fix(extraction): surface live vertex-ai profile on gcloud-adc create failure (#792)

OpenShell's --from-gcloud-adc emits an identical generic "no credentials
resolved" error whether the ADC content is bad or the gateway's served
google-vertex-ai profile doesn't allow empty-credential bootstrap - the
two cases are indistinguishable from CLI stderr alone. Every ADC-content
failure mode (missing file, missing client_secret, revoked refresh_token)
has been reproduced locally and each produces a distinct, more specific
error, none matching what stage actually shows, and a live GetProviderProfile
call captured via the new sticky-runtime probe returned a clean 200 in
under 1ms right before the same generic error - ruling out an RPC failure.

Dump the gateway's actual served profile via `provider profile export`
inline in the error on failure so the next occurrence captured by the
sticky-runtime probe shows the real server-side state instead of another
occurrence of the same uninformative message.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: aredenba-rh

src/api/extraction/infrastructure/openshell/vertex_provider.py

@@ -136,11 +136,39 @@ def ensure_vertex_provider(
         args.extend(["--config", f"VERTEX_AI_REGION={region.strip()}"])
 
     with _home_for_adc(gcloud_config_mount=gcloud_config_mount):
-        run_openshell(args, timeout=60.0)
+        try:
+            run_openshell(args, timeout=60.0)
+        except OpenShellCliError as exc:
+            diagnostic = _diagnose_vertex_profile()
+            raise OpenShellCliError(
+                f"{exc} | google-vertex-ai profile diagnostic: {diagnostic}"
+            ) from exc
     if auth_mode == "vertex":
         ensure_inference_routing(provider_name=provider_name, model=model)
 
 
+def _diagnose_vertex_profile() -> str:
+    """Dump the gateway's live google-vertex-ai profile for failure diagnostics.
+
+    OpenShell's ``--from-gcloud-adc`` emits an identical generic "no
+    credentials resolved" error whether the ADC file is fine or the gateway's
+    served provider profile doesn't allow empty-credential bootstrap (see
+    OpenShell CLI ``missing_credentials_error`` / ``allows_empty_provider_credentials``).
+    The two cases are indistinguishable from the CLI's own stderr, so capture
+    the actual served profile at failure time instead of guessing.
+    """
+    try:
+        result = run_openshell(
+            ["provider", "profile", "export", "google-vertex-ai", "--output", "json"],
+            check=False,
+            timeout=15.0,
+        )
+    except OpenShellCliError as exc:
+        return f"profile diagnostic call failed: {exc}"
+    output = (result.stdout or result.stderr or "").strip()
+    return output or "profile diagnostic returned no output"
+
+
 def ensure_inference_routing(*, provider_name: str, model: str) -> None:
     """Point sandbox inference.local at the configured Vertex provider."""
     resolved_model = model.strip() or "claude-opus-4-6"

src/api/tests/unit/extraction/infrastructure/test_openshell_vertex_provider.py

@@ -140,6 +140,69 @@ def test_home_for_adc_restores_previous_home(tmp_path) -> None:
     assert os.environ.get("HOME") == previous
 
 
+def test_ensure_vertex_provider_enriches_create_failure_with_profile_diagnostic(
+    tmp_path,
+) -> None:
+    """On create failure, append a live `provider profile export` dump.
+
+    OpenShell's generic "no credentials resolved" error for google-vertex-ai
+    hides whether the gateway's served profile actually allows empty-credential
+    bootstrap (see openshell-cli run.rs `missing_credentials_error`). Since
+    that can only be observed against the real gateway at failure time,
+    surface it inline so it lands in the sticky-runtime probe's error field.
+    """
+    adc_dir = tmp_path / "gcloud"
+    adc_dir.mkdir()
+    (adc_dir / "application_default_credentials.json").write_text(
+        '{"type":"authorized_user"}', encoding="utf-8"
+    )
+
+    import subprocess
+
+    diagnostic_result = subprocess.CompletedProcess(
+        args=[],
+        returncode=0,
+        stdout='{"id": "google-vertex-ai", "credentials": []}',
+        stderr="",
+    )
+
+    with (
+        patch(
+            "extraction.infrastructure.openshell.vertex_provider.provider_exists",
+            return_value=False,
+        ),
+        patch(
+            "extraction.infrastructure.openshell.vertex_provider.run_openshell",
+            side_effect=[
+                OpenShellCliError(
+                    "openshell provider create ... failed: no credentials resolved"
+                ),
+                diagnostic_result,
+            ],
+        ) as run,
+    ):
+        with pytest.raises(OpenShellCliError) as exc_info:
+            ensure_vertex_provider(
+                provider_name="kartograph-gma",
+                project_id="my-project",
+                region="us-east5",
+                gcloud_config_mount=str(adc_dir),
+            )
+
+    assert "no credentials resolved" in str(exc_info.value)
+    assert '"id": "google-vertex-ai"' in str(exc_info.value)
+    assert run.call_count == 2
+    diagnostic_args = run.call_args_list[1].args[0]
+    assert diagnostic_args == [
+        "provider",
+        "profile",
+        "export",
+        "google-vertex-ai",
+        "--output",
+        "json",
+    ]
+
+
 def test_ensure_vertex_provider_raises_when_adc_missing(tmp_path) -> None:
     with patch(
         "extraction.infrastructure.openshell.vertex_provider.provider_exists",