diff --git a/README.md b/README.md
index 349cee6249..f3068675bb 100644
--- a/README.md
+++ b/README.md
@@ -149,6 +149,33 @@ yourself.
 Note that `agentcore status` reports only the resources `agentcore.json`
 declares, not the ones you add in the stack.
 
+## China (aws-cn) regions
+
+`cn-north-1` and `cn-northwest-1` are supported, with three differences:
+
+- **Templates:** Amazon Bedrock, Anthropic, OpenAI, and Gemini are not accessible from China
+  regions, so templates wired to those providers (and `--type import`, which reads from Amazon
+  Bedrock) are rejected when a deployment target is in a China region. Bring your own agent
+  implementation instead: scaffold with `agent-python-minimal` or `mcp-python-fastmcp` and add
+  your own model connectivity, or use `--template agent-python-strands --model-provider litellm
+--model-id <model>` with a [LiteLLM model](https://docs.litellm.ai/docs/providers) reachable
+  from China — no default model id is applied there, and the `bedrock/` LiteLLM prefix (which
+  routes to Amazon Bedrock) is rejected. The scaffolded runtime records `modelProvider` and,
+  for LiteLLM, `modelId` in `agentcore.json` so deploys can re-check this.
+- The restrictions are enforced wherever the region is known: at `agentcore create` when the
+  resolved region (`--region`, environment, or profile) is a China region, at
+  `agentcore add runtime` once deployment targets exist, and at `agentcore deploy` — deploying
+  to a China target fails when a runtime was scaffolded with an inaccessible model provider
+  (recorded as the runtime's `modelProvider` in `agentcore.json`; delete that field if you have
+  replaced the model wiring in code). Harness projects are not available in China regions.
+- **Resource families:** only Runtimes, Gateways, and credentials are available in China
+  regions. The strands template's default memory is dropped from China scaffolds (the memory
+  module stays in the code and activates once a memory exists); adding unsupported resources
+  (memory, evaluators, harnesses, payments, …) or deploying a spec that contains them to a
+  China target fails with an explicit message.
+- **Telemetry** is always disabled when the ambient AWS region or any deployment target is a
+  China region.
+
 ## Documentation
 
 - [Amazon Bedrock AgentCore documentation](https://docs.aws.amazon.com/bedrock-agentcore/): service guides and API references.
diff --git a/command.md b/command.md
index 9dc95e674f..856aa1a236 100644
--- a/command.md
+++ b/command.md
@@ -255,6 +255,7 @@ create a new AgentCore project
 - `--name <name>`: name of the project to create (required)
 - `--template <template>`: the template to scaffold the Runtime from; some templates also accept --model-provider/--api-key
 - `--model-provider <model-provider>`: model provider for templates that support it: bedrock, anthropic, open\_ai, gemini, or lite\_llm
+- `--model-id <model-id>`: model id for the scaffolded Runtime code, overriding the provider's default (required with lite\_llm in China regions)
 - `--api-key <api-key>`: API key for non-Bedrock providers: '-' for stdin, 'file://path' for file
 - `--skip-install`: skip installing dependencies (npm install, uv sync) (default: false)
 - `--skip-git`: skip initializing a git repository (default: false)
@@ -352,7 +353,8 @@ add a Runtime to the current project
 - `--name <name>`: the name of the Runtime (required)
 - `--type <type>`: create generates new agent code (the default); import translates a Bedrock Agent version
 - `--template <template>`: template for the Runtime code (default: agent-python-minimal); available templates listed below
-- `--model-provider <model-provider>`: model provider for supported templates (Bedrock, Anthropic, OpenAI, or Gemini)
+- `--model-provider <model-provider>`: model provider for supported templates (Bedrock, Anthropic, OpenAI, Gemini, or LiteLLM)
+- `--model-id <model-id>`: model id for the scaffolded Runtime code, overriding the provider's default (required with litellm in China regions)
 - `--api-key <api-key>`: API key for non-Bedrock providers on supported templates; '-' for stdin, 'file://path' for file
 - `--description <description>`: an optional description of the Runtime
 - `--tags <tags...>`: tags as key=value (repeatable) or JSON object
diff --git a/src/assets/templates/agent-python-strands/model/load.py b/src/assets/templates/agent-python-strands/model/load.py
index 3798473967..1412ac1ed8 100644
--- a/src/assets/templates/agent-python-strands/model/load.py
+++ b/src/assets/templates/agent-python-strands/model/load.py
@@ -4,7 +4,7 @@
 
