Onboarding is where a platform shows whether it is a product. Here, the developer makes one choice, and each following step is a reviewed commit the platform makes on their behalf.
Principle honored
Backstage holds no Kubernetes credentials. Even creating a new app is a git commit, not an API call.
What changes
The identity file is written by the platform, never by the app repo, so a developer's commit cannot redirect a release.
The execution namespace is computed as <type>-<app>-cicd, so it cannot drift.
Found in use
A private gitops repo needs the GitHub App installed on it too, or delivery to it fails: found live, and now in the docs.