 / GPT-5.4 per their model cards + +| Model | Input $/1M | Output $/1M | Cache read $/1M | +| ------------- | ---------- | ----------- | --------------- | +| GPT-5.6 Sol | 8.80 | 33.00 | — | +| GPT-5.6 Terra | 4.40 | 19.80 | — | +| GPT-5.6 Luna | 0.44 | 1.98 | — | +| GPT-5.5 | 11.00 | 49.50 | 1.10 | +| GPT-5.4 | 5.50 | 24.75 | 0.55 | + +A workload above 272K input tokens must be priced at the long-context tier, applied to all input and output tokens +of the request. GPT-5.5 and GPT-5.4 rows read from their model cards on 2026-11-06 +([GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), +[GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)); both cards state a +1,050,000-token context window (128,000 max output) and list `us.`/`global.` CRIS ids on `bedrock-runtime`, but +publish the In-Region inference option only. Global CRIS is published at OpenAI's standard list price (cost parity, +GPT-5.6 only — see `openai-on-bedrock.md`). GovCloud (US-West) GPT-5.4 short-context is 3.375 / 20.25 (cache read +0.3375) per the 2026-11-06 card; an earlier revision recorded 3.30 / 19.80. > **One source conflict.** These models are absent > from the AWS Price List API entirely: querying `AmazonBedrock` returns only `gpt-oss` and GPT OSS Safeguard, and @@ -373,7 +380,8 @@ see `openai-on-bedrock.md`). GovCloud GPT-5.4 is 3.30 / 19.80. **Prompt caching (GPT-5.6 only):** cached input read at a 90% discount, cache write at 1.25x uncached input, minimum 1,024-token prefix, up to 4 breakpoints, ≥30-minute retention. Cached input is exempt from the input-TPM quota. -GPT-5.5 and GPT-5.4 do not list prompt caching support. +GPT-5.5 and GPT-5.4 list only implicit prompt caching on `bedrock-runtime` Responses (automatic, no request +parameters; cache-read rate above, no cache-write rate) and none on mantle (model cards read 2026-11-06). #### Open-weight gpt-oss diff --git a/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json b/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json index a6bb34385..bed2a584b 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json +++ b/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json @@ -3,8 +3,8 @@ "provider": "openai", "verified_at": "2026-09-24", "verified_region": "us-east-2", - "source": "Opus 5.5 cross-family target: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-5-5.html (retrieved 2026-09-24). OpenAI and other unchanged entries retain their evidence from the superseded 2026-08-21 catalog (removed; see git history).", - "disclaimer": "The Opus cross-family target is updated to Opus 5.5; same-model OpenAI paths and their earlier evidence remain unchanged. This is a migration target catalog, not an account-availability claim. Verify the chosen model, API, region and CRIS profile before implementation. Opus 5.5 uses CRIS on runtime outside eu-west-2, has 1M context/128K output, always-on adaptive thinking, and no Batch tier. Fable and Mythos remain excluded from default selection. Opus 5.5 is the only Opus model in the automatic selection pool; older Opus snapshots and pricing records are historical references. The runtime in-region exception in eu-west-2 was verified 2026-10-03; the original catalog and other model evidence dates remain unchanged.", + "source": "Opus 5.5 cross-family target: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-5-5.html (retrieved 2026-09-24). GPT-5.5 and GPT-5.4 rows re-read from their public model cards on 2026-11-06 (https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html, https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html): both now list bedrock-runtime (Responses, Chat Completions, Converse via us./global. CRIS ids) and Chat Completions on bedrock-mantle. Other OpenAI entries retain their evidence from the superseded 2026-08-21 catalog (removed; see git history).", + "disclaimer": "The Opus cross-family target is updated to Opus 5.5; the GPT-5.5 and GPT-5.4 entries were re-read from their public model cards on 2026-11-06 (runtime CRIS paths, Chat Completions on mantle, 1.05M context, long-context pricing); the other same-model OpenAI paths and their earlier evidence remain unchanged. This is a migration target catalog, not an account-availability claim. Verify the chosen model, API, region and CRIS profile before implementation. Opus 5.5 uses CRIS on runtime outside eu-west-2, has 1M context/128K output, always-on adaptive thinking, and no Batch tier. Fable and Mythos remain excluded from default selection. Opus 5.5 is the only Opus model in the automatic selection pool; older Opus snapshots and pricing records are historical references. The runtime in-region exception in eu-west-2 was verified 2026-10-03; the original catalog and other model evidence dates remain unchanged.", "paths": { "mantle_openai_responses": { "sdk": "openai", @@ -19,8 +19,8 @@ "GPT-5.x on Bedrock Mantle is served through the Responses API" ], "constraints": [ - "Mantle itself has no cross-region form for any GPT model (in-region only); for GPT-5.6 the bedrock-runtime CRIS path covers additional regions instead (see runtime_converse)", - "GPT-5.x on Mantle rejects Chat Completions; a Chat Completions source must reshape to Responses (reference-verified on gpt-5.4; the 5.6 cards list Chat Completions as a supported API but its mantle-side availability is unprobed — verify in the target account)", + "Mantle itself has no cross-region form for any GPT model (in-region only); for GPT-5.6, GPT-5.5 and GPT-5.4 the bedrock-runtime CRIS path covers additional regions instead (see runtime_converse)", + "Chat Completions support on Mantle is model-specific: the GPT-5.4 and GPT-5.5 model cards list Chat Completions as supported on bedrock-mantle (read 2026-11-06); the GPT-5.6 Sol card does not. A Chat Completions source reshapes to Responses only when the selected model's card does not list Chat Completions — verify in the target account", "Availability must be probed in the target account and region" ] }, @@ -36,7 +36,7 @@ "OpenAI-compatible Chat Completions surface for models that accept it" ], "constraints": [ - "Not available for the GPT-5.x models listed here: rejected on gpt-5.4 (internal reference probe) and unsupported on the gpt-5.6-sol model card", + "Model-specific: listed as supported on bedrock-mantle by the GPT-5.4 and GPT-5.5 model cards (https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html, https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html, read 2026-11-06) and by the GPT-6 cards; unsupported on the gpt-5.6-sol model card. Uses /openai/v1/chat/completions", "Availability and model support must be probed in the target account and region" ] }, @@ -51,10 +51,10 @@ "strengths": [ "Bedrock-native multi-model request surface", "Supports Bedrock Guardrails (Converse API only), invocation logging, and CloudWatch", - "For GPT-5.6 this is a SAME-MODEL governance path via CRIS (us./in./global. ids; base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs); the model cards recommend runtime for new applications, and Global CRIS is priced at OpenAI's standard rate (cost parity)" + "For GPT-5.6, GPT-5.5 and GPT-5.4 this is a SAME-MODEL governance path via CRIS (us./in./global. ids; base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs); the model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" ], "constraints": [ - "GPT-5.5 / GPT-5.4 have NO runtime path — a Converse target for them means a Bedrock-native model and a boto3 rewrite of the OpenAI integration", + "GPT-5.5 / GPT-5.4 on runtime are CRIS-only (us. and global. ids; no in-region form) per their model cards (read 2026-11-06); the cards publish In-Region (1.10x) pricing only, so do not assume Global CRIS price parity for them", "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. Runtime does not support server-side tool use, structured outputs, or application inference profiles for these models; prompt caching is Responses-only", "Bedrock-native models generally require a Global or geography-scoped CRIS inference profile", "Availability must be probed in the target account and region" @@ -111,19 +111,47 @@ "generation": "reasoning", "version": "5.5", "class": "reasoning", - "context_window": 272000, - "output_token_ceiling": "unknown", + "context_window": 1050000, + "output_token_ceiling": 128000, + "inference_profiles": { + "us": ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "ca-central-1", "ca-west-1"], + "global": ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "ca-central-1", "ca-west-1", "mx-central-1", "eu-central-1", "eu-central-2", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-2", "eu-west-3", "ap-east-2", "ap-northeast-1", "ap-northeast-2", "ap-northeast-3", "ap-south-1", "ap-south-2", "ap-southeast-1", "ap-southeast-2", "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", "ap-southeast-6", "ap-southeast-7", "il-central-1", "me-central-1", "me-south-1", "af-south-1", "sa-east-1"] + }, + "region_availability": { + "commercial": ["us-east-1", "us-east-2"], + "govcloud": [], + "evidence": "bedrock-mantle in-region rows of the GPT-5.5 model card, read 2026-11-06: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html" + }, + "pricing": { + "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html (read 2026-11-06); USD per 1M tokens, Standard tier; the card lists the In-Region inference option only", + "commercial_short_context_le_272k": {"input": 5.50, "cache_read": 0.55, "output": 33.00}, + "commercial_long_context_gt_272k": {"input": 11.00, "cache_read": 1.10, "output": 49.50}, + "service_tiers": {"standard": true, "priority": false, "flex": false, "reserved": false} + }, "capabilities": [ "reasoning", - "tool_or_function_calling" + "tool_or_function_calling", + "image_input_vision" ], - "capability_source": "AWS model card 2026-07-21 (launch 2026-06-01, Active): advanced coding/agentic tasks; tool calling via the Responses API's built-in tool use. Feature-level Mantle behavior not probed — verify before relying. Re-verified 2026-08-21: still mantle-only, in-region only; no CRIS, no runtime path, no long-context tier.", + "capability_source": "AWS model card https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html (read 2026-11-06; launch 2026-06-01, Active, EOL no sooner than 2027-06-01): text+image input, text output; 1,050,000-token context shared between input and output, 128,000 max output. Mantle lists server-side and client-side tool calling; runtime lists invocation logs, streaming, Guardrails (Converse only), application inference profiles (Converse only), implicit prompt caching (Responses only), structured outputs (Responses) and reasoning summaries; server-side tool use is unsupported on runtime. Documentation claims, not account probes — verify before relying.", "paths": { "mantle_openai_responses": { "available": true, "model_id": "openai.gpt-5.5", "requires_cris": false, - "evidence": "AWS model card model-card-openai-gpt-55 (2026-07-21): bedrock-mantle Programmatic Access with Responses sample code; Geo/Global inference not supported" + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): bedrock-mantle supports Responses at /openai/v1/responses; in-region us-east-1 and us-east-2 only; Geo/Global not supported on mantle" + }, + "mantle_openai_chat": { + "available": true, + "model_id": "openai.gpt-5.5", + "requires_cris": false, + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): Chat Completions listed as supported on bedrock-mantle at /openai/v1/chat/completions, with sample code" + }, + "runtime_converse": { + "available": true, + "model_id": "openai.gpt-5.5", + "requires_cris": true, + "evidence": "AWS model card model-card-openai-gpt-55 (read 2026-11-06): bedrock-runtime supported with Responses, Chat Completions and Converse (Messages and Invoke unsupported); no in-region form — requests must name us.openai.gpt-5.5 (Geo) or global.openai.gpt-5.5 (Global); base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs" } } }, @@ -213,27 +241,50 @@ "generation": "reasoning", "version": "5.4", "class": "reasoning", - "context_window": "unknown", - "output_token_ceiling": "unknown", + "context_window": 1050000, + "output_token_ceiling": 128000, + "inference_profiles": { + "us": ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "ca-central-1", "ca-west-1"], + "global": ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "ca-central-1", "ca-west-1", "mx-central-1", "eu-central-1", "eu-central-2", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-2", "eu-west-3", "ap-east-2", "ap-northeast-1", "ap-northeast-2", "ap-northeast-3", "ap-south-1", "ap-south-2", "ap-southeast-1", "ap-southeast-2", "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", "ap-southeast-6", "ap-southeast-7", "il-central-1", "me-central-1", "me-south-1", "af-south-1", "sa-east-1"] + }, + "region_availability": { + "commercial": ["us-east-1", "us-east-2", "us-west-2"], + "govcloud": ["us-gov-west-1"], + "evidence": "bedrock-mantle in-region rows of the GPT-5.4 model card, read 2026-11-06: https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html" + }, + "pricing": { + "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html (read 2026-11-06); USD per 1M tokens, Standard tier; the card lists the In-Region inference option only", + "commercial_short_context_le_272k": {"input": 2.75, "cache_read": 0.275, "output": 16.50}, + "commercial_long_context_gt_272k": {"input": 5.50, "cache_read": 0.55, "output": 24.75}, + "govcloud_us_west_short_context_le_272k": {"input": 3.375, "cache_read": 0.3375, "output": 20.25}, + "service_tiers": {"standard": true, "priority": false, "flex": false, "reserved": false} + }, "capabilities": [ "tool_or_function_calling", "structured_output_json", "reasoning", - "streaming" + "streaming", + "image_input_vision" ], - "capability_source": "internal reference smoke tests and its reasoning-API migration notebook (Responses path, 2026-06 probes) — the only entry with feature-level Mantle behavior probes (tools, structured output, sampling); limits not stated Re-verified 2026-08-21: still mantle-only, in-region only; no CRIS, no runtime path, no long-context tier.", + "capability_source": "AWS model card https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html (read 2026-11-06; launch 2026-06-01, Active, EOL no sooner than 2027-06-01): text+image input, text output; 1,050,000-token context shared between input and output, 128,000 max output. Mantle lists server-side and client-side tool calling; runtime lists invocation logs, response streaming, Guardrails (Converse only), application inference profiles (Converse only), implicit prompt caching (Responses only), structured outputs (JSON Schema; Responses API) and reasoning summaries; server-side tool use is unsupported on runtime. Documentation claims, not account probes — verify before relying.", "paths": { "mantle_openai_responses": { "available": true, "model_id": "openai.gpt-5.4", "requires_cris": false, - "evidence": "internal reference smoke-test default Mantle model id; client.responses.create verified live" + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): bedrock-mantle supports Responses at /openai/v1/responses; in-region us-east-1, us-east-2, us-west-2 and us-gov-west-1; Geo/Global not supported on mantle" }, "mantle_openai_chat": { - "available": false, + "available": true, "model_id": "openai.gpt-5.4", "requires_cris": false, - "evidence": "internal reference verified gotcha: GPT-5.x on Mantle is Responses-only; Chat Completions rejected" + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): Chat Completions listed as supported on bedrock-mantle at /openai/v1/chat/completions, with sample code" + }, + "runtime_converse": { + "available": true, + "model_id": "openai.gpt-5.4", + "requires_cris": true, + "evidence": "AWS model card model-card-openai-gpt-54 (read 2026-11-06): bedrock-runtime supported with Responses, Chat Completions and Converse (Messages and Invoke unsupported); no in-region form — requests must name us.openai.gpt-5.4 (Geo) or global.openai.gpt-5.4 (Global); base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs" } } }, diff --git a/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md index cdf8ced55..7720d4b58 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md @@ -190,12 +190,18 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` ## migration_path vocabulary `mantle_openai_responses` (an OpenAI-protocol source — direct or Azure-fronted — with the model -on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `converse` -(Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when a proprietary GPT -model must move off mantle for Guardrails / Knowledge Bases / logging / an unsupported region) · -`gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic -Bedrock SDK swap). A proprietary `openai.gpt-*` model ID is NEVER paired with a -`converse`/`bedrock-runtime` path — those models are mantle-only. +on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` +(same, preserving a Chat Completions source on a model whose card lists Chat Completions on +mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via +`bedrock-runtime` with a `us.`/`in.`/`global.` CRIS id, `model_change: false`; available for +GPT-6, GPT-5.6, GPT-5.5 and GPT-5.4 per their model cards) · `converse` (Bedrock-native +Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, +intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` +(OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK +swap). A **bare** proprietary `openai.gpt-*` model ID is NEVER paired with a +`converse`/`bedrock-runtime` path — bare ids are mantle ids; every proprietary GPT target on +`bedrock-runtime` carries a CRIS-prefixed id (there is no runtime in-region form for GPT-6, +GPT-5.6, GPT-5.5 or GPT-5.4). ## regional_validation @@ -255,8 +261,9 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `price_comparison`. - [ ] `honest_assessment` overall is the weakest across `bedrock_models[]`; if `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. -- [ ] No `bedrock_models[]` entry pairs a proprietary `openai.gpt-*` model ID with a - `converse`/`bedrock-runtime` migration path (mantle-only). +- [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a + `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` + target for GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 carries a `us.`/`in.`/`global.` CRIS id). