diff --git a/.devcontainer/03-azure-01-04-ai-03-inventory-planning-agentic/devcontainer.json b/.devcontainer/03-azure-01-04-ai-03-inventory-planning-agentic/devcontainer.json
index c6f2d89b8..71d4fe68d 100644
--- a/.devcontainer/03-azure-01-04-ai-03-inventory-planning-agentic/devcontainer.json
+++ b/.devcontainer/03-azure-01-04-ai-03-inventory-planning-agentic/devcontainer.json
@@ -1,15 +1,63 @@
 {
+  // Agentic Inventory Planning Hack — GitHub Codespaces / VS Code Dev Containers
+  // Python + uv + Azure CLI + azd. post-create.sh installs dependencies and seeds src/.env.
   "name": "Azure / AI / Inventory Planning Agentic",
-  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
-  "workspaceMount": "source=${localWorkspaceFolder},target=/workspaces/microhack,type=bind,consistency=cached",
-  "workspaceFolder": "/workspaces/microhack/03-Azure/01-04-AI/03_Inventory_Planning_Agentic",
+  "image": "mcr.microsoft.com/devcontainers/python:3.12-bookworm",
+
+  "features": {
+    "ghcr.io/devcontainers/features/azure-cli:1": {
+      "version": "latest"
+    },
+    "ghcr.io/azure/azure-dev/azd:latest": {},
+    "ghcr.io/devcontainers/features/github-cli:1": {
+      "version": "latest"
+    }
+  },
+
   "customizations": {
     "vscode": {
+      "extensions": [
+        "ms-python.python",
+        "ms-python.vscode-pylance",
+        "ms-python.debugpy",
+        "ms-azuretools.azure-dev",
+        "ms-azuretools.vscode-azureresourcegroups",
+        "ms-windows-ai-studio.windows-ai-studio",
+        "GitHub.copilot",
+        "GitHub.copilot-chat"
+      ],
       "settings": {
-        "terminal.integrated.defaultProfile.linux": "bash"
+        "terminal.integrated.defaultProfile.linux": "bash",
+        "python.defaultInterpreterPath": "${containerWorkspaceFolder}/src/.venv/bin/python",
+        "python.terminal.activateEnvironment": true
       }
     }
   },
+
+  // Planner console (uvicorn ui.app:app --port 8000)
+  "forwardPorts": [8000],
+  "portsAttributes": {
+    "8000": { "label": "Planner Console", "onAutoForward": "openBrowser" }
+  },
+
+  // Runs once after the container is created, from workspaceFolder (the hack folder).
+  "postCreateCommand": "bash .devcontainer/post-create.sh",
+  "postAttachCommand": "bash /workspaces/${localWorkspaceFolderBasename}/.devcontainer/welcome.sh",
+
   "remoteUser": "vscode",
-  "postAttachCommand": "bash /workspaces/microhack/.devcontainer/welcome.sh"
-}
+
+  // Keep the Python venv on a container volume instead of the bind-mounted workspace:
+  // Docker Desktop (Windows/macOS) file sharing fails with I/O errors on venv-sized installs.
+  "mounts": [
+    "source=inv-agentic-venv-${devcontainerId},target=/workspaces/${localWorkspaceFolderBasename}/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/src/.venv,type=volume"
+  ],
+
+  // ${localWorkspaceFolderBasename} = the repo/fork name (e.g. microhack-labuser-0001),
+  // so this works for uniquely named forks in Codespaces and for local clones.