 def load_model() -> BedrockModel:
     """Get Bedrock model client using IAM credentials."""
-    return BedrockModel(model_id="global.anthropic.claude-sonnet-4-5-20250929-v1:0")
+    return BedrockModel(model_id={{safeJson modelId}})
 {{/if}}
 {{#if (eq modelProvider "Anthropic")}}
 import os
@@ -41,7 +41,7 @@ def load_model() -> AnthropicModel:
     """Get authenticated Anthropic model client."""
     return AnthropicModel(
         client_args={"api_key": _get_api_key()},
-        model_id="claude-sonnet-4-5-20250929",
+        model_id={{safeJson modelId}},
         max_tokens=5000,
     )
 {{/if}}
@@ -80,7 +80,7 @@ def load_model() -> OpenAIModel:
     """Get authenticated OpenAI model client."""
     return OpenAIModel(
         client_args={"api_key": _get_api_key()},
-        model_id="gpt-4.1",
+        model_id={{safeJson modelId}},
     )
 {{/if}}
 {{#if (eq modelProvider "Gemini")}}
@@ -118,7 +118,7 @@ def load_model() -> GeminiModel:
     """Get authenticated Gemini model client."""
     return GeminiModel(
         client_args={"api_key": _get_api_key()},
-        model_id="gemini-2.5-flash",
+        model_id={{safeJson modelId}},
     )
 {{/if}}
 {{#if (eq modelProvider "LiteLLM")}}
@@ -164,6 +164,6 @@ def load_model() -> LiteLLMModel:
     {{/if}}
     return LiteLLMModel(
         client_args=client_args,
-        model_id="bedrock/us.anthropic.claude-sonnet-4-5-20250514-v1:0",
+        model_id={{safeJson modelId}},
     )
 {{/if}}
diff --git a/src/core/partition.test.ts b/src/core/partition.test.ts
new file mode 100644
index 0000000000..7275bf0827
--- /dev/null
+++ b/src/core/partition.test.ts
@@ -0,0 +1,86 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { isChinaContext, isChinaRegion } from "./partition";
+
+describe("isChinaRegion", () => {
+  test.each(["cn-north-1", "cn-northwest-1"])("returns true for %s", (region) => {
+    expect(isChinaRegion(region)).toBe(true);
+  });
+
+  test.each(["us-east-1", "eu-west-1", "us-gov-west-1", ""])("returns false for %j", (region) => {
+    expect(isChinaRegion(region)).toBe(false);
+  });
+});
+
+describe("isChinaContext", () => {
+  let savedRegion: string | undefined;
+  let savedDefaultRegion: string | undefined;
+  let directory: string;
+
+  beforeEach(async () => {
+    savedRegion = process.env.AWS_REGION;
+    savedDefaultRegion = process.env.AWS_DEFAULT_REGION;
+    delete process.env.AWS_REGION;
+    delete process.env.AWS_DEFAULT_REGION;
+    directory = await mkdtemp(join(tmpdir(), "agentcore-partition-"));
+  });
+
+  afterEach(async () => {
+    if (savedRegion === undefined) delete process.env.AWS_REGION;
+    else process.env.AWS_REGION = savedRegion;
+    if (savedDefaultRegion === undefined) delete process.env.AWS_DEFAULT_REGION;
+    else process.env.AWS_DEFAULT_REGION = savedDefaultRegion;
+    await rm(directory, { recursive: true, force: true });
+  });
+
+  async function projectWithTargets(targets: unknown): Promise<string> {
+    const root = join(directory, "project");
+    await mkdir(join(root, "agentcore"), { recursive: true });
+    await writeFile(join(root, "agentcore", "agentcore.json"), "{}");
+    if (targets !== undefined) {
+      await writeFile(join(root, "agentcore", "aws-targets.json"), JSON.stringify(targets));
+    }
+    return root;
+  }
+
+  test("true when the ambient region env var is a China region", async () => {
+    process.env.AWS_REGION = "cn-northwest-1";
+    expect(await isChinaContext({ cwd: directory })).toBe(true);
+  });
+
+  test("true when the caller passes a resolved China region", async () => {
+    expect(await isChinaContext({ region: "cn-north-1", cwd: directory })).toBe(true);
+    expect(await isChinaContext({ region: "us-west-2", cwd: directory })).toBe(false);
+  });
+
+  test("true when the enclosing project declares a China deployment target", async () => {
+    const root = await projectWithTargets([
+      { name: "primary", account: "111122223333", region: "us-west-2" },
+      { name: "china", account: "111122223333", region: "cn-north-1" },
+    ]);
+    expect(await isChinaContext({ cwd: root })).toBe(true);
+    // The walk finds the project from a nested path as well.
+    expect(await isChinaContext({ cwd: join(root, "app", "nested") })).toBe(true);
+  });
+
+  test("false for a project with only commercial targets", async () => {
+    const root = await projectWithTargets([
+      { name: "primary", account: "111122223333", region: "us-west-2" },
+    ]);
+    expect(await isChinaContext({ cwd: root })).toBe(false);
+  });
+
+  test("false when no project encloses the directory", async () => {
+    expect(await isChinaContext({ cwd: directory })).toBe(false);
+  });
+
+  test("false when the targets file is missing or malformed", async () => {
+    const noTargets = await projectWithTargets(undefined);
+    expect(await isChinaContext({ cwd: noTargets })).toBe(false);
+
+    await writeFile(join(noTargets, "agentcore", "aws-targets.json"), "not json");
+    expect(await isChinaContext({ cwd: noTargets })).toBe(false);
+  });
+});
diff --git a/src/core/partition.ts b/src/core/partition.ts
new file mode 100644
index 0000000000..e2657d26e9
--- /dev/null
+++ b/src/core/partition.ts
@@ -0,0 +1,61 @@
+import { readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { partition } from "@aws-sdk/util-endpoints";
+
+/**
+ * True when the region belongs to the aws-cn partition (cn-north-1,
+ * cn-northwest-1), per the AWS SDK's partition data rather than a name
+ * prefix. Features whose backing services are not reachable from that
+ * partition (template model providers, Bedrock Agent import, the telemetry
+ * collector) gate on this.
+ */
+export function isChinaRegion(region: string): boolean {
+  return partition(region).name === "aws-cn";
+}
+
+/**
+ * True when the CLI is operating in a China (aws-cn) context: the caller's
+ * resolved region (when provided — telemetry resolves through the same chain
+ * as withRegion) or the ambient AWS region env vars point at a China region,
+ * or the AgentCore project enclosing `cwd` declares a China-region deployment
+ * target in
+ * agentcore/aws-targets.json.
+ *
+ * Best-effort by design — a missing project or an unreadable/malformed targets
+ * file counts as non-China — so callers that must never fail (telemetry) can
+ * rely on it unconditionally.
+ */
+export async function isChinaContext(
+  options: { region?: string; cwd?: string } = {},
+): Promise<boolean> {
+  const cwd = options.cwd ?? process.cwd();
+  if (options.region !== undefined && isChinaRegion(options.region)) return true;
+  if (isChinaRegion(process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "")) return true;
+
+  // Mirror project discovery: walk up to the first directory containing
+  // agentcore/agentcore.json, then inspect its aws-targets.json.
+  let dir = cwd;
+  while (!existsSync(join(dir, "agentcore", "agentcore.json"))) {
+    const parent = dirname(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+  try {
+    const raw = await readFile(join(dir, "agentcore", "aws-targets.json"), "utf8");
+    const targets: unknown = JSON.parse(raw);
+    return (
+      Array.isArray(targets) &&
+      targets.some(
+        (target) =>
+          typeof target === "object" &&
+          target !== null &&
+          "region" in target &&
+          typeof target.region === "string" &&
+          isChinaRegion(target.region),
+      )
+    );
+  } catch {
+    return false;
+  }
+}
diff --git a/src/core/project/__snapshots__/manager.test.ts.snap b/src/core/project/__snapshots__/manager.test.ts.snap
index bf2f3ef47f..9af00244b0 100644
--- a/src/core/project/__snapshots__/manager.test.ts.snap
+++ b/src/core/project/__snapshots__/manager.test.ts.snap
@@ -83,6 +83,7 @@ exports[`FsProjectManager.create snapshots the Strands project manifest and runt
       "build": "CodeZip",
       "codeLocation": "app/agent_python_strands",
       "entrypoint": "main.py",
+      "modelProvider": "Bedrock",
       "name": "agent_python_strands",
       "protocol": "HTTP",
       "runtimeVersion": "PYTHON_3_14",
@@ -153,6 +154,7 @@ exports[`FsProjectManager.create snapshots the Strands TypeScript project manife
       "build": "CodeZip",
       "codeLocation": "app/agent_typescript_strands",
       "entrypoint": "main.js",
+      "modelProvider": "Bedrock",
       "name": "agent_typescript_strands",
       "protocol": "HTTP",
       "runtimeVersion": "NODE_22",
@@ -224,6 +226,7 @@ exports[`FsProjectManager.create snapshots the Strands A2A project manifest and
       "build": "CodeZip",
       "codeLocation": "app/a2a_python_strands",
       "entrypoint": "main.py",
+      "modelProvider": "Bedrock",
       "name": "a2a_python_strands",
       "protocol": "A2A",
       "runtimeVersion": "PYTHON_3_14",
@@ -259,6 +262,7 @@ exports[`FsProjectManager.create snapshots the LangChain project manifest and ru
       "build": "CodeZip",
       "codeLocation": "app/agent_python_langchain",
       "entrypoint": "main.py",
+      "modelProvider": "Bedrock",
       "name": "agent_python_langchain",
       "protocol": "HTTP",
       "runtimeVersion": "PYTHON_3_14",
diff --git a/src/core/project/manager.test.ts b/src/core/project/manager.test.ts
index 5814f731ca..f09bdb8ad7 100644
--- a/src/core/project/manager.test.ts
+++ b/src/core/project/manager.test.ts
@@ -1,20 +1,31 @@
 import { afterEach, describe, expect, test } from "bun:test";
 import { existsSync } from "node:fs";
-import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
 import { join, relative } from "node:path";
 import { tmpdir } from "node:os";
 import {
   DeserializationError,
   InputValidationError,
   ProjectStateError,
+  RegionUnsupportedFeatureError,
   ResourceNotFoundError,
 } from "../../errors/errors";
 import type { AwsDeploymentTarget } from "../../projectSchemas/aws-targets";
 import { credentialEnvVarName } from "../../projectSchemas/credential";
 import { ProjectSpecSchema } from "../../projectSchemas/project";
 import { ENV_LOCAL_RELATIVE_PATH } from "./envLocal";
-import { FsProjectManager } from "./manager";
-import { resolveRuntimeTemplateShortcut } from "../../handlers/project/shortcuts";
+import {
+  cnUnsupportedResourceMessage,
+  FsProjectManager,
+  LITELLM_BEDROCK_MODEL_ID_CN_MESSAGE,
+  LITELLM_MODEL_ID_REQUIRED_CN_MESSAGE,
+  MEMORY_STRIPPED_CN_MESSAGE,
+  MODEL_PROVIDER_RUNTIMES_CN_MESSAGE,
+} from "./manager";
+import {
+  getDefaultMemorySpec,
+  resolveRuntimeTemplateShortcut,
+} from "../../handlers/project/shortcuts";
 import {
   type AddResourceInput,
   type CreateProjectInput,
@@ -531,6 +542,363 @@ describe("FsProjectManager.addResource", () => {
       expect(await Bun.file(specPath).text()).toBe(specBefore);
     },
   );
+
+  // Model-provider templates are gated in the aws-cn partition: none of the
+  // template model providers are reachable there, so the add must fail before
+  // any scaffolding. Provider-free templates and commercial-only targets pass.
+  describe("China (aws-cn) deployment targets", () => {
+    const MCP_PYTHON_FASTMCP = resolveRuntimeTemplateShortcut("mcp-python-fastmcp");
+
+    async function projectWithTarget(region: string, missingToolAfterCreate?: string) {
+      const checkedTools: string[] = [];
+      let missingTool: string | undefined;
+      const subject = new FsProjectManager({
+        logger: createSilentLogger(),
+        identity: new TestIdentityClient(),
+        enableTransactionSearch: async () => {},
+        runner: async () => {},
+        checkTool: async (candidate: string) => {
+          checkedTools.push(candidate);
+          if (candidate === missingTool) throw new Error(`${candidate} is missing`);
+        },
+      });
+      const { project } = await runCreate(subject, {
+        name: "example",
+        scaffoldRuntimeInput: AGENT_PYTHON,
+        skipInstall: true,
+        skipGit: true,
+      });
+      await writeFile(
+        join(project.rootPath, "agentcore", "aws-targets.json"),
+        JSON.stringify([{ name: "primary", account: "111122223333", region }]),
+      );
+      missingTool = missingToolAfterCreate;
+      checkedTools.length = 0;
+      return { subject, project, checkedTools };
+    }
+
+    test("rejects a model-provider template before scaffolding", async () => {
+      await inTempDirectory();
+      const { subject, project, checkedTools } = await projectWithTarget("cn-north-1");
+      const runtimePath = join(project.rootPath, "app", "cn_blocked");
+
+      await expect(
+        runAdd(subject, project, {
+          resourceType: "runtime",
+          resourceConfig: {
+            name: "cn_blocked",
+            scaffoldRuntimeInput: { ...AGENT_PYTHON_STRANDS, runtimeName: "cn_blocked" },
+          },
+        }),
+      ).rejects.toThrow(new RegionUnsupportedFeatureError(MODEL_PROVIDER_RUNTIMES_CN_MESSAGE));
+
+      expect(checkedTools).toEqual([]);
+      expect(existsSync(runtimePath)).toBe(false);
+    });
+
+    test("lets a provider-free template past the partition gate", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1", "uv");
+
+      // The gate does not fire; the add proceeds to dependency checks.
+      await expect(
+        runAdd(subject, project, {
+          resourceType: "runtime",
+          resourceConfig: {
+            name: "cn_allowed",
+            scaffoldRuntimeInput: { ...MCP_PYTHON_FASTMCP, runtimeName: "cn_allowed" },
+          },
+        }),
+      ).rejects.toThrow("uv is missing");
+    });
+
+    test("lets the minimal skeleton past the partition gate despite its nominal provider", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1", "uv");
+
+      // agent-python-minimal carries modelProvider Bedrock in its shortcut but
+      // renders no model code (framework "none") — it is the BYO vehicle in CN.
+      await expect(
+        runAdd(subject, project, {
+          resourceType: "runtime",
+          resourceConfig: {
+            name: "cn_minimal",
+            scaffoldRuntimeInput: { ...AGENT_PYTHON, runtimeName: "cn_minimal" },
+          },
+        }),
+      ).rejects.toThrow("uv is missing");
+    });
+
+    test("requires an explicit model id for LiteLLM", async () => {
+      await inTempDirectory();
+      const { subject, project, checkedTools } = await projectWithTarget("cn-north-1");
+      const runtimePath = join(project.rootPath, "app", "cn_litellm");
+
+      await expect(
+        runAdd(subject, project, {
+          resourceType: "runtime",
+          resourceConfig: {
+            name: "cn_litellm",
+            scaffoldRuntimeInput: {
+              ...AGENT_PYTHON_STRANDS,
+              runtimeName: "cn_litellm",
+              modelProvider: "LiteLLM",
+            },
+          },
+        }),
+      ).rejects.toThrow(new RegionUnsupportedFeatureError(LITELLM_MODEL_ID_REQUIRED_CN_MESSAGE));
+
+      expect(checkedTools).toEqual([]);
+      expect(existsSync(runtimePath)).toBe(false);
+    });
+
+    test("rejects a LiteLLM model id routing to Bedrock on a China target", async () => {
+      await inTempDirectory();
+      const { subject, project, checkedTools } = await projectWithTarget("cn-north-1");
+
+      await expect(
+        runAdd(subject, project, {
+          resourceType: "runtime",
+          resourceConfig: {
+            name: "cn_litellm",
+            scaffoldRuntimeInput: {
+              ...AGENT_PYTHON_STRANDS,
+              runtimeName: "cn_litellm",
+              modelProvider: "LiteLLM",
+              modelId: "bedrock/us.anthropic.claude-sonnet-4-5-20250514-v1:0",
+            },
+          },
+        }),
+      ).rejects.toThrow(new RegionUnsupportedFeatureError(LITELLM_BEDROCK_MODEL_ID_CN_MESSAGE));
+
+      expect(checkedTools).toEqual([]);
+    });
+
+    test("lets LiteLLM with an explicit model id past the partition gate", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1", "uv");
+
+      await expect(
+        runAdd(subject, project, {
+          resourceType: "runtime",
+          resourceConfig: {
+            name: "cn_litellm_ok",
+            scaffoldRuntimeInput: {
+              ...AGENT_PYTHON_STRANDS,
+              runtimeName: "cn_litellm_ok",
+              modelProvider: "LiteLLM",
+              modelId: "openai/my-cn-reachable-model",
+            },
+          },
+        }),
+      ).rejects.toThrow("uv is missing");
+    });
+
+    async function editSpec(
+      project: Project,
+      edit: (spec: {
+        runtimes: { name: string; modelProvider?: string; modelId?: string }[];
+        harnesses: unknown[];
+        memories?: unknown[];
+      }) => void,
+    ) {
+      const specPath = join(project.rootPath, "agentcore", "agentcore.json");
+      const spec = JSON.parse(await readFile(specPath, "utf8"));
+      edit(spec);
+      await writeFile(specPath, JSON.stringify(spec, null, 2));
+    }
+
+    async function deployOutcome(subject: FsProjectManager, project: Project) {
+      // Re-resolve so the deploy sees the spec as edited on disk.
+      const fresh = (await subject.resolve({ filePath: project.rootPath }))!;
+      const steps: string[] = [];
+      try {
+        const generator = subject.deploy(fresh, {
+          target: "primary",
+          region: "us-east-1",
+          confirmTeardown: async () => false,
+        });
+        for await (const event of generator) {
+          if (event.type === "step") steps.push(event.message);
+        }
+        return { steps, error: undefined };
+      } catch (error) {
+        return { steps, error };
+      }
+    }
+
+    test("deploy to a China target hard-fails on a persisted commercial model provider", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1");
+      await editSpec(project, (spec) => {
+        spec.runtimes[0]!.modelProvider = "Bedrock";
+      });
+
+      const { error } = await deployOutcome(subject, project);
+      expect(error).toBeInstanceOf(RegionUnsupportedFeatureError);
+      expect(String(error)).toContain("Cannot deploy to China region cn-north-1");
+      expect(String(error)).toContain("'agent_python_minimal'");
+    });
+
+    test("deploy to a China target proceeds past the gate for LiteLLM", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1");
+      await editSpec(project, (spec) => {
+        spec.runtimes[0]!.modelProvider = "LiteLLM";
+      });
+
+      const { error } = await deployOutcome(subject, project);
+      expect(error).not.toBeInstanceOf(RegionUnsupportedFeatureError);
+    });
+
+    test("deploy to a China target hard-fails a LiteLLM runtime routing to Bedrock", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1");
+      await editSpec(project, (spec) => {
+        spec.runtimes[0]!.modelProvider = "LiteLLM";
+        spec.runtimes[0]!.modelId = "bedrock/us.anthropic.claude-sonnet-4-5-20250514-v1:0";
+      });
+
+      const { error } = await deployOutcome(subject, project);
+      expect(error).toBeInstanceOf(RegionUnsupportedFeatureError);
+      expect(String(error)).toContain("LiteLLM → bedrock/");
+    });
+
+    test("deploy to a China target passes a LiteLLM runtime with a non-Bedrock model id", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1");
+      await editSpec(project, (spec) => {
+        spec.runtimes[0]!.modelProvider = "LiteLLM";
+        spec.runtimes[0]!.modelId = "deepseek/deepseek-chat";
+      });
+
+      const { steps, error } = await deployOutcome(subject, project);
+      expect(error).not.toBeInstanceOf(RegionUnsupportedFeatureError);
+      expect(steps.join("\n")).not.toContain("cannot verify the model provider");
+    });
+
+    test("deploy to a China target notes a LiteLLM runtime without a persisted model id", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1");
+      await editSpec(project, (spec) => {
+        spec.runtimes[0]!.modelProvider = "LiteLLM";
+      });
+
+      const { steps, error } = await deployOutcome(subject, project);
+      expect(error).not.toBeInstanceOf(RegionUnsupportedFeatureError);
+      expect(steps.join("\n")).toContain("cannot verify the model provider");
+    });
+
+    test("deploy to a China target notes unclassifiable runtimes and proceeds", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1");
+
+      const { steps, error } = await deployOutcome(subject, project);
+      expect(steps.join("\n")).toContain(
+        "cannot verify the model provider of 'agent_python_minimal'",
+      );
+      expect(error).not.toBeInstanceOf(RegionUnsupportedFeatureError);
+    });
+
+    test("deploy to a China target rejects harness projects", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1");
+      await editSpec(project, (spec) => {
+        spec.harnesses = [{ name: "example_harness", path: "harness/example" }];
+      });
+
+      const { error } = await deployOutcome(subject, project);
+      expect(error).toBeInstanceOf(RegionUnsupportedFeatureError);
+      expect(String(error)).toContain("Harness projects are not available in China regions");
+    });
+
+    test("deploy to a commercial target skips the China gate entirely", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("us-west-2");
+      await editSpec(project, (spec) => {
+        spec.runtimes[0]!.modelProvider = "Bedrock";
+      });
+
+      const { steps, error } = await deployOutcome(subject, project);
+      expect(error).not.toBeInstanceOf(RegionUnsupportedFeatureError);
+      expect(steps.join("\n")).not.toContain("cannot verify");
+    });
+
+    test("strips the default memory from a China runtime scaffold", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1", "uv");
+
+      const steps: string[] = [];
+      const iterator = subject.addResource(project, {
+        resourceType: "runtime",
+        resourceConfig: {
+          name: "cn_mem",
+          scaffoldRuntimeInput: {
+            ...AGENT_PYTHON_STRANDS,
+            runtimeName: "cn_mem",
+            modelProvider: "LiteLLM",
+            modelId: "deepseek/deepseek-chat",
+          },
+        },
+      });
+      const error = await (async () => {
+        try {
+          for (;;) {
+            const next = await iterator.next();
+            if (next.done) return undefined;
+            if (next.value.type === "step") steps.push(next.value.message);
+          }
+        } catch (e) {
+          return e;
+        }
+      })();
+
+      // The memory is stripped with a note before the scaffold proceeds to
+      // dependency checks (which fail in this environment).
+      expect(steps.join("\n")).toContain(MEMORY_STRIPPED_CN_MESSAGE);
+      expect(String(error)).toContain("uv is missing");
+    });
+
+    test("rejects adding a memory on a China target", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1");
+
+      await expect(
+        runAdd(subject, project, {
+          resourceType: "memory",
+          resourceConfig: getDefaultMemorySpec("cn_mem"),
+        }),
+      ).rejects.toThrow(new RegionUnsupportedFeatureError(cnUnsupportedResourceMessage("memory")));
+    });
+
+    test("deploy to a China target rejects unsupported spec collections", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("cn-north-1");
+      await editSpec(project, (spec) => {
+        spec.memories = [getDefaultMemorySpec("cn_mem")];
+      });
+
+      const { error } = await deployOutcome(subject, project);
+      expect(error).toBeInstanceOf(RegionUnsupportedFeatureError);
+      expect(String(error)).toContain("'memories'");
+      expect(String(error)).toContain("not available in China regions");
+    });
+
+    test("lets a model-provider template through for commercial-only targets", async () => {
+      await inTempDirectory();
+      const { subject, project } = await projectWithTarget("us-west-2", "uv");
+
+      await expect(
+        runAdd(subject, project, {
+          resourceType: "runtime",
+          resourceConfig: {
+            name: "commercial",
+            scaffoldRuntimeInput: { ...AGENT_PYTHON_STRANDS, runtimeName: "commercial" },
+          },
+        }),
+      ).rejects.toThrow("uv is missing");
+    });
+  });
 });
 
