feat(databricks): support Unity Catalog model filtering

[kalvinnchau]

Category: improvement
User Impact: Managed Databricks users see only distribution-approved Unity Catalog models while explicit curated models remain available.

Problem: Databricks discovery can return Unity Catalog models outside a distribution's supported namespaces, and stale selections could survive with inconsistent picker behavior. The backend pin also changed ACP extension contracts that Berd's generated SDK and callers had not yet adopted.

Solution: Add a validated Databricks model-prefix policy across runtime configuration, discovery caches, and selection repair; preserve explicit curated models and BYO behavior; and synchronize Berd's ACP SDK and extension callers with the exact Goose capability commit.

File changes

goose-backend.lock.json
Pins the exact upstream Goose commit that adds Databricks Unity Catalog model-service discovery.

scripts/release/build-macos.sh
Removes distribution-owned model-prefix policy from BYO-key builds alongside the existing endpoint and fast-model values.

sdk/schema/acp-meta.json
Regenerates ACP method metadata from the pinned Goose backend.

sdk/schema/acp-schema.json
Regenerates the ACP schema, including current session-extension keys and provider notification contracts.

sdk/src/generated/index.ts
Refreshes generated SDK exports from the pinned schema.

sdk/src/generated/types.gen.ts
Updates generated TypeScript contracts to match Goose's current ACP surface.

sdk/src/generated/zod.gen.ts
Updates generated runtime validators to match the pinned ACP schema.

src-tauri/src/commands/runtime_config.rs
Adds Rust parsing, validation, serialization, BYO stripping, and tests for Databricks model-prefix policy.

src-tauri/src/services/acp/goose_serve.rs
Updates the BYO provider-environment test to use the expanded distribution-policy cleanup.

src/features/chat/hooks/tests/useChatSessionController.test.ts
Keeps the foreground model-repair fixture distinct from explicitly curated runtime models.

src/features/extensions/api/extensions.test.ts
Updates extension API coverage for the ACP transports supported by the pinned Goose schema.

src/features/extensions/api/extensions.ts
Removes obsolete ACP-transport conversion paths no longer present in Goose's generated contract.

src/features/extensions/types.ts
Removes the unsupported ACP-transport extension configuration type.

src/features/providers/lib/managedModelSelectionRepair.test.ts
Covers prefix exclusion, curated model preservation, partial discovery, cache invalidation, and runtime-policy races.

src/features/providers/lib/managedModelSelectionRepair.ts
Applies current runtime prefix policy during repair while preserving explicit and approved models.

src/features/providers/lib/modelRecommendations.test.ts
Verifies non-recommended discovered models remain visible for managed Databricks providers.

src/features/providers/lib/modelRecommendations.ts
Stops discarding non-goose- Databricks models before recommendation metadata is applied.

src/features/providers/stores/providerModelCacheStore.test.ts
Covers filtered discovery, authoritative filtered-empty inventories, and the cache-version migration.

src/features/providers/stores/providerModelCacheStore.ts
Filters discovered IDs through runtime policy and advances persisted cache semantics to v2.

src/features/security/lib/inferExplanation.test.ts
Updates tool-free inference cleanup coverage to use stable extension keys.

src/features/security/lib/inferExplanation.ts
Removes session extensions by the keys returned by the current Goose ACP response.

src/shared/runtime-config/modelProviderPolicy.test.ts
Adds focused coverage for model-prefix filtering behavior.

src/shared/runtime-config/modelProviderPolicy.ts
Defines the shared discovery filter used by provider cache and selection repair.

src/shared/runtime-config/schema.test.ts
Covers accepted, malformed, duplicate, empty, and non-Databricks prefix policies.

src/shared/runtime-config/schema.ts
Adds the validated allowedModelIdPrefixes runtime field, scoped to databricks_v2.

src/shared/runtime-config/setRuntimeConfigDistribution.test.ts
Pins release-script cleanup of the distribution model-prefix policy in BYO builds.

Validation

• just ci
• Three adversarial review rounds with four independent reviewers per round

[morgmart]

🤖 Automated code review

APPROVE. Fresh static review completed for the exact three-dot comparison 0664d20...818f6fb (merge base 0eee050), with no publishable findings. Final self-check covered every changed user flow (managed model discovery/filtering, picker population, stale-selection repair, BYO distribution stripping, extension contract migration, tool-free security explanation cleanup, and generated ACP contract updates), accessibility, i18n/localization completeness, navigation and consent guards, async/error/never-completes/lifecycle/race behavior, test honesty, design-system and project rules, duplicate overlap, and blocking-severity evidence plus user effect. No changed UI accessibility, localization, navigation, or consent surface was introduced; the async policy race and filtered-empty inventory behavior have discriminating coverage; and no unsupported or overlapping claim survived consolidation. Supplied GitHub evidence was inspected: all reported substantive checks completed successfully, with the workflow close job skipped; required checks still govern merge readiness. No local code, tests, builds, package managers, generated binaries, hooks, or project scripts were run.

Deterministic publication result: 0 blocking and 0 non-blocking finding(s) publishable; 0 duplicate(s) suppressed.

Pending checks: 1 check(s) are not complete.

This approval reflects the completed code review only; merge readiness remains governed by the repository's required checks.