The publisher listing answered only under v1beta1, and returned two
models — fewer than the catalog ships. That is what a publisher-global
list looks like rather than what a given project has enabled, and
per-project availability is most of why live discovery beats a static
catalogue. The project-scoped form was only tried under v1, which 404s
like every other v1 path here, so try it under the version that answers.
Also ask for all versions. A publisher model is addressed as
'<id>@<version>' on the rawPredict path while the plain listing reports
one versionId per model, so a model with several live versions would
have the rest silently hidden from a picker.
Report the version in the extracted id for the same reason: Vertex
splits the wire id across name and versionId, and a listing that showed
only the name would look usable without being so.
Management could populate the provider-config model picker from live
vendor data instead of the hand-curated catalog, which today carries
comments tracking which models a vendor retired on which date and which
cannot know what a particular account may actually invoke.
Whether that is a small feature or a large one turns on one unknown:
ListInferenceProfiles is a control-plane operation on
bedrock.<region>.amazonaws.com, while a provider record's upstream must
be bedrock-runtime.<region> for InvokeModel. Nothing documents whether a
Bedrock API key authorises the control plane, and if it does not, live
discovery for Bedrock needs SigV4 signing in management.
Probe each vendor directly — no proxy, no tunnel, no containers — under
the credential an operator would actually supply, and print a verdict
table. Bedrock gets three probes so the control-plane answer is read
against the runtime host we already know 404s, rather than as a lone
data point; Vertex gets three because which path serves the publisher
listing is itself part of the question. Vertex reuses the same JWT mint
and cloud-platform scope llm_router uses in production, so a result here
transfers.
No status code is asserted: the status is the finding. A probe fails
only when its credential is present and the request could not be made at
all, which is a broken probe rather than an answer.
Add a test_pattern dispatch input so this can run on its own in about a
minute instead of behind the sixteen-minute container suite. It reaches
the shell through an env var, since a dispatch input interpolated into a
run script is a script-injection seam.
mlsmaycon