What
The lock that serializes OAuth refreshes for workload identity federation now has two modes. Fail-closed retries acquisition 5 times; fail-open retries 15 and, if it still cannot get the lock, refreshes anyway without cross-process serialization rather than failing the refresh.
Details
- The fail-open path logs a debug line explaining that it proceeded unlocked.
- The existing lock acquire and release telemetry now records which mode was in use.
- The mode is chosen per call site, not by a user setting.
- Workload identity client state (the credentials promise, token cache, resolved base URL and failed access tokens) moved from module globals into a resettable object.
Evidence
wif: credentials lock unavailable at
Strings lifted out of the shipped bundle, so the claim above can be checked against them.