Let explicit selectors route unverifiable ARNs to BedrockInvokeModel

invoke_model? consulted anthropic_model? before the selector, so an
application-inference-profile ARN with no provider_name metadata could
never route to InvokeModel — even when an Array or Proc selector opted
in explicitly. Since assume_model_exists chats carry no registry
metadata, every ARN-routed request fell back to Converse regardless of
the operator's configuration, and the refusal warning's own advice
("use an Array or Proc selector to opt in explicitly") was impossible
to follow.

Split vendor verification into two tiers: provably non-Anthropic ids
(known vendor prefixes, bare or cross-region) are never routed under
any selector; unverifiable ids (ARNs without metadata) route when an
Array or Proc opts in explicitly. Only the blanket true selector still
requires positive verification, since it expresses 'all Anthropic
models' rather than a specific opt-in.

Author: samuelboland

lib/ruby_llm/providers/bedrock.rb

@@ -127,26 +127,51 @@ def model_supports_top_k?(model)
       # Returns true if the InvokeModel protocol should be used for this model.
       # `bedrock_use_invoke_model` can be:
       #   - false / nil  → always Converse (default)
-      #   - true         → InvokeModel for all Anthropic models
+      #   - true         → InvokeModel for all verifiably Anthropic models
       #   - Array        → InvokeModel when model.id is in the list
       #   - Proc/lambda  → InvokeModel when the callable returns truthy for model
+      #
+      # Vendor verification interacts with the selector in two tiers:
+      #   - Ids that are provably non-Anthropic (a known vendor prefix like amazon./meta.,
+      #     with or without a cross-region geo prefix) are never routed, under any selector —
+      #     the InvokeModel payload is Anthropic Messages format and would be rejected.
+      #   - Ids that cannot be verified either way — chiefly application-inference-profile
+      #     ARNs, whose Model::Info carries no provider_name metadata on the
+      #     assume_model_exists path — are routed when the selector opts in explicitly
+      #     (Array or Proc). An operator naming the exact id IS the verification. Only the
+      #     blanket `true` selector requires positive verification via anthropic_model?,
+      #     because it expresses "all Anthropic models", not "this specific model".
       def invoke_model?(model)
         selector = @config.bedrock_use_invoke_model
         return false unless selector
-        return false unless anthropic_model?(model)
+        return false if non_anthropic_model?(model)
 
         case selector
         when true
-          true
+          anthropic_model?(model)
         when Array
           selector.include?(model.id)
         else
           selector.respond_to?(:call) ? selector.call(model) : false
         end
       end
 
-      NON_ANTHROPIC_PREFIXES = %w[amazon. meta. ai21. cohere. mistral. writer. stability.].freeze
-      private_constant :NON_ANTHROPIC_PREFIXES
+      NON_ANTHROPIC_VENDORS = %w[amazon meta ai21 cohere mistral writer stability].freeze
+      private_constant :NON_ANTHROPIC_VENDORS
+
+      # Matches known non-Anthropic vendor ids in both bare ("amazon.nova-pro-v1:0") and
+      # cross-region ("us.amazon.nova-pro-v1:0") forms.
+      NON_ANTHROPIC_PATTERN = /\A(?:[a-z0-9-]+\.)?(?:#{NON_ANTHROPIC_VENDORS.join('|')})\./
+      private_constant :NON_ANTHROPIC_PATTERN
+
+      # True only when the id provably belongs to a non-Anthropic vendor. ARNs return false:
+      # they don't encode the vendor, so they are "unverifiable", not "non-Anthropic".
+      def non_anthropic_model?(model)
+        id = model.id.to_s
+        return false if id.start_with?('arn:')
+
+        NON_ANTHROPIC_PATTERN.match?(id)
+      end
 
       def anthropic_model?(model)
         id = model.id.to_s
@@ -163,13 +188,15 @@ def anthropic_model?(model)
         # Application-inference-profile ARNs do not encode the underlying vendor in the ARN
         # string itself. When available, consult model.metadata[:provider_name] (populated
         # by Bedrock::Models for registered foundation models) to confirm the profile is
-        # Anthropic-backed. If that field is absent (e.g. a runtime-only ARN the registry
-        # has never seen), log a warning and refuse to route rather than silently forwarding
-        # an incompatible payload to a non-Anthropic model.
+        # Anthropic-backed. If that field is absent (e.g. an assume_model_exists chat, whose
+        # Model::Info carries no registry metadata), log a warning and refuse to route rather
+        # than silently forwarding an incompatible payload to a non-Anthropic model — the
+        # operator can still opt in explicitly via an Array or Proc selector (see
+        # invoke_model?).
         return arn_anthropic_model?(model, id) if id.start_with?('arn:')
 
         # Block known non-Anthropic Bedrock vendor prefixes (Nova, Llama, Jurassic, etc.).
-        return false if NON_ANTHROPIC_PREFIXES.any? { |pfx| id.start_with?(pfx) }
+        return false if NON_ANTHROPIC_PATTERN.match?(id)
 
         provider = model.respond_to?(:provider) ? model.provider : nil
         provider.to_s == 'anthropic'

spec/ruby_llm/providers/bedrock_spec.rb

@@ -235,6 +235,44 @@ def model_double(id, metadata: {}, provider: 'bedrock')
       end
     end
 
+    context 'with an unverifiable ARN id (no provider_name metadata)' do # rubocop:disable RSpec/MultipleMemoizedHelpers
+      before { allow(RubyLLM.logger).to receive(:warn) }
+
+      it 'routes to BedrockInvokeModel when an Array selector lists the ARN' do
+        provider = build_bedrock(use_invoke_model: [arn_id])
+        expect(provider.protocol_for(model_double(arn_id))).to be(RubyLLM::Protocols::BedrockInvokeModel)
+      end
+
+      it 'routes to BedrockInvokeModel when a Proc selector returns true' do
+        provider = build_bedrock(use_invoke_model: ->(_m) { true })
+        expect(provider.protocol_for(model_double(arn_id))).to be(RubyLLM::Protocols::BedrockInvokeModel)
+      end
+
+      it 'routes to Converse when a Proc selector returns false' do
+        provider = build_bedrock(use_invoke_model: ->(_m) { false })
+        expect(provider.protocol_for(model_double(arn_id))).to be(RubyLLM::Protocols::Converse)
+      end
+
+      it 'still requires positive verification under the blanket true selector' do
+        provider = build_bedrock(use_invoke_model: true)
+        expect(provider.protocol_for(model_double(arn_id))).to be(RubyLLM::Protocols::Converse)
+        expect(RubyLLM.logger).to have_received(:warn).with(/cannot verify.*Anthropic-backed/)
+      end
+    end
+
+    context 'with provably non-Anthropic ids under explicit selectors' do # rubocop:disable RSpec/MultipleMemoizedHelpers
+      it 'never routes a bare vendor id, even when an Array selector lists it' do
+        provider = build_bedrock(use_invoke_model: [nova_id])
+        expect(provider.protocol_for(model_double(nova_id))).to be(RubyLLM::Protocols::Converse)
+      end
+
+      it 'never routes a cross-region vendor id, even when a Proc selector returns true' do
+        provider = build_bedrock(use_invoke_model: ->(_m) { true })
+        expect(provider.protocol_for(model_double(us_nova_id))).to be(RubyLLM::Protocols::Converse)
+        expect(provider.protocol_for(model_double(llama_id))).to be(RubyLLM::Protocols::Converse)
+      end
+    end
+
     describe 'anthropic_model? directly' do # rubocop:disable RSpec/MultipleMemoizedHelpers
       let(:bedrock) { build_bedrock }