 describe("FsProjectManager.build", () => {
diff --git a/src/core/project/manager.tsx b/src/core/project/manager.tsx
index 927be565fb..433effb25d 100644
--- a/src/core/project/manager.tsx
+++ b/src/core/project/manager.tsx
@@ -72,8 +72,10 @@ import {
   MalformedServiceResponseError,
   NotImplementedError,
   ProjectStateError,
+  RegionUnsupportedFeatureError,
   ResourceNotFoundError,
 } from "../../errors/errors";
+import { isChinaRegion } from "../partition";
 import z from "zod";
 import { CdkBackend, type TransactionSearchEnabler } from "./backends/cdk";
 import { resolveAwsAccount } from "./backends/cdk/environment";
@@ -95,6 +97,94 @@ const TARGETS_EXAMPLE = '[{ "name": "default", "account": "111122223333", "regio
 
 const NODE_INSTALL_HINT = "Install Node.js: https://nodejs.org/";
 const UV_INSTALL_HINT = "Install uv: https://docs.astral.sh/uv/getting-started/installation/";
+
+/**
+ * Shown when a runtime template hardwired to an unreachable model provider
+ * targets a China (aws-cn) region. Amazon Bedrock, Anthropic, OpenAI, and
+ * Gemini cannot be called from China regions; LiteLLM can route to a reachable provider.
+ */
+export const MODEL_PROVIDER_RUNTIMES_CN_MESSAGE =
+  "This template's model provider is not accessible from China regions (cn-north-1, " +
+  "cn-northwest-1): Amazon Bedrock, " +
+  "Anthropic, OpenAI, and Gemini cannot be used there. Either scaffold a provider-free runtime " +
+  "(--template agent-python-minimal or mcp-python-fastmcp) and bring your own model connectivity, " +
+  "or use --template agent-python-strands --model-provider litellm --model-id <model reachable " +
+  "from China>.";
+
+/**
+ * Shown when a harness is created in or deployed to a China (aws-cn) region.
+ * Harnesses are not part of the China launch: their model providers and IAM
+ * role generation are not partition-aware there.
+ */
+export const HARNESS_CN_MESSAGE =
+  "Harness projects are not available in China regions (cn-north-1, cn-northwest-1). " +
+  "Scaffold a runtime project " +
+  "instead (e.g. --template agent-python-minimal) or start from --template empty.";
+
+/**
+ * The resource families whose CloudFormation types ARE registered in the
+ * China regions (verified against cn-north-1's public registry): Runtime,
+ * RuntimeEndpoint, Gateway (+Target/+RateLimit), and Identity credentials.
+ * Declared as an allowlist so any family added later defaults to blocked in
+ * China until its availability there is confirmed.
+ */
+const CN_SUPPORTED_RESOURCE_TYPES = new Set<AddResourceInput["resourceType"]>([
+  "runtime",
+  "runtime-endpoint",
+  "credential",
+  "gateway",
+  "gateway-target",
+]);
+
+/**
+ * The project spec collections deployable to a China region — the spec-file
+ * counterpart of {@link CN_SUPPORTED_RESOURCE_TYPES} (toolRuntimes render as
+ * Runtime resources). Any other non-empty array collection in the spec,
+ * including ones added in the future, blocks a China deploy.
+ */
+const CN_SUPPORTED_SPEC_COLLECTIONS = new Set([
+  "runtimes",
+  "credentials",
+  "agentCoreGateways",
+  "toolRuntimes",
+]);
+
+/** Shown when an `add` targets a resource family that is unavailable in China regions. */
+export function cnUnsupportedResourceMessage(resourceType: string): string {
+  return (
+    `'${resourceType}' resources are not available in China regions (cn-north-1, ` +
+    `cn-northwest-1), and this project has a China deployment target.`
+  );
+}
+
+/**
+ * Shown when the default memory is dropped from a China scaffold. The rendered
+ * code keeps the memory module (it degrades to no memory while its env var is
+ * absent), so a memory can be added without code changes once available.
+ */
+export const MEMORY_STRIPPED_CN_MESSAGE =
+  "AgentCore Memory is not available in China regions (cn-north-1, cn-northwest-1); " +
+  "scaffolding without the default memory";
+
+/**
+ * Shown when a LiteLLM runtime template targets a China (aws-cn) region without
+ * an explicit model id: the LiteLLM default routes to Amazon Bedrock, which is
+ * not available there.
+ */
+export const LITELLM_MODEL_ID_REQUIRED_CN_MESSAGE =
+  "--model-provider litellm requires --model-id in China regions (cn-north-1, " +
+  "cn-northwest-1): the default model id " +
+  "routes to Amazon Bedrock, which is not available there. Pass a LiteLLM model id for a " +
+  "provider reachable from China (see https://docs.litellm.ai/docs/providers).";
+
+/**
+ * Shown when a LiteLLM runtime explicitly targets LiteLLM's Bedrock route
+ * (the 'bedrock/' model id prefix) in a China (aws-cn) region.
+ */
+export const LITELLM_BEDROCK_MODEL_ID_CN_MESSAGE =
+  "the 'bedrock/' LiteLLM model id prefix routes to Amazon Bedrock, which is not available " +
+  "in China regions (cn-north-1, cn-northwest-1). Pass a LiteLLM model id for a provider " +
+  "reachable from China (see https://docs.litellm.ai/docs/providers).";
 const GIT_INSTALL_HINT = "Install git: https://git-scm.com/downloads";
 
 // npm prints nothing until it exits when stderr is piped, and its HTTP log is the only per-package
@@ -345,6 +435,42 @@ export class FsProjectManager implements ProjectManager {
     const scaffoldedPaths: string[] = [];
     let envFile: EnvLocalFile | undefined;
 
