# Transfer check report

**4 results need a decision.** Nothing failed, and nobody can hand this over until somebody decides.

| Field | Value |
|---|---|
| Repository | `[redacted: local working copy path]` |
| Commit | `01352d3b953b3cfccaeb4876bfeb66dd96183217` |
| Started | 2026-10-25T07:20:37.488Z |
| Finished | 2026-10-25T07:28:29.500Z |

## Checks

| Check | Result | Summary | Duration |
|---|---|---|---|
| Documentation matches the repository | pass | Every documented command exists and the environment example ships | 0.0s |
| The database can be set up from a clean clone | pass | Every script a buyer needs to reach a working database is present | 0.0s |
| Environment variables are documented and used | pass | Every variable the code reads is documented, and every documented variable is used | 0.3s |
| The repository runs without VoyantIQ | pass | No sibling imports, no VoyantIQ service calls and no denylisted terms | 0.3s |
| A buyer can install, migrate and build | pass | Installed, migrated and built from a clean clone, creating 62 tables | 401.2s |
| The shipped tests pass | review | The documentation claims 371 tests and the suite reports 373 | 38.1s |
| No secret in the git history | pass | No secret found anywhere in the history | 10.2s |
| No critical vulnerability in the dependency tree | review | 4 high severity advisories, none critical | 3.4s |
| A software bill of materials is produced | pass | SPDX and CycloneDX bills of materials written | 4.6s |
| Every dependency licence is on the allowlist | review | 1 package is outside the allowlist under a reviewed exception: @img/sharp-libvips-linux-x64 | 6.7s |
| Buyer handoff documentation exists | pass | All 10 handoff documents are present and substantive | 0.0s |
| Nothing is committed that should not be (advisory) | review | Committed binaries: docs/handoff/evidence/evidence.zip | 0.1s |

## Needs a decision

### The shipped tests pass

The documentation claims 371 tests and the suite reports 373.

### No critical vulnerability in the dependency tree

4 high severity advisories, none critical.

7 distinct advisories: critical 0, high 4, other 3.
GHSA-27r3-jxmh-p828, GHSA-67mh-4wv8-2f99, GHSA-6g55-p6wh-862q,
GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849,
GHSA-mrhx-c7xc-m3w5

### Every dependency licence is on the allowlist

1 package is outside the allowlist under a reviewed exception:
@img/sharp-libvips-linux-x64

684 packages, 16 distinct licences.

Reviewed exception, 2026-10-24, founder: LGPL-3.0-or-later for
@img/sharp-libvips-linux-x64. A prebuilt libvips binary that arrives
through sharp, which arrives through Next.js image optimisation. No
VoyantIQ code imports or links it: it is a separate file, resolved at
install time, loaded dynamically and replaceable with another build of
libvips without touching any source. That replaceability is what LGPL's
obligations are about. Conditions: unmodified, installed by sharp rather
than vendored, dynamically loaded, licence notice kept. Counsel has not
reviewed it and the sale checklist blocks the first handover until they
do.

### Nothing is committed that should not be

Committed binaries: docs/handoff/evidence/evidence.zip

## Tooling

| Tool | Version or digest |
|---|---|
| git | `git version 2.55.0.windows.3` |
| docker | `Docker version 29.8.0, build 88096ef` |
| node | `node@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205` |
| postgres | `postgres@sha256:f4610795587492cd4fb887c2dc3de301b813278bb6f616992061141b5f15ac36` |
| gitleaks | `zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f` |
| osvScanner | `ghcr.io/google/osv-scanner@sha256:4f3b7e2c64b9d38a5febc5a7e4a3dfef1d1362f726dea7a2ef4762b46469fcd0` |
| syft | `anchore/syft@sha256:4cc92b64ca74ffca4c94d4c8fcc01f217731375300be14d0b6eeb2e82eaa110a` |

## What this report does not say

It does not say the product is good, that anyone wants it, or that the
code is well written. It says a stranger can obtain it, stand it up and
run its own tests without us.