Deployment Verification — THE THREE PATHS RULE

STOP. Before declaring any workspace "deployed" or "verified", you MUST run all three of:

1. Classic cluster with UC (data_security_mode = "SINGLE_USER")
2. Serverless SQL warehouse (PRO)
3. Serverless notebook job (ephemeral job compute)

Each must read AND write a UC table end-to-end (CREATE → INSERT → SELECT → DROP).

One success on serverless does NOT count as verified. Classic must work too — that's where most real-world skill bugs live (cluster policies, init scripts, custom AMIs, SCC/PrivateLink port story, JVM warmup interactions with private storage, data_security_mode enforcement). If you only test serverless you're testing the easy path.

Approval gate for the verification resources

Verification is mandatory (never skip it), but the verification itself creates real remote resources — a classic cluster, a PRO SQL warehouse, a notebook, and a job. Those are mutations, so before creating them present ONE plan and get explicit approval: