verify: upstream error envelopes for Bedrock, Gemini and Microsoft Foundry #302

What needs verifying

"Centralized Onboarding for Models and Providers" (Oct 2026) onboards Anthropic,
Gemini, Google EAP, Bedrock, Microsoft Foundry and custom models "once for use
across all Agent Fabric capability". Each provider's 4xx error envelope needs
capturing as it emerges from the proxy — and, critically, whether the proxy
normalises them or passes them through verbatim.

Why it blocks work

core/errors.py::_provider_error_object recognises exactly one envelope: the
upstream-passthrough shape {"error": {..object..}} carrying code / type /
param. Its docstring is explicit that a flat {"error": "<string>"} is an Anypoint
policy rejection and returns None.

classify() then routes any non-429 4xx with that nested object to
UpstreamRequestError, and anything else to a generic PolicyViolation.

Bedrock, Gemini and Foundry do not use the OpenAI envelope. Under the current
implementation their rejections fall through to the generic PolicyViolation
branch and get reported to the developer as gateway policy refusals — which is
precisely the confusion BG §1.2 exists to prevent, and worse than an untyped
error because it is confidently wrong. A developer would be told a governance
policy blocked their call when in fact they passed a bad parameter.

Done when

• One rejection fixture captured per onboarded provider, under python/tests/fixtures/anypoint/llm_proxy/.
• Confirmed whether the proxy normalises provider envelopes or passes them verbatim.
• Confirmed how a custom (self-onboarded) model's errors are shaped.
• docs/verified-apis.md rows added per provider.

Cross-surface impact

• core: errors.py (_provider_error_object, classify(), UpstreamRequestError).
• llm: model catalog naming, if onboarding changes how models are addressed.
• registry / tools / integrations: not affected.
• TypeScript parity (planned): flag — classify() is mirrored in the TS port.
• Provisioning CLI: not affected.
• Nextra docs site: errors.mdx refusal table.
• docs/verified-apis.md: new rows per provider.

Related

• llm/catalog: ModelHandle, resolve(), and an honest list_models() with no /models endpoint #19 — list_models() may become answerable once onboarding is centralised.
• verify: re-confirm the v1.11-v1.13 rejection contracts against current docs and a sandbox #253 — the existing re-confirmation of the v1.11–v1.13 rejection contracts.