Best possible solution:

Keep the focused image carve-out, replace the runner sentinel with a real credentialless execution path or explicit auth-mode contract, then require live Bedrock aws-sdk media proof or a maintainer proof override before merge.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level. Current main resolves Bedrock aws-sdk auth without an apiKey, then the image and runner paths pass that result into requireApiKey, even though the Bedrock docs say no static API key is required.

Is this the best way to solve the issue?

No, not as submitted. The image change follows the existing text-runtime carve-out, but the runner change is not the narrowest maintainable fix because it sends a fake credential through the real media provider execution path.

Full review comments:

• [P2] Avoid passing the AWS SDK sentinel as an API key — src/media-understanding/runner.entries.ts:438
  In real runner execution, primaryApiKey is collected and then executeWithApiKeyRotation passes each collected string as req.apiKey to describeVideo/transcribeAudio. With this sentinel, an aws-sdk media provider receives __openclaw_aws_sdk_default_chain__ as its credential instead of running credentialless; the new test mocks rotation to call execute("test-key"), so it does not catch the real path. Please route this case through a credentialless execution path or explicit auth-mode contract instead of fabricating an API key.
  Confidence: 0.89

Overall correctness: patch is incorrect
Overall confidence: 0.86

Acceptance criteria:

• pnpm test src/media-understanding/image.test.ts src/media-understanding/runner.video.test.ts
• pnpm exec oxfmt --check --threads=1 src/media-understanding/image.ts src/media-understanding/image.test.ts src/media-understanding/runner.entries.ts src/media-understanding/runner.video.test.ts
• git diff --check
• Real Bedrock auth: "aws-sdk" image-tool or runtime proof with credentials redacted

What I checked:

• Current main image path still hits static-key guard: resolveImageRuntime calls requireApiKey(apiKeyInfo, model.provider) and stores that runtime key before provider execution, so mode: "aws-sdk" with no apiKey throws before the AWS SDK chain can run. (src/media-understanding/image.ts:212, 04442f4c059f)
• Current main runner path has the same guard: resolveProviderExecutionAuth passes requireApiKey(auth, params.providerId) into media provider API-key collection. (src/media-understanding/runner.entries.ts:439, 04442f4c059f)
• Shared helper rejects missing static keys: requireApiKey only normalizes auth.apiKey and throws when absent, regardless of auth.mode. (src/agents/model-auth-runtime-shared.ts:28, 04442f4c059f)
• Bedrock docs define credential-chain auth: The Bedrock provider docs say Bedrock auth uses the AWS SDK default credential chain and that no apiKey is required for auth: "aws-sdk". Public docs: docs/providers/bedrock.md. (docs/providers/bedrock.md:9, 04442f4c059f)
• Text runtime already has the credential-chain carve-out: The embedded runner permits missing apiKey when apiKeyInfo.mode is aws-sdk, matching the reported expected behavior for text calls. (src/agents/pi-embedded-runner/compact.ts:510, 04442f4c059f)
• PR runner change fabricates a primary key: The PR introduces AWS_SDK_CREDENTIALLESS_API_KEY and uses it as primaryApiKey for aws-sdk auth without a static key. (src/media-understanding/runner.entries.ts:438, 82f1b67a86ac)

Likely related people:

• steipete: Recent history ties this person to media runner maintenance, image timeout behavior, provider runtime auth seams, and Amazon Bedrock provider behavior near this auth surface. (role: recent maintainer; confidence: high; commits: 58db3d2d22d9, 74889462a82b, b07c7f6ab3e0; files: src/media-understanding/runner.entries.ts, src/media-understanding/image.ts, extensions/amazon-bedrock/register.sync.runtime.ts)
• vincentkoc: Recent merged Bedrock discovery and guardrail work touched the Amazon Bedrock provider runtime area adjacent to this auth behavior. (role: adjacent Bedrock maintainer; confidence: medium; commits: da8993203c66; files: extensions/amazon-bedrock/register.sync.runtime.ts, extensions/amazon-bedrock/index.test.ts)
• neeravmakwana: Prior merged media-understanding provider work added image-runtime coverage and provider support around this surface. (role: adjacent media-understanding contributor; confidence: medium; commits: 6fd9d2ff3871; files: src/media-understanding/image.ts, src/media-understanding/image.test.ts, extensions/openai/media-understanding-provider.ts)

Remaining risk / open question:

• No after-fix Bedrock image-tool or runtime output is attached, so AWS SDK credential-chain behavior remains unproven outside mocked tests.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 04442f4c059f.