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/tests/test_gpt6_review_round2.py b/plugins/aws-startup-advisor/tests/test_gpt6_review_round2.py index 7af115742..2309b54cb 100644 --- a/plugins/aws-startup-advisor/tests/test_gpt6_review_round2.py +++ b/plugins/aws-startup-advisor/tests/test_gpt6_review_round2.py @@ -70,15 +70,25 @@ def test_both_estimate_ai_files_require_matching_context_tiers() -> None: # --- Finding 2: runtime_openai_cris gate/dispatch --- -def test_design_ai_scopes_mantle_only_to_gpt55_gpt54() -> None: +def test_design_ai_gives_gpt55_gpt54_the_runtime_cris_path() -> None: + # GPT-5.5 / GPT-5.4 model cards (read 2026-11-06) list us./global. CRIS ids on + # bedrock-runtime, so the runtime_openai_cris carve-out must name them alongside + # GPT-6/5.6 and the old "mantle-only, no CRIS" scoping must be gone. for f in DESIGN_AI_FILES: - text = f.read_text(encoding="utf-8") + text = re.sub(r"\s+", " ", f.read_text(encoding="utf-8")) assert "runtime_openai_cris" in text, ( - f"{f}: no runtime_openai_cris carve-out for GPT-6/5.6 (Finding 2)" + f"{f}: no runtime_openai_cris carve-out (Finding 2)" ) assert "GPT-5.5" in text and "GPT-5.4" in text, ( - f"{f}: mantle-only scoping must name GPT-5.5/GPT-5.4 specifically (Finding 2)" + f"{f}: the runtime_openai_cris rule must name GPT-5.5/GPT-5.4 specifically" + ) + assert "us.openai.gpt-5.5" in text and "us.openai.gpt-5.4" in text, ( + f"{f}: must record the GPT-5.5/GPT-5.4 us. CRIS ids" ) + assert "GPT-5.5 and GPT-5.4 are mantle-only" not in text + assert "GPT-5.5 and GPT-5.4 are `bedrock-mantle` only" not in text + assert "no CRIS" not in text + assert "No Converse fallback for GPT-5.5/GPT-5.4" not in text def test_generate_artifacts_ai_dispatches_runtime_openai_cris() -> None: @@ -102,9 +112,16 @@ def test_schema_design_aws_ai_vocabulary_includes_runtime_openai_cris() -> None: "schema-design-aws-ai.md: migration_path vocabulary missing runtime_openai_cris (Finding 2)" ) assert "GPT-5.5" in text and "GPT-5.4" in text, ( - "schema-design-aws-ai.md: mantle-only scoping must name GPT-5.5/GPT-5.4 specifically, " - "not blanket 'proprietary GPT' (Finding 2)" + "schema-design-aws-ai.md: runtime_openai_cris vocabulary must name GPT-5.5/GPT-5.4 " + "specifically, not blanket 'proprietary GPT' (Finding 2)" ) + # The ban is on BARE proprietary GPT ids paired with converse/bedrock-runtime, + # not on the GPT-5.5/GPT-5.4 models — their cards list us./global. CRIS ids. + normalized = re.sub(r"\s+", " ", text) + assert "those models are mantle-only" not in normalized + assert "mantle-only, no CRIS" not in normalized + assert "**bare** proprietary `openai.gpt-*`" in normalized + assert "us.openai.gpt-5.5" in normalized or "GPT-5.5 / GPT-5.4 runtime support" in normalized # --- Finding 3: Astra Invoke-support correction --- diff --git a/plugins/aws-startup-advisor/tests/test_gpt6_review_round5.py b/plugins/aws-startup-advisor/tests/test_gpt6_review_round5.py index c73b08235..187601bd6 100644 --- a/plugins/aws-startup-advisor/tests/test_gpt6_review_round5.py +++ b/plugins/aws-startup-advisor/tests/test_gpt6_review_round5.py @@ -114,6 +114,12 @@ def test_behavior_delta_no_longer_claims_chat_completions_unverified() -> None: assert "OPTIONAL" in text, ( "openai-to-bedrock.md must make the Responses reshape optional, not mandatory" ) + # GPT-5.5 / GPT-5.4 model cards (read 2026-11-06) list Chat Completions on both + # bedrock-mantle and bedrock-runtime — the reshape is optional for them too. + assert "GPT-5.5 / GPT-5.4 follow the same rule" in text + assert "model-card-openai-gpt-54.html" in text and "model-card-openai-gpt-55.html" in text + assert "mantle-only, no CRIS" not in text + assert "still unconfirmed" not in text def test_both_design_ai_no_longer_force_gpt6_chat_completions_reshape() -> None: @@ -122,12 +128,17 @@ def test_both_design_ai_no_longer_force_gpt6_chat_completions_reshape() -> None: assert "near-drop-in" in text.lower() or "optional" in text.lower(), ( f"{f}: a GPT-6/GPT-5.6 Chat Completions source must not be forced to reshape" ) - assert "GPT-5.5" in text and "GPT-5.4" in text, ( - f"{f}: the mandatory-reshape exception must still be scoped to GPT-5.5/GPT-5.4" + assert "GPT-5.5 and GPT-5.4 follow the same rule" in text, ( + f"{f}: GPT-5.5/GPT-5.4 Chat Completions is listed on both endpoints (cards read " + "2026-11-06); they must not be the mandatory-reshape exception" ) + assert "GPT-5.5 and GPT-5.4 are the exception" not in text + assert "unconfirmed" not in text def test_gcp_generate_ai_no_longer_forces_gpt6_chat_completions_reshape() -> None: text = _norm(GCP_GENERATE_AI_MD.read_text(encoding="utf-8")) assert "optional" in text.lower() - assert "GPT-5.5" in text and "GPT-5.4" in text + assert "GPT-5.5/GPT-5.4 follow the same rule" in text + assert "still need a reshape" not in text + assert "unconfirmed" not in text diff --git a/plugins/aws-startup-advisor/tests/test_gpt6_round4_findings.py b/plugins/aws-startup-advisor/tests/test_gpt6_round4_findings.py index f375e2ef2..46e2ac3a8 100644 --- a/plugins/aws-startup-advisor/tests/test_gpt6_round4_findings.py +++ b/plugins/aws-startup-advisor/tests/test_gpt6_round4_findings.py @@ -2,8 +2,9 @@ GPT-6 recognition, report pricing bugs). Finding 0 — runtime_openai_cris carve-out gaps: - (a) Azure design.md / generate.md _assert blocks must scope the GPT-ban to - GPT-5.5/GPT-5.4 and explicitly carve out GPT-5.6/GPT-6 on runtime_openai_cris. + (a) Azure design.md / generate.md _assert blocks must scope the GPT-ban to BARE + proprietary ids and explicitly carve out GPT-5.6/GPT-6 — and, since the + 2026-11-06 model-card re-read, GPT-5.5/GPT-5.4 — on runtime_openai_cris. (b) GCP generate-ai.md Part 1 must route runtime_openai_cris through bedrock-runtime, not the mantle URL/IAM. (c) Canonical model-selection guide + vendored guardrails must name the full @@ -79,21 +80,30 @@ def _norm(text: str) -> str: # --- Finding 0.1: Azure design.md / generate.md assert carve-out --- -def test_azure_design_assert_scopes_gpt_ban_to_55_54_and_carves_out_cris() -> None: +def test_azure_design_assert_scopes_gpt_ban_to_bare_ids_and_carves_out_cris() -> None: + # GPT-5.5 / GPT-5.4 model cards (read 2026-11-06) list us./global. CRIS ids on + # bedrock-runtime, so the ban is on BARE proprietary ids paired with + # converse/bedrock-runtime — not on the GPT-5.5/GPT-5.4 models themselves. text = _norm(AZURE_DESIGN_MD.read_text(encoding="utf-8")) - assert "no proprietary GPT-5.5 or GPT-5.4 model ID is paired" in text, ( - "design.md _assert must scope the ban to GPT-5.5/GPT-5.4, not blanket 'openai.gpt-*'" + assert "no bare proprietary openai.gpt-* model ID (including bare openai.gpt-5.5 or openai.gpt-5.4) is paired" in text, ( + "design.md _assert must ban bare proprietary ids on converse/bedrock-runtime, " + "naming bare openai.gpt-5.5/openai.gpt-5.4 explicitly" ) - assert "runtime_openai_cris on bedrock-runtime — this is not a violation" in text + assert "GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation" in text + assert "GPT-5.5/GPT-5.4 us./global. profiles" in text + assert "no proprietary GPT-5.5 or GPT-5.4 model ID is paired" not in text assert "no proprietary openai.gpt-* model ID is paired" not in text -def test_azure_generate_assert_scopes_gpt_ban_to_55_54_and_carves_out_cris() -> None: +def test_azure_generate_assert_scopes_gpt_ban_to_bare_ids_and_carves_out_cris() -> None: text = _norm(AZURE_GENERATE_MD.read_text(encoding="utf-8")) - assert "no proprietary GPT-5.5 or GPT-5.4 model ID is paired" in text, ( - "generate.md _assert must scope the ban to GPT-5.5/GPT-5.4, not blanket 'openai.gpt-*'" + assert "no bare proprietary openai.gpt-* model ID (including bare openai.gpt-5.5 or openai.gpt-5.4) is paired" in text, ( + "generate.md _assert must ban bare proprietary ids on converse/bedrock-runtime, " + "naming bare openai.gpt-5.5/openai.gpt-5.4 explicitly" ) - assert "runtime_openai_cris on bedrock-runtime — this is not a violation" in text + assert "GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 models MAY use migration_path: runtime_openai_cris on bedrock-runtime — this is not a violation" in text + assert "GPT-5.5/GPT-5.4 us./global. profiles" in text + assert "no proprietary GPT-5.5 or GPT-5.4 model ID is paired" not in text assert "no proprietary openai.gpt-* model ID is paired" not in text From e72d05df801a77c7a8987b708e304d98713b51fa Mon Sep 17 00:00:00 2001 From: Logan Kleier Date: Fri, 6 Nov 2026 23:35:29 -0800 Subject: [PATCH 2/7] fix(aws-startup-advisor): pin and disclose the GPT-6 Chat fallback shift caused by the GPT-5.4/5.5 catalog facts Review round 1 (CHANGES_REQUESTED, 2 blockers) on c1944a53. Finding 1: recording the public GPT-5.5/GPT-5.4 facts in skills/shared/ai/models/openai-bedrock.json (mantle_openai_chat available, region_availability) changes agent-advisor recommendations through the unchanged catalog-order fallback in openai_model_recommendation.py (_mantle_candidate_order -> _catalog_model_for_path): GPT-5.5 and GPT-5.4 precede GPT-6 Astra in catalog key order, so a GPT-6 Sol / 6.1 Sol Chat Completions source outside us-east-1 now lands on - openai.gpt-5.5 via mantle_openai_chat in us-east-2 (base: decision_required, mantle_region_unavailable, options mantle chat / runtime_converse) - openai.gpt-5.4 via mantle_openai_chat in us-west-2 (base: openai.gpt-6-astra) and a GPT-5.6 Sol Responses source in us-west-2 lands on openai.gpt-5.6-terra (base: openai.gpt-5.5, whose cataloged footprint is us-east-1/us-east-2 only). The previous commit message called this PR "no behavior change"; that was wrong for these cells. The catalog facts are kept (they are what the public cards state); the engine ordering is NOT changed in this PR. Instead: - skills/agent-advisor/scripts/test_openai_model_recommendation.py: new regression tests pin all five cells so the shift is deliberate and visible (test_gpt6_chat_outside_own_footprint_falls_back_to_in_region_gpt5_chat x4, test_gpt56_sol_responses_outside_us_east_skips_gpt55_for_in_region_terra). - skills/agent-advisor/references/phases/model-recommend/model-recommend.md: the engine-limitation paragraph now states that Chat fallbacks walk catalog order, that GPT-5.5/5.4 precede GPT-6 Astra, and that a GPT-6 Chat source outside us-east-1 lands on GPT-5.5 (us-east-2) / GPT-5.4 (us-west-2); a newer-generation source falling back to an older-generation model is an engine ordering limitation to resolve in the follow-up selection PR (PR 2). Finding 2: skills/agent-advisor/scripts/openai_model_recommendation.py:118-119 still said "the (Mantle-only) GPT-5.x family". Reworded to the engine fact (GPT-5.x sources not recognized as same-model runtime identities map to Claude tiers; GPT-5.5/5.4 do carry a cataloged runtime_converse path via us./global. CRIS ids). Grep over plugins/ for mantle-only / "no CRIS" / "no inference profile" / unconfirmed / "internal reference" near GPT-5.4/5.5/5.x is now clean apart from negative test assertions, the GovCloud Opus 5.5 pricing row, and the bare-id rule ("bare proprietary openai.gpt-* IDs use Mantle only"). Carry-forward for PR 2 (endpoint selection): reorder / tier the mantle_openai_chat candidate walk so a GPT-6 source does not fall back to GPT-5.4/5.5 ahead of GPT-6 Astra; add GPT-5.5/5.4 to _SOURCE_MODEL_KEYS so they are recognized as same-model runtime identities. No new behavior added; no dispatch or endpoint-selection code changed. No vendored files affected (none of the three files is in the sync manifest); lint:vendored-parity re-run and still 62/62 byte-identical. Sources (public model cards, read 2026-11-06 via the AWS Documentation MCP tools): - https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html - https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html Validation (run from the worktree with mise Python 3.12): - mise -C plugins/aws-startup-advisor run ci: PASS - lint:md 0 errors; lint:model-id OK (19 retired IDs enforced); lint:model-staleness fresh (4d old, 45d window); lint:model-catalog-drift OK (3 pre-existing warnings, unrelated); lint:startup-model-pricing OK; lint:artifacts PASS (99 checked, 0 errors); lint:vendored-parity PASS (62 files byte-identical); lint:skill-refs PASS (1482 checked, 0 missing); lint:consent-disclosure OK (6 checked); test: 1395 passed, 222 subtests passed; test:telemetry 311 passed; test:heroku-source-review 44 pass, 0 fail - agent-advisor pytest (skills/agent-advisor/scripts): 569 passed, 0 failed (564 at c1944a53 + 5 new) - llm-to-bedrock pytest (skills/llm-to-bedrock/scripts): 418 passed, 0 failed - root: python3 tools/validate.py "All validations passed"; mise run lint:md 0 issues / 2763 files; lint:manifests, lint:spec, lint:skill-parity pass; test:tools OK. mise run build's security step still fails only on the pre-existing gitleaks finding in upstream commit f8d09fd1 (tests/test_bedrock_migration_assessment_discover.py:118); gitleaks protect --staged over this change set: no leaks found. Base: 0a218f8cc13220013f72147e2e0fdbe350b34ae2 (upstream/main) --- .../phases/model-recommend/model-recommend.md | 9 +++- .../scripts/openai_model_recommendation.py | 5 +- .../test_openai_model_recommendation.py | 51 +++++++++++++++++++ 3 files changed, 63 insertions(+), 2 deletions(-) diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md b/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md index c418842ed..013ceaf50 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md +++ b/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/model-recommend/model-recommend.md @@ -104,7 +104,14 @@ use `mantle_openai_responses`. Both Mantle paths are in-region only and enforce the selected model's cataloged `region_availability`: Astra reaches us-east-1 and us-west-2, while Sol, Luna, and 6.1 Sol reach us-east-1 only. Outside that footprint, the engine skips the same-model Mantle candidate and evaluates its existing capability/numeric -fallbacks. Governance requirements select the exact same GPT-5.6 or GPT-6 model through +fallbacks. Those fallbacks walk candidates in catalog order, and GPT-5.5 and GPT-5.4 (both +cataloged with Chat Completions on Mantle; GPT-5.5 reaches us-east-1/us-east-2, GPT-5.4 reaches +us-east-1/us-east-2/us-west-2 and us-gov-west-1) precede GPT-6 Astra in that order. A GPT-6 Sol or +6.1 Sol Chat Completions source outside us-east-1 therefore lands on GPT-5.5 in us-east-2 or GPT-5.4 +in us-west-2 through `mantle_openai_chat`, not on Astra. That is a current engine ordering +limitation (a newer-generation source falls back to an older-generation model); treat such a +recommendation as a prompt for the Chat-vs-Converse decision, not as a model endorsement. +Governance requirements select the exact same GPT-5.6 or GPT-6 model through `runtime_converse` only when the requested Global or geography-scoped CRIS profile is cataloged for that model and source region; an unsupported profile falls through to an eligible documented runtime candidate or remains an explicit decision. GPT-5.5/5.4 also carry a cataloged diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py index e3b1a07e0..47aeed856 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py +++ b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/openai_model_recommendation.py @@ -116,7 +116,10 @@ def _delta(code, category, description): # Converse tier map: a governance workload keeps its capability tier when moving -# from the (Mantle-only) GPT-5.x family to Claude on runtime Converse. +# from a GPT-5.x source the engine does not recognize as a same-model runtime +# identity (see _SOURCE_MODEL_KEYS) to Claude on runtime Converse. This is an +# engine recognition gap, not an endpoint fact: GPT-5.5 and GPT-5.4 do carry a +# cataloged runtime_converse path via us./global. CRIS ids. # GPT-5.6 Sol (frontier) -> Claude Opus 5.5 # GPT-5.6 Terra / 5.5 / 5.4 -> Claude Sonnet 5 (also the default tier) # GPT-5.6 Luna (fast/low-cost)-> Claude Haiku 4.5 diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py index 7d22b84a7..0ebb2a29a 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py +++ b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py @@ -308,6 +308,57 @@ def test_gpt6_mantle_skips_exact_model_outside_cataloged_region(): assert "exact same model" not in rec["rationale"][0] +# Deliberate consequence of recording the public GPT-5.5/GPT-5.4 facts (Chat +# Completions available on Mantle, cataloged region_availability): the Mantle Chat +# fallback walks candidates in catalog order, and GPT-5.5 / GPT-5.4 sit ahead of +# GPT-6 Astra in that order. A GPT-6 Sol / 6.1 Sol Chat source outside its own +# footprint therefore lands on GPT-5.5 (us-east-2) or GPT-5.4 (us-west-2) instead +# of Astra / a blocking decision. Pinned here so the shift is visible; reordering +# the candidate walk is engine work tracked for the follow-up PR. +@pytest.mark.parametrize("source_id", ["gpt-6-sol", "gpt-6.1-sol"]) +@pytest.mark.parametrize( + ("region", "fallback_id", "fallback_key"), + [ + ("us-east-2", "openai.gpt-5.5", "openai_gpt_5_5"), + ("us-west-2", "openai.gpt-5.4", "openai_gpt_5_4"), + ], +) +def test_gpt6_chat_outside_own_footprint_falls_back_to_in_region_gpt5_chat( + source_id, region, fallback_id, fallback_key +): + rec = _recommend( + _workload( + source={"model_ids": [source_id], "api_surface": "chat_completions"}, + requirements={"api_continuity": "required"}, + ), + region=region, + ) + assert rec["decision_status"] == "recommended" + assert rec["primary_model"] == fallback_id + assert rec["api_path"] == "mantle_openai_chat" + assert "mantle_region_unavailable" not in _codes(rec["blocks"]) + assert "chat_completions_to_responses_required" not in _codes(rec["blocks"]) + assert "fallback" in rec["rationale"][0] + assert region in OPENAI_CATALOG["models"][fallback_key]["region_availability"]["commercial"] + + +def test_gpt56_sol_responses_outside_us_east_skips_gpt55_for_in_region_terra(): + # GPT-5.5's cataloged footprint is us-east-1/us-east-2 only, so in us-west-2 + # the Responses fallback now skips it and lands on GPT-5.6 Terra (base + # catalog, with no GPT-5.5 region data, selected GPT-5.5 here). + rec = _recommend( + _workload( + source={"model_ids": ["gpt-5.6-sol"]}, + requirements={"api_continuity": "required"}, + ), + region="us-west-2", + ) + assert rec["decision_status"] == "recommended" + assert rec["primary_model"] == "openai.gpt-5.6-terra" + assert rec["api_path"] == "mantle_openai_responses" + assert "us-west-2" not in OPENAI_CATALOG["models"]["openai_gpt_5_5"]["region_availability"]["commercial"] + + def test_gpt6_chat_outside_every_mantle_footprint_returns_blocking_decision(): workload = _workload( source={"model_ids": ["gpt-6-sol"], "api_surface": "chat_completions"}, From bc51f0cc28406296db46d6ed81ee5941308d486d Mon Sep 17 00:00:00 2001 From: Logan Kleier Date: Sat, 7 Nov 2026 08:52:30 -0800 Subject: [PATCH 3/7] fix(aws-startup-advisor): scope the in. CRIS prefix and runtime feature constraints per model for GPT-5.4/5.5 The GPT-5.4 and GPT-5.5 model cards publish only us. and global. CRIS ids; the in. profile exists for GPT-5.6 only. The runtime_converse path strength and both schema-design vocabulary/checklist lines attached us./in./global. to all three models, contradicting the catalog's own next constraint and openai-on-bedrock.md. Rewritten so in. stays on GPT-5.6 / GPT-6. The GPT-5.6 runtime constraint ("does not support server-side tool use, structured outputs, or application inference profiles") is now scoped to GPT-5.6, and a separate GPT-5.4/5.5 constraint records what their cards mark: server-side tools unsupported; structured outputs and implicit prompt caching Responses-only; Guardrails and application inference profiles Converse-only. Vendored copies re-synced (62 checked, 3 synced). Regression test added. --- .../vendored/ai/models/openai-bedrock.json | 5 +++-- .../test_openai_model_recommendation.py | 18 ++++++++++++++++++ .../references/shared/schema-design-aws-ai.md | 7 ++++--- .../vendored/ai/schema-design-aws-ai.md | 7 ++++--- .../vendored/ai/schema-design-aws-ai.md | 7 ++++--- .../shared/ai/models/openai-bedrock.json | 5 +++-- .../skills/shared/ai/schema-design-aws-ai.md | 7 ++++--- 7 files changed, 40 insertions(+), 16 deletions(-) diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json index bed2a584b..48758f3c9 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json +++ b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json @@ -51,11 +51,12 @@ "strengths": [ "Bedrock-native multi-model request surface", "Supports Bedrock Guardrails (Converse API only), invocation logging, and CloudWatch", - "For GPT-5.6, GPT-5.5 and GPT-5.4 this is a SAME-MODEL governance path via CRIS (us./in./global. ids; base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs); the model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" + "For GPT-5.6 this is a SAME-MODEL governance path via CRIS (us./in./global. ids). For GPT-5.5 and GPT-5.4 the runtime ids are us. and global. only (their model cards publish no in. profile). The base URL for the OpenAI-compatible APIs is bedrock-runtime.