# Code preparation, sample and delivery checklist

Original blank working aid. Complete privately for the chosen route; it is not an executed agreement or a promise that all work is included. Never place credentials or reusable access secrets in a sample, manifest, report sent externally or delivery. Repository crosswalks, identity maps and reversal keys stay owner-held. Necessary rights/security evidence travels separately through a controlled review channel with secrets redacted, outside the licensed dataset.

## Before preparation

- [ ] Identify candidate, original revision, included history/context and selected lots.
- [ ] Name the business/rights owner, engineer and authorized recipient.
- [ ] Resolve title evidence or record exclusions and their technical consequence.
- [ ] Revoke/rotate exposed credentials immediately.
- [ ] Record the agreement permitting this access, copy, execution and network use.
- [ ] Name preparer, working environment, approved tools/subcontractors and owner review point.
- [ ] Specify funded extraction/scrubbing/transfer and any separately approved work.
- [ ] Preserve a secure original and create a separately controlled working copy.

## Prepare and verify

- [ ] Apply exclusions and identity transformations across included source, history and context.
- [ ] Keep any necessary identity and old-to-new commit maps privately controlled.
- [ ] Preserve useful issue/fix/review/test relationships and check them after transformation.
- [ ] Provide a permitted private-dependency mechanism or document the limitation.
- [ ] Record exact runtime/engine versions and setup instructions without production credentials.
- [ ] Rescan the prepared revision and inspect a representative sample.
- [ ] Run only the agreed build/tests in the authorized environment; save exact-version results.
- [ ] Record failures, skipped tests and limitations; do not substitute a scan pass for execution.
- [ ] Obtain the responsible owner's release decision for this version.

## Sample cover sheet

| Field                                                        | Value |
| ------------------------------------------------------------ | ----- |
| Candidate, prepared revision and sample ID                   |       |
| Selection method, size/unit and coverage                     |       |
| Included paths or record classes and exclusions              |       |
| Known gaps and likely weak point to test                     |       |
| Permitted recipient and purpose                              |       |
| Inspection, execution, model use or other operations allowed |       |
| Location, network, access and retention/deletion rules       |       |
| Decision-maker, agreed test and decision date                |       |
| Feedback, correction payer and next approved action          |       |

## Delivery manifest and acceptance

- [ ] Package ID, prepared revision and digest identify the bytes sent.
- [ ] Candidate IDs, refs, history/context, quantity and counting basis match the license.
- [ ] Exclusions and changes since evaluation are visible.
- [ ] Required objects, dependencies and setup instructions are included as permitted.
- [ ] Relevant scan/test evidence belongs to this version.
- [ ] Sender, authorized recipient and receipt event are recorded.
- [ ] Receiver checks integrity and agreed functional/coverage criteria.
- [ ] Acceptance/rejection is recorded by the authorized decision-maker.
- [ ] Corrections have a new version and relevant checks repeated.
- [ ] Invoice, payment and onward settlement are tracked separately.