Go ADK: Vertex AI Anthropic requests fail with 401 CREDENTIALS_MISSING due to SDK option ordering

[jon-waggoner]

Bug Description

The Go ADK's NewAnthropicVertexAIModelWithLogger in go/adk/pkg/models/anthropic.go applies SDK options in the wrong order, causing all Vertex AI Anthropic requests to fail with 401 CREDENTIALS_MISSING.

Root Cause

vertex.WithGoogleAuth() is called first, which sets up an OAuth2-authenticated HTTP client, the Vertex AI base URL, and URL-rewriting middleware. Then option.WithHTTPClient() is appended after it, overwriting the authenticated client with a plain one. This causes:

1. Requests sent without OAuth2 credentials (401 Unauthorized)
2. Requests going to /v1/messages instead of the correct Vertex AI rawPredict endpoint

Symptoms

• POST "https://us-east5-aiplatform.googleapis.com/v1/messages": 401 Unauthorized
• Error: CREDENTIALS_MISSING / UNAUTHENTICATED
• "message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential."

How to Reproduce

1. Deploy an Agent CR with runtime: go and a ModelConfig using provider: AnthropicVertexAI
2. Run on GKE with Workload Identity configured (KSA annotated with iam.gke.io/gcp-service-account)
3. Send any message to the agent via A2A protocol
4. Observe 401 in agent logs

Expected Behavior

The Go ADK should construct the correct Vertex AI URL (https://{region}-aiplatform.googleapis.com/v1/projects/{project}/locations/{region}/publishers/anthropic/models/{model}:rawPredict) and attach OAuth2 credentials from Application Default Credentials.

Workaround

Switch the Agent to runtime: python — the Python runtime correctly handles Vertex AI URL construction and ADC authentication.

Fix

PR #2314 reorders the options so option.WithHTTPClient (TLS/headers/timeout) is applied first, then vertex.WithGoogleAuth is applied last, allowing its internal WithHTTPClient with the OAuth2-authenticated transport to take precedence.

Python runtime is unaffected — only the Go ADK (golang-adk image) has this bug.