+    // A project with a China (aws-cn) deployment target can only add the
+    // resource families whose CloudFormation types exist there (Runtime,
+    // Gateway, credential). Runtimes additionally gate on the model provider
+    // — Bedrock/Anthropic/OpenAI/Gemini are unreachable, LiteLLM needs an
+    // explicit model id (its default routes to Bedrock) — and the default
+    // memory is dropped from the scaffold (see MEMORY_STRIPPED_CN_MESSAGE);
+    // provider-free scaffolds (framework "none": minimal, MCP) stay available
+    // as the bring-your-own-implementation path.
+    if ((await this.listTargets(project)).some((target) => isChinaRegion(target.region))) {
+      if (input.resourceType === "harness") {
+        throw new RegionUnsupportedFeatureError(HARNESS_CN_MESSAGE);
+      }
+      if (!CN_SUPPORTED_RESOURCE_TYPES.has(input.resourceType)) {
+        throw new RegionUnsupportedFeatureError(cnUnsupportedResourceMessage(input.resourceType));
+      }
+      if (input.resourceType === "runtime") {
+        const { framework, modelProvider, modelId, memory } =
+          input.resourceConfig.scaffoldRuntimeInput;
+        if (framework !== "none") {
+          if ((modelProvider ?? "Bedrock") !== "LiteLLM") {
+            throw new RegionUnsupportedFeatureError(MODEL_PROVIDER_RUNTIMES_CN_MESSAGE);
+          }
+          if (modelId === undefined) {
+            throw new RegionUnsupportedFeatureError(LITELLM_MODEL_ID_REQUIRED_CN_MESSAGE);
+          }
+          if (modelId.startsWith("bedrock/")) {
+            throw new RegionUnsupportedFeatureError(LITELLM_BEDROCK_MODEL_ID_CN_MESSAGE);
+          }
+        }
+        if (memory !== undefined) {
+          input.resourceConfig.scaffoldRuntimeInput.memory = undefined;
+          yield { type: "step", message: MEMORY_STRIPPED_CN_MESSAGE };
+        }
+      }
+    }
+
     switch (input.resourceType) {
       case "harness": {
         yield { type: "step", message: `Scaffolding harness in project` };
@@ -1012,6 +1138,76 @@ export class FsProjectManager implements ProjectManager {
       );
     }
 
+    // China (aws-cn) targets cannot run runtimes whose scaffolded code is
+    // wired to Bedrock/Anthropic/OpenAI/Gemini (unreachable there), nor
+    // harnesses (not part of the China launch). Runtimes without a persisted
+    // modelProvider (BYO, provider-free, hand-edited, or scaffolded by an
+    // older CLI) cannot be classified and only get an informational note.
+    if (isChinaRegion(target.region)) {
+      const blocked = project.spec.runtimes.filter(
+        (runtime) =>
+          runtime.modelProvider !== undefined &&
+          (runtime.modelProvider !== "LiteLLM" ||
+            // LiteLLM's 'bedrock/' model id prefix routes to Amazon Bedrock —
+            // the default when a runtime was scaffolded without --model-id.
+            runtime.modelId?.startsWith("bedrock/")),
+      );
+      if (blocked.length > 0) {
+        throw new RegionUnsupportedFeatureError(
+          `Cannot deploy to China region ${target.region}: ` +
+            blocked
+              .map(
+                (runtime) =>
+                  `runtime '${runtime.name}' (${runtime.modelProvider}${
+                    runtime.modelProvider === "LiteLLM" ? ` → ${runtime.modelId}` : ""
+                  })`,
+              )
+              .join(", ") +
+            ` scaffolded with a model provider that is not accessible from China regions. ` +
+            `Re-scaffold with '--model-provider litellm --model-id <model reachable from China>' ` +
+            `or bring your own model connectivity. If you have already replaced a runtime's ` +
+            `model wiring in code, delete its 'modelProvider' field from agentcore.json.`,
+        );
+      }
+      if (project.spec.harnesses.length > 0) {
+        throw new RegionUnsupportedFeatureError(HARNESS_CN_MESSAGE);
+      }
+      // Any non-empty spec collection outside the China allowlist fails here
+      // with a clear message instead of CloudFormation's opaque "Unrecognized
+      // resource types" — including collections added to the spec in the
+      // future, which default to blocked until confirmed available there.
+      const present = Object.entries(project.spec).filter(
+        ([key, value]) =>
+          Array.isArray(value) && value.length > 0 && !CN_SUPPORTED_SPEC_COLLECTIONS.has(key),
+      );
+      if (present.length > 0) {
+        throw new RegionUnsupportedFeatureError(
+          `Cannot deploy to China region ${target.region}: ` +
+            present.map(([name]) => `'${name}'`).join(", ") +
+            ` in agentcore.json ${present.length === 1 ? "is" : "are"} not available in China ` +
+            `regions (cn-north-1, cn-northwest-1). Remove ${
+              present.length === 1 ? "this entry" : "these entries"
+            } before deploying to a China target.`,
+        );
+      }
+      const unclassified = project.spec.runtimes.filter(
+        (runtime) =>
+          runtime.modelProvider === undefined ||
+          // A LiteLLM runtime without a persisted model id (older CLI or
+          // hand-edited spec) cannot be classified by routing.
+          (runtime.modelProvider === "LiteLLM" && runtime.modelId === undefined),
+      );
+      if (unclassified.length > 0) {
+        yield {
+          type: "step",
+          message:
+            `Note: cannot verify the model provider of ` +
+            unclassified.map((runtime) => `'${runtime.name}'`).join(", ") +
+            `; Bedrock, Anthropic, OpenAI, and Gemini connectivity does not work in China regions.`,
+        };
+      }
+    }
+
     return yield* this.backendFor(project).deploy(project, {
       target,
       confirmTeardown: input.confirmTeardown,
diff --git a/src/core/project/templates/runtime.ts b/src/core/project/templates/runtime.ts
index 59322b1797..8bdaf73812 100644
--- a/src/core/project/templates/runtime.ts
+++ b/src/core/project/templates/runtime.ts
@@ -4,9 +4,13 @@ import type { RuntimeResourceConfig } from "../../../handlers/project/add/runtim
 import type { ProjectRuntime } from "../../../projectSchemas/runtime";
 import { mergeSpecEntries } from "./spec";
 import type { SpecEntries, TemplateRenderer, TemplateResolver } from "./types";
-import type { EnvLocalEntry, ScaffoldRuntimeInput } from "../../../handlers/project/types";
+import type {
+  EnvLocalEntry,
+  ModelProvider,
+  ScaffoldRuntimeInput,
+} from "../../../handlers/project/types";
 import { credentialEnvVarName } from "../../../projectSchemas/credential";
-import { memoryEnvVarName } from "../../../projectSchemas/memory";
+import { defaultMemoryName, memoryEnvVarName } from "../../../projectSchemas/memory";
 import { InputValidationError } from "../../../errors";
 import { toPythonPackageName } from "../fsUtils";
 
@@ -17,6 +21,15 @@ type ModelProviderTemplateConfig = {
   envEntries: EnvLocalEntry[];
 };
 
+/** The model id each provider block renders when the user does not pass one. */
+const DEFAULT_MODEL_IDS: Record<ModelProvider, string> = {
+  Bedrock: "global.anthropic.claude-sonnet-4-5-20250929-v1:0",
+  Anthropic: "claude-sonnet-4-5-20250929",
+  OpenAI: "gpt-4.1",
+  Gemini: "gemini-2.5-flash",
+  LiteLLM: "bedrock/us.anthropic.claude-sonnet-4-5-20250514-v1:0",
+};
+
 function resolveModelProviderScaffold(input: RuntimeResourceConfig): ModelProviderTemplateConfig {
   const { modelProvider, apiKey } = input.scaffoldRuntimeInput;
   if (apiKey === undefined) {
@@ -42,6 +55,20 @@ function buildRuntimeSpec(input: RuntimeResourceConfig): ProjectRuntime {
   return {
     name,
     build: scaffoldRuntimeInput.build,
+    // Persist the provider actually wired into the scaffolded code so the
+    // China deploy gate can classify this runtime later: framework scaffolds
+    // and Bedrock Agent imports (whose translated code calls Bedrock despite
+    // framework "none"). Provider-free scaffolds (minimal, MCP) stay
+    // unclassified.
+    ...((scaffoldRuntimeInput.framework !== "none" || input.importBedrockAgent !== undefined) && {
+      modelProvider: scaffoldRuntimeInput.modelProvider ?? "Bedrock",
+    }),
+    // For LiteLLM the model id determines the actual routing (its 'bedrock/'
+    // prefix routes to Amazon Bedrock), so persist the id the code renders —
+    // explicit --model-id or the template default — for the China deploy gate.
+    ...(scaffoldRuntimeInput.modelProvider === "LiteLLM" && {
+      modelId: scaffoldRuntimeInput.modelId ?? DEFAULT_MODEL_IDS.LiteLLM,
+    }),
     // TypeScript deploys a compiled main.js (esbuild runs at synth); Python runs main.py directly.
     entrypoint: scaffoldRuntimeInput.language === "TypeScript" ? "main.js" : "main.py",
     codeLocation: `app/${name}` as ProjectRuntime["codeLocation"],
@@ -148,10 +175,15 @@ const getTemplateResolvers = (assetSource: AssetSource, templateRenderer: Templa
   [buildResolverKey("strands", "Python", "HTTP")]: async (input: RuntimeResourceConfig) => {
     const memory = input.scaffoldRuntimeInput.memory;
     const modelScaffold = resolveModelProviderScaffold(input);
+    const modelProvider = input.scaffoldRuntimeInput.modelProvider ?? "Bedrock";
     const context = {
       name: toPythonPackageName(input.name),
-      modelProvider: input.scaffoldRuntimeInput.modelProvider ?? "Bedrock",
-      memoryEnvVarName: memory ? memoryEnvVarName(memory.name) : undefined,
+      modelProvider,
+      modelId: input.scaffoldRuntimeInput.modelId ?? DEFAULT_MODEL_IDS[modelProvider],
+      // Even without a memory resource (China scaffolds omit it — AgentCore
+      // Memory is not available there), the rendered module reads the default
+      // memory's env var so adding a memory later needs no code edit.
+      memoryEnvVarName: memoryEnvVarName(memory?.name ?? defaultMemoryName(input.name)),
       ...modelScaffold.templateRenderContext,
       enableOtel: true,
       // The strands template's entrypoint is fixed to main.py; the container Dockerfile launches it as the `main` module.
@@ -164,8 +196,10 @@ const getTemplateResolvers = (assetSource: AssetSource, templateRenderer: Templa
       {
         rootDirName: input.name,
         transformContent: (raw) => templateRenderer.render(raw, context),
-        filter: (name, isDir) => {
-          if (isDir && name === "memory") return memory !== undefined;
+        filter: (name) => {
+          // The memory module is always included: main.py imports it
+          // unconditionally and it degrades to no memory when its env var is
+          // absent (the China scaffold omits the memory resource).
           if (name === "Dockerfile" || name === ".dockerignore") return isContainer;
           return true;
         },
diff --git a/src/core/region.test.ts b/src/core/region.test.ts
new file mode 100644
index 0000000000..65ce10b3a4
--- /dev/null
+++ b/src/core/region.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, test } from "bun:test";
+import { regionFlagFromArgv } from "./region";
+
+describe("regionFlagFromArgv", () => {
+  test("extracts --region <value>", () => {
+    expect(regionFlagFromArgv(["node", "agentcore", "deploy", "--region", "cn-north-1"])).toBe(
+      "cn-north-1",
+    );
+  });
+
+  test("extracts --region=<value>", () => {
+    expect(regionFlagFromArgv(["node", "agentcore", "--region=us-west-2", "status"])).toBe(
+      "us-west-2",
+    );
+  });
+
+  test("returns undefined without the flag", () => {
+    expect(regionFlagFromArgv(["node", "agentcore", "status"])).toBeUndefined();
+  });
+
+  test("returns undefined for a trailing bare --region", () => {
+    expect(regionFlagFromArgv(["node", "agentcore", "--region"])).toBeUndefined();
+  });
+});
+
+describe("regionFromConfigFile", () => {
+  test("returns undefined when the config file lacks the profile's region", async () => {
+    const { mkdtemp, rm, writeFile } = await import("node:fs/promises");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    const dir = await mkdtemp(join(tmpdir(), "agentcore-region-"));
+    const savedConfigFile = process.env.AWS_CONFIG_FILE;
+    const savedProfile = process.env.AWS_PROFILE;
+    try {
+      const path = join(dir, "config");
+      await writeFile(path, "[profile other]\nregion = eu-west-1\n\n[default]\noutput = json\n");
+      process.env.AWS_CONFIG_FILE = path;
+      delete process.env.AWS_PROFILE;
+      const { regionFromConfigFile } = await import("./region");
+      expect(await regionFromConfigFile()).toBeUndefined();
+    } finally {
+      if (savedConfigFile === undefined) delete process.env.AWS_CONFIG_FILE;
+      else process.env.AWS_CONFIG_FILE = savedConfigFile;
+      if (savedProfile === undefined) delete process.env.AWS_PROFILE;
+      else process.env.AWS_PROFILE = savedProfile;
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/src/core/region.ts b/src/core/region.ts
new file mode 100644
index 0000000000..f7c2ba415d
--- /dev/null
+++ b/src/core/region.ts
@@ -0,0 +1,73 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { readTextFile } from "../io";
+
+// DEFAULT_REGION is the final fallback when no region is configured anywhere.
+export const DEFAULT_REGION = "us-east-1";
+
+/**
+ * Reads the `region` setting for the active profile from the shared AWS config
+ * file (~/.aws/config, or $AWS_CONFIG_FILE). The active profile is $AWS_PROFILE,
+ * else "default". Returns undefined if the file, profile, or setting is absent —
+ * never throws.
+ */
+export async function regionFromConfigFile(): Promise<string | undefined> {
+  const path = process.env.AWS_CONFIG_FILE || join(homedir(), ".aws", "config");
+  let text: string;
+  try {
+    text = await readTextFile(path);
+  } catch {
+    return undefined; // no config file
+  }
+
+  // In ~/.aws/config the default profile is "[default]" and named profiles are
+  // "[profile name]".
+  const profile = process.env.AWS_PROFILE || "default";
+  const wanted = profile === "default" ? "default" : `profile ${profile}`;
+
+  let inSection = false;
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (line.startsWith("[") && line.endsWith("]")) {
+      inSection = line.slice(1, -1).trim() === wanted;
+      continue;
+    }
+    if (inSection && line.startsWith("region")) {
+      const value = line.split("=")[1]?.trim();
+      if (value) return value;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Picks the effective AWS region: an explicit --region value, then
+ * AWS_REGION / AWS_DEFAULT_REGION, then the shared config file, finally
+ * DEFAULT_REGION. It always resolves to a value.
+ */
+export async function resolveRegion(flagRegion: string | undefined): Promise<string> {
+  return (
+    flagRegion ||
+    process.env.AWS_REGION ||
+    process.env.AWS_DEFAULT_REGION ||
+    (await regionFromConfigFile()) ||
+    DEFAULT_REGION
+  );
+}
+
+/**
+ * Best-effort extraction of a `--region <value>` / `--region=<value>` argument
+ * from raw argv, for callers that run outside the command router (telemetry).
+ * Not a full argv parser: a literal "--region" appearing as another flag's
+ * value can mislead it, which is acceptable for its only consumer — the China
+ * telemetry gate, where a wrong match can only disable telemetry, never enable
+ * it.
+ */
+export function regionFlagFromArgv(argv: readonly string[]): string | undefined {
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]!;
+    if (arg === "--region") return argv[i + 1];
+    if (arg.startsWith("--region=")) return arg.slice("--region=".length);
+  }
+  return undefined;
+}
diff --git a/src/errors/errors.tsx b/src/errors/errors.tsx
index 1580346c88..06f1c12cc3 100644
--- a/src/errors/errors.tsx
+++ b/src/errors/errors.tsx
@@ -88,6 +88,17 @@ export class InputValidationError extends AgentCoreCLIError {
   }
 }
 
+/**
+ * Error raised when a feature is not available in the AWS partition of the
+ * target region (e.g. model-provider templates or Bedrock-backed features in
+ * the aws-cn partition).
+ */
+export class RegionUnsupportedFeatureError extends AgentCoreCLIError {
+  constructor(message?: string, options?: Omit<AgentCoreCLIErrorOptions, "source">) {
+    super(message, { ...options, source: ERROR_SOURCE.USER });
+  }
+}
+
 /** Error raised when valid user input references a resource that does not exist. */
 export class ResourceNotFoundError extends AgentCoreCLIError {
   constructor(message?: string, options?: Omit<AgentCoreCLIErrorOptions, "source">) {
diff --git a/src/errors/index.tsx b/src/errors/index.tsx
index de0b4dbe52..624664306e 100644
--- a/src/errors/index.tsx
+++ b/src/errors/index.tsx
@@ -13,6 +13,7 @@ export {
   NotImplementedError,
   ProjectFileExistsError,
   ProjectStateError,
+  RegionUnsupportedFeatureError,
   ResourceNotFoundError,
   ResultTruncationError,
   RuntimeInvokeResponseError,
diff --git a/src/globalConfig/accessor.test.tsx b/src/globalConfig/accessor.test.tsx
new file mode 100644
index 0000000000..ec4244341e
--- /dev/null
+++ b/src/globalConfig/accessor.test.tsx
@@ -0,0 +1,115 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { DefaultGlobalConfigAccessor } from "./accessor";
+import { FsReadWriteJson } from "../io";
+import { createSilentLogger } from "../testing";
+
+describe("DefaultGlobalConfigAccessor telemetry partition default", () => {
+  let tempDir: string;
+  let configPath: string;
+  const savedEnv = { ...process.env };
+
+  const savedArgv = [...process.argv];
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), "agentcore-accessor-test-"));
+    configPath = join(tempDir, "config.json");
+    delete process.env.AWS_REGION;
+    delete process.env.AWS_DEFAULT_REGION;
+    delete process.env.AWS_PROFILE;
+    // Point the shared-config fallback of the region resolution at a
+    // nonexistent file so the host's real ~/.aws/config cannot leak in.
+    process.env.AWS_CONFIG_FILE = join(tempDir, "no-aws-config");
+  });
+
+  afterEach(async () => {
+    process.env = { ...savedEnv };
+    process.argv = [...savedArgv];
+    await rm(tempDir, { recursive: true, force: true });
+  });
+
+  function accessor() {
+    const logger = createSilentLogger();
+    return new DefaultGlobalConfigAccessor({
+      logger,
+      filePath: configPath,
+      json: new FsReadWriteJson({ logger }),
+    });
+  }
+
+  test("telemetry defaults to enabled outside the aws-cn partition", async () => {
+    const config = await accessor().get();
+    expect(config.telemetry.enabled).toBe(true);
+  });
+
+  test.each(["AWS_REGION", "AWS_DEFAULT_REGION"] as const)(
+    "telemetry defaults to disabled when %s is a China region",
+    async (envVar) => {
+      process.env[envVar] = "cn-north-1";
+      const config = await accessor().get();
+      expect(config.telemetry.enabled).toBe(false);
+    },
+  );
+
+  test("an explicit telemetry.enabled in the config file wins over the aws-cn default", async () => {
+    process.env.AWS_REGION = "cn-north-1";
+    await writeFile(configPath, JSON.stringify({ telemetry: { enabled: true } }));
+
+    const config = await accessor().get();
+    expect(config.telemetry.enabled).toBe(true);
+  });
+
+  test("a first run in a China region persists telemetry disabled", async () => {
+    process.env.AWS_REGION = "cn-north-1";
+    await accessor().get();
+
+    const persisted = JSON.parse(await readFile(configPath, "utf8"));
+    expect(persisted.telemetry).toEqual({ enabled: false });
+
+    // A later run in a commercial region keeps the persisted opt-out — the
+    // first-run notice was never shown, so telemetry must not silently start.
+    delete process.env.AWS_REGION;
+    const config = await accessor().get();
+    expect(config.telemetry.enabled).toBe(false);
+    expect(config.isFirstRun).toBe(false);
+  });
+
+  test("a first commercial run persists only the installation id", async () => {
+    await accessor().get();
+
+    const persisted = JSON.parse(await readFile(configPath, "utf8"));
+    expect(persisted.telemetry).toBeUndefined();
+    expect(persisted.installationId).toBeDefined();
+  });
+
+  test("a first run with China only from --region persists telemetry disabled", async () => {
+    process.argv = ["node", "agentcore", "runtime", "list", "--region", "cn-north-1"];
+    await accessor().get();
+
+    const persisted = JSON.parse(await readFile(configPath, "utf8"));
+    expect(persisted.telemetry).toEqual({ enabled: false });
+  });
+
+  test("a first run with China only from the active profile persists telemetry disabled", async () => {
+    const awsConfigPath = join(tempDir, "aws-config");
+    await writeFile(awsConfigPath, "[default]\nregion = cn-northwest-1\n");
+    process.env.AWS_CONFIG_FILE = awsConfigPath;
+
+    const config = await accessor().get();
+    expect(config.telemetry.enabled).toBe(false);
+
+    const persisted = JSON.parse(await readFile(configPath, "utf8"));
+    expect(persisted.telemetry).toEqual({ enabled: false });
+  });
+
+  test("a first China run does not clobber a pre-seeded explicit opt-in", async () => {
+    process.env.AWS_REGION = "cn-north-1";
+    await writeFile(configPath, JSON.stringify({ telemetry: { enabled: true } }));
+
+    await accessor().get();
+    const persisted = JSON.parse(await readFile(configPath, "utf8"));
+    expect(persisted.telemetry.enabled).toBe(true);
+  });
+});
diff --git a/src/globalConfig/accessor.tsx b/src/globalConfig/accessor.tsx
index 1bb1210557..281f546f45 100644
--- a/src/globalConfig/accessor.tsx
+++ b/src/globalConfig/accessor.tsx
@@ -8,6 +8,8 @@ import type { ReadWriteJson } from "../io";
 import type { Logger } from "../logging";
 import { globalConfigFileSchema } from "./types";
 import { DEFAULT_GLOBAL_CONFIG, applyOverrides } from "./config";
+import { isChinaContext } from "../core/partition";
+import { regionFlagFromArgv, resolveRegion } from "../core/region";
 import z from "zod";
 import { InputValidationError } from "../errors";
 
@@ -45,6 +47,13 @@ export class DefaultGlobalConfigAccessor implements GlobalConfigAccessor {
 
     const configFileData = await this.readConfigFile();
 
+    // Resolve China the same way the telemetry client does (--region from
+    // argv, env vars, shared config profile, project targets) so the persist
+    // decision below can never disagree with the client's suppression.
+    const chinaContext = await isChinaContext({
+      region: await resolveRegion(regionFlagFromArgv(process.argv)),
+    });
+
     // a run with no persisted installationId is the first run on this machine
     const isFirstRun = !configFileData.installationId;
 
@@ -52,6 +61,15 @@ export class DefaultGlobalConfigAccessor implements GlobalConfigAccessor {
       configFileData.installationId = DEFAULT_GLOBAL_CONFIG.installationId;
       this.logger.info(`no installationId found, persisting one`);
 
