Boundary assumptions
- Lives in the dev estate, but is intentionally internet-facing there.
- Uses Keycloak as the identity boundary, with Microsoft and Google behind it.
- Surfaces only tenant-allowed GitLab repositories.
- Launches managed development workspaces with Codex already prepared inside them.