The evidence, named so you can ask for it by name.
Diligence on a software purchase is a short list of specific documents rather than a questionnaire. These are the documents, each with what it found for each application and whether it is ready. Three of the four applications have a required check that has not passed, and that is on this page rather than discovered at signature.
What the three statuses mean.
- Ready
- The check ran and passed at the commit named beside it. You can ask for this artifact today.
- Needs a Decision
- The check ran and produced a real result that somebody has to decide about before a handover completes. The decision, not the artifact, is what is outstanding.
- Not Ready
- The check ran and did not pass. The artifact is incomplete, and it is listed here rather than left off the page.
The evidence library.
Twelve checks run against each application from a clean clone. Each artifact below is one output of that run, and each row says what it found for each of the four.
Dependency inventory and licence position
Needs a DecisionEvery package the application resolves, with the licence each one states, checked against an allowlist.
Produced from the real lockfile of a clean clone by a pinned scanner image.
- Mission Control
- One package outside the allowlist, under a recorded exception.
- Real Estate
- One package outside the allowlist, under a recorded exception.
- Family Travel
- One package outside the allowlist, under a recorded exception.
- Teams
- One package outside the allowlist, under a recorded exception. 684 packages, 16 distinct licences.
The same package in all four: a prebuilt image library that arrives through the framework's image handling under a copyleft licence. It is a separate file, resolved at install time, dynamically loaded and replaceable with another build without touching any source, which is the condition the licence is written around. Counsel has not reviewed that reasoning and the sale checklist blocks the first handover until they do. It is a decision that is outstanding, not an artifact that is missing.
Software bill of materials
ReadyA machine-readable inventory of everything in the build, in both formats a reviewer is likely to ask for.
Generated from a clean clone by a pinned scanner image, in SPDX and CycloneDX.
- Mission Control
- Both formats written.
- Real Estate
- Both formats written.
- Family Travel
- Both formats written.
- Teams
- Both formats written.
History secret scan
ReadyA scan for credentials across the entire commit history, not only the current tree, so a secret committed and later removed is still found.
A pinned scanner image run against the full history of a clean clone.
- Mission Control
- No secret found anywhere in the history.
- Real Estate
- No secret found anywhere in the history.
- Family Travel
- No secret found, with one finding reviewed and recorded as ignored rather than silently suppressed.
- Teams
- No secret found anywhere in the history.
Dependency advisories
Needs a DecisionThe open advisories against the resolved dependency tree, enumerated by identifier rather than summarised as a count.
A pinned vulnerability scanner run against the lockfile of a clean clone.
- Mission Control
- Seven high severity advisories, none critical.
- Real Estate
- Seven high severity advisories, none critical.
- Family Travel
- Seven high severity advisories, none critical.
- Teams
- Four high severity advisories, none critical.
An advisory list is true of the commit it ran against and starts ageing the moment it is written. These are carried as needing a decision rather than as a pass, and a buyer receives a freshly generated list against the delivered commit rather than this one.
Clean-clone transfer rehearsal
ReadyThe whole handover performed against an empty database with nothing from our machines involved: install, migrate, seed, build.
A fresh clone into a container, a database created empty, and every documented command run in order.
- Mission Control
- Installed, migrated and built, creating 11 tables.
- Real Estate
- Installed, migrated and built, creating 16 tables.
- Family Travel
- Installed, migrated and built, creating 47 tables.
- Teams
- Installed, migrated and built, creating 62 tables.
Shipped test run
Needs a DecisionThe application's own test suite, run from the clean clone and compared against what its documentation claims.
Run inside the same container as the rehearsal, against the migrated database.
- Mission Control
- 82 passed, matching the documentation.
- Real Estate
- 136 passed, matching the documentation.
- Family Travel
- 479 passed and one skipped, matching the documentation.
- Teams
- 373 passed, where the documentation claims 371. The suite is ahead of its own README.
Teams passes more tests than its documentation claims, which is the harmless direction and is still a mismatch between a document a buyer reads and a number they can run. It is corrected in the documentation rather than explained away.
Environment variable inventory
ReadyEvery variable the code reads, what it is for, and whether it is required — checked in both directions, so a documented variable nothing reads is also a finding.
A scan of every source file against the shipped environment example.
- Mission Control
- Ten read by code, every one documented.
- Real Estate
- Twenty-seven read by code, every one documented. Three documented spellings are deprecated aliases and are recorded as such.
- Family Travel
- Thirty-seven read by code, every one documented. Two documented variables are read by a library rather than by application code and are recorded as such.
- Teams
- Twenty-six read by code, every one documented. Two are read by a library rather than by application code and are recorded as such.
