Code repositories and databases today; cloud and observability on the way. The principle does not change: the diagnosis declares what it does not see — and every new connection shrinks that list.
A PUBLIC REPOSITORY CONNECTS WITH NO CREDENTIAL AT ALL
ArchConnection replaces the long-lived token with an app installation and an ephemeral credential per execution. The migration is gradual — the traditional token remains available.
| Token (PAT) | ArchConnection | Public repo | |
|---|---|---|---|
| What is stored | long-lived token, encrypted | nothing permanent | nothing |
| Access duration | until manual revocation | minutes, single use per scan | — |
| Scope | broad — everything the user sees | only the repositories the admin chose | — |
| If it leaks | high blast radius | near-zero blast radius | none |
Bound to the organization, not to a person: whoever leaves the company does not take the access along — and uninstalling the app revokes everything at once.
The whole line was born from one principle: audit the structure without ever touching row data.
The DBA exports the schema (no data) and uploads the file. No credential, works in a closed network — and a guard rejects any file containing real data. PostgreSQL and MySQL/MariaDB validated; others in validation.
A metadata-reading user: the structure stays current and freshness stops being a caveat in the report.
Usage statistics — indexes actually used, table growth — without ever reading row data. Risk goes from static to measured.
Phrased the way the product phrases it: today we declare we do not see X — connection Y will make us see it. No promised date.
real response time per route, production errors crossed with the code's critical points, delivery indicators with real data.
cost per component crossed with the Executive Report's decision matrix; continuity actually configured, not just declared in code.
database audit goes from a dated snapshot to continuous tracking of the structure.
the documents you upload raising the confidence of every report in the unit.
The mechanism already exists in the product: the report declares a confidence ceiling for what it can see — code, git history, and ready steps waiting for each new source. Connecting does not change the wording: it changes the number, auditably.
In the demo, we connect one of your repositories (or a public one) and the first report shows what each source adds.