Architecture - Find My Data

This diagram reflects the system as implemented in the current release. One deployable server process hosts the API and an embedded durable worker; the worker can also run as a separate process against the same queue (bun run worker). All stores are SQLite tables behind role interfaces (ADR-0003); projections are rebuildable.

The staged pipeline (scan/pipeline.ts + intelligence/inference.ts)

Stage-cache keys encode the invalidation matrix: an eTag-only change (rename, permission, label) reuses content/features as cache hits with zero content fetches (tested); a cTag change re-fetches; an ensemble release re-scores from retained features with no connector dependency at all (tested).

What is real vs. gated here

Capability	State
Fixture connector, pipeline, ensemble, review, analyst, actions, audit	Implemented + tested (358 tests)
Azure OpenAI / Anthropic providers	Adapters implemented, config-gated, not exercised by tests
Microsoft Graph live connector (read)	Implemented + validated read-only against a live Microsoft 365 tenant (ADR-0013). Mock stays the default/CI path.
Microsoft Graph live connector (write / label actions)	Implemented behind a separate, feature-gated remediation identity — the scan identity stays read-only
Entra ID sign-in	Built (26.7.16.14, ADR-0035): authorization-code + PKCE, RS256 ID-token validation; activated by `FMD_AUTH_MODE=entra` + a sign-in app registration (unconfigured → honest 501)
Purview label write (live)	Implemented + gated; requires Microsoft’s protected/metered API enablement for your tenant
Teams / Exchange connectors	Implemented + mock-validated; live paths feature-gated, not yet exercised against a live tenant