P1 [CRF-1] The update handler validates the incoming patch instead of the merged settings, so a PATCH that omits base_url skips bedrock validation entirely and persists the exact invalid row this PR exists to prevent. (Netero)

mergeAIProviderSettings (ai_providers.go:834) replaces the stored bedrock blob wholesale: only AccessKey, AccessKeySecret and ExternalID are carried forward. Model and SmallFastModel are not, so a patch that omits them clears them. The new guard is gated on req.BaseURL != nil, so that patch never reaches ValidationErrors().

Reproduced against head: create a valid invoke-model bedrock provider, then

client.UpdateAIProvider(ctx, name, codersdk.UpdateAIProviderRequest{
    Settings: &codersdk.AIProviderSettings{
        Bedrock: &codersdk.AIProviderBedrockSettings{Region: "us-west-2"},
    },
})

returns 200 and the stored row reads model="" small_fast_model="". At startup that row fails runtimeCfg.Validate() with model required and never enters the route table, which is the "silently skipped, every chat 404s" failure in the PR description.

The comment's justification ("we cannot evaluate the mantle base_url rule without a DB read") only covers one rule but the code skips all four. The DB read is already happening: old is loaded at ai_providers.go:356 and the merge result is in existing at :372.

Validate after the merge, inside the transaction, against ptr.NilToDefault(req.BaseURL, old.BaseUrl). That also removes the requirement that callers resend fields they are not changing.

🤖

P2 [CRF-2] Gating validation on BedrockConfigFromSettings returning ok means a patch that clears every load-bearing field escapes validation, because IsConfigured() is false for the cleared blob. (Netero)

IsConfigured() (codersdk/aiproviders_bedrock.go:86) is true only for region, role ARN, or access keys. A PATCH carrying base_url plus bedrock: {} therefore yields ok=false, no validation runs, and the merge wipes the stored row.

Reproduced against head: PATCH with BaseURL set and Settings.Bedrock = &codersdk.AIProviderBedrockSettings{} returns 200 and the stored row reads region="" model="" small_fast_model="". Same runtime consequence as CRF-1: a type=bedrock row that buildProvider refuses.

The gate is protecting a different case (a type=anthropic provider carrying an unconfigured bedrock blob). Validating the merged result narrows it correctly: after the merge, a bedrock-typed row must satisfy the bedrock rules regardless of what the patch contained.

🤖

P2 [CRF-3] Deleting validateAIProviderBedrockMantleRegion drops the mantle-requires-region check for any request where IsConfigured() is false, with no replacement and no test. (Netero)

The replacement path only runs when BedrockConfigFromSettings reports configured, and a mantle blob that sets nothing but protocol is not configured.

Reproduced against head: creating type=anthropic, base_url=https://bedrock-mantle.us-east-1.api.aws/anthropic, settings.bedrock={protocol: "mantle"} returns 201. At base this was a 400 on settings.region, asserted by the deleted test TestAIProviderRequest_ValidateBedrockMantle/MantleRequiresRegion.

The operator asks for mantle, gets a stored provider that the runtime serves as a plain bearer-token Anthropic provider (bedrock == nil at cli/aibridged.go:285), and no error anywhere.

grep -rn mantle --include=*_test.go coderd/ codersdk/ cli/ leaves BedrockMantleMissingBaseURLRejected as the only mantle create test; nothing covers mantle without a region. Deleting a test alongside the check it guarded removes the signal that would have caught this.

🤖

P2 [CRF-4] The new seed guard misses base-URL-only bedrock providers, because the seed decides a provider is bedrock with codersdk.IsBedrockConfigured (base URL counts) while the guard gates on BedrockConfigFromSettings (base URL does not count). (Netero)

isBedrock = codersdk.IsBedrockConfigured(p.BedrockBaseURL, bedrock) at ai_providers_migrate.go:409 sets dp.Bedrock when only BedrockBaseURL is present. The guard then calls BedrockConfigFromSettings, which gates on IsConfigured(), gets ok=false, and continues.

Reproduced against head on postgres: seeding AIProviderConfig{Type: "bedrock", Name: "baseurl-only", BedrockBaseURL: "https://bedrock-runtime.us-east-1.amazonaws.com"} returns no error and persists settings={"_type":"bedrock","_version":1}. No model, no small fast model, so buildProvider refuses the row and every chat routed at it 404s: the class the guard's own comment claims to close.

