Targetread

W/P TR-3 · Memo, sample

The memo, read on this site's own code

A buyer receives this skeleton filled for the target. Here the counted sections are filled with this site's own repository, counted when the site was built; the graded sections stay empty, because a reviewer writes them per order and a sample has no order.

W/P TR-3

Repository
targetread, this site's own
Read
2026-10-10
Prepared by
scripts/sample.mjs, at build
Reviewed by
[[NAMED REVIEWER NEEDED]]

A. Counted

Each counted section is a finding that must point at its evidence. A section with no reading is printed as a gap, never as a pass.

A1 Files and lines by language

  • 3,859 physical lines in 48 files, counted file by file.
  • TypeScript: 2,472 lines in 29 files.
  • HTML: 669 lines in 9 files.
  • JavaScript: 360 lines in 9 files.
  • CSS: 358 lines in 1 file.

Evidence: file: scripts/sample.mjs; read: 2026-10-10T16:41:31.402Z

A2 Dependencies, with the end-of-life table

  • 3 runtime and 4 development dependencies named in package.json.
  • 116 packages resolved in pnpm-lock.yaml.
  • The end-of-life table is run by the desk on each order.

Evidence: file: package.json; lockfile: pnpm-lock.yaml

A3 Licence inventory

  • package.json declares UNLICENSED; no LICENSE file at the top level.
  • 0 installed packages declare: .

Evidence: file: each installed package.json; field: license

A4 Secret-pattern hits

Not run on this sample. Run by the desk on each order, with assay's secret patterns.

A5 Test files found

  • 6 test files under test/.
  • test/estimate.test.ts
  • test/finding.test.ts
  • test/rates.test.ts
  • test/readout.test.ts
  • test/receipt-memo.test.ts
  • test/till.test.ts

Evidence: test/estimate.test.ts, test/finding.test.ts, test/rates.test.ts, test/readout.test.ts, test/receipt-memo.test.ts, test/till.test.ts

A6 Open advisories, by ID

Not run on this sample. Run by the desk on each order, against the lockfile; a site build has no business calling an advisory database.

A7 The ShipSafe grade line

Not run on this sample. ShipSafe scans the target on each order, and its grade line is quoted here as printed.

B. Graded by the reviewer

Graded by the reviewer, evidence pointer beside each grade. The reviewer writes these per order, so a sample cannot carry them: the labels are the memo's, and the cells stay empty on purpose.

SectionGradeEvidence pointer
B1 Architecturewritten per orderbeside each grade
B2 Maintainabilitywritten per orderbeside each grade
B3 Delivery riskwritten per orderbeside each grade
B4 Securitywritten per orderbeside each grade
B5 Data handlingwritten per orderbeside each grade
B6 Bus factorwritten per orderbeside each grade

C. Remediation bands

Remediate, partial rebuild, full rebuild: each a cost band from refit, traced to the files it came from. Run per order; not run on this sample.

D. What was not read

  • Financial statements, revenue, costs or forecasts.
  • Contracts, customer agreements, and who holds title to the code.
  • A valuation, or any opinion on the price.
  • Running systems: servers, cloud accounts, databases and live customer data.
  • Any repository not named at intake.
  • This repository's git history and who wrote which line.
  • The deployed site and its functions as they run.

How to read a memo

Why are some counted sections marked not run?

Secret patterns, open advisories and the ShipSafe grade need the desk's machine and the network, and a website build has no business running them on itself at every deploy. On an order each one runs. A section that did not run is printed as a gap with its reason, because a blank section read as a pass is the error this memo exists to prevent.

What does an evidence pointer look like?

A file, and where it helps a line or a field: package.json, pnpm-lock.yaml, the license field of each installed package. A grade the reviewer writes carries the same kind of pointer, so a buyer's engineer, or the seller's, can open the file and argue with the grade.