{region}.amazonaws.com/openai/v1. The model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" ], "constraints": [ "GPT-5.5 / GPT-5.4 on runtime are CRIS-only (us. and global. ids; no in-region form) per their model cards (read 2026-11-06); the cards publish In-Region (1.10x) pricing only, so do not assume Global CRIS price parity for them", - "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. Runtime does not support server-side tool use, structured outputs, or application inference profiles for these models; prompt caching is Responses-only", + "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. For GPT-5.6, runtime does not support server-side tool use, structured outputs, or application inference profiles; prompt caching is Responses-only", + "GPT-5.5 / GPT-5.4 on runtime (per their model cards, read 2026-11-07): server-side tool use is unsupported; structured outputs and implicit prompt caching are Responses-only; Guardrails and application inference profiles are Converse-only", "Bedrock-native models generally require a Global or geography-scoped CRIS inference profile", "Availability must be probed in the target account and region" ] diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py index 0ebb2a29a..c506f6830 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py +++ b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py @@ -116,6 +116,24 @@ def test_catalog_gpt54_gpt55_record_public_runtime_and_chat_facts(catalog_key, m assert "internal reference" not in model["capability_source"] +def test_runtime_converse_path_text_does_not_grant_in_profile_to_gpt54_gpt55(): + # The GPT-5.4 / GPT-5.5 cards publish only us. and global. CRIS ids; only + # GPT-5.6 has an in. profile. The shared runtime_converse path text must not + # attach the in. prefix to the 5.4/5.5 models, and its feature constraints + # must be stated per model (5.4/5.5 cards list structured outputs on Responses + # and application inference profiles on Converse, which the GPT-5.6 sentence + # denies). + path = OPENAI_CATALOG["paths"]["runtime_converse"] + strengths = "\n".join(path["strengths"]) + constraints = "\n".join(path["constraints"]) + assert "For GPT-5.6, GPT-5.5 and GPT-5.4" not in strengths + assert "GPT-5.5 and GPT-5.4 the runtime ids are us. and global. only" in strengths + assert "For GPT-5.6, runtime does not support server-side tool use" in constraints + assert "GPT-5.5 / GPT-5.4 on runtime" in constraints + assert "structured outputs and implicit prompt caching are Responses-only" in constraints + assert "Guardrails and application inference profiles are Converse-only" in constraints + + def test_chat_completions_case_includes_full_reshape_deltas(): rec = _recommend( _workload( diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md index 36a049656..9d5c929aa 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md @@ -127,8 +127,8 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` lists it there (GPT-6, GPT-5.5, GPT-5.4). `mantle_openai_responses` (Azure OpenAI / OpenAI source, model on Bedrock, region carries it — keep the SDK, `model_change: false`) · `runtime_openai_cris` (GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 -same-model move served via `bedrock-runtime` CRIS, `us.`/`in.`/`global.` prefixed, -`model_change: false`) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set +same-model move served via `bedrock-runtime` CRIS — `us.`/`in.`/`global.` prefixed for GPT-6 / +GPT-5.6, `us.`/`global.` only for GPT-5.5 / GPT-5.4 — `model_change: false`) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, intelligent prompt routing, or another feature the same-model CRIS path itself cannot serve) · `gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK swap). A **bare** @@ -207,7 +207,8 @@ rubric file (`ai.md`, `ai-azure-openai-to-bedrock.md`, or a `vendored/ai/*` ref) - [ ] No `bedrock_models[]` entry pairs a **bare** proprietary GPT id (including bare `openai.gpt-5.5` / `openai.gpt-5.4`) with a `converse`/`bedrock-runtime` migration path. GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on - `bedrock-runtime` with a `us.`/`in.`/`global.` CRIS id — this is NOT a violation. + `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` for GPT-6 / GPT-5.6, `us.`/`global.` + only for GPT-5.5 / GPT-5.4) — this is NOT a violation. - [ ] If `ai_source` is `azure_openai` or `openai`: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md index 7720d4b58..c31359bbc 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md @@ -193,8 +193,8 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` (same, preserving a Chat Completions source on a model whose card lists Chat Completions on mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via -`bedrock-runtime` with a `us.`/`in.`/`global.` CRIS id, `model_change: false`; available for -GPT-6, GPT-5.6, GPT-5.5 and GPT-5.4 per their model cards) · `converse` (Bedrock-native +`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-6 and +GPT-5.6, `us.`/`global.` only for GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK @@ -263,7 +263,8 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. - [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` - target for GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 carries a `us.`/`in.`/`global.` CRIS id). + target carries a CRIS id: `us.`/`in.`/`global.` for GPT-6 / GPT-5.6, `us.`/`global.` only for + GPT-5.5 / GPT-5.4). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md index 7720d4b58..c31359bbc 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md @@ -193,8 +193,8 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` (same, preserving a Chat Completions source on a model whose card lists Chat Completions on mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via -`bedrock-runtime` with a `us.`/`in.`/`global.` CRIS id, `model_change: false`; available for -GPT-6, GPT-5.6, GPT-5.5 and GPT-5.4 per their model cards) · `converse` (Bedrock-native +`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-6 and +GPT-5.6, `us.`/`global.` only for GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK @@ -263,7 +263,8 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. - [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` - target for GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 carries a `us.`/`in.`/`global.` CRIS id). + target carries a CRIS id: `us.`/`in.`/`global.` for GPT-6 / GPT-5.6, `us.`/`global.` only for + GPT-5.5 / GPT-5.4). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json b/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json index bed2a584b..48758f3c9 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json +++ b/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json @@ -51,11 +51,12 @@ "strengths": [ "Bedrock-native multi-model request surface", "Supports Bedrock Guardrails (Converse API only), invocation logging, and CloudWatch", - "For GPT-5.6, GPT-5.5 and GPT-5.4 this is a SAME-MODEL governance path via CRIS (us./in./global. ids; base URL bedrock-runtime.{region}.amazonaws.com/openai/v1 for the OpenAI-compatible APIs); the model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" + "For GPT-5.6 this is a SAME-MODEL governance path via CRIS (us./in./global. ids). For GPT-5.5 and GPT-5.4 the runtime ids are us. and global. only (their model cards publish no in. profile). The base URL for the OpenAI-compatible APIs is bedrock-runtime.{region}.amazonaws.com/openai/v1. The model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" ], "constraints": [ "GPT-5.5 / GPT-5.4 on runtime are CRIS-only (us. and global. ids; no in-region form) per their model cards (read 2026-11-06); the cards publish In-Region (1.10x) pricing only, so do not assume Global CRIS price parity for them", - "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. Runtime does not support server-side tool use, structured outputs, or application inference profiles for these models; prompt caching is Responses-only", + "GPT-5.6 on runtime is CRIS-only (no in-region form); Geo CRIS stays within the geography, Global CRIS routes anywhere — pick by data-residency posture. For GPT-5.6, runtime does not support server-side tool use, structured outputs, or application inference profiles; prompt caching is Responses-only", + "GPT-5.5 / GPT-5.4 on runtime (per their model cards, read 2026-11-07): server-side tool use is unsupported; structured outputs and implicit prompt caching are Responses-only; Guardrails and application inference profiles are Converse-only", "Bedrock-native models generally require a Global or geography-scoped CRIS inference profile", "Availability must be probed in the target account and region" ] diff --git a/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md index 7720d4b58..c31359bbc 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md @@ -193,8 +193,8 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` (same, preserving a Chat Completions source on a model whose card lists Chat Completions on mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via -`bedrock-runtime` with a `us.`/`in.`/`global.` CRIS id, `model_change: false`; available for -GPT-6, GPT-5.6, GPT-5.5 and GPT-5.4 per their model cards) · `converse` (Bedrock-native +`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-6 and +GPT-5.6, `us.`/`global.` only for GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK @@ -263,7 +263,8 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. - [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` - target for GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 carries a `us.`/`in.`/`global.` CRIS id). + target carries a CRIS id: `us.`/`in.`/`global.` for GPT-6 / GPT-5.6, `us.`/`global.` only for + GPT-5.5 / GPT-5.4). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. From dfd07bdcd352babffca2e2da32fce5661f06b8df Mon Sep 17 00:00:00 2001 From: Logan Kleier Date: Sat, 7 Nov 2026 09:01:51 -0800 Subject: [PATCH 4/7] fix(aws-startup-advisor): stop granting GPT-5.4/5.5 an in. CRIS id in the rewriter and Design/Generate checklists bc51f0cc scoped the in. prefix to GPT-5.6 in the catalog and schema, but three consumers of that rule still said us./in./global. for GPT-5.4/5.5: agents/llm2bedrock-code-rewriter.md, gcp-to-aws design-ai.md's checklist, and azure-to-aws generate-artifacts-ai.md's checklist. Their model cards publish only us. and global. ids. Each now reads: us./in./global. for GPT-5.6; us./global. only for GPT-6, GPT-5.5 and GPT-5.4. Adds tests/test_gpt54_55_cris_prefix_scope.py, which reads the catalog, the shared/Azure schemas, the guardrails guide, and the three consumer files and fails on any window that pairs GPT-5.4/5.5 with a grouped us./in./global. grant without scoping in. to GPT-5.6. Verified to fail against the previous wording of all three files. --- .../agents/llm2bedrock-code-rewriter.md | 2 +- .../phases/generate/generate-artifacts-ai.md | 4 +- .../references/phases/design/design-ai.md | 3 +- .../tests/test_gpt54_55_cris_prefix_scope.py | 76 +++++++++++++++++++ 4 files changed, 81 insertions(+), 4 deletions(-) create mode 100644 plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py diff --git a/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md b/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md index d4065c4a5..38f89db7c 100644 --- a/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md +++ b/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md @@ -257,7 +257,7 @@ client = anthropic.Anthropic( Preserve compatible SDK request/response shapes. A model version change still requires §9 target checks, including typed response parsing for Opus 5.5. Apply the Chat Completions → Responses reshape only when that API change was selected. Preserve the exact validated runtime profile ID or ARN. After applying the changes above, skip the Converse-specific guidance in the rest of §8; the §9 behavior-delta application still applies normally. -**Converse for a proprietary GPT target is id-form-dependent, not family-dependent.** A **bare** proprietary GPT id (`openai.gpt-5.5`, `openai.gpt-5.4`, `openai.gpt-5.6-*`, `openai.gpt-6-*`) is a `bedrock-mantle` id with no `bedrock-runtime` in-region form — a boto3 `converse()` call against a bare id fails at runtime; if your context pairs a bare id with the Converse path, stop and report the contradiction. GPT-5.6, GPT-6 (Astra, Sol, Luna, 6.1 Sol) **and GPT-5.5 / GPT-5.4** (model cards read 2026-11-06: `us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`; Responses, Chat Completions and Converse on runtime, no Invoke) all have a `bedrock-runtime` path via CRIS ids (`us.`/`in.`/`global.` prefixed): when the plan says `migration_path: runtime_openai_cris`, a Converse, Responses or Chat Completions rewrite against the CRIS id is valid (base URL `bedrock-runtime.{region}.amazonaws.com/openai/v1` for the OpenAI-compatible APIs; note Guardrails are Converse-only and prompt caching Responses-only on runtime). For a Responses-based source app, the mantle express lane above remains the default and smallest change. +**Converse for a proprietary GPT target is id-form-dependent, not family-dependent.** A **bare** proprietary GPT id (`openai.gpt-5.5`, `openai.gpt-5.4`, `openai.gpt-5.6-*`, `openai.gpt-6-*`) is a `bedrock-mantle` id with no `bedrock-runtime` in-region form — a boto3 `converse()` call against a bare id fails at runtime; if your context pairs a bare id with the Converse path, stop and report the contradiction. GPT-5.6, GPT-6 (Astra, Sol, Luna, 6.1 Sol) **and GPT-5.5 / GPT-5.4** (model cards read 2026-11-06: `us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`; Responses, Chat Completions and Converse on runtime, no Invoke) all have a `bedrock-runtime` path via CRIS ids (`us.`/`in.`/`global.` prefixed for GPT-5.6; `us.`/`global.` for GPT-6, GPT-5.5 and GPT-5.4 — those cards publish no `in.` profile): when the plan says `migration_path: runtime_openai_cris`, a Converse, Responses or Chat Completions rewrite against the CRIS id is valid (base URL `bedrock-runtime.{region}.amazonaws.com/openai/v1` for the OpenAI-compatible APIs; note Guardrails are Converse-only and prompt caching Responses-only on runtime). For a Responses-based source app, the mantle express lane above remains the default and smallest change. ### Converse rewrite (default) diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md index 109a9a003..1f732c5fd 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md @@ -157,8 +157,8 @@ is AWS-only and ports from gcp unchanged. `global.` CRIS id. Chat/Responses and runtime artifact selection match the saved design. - [ ] No **bare** proprietary GPT model ID (including bare `openai.gpt-5.5` / `openai.gpt-5.4`) paired with a Converse/`bedrock-runtime` path. GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use - `migration_path: "runtime_openai_cris"` on `bedrock-runtime` with a `us.`/`in.`/`global.` - CRIS id — this is NOT a violation. + `migration_path: "runtime_openai_cris"` on `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` + for GPT-5.6; `us.`/`global.` only for GPT-6, GPT-5.5 and GPT-5.4) — this is NOT a violation. - [ ] Plugin attribution strings say "Azure-to-AWS". - [ ] `generation-ai.json` validates; `rollback_plan.mechanism == "feature_flag"`. diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md index a744a6faf..281804c92 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md @@ -518,7 +518,8 @@ Write `aws-design-ai.json` to `$MIGRATION_DIR/`. - [ ] No `bedrock_models[]` entry pairs a **bare** proprietary GPT id (including bare `openai.gpt-5.5` / `openai.gpt-5.4`) with a Converse/`bedrock-runtime` migration path. GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on - `bedrock-runtime` with a `us.`/`in.`/`global.` CRIS id — this is NOT a violation. + `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` for GPT-5.6; `us.`/`global.` only for + GPT-6, GPT-5.5 and GPT-5.4) — this is NOT a violation. - [ ] `regional_warnings` is present (empty array `[]` if no issues; populated if any service unavailable in target region) - [ ] `multi_model_warnings` is present (empty array `[]` if single model or no coordination issues) - [ ] If `agentic_profile.is_agentic == true`: `agentic_design` object is present with `migration_approach` matching `preferences.json` diff --git a/plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py b/plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py new file mode 100644 index 000000000..7db7f9558 --- /dev/null +++ b/plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py @@ -0,0 +1,76 @@ +"""Guard: the `in.` CRIS prefix is a GPT-5.6 fact only. +The GPT-5.4 and GPT-5.5 model cards (read 2026-11-07) publish only `us.` and +`global.` inference-profile ids: + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html +The catalog records that; this test makes sure no prose consumer of the catalog +(design/generate checklists, the code-rewriter agent, the shared schema) hands +those two models a grouped `us.`/`in.`/`global.` grant that would let an agent +record `in.openai.gpt-5.4` / `in.openai.gpt-5.5` as a runtime id. +""" +from __future__ import annotations +import json +import re +from pathlib import Path +PLUGIN_ROOT = Path(__file__).resolve().parent.parent +CATALOG = PLUGIN_ROOT / "skills" / "shared" / "ai" / "models" / "openai-bedrock.json" +# Every file that names GPT-5.4 / GPT-5.5 alongside a CRIS-prefix grant. +CONSUMERS = [ + PLUGIN_ROOT / "agents" / "llm2bedrock-code-rewriter.md", + PLUGIN_ROOT / "skills" / "gcp-to-aws" / "references" / "phases" / "design" / "design-ai.md", + PLUGIN_ROOT / "skills" / "azure-to-aws" / "references" / "phases" / "generate" / "generate-artifacts-ai.md", + PLUGIN_ROOT / "skills" / "shared" / "ai" / "schema-design-aws-ai.md", + PLUGIN_ROOT / "skills" / "azure-to-aws" / "references" / "shared" / "schema-design-aws-ai.md", + PLUGIN_ROOT / "skills" / "shared" / "ai" / "ai-migration-guardrails.md", +] +_GROUPED_PREFIX = re.compile(r"`?us\.`?\s*/\s*`?in\.`?\s*/\s*`?global\.`?") +_GPT_54_55 = re.compile(r"GPT-5\.[45]|gpt-5\.[45]", re.IGNORECASE) +def _sentences_granting_in_to_gpt54_55(text: str) -> list[str]: + """Return sentence-ish windows that mention GPT-5.4/5.5 AND the grouped + us./in./global. prefix WITHOUT also scoping `in.` to GPT-5.6 in that window.""" + hits: list[str] = [] + for m in _GROUPED_PREFIX.finditer(text): + window = text[max(0, m.start() - 320) : m.end() + 320] + if not _GPT_54_55.search(window): + continue + # Acceptable only when the same window explicitly scopes `in.` to GPT-5.6 + # and gives GPT-5.4/5.5 their own `us.`/`global.` grant. + scoped = re.search(r"GPT-5\.6", window) and re.search( + r"`?us\.`?\s*/\s*`?global\.`?\s*(only|for|;)", window + ) + if not scoped: + hits.append(" ".join(window.split())) + return hits +def test_catalog_inference_profiles_for_gpt54_55_are_us_and_global_only() -> None: + catalog = json.loads(CATALOG.read_text()) + for key in ("openai_gpt_5_4", "openai_gpt_5_5"): + assert set(catalog["models"][key]["inference_profiles"]) == {"us", "global"}, key +def test_no_prose_consumer_grants_in_prefix_to_gpt54_55() -> None: + offenders: dict[str, list[str]] = {} + for path in CONSUMERS: + assert path.exists(), path + hits = _sentences_granting_in_to_gpt54_55(path.read_text()) + if hits: + offenders[str(path.relative_to(PLUGIN_ROOT))] = hits + assert not offenders, ( + "GPT-5.4 / GPT-5.5 are granted a us./in./global. CRIS id; their cards publish " + "us. and global. only. Scope `in.