[billiam-wang]

When ug configure makes an authoritative read of a published managed config, it also writes /etc/unitygateway/managed-config.json (Linux and macOS): the ~/.ucode/managed-config.json format (workspace, raw config, retrieved_at, outcome) plus a ug_state listing the managed agents that configured successfully and their managed provider_services and model_locations. Nothing comes from the administrator's own state.json.

• Written through the existing lazy sudo session (path added to both allowlists); root needs no terminal. The replace script resets ug's file to root 0644 in a root 0755 directory on every write.
• Unchanged content and metadata write nothing; --dry-run prints; UG_SKIP_OS_SETTINGS and Windows skip.
• An authoritative removal, disable, or switch to an unmanaged workspace replaces a published copy with a no-policy record; a failed fetch that fell back to the cache neither publishes nor invalidates.
• A config that may hold credentials is not published, and an older copy is withdrawn.
• A failed privileged write is reported without failing configure.

Launches do not read the file yet.

Example written file in /etc/unitygatewa/managed-config.json

{
  "workspace": "https://eng-ml-inference.staging.cloud.databricks.com",
  "config": {
    "name": "coding-agent-configs/affc6a8d-44ef-46de-92f4-4247d71cc814",
    "create_time": "2026-10-19T20:19:55.163Z",
    "created_user_id": 71595345758030,
    "update_time": "2026-10-19T20:19:55.163Z",
    "updated_user_id": 71595345758030,
    "default_agent": "CODING_AGENT_CLAUDE_CODE",
    "enabled_agents": [
      {
        "agent": "CODING_AGENT_CLAUDE_CODE",
        "config": {
          "models": {
            "model_services": [
              "system.ai.claude-opus-5",
              "system.ai.claude-sonnet-5",
              "system.ai.claude-haiku-4-5"
            ]
          },
          "smart_routing": {
            "enabled": false
          },
          "default_models": {
            "default_model": "system.ai.claude-opus-5",
            "default_opus_model": "system.ai.claude-opus-5",
            "default_sonnet_model": "system.ai.claude-sonnet-5",
            "default_haiku_model": "system.ai.claude-haiku-4-5"
          },
          "tracing": {
            "enabled": false
          }
        }
      },
      {
        "agent": "CODING_AGENT_CODEX",
        "config": {
          "models": {
            "model_services": [
              "system.ai.gpt-6-astra",
              "system.ai.gpt-5-6-sol",
              "system.ai.gpt-5-6-terra",
              "system.ai.gpt-5-6-luna",
              "system.ai.gpt-5-5",
              "system.ai.glm-5-3",
              "system.ai.kimi-k3"
            ]
          },
          "smart_routing": {
            "enabled": false
          },
          "default_models": {
            "default_model": "system.ai.gpt-5-6-sol"
          },
          "tracing": {
            "enabled": true
          }
        }
      }
    ],
    "spec_version": 1,
    "retrieved_time": "2026-10-21T17:48:01.535Z",
    "mcp_servers": {
      "unity_catalog_location": "system.ai"
    }
  },
  "retrieved_at": "2026-10-21T17:48:01.573673+00:00",
  "outcome": "published",
  "ug_state": {
    "version": 1,
    "available_tools": [
      "claude",
      "codex"
    ],
    "provider_services": {},
    "model_locations": {}
  }
}