Chain (re-)materialization is triggered by sync ingestion (continuous), a deploy-gate one-shot job (when chain-builder code changes), and operator-run recovery — never by the evaluator.
scan_runs is the pipeline-run root; stage outcomes are stamped onto scan_runs.category_results under reserved __stage keys; a typed CredentialBroker is the only runtime path that resolves CredentialsRef; deploy-gate rematerialization (ADR-026 path b) is one job kind, generalised to all derived collections.
Current-state audit of sv0-platform's connector → ingest → chain-assemble → evaluate pipeline. Confirms Stream-1 Phases 1-3 already shipped (scheduler, atomic scope claim, execute_scan worker, connector-driver seam, sync→eval→evidence cascade). Identifies the single hard blocker (inert credential broker — `InProcessSubprocessDriver` constructed at `src/index.ts:98` with `env: undefined`) and ten secondary gaps. Drives the decision in ADR-027; lays out the seven-slice migration.
Comprehensive CI/CD strategy for sv0-platform deployment and sv0-connectors scan pipelines, including secrets management evaluation (GitHub Secrets, SOPS+age, Tailscale, Vault, Doppler, self-hosted...
Merges W1.1 (persistent authority paths + path-level findings) with Phase 4 (platform-side graph computation, import-by-type ingestion)
Synthesized plan from three concurrent architectural reviews (Gemini3, Codex, fresh architect review) to make the connector ETL pipeline produce audit-grade, deterministic execution evidence
Analyzes whether the current TypeScript/Node.js stack is sufficient for the processing pipeline at scale
Defines the batch processing pipeline from connector submission through findings and evidence packs