Independence from VoyantIQ
ReadyA scan for imports from sibling repositories, calls to VoyantIQ services, and terms that would indicate a hidden dependency.
Every source file in the clean clone, read and matched.
- Mission Control
- 112 source files scanned, nothing found.
- Real Estate
- 171 source files scanned, nothing found.
- Family Travel
- 451 source files scanned, nothing found.
- Teams
- 372 source files scanned, nothing found.
This is an architectural finding about the inspected commit. It is not a licence position and not a statement about what VoyantIQ retains, which is settled in the agreement rather than by a scan.
Buyer handoff documentation
Not ReadyThe ten documents a buyer needs to operate the application without us: architecture, operations, data model, environment, deployment, and the rest.
Checked for presence and for being substantive rather than a heading with nothing under it.
- Mission Control
- Six of the ten are missing.
- Real Estate
- Six of the ten are missing.
- Family Travel
- Six of the ten are missing.
- Teams
- All ten present and substantive.
This is the one required check that genuinely fails, and it fails for three of the four applications. It is why those three are not described anywhere on this site as transfer-ready, and it is work in progress rather than a disclosure. Teams is complete.
File digests
ReadyA SHA-256 for every file in the pack, so you can prove that what you received is what was produced.
Computed over each file as the pack was assembled, and recorded in a manifest that travels with it.
- Mission Control
- A digest and a byte count for every file in the pack.
- Real Estate
- A digest and a byte count for every file in the pack.
- Family Travel
- A digest and a byte count for every file in the pack.
- Teams
- A digest and a byte count for every file in the pack.
Exclusivity and retained components
Not ReadyWhat VoyantIQ keeps after a sale, what the buyer's rights are to the delivered copies, and whether any prior right has been granted that would limit exclusivity.
Not a scan. A contractual position, resolved document by document before a transfer completes.
- Mission Control
- A retained-components document records a separately evolved seller-retained implementation. Scope unresolved.
- Real Estate
- Not yet resolved.
- Family Travel
- Not yet resolved.
- Teams
- Not yet resolved.
No exclusivity is advertised anywhere on this site until this is settled in writing for the application in question. It is listed as an artifact because it is the question a serious buyer asks third, and a page of scanner output that did not mention it would be answering the easy questions only.
Repository hygiene
Needs a DecisionWhether anything is committed that should not be: oversized files, generated output, stray binaries. Advisory rather than required.
A pass over every tracked file in the clean clone.
- Mission Control
- 139 tracked files, nothing oversized or generated.
- Real Estate
- 198 tracked files, nothing oversized or generated.
- Family Travel
- 507 tracked files, nothing oversized or generated.
- Teams
- One committed binary: the application's own evidence archive.
Advisory rather than required, and the one finding is benign: Teams carries its own evidence archive in the repository, which is a deliberate choice rather than a stray build output. It is left as needing a decision because a committed binary is exactly the thing that should have to be justified each time rather than waved through.
When each of these was produced.
A sweep is true of the commit it ran against and of nothing after it. The fact that this page rendered today says nothing about today: it says a web server answered.
- Mission Control
- Commit e0a7f905
- Swept , 12 checks
- Real Estate
- Commit 7654f2eb
- Swept , 12 checks
- Family Travel
- Commit 3f8ff1be
- Swept , 12 checks
- Teams
- Commit 01352d3b
- Swept , 12 checks
The most recent sweep was 2026-10-25. A buyer receives a pack generated against the commit actually being delivered rather than any of these, because an advisory list starts ageing the moment it is written.
A real pack, published in full.
Not a description of what a pack contains. This is the report the checker wrote for Teams on 2026-10-25, carried across verbatim apart from the local build path, which was redacted. It is also the least flattering document on this site, and that is the reason it is the one published.
What it is
- Product
- Teams
- Version
- 01352d3b953b3cfccaeb4876bfeb66dd96183217
- Generated
- 2026-10-25
- Size
- 4,080 bytes
- SHA-256
- 39015b093a83d4ce92e13d82f20ff888bfd35a45a3848aaa8538b56086974659
The digest is computed over the bytes published here, so it proves the file you saved is the file this page shows you.
Its scope
- One application, Teams, at one commit, on one date.
- Twelve checks: documentation truth, database setup, environment inventory, independence from VoyantIQ, install and migrate and build from a clean clone, the shipped test suite, a full-history secret scan, dependency advisories, bills of materials, the licence allowlist, buyer handoff documentation, and repository hygiene.
- Every scanner ran from a pinned container image, whose digest is recorded in the report so the result can be reproduced rather than taken on trust.
Its limitations
- It is true of the commit named in it and of nothing after that commit.