` to GPT-5.6:\n" + + "\n".join(f" {k}: {v[0][:200]}" for k, v in offenders.items()) + ) +def test_vendored_copies_match_canonical_for_edited_files() -> None: + pairs = [ + ( + PLUGIN_ROOT / "skills" / "shared" / "ai" / "schema-design-aws-ai.md", + PLUGIN_ROOT / "skills" / "gcp-to-aws" / "references" / "vendored" / "ai" / "schema-design-aws-ai.md", + ), + ( + PLUGIN_ROOT / "skills" / "shared" / "ai" / "schema-design-aws-ai.md", + PLUGIN_ROOT / "skills" / "azure-to-aws" / "references" / "vendored" / "ai" / "schema-design-aws-ai.md", + ), + ( + CATALOG, + PLUGIN_ROOT / "skills" / "agent-advisor" / "references" / "vendored" / "ai" / "models" / "openai-bedrock.json", + ), + ] + for canonical, vendored in pairs: + assert canonical.read_bytes() == vendored.read_bytes(), f"{vendored} drifted from {canonical}" From 6b873f8c9c1752f891c5a3195ce15bacf0cea839 Mon Sep 17 00:00:00 2001 From: Logan Kleier Date: Sat, 7 Nov 2026 09:14:47 -0800 Subject: [PATCH 5/7] fix(aws-startup-advisor): grant the in. CRIS prefix to GPT-5.6 Terra and Luna only, not Sol The GPT-5.6 Sol card (read 2026-11-07) publishes us.openai.gpt-5.6-sol and global.openai.gpt-5.6-sol only; Terra and Luna publish us./in./us-gov./global. Prior wording granted in. to "GPT-5.6" family-wide in the catalog strength, the rewriter, the GCP Design and Azure Generate checklists, both schema copies, and ai-migration-guardrails.md ("GPT-5.6 Sol/Terra/Luna (us./in./global.)"). Each now reads: us./in./global. for GPT-5.6 Terra and Luna; us./global. only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4. tests/test_gpt54_55_cris_prefix_scope.py now also scans the catalog strength text and rejects any grouped in. grant to GPT-5.6 that does not name Terra/Luna and place Sol in the us./global.-only set. Verified to fail against the dfd07bdc wording of every file above. --- .../agents/llm2bedrock-code-rewriter.md | 2 +- .../vendored/ai/models/openai-bedrock.json | 2 +- .../test_openai_model_recommendation.py | 4 +- .../phases/generate/generate-artifacts-ai.md | 3 +- .../references/shared/schema-design-aws-ai.md | 8 +-- .../vendored/ai/ai-migration-guardrails.md | 2 +- .../vendored/ai/schema-design-aws-ai.md | 8 +-- .../references/phases/design/design-ai.md | 4 +- .../vendored/ai/ai-migration-guardrails.md | 2 +- .../vendored/ai/schema-design-aws-ai.md | 8 +-- .../shared/ai/ai-migration-guardrails.md | 2 +- .../shared/ai/models/openai-bedrock.json | 2 +- .../skills/shared/ai/schema-design-aws-ai.md | 8 +-- .../tests/test_gpt54_55_cris_prefix_scope.py | 65 ++++++++++++------- 14 files changed, 72 insertions(+), 48 deletions(-) diff --git a/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md b/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md index 38f89db7c..d46296670 100644 --- a/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md +++ b/plugins/aws-startup-advisor/agents/llm2bedrock-code-rewriter.md @@ -257,7 +257,7 @@ client = anthropic.Anthropic( Preserve compatible SDK request/response shapes. A model version change still requires §9 target checks, including typed response parsing for Opus 5.5. Apply the Chat Completions → Responses reshape only when that API change was selected. Preserve the exact validated runtime profile ID or ARN. After applying the changes above, skip the Converse-specific guidance in the rest of §8; the §9 behavior-delta application still applies normally. -**Converse for a proprietary GPT target is id-form-dependent, not family-dependent.** A **bare** proprietary GPT id (`openai.gpt-5.5`, `openai.gpt-5.4`, `openai.gpt-5.6-*`, `openai.gpt-6-*`) is a `bedrock-mantle` id with no `bedrock-runtime` in-region form — a boto3 `converse()` call against a bare id fails at runtime; if your context pairs a bare id with the Converse path, stop and report the contradiction. GPT-5.6, GPT-6 (Astra, Sol, Luna, 6.1 Sol) **and GPT-5.5 / GPT-5.4** (model cards read 2026-11-06: `us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`; Responses, Chat Completions and Converse on runtime, no Invoke) all have a `bedrock-runtime` path via CRIS ids (`us.`/`in.`/`global.` prefixed for GPT-5.6; `us.`/`global.` for GPT-6, GPT-5.5 and GPT-5.4 — those cards publish no `in.` profile): when the plan says `migration_path: runtime_openai_cris`, a Converse, Responses or Chat Completions rewrite against the CRIS id is valid (base URL `bedrock-runtime.{region}.amazonaws.com/openai/v1` for the OpenAI-compatible APIs; note Guardrails are Converse-only and prompt caching Responses-only on runtime). For a Responses-based source app, the mantle express lane above remains the default and smallest change. +**Converse for a proprietary GPT target is id-form-dependent, not family-dependent.** A **bare** proprietary GPT id (`openai.gpt-5.5`, `openai.gpt-5.4`, `openai.gpt-5.6-*`, `openai.gpt-6-*`) is a `bedrock-mantle` id with no `bedrock-runtime` in-region form — a boto3 `converse()` call against a bare id fails at runtime; if your context pairs a bare id with the Converse path, stop and report the contradiction. GPT-5.6, GPT-6 (Astra, Sol, Luna, 6.1 Sol) **and GPT-5.5 / GPT-5.4** (model cards read 2026-11-06: `us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`; Responses, Chat Completions and Converse on runtime, no Invoke) all have a `bedrock-runtime` path via CRIS ids (`us.`/`in.`/`global.` prefixed for GPT-5.6 Terra and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4 — those cards publish no `in.` profile): when the plan says `migration_path: runtime_openai_cris`, a Converse, Responses or Chat Completions rewrite against the CRIS id is valid (base URL `bedrock-runtime.{region}.amazonaws.com/openai/v1` for the OpenAI-compatible APIs; note Guardrails are Converse-only and prompt caching Responses-only on runtime). For a Responses-based source app, the mantle express lane above remains the default and smallest change. ### Converse rewrite (default) diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json index 48758f3c9..cf642646e 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json +++ b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/models/openai-bedrock.json @@ -51,7 +51,7 @@ "strengths": [ "Bedrock-native multi-model request surface", "Supports Bedrock Guardrails (Converse API only), invocation logging, and CloudWatch", - "For GPT-5.6 this is a SAME-MODEL governance path via CRIS (us./in./global. ids). For GPT-5.5 and GPT-5.4 the runtime ids are us. and global. only (their model cards publish no in. profile). The base URL for the OpenAI-compatible APIs is bedrock-runtime.{region}.amazonaws.com/openai/v1. The model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" + "This is a SAME-MODEL governance path via CRIS. GPT-5.6 Terra and Luna publish us./in./global. ids; us./global. only for GPT-5.6 Sol, GPT-5.5 and GPT-5.4 (their model cards list no in. profile; cards read 2026-11-07). The base URL for the OpenAI-compatible APIs is bedrock-runtime.{region}.amazonaws.com/openai/v1. The model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" ], "constraints": [ "GPT-5.5 / GPT-5.4 on runtime are CRIS-only (us. and global. ids; no in-region form) per their model cards (read 2026-11-06); the cards publish In-Region (1.10x) pricing only, so do not assume Global CRIS price parity for them", diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py index c506f6830..33c5b9d9e 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py +++ b/plugins/aws-startup-advisor/skills/agent-advisor/scripts/test_openai_model_recommendation.py @@ -127,7 +127,9 @@ def test_runtime_converse_path_text_does_not_grant_in_profile_to_gpt54_gpt55(): strengths = "\n".join(path["strengths"]) constraints = "\n".join(path["constraints"]) assert "For GPT-5.6, GPT-5.5 and GPT-5.4" not in strengths - assert "GPT-5.5 and GPT-5.4 the runtime ids are us. and global. only" in strengths + # in. exists for GPT-5.6 Terra/Luna only; Sol, 5.5 and 5.4 are us./global. + assert "GPT-5.6 Terra and Luna publish us./in./global. ids" in strengths + assert "us./global. only for GPT-5.6 Sol, GPT-5.5 and GPT-5.4" in strengths assert "For GPT-5.6, runtime does not support server-side tool use" in constraints assert "GPT-5.5 / GPT-5.4 on runtime" in constraints assert "structured outputs and implicit prompt caching are Responses-only" in constraints diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md index 1f732c5fd..554f2b830 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md @@ -158,7 +158,8 @@ is AWS-only and ports from gcp unchanged. - [ ] No **bare** proprietary GPT model ID (including bare `openai.gpt-5.5` / `openai.gpt-5.4`) paired with a Converse/`bedrock-runtime` path. GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` - for GPT-5.6; `us.`/`global.` only for GPT-6, GPT-5.5 and GPT-5.4) — this is NOT a violation. + for GPT-5.6 Terra and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4) — + this is NOT a violation. - [ ] Plugin attribution strings say "Azure-to-AWS". - [ ] `generation-ai.json` validates; `rollback_plan.mechanism == "feature_flag"`. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md index 9d5c929aa..7788f9b6d 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md @@ -127,8 +127,8 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` lists it there (GPT-6, GPT-5.5, GPT-5.4). `mantle_openai_responses` (Azure OpenAI / OpenAI source, model on Bedrock, region carries it — keep the SDK, `model_change: false`) · `runtime_openai_cris` (GPT-6 / GPT-5.6 / GPT-5.5 / GPT-5.4 -same-model move served via `bedrock-runtime` CRIS — `us.`/`in.`/`global.` prefixed for GPT-6 / -GPT-5.6, `us.`/`global.` only for GPT-5.5 / GPT-5.4 — `model_change: false`) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set +same-model move served via `bedrock-runtime` CRIS — `us.`/`in.`/`global.` prefixed for GPT-5.6 +Terra / Luna, `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4 — `model_change: false`) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, intelligent prompt routing, or another feature the same-model CRIS path itself cannot serve) · `gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK swap). A **bare** @@ -207,8 +207,8 @@ rubric file (`ai.md`, `ai-azure-openai-to-bedrock.md`, or a `vendored/ai/*` ref) - [ ] No `bedrock_models[]` entry pairs a **bare** proprietary GPT id (including bare `openai.gpt-5.5` / `openai.gpt-5.4`) with a `converse`/`bedrock-runtime` migration path. GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on - `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` for GPT-6 / GPT-5.6, `us.`/`global.` - only for GPT-5.5 / GPT-5.4) — this is NOT a violation. + `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` for GPT-5.6 Terra / Luna, `us.`/`global.` + only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4) — this is NOT a violation. - [ ] If `ai_source` is `azure_openai` or `openai`: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md index 1ad1b0a09..d457a12a9 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-migration-guardrails.md @@ -48,7 +48,7 @@ Inference on `bedrock-mantle` for these models is governed by **two per-model, p | Medium | Medium | Monitor 429s against **token** throughput, not request rate; enable prompt caching | | High | High | Enable prompt caching first (cached input is exempt from input TPM), then request a quota increase | -**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Sol/Terra/Luna (`us.`/`in.`/`global.`), GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra (`us.`/`global.`), and GPT-5.5 / GPT-5.4 (`us.`/`global.`; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Terra and Luna (`us.`/`in.`/`global.`), and `us.`/`global.` only for GPT-5.6 Sol, GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra, and GPT-5.5 / GPT-5.4 (the GPT-5.6 Sol card lists no `in.` profile; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: 1. Prompt caching (GPT-5.6 and GPT-6 on mantle; GPT-5.5 / GPT-5.4 list implicit caching on `bedrock-runtime` Responses only) — 90% off cached input and exempt from the input-TPM quota 2. Exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK) diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md index c31359bbc..c82a8eebc 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/schema-design-aws-ai.md @@ -193,8 +193,8 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` (same, preserving a Chat Completions source on a model whose card lists Chat Completions on mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via -`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-6 and -GPT-5.6, `us.`/`global.` only for GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native +`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-5.6 Terra +and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK @@ -263,8 +263,8 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. - [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` - target carries a CRIS id: `us.`/`in.`/`global.` for GPT-6 / GPT-5.6, `us.`/`global.` only for - GPT-5.5 / GPT-5.4). + target carries a CRIS id: `us.`/`in.`/`global.` for GPT-5.6 Terra / Luna; `us.`/`global.` only + for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md index 281804c92..a03f7de63 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md @@ -518,8 +518,8 @@ Write `aws-design-ai.json` to `$MIGRATION_DIR/`. - [ ] No `bedrock_models[]` entry pairs a **bare** proprietary GPT id (including bare `openai.gpt-5.5` / `openai.gpt-5.4`) with a Converse/`bedrock-runtime` migration path. GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on - `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` for GPT-5.6; `us.`/`global.` only for - GPT-6, GPT-5.5 and GPT-5.4) — this is NOT a violation. + `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` for GPT-5.6 Terra and Luna; + `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4) — this is NOT a violation. - [ ] `regional_warnings` is present (empty array `[]` if no issues; populated if any service unavailable in target region) - [ ] `multi_model_warnings` is present (empty array `[]` if single model or no coordination issues) - [ ] If `agentic_profile.is_agentic == true`: `agentic_design` object is present with `migration_approach` matching `preferences.json` diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md index 1ad1b0a09..d457a12a9 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-migration-guardrails.md @@ -48,7 +48,7 @@ Inference on `bedrock-mantle` for these models is governed by **two per-model, p | Medium | Medium | Monitor 429s against **token** throughput, not request rate; enable prompt caching | | High | High | Enable prompt caching first (cached input is exempt from input TPM), then request a quota increase | -**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Sol/Terra/Luna (`us.`/`in.`/`global.`), GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra (`us.`/`global.`), and GPT-5.5 / GPT-5.4 (`us.`/`global.`; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Terra and Luna (`us.`/`in.`/`global.`), and `us.`/`global.` only for GPT-5.6 Sol, GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra, and GPT-5.5 / GPT-5.4 (the GPT-5.6 Sol card lists no `in.` profile; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: 1. Prompt caching (GPT-5.6 and GPT-6 on mantle; GPT-5.5 / GPT-5.4 list implicit caching on `bedrock-runtime` Responses only) — 90% off cached input and exempt from the input-TPM quota 2. Exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK) diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md index c31359bbc..c82a8eebc 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/schema-design-aws-ai.md @@ -193,8 +193,8 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` (same, preserving a Chat Completions source on a model whose card lists Chat Completions on mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via -`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-6 and -GPT-5.6, `us.`/`global.` only for GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native +`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-5.6 Terra +and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK @@ -263,8 +263,8 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. - [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` - target carries a CRIS id: `us.`/`in.`/`global.` for GPT-6 / GPT-5.6, `us.`/`global.` only for - GPT-5.5 / GPT-5.4). + target carries a CRIS id: `us.`/`in.`/`global.` for GPT-5.6 Terra / Luna; `us.`/`global.` only + for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md b/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md index 1ad1b0a09..d457a12a9 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/ai-migration-guardrails.md @@ -48,7 +48,7 @@ Inference on `bedrock-mantle` for these models is governed by **two per-model, p | Medium | Medium | Monitor 429s against **token** throughput, not request rate; enable prompt caching | | High | High | Enable prompt caching first (cached input is exempt from input TPM), then request a quota increase | -**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Sol/Terra/Luna (`us.`/`in.`/`global.`), GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra (`us.`/`global.`), and GPT-5.5 / GPT-5.4 (`us.`/`global.`; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: +**Every proprietary GPT model on Bedrock has a `bedrock-runtime` path via CRIS inference profiles.** GPT-5.6 Terra and Luna (`us.`/`in.`/`global.`), and `us.`/`global.` only for GPT-5.6 Sol, GPT-6 Astra/Sol/Luna/6.1 Sol/6.1 Terra, and GPT-5.5 / GPT-5.4 (the GPT-5.6 Sol card lists no `in.` profile; per their model cards read 2026-11-06, [GPT-5.4](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html), [GPT-5.5](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html)) all list `bedrock-runtime` with Responses, Chat Completions and Converse; none has a runtime in-region form. The model cards recommend runtime for new applications. It is a legitimate endpoint option with its own quota family, and for GPT-5.6 / GPT-6 on Global CRIS it is also the cost-parity option (the GPT-5.5 / GPT-5.4 cards publish In-Region pricing only). A same-model endpoint switch is not a model change; only moving to a Bedrock-native model or `gpt-oss` carries the eval cost of a model change. Scaling levers on the mantle path, in order: 1. Prompt caching (GPT-5.6 and GPT-6 on mantle; GPT-5.5 / GPT-5.4 list implicit caching on `bedrock-runtime` Responses only) — 90% off cached input and exempt from the input-TPM quota 2. Exponential backoff with a bounded retry count (`max_retries` on the OpenAI SDK) diff --git a/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json b/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json index 48758f3c9..cf642646e 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json +++ b/plugins/aws-startup-advisor/skills/shared/ai/models/openai-bedrock.json @@ -51,7 +51,7 @@ "strengths": [ "Bedrock-native multi-model request surface", "Supports Bedrock Guardrails (Converse API only), invocation logging, and CloudWatch", - "For GPT-5.6 this is a SAME-MODEL governance path via CRIS (us./in./global. ids). For GPT-5.5 and GPT-5.4 the runtime ids are us. and global. only (their model cards publish no in. profile). The base URL for the OpenAI-compatible APIs is bedrock-runtime.{region}.amazonaws.com/openai/v1. The model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" + "This is a SAME-MODEL governance path via CRIS. GPT-5.6 Terra and Luna publish us./in./global. ids; us./global. only for GPT-5.6 Sol, GPT-5.5 and GPT-5.4 (their model cards list no in. profile; cards read 2026-11-07). The base URL for the OpenAI-compatible APIs is bedrock-runtime.