cooper-oai cb00a67569 Add runtime assertion authentication modes and an auth provider (#55636) ...

## What changed

Add `RuntimeAuthProvider` to resolve request authentication through the runtime auth manager. Support `dual_header` mode, which sends a bearer credential alongside `x-openai-agent-assertion`, and `assertion_only` mode, which uses `Authorization: AgentAssertion …`.

Replace stale authentication headers and sign a fresh assertion for each request attempt. Propagate registration failures without falling back to credential-only authentication, preserving policy errors and classifying transport failures, rate limits, and server errors as transient.

Add the disabled-by-default `features.runtime_agent_instances` configuration with independent `enabled` and `mode` settings, schema support, and structured override merging. Selecting a mode alone does not enable the feature.

## Testing

Add coverage for both modes with API key and ChatGPT credentials, stale header replacement, fresh assertions, credential refresh without runtime replacement, registration failures, and configuration parsing and merging.

GitOrigin-RevId: 9e93d25762600f0ff592c5248fe4c8c2c8182c8d

2026-10-20 17:29:40 +00:00

..

src

Add runtime assertion authentication modes and an auth provider (#55636)

2026-10-20 17:29:40 +00:00

BUILD.bazel

Add wire types for runtime agent registration (#55398)

2026-10-19 22:21:46 +00:00

Cargo.toml

Add runtime assertion authentication modes and an auth provider (#55636)

2026-10-20 17:29:40 +00:00