Workspace compatibility

Fabric Harness targets Databricks workspaces on AWS, Azure, and Google Cloud through workspace REST APIs. Availability of Apps, Lakebase, serverless Model Serving, private connectivity, and individual AI services varies by workspace, region, and account configuration. A successful check in one workspace is recorded only for that cloud and region.

Runtime and API contract

The constants are exported as DATABRICKS_API_VERSIONS, DATABRICKS_AUTH_MODES, and DATABRICKS_PACKAGE_COMPATIBILITY so deployment checks and documentation use the same values.

Authentication modes

Production deployments should use OAuth or App identity. Tokens remain in resolvers and request headers; they are not written to prompts, lineage, compatibility records, or certification errors.

Certification records

The protected live workflow emits schema-versioned, redacted evidence containing:

• cloud, region, workspace id/host, auth mode, and principal kind;
• Node and package versions plus every REST API family used;
• required and optional check identifiers with duration and result;
• source commit and SHA-256 digest of the exact App artifact;
• App restart/cascade-deletion evidence and deployment conformance;
• a stable evidence id suitable for partner review.

Required checks cannot become not-configured: that makes certification fail. The default partner set covers identity, SQL allow/deny, Unity Catalog preflight, mutation approval, Model Serving, ChatAgent proxy, Vector Search, MLflow managed RAG evaluation, Genie, Feature Serving, Lakeflow, Jobs, notebook execution, Volumes, Lakebase, lineage, OBO grant differences, System Tables, cost reconciliation, and the App.

node packages/databricks/dist/certify.js
node scripts/build-databricks-compatibility-matrix.mjs \
  artifacts/databricks-certification.json

databricksCompatibilityRecord() accepts only passing evidence with cloud, region, auth, runtime, package, and artifact identity. The matrix labels a cloud/region live-certified only when such a record is retained; otherwise it remains a contract target requiring workspace certification.

App and Lakebase prerequisites

For the reference App, enable Databricks Apps, grant its service principal the selected SQL Warehouse/serving/UC resources, provision the scoped runtime-token secret, and configure a UC Volume for attachments. Restart recovery additionally requires a Lakebase Autoscaling endpoint and database credential-exchange permission. Apply private networking when the workspace uses private connectivity or an enterprise CA.