Add ucode setup: interactive managed-config authoring

[tt-le]

Demo

Screen.Recording.2026-08-05.at.10.11.05.AM.mov

Changes

Stacked on #267 — review that one first. This PR's diff includes it until #267 merges.

The admin-facing wizard on top of #267's serializer. Walks a workspace admin through agents, per-agent models, tracing, MCP servers, skills, and a spend-routing budget policy, then writes the manifest to ~/.ucode/managed-settings.json. Publishing is a separate ucode apply (next PR) so an admin can review the file first — and ucode setup show prints both the summary and the exact proto-JSON that apply will POST.

managed_wizard.py is the interaction layer only; catalogs, validation, and serialization stay in managed_setup.py. Sub-flows an admin already knows are delegated to the existing commands (configure_tracing_command, configure_mcp_command, configure_skills_mcp_command) and their results read back out of state.json, so there is still exactly one picker per concern.

Claude Code is prompted per model family

ClaudeModelConfig.models is a ClaudeDefaultModels message — four optional slots (default_opus_model / default_sonnet_model / default_haiku_model / default_fable_model), since Claude Code addresses models by family alias rather than from a list. A flat multi-select cannot express that.

? Default opus model:
  › system.ai.claude-opus-5
    system.ai.claude-opus-4-8
    system.ai.claude-opus-4-7
    ... (skip opus)

Each family is skippable (the slots are optional, and an unset one falls back to default_model); the overall default_model is then chosen from the slots that were filled, so it can never name a model the config doesn't carry. With one slot filled there is nothing to choose, so it reports what it inferred rather than asking a single-option question.

That required looking past state["claude_models"], which is {family: newest} because the launch path pins one model per alias — the workspace tested against has 12 Claude models and the bucketed view shows 4. discover_claude_models_unbucketed returns the full listing, claude_family_candidates groups it by family, and _known_models reads the same set so validation cannot reject a version the prompts offered. discover_model_services is untouched — every agent's config writer depends on the shape of claude_models.

Other model-prompt behaviour

— Provider-service agents get a real picker. list_model_provider_services already returns each service's config.targets; the wizard now selects the whole service dict and offers those, instead of an empty text prompt that required knowing a provider-side id by heart. allow_all_targets and relayed Anthropic subscription services have nothing to enumerate, so those fall back to free text — but say why and give an example.

— Gemini and Copilot get one model, not a multi-select: their writers take a single model and set one env var, so extra picks were silently discarded at apply time. Wizard-level only — both protos declare repeated string models, so --from-file still serializes a list. OpenCode and Pi keep their multi-select; they really do show a model picker.

— Nothing is pre-checked. options[0] is whatever discovery sorted first, not a recommendation — for Pi a Claude model, for Codex the oldest GPT. It only existed to make Enter work, which stopped mattering once every agent required a model: an empty selection is re-prompted. That also makes _prompt_models_for_agent total. Without it, picking a multi-model agent and hitting Enter produced an agent with no model_config, and if it was the default_agent the run died at the end — after tracing, MCP, skills, and budget had all been answered.

Budget tiers offer only the agent's own models

The picker previously read the workspace catalog and called load_state(), so it could not have seen this run's choices even in principle — configuring Pi with one Kimi model still offered every family. Picking one of the extras was not harmless: validateStoredConfig checks only that a tier's default_agent is in enabled_agents, never that the agent has the model, so the tier would activate and hand a developer a model their agent was never given. validate_manifest gains that missing rule, which is the durable half — it guards --from-file and hand-written manifests too.

Tiers are prompted in percent and stored as fractions, keeping the spec-vs-API units mismatch in one place.

Smaller notes

Model ids stay bare (system.ai.claude-opus-4-8), not provider-prefixed: each agent's writer adds whatever its config format needs, so the manifest stays agent-neutral.

Two readback details: tracing is stored as tracing.uc_destination but the managed config calls it tracing.table, and an enabled-but-not-UC-backed experiment has no table so it is omitted rather than published empty; state.json records each MCP server's URL but not its type, so _mcp_type_for_url maps the URL shape back and skips anything unrecognized instead of guessing.

databricks.py adds is_workspace_admin (SCIM Me group membership) and list_workspace_budgets (workspace-scoped — ucode never creates budgets, an admin picks an existing one). The admin gate errors on a definite non-admin and warns-then-continues when the check itself fails, since the API enforces the same rule server-side.

Testing

uv run pytest — 1334 passed, 36 skipped. 116 new cases. (tests/test_e2e_user_agent.py::test_user_agent_arrives_at_gateway fails on my machine because /etc/claude-code/managed-settings.json overrides ANTHROPIC_BASE_URL past the test's capture server; it fails on main too and is unrelated.)

Several are mutation-checked: reverting the claude flat multi-select fails eight, reverting the budget-tier picker fails test_offers_only_the_models_the_agent_was_configured_with, and dropping the tier-model validation rule fails test_tier_model_must_be_one_the_agent_has.

Verified interactively against a staging workspace: six opus versions and four sonnet offered, a skipped family absent from models, and the result round-trips through normalize_managed_config to the proto shape.

Known gap

discover_model_services and discover_claude_models_unbucketed both page /api/2.1/unity-catalog/model-services, so a run that configures Claude lists it twice (one extra spinner). _claude_candidates caches on state["all_claude_models"], bounding it to once per run. Removing the second listing means widening discover_model_services' 5-tuple return, which is asserted in eight tests and mocked in sixteen — left for a follow-up rather than growing this PR.

This pull request and its description were written by Isaac.

[AarushiShah-db]

Some high level comments based on the video

• Configuration Summary - can we put a box around it

• Dry run: is there a reason why its ucode configure --dry-run? Can it just be ucode —dry-run?
• Warning message update: "A published Claude configuration already exists for this workspace. Publishing will replace it. Make sure this configuration includes everything you want to keep."
• For the model picker , can we add option to filter by search (you type and it will filter the models) Same with budget policy tracker
• What is the initial "Fetching available models" step doing and is that needed? because aren't we doing individual API calls anyways to get the models for the individual agents?