# Databricks next steps

This is one editable Harness project from local smoke test through production controls.

## 1. Prove the local contract

```sh
npm test
npx fh run databricks-analyst --question "What tables are available?" --mock
```

Mock output is synthetic and is not workspace evidence.

## 2. Connect a workspace

Copy `.env.example` to `.env`, use a named Databricks CLI OAuth profile, then run:

```sh
npx fh doctor --target databricks-app
npx fh run databricks-analyst --question "Compare revenue by region and show the SQL."
```

Review every non-secret resource id and the effective principal before a live run.

Notes:

- The default model is the bare `databricks-gpt-oss-20b` foundation-model serving endpoint
  (pay-per-token), which works on free-tier workspaces. `system.ai.*` model services require
  Unity AI Gateway. A `databricks/`-prefixed reference is accepted too — the provider strips the
  prefix at the wire boundary.
- If any required variable is missing, the first live run fails once listing ALL of them
  (`DATABRICKS_HOST`, `DATABRICKS_WAREHOUSE_ID`, `DATABRICKS_GENIE_SPACE_ID`,
  `DATABRICKS_ANALYTICS_STEWARD_AUDIENCE`, `DATABRICKS_COST_TENANT_ID`,
  `DATABRICKS_COST_PER_DAY_USD`) instead of one at a time.
- In a headless shell (no desktop keyring), set `DATABRICKS_AUTH_STORAGE=plaintext` so the
  Databricks CLI can mint tokens from the profile.
- The session always offers the built-in filesystem tools next to the declared Databricks tools;
  the generated policy (`toolPolicy.allow`) denies them. A model that wanders to `grep`/`read` gets
  policy denials, and a run that ends with an empty result exits nonzero with a warning — it is not
  reported as success.

## 3. Deploy and verify

```sh
npx fh build --target databricks-app
npx fh deploy --target databricks-app
```

## 4. Add advanced controls without replacing the project

- Add `fh add databricks rag-chain`, `jobs`, `lakeflow`, or `lakebase`.
- Use `bundle.sdk` for operator-authored typed native access.
- Give every model-callable write/execute tool a construction-time resource policy.
- Add request-scoped OBO, Lakebase/Temporal durability, approvals, and live certification as required.