+  "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}/03-Azure/01-04-AI/03_Inventory_Planning_Agentic",
+
+  "remoteEnv": {
+    "hackFolder": "/workspaces/${localWorkspaceFolderBasename}/03-Azure/01-04-AI/03_Inventory_Planning_Agentic",
+    "PYTHONPATH": "/workspaces/${localWorkspaceFolderBasename}/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/src"
+  }
+}
\ No newline at end of file
diff --git a/.gitattributes b/.gitattributes
index 243d554e0..601a77b0e 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -19,3 +19,7 @@
 "/03-Azure/01-01-App Innovation/04-adaptive-apps/**/*.yml" text eol=lf
 "/03-Azure/01-01-App Innovation/04-adaptive-apps/iac/bicepconfig.json" text eol=lf
 "/.devcontainer/03-azure-01-01-app-innovation-04-adaptive-apps/devcontainer.json" text eol=lf
+# Agentic Inventory Planning: shell scripts run inside the dev container and must keep LF endings
+"/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/**/*.sh" text eol=lf
+# Shared dev container scripts run inside Linux containers; Windows autocrlf checkouts must not add CRLF
+"/.devcontainer/**/*.sh" text eol=lf
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/.devcontainer/devcontainer.json b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/.devcontainer/devcontainer.json
index e9a3100b4..528c4606c 100644
--- a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/.devcontainer/devcontainer.json
+++ b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/.devcontainer/devcontainer.json
@@ -1,6 +1,10 @@
 {
-  "name": "Agentic Inventory hack",
-  "image": "mcr.microsoft.com/devcontainers/python:3.11-bookworm",
+  // Used when ONLY this hack folder is opened in VS Code ("Dev Containers: Reopen in Container").
+  // GitHub Codespaces and full-repo clones use the repo-root config instead:
+  //   .devcontainer/03-azure-01-04-ai-03-inventory-planning-agentic/devcontainer.json
+  // Keep both in sync.
+  "name": "Azure / AI / Inventory Planning Agentic (hack folder)",
+  "image": "mcr.microsoft.com/devcontainers/python:3.12-bookworm",
   "features": {
     "ghcr.io/devcontainers/features/azure-cli:1": {},
     "ghcr.io/azure/azure-dev/azd:latest": {},
@@ -8,23 +12,28 @@
   },
   "forwardPorts": [8000],
   "portsAttributes": {
-    "8000": {
-      "label": "Planner Console",
-      "onAutoForward": "openPreview"
-    }
+    "8000": { "label": "Planner Console", "onAutoForward": "openBrowser" }
   },
   "postCreateCommand": "bash .devcontainer/post-create.sh",
+  "remoteUser": "vscode",
+  // Python venv on a container volume — Docker Desktop bind mounts fail on venv-sized installs.
+  "mounts": [
+    "source=inv-agentic-venv-${devcontainerId},target=${containerWorkspaceFolder}/src/.venv,type=volume"
+  ],
   "customizations": {
     "vscode": {
       "extensions": [
         "ms-python.python",
         "ms-python.vscode-pylance",
+        "ms-python.debugpy",
         "ms-azuretools.azure-dev",
         "ms-azuretools.vscode-azureresourcegroups",
-        "teamsdevapp.vscode-ai-foundry"
+        "ms-windows-ai-studio.windows-ai-studio",
+        "GitHub.copilot",
+        "GitHub.copilot-chat"
       ],
       "settings": {
-        "python.defaultInterpreterPath": "/usr/local/bin/python",
+        "python.defaultInterpreterPath": "${containerWorkspaceFolder}/src/.venv/bin/python",
         "python.terminal.activateEnvironment": true
       }
     }
@@ -32,4 +41,4 @@
   "remoteEnv": {
     "PYTHONPATH": "${containerWorkspaceFolder}/src"
   }
-}
+}
\ No newline at end of file
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/.devcontainer/post-create.sh b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/.devcontainer/post-create.sh
old mode 100644
new mode 100755
index 9c288322d..d8855a06f
--- a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/.devcontainer/post-create.sh
+++ b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/.devcontainer/post-create.sh
@@ -1,23 +1,56 @@
 #!/usr/bin/env bash
-# Runs once when the Codespace / devcontainer is created.
+# Runs once when the Codespace / Dev Container is created (postCreateCommand).
+# Safe to re-run manually:  bash .devcontainer/post-create.sh
 set -euo pipefail
 
+# Always work from the hack folder, regardless of the caller's working directory.