+      // A first run in a China (aws-cn) environment persists telemetry off:
+      // the first-run notice is not shown there (telemetry is disabled), so
+      // without persisting, a later run in a commercial region would flip
+      // telemetry back on without the notice ever having been displayed.
+      if (chinaContext && configFileData.telemetry?.enabled === undefined) {
+        configFileData.telemetry = { ...configFileData.telemetry, enabled: false };
+        this.logger.info(`first run in a China region, persisting telemetry disabled`);
+      }
+
       try {
         await this.writeToConfigFile(configFileData);
       } catch (e) {
@@ -63,7 +81,17 @@ export class DefaultGlobalConfigAccessor implements GlobalConfigAccessor {
       }
     }
 
-    this.cachedConfig = { ...applyOverrides(DEFAULT_GLOBAL_CONFIG, configFileData), isFirstRun };
+    // No telemetry collector exists in the aws-cn partition, so telemetry
+    // defaults to disabled there; an explicit telemetry.enabled in the config
+    // file still wins through applyOverrides.
+    const defaults = chinaContext
+      ? {
+          ...DEFAULT_GLOBAL_CONFIG,
+          telemetry: { ...DEFAULT_GLOBAL_CONFIG.telemetry, enabled: false },
+        }
+      : DEFAULT_GLOBAL_CONFIG;
+
+    this.cachedConfig = { ...applyOverrides(defaults, configFileData), isFirstRun };
     return this.cachedConfig;
   }
 
diff --git a/src/handlers/project/add/runtime/index.test.ts b/src/handlers/project/add/runtime/index.test.ts
index 3e7652a306..8ebddafa05 100644
--- a/src/handlers/project/add/runtime/index.test.ts
+++ b/src/handlers/project/add/runtime/index.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, describe, expect, test } from "bun:test";
+import { writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { createRootHandler } from "../../../index";
 import {
@@ -487,6 +488,9 @@ describe("project add runtime --type import", () => {
       codeLocation: "app/support_proxy",
       runtimeVersion: "PYTHON_3_14",
       protocol: "HTTP",
+      // Imports wire Bedrock model code; persisting the provider lets the
+      // China deploy gate hard-fail if a China target is added later.
+      modelProvider: "Bedrock",
     });
     expect(spec.runtimes[0].additionalPolicies).toBeUndefined();
 
@@ -575,6 +579,35 @@ describe("project add runtime --type import", () => {
     expect(core.importedBedrockAgents).toEqual([]);
   });
 
+  test("rejects the import before calling Bedrock when a target is in a China region", async () => {
+    const { projectRoot, cleanup } = await initProject();
+    cleanups.push(cleanup);
+    await writeFile(
+      join(projectRoot, "agentcore", "aws-targets.json"),
+      JSON.stringify([{ name: "cn", account: "111122223333", region: "cn-north-1" }]),
+    );
+    const core = new TestCoreClient();
+    core.bedrockAgentImportPlans["A1B2C3D4E5/TSTALIASID"] = translatedImportPlan();
+
+    await expect(run(importArgs, { core })).rejects.toThrow(
+      /Amazon Bedrock is not available in China regions/,
+    );
+    expect(core.importedBedrockAgents).toEqual([]);
+  });
+
+  test("rejects the import when --region is a China region even without a China target", async () => {
+    const { cleanup } = await initProject();
+    cleanups.push(cleanup);
+    const core = new TestCoreClient();
+    core.bedrockAgentImportPlans["A1B2C3D4E5/TSTALIASID"] = translatedImportPlan();
+
+    const args = [...importArgs.slice(0, -2), "--region", "cn-north-1"];
+    await expect(run(args, { core })).rejects.toThrow(
+      /Amazon Bedrock is not available in China regions/,
+    );
+    expect(core.importedBedrockAgents).toEqual([]);
+  });
+
   test("requires --agent-id and --agent-alias-id with --type import", async () => {
     const { cleanup } = await initProject();
     cleanups.push(cleanup);
diff --git a/src/handlers/project/add/runtime/index.ts b/src/handlers/project/add/runtime/index.ts
index b03d021111..0c5077fc36 100644
--- a/src/handlers/project/add/runtime/index.ts
+++ b/src/handlers/project/add/runtime/index.ts
@@ -1,8 +1,9 @@
 import z from "zod";
 import { createHandler, flag, ProjectKey } from "../../../../router";
+import { isChinaRegion } from "../../../../core/partition";
 import type { AddProjectResourceConfig } from "../types";
 import { parseJsonFlag, parseTags } from "../../../utils";
-import { InputValidationError } from "../../../../errors";
+import { InputValidationError, RegionUnsupportedFeatureError } from "../../../../errors";
 import { AgentNameSchema, type EnvVar } from "../../../../projectSchemas/runtime";
 import { RuntimeAuthorizerTypeSchema } from "../../../../projectSchemas/auth";
 import { NetworkModeSchema } from "../../../../projectSchemas/constants";
@@ -73,10 +74,17 @@ export const createAddRuntimeHandler = (config: AddProjectResourceConfig) =>
       ),
       flag(
         "model-provider",
-        "model provider for supported templates (Bedrock, Anthropic, OpenAI, or Gemini)",
+        "model provider for supported templates (Bedrock, Anthropic, OpenAI, Gemini, or LiteLLM)",
         ModelProviderSchema.optional(),
         { group: CONFIGURATION },
       ),
+      flag(
+        "model-id",
+        "model id for the scaffolded Runtime code, overriding the provider's default " +
+          "(required with litellm in China regions)",
+        z.string().min(1).optional(),
+        { group: CONFIGURATION },
+      ),
       flag(
         "api-key",
         "API key for non-Bedrock providers on supported templates; '-' for stdin, 'file://path' for file",
@@ -173,26 +181,22 @@ export const createAddRuntimeHandler = (config: AddProjectResourceConfig) =>
     ],
     handle: async (ctx, flags) => {
       const project = ctx.require(ProjectKey);
-      requireDeployedNameFits(
-        "Runtime",
-        project.name,
-        flags.name,
-        "_",
-        48,
-        await config.projectManager.listTargets(project),
-      );
+      const deploymentTargets = await config.projectManager.listTargets(project);
+      requireDeployedNameFits("Runtime", project.name, flags.name, "_", 48, deploymentTargets);
 
       const isImport = flags["type"] === "import";
       const isTemplate = flags["template"] !== undefined;
       const modelFlagsPresent =
-        flags["model-provider"] !== undefined || flags["api-key"] !== undefined;
+        flags["model-provider"] !== undefined ||
+        flags["model-id"] !== undefined ||
+        flags["api-key"] !== undefined;
 
       if (flags.framework !== undefined && !isImport) {
         throw new InputValidationError("--framework requires --type import");
       }
 
       if (isImport) {
-        const importIncompatibleFlags = (["model-provider", "api-key"] as const).filter(
+        const importIncompatibleFlags = (["model-provider", "model-id", "api-key"] as const).filter(
           (flagName) => flags[flagName] !== undefined,
         );
         if (isTemplate || importIncompatibleFlags.length > 0) {
@@ -210,12 +214,12 @@ export const createAddRuntimeHandler = (config: AddProjectResourceConfig) =>
       if (!isImport && modelFlagsPresent) {
         if (!isTemplate) {
           throw new InputValidationError(
-            "--model-provider and --api-key only apply to templates that support them",
+            "--model-provider, --model-id, and --api-key only apply to templates that support them",
           );
         }
         if (!RUNTIME_TEMPLATE_SHORTCUTS[flags.template!].supportsModelProviderOverride) {
           throw new InputValidationError(
-            `--model-provider and --api-key are not valid with the ${flags.template} template`,
+            `--model-provider, --model-id, and --api-key are not valid with the ${flags.template} template`,
           );
         }
       }
@@ -228,6 +232,19 @@ export const createAddRuntimeHandler = (config: AddProjectResourceConfig) =>
 
       let importBedrockAgent: ImportBedrockAgentInput | undefined;
       if (isImport) {
+        // The import path calls Amazon Bedrock, which is not available in the
+        // aws-cn partition — fail before any Bedrock call is made. Check the
+        // command's resolved region too: it selects the source agent's region
+        // and can be a China region even when no China target is configured.
+        if (
+          deploymentTargets.some((target) => isChinaRegion(target.region)) ||
+          isChinaRegion(ctx.require(RegionKey))
+        ) {
+          throw new RegionUnsupportedFeatureError(
+            "--type import translates a Bedrock Agent, and Amazon Bedrock is not available in " +
+              "China regions (cn-north-1, cn-northwest-1).",
+          );
+        }
         importBedrockAgent = await resolveImportBedrockAgentInput({
           importer: config.bedrockAgentImporter,
           runtimeName,
@@ -252,6 +269,7 @@ export const createAddRuntimeHandler = (config: AddProjectResourceConfig) =>
           ? resolveRuntimeTemplateShortcut(flags.template!, {
               runtimeName: flags.name,
               modelProvider: flags["model-provider"],
+              modelId: flags["model-id"],
               apiKey,
             })
           : resolveRuntimeTemplateShortcut("agent-python-minimal", { runtimeName: flags.name });
diff --git a/src/handlers/project/create/index.ts b/src/handlers/project/create/index.ts
index acfc368657..a5a68a82e5 100644
--- a/src/handlers/project/create/index.ts
+++ b/src/handlers/project/create/index.ts
@@ -25,8 +25,16 @@ import {
   HarnessSpecSchema,
   type HarnessModelProvider,
 } from "../../../projectSchemas/harness";
-import { InputValidationError } from "../../../errors";
-import { JsonKey } from "../../keys";
+import { InputValidationError, RegionUnsupportedFeatureError } from "../../../errors";
+import { isChinaRegion } from "../../../core/partition";
+import {
+  HARNESS_CN_MESSAGE,
+  LITELLM_BEDROCK_MODEL_ID_CN_MESSAGE,
+  LITELLM_MODEL_ID_REQUIRED_CN_MESSAGE,
+  MEMORY_STRIPPED_CN_MESSAGE,
+  MODEL_PROVIDER_RUNTIMES_CN_MESSAGE,
+} from "../../../core/project/manager";
+import { JsonKey, RegionKey } from "../../keys";
 import { renderResult } from "../../utils";
 import { projectReference, type ProjectMutationResult } from "../output";
 
@@ -59,6 +67,12 @@ export const createCreateProjectHandler = (config: CreateProjectHandlerConfig) =
         "model provider for templates that support it: bedrock, anthropic, open_ai, gemini, or lite_llm",
         ModelProviderFlagSchema.optional(),
       ),
+      flag(
+        "model-id",
+        "model id for the scaffolded Runtime code, overriding the provider's default " +
+          "(required with lite_llm in China regions)",
+        z.string().min(1).optional(),
+      ),
       flag(
         "api-key",
         "API key for non-Bedrock providers: '-' for stdin, 'file://path' for file",
@@ -84,7 +98,7 @@ export const createCreateProjectHandler = (config: CreateProjectHandlerConfig) =
       const modelProviderFlag = flags["model-provider"];
       const apiKeyFlag = flags["api-key"];
 