{region}.amazonaws.com/openai/v1. The model cards recommend runtime for new applications, and for GPT-5.6 Global CRIS is priced at OpenAI's standard rate (cost parity)" ], "constraints": [ "GPT-5.5 / GPT-5.4 on runtime are CRIS-only (us. and global. ids; no in-region form) per their model cards (read 2026-11-06); the cards publish In-Region (1.10x) pricing only, so do not assume Global CRIS price parity for them", diff --git a/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md index c31359bbc..c82a8eebc 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/schema-design-aws-ai.md @@ -193,8 +193,8 @@ Traditional-AI capabilities (AWS AI service, not Bedrock): `document_extraction` on Bedrock and the region carrying it: keep the SDK, `model_change: false`) · `mantle_openai_chat` (same, preserving a Chat Completions source on a model whose card lists Chat Completions on mantle — GPT-6, GPT-5.5, GPT-5.4) · `runtime_openai_cris` (same-model move served via -`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-6 and -GPT-5.6, `us.`/`global.` only for GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native +`bedrock-runtime` with a CRIS id, `model_change: false`; `us.`/`in.`/`global.` for GPT-5.6 Terra +and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4, per their model cards) · `converse` (Bedrock-native Converse/`bedrock-runtime`; set `model_change: true` when the workload needs Knowledge Bases, intelligent prompt routing, or another feature no same-model path serves) · `gpt-oss` (OpenAI-lineage model on the Bedrock-native runtime) · `direct` (framework-agnostic Bedrock SDK @@ -263,8 +263,8 @@ rubric file (`ai.md`, a provider-to-Bedrock mapping guide, or a `vendored/ai/*` `recommend_stay`, `honest_assessment_reason` names a non-cost blocker. - [ ] No `bedrock_models[]` entry pairs a **bare** proprietary `openai.gpt-*` model ID with a `converse`/`bedrock-runtime` migration path (bare ids are mantle ids; a `bedrock-runtime` - target carries a CRIS id: `us.`/`in.`/`global.` for GPT-6 / GPT-5.6, `us.`/`global.` only for - GPT-5.5 / GPT-5.4). + target carries a CRIS id: `us.`/`in.`/`global.` for GPT-5.6 Terra / Luna; `us.`/`global.` only + for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4). - [ ] For a retained source whose `source_service` is `azure_openai`, or whose provider resolves to direct OpenAI: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py b/plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py index 7db7f9558..d1d71ba10 100644 --- a/plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py +++ b/plugins/aws-startup-advisor/tests/test_gpt54_55_cris_prefix_scope.py @@ -1,12 +1,19 @@ -"""Guard: the `in.` CRIS prefix is a GPT-5.6 fact only. -The GPT-5.4 and GPT-5.5 model cards (read 2026-11-07) publish only `us.` and -`global.` inference-profile ids: +"""Guard: the `in.` CRIS prefix belongs to GPT-5.6 Terra and Luna only. +Public model cards (read 2026-11-07): + GPT-5.6 Terra / Luna us. / in. / us-gov. / global. + GPT-5.6 Sol us. / global. + GPT-5.4, GPT-5.5 us. / global. + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-sol.html + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-terra.html + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-luna.html https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html -The catalog records that; this test makes sure no prose consumer of the catalog -(design/generate checklists, the code-rewriter agent, the shared schema) hands -those two models a grouped `us.`/`in.`/`global.` grant that would let an agent -record `in.openai.gpt-5.4` / `in.openai.gpt-5.5` as a runtime id. +This test makes sure no prose consumer of the catalog (design/generate +checklists, the code-rewriter agent, the shared schema, the catalog strength +text) hands GPT-5.4 / GPT-5.5 a grouped `us.`/`in.`/`global.` grant, and that +any `in.` grant to "GPT-5.6" names Terra/Luna rather than the whole family, +so an agent cannot record `in.openai.gpt-5.6-sol`, `in.openai.gpt-5.4` or +`in.openai.gpt-5.5` as a runtime id. """ from __future__ import annotations import json @@ -25,36 +32,50 @@ ] _GROUPED_PREFIX = re.compile(r"`?us\.`?\s*/\s*`?in\.`?\s*/\s*`?global\.`?") _GPT_54_55 = re.compile(r"GPT-5\.[45]|gpt-5\.[45]", re.IGNORECASE) -def _sentences_granting_in_to_gpt54_55(text: str) -> list[str]: - """Return sentence-ish windows that mention GPT-5.4/5.5 AND the grouped - us./in./global. prefix WITHOUT also scoping `in.` to GPT-5.6 in that window.""" +_TERRA_LUNA_SCOPED = re.compile(r"GPT-5\.6\s+Terra\s*(and|/)\s*(GPT-5\.6\s+)?Luna", re.IGNORECASE) +_SOL_EXCLUDED = re.compile(r"`?us\.`?\s*/\s*`?global\.`?\s*(only\s+)?for[^.;)]*GPT-5\.6\s+Sol", re.IGNORECASE) +_US_GLOBAL_GRANT = re.compile(r"`?us\.`?\s*/\s*`?global\.`?\s*(only|for|;)") +def _bad_in_grants(text: str) -> list[str]: + """Return windows around a grouped us./in./global. grant that either + (a) cover GPT-5.4/5.5 without giving them their own us./global. grant, or + (b) grant `in.` to "GPT-5.6" family-wide instead of to Terra/Luna with Sol + explicitly in the us./global.-only set.""" hits: list[str] = [] for m in _GROUPED_PREFIX.finditer(text): - window = text[max(0, m.start() - 320) : m.end() + 320] - if not _GPT_54_55.search(window): + window = text[max(0, m.start() - 360) : m.end() + 360] + mentions_54_55 = bool(_GPT_54_55.search(window)) + mentions_56 = bool(re.search(r"GPT-5\.6", window)) + if not (mentions_54_55 or mentions_56): continue - # Acceptable only when the same window explicitly scopes `in.` to GPT-5.6 - # and gives GPT-5.4/5.5 their own `us.`/`global.` grant. - scoped = re.search(r"GPT-5\.6", window) and re.search( - r"`?us\.`?\s*/\s*`?global\.`?\s*(only|for|;)", window - ) - if not scoped: + ok = True + if mentions_54_55 and not _US_GLOBAL_GRANT.search(window): + ok = False + if mentions_56 and not (_TERRA_LUNA_SCOPED.search(window) and _SOL_EXCLUDED.search(window)): + ok = False + if not ok: hits.append(" ".join(window.split())) return hits def test_catalog_inference_profiles_for_gpt54_55_are_us_and_global_only() -> None: catalog = json.loads(CATALOG.read_text()) for key in ("openai_gpt_5_4", "openai_gpt_5_5"): assert set(catalog["models"][key]["inference_profiles"]) == {"us", "global"}, key -def test_no_prose_consumer_grants_in_prefix_to_gpt54_55() -> None: +def test_no_prose_consumer_grants_in_prefix_to_gpt54_55_or_gpt56_sol() -> None: offenders: dict[str, list[str]] = {} + # The catalog's runtime_converse path strength is prose an agent reads too. + catalog = json.loads(CATALOG.read_text()) + strength_text = "\n".join(catalog["paths"]["runtime_converse"]["strengths"]) + hits = _bad_in_grants(strength_text) + if hits: + offenders["skills/shared/ai/models/openai-bedrock.json (runtime_converse.strengths)"] = hits for path in CONSUMERS: assert path.exists(), path - hits = _sentences_granting_in_to_gpt54_55(path.read_text()) + hits = _bad_in_grants(path.read_text()) if hits: offenders[str(path.relative_to(PLUGIN_ROOT))] = hits assert not offenders, ( - "GPT-5.4 / GPT-5.5 are granted a us./in./global. CRIS id; their cards publish " - "us. and global. only. Scope `in.` to GPT-5.6:\n" + "A grouped us./in./global. CRIS grant covers GPT-5.4 / GPT-5.5 or the whole GPT-5.6 " + "family. Cards (2026-11-07): in. exists for GPT-5.6 Terra/Luna only; GPT-5.6 Sol, " + "GPT-5.4 and GPT-5.5 publish us./global. only:\n" + "\n".join(f" {k}: {v[0][:200]}" for k, v in offenders.items()) ) def test_vendored_copies_match_canonical_for_edited_files() -> None: From 8c37ef0f1e9a83d123d6662637fc6fadb6f068f8 Mon Sep 17 00:00:00 2001 From: Logan Kleier Date: Sat, 7 Nov 2026 18:26:40 -0800 Subject: [PATCH 6/7] =?UTF-8?q?fix(aws-startup-advisor):=20address=20PR=20?= =?UTF-8?q?583=20review=20=E2=80=94=20GPT-5.4/5.5=20default-project=20IAM?= =?UTF-8?q?=20grant,=20Converse=20for=20application=20profiles,=20In-Regio?= =?UTF-8?q?n-only=20pricing?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three inline findings by leon1418 on 6b873f8c, each verified against the public GPT-5.4 / GPT-5.5 model cards (read 2026-11-07): https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html 1. IAM default-project grant (iam_policy.py:29). The cards require bedrock:InvokeModel on arn:aws:bedrock:{region}:{account-id}:project/default in addition to the inference profile. iam_policy.py gated that grant on is_gpt6_cris_model(). Added is_gpt54_55_cris_model() (exact us./global. openai.gpt-5.4 / -5.5 short ids and their inference-profile ARNs; bare mantle ids, GPT-5.6 CRIS ids and unrelated models do not match) and requires_default_project_grant(); generate_policy() now emits the third ARN for those ids. Updated the GPT-6-only sentence in gcp generate-ai.md, gcp/azure generate-artifacts-ai.md Step 3, and the report generator §6.4. 2. Application inference profiles are Converse-only (gcp design-ai.md:425). GCP and Azure Design now require required_client_api: "converse" when application inference profiles are the driving need on GPT-5.5 / GPT-5.4 (and any model whose card lists them Converse-only), forbid leaving the field absent, keep the responses default for a region-only move, and record a conflicting Responses-only need (structured outputs, implicit caching) as an explicit decision instead of a silent drop. Added checklist items to the GCP Validation Checklist and the Azure shared schema (required_client_api section and checklist). 3. Unpublished Geo/Global prices (ai-openai-to-bedrock.md:46). The cards publish commercial In-Region prices only. Scoped the verified ~10% premium to the In-Region option in the canonical guide (Tier 0 rows included), both openai-on-bedrock.md fact bases, the report generator and the pricing-cache rows; a CRIS plan needs a separately sourced Geo/Global price or reports the comparison unavailable, and an In-Region proxy is an unverified planning assumption with no verified premium or savings percentage. bedrock_pricing.lookup() already returns available:false for the CRIS ids; pinned with a test (short ids and profile ARNs, no PriceList call). Tests: test_iam_policy.py TestGpt54Gpt55CrisProjectArn (short ids, profile ARNs, bare/GPT-5.6/Anthropic controls, mixed run); test_bedrock_pricing.py test_gpt54_55_cris_ids_are_unpriced_not_inferred_from_in_region; new tests/test_gpt54_55_runtime_review_round3.py text contracts for all three findings. tools/sync-vendored.py re-run (5 copies synced). Validation (this commit, in the worktree): - mise -C plugins/aws-startup-advisor run ci: exit 0 (test 1407 passed + 222 subtests; test:telemetry 311 passed; heroku-source-review 44/44; lint:md 0 errors; vendored-parity PASS 62 files; skill-refs PASS 1482) - llm-to-bedrock: uv run --project scripts python -m pytest: 453 passed (bare mise python3 shows 10 ModuleNotFoundError: httpx in test_astra_execution_contract.py — environment, not the change) - agent-advisor: python3 -m pytest skills/agent-advisor: 570 passed - tests/test_gpt54_55_cris_prefix_scope.py: still green - python3 tools/validate.py: All validations passed (exit 0) - tools/sync-vendored.py --check: PASS - mise run security (gitleaks): 1 pre-existing upstream false positive at f8d09fd1 (tests/test_bedrock_migration_assessment_discover.py, generic-api-key), unrelated to this PR; nothing new flagged. --- .../agents/llm2bedrock-report-generator.md | 4 +- .../vendored/ai/bedrock-pricing-cache.md | 4 +- .../references/phases/design/design-ai.md | 18 +- .../phases/generate/generate-artifacts-ai.md | 10 +- .../references/shared/openai-on-bedrock.md | 15 +- .../references/shared/schema-design-aws-ai.md | 13 +- .../vendored/ai/ai-openai-to-bedrock.md | 15 +- .../vendored/ai/bedrock-pricing-cache.md | 4 +- .../references/phases/design/design-ai.md | 24 ++- .../references/phases/generate/generate-ai.md | 2 +- .../phases/generate/generate-artifacts-ai.md | 2 +- .../references/shared/openai-on-bedrock.md | 15 +- .../vendored/ai/ai-openai-to-bedrock.md | 15 +- .../vendored/ai/bedrock-pricing-cache.md | 4 +- .../llm-to-bedrock/scripts/iam_policy.py | 39 ++++- .../scripts/test_bedrock_pricing.py | 23 +++ .../llm-to-bedrock/scripts/test_iam_policy.py | 90 ++++++++++ .../skills/shared/ai/ai-openai-to-bedrock.md | 15 +- .../skills/shared/ai/bedrock-pricing-cache.md | 4 +- .../test_gpt54_55_runtime_review_round3.py | 164 ++++++++++++++++++ 20 files changed, 435 insertions(+), 45 deletions(-) create mode 100644 plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py diff --git a/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md b/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md index 9b9de321e..9dd8b8107 100644 --- a/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md +++ b/plugins/aws-startup-advisor/agents/llm2bedrock-report-generator.md @@ -143,7 +143,7 @@ The pricing script only covers Bedrock models. For the source provider (OpenAI, **Astra:** use its separately dated Bedrock rates and context/inference tier. Its source price is absent from the table below; verify that price or mark the source comparison unavailable. Do not estimate Astra from a lower GPT tier or assume GPT-5.x parity/premium. -**GPT-5.x same-model pair cost depends on the inference option — state it conditionally, never as a flat figure.** In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier (1.10x standard), so those moves cost ~10% more — quote the increase plainly and carry the non-cost justification (commitments, governance, residency, prompt caching, no behaviour delta). **GPT-5.6 on Global CRIS is priced at the standard rate — cost parity** — applicable only when the workload has no data-residency constraint; when the plan's `migration_path` is `runtime_openai_cris` with a `global.` id, report parity, not a premium. GPT-5.5/5.4 do have `us.`/`global.` CRIS ids on `bedrock-runtime`, but their model cards (read 2026-11-06) publish In-Region pricing only — so the ~10% figure applies to them on every inference option until a Global rate is published; never report parity for them. **If a pair's workload exceeds 272K context**, price the Bedrock side at the long-context tier and show that line separately: GPT-5.6 is 2.0x input / 1.5x output per option; GPT-5.5 is 11.00 / 1.10 cache read / 49.50 and GPT-5.4 is 5.50 / 0.55 cache read / 24.75 per 1M tokens (In-Region, from their cards), applied to all tokens of the request, within a 1,050,000-token context window. +**GPT-5.x same-model pair cost depends on the inference option — state it conditionally, never as a flat figure.** In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier (1.10x standard), so those moves cost ~10% more — quote the increase plainly and carry the non-cost justification (commitments, governance, residency, prompt caching, no behaviour delta). **GPT-5.6 on Global CRIS is priced at the standard rate — cost parity** — applicable only when the workload has no data-residency constraint; when the plan's `migration_path` is `runtime_openai_cris` with a `global.` id, report parity, not a premium. GPT-5.5/5.4 do have `us.`/`global.` CRIS ids on `bedrock-runtime`, but their model cards (read 2026-11-07) publish **commercial In-Region prices only** ("Commercial In-Region prices include a 10% fee over OpenAI rates") — the ~10% premium is verified for their In-Region (mantle) option alone; nothing establishes a Geo or Global CRIS price. For a `runtime_openai_cris` plan on GPT-5.5/5.4, `bedrock_pricing.lookup()` returns `available: false` for the CRIS id and that is correct: do not substitute the In-Region row as a verified rate. Either source the Geo/Global price separately (URL + read date) and add it to `STATIC_FALLBACK`, or take the §6.3 fallback (`Cost comparison unavailable`, `cost_savings_percent: 0`). If you still show an In-Region proxy, label it an **unverified planning assumption** and report no verified premium or savings percentage from it. Never report parity for them. **If a pair's workload exceeds 272K context**, price the Bedrock side at the long-context tier and show that line separately: GPT-5.6 is 2.0x input / 1.5x output per option; GPT-5.5 is 11.00 / 1.10 cache read / 49.50 and GPT-5.4 is 5.50 / 0.55 cache read / 24.75 per 1M tokens (In-Region, from their cards), applied to all tokens of the request, within a 1,050,000-token context window. If the source model is not in this table (likely for any model released after the table's last update — check the provider's public pricing page if you know current rates), note it as a gap in the Risk Assessment section, label the figure "(estimated from ``)", and estimate using the closest listed model's pricing. @@ -571,7 +571,7 @@ uv run --project python /iam_policy.py \ --output /.saws-migrate/iam-policy.json ``` -The script handles the dual-ARN pattern: foundation-model ARNs for plain model IDs and inference-profile ARNs for geo-prefixed IDs (e.g. `us.anthropic.claude-sonnet-4-6`). The output is a ready-to-use IAM policy JSON file. +The script handles the dual-ARN pattern: foundation-model ARNs for plain model IDs and inference-profile ARNs for geo-prefixed IDs (e.g. `us.anthropic.claude-sonnet-4-6`). For a GPT-6 CRIS id and for the GPT-5.5 / GPT-5.4 CRIS ids (`us.`/`global.openai.gpt-5.5`, `us.`/`global.openai.gpt-5.4`, or their `inference-profile/` ARNs) it adds a third resource, `arn:aws:bedrock:::project/default`, because those model cards (GPT-5.4 / GPT-5.5 read 2026-11-07) require `bedrock:InvokeModel` on the default project in addition to the inference profile; do not strip it from the report's policy excerpt. The output is a ready-to-use IAM policy JSON file. **Mantle targets get different actions.** When any target is a bare proprietary OpenAI GPT model (GPT-5.x or `openai.gpt-6-astra`), the script also emits `bedrock-mantle:CreateInference` / `Get*` / `List*` scoped to `arn:aws:bedrock-mantle:::project/*`, plus `bedrock-mantle:CallWithBearerToken` on `*` (AWS does not permit narrowing that one). `bedrock:InvokeModel` alone does **not** authorize these models. Two consequences to carry into the report: diff --git a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md index a4206583c..ff4fa58e1 100644 --- a/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/agent-advisor/references/vendored/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 11.00/49.50; card read 2026-11-06) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 5.50/24.75; card read 2026-11-06) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 11.00/49.50; card read 2026-11-07) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 5.50/24.75; card read 2026-11-07) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md index 7b4564837..0314ff6ca 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/design/design-ai.md @@ -241,7 +241,23 @@ Sol/Luna/6.1 Sol. **When Guardrails is the driving need and the design keeps surface — `converse` for Astra and 6.1 Terra; `converse` / `chat_completions` / `invoke` (never `responses`) for 6.1 Sol and the other GPT-6/5.6 CRIS models except Astra and 6.1 Terra. Do not leave the client on `responses` when Guardrails is required.** `Responses` stays the default for a region-only -CRIS move with no Guardrails need. +CRIS move with no Guardrails or application-inference-profile need. + +**Application inference profiles are Converse-only on GPT-5.5, GPT-5.4, GPT-6.1 Terra and Astra — +the requirement MUST reach `required_client_api`.