cooper-oai efdacaf46f Stop retrying terminal runtime authentication denials (#60096) ...

## Why

Invalid assertions and paused or revoked runtime instances cannot recover through request retries or credential refresh. Permanent refresh-token failures also need to retain their sign-in error instead of becoming retryable stream errors.

## What changed

- Recognize terminal runtime denial codes in `401` and `403` response bodies and identity error headers, preserving HTTP diagnostics while stopping retries.
- Skip credential recovery for runtime denials in runtime-enabled model providers and backend requests, while preserving recovery for ordinary credential expiration.
- Propagate permanent refresh-token failures through runtime authentication as `RefreshTokenFailed` errors.

## Testing

Add coverage for body and header denials, preserved HTTP diagnostics, provider-scoped credential recovery, and cached permanent refresh failures. Complete-turn tests verify that runtime denials stop without retries or refreshes while expired credentials recover in both runtime authentication modes.

GitOrigin-RevId: 33f6f707454130e97e13f3b53e29d2c484602152

2026-11-07 09:48:46 +00:00

..

src

Stop retrying terminal runtime authentication denials (#60096)

2026-11-07 09:48:46 +00:00

BUILD.bazel

Add wire types for runtime agent registration (#55398)

2026-10-19 22:21:46 +00:00

Cargo.toml

Bind reusable backend clients to runtime authentication (#59255)

2026-11-03 23:35:00 +00:00