-      const runtimeCodeFlags = (["model-provider", "api-key"] as const).filter(
+      const runtimeCodeFlags = (["model-provider", "model-id", "api-key"] as const).filter(
         (flagName) => flags[flagName] !== undefined,
       );
       if (runtimeCodeFlags.length > 0) {
@@ -108,20 +122,47 @@ export const createCreateProjectHandler = (config: CreateProjectHandlerConfig) =
 
       let createInput: CreateProjectInput;
       if (template === undefined) {
+        // The default (no --template) creates a harness project, which is not
+        // part of the China launch.
+        if (isChinaRegion(ctx.require(RegionKey))) {
+          throw new RegionUnsupportedFeatureError(HARNESS_CN_MESSAGE);
+        }
         createInput = { ...base, scaffoldHarnessInput: resolveScaffoldHarnessInput({ name }) };
       } else if (template === EMPTY_TEMPLATE_NAME) {
         createInput = { ...base };
       } else {
         const source = new SourceResolver({ stdin: config.io.stdin });
         const apiKey = await source.resolveSecret("api-key", apiKeyFlag);
-        createInput = {
-          ...base,
-          scaffoldRuntimeInput: resolveRuntimeTemplateShortcut(template, {
-            runtimeName: DEFAULT_CREATE_RUNTIME_NAME,
-            modelProvider: resolveRuntimeModelProvider(modelProviderFlag),
-            apiKey,
-          }),
-        };
+        const scaffoldRuntimeInput = resolveRuntimeTemplateShortcut(template, {
+          runtimeName: DEFAULT_CREATE_RUNTIME_NAME,
+          modelProvider: resolveRuntimeModelProvider(modelProviderFlag),
+          modelId: flags["model-id"],
+          apiKey,
+        });
+        // Apply the China gate at creation when the command's resolved region
+        // (--region flag, env, or profile) already says aws-cn, so the most
+        // common workflow fails before scaffolding instead of at deploy.
+        if (isChinaRegion(ctx.require(RegionKey))) {
+          if (scaffoldRuntimeInput.framework !== "none") {
+            if ((scaffoldRuntimeInput.modelProvider ?? "Bedrock") !== "LiteLLM") {
+              throw new RegionUnsupportedFeatureError(MODEL_PROVIDER_RUNTIMES_CN_MESSAGE);
+            }
+            if (scaffoldRuntimeInput.modelId === undefined) {
+              throw new RegionUnsupportedFeatureError(LITELLM_MODEL_ID_REQUIRED_CN_MESSAGE);
+            }
+            if (scaffoldRuntimeInput.modelId.startsWith("bedrock/")) {
+              throw new RegionUnsupportedFeatureError(LITELLM_BEDROCK_MODEL_ID_CN_MESSAGE);
+            }
+          }
+          // AgentCore Memory is not available in China regions; scaffold
+          // without the template's default memory (the rendered code degrades
+          // to no memory until its env var appears).
+          if (scaffoldRuntimeInput.memory !== undefined) {
+            scaffoldRuntimeInput.memory = undefined;
+            config.io.stderr.write(`${MEMORY_STRIPPED_CN_MESSAGE}\n`);
+          }
+        }
+        createInput = { ...base, scaffoldRuntimeInput };
       }
 
       // Same driver as build and deploy: a live step list in a TTY, and the previous plain
diff --git a/src/handlers/project/project.test.ts b/src/handlers/project/project.test.ts
index 5d3ac21aec..4ff68e7675 100644
--- a/src/handlers/project/project.test.ts
+++ b/src/handlers/project/project.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, test, expect, describe } from "bun:test";
 import { existsSync } from "node:fs";
-import { mkdir, readdir, rm } from "node:fs/promises";
+import { mkdir, readdir, readFile, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { parse } from "yaml";
 import { createRootHandler } from "../index";
@@ -1133,3 +1133,159 @@ describe("project deploy", () => {
     );
   });
 });
+
+describe("create in China regions", () => {
+  const skips = ["--skip-install", "--skip-git"];
+
+  test("rejects a Bedrock-wired template", async () => {
+    cleanups.push((await inTempDirectory()).cleanup);
+    await expect(
+      run([
+        "create",
+        "--name",
+        "CnAgent",
+        "--template",
+        "agent-python-strands",
+        ...skips,
+        "--region",
+        "cn-north-1",
+      ]),
+    ).rejects.toThrow(/not accessible from China regions/);
+  });
+
+  test("requires --model-id with litellm", async () => {
+    cleanups.push((await inTempDirectory()).cleanup);
+    await expect(
+      run([
+        "create",
+        "--name",
+        "CnAgent",
+        "--template",
+        "agent-python-strands",
+        "--model-provider",
+        "lite_llm",
+        ...skips,
+        "--region",
+        "cn-north-1",
+      ]),
+    ).rejects.toThrow(/requires --model-id in China regions/);
+  });
+
+  test("scaffolds litellm with --model-id and persists the provider", async () => {
+    const { path: directory, cleanup } = await inTempDirectory();
+    cleanups.push(cleanup);
+    await run([
+      "create",
+      "--name",
+      "CnAgent",
+      "--template",
+      "agent-python-strands",
+      "--model-provider",
+      "lite_llm",
+      "--model-id",
+      "openai/qwen-max",
+      ...skips,
+      "--region",
+      "cn-north-1",
+    ]);
+
+    const projectRoot = join(directory, "CnAgent");
+    const loadPy = await readFile(join(projectRoot, "app", "agent", "model", "load.py"), "utf8");
+    expect(loadPy).toContain('model_id="openai/qwen-max"');
+
+    const spec = JSON.parse(
+      await readFile(join(projectRoot, "agentcore", "agentcore.json"), "utf8"),
+    );
+    expect(spec.runtimes[0].modelProvider).toBe("LiteLLM");
+    expect(spec.runtimes[0].modelId).toBe("openai/qwen-max");
+    // The template's default memory is dropped in China (AgentCore Memory has
+    // no CloudFormation type there), while the memory module stays in the code.
+    expect(spec.memories ?? []).toEqual([]);
+    expect(existsSync(join(projectRoot, "app", "agent", "memory"))).toBe(true);
+  });
+
+  test("rejects a bedrock/ LiteLLM model id in a China region", async () => {
+    const { cleanup } = await inTempDirectory();
+    cleanups.push(cleanup);
+    await expect(
+      run([
+        "create",
+        "--name",
+        "CnBedrockRoute",
+        "--template",
+        "agent-python-strands",
+        "--model-provider",
+        "lite_llm",
+        "--model-id",
+        "bedrock/us.anthropic.claude-sonnet-4-5-20250514-v1:0",
+        ...skips,
+        "--region",
+        "cn-north-1",
+      ]),
+    ).rejects.toThrow(/'bedrock\/' LiteLLM model id prefix routes to Amazon Bedrock/);
+  });
+
+  test("escapes quotes in --model-id in the scaffolded model code", async () => {
+    const { path: directory, cleanup } = await inTempDirectory();
+    cleanups.push(cleanup);
+    await run([
+      "create",
+      "--name",
+      "QuotedModel",
+      "--template",
+      "agent-python-strands",
+      "--model-provider",
+      "lite_llm",
+      "--model-id",
+      'openai/we"ird',
+      ...skips,
+      "--region",
+      "cn-north-1",
+    ]);
+
+    const projectRoot = join(directory, "QuotedModel");
+    const loadPy = await readFile(join(projectRoot, "app", "agent", "model", "load.py"), "utf8");
+    expect(loadPy).toContain('model_id="openai/we\\"ird"');
+  });
+
+  test("allows a provider-free template", async () => {
+    const { path: directory, cleanup } = await inTempDirectory();
+    cleanups.push(cleanup);
+    await run([
+      "create",
+      "--name",
+      "CnMcp",
+      "--template",
+      "mcp-python-fastmcp",
+      ...skips,
+      "--region",
+      "cn-north-1",
+    ]);
+
+    const spec = JSON.parse(
+      await readFile(join(directory, "CnMcp", "agentcore", "agentcore.json"), "utf8"),
+    );
+    expect(spec.runtimes[0].modelProvider).toBeUndefined();
+  });
+
+  test("rejects the default harness project", async () => {
+    cleanups.push((await inTempDirectory()).cleanup);
+    await expect(
+      run(["create", "--name", "CnHarness", ...skips, "--region", "cn-north-1"]),
+    ).rejects.toThrow(/Harness projects are not available in China regions/);
+  });
+
+  test("allows the empty template", async () => {
+    cleanups.push((await inTempDirectory()).cleanup);
+    await run([
+      "create",
+      "--name",
+      "CnEmpty",
+      "--template",
+      "empty",
+      ...skips,
+      "--region",
+      "cn-north-1",
+    ]);
+  });
+});
diff --git a/src/handlers/project/shortcuts.ts b/src/handlers/project/shortcuts.ts
index 56d09d9871..cf73f539c8 100644
--- a/src/handlers/project/shortcuts.ts
+++ b/src/handlers/project/shortcuts.ts
@@ -228,6 +228,7 @@ export function formatTemplateParameterHelp(options?: { includeEmpty?: boolean }
 type RuntimeTemplateOverrides = {
   runtimeName?: string;
   modelProvider?: ModelProvider;
+  modelId?: string;
   apiKey?: string;
 };
 
@@ -247,6 +248,7 @@ export function resolveRuntimeTemplateShortcut(
     modelProvider: template.supportsModelProviderOverride
       ? (overrides?.modelProvider ?? template.modelProvider)
       : template.modelProvider,
+    ...(overrides?.modelId !== undefined && { modelId: overrides.modelId }),
     ...(overrides?.apiKey !== undefined && { apiKey: overrides.apiKey }),
     ...(template.includesMemory && { memory: getDefaultMemorySpec(runtimeName) }),
     runtimeVersion: template.runtimeVersion,
diff --git a/src/handlers/project/types.ts b/src/handlers/project/types.ts
index 43439ea7d4..a9c5b2827f 100644
--- a/src/handlers/project/types.ts
+++ b/src/handlers/project/types.ts
@@ -37,25 +37,9 @@ export type ManagedEvaluatorScaffoldInput = {
 };
 
 /** Model providers the scaffolded runtime code can target. */
-export const MODEL_PROVIDERS = ["Bedrock", "Anthropic", "OpenAI", "Gemini", "LiteLLM"] as const;
-export type ModelProvider = (typeof MODEL_PROVIDERS)[number];
-
-const MODEL_PROVIDER_ALIASES: Record<string, ModelProvider> = {
-  bedrock: "Bedrock",
-  anthropic: "Anthropic",
-  openai: "OpenAI",
-  open_ai: "OpenAI",
-  gemini: "Gemini",
-  litellm: "LiteLLM",
-  lite_llm: "LiteLLM",
-};
-
-/** Parses a provider name case-insensitively (e.g. `anthropic`), normalizing to canonical casing. */
-export const ModelProviderSchema = z.preprocess(
-  (value) =>
-    typeof value === "string" ? (MODEL_PROVIDER_ALIASES[value.toLowerCase()] ?? value) : value,
-  z.enum(MODEL_PROVIDERS),
-);
+import { ModelProviderSchema } from "../../projectSchemas/runtime";
+export { MODEL_PROVIDERS, ModelProviderSchema } from "../../projectSchemas/runtime";
+export type { ModelProvider } from "../../projectSchemas/runtime";
 
 /** Set of arguments needed to scaffold a new Runtime-based agent. */
 export const ScaffoldRuntimeInputSchema = z
@@ -66,6 +50,7 @@ export const ScaffoldRuntimeInputSchema = z
     framework: z.enum(["strands", "langchain", "vercelai", "none"]),
     protocol: ProtocolModeSchema.optional(),
     modelProvider: ModelProviderSchema.optional(),
+    modelId: z.string().min(1).optional(),
     apiKey: z.string().min(1).optional(),
     memory: MemorySchema.optional(),
     runtimeVersion: RuntimeVersionSchema.optional(),
diff --git a/src/index.ts b/src/index.ts
index 6ebebaa6cb..ce4cf49ba9 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -52,6 +52,7 @@ process.exit(
       logger: rootLogger.child({ module: "telemetry" }),
       sessionId: cliSessionId,
       globalConfigAccessor,
+      argv,
     });
 
     const commandRunMetricEvent = telemetryClient.createMetricEvent("cli.command_run", {
diff --git a/src/middleware/withRegion.tsx b/src/middleware/withRegion.tsx
index 3a38a0cee6..eb305ac3bf 100644
--- a/src/middleware/withRegion.tsx
+++ b/src/middleware/withRegion.tsx
@@ -1,58 +1,7 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { RegionKey } from "../handlers/keys";
-import { readTextFile } from "../io";
+import { resolveRegion } from "../core/region";
 import { type Middleware } from "../router";
 