+HACK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$HACK_DIR"
+
+echo "==> Checking Python 3.11+"
+PYTHON_BIN="$(command -v python3 || command -v python || true)"
+if [ -z "$PYTHON_BIN" ]; then
+  echo "ERROR: Python is missing. Rebuild the container with the 'Azure / AI / Inventory Planning Agentic' dev container configuration." >&2
+  exit 1
+fi
+if ! "$PYTHON_BIN" -c 'import sys; raise SystemExit(sys.version_info < (3, 11))'; then
+  echo "ERROR: Python 3.11 or newer is required (found $("$PYTHON_BIN" --version 2>&1))." >&2
+  exit 1
+fi
+"$PYTHON_BIN" --version
+
 echo "==> Installing uv (fast Python package manager)"
-python -m pip install --upgrade pip uv
+export PATH="$HOME/.local/bin:$PATH"
+if ! command -v uv >/dev/null 2>&1; then
+  "$PYTHON_BIN" -m pip install --quiet --upgrade uv \
+    || curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR="$HOME/.local/bin" UV_NO_MODIFY_PATH=1 sh
+fi
+# Make uv available in every new terminal, wherever it was installed.
+if ! grep -q 'HOME/.local/bin' "$HOME/.bashrc" 2>/dev/null; then
+  echo 'export PATH="$HOME/.local/bin:$PATH"' >> "$HOME/.bashrc"
+fi
+uv --version
 
 echo "==> Installing dependencies from src/pyproject.toml (uv sync)"
-( cd src && uv sync )
+# src/.venv is a Docker volume (see devcontainer.json "mounts"); new volumes are root-owned.
+if [ -d src/.venv ] && [ ! -w src/.venv ]; then
+  sudo chown "$(id -u):$(id -g)" src/.venv
+fi
+( cd src && uv sync --python "$PYTHON_BIN" --link-mode=copy )
 
 echo "==> Seeding src/.env (edit it with your lab dashboard values)"
 if [ ! -f src/.env ]; then
   cp .env.example src/.env
+  echo "    Created src/.env from .env.example"
+else
+  echo "    src/.env already exists - leaving it unchanged"
 fi
 
 echo ""
 echo "============================================================"
-echo " Ready. Next steps:"
-echo "   1. az login"
+echo " Ready. Next steps (see challenges/challenge-01.md):"
+echo "   1. az login --use-device-code"
 echo "   2. Edit src/.env with PROJECT_ENDPOINT + MODEL_DEPLOYMENT_NAME + COSMOS_ENDPOINT"
 echo "   3. cd src && uv run uvicorn ui.app:app --reload --port 8000"
 echo "   4. Open the forwarded port 8000 and follow the console."
-echo "============================================================"
+echo "============================================================"
\ No newline at end of file
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/README.md b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/README.md
index df202b44e..41b4ce741 100644
--- a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/README.md
+++ b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/README.md
@@ -131,7 +131,10 @@ it has the longest support horizon (retires **2027-03-18**), and it runs on
 
 To complete this MicroHack you'll need:
 
-- A **GitHub account** (for Codespaces) **or** local **Python 3.11** + [uv](https://docs.astral.sh/uv/) + **Azure CLI**.
+- The **lab account from your Hackbox** — it signs you in to the Azure portal and,
+  via single sign-on, to **GitHub** (the lab organization, used to fork the repo and
+  run a **Codespace**). Prefer local? **VS Code** + **Docker Desktop** + the
+  **Dev Containers** extension runs the same dev container.
 - Access to the **Foundry project** and **Cosmos DB** your lab automation provisioned —
   you'll get a `FoundryProjectEndpoint`, `ModelDeploymentName`, and `CosmosEndpoint` on
   your dashboard.
@@ -139,7 +142,8 @@ To complete this MicroHack you'll need:
 - That's it — no data setup (the app seeds Cosmos on first run), no other software.
 
 > [!TIP]
-> **You're ready to start when** you can open the repo in a Codespace, run `az login`,
+> **You're ready to start when** you can open your fork in a Codespace using the
+> **Azure / AI / Inventory Planning Agentic** dev container, run `az login`,
 > and paste your three dashboard values into `src/.env`.
 
 ## Challenges
@@ -164,7 +168,7 @@ Each challenge follows the same anatomy, so you always know where to look:
 
 ### Challenge list
 
-- **Challenge 1**: **[Get Grounded & Set Up](challenges/challenge-01.md)** *(45 min)* — the scenario, the data model, your Codespace, and the planner console.
+- **Challenge 1**: **[Get Grounded & Set Up](challenges/challenge-01.md)** *(60 min)* — the scenario, the data model, your Codespace, and the planner console.
