pub fn invalidate_binding_mismatched_credential(
agent_id: &str,
mstore: &Arc<Store>,
)Expand description
Same token invalidation as invalidate_cached_token, PLUS a
CREDENTIAL_RETRY_COOLDOWN failure record — for a 403 (binding
mismatch) specifically, not a plain 401 (expired token).
A 401 means the token expired; clearing just the cached token is enough,
because the very same client_id/client_secret is still good and the
next ensure_agent_credential call correctly mints a fresh token from
it. A 403 means the CREDENTIAL ITSELF (not just its cached token) is
bound to the wrong agent_id — clearing only the token doesn’t fix that:
ensure_agent_credential still finds the same client_id on file,
happily mints ANOTHER token from it (token issuance does not check the
binding; the mismatch only surfaces as a 403 from the relay), and the
very next
/reactive/pending or /reactive/ack call 403s again — repeating the
exact same failed round trip on every subsequent InjectAvailable
broadcast instead of falling back to the shared token (reagentx P2 on
PR #2573, flagged by chatgpt-codex-connector originally). Reusing the
existing cooldown here bounds that to once per
CREDENTIAL_RETRY_COOLDOWN window instead of once per broadcast, same
throttling this module already applies to a provisioning/fetch failure.