lex-llm-bedrock 0.4.3 → 0.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05badbea355fec879dbd270070928472682c35d8709e3e6336e0080ca00aeb36
-  data.tar.gz: ec34813a7de565ad347c95777715054d27bd53ce71b04d8ddfd57de149852c9e
+  metadata.gz: 3aa9de1a3f3c07848fe253d6f8627c54b03bbc74bb96ab5032a407b109aad13a
+  data.tar.gz: a3f680546d15739bdfb84f79daa70a45beae2650893aead380e23b0e9086b38e
 SHA512:
-  metadata.gz: '073218f79b092a425703aa62f45b8d07d69afcf01d1249b66435fa4dce7211f74cbfab184e7df61f506f92c0ca4322d1d8448e6317ed5d52870d699ff42757e9'
-  data.tar.gz: 415524d66dcb863b18036935b15b7965996adb249d78779845b6f53679e22745b9316a438de386e490051cf7c46af6bc3264cf3db24d2b7517a7c5c4d49c9375
+  metadata.gz: 7b6ade385af00bbcd329278658f4fe829b312735f0141514353e4da0912d1002a9213cbd6f7411f4ba8dcad9dc9284adefe3518c17ff12297dd18d3f9db36d92
+  data.tar.gz: 0ffcee037a6efb318802b3ec1ad1684f0516ee133799dc420bd7a74883320c0c2029fc0df916757c5c4584386d4cc2f7cc5f5f8e7bfca46a8def152adfdb9e1f

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.4.4 - 2026-06-17
+
+### Fixed
+- **Model policy enforced at dispatch (compliance)** — Bedrock overrides the base dispatch methods (`chat`, `stream`, `embed`), so the base `enforce_model_allowed!` guard did not apply. Each override now calls `enforce_model_allowed!(model_id(model))`, raising `ModelNotAllowedError` before any Bedrock API call when the model is excluded by `model_whitelist`/`model_blacklist`. Fail-closed, no exceptions.
+
+### Changed
+- **Policy-aware default model** — the `anthropic.claude-sonnet-4` default is no longer a hardcoded literal forced via `||=`; it is a named `DEFAULT_MODEL` constant resolved through `Provider.policy_safe_default_model`, so a configured whitelist/blacklist is never overridden by the fallback. Requires lex-llm >= 0.5.4.
+
 ## 0.4.3 - 2026-06-16
 
 - Dependency updates and code quality improvements.

data/lex-llm-bedrock.gemspec

@@ -29,5 +29,5 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'legion-logging', '>= 1.3.2'
   spec.add_dependency 'legion-settings', '>= 1.3.14'
   spec.add_dependency 'legion-transport', '>= 1.4.14'
-  spec.add_dependency 'lex-llm', '>= 0.5.0'
+  spec.add_dependency 'lex-llm', '>= 0.5.4'
 end

data/lib/legion/extensions/llm/bedrock/provider.rb

@@ -225,6 +225,7 @@ module Legion
             thinking: nil,
             **_provider_options
           )
+            enforce_model_allowed!(model_id(model))
             log.info { "bedrock.provider.chat: model=#{model_id(model)} messages=#{messages.size}" }
 
             # Bedrock Converse API silently drops thinking config and tool_use blocks
@@ -311,6 +312,7 @@ module Legion
 
           def stream(messages:, model:, temperature: nil, max_tokens: nil, tools: {}, tool_prefs: nil, params: {},
                      thinking: nil, **_provider_options, &)
+            enforce_model_allowed!(model_id(model))
             log.info do
               "bedrock.provider.stream: model=#{model_id(model)} messages=#{messages.size} tools=#{tools.size}"
             end
@@ -368,6 +370,7 @@ module Legion
             **_provider_options
           )
             mid = model_id(model)
+            enforce_model_allowed!(mid)
             unless titan_embed?(mid)
               raise NotImplementedError,
                     "Bedrock embedding payload for #{mid} is not standardized"

data/lib/legion/extensions/llm/bedrock/version.rb

@@ -4,7 +4,7 @@ module Legion
   module Extensions
     module Llm
       module Bedrock
-        VERSION = '0.4.3'
+        VERSION = '0.4.4'
       end
     end
   end

data/lib/legion/extensions/llm/bedrock.rb

@@ -19,12 +19,16 @@ module Legion
         PROVIDER_FAMILY = :bedrock
 
         DEFAULT_REGION = 'us-east-2'
+        # Provider's preferred default when the operator configures none. Used only
+        # as a fallback and only when the configured model policy permits it
+        # (see resolve_default_model) — a whitelist/blacklist is never overridden.
+        DEFAULT_MODEL = 'anthropic.claude-sonnet-4'
 
         def self.default_settings
           ::Legion::Extensions::Llm.provider_settings(
             family: PROVIDER_FAMILY,
             instance: {
-              default_model: 'anthropic.claude-sonnet-4',
+              default_model: DEFAULT_MODEL,
               region: 'us-east-1',
               tier: :cloud,
               transport: :aws_sdk,
@@ -73,11 +77,20 @@ module Legion
                            .transform_values do |config|
             sanitized = sanitize_instance_config(config)
             sanitized[:capabilities] ||= DEFAULT_CAPABILITIES.dup
-            sanitized[:default_model] ||= 'anthropic.claude-sonnet-4'
+            sanitized[:default_model] = resolve_default_model(sanitized)
             sanitized
           end
         end
 
+        # Resolve a default_model that never violates the configured model policy
+        # (whitelist/blacklist stays authoritative over the DEFAULT_MODEL fallback).
+        def self.resolve_default_model(config)
+          provider_class.policy_safe_default_model(
+            configured: config[:default_model], fallback: DEFAULT_MODEL,
+            **provider_class.model_policy(config, PROVIDER_FAMILY)
+          )
+        end
+
         def self.unresolved_credential?(config)
           return false if config[:bedrock_profile]
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-llm-bedrock
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.4.4
 platform: ruby
 authors:
 - LegionIO
@@ -99,14 +99,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.5.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.5.4
 description: Amazon Bedrock provider integration for the LegionIO LLM routing framework.
 email:
 - matthewdiverson@gmail.com