 - **Challenge 2**: **[Demand Sensing](challenges/challenge-02.md)** *(60 min)* — build and deploy your first hosted agent with function tools over the governed data.
 - **Challenge 3**: **[Inventory Optimisation](challenges/challenge-03.md)** *(60 min)* — a reasoning agent that produces a reorder recommendation, then read its trace.
 - **Challenge 4**: **[Replenishment + Human-in-the-Loop](challenges/challenge-04.md)** *(75 min)* — a real approval gate before the only side-effecting tool.
@@ -181,7 +185,8 @@ Each challenge follows the same anatomy, so you always know where to look:
 ## Repository layout
 
 ```
-.devcontainer/        Codespaces / devcontainer (uv, azd, Azure CLI)
+.devcontainer/        Dev container for this folder + post-create.sh (Codespaces uses
+                      /.devcontainer/03-azure-01-04-ai-03-inventory-planning-agentic)
 labautomation/        Platform entry point — provisions Foundry + Cosmos DB + App Insights
 src/
   pyproject.toml      Dependencies (managed by uv — no requirements.txt)
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/challenges/challenge-01.md b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/challenges/challenge-01.md
index a8bc76c64..cc935dd2c 100644
--- a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/challenges/challenge-01.md
+++ b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/challenges/challenge-01.md
@@ -4,9 +4,10 @@
 
 ## 🎯 Objective
 
-Understand the inventory scenario and the architecture, get your
-**Codespace** running, connect to your **Foundry project**, and open the **planner
-console** — the empty shell you'll light up one agent at a time.
+Sign in with your assigned lab credentials, fork the hack repository and get your
+**Codespace** running, connect to your **Foundry project**, understand the inventory
+scenario, and open the **planner console** — the empty shell you'll light up one agent
+at a time.
 
 ## 🧭 Context
 
@@ -21,22 +22,120 @@ gap — in code — and surface them through a small planner console:
 The governed data lives **inside your code** as function tools over `src/data` — the
 app seeds it into Cosmos on first run, with nothing extra to set up.
 
+Complete this setup with the credentials provided in your **Hackbox** (see the
+**Credentials** section at the top of the Hackbox page). Use the assigned lab account
+— not a personal or work account — so that you have access to the correct Azure
+subscription, resource group, GitHub organization, and repository.
+
 ## ✅ Tasks
 
-### Part A — Open the Codespace (10 min)
+### Part A — Sign in to Azure (5 min)
+
+1. Open the [Azure portal](https://portal.azure.com) and sign in with your Hackbox
+   credentials. When prompted to choose an account, select **Use another account** —
+   do not use your personal or work account.
+
+   ![Sign in to the Azure portal with another account](../images/setup-azureportal.png)
+
+2. Select **Resource groups** and open the resource group assigned to you.
+
+   ![Resource groups in the Azure portal navigation menu](../images/setup-resource-groups.png)
+
+3. Confirm it contains your lab resources: an **Azure AI Services / Foundry** account
+   (`inv-…`) with the `inventory-hack` project, an **Azure Cosmos DB** account
+   (`inv-cos-…`), a **Log Analytics** workspace, and **Application Insights**.
+
+### Part B — Sign in to GitHub and fork the repository (10 min)
+
+1. Open [GitHub](https://github.com) and select **Sign in**. There is **no separate
+   GitHub username or password** — GitHub uses single sign-on with the **same lab
+   account** you used for the Azure portal. When prompted to choose an account,
+   select **Use another account**, then select **Sign in with your identity
+   provider** and authenticate with the lab account.
+
+   ![Sign in to GitHub with another account](../images/setup-github-login.png)
+
+2. Open your profile menu → **Organizations** and select the lab organization
+   assigned to your account.
+
+   ![GitHub organization selector](../images/setup-github-organization.png)
+
+3. Open the `microhack` repository and click **Fork** (top-right). You need your own
+   fork before you can create a Codespace.
+
+   ![Create fork](../images/setup-create-fork-1.png)
+
+4. Give the fork a **unique name** so it doesn't clash with other attendees — for
+   example append your lab username (`microhack-labuser-0001`) — then select
+   **Create fork**.