- It is not a penetration test, a security audit, a code review or a legal opinion.
- It does not say the product is good, that anybody wants it, or that the code is well written.
- Four of its twelve results need a decision, and it says so on its first line rather than in a footnote.
- The full pack it indexes — bills of materials, scanner output, build and test logs, file digests — is shared for diligence under an agreement, not published.
# Transfer check report **4 results need a decision.** Nothing failed, and nobody can hand this over until somebody decides. | Field | Value | |---|---| | Repository | `[redacted: local working copy path]` | | Commit | `01352d3b953b3cfccaeb4876bfeb66dd96183217` | | Started | 2026-10-25T07:20:37.488Z | | Finished | 2026-10-25T07:28:29.500Z | ## Checks | Check | Result | Summary | Duration | |---|---|---|---| | Documentation matches the repository | pass | Every documented command exists and the environment example ships | 0.0s | | The database can be set up from a clean clone | pass | Every script a buyer needs to reach a working database is present | 0.0s | | Environment variables are documented and used | pass | Every variable the code reads is documented, and every documented variable is used | 0.3s | | The repository runs without VoyantIQ | pass | No sibling imports, no VoyantIQ service calls and no denylisted terms | 0.3s | | A buyer can install, migrate and build | pass | Installed, migrated and built from a clean clone, creating 62 tables | 401.2s | | The shipped tests pass | review | The documentation claims 371 tests and the suite reports 373 | 38.1s | | No secret in the git history | pass | No secret found anywhere in the history | 10.2s | | No critical vulnerability in the dependency tree | review | 4 high severity advisories, none critical | 3.4s | | A software bill of materials is produced | pass | SPDX and CycloneDX bills of materials written | 4.6s | | Every dependency licence is on the allowlist | review | 1 package is outside the allowlist under a reviewed exception: @img/sharp-libvips-linux-x64 | 6.7s | | Buyer handoff documentation exists | pass | All 10 handoff documents are present and substantive | 0.0s | | Nothing is committed that should not be (advisory) | review | Committed binaries: docs/handoff/evidence/evidence.zip | 0.1s | ## Needs a decision ### The shipped tests pass The documentation claims 371 tests and the suite reports 373. ### No critical vulnerability in the dependency tree 4 high severity advisories, none critical. 7 distinct advisories: critical 0, high 4, other 3. GHSA-27r3-jxmh-p828, GHSA-67mh-4wv8-2f99, GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849, GHSA-mrhx-c7xc-m3w5 ### Every dependency licence is on the allowlist 1 package is outside the allowlist under a reviewed exception: @img/sharp-libvips-linux-x64 684 packages, 16 distinct licences. Reviewed exception, 2026-10-24, founder: LGPL-3.0-or-later for @img/sharp-libvips-linux-x64. A prebuilt libvips binary that arrives through sharp, which arrives through Next.js image optimisation. No VoyantIQ code imports or links it: it is a separate file, resolved at install time, loaded dynamically and replaceable with another build of libvips without touching any source. That replaceability is what LGPL's obligations are about. Conditions: unmodified, installed by sharp rather than vendored, dynamically loaded, licence notice kept. Counsel has not reviewed it and the sale checklist blocks the first handover until they do. ### Nothing is committed that should not be Committed binaries: docs/handoff/evidence/evidence.zip ## Tooling | Tool | Version or digest | |---|---| | git | `git version 2.55.0.windows.3` | | docker | `Docker version 29.8.0, build 88096ef` | | node | `node@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205` | | postgres | `postgres@sha256:f4610795587492cd4fb887c2dc3de301b813278bb6f616992061141b5f15ac36` | | gitleaks | `zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f` | | osvScanner | `ghcr.io/google/osv-scanner@sha256:4f3b7e2c64b9d38a5febc5a7e4a3dfef1d1362f726dea7a2ef4762b46469fcd0` | | syft | `anchore/syft@sha256:4cc92b64ca74ffca4c94d4c8fcc01f217731375300be14d0b6eeb2e82eaa110a` | ## What this report does not say It does not say the product is good, that anyone wants it, or that the code is well written. It says a stranger can obtain it, stand it up and run its own tests without us.
Asking for the full pack.
The full pack is several megabytes: both bills of materials, the raw scanner output, the install, migrate, seed, build and test logs, and a manifest with a digest for every file. It is shared for diligence under an agreement rather than posted, because the logs name infrastructure and the scanner output is a list of open advisories against a product somebody is still running.
Say which application and roughly when you need it. If your timeline depends on the licence review or on exclusivity being settled in writing, say that first rather than at signature: both are listed above as not yet resolved and neither moves faster for being discovered late.