This also contradicts the contract documented on IsBedrockConfigured (codersdk/aiproviders_bedrock.go:122-129): "the seed, the runtime config builder, and the legacy validator must all agree on what counts as a Bedrock provider." Gate the guard on the same predicate the seed used: dp.Bedrock != nil is already the loop condition, so drop the ok early-continue and validate the converted config.

🤖

P3 [CRF-5] Validate re-derives "unknown protocol" by excluding two named constants, so the protocol list now lives in two places and a third protocol added to ValidationErrors will be reported as unknown. (Netero)

The old switch had a default arm, so the list existed once. Now ValidationErrors() enumerates the known protocols and Validate() repeats them in a negated condition. Add BedrockProtocolFoo with a case in ValidationErrors() and a valid Foo config fails Validate() with unknown bedrock protocol: "foo".

Keep one enumeration: a knownProtocol() bool helper with the same switch, or have ValidationErrors report the unknown protocol as a FieldError{Field: "protocol"} and let Validate stop special-casing it. A PR whose thesis is single source of truth should not split an enumeration in the process.

🤖

Nit [CRF-7] cdaibridge is a third alias for coderd/aibridge in a tree that already standardized on agplaibridge for this exact collision. (Netero)

grep -rn 'coder/v2/coderd/aibridge"' shows agplaibridge in coderd/aibridged.go:13, coderd/aibridged/http.go:14, cli/aibridged.go:17, and unaliased everywhere the aibridge name is free.

This PR uses agplaibridge in cli/aibridged.go and cdaibridge here. Use agplaibridge in both.

🤖

Nit [CRF-8] cfg, ok := cdaibridge.BedrockConfigFromSettings(...) shadows the cfg codersdk.AIBridgeConfig parameter of providersFromEnv. (Netero)

Rename the local to bedrockCfg, which is what cli/aibridged.go:285 calls it.

🤖

Nit [CRF-9] The validation loop ranges over the out map, so with two invalid bedrock providers the returned error names an arbitrary one, immediately above the comment that establishes deterministic ordering for exactly this reason. (Netero)

Fold the check into the sorted res loop below, or sort the names first. An operator who fixes the named provider and restarts should not be told about a different one at random.

🤖

Nit [CRF-10] The 8-line FieldError to codersdk.ValidationError mapping is duplicated verbatim in the create and update handlers. (Netero)

One helper (bedrockValidations(baseURL string, s *codersdk.AIProviderBedrockSettings) []codersdk.ValidationError) removes the copy and gives the two handlers a single place to stay consistent.

Relevant given that the two copies already differ in their guard conditions.

That divergence is CRF-1 and CRF-2. The helper is also where the settings. prefix decision Copilot flagged should live, so the field-path fix lands in one place.

🤖

Note [CRF-11] BedrockConfigFromSettings has no test in its own package. (Netero)

It is exercised indirectly by cli/aibridged_internal_test.go (three ok=false cases, one full-mapping case) and by the coderd handler tests. That is adequate coverage of the mapping today; noting it because the drift guard discussed above belongs here, in the one package that can see both types.

No action needed on coverage alone. Raising it because CRF-6's real fix lands in this file.

🤖

I think it might be confusing to have two exported, very similar methods on the same struct:

• ValidationErrors
• Validate
  ?

Regarding a single source of truth and unification: the runtime validation may need to be stricter than the SDK validation, because runtime validation runs last, after AI Gateway has enriched the configuration from environment variables (see buildBedrockCredentials):

creds, resolvedRegion, err := buildBedrockCredentials(ctx, *bedrockCfg)
if err != nil {
	return nil, xerrors.Errorf("build bedrock credentials: %w", err)
}
runtimeCfg := *bedrockCfg
// resolvedRegion is bedrockCfg.Region if provided;
// otherwise, it is resolved from the environment via awsconfig.LoadDefaultConfig
if runtimeCfg.Region == "" {
	runtimeCfg.Region = resolvedRegion
}
if err := runtimeCfg.Validate(); err != nil {
	return nil, xerrors.Errorf("bedrock config: %w", err)
}

This PR seems fine, but it's worth keeping in mind.