** The GPT-5.4 / GPT-5.5 model cards (read 2026-11-07) +list "Application inference profiles (Converse API only; not supported with Responses or Chat +Completions APIs)" on `bedrock-runtime`. When application inference profiles (cost attribution by +app/environment) are the driving need and the design keeps `runtime_openai_cris`, record +`bedrock_models[].required_client_api: "converse"` for GPT-5.5 / GPT-5.4 and for any other model +whose card or catalog `runtime_converse` path entry lists the feature as Converse-only. Do not leave +the field absent or on `responses` / `chat_completions`: Generate defaults an absent field to +Responses and omits the application profile for an unsupported model/API pair, so the endpoint +switch alone does not deliver the feature. If the same workload also needs a Responses-only +feature on that model (GPT-5.5 / GPT-5.4: structured outputs, implicit prompt caching — see +`openai-on-bedrock.md` § Access Paths), one client API cannot serve both: record the conflict as an +explicit decision in the plan and the Present Summary — name which feature the plan keeps and +which is dropped, or split the workload into two `bedrock_models[]` rows with their own +`required_client_api` — never silently drop either requirement. **GPT-6.1 Terra API constraints:** Guardrails and application inference profiles require `required_client_api: "converse"`. Converse rejects document blocks and images in tool diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md index 554f2b830..b3f83648e 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/generate/generate-artifacts-ai.md @@ -80,10 +80,14 @@ diffs outputs, so the user validates behavior before cutover. ## Step 3: `setup_bedrock.sh` Enables the chosen Bedrock model(s), sets up IAM, and (mantle path) the Bedrock API key. For a -`runtime_openai_cris` target whose CRIS id is a GPT-6 model (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra), the IAM +`runtime_openai_cris` target whose CRIS id is a GPT-6 model (Astra, Sol, Luna, 6.1 Sol, 6.1 Terra) or +GPT-5.5 / GPT-5.4 (`us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / +`global.openai.gpt-5.4`, or their `inference-profile/` ARNs), the IAM policy must grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default` -in addition to the CRIS inference-profile ARN — both required per the GPT-6 model cards; the -mantle `bedrock-mantle:*` policy is unaffected. +in addition to the CRIS inference-profile ARN — both required per the GPT-6 model cards and the +GPT-5.5 / GPT-5.4 cards (read 2026-11-07); `iam_policy.py` emits the third ARN for exactly these +ids. The mantle `bedrock-mantle:*` policy (bare `openai.gpt-5.5` / `openai.gpt-5.4` ids included) +is unaffected. ## Step 3B: `gateway_config.{yaml,py,json}` (gateway users) diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md index 7c9cddaa9..86c2781ab 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md @@ -269,8 +269,13 @@ inference-option dimension:** So the honest cost statement is conditional, not flat: a same-model GPT-5.6 move on Global CRIS is **cost-neutral**; the same move in-region or Geo is **~10% more expensive**. The GPT-5.5 / GPT-5.4 cards publish -In-Region pricing only (no Geo/Global rows as of 2026-11-06), so quote ~10% for them on every inference option. The -same Global-CRIS-is-cost-neutral / in-Region-and-Geo-is-~10%-more pattern applies to the GPT-6 family below. +**commercial In-Region pricing only** (no Geo/Global rows as of 2026-11-07; the cards say "Commercial In-Region +prices include a 10% fee over OpenAI rates"), so for them the ~10% premium is verified for the In-Region (mantle) +option alone — nothing establishes a Geo (`us.`) or Global CRIS price. For a GPT-5.5 / GPT-5.4 CRIS plan, source the +Geo/Global rate separately (the card's inference-option table or the Bedrock pricing page, with URL and read date) +or report the comparison unavailable; an In-Region rate used as a proxy is an **unverified planning assumption**, +labelled as such, and must not be turned into a verified premium or savings percentage. Never report parity for +them. The same Global-CRIS-is-cost-neutral / in-Region-and-Geo-is-~10%-more pattern applies to the GPT-6 family below. Never state either number without stating the inference option it belongs to. ### GPT-6 Astra / Sol / Luna / 6.1 Sol — short context (≤272K) @@ -326,8 +331,10 @@ A workload above 272K context must be priced at the long-context tier. ### GPT-5.5 / GPT-5.4 — In-Region pricing only; short- and long-context tiers (model cards read 2026-11-06) -The cards publish only the In-Region inference option (the `us.` / `global.` runtime CRIS ids exist but carry no -separate price row). Long-context rates apply to all input and output tokens of a request above 272K input tokens. +The cards publish only the commercial In-Region inference option (the `us.` / `global.` runtime CRIS ids exist but +carry no separate price row). A `runtime_openai_cris` plan priced from this table is an unverified planning +assumption, not a verified rate — `bedrock_pricing.lookup()` returns `available: false` for these CRIS ids on +purpose. Long-context rates apply to all input and output tokens of a request above 272K input tokens. | Model | Short context ≤272K (in · cache read · out) | Long context >272K (in · cache read · out) | Notes | | ------- | ------------------------------------------- | ------------------------------------------ | ---------------------------------------- | diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md index 7788f9b6d..a78a20e33 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/schema-design-aws-ai.md @@ -150,7 +150,12 @@ move (no Guardrails or other client-surface need). A Guardrails-requiring worklo `runtime_openai_cris` sets it to the surface that is actually Guardrails-capable for that model: `converse` for GPT-6 Astra and GPT-6.1 Terra, or `converse`/`chat_completions`/`invoke` — never `responses` — for GPT-6.1 Sol and the other -GPT-6/5.6 CRIS models except Astra and GPT-6.1 Terra. Terra also requires `converse` for application inference profiles. `generate-artifacts-ai.md`'s CRIS Step 1M reads this field and +GPT-6/5.6 CRIS models except Astra and GPT-6.1 Terra. Application inference profiles also require +`converse` on every model whose card lists them as Converse-only — GPT-6.1 Terra, Astra, and GPT-5.5 / +GPT-5.4 (cards read 2026-11-07: "Converse API only; not supported with Responses or Chat Completions +APIs") — so a workload needing them on `runtime_openai_cris` sets `converse`, never leaves the field +absent; a same-workload Responses-only need (GPT-5.5 / GPT-5.4 structured outputs, implicit caching) +is an explicit design decision, not a silent drop. `generate-artifacts-ai.md`'s CRIS Step 1M reads this field and emits that surface instead of defaulting to `responses.create`. Keep the existing Astra-no-Invoke migration_path note above — `required_client_api` never sets `invoke` for Astra. @@ -209,6 +214,12 @@ rubric file (`ai.md`, `ai-azure-openai-to-bedrock.md`, or a `vendored/ai/*` ref) GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` for GPT-5.6 Terra / Luna, `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4) — this is NOT a violation. +- [ ] Every `runtime_openai_cris` entry whose driving need includes application inference profiles, + on a model whose card lists them as Converse-only (GPT-5.5, GPT-5.4, GPT-6.1 Terra, Astra), + records `required_client_api: "converse"` — not absent, `responses` or `chat_completions`. + A same-workload Responses-only need (GPT-5.5 / GPT-5.4 structured outputs or implicit + caching) is recorded as an explicit decision, not silently dropped. A region-only CRIS + move keeps the `responses` default. - [ ] If `ai_source` is `azure_openai` or `openai`: every source model that is available on Bedrock and carried by the target region maps to ITSELF with `model_change: false` — not to a Claude/Nova substitute. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md index 78fb426c0..3cc8e290f 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md @@ -43,9 +43,14 @@ Two consequences that invert the previous decision logic: CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on - `bedrock-runtime`, but their model cards (read 2026-11-06) publish In-Region pricing only, so quote the ~10% - figure for them on every inference option until a Global rate is published. See - `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, + `bedrock-runtime`, but their model cards (read 2026-11-07) publish **commercial In-Region prices only** + ("Commercial In-Region prices include a 10% fee over OpenAI rates") — nothing on either card establishes a + Geo or Global CRIS price. So the verified ~10% premium for GPT-5.5 / GPT-5.4 is scoped to the commercial + In-Region (mantle) option. For a GPT-5.5 / GPT-5.4 CRIS plan, either source the Geo/Global rate separately + (the card's inference-option table or [aws.amazon.com/bedrock/pricing](https://aws.amazon.com/bedrock/pricing/), + with URL and read date) or report the comparison unavailable; an In-Region rate used as a proxy is an + **unverified planning assumption**, labelled as such, and yields no verified premium or savings percentage. + Never report parity for them. See `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, prompt caching, one vendor relationship — carries the in-region path; never present that path as free or neutral. For Astra, use its separately dated Bedrock rates and verify the source provider's rate before comparing. @@ -74,8 +79,8 @@ GPT-5.4, the target is **the same model on Bedrock**. | GPT-5.6 Sol | GPT-5.6 Sol | `openai.gpt-5.6-sol` / `us.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Terra | GPT-5.6 Terra | `openai.gpt-5.6-terra` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Luna | GPT-5.6 Luna | `openai.gpt-5.6-luna` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | -| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | -| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | +| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | Then apply the **region gate** below. Record `model_change: false` and the chosen path in `aws-design-ai.json` → `ai_architecture.code_migration`: `migration_path: "mantle_openai_chat"` for diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md index a4206583c..ff4fa58e1 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 11.00/49.50; card read 2026-11-06) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 5.50/24.75; card read 2026-11-06) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 11.00/49.50; card read 2026-11-07) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 5.50/24.75; card read 2026-11-07) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md index a03f7de63..3e182e26c 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md @@ -436,7 +436,23 @@ must verify against Astra's model card per-feature, not assume parity with Sol/L switch, not model switch), it MUST also record `bedrock_models[].required_client_api` so the generated client uses a Guardrails-capable surface — `converse` for Astra and 6.1 Terra; `converse` / `chat_completions` / `invoke` (never `responses`) for 6.1 Sol and the other GPT-6/5.6 CRIS models except Astra and 6.1 Terra. Do not leave the client on `responses` when Guardrails is required.** `Responses` -stays the default for a region-only CRIS move with no Guardrails need. +stays the default for a region-only CRIS move with no Guardrails or application-inference-profile need. + +**Application inference profiles are Converse-only on GPT-5.5, GPT-5.4, GPT-6.1 Terra and Astra — +the requirement MUST reach `required_client_api`.** The GPT-5.4 / GPT-5.5 model cards (read 2026-11-07) +list "Application inference profiles (Converse API only; not supported with Responses or Chat +Completions APIs)" on `bedrock-runtime`. When application inference profiles (cost attribution by +app/environment) are the driving need and the design keeps `runtime_openai_cris`, record +`bedrock_models[].required_client_api: "converse"` for GPT-5.5 / GPT-5.4 and for any other model +whose card or catalog `runtime_converse` path entry lists the feature as Converse-only. Do not leave +the field absent or on `responses` / `chat_completions`: Generate defaults an absent field to +Responses and omits the application profile for an unsupported model/API pair, so the endpoint +switch alone does not deliver the feature. If the same workload also needs a Responses-only +feature on that model (GPT-5.5 / GPT-5.4: structured outputs, implicit prompt caching — see +`openai-on-bedrock.md` § Access Paths), one client API cannot serve both: record the conflict as an +explicit decision in the Part 5 plan and the Present Summary — name which feature the plan keeps +and which is dropped, or split the workload into two `bedrock_models[]` rows with their own +`required_client_api` — never silently drop either requirement. **GPT-6.1 Terra API constraints:** Guardrails and application inference profiles require `required_client_api: "converse"`. Converse rejects document blocks and images in tool @@ -520,6 +536,12 @@ Write `aws-design-ai.json` to `$MIGRATION_DIR/`. GPT-5.6, GPT-6, GPT-5.5 and GPT-5.4 MAY use `migration_path: "runtime_openai_cris"` on `bedrock-runtime` with a CRIS id (`us.`/`in.`/`global.` for GPT-5.6 Terra and Luna; `us.`/`global.` only for GPT-5.6 Sol, GPT-6, GPT-5.5 and GPT-5.4) — this is NOT a violation. +- [ ] Every `runtime_openai_cris` entry whose driving need includes application inference profiles, + on a model whose card lists them as Converse-only (GPT-5.5, GPT-5.4, GPT-6.1 Terra, Astra), + records `required_client_api: "converse"` — not absent, `responses` or `chat_completions`. + A same-workload Responses-only need (GPT-5.5 / GPT-5.4 structured outputs or implicit + caching) is recorded as an explicit decision in the Part 5 plan, not silently dropped. + A region-only CRIS move keeps the `responses` default. - [ ] `regional_warnings` is present (empty array `[]` if no issues; populated if any service unavailable in target region) - [ ] `multi_model_warnings` is present (empty array `[]` if single model or no coordination issues) - [ ] If `agentic_profile.is_agentic == true`: `agentic_design` object is present with `migration_approach` matching `preferences.json` diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md index 5fbeb17bc..5fa5c23ee 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-ai.md @@ -31,7 +31,7 @@ Check `preferences.json` → `ai_constraints.ai_framework` to determine the migr **OpenAI SDK users via Mantle (config path for a Responses source; small reshape for a Chat Completions source)** — `ai_framework` = `direct` AND `ai_source` = `openai` AND (`migration_path` **starts with** `mantle` (`mantle`, `mantle_openai_responses`, `mantle_openai_chat`) OR `migration_path` == `"runtime_openai_cris"`): - `mantle` / `mantle_openai_responses`: point the client at `https://bedrock-mantle.{region}.api.aws/openai/v1` — note the `openai/v1` segment for proprietary GPT models; a bare `/v1` 404s. Swap the credential for a Bedrock API key or the auto-refreshing token provider — **not** the existing OpenAI key. Update the model string to the bare Bedrock model ID (`openai.gpt-*` for a same-model move). Grant the `bedrock-mantle:*` actions; `bedrock:InvokeModel` does not authorize these models. -- `runtime_openai_cris` (GPT-5.6/GPT-6 via `bedrock-runtime` CRIS): point the client at `https://bedrock-runtime.{region}.amazonaws.com/openai/v1` instead — **not** the mantle URL. Update the model string to the `us.`/`in.`/`global.`-prefixed CRIS inference-profile ID, not the bare ID. Grant standard `bedrock:InvokeModel*` actions against the CRIS inference-profile ARN — **not** `bedrock-mantle:*`. For a GPT-6 CRIS id, also grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default` alongside the inference-profile ARN (per the GPT-6 model cards). Check `aws-design-ai.json` → `ai_architecture.bedrock_models[].required_client_api`: if non-Responses, emit that surface (e.g. Converse) instead of defaulting to `responses.create` — absent/`responses` keeps the Responses surface for a region-only move. +- `runtime_openai_cris` (GPT-5.6/GPT-6/GPT-5.5/GPT-5.4 via `bedrock-runtime` CRIS): point the client at `https://bedrock-runtime.{region}.amazonaws.com/openai/v1` instead — **not** the mantle URL. Update the model string to the CRIS inference-profile ID the selected model's card lists (`us.`/`global.`; `in.` exists for GPT-5.6 Terra and Luna only), not the bare ID. Grant standard `bedrock:InvokeModel*` actions against the CRIS inference-profile ARN — **not** `bedrock-mantle:*`. For a GPT-6 CRIS id, and for the GPT-5.5 / GPT-5.4 CRIS ids (`us.openai.gpt-5.5` / `global.openai.gpt-5.5`, `us.openai.gpt-5.4` / `global.openai.gpt-5.4`, or their `inference-profile/` ARNs), also grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default` alongside the inference-profile ARN (per the GPT-6 model cards and the GPT-5.5 / GPT-5.4 cards, read 2026-11-07); `iam_policy.py` emits this third ARN for exactly those ids. Check `aws-design-ai.json` → `ai_architecture.bedrock_models[].required_client_api`: if non-Responses, emit that surface (e.g. Converse) instead of defaulting to `responses.create` — absent/`responses` keeps the Responses surface for a region-only move. - **Config-only if the source already calls `responses.create`.** A Chat Completions source for GPT-6 or GPT-5.6 may keep `chat.completions.create`/`choices[0].message` parsing unchanged — Chat Completions is supported on both mantle and runtime CRIS for these models, so reshape to Responses is optional (only for a Responses-only feature or demonstrated constraint). GPT-5.5/GPT-5.4 follow the same rule — their model cards (read 2026-11-06) list Chat Completions on both mantle and runtime, so the reshape is optional for them too; probe the selected API against the target account before committing, as for any model. - Test in staging, validate responses diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-artifacts-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-artifacts-ai.md index c2303a9c2..9ef33ae64 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-artifacts-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/generate/generate-artifacts-ai.md @@ -209,7 +209,7 @@ Generate `ai-migration/setup_bedrock.sh`. - Dry-run by default (`--execute` flag to run for real) - Step 1 — Request model access: List each model from `aws-design-ai.json` → `bedrock_models[].aws_model_id` and the embedding model -- Step 2 — Create IAM role: Trust policy for the compute platform (Lambda, ECS, or EC2 based on `aws-design.json` if present). Match inference permissions to the selected endpoint. Mantle needs `bedrock-mantle:CreateInference` scoped to `arn:aws:bedrock-mantle:{region}:{account_id}:project/*`, plus `bedrock-mantle:CallWithBearerToken` on `*` when using bearer credentials. Runtime needs `bedrock:InvokeModel` / `bedrock:InvokeModelWithResponseStream` against the selected foundation-model ARN and, for CRIS, the exact inference-profile ARN. For GPT-6 CRIS, also grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default`. Runtime actions do not authorize Mantle. +- Step 2 — Create IAM role: Trust policy for the compute platform (Lambda, ECS, or EC2 based on `aws-design.json` if present). Match inference permissions to the selected endpoint. Mantle needs `bedrock-mantle:CreateInference` scoped to `arn:aws:bedrock-mantle:{region}:{account_id}:project/*`, plus `bedrock-mantle:CallWithBearerToken` on `*` when using bearer credentials. Runtime needs `bedrock:InvokeModel` / `bedrock:InvokeModelWithResponseStream` against the selected foundation-model ARN and, for CRIS, the exact inference-profile ARN. For GPT-6 CRIS, and for the GPT-5.5 / GPT-5.4 CRIS ids (`us.`/`global.openai.gpt-5.5`, `us.`/`global.openai.gpt-5.4`, or their `inference-profile/` ARNs — their cards, read 2026-11-07, require it "in addition to the inference profile"), also grant `bedrock:InvokeModel` on `arn:aws:bedrock:{region}:{account}:project/default`. A bare `openai.gpt-5.5` / `openai.gpt-5.4` id is a mantle target and gets no such grant. Runtime actions do not authorize Mantle. - If the runtime client uses `BEDROCK_INFERENCE_PROFILE_ARN` from the generated monitoring output, also authorize that exact `application-inference-profile/…` ARN, retaining the backing model/CRIS resources needed for the selected model and fallback. Resolve it from the same output used by the client; do not grant every application profile. Re-run setup after enabling or changing this override so the effective invocation target and IAM remain aligned. See [inference-profile IAM prerequisites](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-prereq.html). - Compliance carry-through: if `preferences.json` → `design_constraints.compliance` is set and not `none`/`unknown` (full-flow Q2 / AI-only Q1.5), the script and its printed notes MUST reflect the design's Step 0.7 constraints — `AWS_REGION` from the compliance-constrained region (GovCloud for fedramp, EU for gdpr), `eu.