AI Code Completion Service · View 01 of 21 · Context and scope
Decisions
- The editor plugins are outside the boundary; what is inside is the contract they must honour — debounce, one in-flight request per session, cancel on keystroke.
- Chat and agent surfaces are a separate service. They share an editor and almost nothing else: their latency budget is seconds and their unit of work is a conversation.
- No path exists from tenant code to model training. The absence is the control; a setting that disabled it would be a weaker claim.
Assumptions
- 1.2 M daily active developers across 40 enterprise tenants and a self-serve population.
- 2.4 B suggestion requests a day, 35 k/s steady and 90 k/s at the working-day peak.
- Source hosting can answer a per-principal repository permission question in single-digit milliseconds.
Risks
- The plugin is the only component that knows the keystroke, and it is the component the platform controls least — a bad release is a fleet-wide incident with no server-side fix beyond a version gate.
- Repository permission lives in a system this platform does not own; a slow or wrong answer there becomes either a latency miss or a disclosure.
