[waleedlatif1]

Summary

Follow-ups from release review on the held keyless subjects change (#10011).

• Databricks identity check gets a hard deadline. The SCIM /Me verification moved to the egress-guarded fetch, whose timeout only resets on inactivity. It now also passes signal: AbortSignal.timeout(15s), so a slow or dribbling workspace can't hold a save open, and DNS validation is capped too. This restores the absolute deadline the old fetch call had, matching the other Databricks calls in the file.
• An unheld reconnect subject reports no hold. A reconnect that keeps its subject mints a subject Sim never holds. The internal response used to report the proof's 24-hour expiry as subjectHeldUntil. Now subjectIssuedAt, subjectHeldUntil and subjectReused are absent on that path: optional on the internal contract and the use-case result only. The v2 contract still requires them, and its adapter asserts them, since it only issues or renews held subjects. The connect dialog's hint narrows on the optional field. Nothing displayed the unheld values before, so there's no visible change.
• Docs baseline: the two keyless-subject usage fences record their new size (bytes 54).
• The use case's TSDoc moves back onto prepareWorkloadIdentity.

Type of Change

• Bug fix

Testing

• New unit test: a reconnect subject Sim doesn't hold reports no hold. It fails on the previous code, which invented the fields.
• Not covered by a test: the deadline. Asserting the call argument would only restate the code, and fake timers don't drive AbortSignal.timeout.
• Unit runs: 81 tests pass across prepare-workload-identity, the v2 subjects route and the Databricks server tests.
• Integration: workload-identity-pending-subject.integration.ts (10) and workload-identity-subject-reuse.integration.ts (9) pass against Postgres provisioned through migrations.
• Lint and audits: bun run lint, check:audits (all), check:test-types and the docs compatibility check pass. The generated artifacts are unchanged.
• Type-check and the full suite run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 13, 2026 10:49pm UTC

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Adds a 15-second deadline to the Databricks identity request and stops reporting a hold for reconnect subjects Sim does not hold.

• Databricks identity checks stop after 15 seconds.
• Reconnects no longer report a hold for subjects Sim does not hold.

_{Reviews (1) · Last reviewed commit: "fix(credentials): cap the Databricks ide..." · Reviewed by Greptile}