` inference-profile model IDs for gdpr, and for hipaa a printed warning that Bedrock invocation logs retain original content (KMS-encrypt + restrict IAM on the log group before enabling) - Step 3 — Print required environment variables: `AWS_REGION`, `AI_PROVIDER=bedrock`, model IDs diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md index 492bced1e..beaeb79b7 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md @@ -274,8 +274,13 @@ inference-option dimension:** So the honest cost statement is conditional, not flat: a same-model GPT-5.6 move on Global CRIS is **cost-neutral**; the same move in-region or Geo is **~10% more expensive**. The GPT-5.5 / GPT-5.4 cards publish -In-Region pricing only (no Geo/Global rows as of 2026-11-06), so quote ~10% for them on every inference option. The -same Global-CRIS-is-cost-neutral / in-Region-and-Geo-is-~10%-more pattern applies to the GPT-6 family below. +**commercial In-Region pricing only** (no Geo/Global rows as of 2026-11-07; the cards say "Commercial In-Region +prices include a 10% fee over OpenAI rates"), so for them the ~10% premium is verified for the In-Region (mantle) +option alone — nothing establishes a Geo (`us.`) or Global CRIS price. For a GPT-5.5 / GPT-5.4 CRIS plan, source the +Geo/Global rate separately (the card's inference-option table or the Bedrock pricing page, with URL and read date) +or report the comparison unavailable; an In-Region rate used as a proxy is an **unverified planning assumption**, +labelled as such, and must not be turned into a verified premium or savings percentage. Never report parity for +them. The same Global-CRIS-is-cost-neutral / in-Region-and-Geo-is-~10%-more pattern applies to the GPT-6 family below. Never state either number without stating the inference option it belongs to. ### GPT-6 Astra / Sol / Luna / 6.1 Sol — short context (≤272K) @@ -331,8 +336,10 @@ A workload above 272K context must be priced at the long-context tier. ### GPT-5.5 / GPT-5.4 — In-Region pricing only; short- and long-context tiers (model cards read 2026-11-06) -The cards publish only the In-Region inference option (the `us.` / `global.` runtime CRIS ids exist but carry no -separate price row). Long-context rates apply to all input and output tokens of a request above 272K input tokens. +The cards publish only the commercial In-Region inference option (the `us.` / `global.` runtime CRIS ids exist but +carry no separate price row). A `runtime_openai_cris` plan priced from this table is an unverified planning +assumption, not a verified rate — `bedrock_pricing.lookup()` returns `available: false` for these CRIS ids on +purpose. Long-context rates apply to all input and output tokens of a request above 272K input tokens. | Model | Short context ≤272K (in · cache read · out) | Long context >272K (in · cache read · out) | Notes | | ------- | ------------------------------------------- | ------------------------------------------ | ---------------------------------------- | diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md index 78fb426c0..3cc8e290f 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md @@ -43,9 +43,14 @@ Two consequences that invert the previous decision logic: CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on - `bedrock-runtime`, but their model cards (read 2026-11-06) publish In-Region pricing only, so quote the ~10% - figure for them on every inference option until a Global rate is published. See - `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, + `bedrock-runtime`, but their model cards (read 2026-11-07) publish **commercial In-Region prices only** + ("Commercial In-Region prices include a 10% fee over OpenAI rates") — nothing on either card establishes a + Geo or Global CRIS price. So the verified ~10% premium for GPT-5.5 / GPT-5.4 is scoped to the commercial + In-Region (mantle) option. For a GPT-5.5 / GPT-5.4 CRIS plan, either source the Geo/Global rate separately + (the card's inference-option table or [aws.amazon.com/bedrock/pricing](https://aws.amazon.com/bedrock/pricing/), + with URL and read date) or report the comparison unavailable; an In-Region rate used as a proxy is an + **unverified planning assumption**, labelled as such, and yields no verified premium or savings percentage. + Never report parity for them. See `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, prompt caching, one vendor relationship — carries the in-region path; never present that path as free or neutral. For Astra, use its separately dated Bedrock rates and verify the source provider's rate before comparing. @@ -74,8 +79,8 @@ GPT-5.4, the target is **the same model on Bedrock**. | GPT-5.6 Sol | GPT-5.6 Sol | `openai.gpt-5.6-sol` / `us.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Terra | GPT-5.6 Terra | `openai.gpt-5.6-terra` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Luna | GPT-5.6 Luna | `openai.gpt-5.6-luna` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | -| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | -| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | +| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | Then apply the **region gate** below. Record `model_change: false` and the chosen path in `aws-design-ai.json` → `ai_architecture.code_migration`: `migration_path: "mantle_openai_chat"` for diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md index a4206583c..ff4fa58e1 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 11.00/49.50; card read 2026-11-06) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 5.50/24.75; card read 2026-11-06) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 11.00/49.50; card read 2026-11-07) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 5.50/24.75; card read 2026-11-07) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py index 0ceaa4f1e..ce486b3ae 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/iam_policy.py @@ -61,8 +61,9 @@ def inference_profile_arn(model_id: str, region: str, account_id: str) -> str: def default_project_arn(region: str, account_id: str) -> str: """ARN for the default Bedrock project, scoped to the account/region. - Required alongside the inference-profile ARN for a GPT-6 CRIS id on - bedrock-runtime: every GPT-6 model card's "Call the model" section grants + Required alongside the inference-profile ARN for a GPT-6 CRIS id and for the + GPT-5.5 / GPT-5.4 CRIS ids on bedrock-runtime: every GPT-6 model card's "Call + the model" section, and the GPT-5.4 / GPT-5.5 cards (read 2026-11-07), grant `bedrock:InvokeModel` on both the inference-profile ARN and this ARN.""" return f"arn:{_partition(region)}:bedrock:{region}:{account_id}:project/default" @@ -77,6 +78,35 @@ def is_gpt6_cris_model(model_id: str) -> bool: return base_id.startswith("openai.gpt-6") +# The exact bedrock-runtime ids the GPT-5.4 / GPT-5.5 model cards list (read +# 2026-11-07: us. and global. only — no in. or in-region form). Both cards say the +# identity "also needs bedrock:InvokeModel on your account's default project +# (arn:aws:bedrock:{region}:{account-id}:project/default) in addition to the +# inference profile". +_GPT54_55_CRIS_IDS = frozenset({ + "us.openai.gpt-5.4", + "global.openai.gpt-5.4", + "us.openai.gpt-5.5", + "global.openai.gpt-5.5", +}) + + +def is_gpt54_55_cris_model(model_id: str) -> bool: + """True for exactly `us.`/`global.openai.gpt-5.4` / `-5.5`, as a short id or as + an `arn:...:inference-profile/` ARN. The bare `openai.gpt-5.4` / `-5.5` ids + (mantle) and every other model, GPT-5.6 CRIS ids included, do NOT match.""" + if not is_inference_profile(model_id): + return False + return model_id.rsplit("/", 1)[-1].lower() in _GPT54_55_CRIS_IDS + + +def requires_default_project_grant(model_id: str) -> bool: + """True when the model card for this runtime CRIS id requires + `bedrock:InvokeModel` on the default project ARN alongside the + inference-profile ARN: every GPT-6 CRIS id, and the GPT-5.5 / GPT-5.4 ones.""" + return is_gpt6_cris_model(model_id) or is_gpt54_55_cris_model(model_id) + + def generate_policy(model_ids: list[str], region: str, account_id: str) -> dict: """Build a scoped IAM policy covering exactly the given model IDs. @@ -102,11 +132,12 @@ def generate_policy(model_ids: list[str], region: str, account_id: str) -> dict: resources.append(inference_profile_arn(mid, region, account_id)) base_id = _GEO_PREFIX.sub("", mid.rsplit("/", 1)[-1]) resources.append(foundation_model_arn(base_id, region)) - # A GPT-6 CRIS id's model card "Call the model" section grants + # A GPT-6 CRIS id's model card "Call the model" section, and the + # GPT-5.5 / GPT-5.4 cards for their us./global. CRIS ids, grant # InvokeModel on the inference-profile ARN AND the default project # ARN — both are required, neither replaces the other. GPT-5.6 CRIS # ids and all other runtime targets keep the 2-ARN shape above. - if is_gpt6_cris_model(mid): + if requires_default_project_grant(mid): resources.append(default_project_arn(region, account_id)) else: resources.append(foundation_model_arn(mid, region)) diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py index 55161d2a7..71533c209 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_bedrock_pricing.py @@ -373,6 +373,29 @@ def test_all_five_proprietary_gpt_models_are_priced(): assert v["input_per_1k_usd"] > 0 and v["output_per_1k_usd"] > 0, mid +@pytest.mark.parametrize("model_id", [ + "us.openai.gpt-5.4", "global.openai.gpt-5.4", + "us.openai.gpt-5.5", "global.openai.gpt-5.5", + "arn:aws:bedrock:us-east-1:123456789012:inference-profile/us.openai.gpt-5.4", + "arn:aws:bedrock:us-east-1:123456789012:inference-profile/global.openai.gpt-5.5", +]) +def test_gpt54_55_cris_ids_are_unpriced_not_inferred_from_in_region(model_id, monkeypatch): + # PR 583 review: the GPT-5.4 / GPT-5.5 cards (read 2026-11-07) publish commercial + # In-Region prices only. Nothing establishes a Geo/Global CRIS rate, so a CRIS id + # must resolve to `available: false` — never to the bare In-Region row, and never + # via a live PriceList call that cannot carry these models. + import boto3 + + def boom(*a, **k): + raise AssertionError("must not call the PriceList API for a proprietary GPT CRIS id") + + monkeypatch.setattr(boto3, "client", boom) + v = bp.lookup("us-east-1", model_id) + assert v["available"] is False, model_id + assert v["input_per_1k_usd"] is None and v["output_per_1k_usd"] is None + assert "not in the static table" in v["note"] + + def test_all_four_gpt6_models_are_priced(): # Finding 4: GPT-6's bare ids previously had zero STATIC_FALLBACK entries, so # they fell through to the live Pricing API (which never carries OpenAI rows) diff --git a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py index b3f6449ab..bd1806ef2 100644 --- a/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py +++ b/plugins/aws-startup-advisor/skills/llm-to-bedrock/scripts/test_iam_policy.py @@ -12,10 +12,12 @@ foundation_model_arn, generate_policy, is_gpt6_cris_model, + is_gpt54_55_cris_model, is_mantle_model, mantle_project_arn, inference_profile_arn, is_inference_profile, + requires_default_project_grant, ) REGION = "us-east-1" @@ -267,3 +269,91 @@ def test_bare_gpt6_mantle_id_still_yields_no_invoke_model_statement(self): pol = generate_policy(["openai.gpt-6-sol"], REGION, ACCOUNT) sids = {s["Sid"] for s in pol["Statement"]} assert "BedrockInvokeModelScoped" not in sids + + +_GPT54_55_CRIS_SHORT_IDS = [ + "us.openai.gpt-5.4", + "global.openai.gpt-5.4", + "us.openai.gpt-5.5", + "global.openai.gpt-5.5", +] + + +class TestGpt54Gpt55CrisProjectArn: + """PR 583 review: the GPT-5.4 / GPT-5.5 model cards (read 2026-11-07, + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html + and ...-gpt-55.html) say the IAM identity "also needs bedrock:InvokeModel on + your account's default project ... in addition to the inference profile" for + their us./global. runtime ids. The grant must cover exactly those ids.""" + + @pytest.mark.parametrize("model_id", _GPT54_55_CRIS_SHORT_IDS) + def test_predicates_match_short_ids(self, model_id): + assert is_gpt54_55_cris_model(model_id) + assert requires_default_project_grant(model_id) + assert not is_gpt6_cris_model(model_id) + + @pytest.mark.parametrize("model_id", _GPT54_55_CRIS_SHORT_IDS) + def test_predicates_match_system_profile_arns(self, model_id): + arn = f"arn:aws:bedrock:{REGION}:{ACCOUNT}:inference-profile/{model_id}" + assert is_gpt54_55_cris_model(arn) + assert requires_default_project_grant(arn) + + @pytest.mark.parametrize( + "model_id", + [ + "openai.gpt-5.4", # bare — mantle, not CRIS + "openai.gpt-5.5", + "us.openai.gpt-5.6-sol", # GPT-5.6 cards do not add the grant + "global.openai.gpt-5.6-terra", + "us.openai.gpt-5.4-pro", # not a published runtime id + "us.anthropic.claude-sonnet-5", + f"arn:aws:bedrock:{REGION}:{ACCOUNT}:inference-profile/us.anthropic.claude-sonnet-5", + ], + ) + def test_predicates_exclude_bare_mantle_gpt56_and_unrelated_ids(self, model_id): + assert not is_gpt54_55_cris_model(model_id) + assert not requires_default_project_grant(model_id) + + @pytest.mark.parametrize("model_id", _GPT54_55_CRIS_SHORT_IDS) + def test_generate_policy_grants_project_default_for_short_id(self, model_id): + pol = generate_policy([model_id], REGION, ACCOUNT) + assert [s["Sid"] for s in pol["Statement"]] == ["BedrockInvokeModelScoped"] + base = model_id.split(".", 1)[1] + assert set(pol["Statement"][0]["Resource"]) == { + f"arn:aws:bedrock:*::foundation-model/{base}", + f"arn:aws:bedrock:{REGION}:{ACCOUNT}:inference-profile/{model_id}", + default_project_arn(REGION, ACCOUNT), + } + + @pytest.mark.parametrize("model_id", _GPT54_55_CRIS_SHORT_IDS) + def test_generate_policy_grants_project_default_for_profile_arn(self, model_id): + arn = f"arn:aws:bedrock:{REGION}:{ACCOUNT}:inference-profile/{model_id}" + pol = generate_policy([arn], REGION, ACCOUNT) + resources = pol["Statement"][0]["Resource"] + assert arn in resources + assert default_project_arn(REGION, ACCOUNT) in resources + + @pytest.mark.parametrize("model_id", ["openai.gpt-5.4", "openai.gpt-5.5"]) + def test_bare_mantle_id_gets_mantle_statements_and_no_project_default(self, model_id): + pol = generate_policy([model_id], REGION, ACCOUNT) + sids = {s["Sid"] for s in pol["Statement"]} + assert "BedrockInvokeModelScoped" not in sids + assert "BedrockMantleInference" in sids + assert default_project_arn(REGION, ACCOUNT) not in json.dumps(pol) + + @pytest.mark.parametrize( + "model_id", + ["us.anthropic.claude-sonnet-5", "us.openai.gpt-5.6-sol", "global.openai.gpt-5.6-luna"], + ) + def test_unrelated_runtime_ids_do_not_get_project_default(self, model_id): + pol = generate_policy([model_id], REGION, ACCOUNT) + resources = pol["Statement"][0]["Resource"] + assert default_project_arn(REGION, ACCOUNT) not in resources + assert len(resources) == 2 + + def test_mixed_run_adds_project_default_once(self): + pol = generate_policy( + ["us.openai.gpt-5.4", "us.anthropic.claude-sonnet-5"], REGION, ACCOUNT + ) + resources = pol["Statement"][0]["Resource"] + assert resources.count(default_project_arn(REGION, ACCOUNT)) == 1 diff --git a/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md index 78fb426c0..3cc8e290f 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md @@ -43,9 +43,14 @@ Two consequences that invert the previous decision logic: CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on - `bedrock-runtime`, but their model cards (read 2026-11-06) publish In-Region pricing only, so quote the ~10% - figure for them on every inference option until a Global rate is published. See - `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, + `bedrock-runtime`, but their model cards (read 2026-11-07) publish **commercial In-Region prices only** + ("Commercial In-Region prices include a 10% fee over OpenAI rates") — nothing on either card establishes a + Geo or Global CRIS price. So the verified ~10% premium for GPT-5.5 / GPT-5.4 is scoped to the commercial + In-Region (mantle) option. For a GPT-5.5 / GPT-5.4 CRIS plan, either source the Geo/Global rate separately + (the card's inference-option table or [aws.amazon.com/bedrock/pricing](https://aws.amazon.com/bedrock/pricing/), + with URL and read date) or report the comparison unavailable; an In-Region rate used as a proxy is an + **unverified planning assumption**, labelled as such, and yields no verified premium or savings percentage. + Never report parity for them. See `shared/openai-on-bedrock.md`. The non-cost case — AWS commitments, IAM/VPC/CloudTrail governance, residency, prompt caching, one vendor relationship — carries the in-region path; never present that path as free or neutral. For Astra, use its separately dated Bedrock rates and verify the source provider's rate before comparing. @@ -74,8 +79,8 @@ GPT-5.4, the target is **the same model on Bedrock**. | GPT-5.6 Sol | GPT-5.6 Sol | `openai.gpt-5.6-sol` / `us.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Terra | GPT-5.6 Terra | `openai.gpt-5.6-terra` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | | GPT-5.6 Luna | GPT-5.6 Luna | `openai.gpt-5.6-luna` / `us.` `in.` `global.` prefixed | `strong_migrate` — same model; parity on Global CRIS, else +10% | -| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | -| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model, ~10% over OpenAI std | +| GPT-5.5 | GPT-5.5 | `openai.gpt-5.5` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | +| GPT-5.4 | GPT-5.4 | `openai.gpt-5.4` / `us.` `global.` prefixed | `strong_migrate` — same model; ~10% over OpenAI std In-Region only (no Geo/Global price published) | Then apply the **region gate** below. Record `model_change: false` and the chosen path in `aws-design-ai.json` → `ai_architecture.code_migration`: `migration_path: "mantle_openai_chat"` for diff --git a/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md b/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md index a4206583c..ff4fa58e1 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/bedrock-pricing-cache.md @@ -133,8 +133,8 @@ See `vendored/ai/ai-model-lifecycle.md` for lifecycle details. **Do not recommen | GPT-5.6 Sol | openai.gpt-5.6-sol | OpenAI | 4.40 | 22.