> ## Documentation Index
> Fetch the complete documentation index at: https://docs.findmydata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Find My Data — documentation

The documentation home for the Find My Data platform (the current release is always the first entry in the [release notes](release-notes.md)). Start here and follow the path that matches your role. Every document is grounded in the code in this repository and follows the platform's honesty convention: capabilities are always described as *built + validated live*, *built + mock-validated (live path feature-gated)*, or *not built* — never vaguer than that.

## Start here

| If you are…                              | Read first                                    | Then                                                                                                              |
| ---------------------------------------- | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| New to the product                       | [Platform overview](platform-overview.md)     | [Quick start](quick-start.md)                                                                                     |
| Installing or configuring it             | [Installation guide](installation-guide.md)   | [Operations guide](operations-guide.md), [Troubleshooting](troubleshooting.md)                                    |
| Reviewing it for adoption (security/ARB) | [Security review package](security-review.md) | [Threat model](threat-model.md), [Data catalog](data-catalog.md), [Permissions manifest](permissions-manifest.md) |
| Building on or integrating with it       | [HTTP API reference](api-reference.md)        | [Data schema](data-schema.md), [Architecture](architecture.md)                                                    |
| Tracking releases and direction          | [Release notes](release-notes.md)             | [Roadmap](roadmap.md), [STATUS](../STATUS.md)                                                                     |

## User & adopter documentation

| Document                                    | What it covers                                                                                                                                 |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| [Platform overview](platform-overview.md)   | What Find My Data is, the Find → Confirm → Connect → Govern loop, personas/roles, core concepts glossary, honest capability matrix, invariants |
| [Installation guide](installation-guide.md) | Prerequisites, install/seed/run, the complete `FMD_*` configuration reference, feature-gate matrix, production lockouts, Azure deployment      |
| [Quick start guides](quick-start.md)        | 10-minute walkthroughs per persona: platform admin, governance admin, domain owner, remediation approver, auditor                              |
| [Troubleshooting guide](troubleshooting.md) | Symptom → cause → resolution, grounded in the platform's real error strings and gating messages                                                |
| [Release notes](release-notes.md)           | Versioning policy (`year.month.day.x`) and per-release changes, newest first                                                                   |

## Operations & engineering

| Document                                | What it covers                                                                                                                                           |
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Operations guide](operations-guide.md) | Process topology, scanner fleet, durable queue and dead letters, metrics and readiness semantics, change-notification operations, backup, scale triggers |
| [HTTP API reference](api-reference.md)  | Every endpoint with method, path, required capability, and the auth/CSRF/error model                                                                     |
| [Data schema reference](data-schema.md) | Every table across all 12 migrations, conventions, constraints, and an ER overview                                                                       |
| [Architecture](architecture.md)         | Actual-code module architecture and diagram                                                                                                              |
| [Capacity model](capacity-model.md)     | Measured load-harness results and the documented scale triggers                                                                                          |
| [CDX test runbook](cdx-test-runbook.md) | The live Microsoft 365 validation runbook, including the recorded read-only CDX run                                                                      |

## Governance, security & compliance

| Document                                        | What it covers                                                                                                                                                                                    |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Security review package](security-review.md)   | The Architecture Review Board package: deployment model, trust boundaries, identity and authorization, data protection, secrets, audit, AI governance, residual risks, evidence-pointer checklist |
| [Threat model](threat-model.md)                 | Trust boundaries, threat register (T1–T16) with mitigations and residual risk, retention caveats                                                                                                  |
| [Data catalog & handling](data-catalog.md)      | What data is acquired, derived, retained, and never stored — sensitivity, retention, access levels, redaction                                                                                     |
| [Permissions manifest](permissions-manifest.md) | Every Microsoft Graph permission the product uses or plans to use, least-privilege alternatives, protected/metered API notes                                                                      |

## Decisions & direction

| Document                                    | What it covers                                                                                |
| ------------------------------------------- | --------------------------------------------------------------------------------------------- |
| [Decision register](decisions.md)           | Index and summaries of all ADRs                                                               |
| [ADRs](adr/)                                | The full architecture decision records (ADR-0001 … ADR-0014)                                  |
| [Roadmap](roadmap.md)                       | What is built vs. what the design documents call for next, by release                         |
| [STATUS](../STATUS.md)                      | The living honest-state document: completed / gated / known limitations / verification record |
| [Review findings](review-findings.md)       | Adversarial review findings and their resolutions                                             |
| [Handoff package](../find_my_data_handoff/) | The original product, architecture, security, data-model, and delivery-plan documents         |

## Conventions used across the documentation

* **Versioning:** releases are `year.month.day.x` (e.g. `26.7.15.0` = first release on 2026-07-15; a same-day follow-up would be `26.7.15.1`). The authoritative version lives in the repo-root `VERSION` file and `PRODUCT_VERSION` in `packages/server/src/controlplane/routes.ts`.
* **Honesty labels:** `/api/ready` reports each integration as `mock`, `live`, `blocked` (enabled but prerequisites unmet), or `disabled` (not enabled). Documentation uses the same vocabulary.
* **Demo data:** all fixture people and documents belong to the fictional **Meridian Grove Holdings**; nothing in the fixtures is real data.
