Skip to content

Add model_service app resource and picker to the CLI - #7341

Open
MarioCadenas wants to merge 9 commits into
mainfrom
work/1-add-model-service-app-resource
Open

MarioCadenas wants to merge 9 commits into
mainfrom
work/1-add-model-service-app-resource

Conversation

@MarioCadenas

@MarioCadenas MarioCadenas commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor

Changes

Adds a model_service app resource type for apps init, plus an interactive picker for it.

  • libs/apps/generator/generator.go: model_service maps to uc_securable with securable_type: MODEL_SERVICE. The manifest field name (catalog.schema.name) becomes securable_full_name, and the default permission is EXECUTE.
  • libs/apps/prompt: new PromptForModelService.
    • It opens on the system.ai model services, with a "Browse other catalogs..." entry that falls back to a catalog -> schema -> model service picker (the same flow as UC functions).
    • Model services are listed with AiGateway.ListModelServices; all pages are fetched. The model-services/ prefix is removed, so values are catalog.schema.name.
    • Without access to system.ai (403/404), or when it has no services, the picker goes straight to the catalog picker.
    • The system.ai list is loaded in the background while apps init starts; the catalog list loads only when browsing.
  • --set accepts any catalog.schema.name (no filtering to system.ai).

Why

universe#2571640 adds MODEL_SERVICE as a Databricks Apps UC securable type. The serving and agents plugins move from serving_endpoint to model_service; that switch happens in the AppKit plugin manifests, and the CLI only needs to support the new type.

The picker opens on system.ai because on large workspaces (e.g. dogfood: 1158 catalogs, 200 per page) reaching the system catalog means paging through the catalog list. User model services in other schemas (e.g. main.default) stay reachable through "Browse other catalogs...".

Known follow-ups:

  • The Go SDK doesn't list MODEL_SERVICE in the apps uc_securable.securable_type enum yet, so bundle validate shows an enum warning (not an error) for these resources until the SDK is bumped and the schema regenerated.
  • The AppKit picker should get the same system.ai-first behaviour.

Tests

  • Unit tests: the generated YAML and default permission for model_service; ListModelServicesInSchema (prefix stripping); the system.ai list with the browse entry, and the case without access.
  • go test ./libs/apps/... ./cmd/apps/..., TestAccept/apps and golangci-lint pass locally.
  • Not tried interactively against a real workspace.

This pull request and its description were written by Isaac.

MarioCadenas and others added 2 commits November 4, 2026 11:16
Maps the model_service manifest resource type to uc_securable with
securable_type MODEL_SERVICE and default permission EXECUTE, and adds a
catalog -> schema -> model service picker backed by AiGateway.ListModelServices.

Co-authored-by: Isaac <no-reply@databricks.com>
@MarioCadenas

Copy link
Copy Markdown
Contributor Author

Review 1 · Pass · 1 minor, 1 trivial

Does the change do what the task asked? Yes. Gate: major and worse must be fixed.

The model_service resource spec (uc_securable, MODEL_SERVICE, EXECUTE, securable_full_name) and a catalog -> schema -> model service picker using the paginating ListModelServicesAll are added and wired into the registry and prefetch, matching how uc_function is handled at every place it appears. The libs/apps tests pass, and the bundle schema and SDK already accept MODEL_SERVICE. The plugin manifests that pick serving_endpoint for the model plugins live in the AppKit templates, not in the CLI, so the CLI has nothing to switch for step 3.

Not required (below the gate)

  • minor: There is no .nextchanges fragment for this user-visible change; the agent left it until a PR link exists. (.nextchanges/cli/)
    Proof: git diff 2534bb0...HEAD --stat shows no .nextchanges file
  • trivial: The lister test covers a single page; pagination is left to the SDK's ListModelServicesAll iterator. (libs/apps/prompt/listers_test.go)
    Proof: Read the test: it mocks ListModelServicesAll directly

