W/P TR-7 · Method
What the desk reads, and what it refuses
A code diligence memo reads the software you are buying the way an accountant reads the books, before the money moves. This page names the instruments, the limits, the clock and the refund, and prints every number the free readout rests on.
Which instruments read the target?
A person runs three engines on the desk's own machine, and a reviewer grades what they find.
- assay writes each counted section of the memo as a finding that must point at a file. A finding with nothing to point at cannot be created, and a check that did not run becomes a gap with its reason. This site carries a TypeScript port of that contract,
src/engine/finding.ts, taken from assay at commit73e75e1. - shipsafe scans the repository with its 22 checks and prints a grade line. The memo quotes that line as printed and attaches the full output as an appendix.
- refit prices the ways out: remediate, partial rebuild, full rebuild, each as a band traced to the files it came from. Its rule for rates, that every number is cited or marked ASSUMED, is the rule this site's line estimate follows (
src/engine/rates.ts, from refit at commitb2231bb). - The reviewer, [[NAMED REVIEWER NEEDED]], grades six sections (architecture, maintainability, delivery risk, security, data handling, bus factor) and writes an evidence pointer beside each grade.
The three engines live in private repositories. The memo names the commit of each one that read the target, so a later reader knows which version said what.
What does the memo refuse?
- Financial statements, revenue, costs or forecasts. Centurica and others sell that report; this desk reads code.
- Contracts, customer agreements, and who holds title to the code. That is a lawyer's question, and the memo gives no legal opinion.
- A valuation, or any opinion on the price you are paying.
- Running systems: servers, cloud accounts, databases and live customer data.
- Any repository not named at intake.
The memo also never calls the target's code secure, compliant, clean or safe. It reports findings against named checks, and a check not run is printed as a gap.
How does the five-day clock run?
Five business days, Monday to Friday, from the day access is granted: the day the desk accepts the collaborator invitation, or the day a zip arrives and passes its first-bytes check. Public holidays are not skipped. The order form computes the earliest delivery from today and refuses payment when your deadline falls before it, because a memo that lands after the deal closes is worth nothing to you.
When is the price refunded?
In full, if the desk cannot read the repository within 48 hours of payment, or if the band was wrong on our side. Refunds are issued by a person, through Stripe. Write to [[CONTACT EMAIL NEEDED]].
How is the free line estimate made?
GitHub publishes, for any public repository, the bytes written in each language. The readout divides each language's bytes by an average line length for that language, which gives physical lines, blank and comment lines included. The line lengths below were measured by scripts/fetch-rates.mjs, which counted every file in the named public repositories at the commits shown. A language with no measurement carries an ASSUMED length, and the readout prints the red mark beside every line it moves.
| Mark | Language | Bytes per line | Measured on |
|---|---|---|---|
| C# | 38.3 | JamesNK/Newtonsoft.Json@52fa3ae | |
| CSS | 34.1 | shadcn-ui/taxonomy@298a885, pallets/flask@d086db8, vuejs/vitepress@8cc9e34, picocss/pico@a07563d | |
| Go | 29.7 | gin-gonic/gin@0f09c3a | |
| HTML | 59.3 | colinhacks/zod@284243f, expressjs/express@a419aa7, axios/axios@f694ecd, pallets/flask@d086db8, twbs/bootstrap@7771f16 | |
| Java | 36.3 | google/gson@845664b, square/okio@a6ae13e | |