+
+   ![Fork repository with a unique name](../images/setup-create-fork-2.png)
+
+5. You should now see your fork with all files and folders from the original
+   repository.
+
+   ![Files and folders in the forked GitHub repository](../images/setup-github-repository.png)
+
+### Part C — Create the development environment (10 min)
+
+**Option 1 — GitHub Codespaces (recommended)**
+
+1. On your fork, select **Code → Codespaces**, open the `...` menu and choose
+   **New with options...** (do **not** use *Create codespace on main* — that picks a
+   different dev container).
+
+   ![Create a GitHub Codespace with options](../images/setup-github-codespaces.png)
+
+2. Set **Dev container configuration** to
+   **Azure / AI / Inventory Planning Agentic**, keep the **2-core** machine type, and
+   select **Create codespace**.
+3. GitHub opens the Codespace in a new tab. The first build takes a few minutes: the
+   container installs Python 3.12, `uv`, the Azure CLI, and `azd`, then
+   `.devcontainer/post-create.sh` runs `uv sync` and seeds `src/.env`. The Explorer
+   opens directly on the `03_Inventory_Planning_Agentic` folder.
+
+   > [!IMPORTANT]
+   > When VS Code asks whether to open the git repository found in the parent folders,
+   > select **Never** — you only need the hack folder.
+   >
+   > ![Select Never when asked to open the repository](../images/setup-never-open-repository.png)
+
+**Option 2 — Local VS Code Dev Containers**
+
+Prerequisites: [Docker Desktop](https://www.docker.com/products/docker-desktop/) (running)
+and the [Dev Containers](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers)
+extension.
+
+1. Clone your fork and open the **repository root** folder in VS Code:
+   ```bash
+   git clone https://github.com/<your-org>/<your-fork>.git
+   code <your-fork>
+   ```
+2. Run **Dev Containers: Reopen in Container** from the Command Palette
+   (`Ctrl/Cmd+Shift+P`) and select **Azure / AI / Inventory Planning Agentic**. The
+   same image and `post-create.sh` run as in Codespaces.
+
+**Verify the environment** (either option) — in a new terminal:
+
+```bash
+python --version   # 3.12.x
+uv --version
+az --version
+ls src/.env src/.venv
+```
 
-1. On the GitHub repo, click **Code → Codespaces → Create codespace on main**.
-   (Prefer local? Open the folder in VS Code with the Dev Containers extension.)
-2. Wait for the container to build — it installs dependencies with `uv` and seeds
-   `src/.env` automatically (see `.devcontainer/post-create.sh`).
+The setup log ends with **Ready. Next steps**. If any check fails, re-run the setup
+script from the hack folder: `bash .devcontainer/post-create.sh`.
 
-### Part B — Connect to your Foundry project (10 min)
+### Part D — Connect to your Foundry project (10 min)
 
-1. In the Codespace terminal, sign in:
+1. In the terminal, sign in with your Hackbox credentials:
    ```bash
    az login --use-device-code
    ```
-2. Open `src/.env` and paste the three values from your **lab dashboard**:
+   Open the URL shown, enter the code, and sign in with the lab account. If prompted
+   to choose a subscription, pick the one that contains your resource group.
+2. Open `src/.env` and paste the three values from your **Hackbox** credentials:
    ```
    PROJECT_ENDPOINT=<FoundryProjectEndpoint>
    MODEL_DEPLOYMENT_NAME=<ModelDeploymentName>   # gpt-5.4-mini
@@ -45,7 +144,7 @@ app seeds it into Cosmos on first run, with nothing extra to set up.
 3. Confirm the model is deployed: open [ai.azure.com](https://ai.azure.com), select
    your project, and check **Models + endpoints** shows `gpt-5.4-mini` = *Succeeded*.
 
-### Part C — Read the data model (15 min)
+### Part E — Read the data model (15 min)
 
 The governed data lives in a **per-attendee Azure Cosmos DB** that the lab
 provisioned (serverless, keyless). `src/inventory_store.py` seeds it from `src/data`
@@ -64,7 +163,7 @@ on first run and serves these containers to the tools:
 
 A row is **CRITICAL** when `onHand < safetyStock`, **AT_RISK** at/below `reorderPoint`.
 
-### Part D — Open the planner console (10 min)
+### Part F — Open the planner console (10 min)
 
 1. From `src/`, launch the console:
    ```bash
@@ -80,7 +179,9 @@ A row is **CRITICAL** when `onHand < safetyStock`, **AT_RISK** at/below `reorder
 
 ## 🏁 Success criteria
 
-- [ ] Your Codespace (or local devcontainer) is running with dependencies installed.
+- [ ] You can see your lab resource group (Foundry, Cosmos DB, Application Insights) in the Azure portal.
+- [ ] You forked the `microhack` repository in the lab GitHub organization under a unique name.
+- [ ] Your Codespace (or local Dev Container) runs the **Azure / AI / Inventory Planning Agentic** configuration and `python`, `uv`, `az` all work.
 - [ ] `az login` succeeded and `src/.env` has your endpoint, model name, and Cosmos endpoint.
 - [ ] `gpt-5.4-mini` shows *Succeeded* in your Foundry project.
 - [ ] The planner console loads and shows current exposure + the order book (Cosmos seeded).
@@ -90,6 +191,11 @@ A row is **CRITICAL** when `onHand < safetyStock`, **AT_RISK** at/below `reorder
 
 | Symptom | Fix |
 |---------|-----|
+| GitHub organization or `microhack` repository missing | Sign out of GitHub and sign in again via **Sign in with your identity provider** using the lab account (the same one as the Azure portal). If the organization is still missing, ask your facilitator — the lab user needs GitHub access (`GHCPUsers`). |
+| **Azure / AI / Inventory Planning Agentic** not in the dev container list | Make sure you're on your **fork** of the `microhack` repository and used **New with options...**. |
+| `python: command not found` / `uv: command not found` / `src/.venv` missing | The Codespace was created with the wrong dev container (e.g. *Create codespace on main*). Delete it and recreate it with **New with options...** → **Azure / AI / Inventory Planning Agentic**. If the config is right, open a new terminal or re-run `bash .devcontainer/post-create.sh`. |
+| `post-create.sh` fails locally with `$'\r': command not found` | The script was checked out with Windows line endings before the LF rule applied. In the container terminal run `sed -i 's/\r$//' .devcontainer/post-create.sh && bash .devcontainer/post-create.sh`. |
+| Local Dev Container: `uv sync` fails with SSL / connection errors | Your network blocks direct access to PyPI (corporate proxy). Codespaces is not affected. Set your company's proxy (`export HTTPS_PROXY=...`) or package mirror (`export UV_DEFAULT_INDEX=...`) in the container terminal and re-run `bash .devcontainer/post-create.sh` — or use Codespaces. |
 | `gpt-5.4-mini` missing | Flag your facilitator — it's part of the provisioned lab. |
 | Port 8000 didn't open | Open the **Ports** tab and click the globe on 8000. |
 | `az login` opens no browser | Use `az login --use-device-code` and follow the URL. |
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/README.md b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/README.md
index 8c3678bea..e44eb7942 100644
--- a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/README.md
+++ b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/README.md
@@ -25,3 +25,11 @@ portal) from the sense → plan → approve → act loop:
 To refresh one, run the matching step in the planner console (or open the agent's
 **Traces** tab in the Foundry portal for the trace) and re-save it under the same file
 name. Keep them legible in the rendered Markdown.
+
+## Setup screenshots (Challenge 1)
+
+The `setup-*.png` files illustrate the generic MicroHack lab sign-in and Codespaces
+flow: Azure portal sign-in and resource
+groups, GitHub sign-in via the identity provider, the lab organization, forking the
+`microhack` repository under a unique name, **Code → Codespaces → New with options**,
+and the *Never* answer to VS Code's "open the parent repository" prompt.
