fix(bedrock): improve authentication and Blue/Red support

[mldangelo-oai]

Summary

Native Amazon Bedrock scans could receive an unrelated ChatGPT account-access advisory, and AWS failures could lose diagnostic details or suggest the wrong authentication recovery. Bedrock scans now preserve provider diagnostics, give relevant authentication guidance, and support cost estimates and existing budget checks for both Daybreak Blue and Red.

Changes

• Keep ChatGPT account advisories out of native Bedrock Standard and Deep scans, including resumed scans, while preserving real inference failures.
• Distinguish expired credentials, model-access denial, and throttling in terminal and JSON output. Preserve diagnostics for AWS credentials and configured provider authentication commands.
• Recognize the exact Bedrock IDs openai.gpt-daybreak-blue-5.6-sol and openai.gpt-5.6-cyber at AWS Standard commercial in-region rates. Preserve Red's fractional-nanodollar cache-write price, including odd token counts. Blue retains its context-price range; Red has no invented long-context upper estimate.
• Document AWS profiles, temporary session credentials, region/model selection, model-specific access approval, local results versus hosted publication, and repeatable synthetic QA. No new commands, flags, or defaults.

Testing

• Live development-build QA used this wrapper with a patched native executable, the native Bedrock provider, an AWS profile, isolated state, and no OpenAI login or API key. Blue and Red each completed Standard and Deep scans with complete coverage. Each Deep scan reached convergence with three discovery workers and two reducers, all successful.
• Local viewing and SARIF export passed with cloud credentials removed. Actual parent/worker sessions used the selected model, provider, reasoning settings, and corrected metadata; recorded calls contained no account-advisory invocations or metadata fallback warnings. Independent pricing calculations matched recorded costs, including odd Red cache-write counts.
• One initial Red Standard run correctly returned exit 2 / partial coverage because an earlier duplicate candidate ID remained unresolved. A fresh run with the same binaries and settings completed with full coverage. This pre-existing candidate-reconciliation behavior is preserved and is not an AWS authentication or metadata failure. Finding validation in these scans was static; no runtime exploit test is claimed.
• Full SDK suites: seed 12345 and random seed 3649136333 each passed with 3,416 tests passed, 51 platform skips, zero failures, and 68,160 assertions across 158 files.
• Focused pricing/property and Blue/Red Standard/Deep budget-preflight tests, SDK types, formatting, and production build passed. Portable plugin Ruff/source checks and nine compatibility-script tests passed, as did MCP smoke and fresh/resumed discovery/reducer launch regressions.
• Three fresh independent native reviews plus a separate verifier passed on the final commit with no findings.

Risk and rollout

Inference continues to use native Codex authentication and transport. Enrollment and AWS provisioning for the chosen model remain required. Provisioned Bedrock inference and local results need no additional OpenAI CLI login. Hosted publication retains separate authentication requirements and was not tested.

The model-metadata correction must ship in a Codex release and then be included in the bundled dependency. This change does not claim the current bundled release contains that correction. Live QA with a patched native development executable is recorded separately from testing the bundled executable.

Pricing follows the AWS model cards for Blue and Red. Estimates and budget limits are not guaranteed AWS billing totals.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-02T07:15:32.076604Z	7f739d3	New commits
🔒 Security Review	✅ Completed 2026-10-02T07:15:42.773864Z	7f739d3	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.