| JavaScript | 31 | colinhacks/zod@284243f, pmndrs/zustand@d7a5583, shadcn-ui/taxonomy@298a885, expressjs/express@a419aa7, axios/axios@f694ecd, twbs/bootstrap@7771f16, vuejs/vitepress@8cc9e34, nvm-sh/nvm@b1b3a00, picocss/pico@a07563d | |
| Kotlin | 31.8 | square/okio@a6ae13e | |
| PHP | 33.1 | slimphp/Slim@3675bf6 | |
| Python | 34 | pallets/flask@d086db8, psf/requests@611c616, vuejs/vitepress@8cc9e34 | |
| Ruby | 29.3 | sinatra/sinatra@cb22afd, Alamofire/Alamofire@bda9ed5, BurntSushi/ripgrep@3fce3b5 | |
| Rust | 34.8 | BurntSushi/ripgrep@3fce3b5 | |
| SCSS | 29.1 | sinatra/sinatra@cb22afd, twbs/bootstrap@7771f16, picocss/pico@a07563d | |
| Shell | 33.6 | colinhacks/zod@284243f, pallets/flask@d086db8, square/okio@a6ae13e, BurntSushi/ripgrep@3fce3b5, twbs/bootstrap@7771f16, nvm-sh/nvm@b1b3a00 | |
| Swift | 42.5 | Alamofire/Alamofire@bda9ed5 | |
| TSX | 31.8 | pmndrs/zustand@d7a5583, shadcn-ui/taxonomy@298a885 | |
| TypeScript | 34 | colinhacks/zod@284243f, pmndrs/zustand@d7a5583, shadcn-ui/taxonomy@298a885, axios/axios@f694ecd, twbs/bootstrap@7771f16, vuejs/vitepress@8cc9e34 | |
| Vue | 23 | vuejs/vitepress@8cc9e34 | |
| Astro | 34 | ASSUMED | |
| Blade | 40 | ASSUMED | |
| C | 30 | ASSUMED | |
| C++ | 32 | ASSUMED | |
| Dart | 34 | ASSUMED | |
| Dockerfile | 40 | ASSUMED | |
| Elixir | 32 | ASSUMED | |
| Handlebars | 38 | ASSUMED | |
| Jupyter Notebook | 120 | ASSUMED | |
| Less | 26 | ASSUMED | |
| Lua | 30 | ASSUMED | |
| Objective-C | 38 | ASSUMED | |
| Perl | 32 | ASSUMED | |
| PowerShell | 36 | ASSUMED | |
| R | 34 | ASSUMED | |
| Sass | 24 | ASSUMED | |
| Scala | 36 | ASSUMED | |
| Solidity | 34 | ASSUMED | |
| Svelte | 34 | ASSUMED | |
| Twig | 38 | ASSUMED | |
| Any other language | 35 | ASSUMED |
The estimate is checked against five public repositories that were never used to set a rate. Each was counted file by file, and the estimate from GitHub's bytes has to land within the tolerance below. The same comparison runs in the site's tests on every build.
| Mark | Repository | Counted | Estimated | Error |
|---|---|---|---|---|
| sindresorhus/ky@3541888 | 36,231 | 31,858 | −12.1% | |
| pallets/click@2247b35 | 29,231 | 28,593 | −2.2% | |
| labstack/echo@3882266 | 44,037 | 44,656 | +1.4% | |
| rack/rack@a9833c8 | 22,424 | 25,634 | +14.3% | |
| tj/commander.js@ba6d13d | 19,257 | 19,862 | +3.1% |
What has this desk done so far?
Zero orders have been fulfilled by this desk. The engines have read other repositories, the fleet's own among them; none has yet read a target under a letter of intent. This sentence changes when the first memo ships.
What else could a buyer buy?
Prices as each seller prints them, with the address and the day they were read. Centurica's reports, sold through Flippa, cover the financials; code appears on that list only as Tech DD, priced "Custom".
| Seller | What is sold | Price, as printed |
|---|---|---|
| Centurica, via Flippa (investors.club) | Red Flag Report: "1 year", "below $30,000" | $1,500 |
| Centurica | Standard Report: "2 years", "$30,000 to $200,000" | $2,000 |
| Centurica | Enhanced Report: "3 years", "over $200,000" | $2,500 |
| Centurica | Tech DD | "Custom" |
| Kolonell (kolonell.com, dated 2026-10-01) | One app under 100,000 lines, about two weeks | "8,000 to 12,000 EUR" |
| Kolonell | 100,000 to 400,000 lines | "12,000 to 18,000 EUR" |
| Kolonell | Above 400,000 lines | "18,000 to 25,000 EUR" |
| Rockingtech (rockingtech.co.uk) | "Technical Review", "10 working days"; unverified, from a search summary | "GBP 15,000" |
| Scrums.com (scrums.com) | Tech diligence, "approximately 2 weeks from signed agreement to first deliverable" | "Sign in for pricing" |
| Targetread | One repository up to 200,000 lines, five business days after access | $1,900 |
| Targetread | One repository up to 1,000,000 lines, five business days after access | $3,900 |
An acquirer's exclusivity window commonly runs two to four weeks after the letter of intent. The memo is priced and timed to land inside it.