feat(cdk): switch Bedrock inference profile to the global geo

[scottschreckengaust]

Child 6 of 6 — parent #741. Behavior change. Depends on #746 being deployed first.

Flips the geo from us to global. One context value + three default strings; revert is a one-line context change.

Blocked by

• refactor(cdk): bedrockGeoRegion context key (default us; template-identical) #746 — the bedrockGeoRegion plumbing must be deployed first, or the IAM grant won't cover inference-profile/global.anthropic.… and every task fails at turn 0 with AccessDenied.
• feat(agent): flip platform default model to us.anthropic.claude-opus-5 #745 recommended first, so Opus 5 is already proven in production on the us. profile and this change isolates the geo variable.

Verified prerequisites (us-east-1, acct 677276119483)

Profile	Status	InvokeModel
global.anthropic.claude-opus-5	ACTIVE	✅ 200
global.anthropic.claude-haiku-4-5-20251001-v1:0	ACTIVE	✅ 200

SDK path verified end-to-end with the pinned toolchain (claude-agent-sdk==0.2.110, bundled CLI 2.1.191): agent/scripts/diagnostics/test_sdk_smoke.py with ANTHROPIC_MODEL=global.anthropic.claude-opus-5 and ANTHROPIC_DEFAULT_HAIKU_MODEL=global.anthropic.claude-haiku-4-5-20251001-v1:0 returned status=success turns=1 in 3.6s. No SDK/CLI bump required.

Why global

global. routes to any supported commercial AWS Region, giving higher throughput and better resilience under peak demand than a US-only profile. That matters for a workload whose tasks run up to 8h and burst.

The tradeoff is data residency. A deployer with a residency requirement must keep a geo profile (us./eu./apac.) instead — which is why #746 made this a context key rather than a second hardcode. Document the tradeoff in the canonical section from #742: when to prefer global. (throughput/resilience) vs a geo profile (residency), and that the geo choice must match the deployment Region's entitlements.

There is prior art in-repo: .threat-composer/20260526-1924/config/config.json pins global.anthropic.claude-opus-4-6-v1.

Scope

File	Change
cdk/cdk.json	add context: { "bedrockGeoRegion": "global" } — the file currently has no context block
agent/src/config.py:563	ANTHROPIC_MODEL fallback → global.anthropic.claude-opus-5
agent/src/models.py:157	anthropic_model default → same
cli/src/repo-display.ts:48	PLATFORM_REPO_DEFAULTS.model_id → same
cdk/src/handlers/shared/workflows.ts:84	add global.anthropic.claude-opus-5 to WORKFLOW_MODEL_ALLOWLIST (#744 deliberately held this back)
docs	geo tradeoff subsection + documented default (#742 drift test will enforce)

ANTHROPIC_DEFAULT_HAIKU_MODEL needs no edit — #746 derives its prefix from the context key.

The generalized drift guard from #746 accepts the global. prefix; if it fails here, #746 is incomplete and this issue is blocked rather than the guard being wrong.

Rollback

Set bedrockGeoRegion back to us in cdk.json and redeploy; revert the three default strings. Because #746 keeps both geos' plumbing valid, rollback needs no code restructuring. The us. profile ARNs remain granted only if bedrockGeoRegion is us — so roll back context and defaults together, not independently.

Acceptance criteria

• refactor(cdk): bedrockGeoRegion context key (default us; template-identical) #746 confirmed deployed before merge
• cdk.json sets bedrockGeoRegion: "global"
• Three default strings updated to global.anthropic.claude-opus-5 in one commit
• global.anthropic.claude-opus-5 added to WORKFLOW_MODEL_ALLOWLIST
• cdk diff reviewed: inference-profile ARNs change us. → global.; foundation-model ARNs unchanged (already region: '*')
• Deployed smoke test on agentcore: one task completes end-to-end and opens a PR
• ECS / lambda-microvm verification is out of scope — CI deploys agentcore only (ALLOWED_COMPUTE_TYPES: "agentcore" in .github/workflows/build.yml + deploy.yml). ECS unit-test coverage still applies and must pass
• platform doctor passes its access probe against the global profile
• Docs updated with the global-vs-geo tradeoff and residency caveat; mise //docs:sync run
• Rollback rehearsed: -c bedrockGeoRegion=us synths cleanly with us. ARNs
• mise run build green

Notes

Blocked by #746. Final step in the #740/#741 stack.