@eng-dev-ecosystem-bot

eng-dev-ecosystem-bot commented Nov 4, 2026 •

Copy link
Copy Markdown
Collaborator

Integration test report

Commit: 1260857

Run: 41860159898

Env ✅​pass 🙈​skip Time
✅​ aws linux-2core-8gb 271 15 5:16
✅​ aws-windows-latest-4core-16gb 273 13 6:41
✅​ azure linux-2core-8gb 270 15 5:43
✅​ azure-windows-latest-4core-16gb 272 13 5:40
✅​ gcp linux-2core-8gb 271 15 5:36
✅​ gcp-windows-latest-4core-16gb 273 13 5:32
Top 3 slowest tests (at least 2 minutes):
duration env testname
3:22 azure-windows-latest-4core-16gb TestAccept
3:15 gcp-windows-latest-4core-16gb TestAccept
3:13 aws-windows-latest-4core-16gb TestAccept

MarioCadenas and others added 3 commits November 4, 2026 11:57
List the system.ai model services first with a "Browse other catalogs..."
entry that falls back to the catalog -> schema -> model service picker.
Finding the system catalog otherwise means paging through every catalog.

Co-authored-by: Isaac <no-reply@databricks.com>
@MarioCadenas

Copy link
Copy Markdown
Contributor Author

Review 2 · Pass · 1 minor, 1 pre-existing

Does the change do what the task asked? Yes. Gate: major and worse must be fixed.

The model_service spec (uc_securable, MODEL_SERVICE, EXECUTE, catalog.schema.name) is added. It is wired into the prompt registry and prefetch, and the picker paginates via ListModelServicesAll with the system.ai shortcut. Tests pass once the blocked yaml dependency is pinned. The serving/agents plugin replacement lives in AppKit templates, outside this repo, so the CLI part looks complete. The interactive flow itself was not run by hand.

Not required (below the gate)

  • minor: PromptForModelService (the system.ai list, the browse fallback, and returning the chosen value) has no test; only the helper systemAIModelServiceItems and the lister are tested. (libs/apps/prompt/prompt.go PromptForModelService)
    Proof: git diff: tests cover systemAIModelServiceItems and ListModelServicesInSchema only

Not required (there before this change)

  • minor: The tests do not build on this machine without a workaround, because the internal proxy blocks go.yaml.in/yaml/v3 v3.0.6, which came in with the base-branch merge. (go.mod)
    Proof: go test ./libs/apps/... -> 403 Forbidden Socket Security Policy for v3.0.6

Prefetch the system.ai model service list for model_service resources instead
of the catalog list, so the first picker no longer blocks on a fetch; the
catalog list is fetched on demand when browsing. Merge the single-caller
helper into listSystemAIModelServices and shorten the new doc comments.

Co-authored-by: Isaac <no-reply@databricks.com>
@MarioCadenas

Copy link
Copy Markdown
Contributor Author

Review 3 · Pass · 1 minor, 1 pre-existing

Does the change do what the task asked? Yes. Gate: major and worse must be fixed.

The model_service resource maps to uc_securable with MODEL_SERVICE/EXECUTE and securable_full_name. The picker lists model services in catalog.schema.name form, opening on system.ai and falling back to the catalog/schema browser, and it is registered and prefetched. Unit tests and vet pass with the yaml v3.0.5 pin. The CLI has no plugin-specific serving_endpoint lister to swap, so item 3 belongs to the AppKit template manifests, which live outside this repo. The only gap is a missing .nextchanges fragment.

Not required (below the gate)

  • minor: The change adds a user-visible app resource type and picker, but there is no .nextchanges fragment for it, which the repo's changelog rule asks for. (.nextchanges/)
    Proof: rg -l model_service .nextchanges returned nothing; git diff --stat shows only libs/apps files changed

Not required (there before this change)

  • minor: go build fails on this branch because the internal proxy blocks go.yaml.in/yaml/v3 v3.0.6, so CI on the internal proxy may fail for reasons unrelated to this change. (go.mod)
    Proof: go build ./... returned 403 Forbidden (Socket Security Policy, recently published)

@MarioCadenas
MarioCadenas marked this pull request as ready for review November 4, 2026 14:49
@MarioCadenas
MarioCadenas requested review from a team as code owners November 4, 2026 14:49

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants