scan_runs is the pipeline-run root; stage outcomes are stamped onto scan_runs.category_results under reserved __stage keys; a typed CredentialBroker is the only runtime path that resolves CredentialsRef; deploy-gate rematerialization (ADR-026 path b) is one job kind, generalised to all derived collections.
Current-state audit of sv0-platform's connector → ingest → chain-assemble → evaluate pipeline. Confirms Stream-1 Phases 1-3 already shipped (scheduler, atomic scope claim, execute_scan worker, connector-driver seam, sync→eval→evidence cascade). Identifies the single hard blocker (inert credential broker — `InProcessSubprocessDriver` constructed at `src/index.ts:98` with `env: undefined`) and ten secondary gaps. Drives the decision in ADR-027; lays out the seven-slice migration.
How connectors actually run inside the SecurityV0 platform — VM topology, credential delivery chain (1Password → Key Vault → Managed Identity → VM env → broker → subprocess), scheduler/driver path, tenant isolation invariants, and failure topology. Complements 05-connectors.md (interface contract) with the runtime/infra view.