-// DEFAULT_REGION is the final fallback when no region is configured anywhere.
-const DEFAULT_REGION = "us-east-1";
-
-// regionFromConfigFile reads the `region` setting for the active profile from the
-// shared AWS config file (~/.aws/config, or $AWS_CONFIG_FILE). The active profile
-// is $AWS_PROFILE, else "default". Returns undefined if the file, profile, or
-// setting is absent — never throws.
-async function regionFromConfigFile(): Promise<string | undefined> {
-  const path = process.env.AWS_CONFIG_FILE || join(homedir(), ".aws", "config");
-  let text: string;
-  try {
-    text = await readTextFile(path);
-  } catch {
-    return undefined; // no config file
-  }
-
-  // In ~/.aws/config the default profile is "[default]" and named profiles are
-  // "[profile name]".
-  const profile = process.env.AWS_PROFILE || "default";
-  const wanted = profile === "default" ? "default" : `profile ${profile}`;
-
-  let inSection = false;
-  for (const raw of text.split("\n")) {
-    const line = raw.trim();
-    if (line.startsWith("[") && line.endsWith("]")) {
-      inSection = line.slice(1, -1).trim() === wanted;
-      continue;
-    }
-    if (inSection && line.startsWith("region")) {
-      const value = line.split("=")[1]?.trim();
-      if (value) return value;
-    }
-  }
-  return undefined;
-}
-
-// resolveRegion picks the effective AWS region: an explicit --region (already on
-// the context), then AWS_REGION / AWS_DEFAULT_REGION, then the shared config file,
-// finally DEFAULT_REGION. It always resolves to a value.
-async function resolveRegion(flagRegion: string | undefined): Promise<string> {
-  return (
-    flagRegion ||
-    process.env.AWS_REGION ||
-    process.env.AWS_DEFAULT_REGION ||
-    (await regionFromConfigFile()) ||
-    DEFAULT_REGION
-  );
-}
-
 // withRegion resolves the effective AWS region and pins it onto the context under
 // RegionKey so the whole app uses a single, consistent value. There is always a
 // region: it falls back to DEFAULT_REGION when nothing else is configured.
diff --git a/src/projectSchemas/aws-targets.test.ts b/src/projectSchemas/aws-targets.test.ts
index 5cf2997540..2ad154abb7 100644
--- a/src/projectSchemas/aws-targets.test.ts
+++ b/src/projectSchemas/aws-targets.test.ts
@@ -54,6 +54,8 @@ describe("AWS deployment targets", () => {
     "ap-south-2",
     "ap-southeast-5",
     "ap-southeast-7",
+    "cn-north-1",
+    "cn-northwest-1",
     "eu-south-1",
     "eu-south-2",
     "us-gov-west-1",
diff --git a/src/projectSchemas/aws-targets.ts b/src/projectSchemas/aws-targets.ts
index b3dc0c5ec3..863e510061 100644
--- a/src/projectSchemas/aws-targets.ts
+++ b/src/projectSchemas/aws-targets.ts
@@ -13,6 +13,8 @@ export const AgentCoreRegionSchema = z.enum([
   "ap-southeast-5",
   "ap-southeast-7",
   "ca-central-1",
+  "cn-north-1",
+  "cn-northwest-1",
   "eu-central-1",
   "eu-north-1",
   "eu-south-1",
diff --git a/src/projectSchemas/runtime.ts b/src/projectSchemas/runtime.ts
index 5e626e417f..d7f08a9565 100644
--- a/src/projectSchemas/runtime.ts
+++ b/src/projectSchemas/runtime.ts
@@ -236,9 +236,46 @@ export const RuntimeEndpointSchema = z.object({
   description: z.string().max(200).optional(),
 });
 export type RuntimeEndpoint = z.infer<typeof RuntimeEndpointSchema>;
+export const MODEL_PROVIDERS = ["Bedrock", "Anthropic", "OpenAI", "Gemini", "LiteLLM"] as const;
+export type ModelProvider = (typeof MODEL_PROVIDERS)[number];
+
+const MODEL_PROVIDER_ALIASES: Record<string, ModelProvider> = {
+  bedrock: "Bedrock",
+  anthropic: "Anthropic",
+  openai: "OpenAI",
+  open_ai: "OpenAI",
+  gemini: "Gemini",
+  litellm: "LiteLLM",
+  lite_llm: "LiteLLM",
+};
+
+/** Parses a provider name case-insensitively (e.g. `anthropic`), normalizing to canonical casing. */
+export const ModelProviderSchema = z.preprocess(
+  (value) =>
+    typeof value === "string" ? (MODEL_PROVIDER_ALIASES[value.toLowerCase()] ?? value) : value,
+  z.enum(MODEL_PROVIDERS),
+);
+
 export const ProjectRuntimeSchema = z
   .object({
     name: AgentNameSchema,
+    /**
+     * The model provider a template scaffold wired into this runtime's code.
+     * Written by scaffolds whose template renders provider client code; absent
+     * for BYO/provider-free runtimes and projects from older CLI versions.
+     * Read by the China (aws-cn) deploy gate; ignored by the CDK app.
+     * If you replace the model wiring in the runtime's code by hand, delete
+     * this field to reflect that.
+     */
+    modelProvider: ModelProviderSchema.optional(),
+    /**
+     * The model id the scaffold rendered into a LiteLLM runtime's code
+     * (explicit --model-id or the template default). Read by the China
+     * deploy gate to detect LiteLLM's Bedrock route ('bedrock/' prefix);
+     * ignored by the CDK app. Delete it together with modelProvider if you
+     * replace the model wiring by hand.
+     */
+    modelId: z.string().min(1).optional(),
     description: z.string().max(200).optional(),
     build: BuildTypeSchema,
     entrypoint: EntrypointSchema,
diff --git a/src/telemetry/client.test.tsx b/src/telemetry/client.test.tsx
index c7c2c559d2..9c76cf2356 100644
--- a/src/telemetry/client.test.tsx
+++ b/src/telemetry/client.test.tsx
@@ -433,6 +433,76 @@ describe("OtelHistogramSink", () => {
     expect(await readFile(auditFilePath, "utf8")).toContain("cli.command_run");
     await rm(auditFilePath, { force: true });
   });
+
+  test("an explicit --region China flag suppresses network export", async () => {
+    const auditFilePath = join(tmpdir(), `cn-flag-audit-${crypto.randomUUID()}.jsonl`);
+    const globalConfigAccessor = new TestGlobalConfigAccessor({
+      initialConfigData: {
+        ...DEFAULT_GLOBAL_CONFIG,
+        telemetry: {
+          enabled: true,
+          audit: true,
+          endpoint: `http://localhost:${testCollector.port}`,
+        },
+      },
+    });
+
+    const client = new DefaultTelemetryClient({
+      logger,
+      sessionId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+      globalConfigAccessor,
+      auditFilePath,
+      argv: ["node", "agentcore", "status", "--region", "cn-northwest-1"],
+    });
+    const event = client.createMetricEvent("cli.command_run", {
+      exit_reason: "success",
+      command_path: "/agentcore",
+    });
+    await event.emit(100);
+    await client.shutdown();
+
+    expect(receivedBodies).toHaveLength(0);
+    expect(await readFile(auditFilePath, "utf8")).toContain("cli.command_run");
+    await rm(auditFilePath, { force: true });
+  });
+
+  test("a China region suppresses network export even when telemetry is enabled", async () => {
+    const auditFilePath = join(tmpdir(), `cn-disabled-audit-${crypto.randomUUID()}.jsonl`);
+    const globalConfigAccessor = new TestGlobalConfigAccessor({
+      initialConfigData: {
+        ...DEFAULT_GLOBAL_CONFIG,
+        telemetry: {
+          enabled: true,
+          audit: true,
+          endpoint: `http://localhost:${testCollector.port}`,
+        },
+      },
+    });
+
+    const savedRegion = process.env.AWS_REGION;
+    process.env.AWS_REGION = "cn-north-1";
+    try {
+      const client = new DefaultTelemetryClient({
+        logger,
+        sessionId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+        globalConfigAccessor,
+        auditFilePath,
+      });
+      const event = client.createMetricEvent("cli.command_run", {
+        exit_reason: "success",
+        command_path: "/agentcore",
+      });
+      await event.emit(100);
+      await client.shutdown();
+    } finally {
+      if (savedRegion === undefined) delete process.env.AWS_REGION;
+      else process.env.AWS_REGION = savedRegion;
+    }
+
+    expect(receivedBodies).toHaveLength(0);
+    expect(await readFile(auditFilePath, "utf8")).toContain("cli.command_run");
+    await rm(auditFilePath, { force: true });
+  });
 });
 
 describe("resourceAttributesSchema", () => {
diff --git a/src/telemetry/client.tsx b/src/telemetry/client.tsx
index ce7b78ed2d..2ab7f490a3 100644
--- a/src/telemetry/client.tsx
+++ b/src/telemetry/client.tsx
@@ -15,6 +15,8 @@ import { FileSystemSink } from "./fileSystemSink";
 import path from "path";
 import { OtelHistogramSink } from "./otelSink";
 import { PACKAGE_VERSION } from "../constants";
+import { isChinaContext } from "../core/partition";
+import { regionFlagFromArgv, resolveRegion } from "../core/region";
 
 export type DefaultTelemetryClientConfig = {
   logger: Logger;
@@ -22,6 +24,8 @@ export type DefaultTelemetryClientConfig = {
   sessionId: string;
   metricSinks?: MetricSink[];
   auditFilePath?: string;
+  /** Raw process argv, used to honor an explicit --region for the China telemetry gate. */
+  argv?: readonly string[];
 };
 
 /**
@@ -33,12 +37,14 @@ export class DefaultTelemetryClient implements TelemetryClient {
   private readonly auditFilePath: string;
   private globalConfigAccessor: GlobalConfigAccessor;
   private readonly metricSinksOverride: MetricSink[] | undefined;
+  private readonly argv: readonly string[];
 
   constructor(config: DefaultTelemetryClientConfig) {
     this.logger = config.logger;
     this.sessionId = config.sessionId;
     this.globalConfigAccessor = config.globalConfigAccessor;
     this.metricSinksOverride = config.metricSinks;
+    this.argv = config.argv ?? [];
     this.auditFilePath =
       config.auditFilePath ??
       path.join(os.homedir(), ".agentcore", "telemetry", `${this.sessionId}.jsonl`);
@@ -87,7 +93,18 @@ export class DefaultTelemetryClient implements TelemetryClient {
         }),
       );
 
-    if (globalConfig.telemetry.enabled && !telemetryDisabledByEnv())
+    // Telemetry is unconditionally disabled in a China (aws-cn) context —
+    // regardless of config or endpoint overrides — to comply with the
+    // restrictions on sending telemetry out of the region. The region is
+    // resolved through the same chain the CLI itself uses (--region flag, env
+    // vars, shared config file). The audit file sink above is unaffected (it
+    // only writes locally).
+    const resolvedRegion = await resolveRegion(regionFlagFromArgv(this.argv));
+    if (
+      globalConfig.telemetry.enabled &&
+      !telemetryDisabledByEnv() &&
+      !(await isChinaContext({ region: resolvedRegion }))
+    )
       metricSinks.push(
         new OtelHistogramSink({
           logger: this.logger.child({ module: "otelCollectorSink" }),