fix(vector): abort builds on auth-status encode errors instead of skipping

Author: wesm

internal/vector/encoder.go

@@ -70,10 +70,20 @@ func (e *HTTPStatusError) Error() string {
 
 // Permanent reports whether the embeddings endpoint's response indicates a
 // rejection of this specific input that will never succeed on retry: any
-// 4xx status except 429, which is rate-limiting rather than a content
-// rejection and is itself retryable.
+// 4xx status except 429 (rate-limiting, retryable) and except the auth
+// statuses 401/403/407, which describe the caller's credentials rather
+// than the input — skip-stamping documents on an expired token would
+// silently mark an entire corpus embedded-with-no-vectors, so auth
+// failures must abort the build instead.
 func (e *HTTPStatusError) Permanent() bool {
-	return e.Status >= 400 && e.Status < 500 && e.Status != http.StatusTooManyRequests
+	switch e.Status {
+	case http.StatusTooManyRequests,
+		http.StatusUnauthorized,
+		http.StatusForbidden,
+		http.StatusProxyAuthRequired:
+		return false
+	}
+	return e.Status >= 400 && e.Status < 500
 }
 
 // embeddingsRequestBody is the OpenAI-compatible embeddings request.

internal/vector/encoder_test.go

@@ -311,6 +311,32 @@ func TestEncoder429ReturnsNonPermanentHTTPStatusError(t *testing.T) {
 	assert.False(t, statusErr.Permanent(), "429 is transient rate-limiting, not a content rejection")
 }
 
+// TestHTTPStatusErrorPermanentClassification pins the skip-vs-abort
+// classification: auth statuses describe the caller's credentials, not the
+// input, so treating them as permanent would skip-stamp an entire corpus
+// on an expired token instead of aborting the build.
+func TestHTTPStatusErrorPermanentClassification(t *testing.T) {
+	cases := []struct {
+		status    int
+		permanent bool
+	}{
+		{http.StatusBadRequest, true},
+		{http.StatusNotFound, true},
+		{http.StatusUnprocessableEntity, true},
+		{http.StatusUnauthorized, false},
+		{http.StatusForbidden, false},
+		{http.StatusProxyAuthRequired, false},
+		{http.StatusTooManyRequests, false},
+		{http.StatusInternalServerError, false},
+		{http.StatusBadGateway, false},
+	}
+	for _, tc := range cases {
+		err := &HTTPStatusError{Status: tc.status}
+		assert.Equalf(t, tc.permanent, err.Permanent(),
+			"status %d: Permanent() classification", tc.status)
+	}
+}
+
 // TestEncoderDecodeErrorIsRetried covers fix 2: a decoding failure almost
 // always means the connection died mid-stream, not that the endpoint sent
 // a deliberately malformed response, so it must be retried rather than