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 8.80/33.00) | | GPT-5.6 Terra | openai.gpt-5.6-terra | OpenAI | 2.20 | 13.20 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 4.40/19.80) | | GPT-5.6 Luna | openai.gpt-5.6-luna | OpenAI | 0.22 | 1.32 | 272K | fast | active (mantle in-region + runtime CRIS; 1M tier 0.44/1.98) | -| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (mantle in-region + runtime CRIS; 1M tier 11.00/49.50; card read 2026-11-06) | -| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (mantle in-region + runtime CRIS; 1M tier 5.50/24.75; card read 2026-11-06) | +| GPT-5.5 | openai.gpt-5.5 | OpenAI | 5.50 | 33.00 | 272K | frontier | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 11.00/49.50; card read 2026-11-07) | +| GPT-5.4 | openai.gpt-5.4 | OpenAI | 2.75 | 16.50 | 272K | flagship | active (commercial In-Region price; runtime us./global. CRIS ids exist but carry no published rate; 1M tier 5.50/24.75; card read 2026-11-07) | | Gemma 4 31B | google.gemma-4-31b | Google | 0.14 | 0.40 | 256K | mid | active (Mantle only) | | Gemma 4 26B-A4B | google.gemma-4-26b-a4b | Google | 0.13 | 0.40 | 256K | efficient | active (Mantle only) | | Gemma 4 E2B | google.gemma-4-e2b | Google | 0.04 | 0.08 | 128K | budget | active (Mantle only) | diff --git a/plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py b/plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py new file mode 100644 index 000000000..1ec8aa9dd --- /dev/null +++ b/plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py @@ -0,0 +1,164 @@ +"""Guards for the three PR 583 review findings on the GPT-5.4 / GPT-5.5 runtime path. + +Public model cards (read 2026-11-07): + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-54.html + https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-55.html + +1. IAM: on bedrock-runtime the identity "also needs bedrock:InvokeModel on your + account's default project (arn:aws:bedrock:{region}:{account-id}:project/default) + in addition to the inference profile". The setup recipes must say so for the + GPT-5.5 / GPT-5.4 CRIS ids, not only for GPT-6. +2. Application inference profiles are "Converse API only; not supported with + Responses or Chat Completions APIs". A Design that selects runtime_openai_cris + for that need must carry required_client_api: "converse" and surface a + conflicting Responses-only need as an explicit decision. +3. The cards publish commercial In-Region prices only. No file may infer a Geo or + Global CRIS price (or a premium / savings percentage) for GPT-5.4 / GPT-5.5 from + the In-Region row; an In-Region proxy is an unverified planning assumption. +""" +from __future__ import annotations + +import re +from pathlib import Path + +PLUGIN_ROOT = Path(__file__).resolve().parent.parent +SKILLS = PLUGIN_ROOT / "skills" +AGENTS = PLUGIN_ROOT / "agents" + +GCP_GENERATE_AI = SKILLS / "gcp-to-aws" / "references" / "phases" / "generate" / "generate-ai.md" +GCP_GENERATE_ARTIFACTS = SKILLS / "gcp-to-aws" / "references" / "phases" / "generate" / "generate-artifacts-ai.md" +AZURE_GENERATE_ARTIFACTS = SKILLS / "azure-to-aws" / "references" / "phases" / "generate" / "generate-artifacts-ai.md" +GCP_DESIGN_AI = SKILLS / "gcp-to-aws" / "references" / "phases" / "design" / "design-ai.md" +AZURE_DESIGN_AI = SKILLS / "azure-to-aws" / "references" / "phases" / "design" / "design-ai.md" +AZURE_SCHEMA = SKILLS / "azure-to-aws" / "references" / "shared" / "schema-design-aws-ai.md" +REPORT_GENERATOR = AGENTS / "llm2bedrock-report-generator.md" + +CANONICAL_GUIDE = SKILLS / "shared" / "ai" / "ai-openai-to-bedrock.md" +VENDORED_GUIDES = [ + SKILLS / "gcp-to-aws" / "references" / "vendored" / "ai" / "ai-openai-to-bedrock.md", + SKILLS / "azure-to-aws" / "references" / "vendored" / "ai" / "ai-openai-to-bedrock.md", +] +FACT_BASES = [ + SKILLS / "gcp-to-aws" / "references" / "shared" / "openai-on-bedrock.md", + SKILLS / "azure-to-aws" / "references" / "shared" / "openai-on-bedrock.md", +] + +_GPT_54_55 = re.compile(r"GPT-5\.[45]|gpt-5\.[45]", re.IGNORECASE) + + +def _windows(text: str, pattern: re.Pattern[str], radius: int = 700) -> list[str]: + return [text[max(0, m.start() - radius): m.end() + radius] for m in pattern.finditer(text)] + + +# --- Finding 1: default-project grant reaches the GPT-5.5 / GPT-5.4 CRIS ids --- + +def test_setup_recipes_grant_project_default_for_gpt54_55_cris_ids() -> None: + for path in (GCP_GENERATE_AI, GCP_GENERATE_ARTIFACTS, AZURE_GENERATE_ARTIFACTS, REPORT_GENERATOR): + text = path.read_text() + windows = _windows(text, re.compile(r"project/default")) + assert windows, f"{path}: no project/default grant sentence" + assert any(_GPT_54_55.search(w) and "global.openai.gpt-5." in w for w in windows), ( + f"{path}: the project/default grant must name the GPT-5.5 / GPT-5.4 " + "us./global. CRIS ids, not only GPT-6" + ) + # The grant is still a runtime-CRIS grant: the recipe must not hand it to bare mantle ids. + assert not re.search(r"bare `?openai\.gpt-5\.[45]`?[^.]*(gets|needs|requires) (the )?project/default", text), path + + +def test_no_recipe_still_scopes_project_default_to_gpt6_only() -> None: + gpt6_only = re.compile(r"For (a )?GPT-6 CRIS( id)?, (also )?grant `bedrock:InvokeModel` on `arn:aws:bedrock:\{region\}:\{account\}:project/default`\.") + for path in (GCP_GENERATE_AI, GCP_GENERATE_ARTIFACTS): + assert not gpt6_only.search(path.read_text()), f"{path}: project/default grant is still GPT-6-only" + + +# --- Finding 2: application inference profiles force required_client_api: "converse" --- + +_CONVERSE_FIELD = re.compile(r"required_client_api(`)?:?\s*`?\"?converse\"?") + + +def test_design_rule_requires_converse_for_application_profiles_on_gpt54_55() -> None: + for path in (GCP_DESIGN_AI, AZURE_DESIGN_AI, AZURE_SCHEMA): + text = path.read_text() + windows = [w for w in _windows(text, re.compile(r"application inference profiles", re.IGNORECASE)) + if _GPT_54_55.search(w) and _CONVERSE_FIELD.search(w)] + assert windows, ( + f"{path}: no rule ties application inference profiles on GPT-5.5 / GPT-5.4 " + "to required_client_api: \"converse\"" + ) + joined = " ".join(" ".join(w.split()) for w in windows) + assert re.search(r"Converse(-| )only|Converse API only", joined), path + # Generate's absent-field default and the unsupported-pair omission are the failure mode. + assert re.search(r"absent", joined), f"{path}: must forbid leaving required_client_api absent" + # A conflicting Responses-only need is a decision, not a silent drop. + assert re.search(r"explicit (design )?decision", joined), path + assert re.search(r"silent", joined), path + assert re.search(r"structured outputs", joined), path + + +def test_region_only_cris_move_keeps_responses_default() -> None: + for path in (GCP_DESIGN_AI, AZURE_DESIGN_AI, AZURE_SCHEMA): + text = path.read_text() + assert re.search(r"default[^.]*region-only|region-only[^.]*default", text), ( + f"{path}: the responses default for a region-only CRIS move must remain" + ) + + +def test_design_checklists_assert_the_application_profile_rule() -> None: + for path in (GCP_DESIGN_AI, AZURE_SCHEMA): + text = path.read_text() + checklist = text[text.index("## Validation Checklist"):] + item = [w for w in _windows(checklist, re.compile(r"application inference profiles"), 500) + if _CONVERSE_FIELD.search(w) and _GPT_54_55.search(w)] + assert item, f"{path}: Validation Checklist has no application-profile → converse item" + assert "explicit decision" in " ".join(item), path + + +# --- Finding 3: no Geo/Global CRIS price inferred from the In-Region row --- + +_INFERRED_CRIS_PRICE = re.compile( + r"(every inference option|until a Global rate is published|on every inference option)", + re.IGNORECASE, +) + + +def test_no_file_infers_a_cris_price_for_gpt54_55_from_in_region() -> None: + offenders = {} + for path in [CANONICAL_GUIDE, *VENDORED_GUIDES, *FACT_BASES, REPORT_GENERATOR]: + text = path.read_text() + hits = [m.group(0) for m in _INFERRED_CRIS_PRICE.finditer(text) + if _GPT_54_55.search(text[max(0, m.start() - 400): m.end() + 400])] + if hits: + offenders[str(path.relative_to(PLUGIN_ROOT))] = hits + assert not offenders, f"GPT-5.5 / GPT-5.4 CRIS price inferred from the In-Region row: {offenders}" + + +def test_premium_is_scoped_to_commercial_in_region_and_proxy_is_labelled() -> None: + for path in [CANONICAL_GUIDE, *VENDORED_GUIDES, *FACT_BASES, REPORT_GENERATOR]: + text = path.read_text() + windows = [" ".join(w.split()) for w in _windows(text, re.compile(r"In-Region\s+pric(?:es?|ing)\s+(?:only|include)", re.IGNORECASE)) + if _GPT_54_55.search(w)] + assert windows, f"{path}: no GPT-5.5 / GPT-5.4 In-Region-only pricing statement" + joined = " ".join(windows) + assert re.search(r"commercial In-Region", joined, re.IGNORECASE), path + assert re.search(r"Geo( \(`us\.`\))? or Global CRIS price|Geo/Global (rate|price|rows)", joined), path + assert "unverified planning assumption" in joined, path + assert re.search(r"(no|not .*?)(verified )?(premium or savings|premium|savings) percentage", joined), ( + f"{path}: a CRIS plan with only card prices must yield no verified premium/savings percentage" + ) + assert re.search(r"unavailable", joined), f"{path}: must allow reporting the comparison unavailable" + + +def test_tier0_table_scopes_gpt54_55_premium_to_in_region() -> None: + for path in [CANONICAL_GUIDE, *VENDORED_GUIDES]: + rows = [ + line for line in path.read_text().splitlines() + if (line.startswith("| GPT-5.5 ") or line.startswith("| GPT-5.4 ")) and "strong_migrate" in line + ] + assert len(rows) == 2, f"{path}: expected the two Tier 0 GPT-5.5 / GPT-5.4 rows, got {rows}" + for line in rows: + assert "In-Region only" in line and "no Geo/Global price published" in line, line + + +def test_vendored_guides_match_canonical() -> None: + for vendored in VENDORED_GUIDES: + assert vendored.read_bytes() == CANONICAL_GUIDE.read_bytes(), vendored From e39c59a3b00b3e1115a141abf47df4b17641c21e Mon Sep 17 00:00:00 2001 From: Logan Kleier Date: Sun, 8 Nov 2026 15:20:07 -0800 Subject: [PATCH 7/7] fix(aws-startup-advisor): scope the 1.10x Geo rate to GPT-5.6 GPT-5.4 and GPT-5.5 publish an In-Region price only, so a Geo or Global plan stays unpublished. Co-authored-by: Cursor --- .../phases/clarify/clarify-ai-only.md | 4 +-- .../references/shared/openai-on-bedrock.md | 2 +- .../vendored/ai/ai-openai-to-bedrock.md | 2 +- .../phases/clarify/clarify-ai-only.md | 4 +-- .../phases/clarify/clarify-ai-only.md | 4 +-- .../references/shared/openai-on-bedrock.md | 2 +- .../vendored/ai/ai-openai-to-bedrock.md | 2 +- .../skills/shared/ai/ai-openai-to-bedrock.md | 2 +- .../test_gpt54_55_runtime_review_round3.py | 29 +++++++++++++++++++ 9 files changed, 40 insertions(+), 11 deletions(-) diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md index 760e5e5bb..2c3908516 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/phases/clarify/clarify-ai-only.md @@ -119,8 +119,8 @@ running). → `ai_constraints.cross_cloud`. Default `"latency-acceptable"`. | GPT-6 (Astra/Sol/Luna) / GPT-6.1 Sol | **Same model on Bedrock** | ~10% over OpenAI std (data-residency tier); Astra/6.1 Sol also support Ultrafast (6x) | | GPT-6.1 Terra | **Same model on Bedrock** | Use the model-specific endpoint and context-tier prices in `references/shared/openai-on-bedrock.md`; compare against measured source spend or verified source rates. | | GPT-5.6 (Sol/Terra/Luna) | **Same model on Bedrock** | ~10% over OpenAI std (data-residency tier) | -| GPT-5.5 | **Same model on Bedrock** | ~10% over std | -| GPT-5.4 | **Same model on Bedrock** | ~10% over std | +| GPT-5.5 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | +| GPT-5.4 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | | GPT-4o | GPT-5.6 Terra; or Claude Sonnet 5 | not on Bedrock — offer both | | GPT-4 / 4 Turbo | GPT-5.6 Terra; or Sonnet 5 | not on Bedrock — offer both | | GPT-4.1 / mini / nano | GPT-5.6 Terra/Luna; or Nova Lite/Micro | not on Bedrock — offer both | diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md index 86c2781ab..ffe3ec488 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/shared/openai-on-bedrock.md @@ -263,7 +263,7 @@ for these models). Sol rates reflect the Aug 21, 2026 reduction (−20% input / the AWS What's New announcement lists as promotional through at least Nov 21, 2026. **Pricing now has an inference-option dimension:** -- **GPT-5.x In-Region and Geo CRIS: 1.10x OpenAI's standard list price** (parity with OpenAI's _data residency_ tier). +- **GPT-5.6 In-Region and Geo CRIS: 1.10x OpenAI's standard list price** (parity with OpenAI's _data residency_ tier). - **Global CRIS: OpenAI's standard list price** — cost parity for the recorded GPT-5.6 rates, and only when the workload has no data-residency constraint. diff --git a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md index 3cc8e290f..dba311abf 100644 --- a/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/azure-to-aws/references/vendored/ai/ai-openai-to-bedrock.md @@ -39,7 +39,7 @@ Two consequences that invert the previous decision logic: 1. **When the source model is on Bedrock, keep it.** A same-model move has no behavior delta to validate, no prompt re-engineering, and no eval regression risk — the migration is an endpoint and credential change, not a model change. This is the default recommendation. -2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.x In-Region and Geo +2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.6 In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on diff --git a/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md b/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md index 1b5c2c4e5..7dd9876fb 100644 --- a/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md +++ b/plugins/aws-startup-advisor/skills/bedrock-migration-assessment/references/phases/clarify/clarify-ai-only.md @@ -211,8 +211,8 @@ _Skip when:_ the validator summary reports `models_extractable: true` — every | GPT-6/6.1 (Astra/Sol/Luna) | **Same model on Bedrock** | ~10% over OpenAI std (DR tier); Astra/6.1 Sol also support Ultrafast | | GPT-6.1 Terra | **Same model on Bedrock** | Use the model-specific endpoint and context-tier prices in the [GPT-6.1 Terra model card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-6-1-terra.html); compare against measured source spend or verified source rates. | | GPT-5.6 (any) | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | -| GPT-5.5 | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | -| GPT-5.4 | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | +| GPT-5.5 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | +| GPT-5.4 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | | GPT-3.5 Turbo | GPT-5.6 Luna; or Claude Haiku 5.5 | At equal billed volumes and 2:1 input/output, Haiku US Geo is 56.25% cheaper up to 100K prompt tokens; Luna is 54.29% cheaper above 100K while Luna remains within 272K. Recount target tokens; if request size is unknown, present both Haiku tiers. | | GPT-4/4 Turbo | GPT-5.6 Terra; or Sonnet 5 | Not on Bedrock — offer both | | GPT-4o | GPT-5.6 Terra; or Sonnet 5 | Not on Bedrock — offer both | diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md index 8634efdc5..bbf691b8c 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md @@ -190,8 +190,8 @@ _Skip when:_ `models[].model_id` is populated in `ai-workload-profile.json` **wi | GPT-6/6.1 (Astra/Sol/Luna) | **Same model on Bedrock** | ~10% over OpenAI std (DR tier); Astra/6.1 Sol also support Ultrafast | | GPT-6.1 Terra | **Same model on Bedrock** | Use the model-specific endpoint and context-tier prices in `references/shared/openai-on-bedrock.md`; compare against measured source spend or verified source rates. | | GPT-5.6 (any) | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | -| GPT-5.5 | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | -| GPT-5.4 | **Same model on Bedrock** | ~10% over OpenAI std (DR tier) | +| GPT-5.5 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | +| GPT-5.4 | **Same model on Bedrock** | In-Region (mantle) ~10% over OpenAI std; no Geo or Global price published | | GPT-3.5 Turbo | GPT-5.6 Luna; or Claude Haiku 5.5 | At equal billed volumes and 2:1 input/output, Haiku US Geo is 56.25% cheaper up to 100K prompt tokens; Luna is 54.29% cheaper above 100K while Luna remains within 272K. Recount target tokens; if request size is unknown, present both Haiku tiers. | | GPT-4/4 Turbo | GPT-5.6 Terra; or Sonnet 5 | Not on Bedrock — offer both | | GPT-4o | GPT-5.6 Terra; or Sonnet 5 | Not on Bedrock — offer both | diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md index beaeb79b7..b669556ad 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/shared/openai-on-bedrock.md @@ -268,7 +268,7 @@ for these models). Sol rates reflect the Aug 21, 2026 reduction (−20% input / the AWS What's New announcement lists as promotional through at least Nov 21, 2026. **Pricing now has an inference-option dimension:** -- **GPT-5.x In-Region and Geo CRIS: 1.10x OpenAI's standard list price** (parity with OpenAI's _data residency_ tier). +- **GPT-5.6 In-Region and Geo CRIS: 1.10x OpenAI's standard list price** (parity with OpenAI's _data residency_ tier). - **Global CRIS: OpenAI's standard list price** — cost parity for the GPT-5.6 rates verified above, and only when the workload has no data-residency constraint. diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md index 3cc8e290f..dba311abf 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/vendored/ai/ai-openai-to-bedrock.md @@ -39,7 +39,7 @@ Two consequences that invert the previous decision logic: 1. **When the source model is on Bedrock, keep it.** A same-model move has no behavior delta to validate, no prompt re-engineering, and no eval regression risk — the migration is an endpoint and credential change, not a model change. This is the default recommendation. -2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.x In-Region and Geo +2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.6 In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on diff --git a/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md b/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md index 3cc8e290f..dba311abf 100644 --- a/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md +++ b/plugins/aws-startup-advisor/skills/shared/ai/ai-openai-to-bedrock.md @@ -39,7 +39,7 @@ Two consequences that invert the previous decision logic: 1. **When the source model is on Bedrock, keep it.** A same-model move has no behavior delta to validate, no prompt re-engineering, and no eval regression risk — the migration is an endpoint and credential change, not a model change. This is the default recommendation. -2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.x In-Region and Geo +2. **The cost of a same-model move depends on the inference option — state it conditionally.** GPT-5.6 In-Region and Geo CRIS are priced at OpenAI's _data residency_ tier, exactly 1.10x the standard list price, so those moves cost ~10% more. **GPT-5.6 on Global CRIS is priced at the standard list price — cost parity** — available only when the workload has no data-residency constraint. GPT-5.5 / GPT-5.4 also have `us.`/`global.` CRIS ids on diff --git a/plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py b/plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py index 1ec8aa9dd..e45e852fe 100644 --- a/plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py +++ b/plugins/aws-startup-advisor/tests/test_gpt54_55_runtime_review_round3.py @@ -121,6 +121,35 @@ def test_design_checklists_assert_the_application_profile_rule() -> None: ) +def test_the_1_10x_geo_rate_names_gpt56_not_the_gpt5x_family() -> None: + """The GPT-5.4 and GPT-5.5 cards publish no Geo or Global price. A GPT-5.x + In-Region-and-Geo 1.10x bullet would price those CRIS ids at the In-Region rate. + """ + for path in [CANONICAL_GUIDE, *VENDORED_GUIDES, *FACT_BASES]: + text = path.read_text() + assert "GPT-5.x In-Region and Geo" not in text, path + assert "GPT-5.6 In-Region and Geo" in text, path + + +CLARIFY_AI_ONLY = [ + SKILLS / "gcp-to-aws" / "references" / "phases" / "clarify" / "clarify-ai-only.md", + SKILLS / "azure-to-aws" / "references" / "phases" / "clarify" / "clarify-ai-only.md", + SKILLS / "bedrock-migration-assessment" / "references" / "phases" / "clarify" / "clarify-ai-only.md", +] + + +def test_clarify_ai_only_scopes_the_gpt54_55_premium_to_in_region() -> None: + for path in CLARIFY_AI_ONLY: + rows = [ + line for line in path.read_text().splitlines() + if re.match(r"\| GPT-5\.5\s+\|", line) or re.match(r"\| GPT-5\.4\s+\|", line) + ] + assert len(rows) == 2, f"{path}: expected two GPT-5.5 / GPT-5.4 rows, got {rows}" + for line in rows: + assert "In-Region (mantle)" in line, line + assert "no Geo or Global price published" in line, line + + def test_no_file_infers_a_cris_price_for_gpt54_55_from_in_region() -> None: offenders = {} for path in [CANONICAL_GUIDE, *VENDORED_GUIDES, *FACT_BASES, REPORT_GENERATOR]: