Stacked on #22 (P-a). Base is feature/p1-provider-registry. Merge #22 first; this PR then retargets to develop.
AWS Bedrock: new module qbit-assistant-provider-bedrock
Runs Claude through anthropic-java's Bedrock backend, so AnthropicMapping, streaming, strict handling and the error mapping are shared with the Anthropic adapter (AnthropicModelProvider.Builder.client(...)).
Credentials: the server's AWS default credential chain (environment, profile, ECS/EKS Pod Identity). Nothing is stored. A key reference on the row is a validation error. IRSA (web identity) needs the host to add software.amazon.awssdk:sts; this is documented, not bundled.
Region and endpoint:region is required. A base URL override (VPC endpoint) must be allow-listed, and it is still SigV4-signed.
Models: discovery returns the static model list. Listing foundation models would need the control-plane SDK, which is not added.
Google Vertex: new module qbit-assistant-provider-vertex
Routing by model id:claude-* goes through anthropic-java's Vertex backend (:streamRawPredict). Gemini goes through Vertex's OpenAI-compatible endpoint with a Google ADC bearer token that is refreshed when it expires, reusing the P-a adapter, never strict, model sent as google/<id>.
Settings:region and the new cloud_project column are required. Credentials are ADC, and nothing is stored.
hipaa_eligible stays an admin-recorded fact for both: a BAA is an owner and legal step.
Tests
172 in total, all green in ./mvnw verify, with the per-module JaCoCo gates.
Module
Tests
Instructions
Classes
core
100
87%
99%
anthropic
15
87%
100%
openai
43
95%
100%
bedrock
6
100%
100%
vertex
8
92%
100%
Bedrock: a localhost mock of invoke-with-response-stream speaking the AWS event-stream binary framing (prelude, headers, CRC32) with base64 chunk payloads. It checks the SigV4 Authorization, the path, the body the SDK really sends, streamed text, a tool call, usage, and 403, 429 and 500.
Vertex Claude: a :streamRawPredict mock. It checks the bearer, anthropic_version: vertex-2023-10-16, streaming and tools.
Vertex Gemini: an OpenAI-compatible mock. It checks the path, the google/ prefix, that a refreshed bearer token is used on the next call, and that strict is never sent.
Validation: region and project are required, key references are rejected, and unlisted URLs are rejected.
Golden turn: one golden tool round trip per module.
## P-b: AWS Bedrock and Google Vertex adapters
**Stacked on #22 (P-a).** Base is `feature/p1-provider-registry`. Merge #22 first; this PR then retargets to `develop`.
### AWS Bedrock: new module `qbit-assistant-provider-bedrock`
- Runs Claude through anthropic-java's Bedrock backend, so `AnthropicMapping`, streaming, strict handling and the error mapping are shared with the Anthropic adapter (`AnthropicModelProvider.Builder.client(...)`).
- **Credentials:** the server's AWS default credential chain (environment, profile, ECS/EKS Pod Identity). Nothing is stored. A key reference on the row is a validation error. IRSA (web identity) needs the host to add `software.amazon.awssdk:sts`; this is documented, not bundled.
- **Region and endpoint:** `region` is required. A base URL override (VPC endpoint) must be allow-listed, and it is still SigV4-signed.
- **Models:** discovery returns the static model list. Listing foundation models would need the control-plane SDK, which is not added.
### Google Vertex: new module `qbit-assistant-provider-vertex`
- **Routing by model id:** `claude-*` goes through anthropic-java's Vertex backend (`:streamRawPredict`). Gemini goes through Vertex's OpenAI-compatible endpoint with a Google ADC bearer token that is refreshed when it expires, reusing the P-a adapter, never strict, model sent as `google/<id>`.
- **Settings:** `region` and the new `cloud_project` column are required. Credentials are ADC, and nothing is stored.
`hipaa_eligible` stays an admin-recorded fact for both: a BAA is an owner and legal step.
### Tests
172 in total, all green in `./mvnw verify`, with the per-module JaCoCo gates.
| Module | Tests | Instructions | Classes |
|---|---:|---:|---:|
| core | 100 | 87% | 99% |
| anthropic | 15 | 87% | 100% |
| openai | 43 | 95% | 100% |
| bedrock | 6 | 100% | 100% |
| vertex | 8 | 92% | 100% |
- **Bedrock:** a localhost mock of `invoke-with-response-stream` speaking the AWS event-stream binary framing (prelude, headers, CRC32) with base64 chunk payloads. It checks the SigV4 `Authorization`, the path, the body the SDK really sends, streamed text, a tool call, usage, and 403, 429 and 500.
- **Vertex Claude:** a `:streamRawPredict` mock. It checks the bearer, `anthropic_version: vertex-2023-10-16`, streaming and tools.
- **Vertex Gemini:** an OpenAI-compatible mock. It checks the path, the `google/` prefix, that a refreshed bearer token is used on the next call, and that `strict` is never sent.
- **Validation:** region and project are required, key references are rejected, and unlisted URLs are rejected.
- **Golden turn:** one golden tool round trip per module.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
P-b: AWS Bedrock and Google Vertex adapters
Stacked on #22 (P-a). Base is
feature/p1-provider-registry. Merge #22 first; this PR then retargets todevelop.AWS Bedrock: new module
qbit-assistant-provider-bedrockAnthropicMapping, streaming, strict handling and the error mapping are shared with the Anthropic adapter (AnthropicModelProvider.Builder.client(...)).software.amazon.awssdk:sts; this is documented, not bundled.regionis required. A base URL override (VPC endpoint) must be allow-listed, and it is still SigV4-signed.Google Vertex: new module
qbit-assistant-provider-vertexclaude-*goes through anthropic-java's Vertex backend (:streamRawPredict). Gemini goes through Vertex's OpenAI-compatible endpoint with a Google ADC bearer token that is refreshed when it expires, reusing the P-a adapter, never strict, model sent asgoogle/<id>.regionand the newcloud_projectcolumn are required. Credentials are ADC, and nothing is stored.hipaa_eligiblestays an admin-recorded fact for both: a BAA is an owner and legal step.Tests
172 in total, all green in
./mvnw verify, with the per-module JaCoCo gates.invoke-with-response-streamspeaking the AWS event-stream binary framing (prelude, headers, CRC32) with base64 chunk payloads. It checks the SigV4Authorization, the path, the body the SDK really sends, streamed text, a tool call, usage, and 403, 429 and 500.:streamRawPredictmock. It checks the bearer,anthropic_version: vertex-2023-10-16, streaming and tools.google/prefix, that a refreshed bearer token is used on the next call, and thatstrictis never sent.🤖 Generated with Claude Code