Assurance · Deliverable

Software assurance review — Northwind Grants

Ruleset v1 · delivered 2026-03-20

Independence

39/100

You can run

11%

Backend tests

Lint problems

821

AI-assisted

40–50%

Findings

The verdict

The independence test passed only 5 of 18 checks (39/100): the code compiles and type-checks, but Northwind could not install its dependencies, start, run or deploy Grants Manager V3 without the vendor. The two critical domains are dependency & lock-in (63 private vantage/* packages on a vendor-owned repo, registry and CI) and test coverage (9 backend tests, 0 frontend/E2E on a live production system). Delivery slipped through four missed targets before a filing-window MVP.

Top findings

The backend can't be built or deployed without vendor registries: 63 private vantage/* packages plus @vantage npm.
Dependency & lock-in
Critical
9 backend test files and zero frontend/E2E tests protect 380K lines; CI runs only a typecheck.
Test coverage & release control
Critical
Plaintext AWS access keys (prod + staging S3) and a default admin password were committed to the repo.
Secrets & credential exposure
High
No IaC, backup/DR, or monitoring for RDS, Elasticsearch, StarRocks or Kafka.
Infrastructure & recovery
High

Remediation progress

3 done · 4 in progress

38%

Safety net first (secrets, registry, CI/CD, tests), then full independence — tracked as the in-house team executes.

Recommended path

Vendor continues, add oversight (recommended)

Low

5 months — Lowest risk first step: don't replace the vendor — verify Northwind can. Embed a QA engineer and the build checklist answers, within 30 days, whether Northwind could operate independently.

Deliverables

Executive brief (2 pages)Included
Independence verification checklist (18 checks)Included
Full technical assessment (10 domains)Included
Delivery record (triangulation)Included
Ranked remediation roadmapIncluded
Transition risk modelIncluded

Bottom line

Northwind Grants could not build, deploy or recover its own software without the vendor (39/100). We proved it, priced the exit, and the in-house team is now taking over with a safety net first — no interruption to a live service. Ongoing engineering intelligence tracks the value from here.