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-azureportal.png b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-azureportal.png
new file mode 100644
index 000000000..5a5a5d966
Binary files /dev/null and b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-azureportal.png differ
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-create-fork-1.png b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-create-fork-1.png
new file mode 100644
index 000000000..b7b0c45b5
Binary files /dev/null and b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-create-fork-1.png differ
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-create-fork-2.png b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-create-fork-2.png
new file mode 100644
index 000000000..2c44798c9
Binary files /dev/null and b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-create-fork-2.png differ
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-codespaces.png b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-codespaces.png
new file mode 100644
index 000000000..24ed14124
Binary files /dev/null and b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-codespaces.png differ
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-login.png b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-login.png
new file mode 100644
index 000000000..6040440ee
Binary files /dev/null and b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-login.png differ
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-organization.png b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-organization.png
new file mode 100644
index 000000000..db7276bab
Binary files /dev/null and b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-organization.png differ
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-repository.png b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-repository.png
new file mode 100644
index 000000000..4e2e0895a
Binary files /dev/null and b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-github-repository.png differ
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-never-open-repository.png b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-never-open-repository.png
new file mode 100644
index 000000000..611d0a485
Binary files /dev/null and b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-never-open-repository.png differ
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-resource-groups.png b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-resource-groups.png
new file mode 100644
index 000000000..6b563f4c6
Binary files /dev/null and b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/images/setup-resource-groups.png differ
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/labautomation/README.md b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/labautomation/README.md
index 50e6076f7..5e52fc661 100644
--- a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/labautomation/README.md
+++ b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/labautomation/README.md
@@ -42,6 +42,13 @@ Edit [`lab-defaults.json`](lab-defaults.json) to tune region priority, labs per
 subscription, and the per-user daily cost estimate. No IDs or secrets are stored
 in this folder.
 
+`"groups": ["GHCPUsers"]` is **required**: the platform adds each lab Entra user to the
+lab GitHub organization (with access to the `microhack` repository and a Copilot
+seat). Attendees sign in to GitHub via **single sign-on** with the same lab account —
+`deploy-lab.ps1` does **not** emit any GitHub credentials. Attendees fork that
+repository and create their Codespace from the fork in Challenge 1 — without this
+group they cannot access GitHub and the setup cannot be completed.
+
 ## Deployment robustness
 
 `deploy-lab.ps1` is defensive about the failure modes that could otherwise produce a
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/labautomation/lab-defaults.json b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/labautomation/lab-defaults.json
index fee4266f7..124a8a1c1 100644
--- a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/labautomation/lab-defaults.json
+++ b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/labautomation/lab-defaults.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/MicroHack/refs/heads/main/lab-defaults-schema.json",
-  "groups": [],
+  "groups": ["GHCPUsers"],
   "deploymentType": "resourcegroup",
   "labsPerSubscription": 8,
   "preferredLocation": "swedencentral, westeurope, norwayeast",
diff --git a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/walkthrough/challenge-01/solution-01.md b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/walkthrough/challenge-01/solution-01.md
index 2448b229f..7dbcd1252 100644
--- a/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/walkthrough/challenge-01/solution-01.md
+++ b/03-Azure/01-04-AI/03_Inventory_Planning_Agentic/walkthrough/challenge-01/solution-01.md
@@ -6,7 +6,11 @@ This walkthrough confirms a correct setup. There is no agent to build yet.
 
 ## Expected end state
 
-- Codespace (or local devcontainer) built, dependencies installed.
+- Signed in to the Azure portal and GitHub with the Hackbox lab account; the
+  `microhack` repository forked under a unique name (e.g. `microhack-labuser-0001`).
+- Codespace (or local Dev Container) built from the
+  **Azure / AI / Inventory Planning Agentic** configuration — `python --version`
+  shows 3.12, `uv --version` and `az --version` work, and `src/.venv` exists.
 - `az login` completed in the Codespace terminal.
 - `src/.env` populated from the lab dashboard:
   ```
@@ -38,6 +42,7 @@ and each step lights up as you build its agent.
 
 | Symptom | Cause / fix |
 |---------|-------------|
+| `python` / `uv` not found, no `src/.venv` | Codespace created with the default config (*Create codespace on main*). Recreate it via **New with options...** → **Azure / AI / Inventory Planning Agentic**. |
 | `PROJECT_ENDPOINT is not set` | `.env` missing or not in `src/` — the console reads it via `config.py`. |
 | Panels empty | A Python import error — check the `uvicorn` terminal output. |
 | Port 8000 not forwarded | Open the **Ports** tab and forward 8000 manually. |