FILE 01 · SERVICES Five engagements. Fixed scope. Fixed price where possible.
Five things
we will do for you.
Every service ends in a sealed receipt: findings by file and line (for code), or by claim and check (for attestations). A SHA-256 of the exact report, signed. You can re-run the harness we shipped and produce the same hash. If you can’t, that’s a defect in our practice and we want to know.
Not ready to buy? The method is open source: assay-kit. Run it on your own claim and publish a SELF-ASSAYED result. When we run it on you — blind, re-scored on a different model, signed — it is ASSAY-VERIFIED. The kit cannot produce the second one; only an independent party can. §01 is the trial.
§01Instant Repo Audit
You point us at a repository. We run the deterministic pass — dependency provenance, license, secret scan, dead-code & ghost-import count, test-to-assertion ratio, coverage vs. claimed coverage, build reproducibility — and return a sealed report. No interviews, no calls. If the repo won’t build, that is finding #01.
- What you get
- A PDF report + a machine-readable JSON receipt. Every finding cites path/file.ext:LN. Every metric shows the command that produced it.
- Turnaround
- 48h from executed engagement letter and repo access. Weekends do not extend it; we’re a small practice.
- Receipt contains
- Findings ledger · deterministic-check outputs · dependency SBOM (CycloneDX) · reproducer script assay-rerun.sh · SHA-256 of report bytes · signature.
- Not included
- Runtime behavior, live traffic analysis, or anything that requires production credentials. That’s Claim Verification.
- Price
- $990 · flat
§02Procurement Attestation
You are buying software. The vendor made claims in the RFP. We check the ones that can be checked from artifacts they can hand over (source, binaries, SBOMs, prior audit letters) without you having to trust that we chatted with them nicely.
- What you get
- An attestation letter, on ASSAY letterhead, addressed to your procurement officer. Each vendor claim is listed with one of three verdicts: VERIFIED, UNVERIFIABLE, CONTRADICTED. No fourth option.
- Turnaround
- 5–7 business days once artifacts are delivered. Clock stops if the vendor stops sending files.
- Receipt contains
- Claim ledger · artifact hash chain · license & provenance analysis · CVE cross-check · signature.
- Built for
- Enterprise SaaS purchases > $50k/yr, government IT procurement, insurer requests.
- Price
- $4,900 · flat, up to 12 claims
§03Claim Verification
A single, specific, technical claim — verified end-to-end. “Our model runs at 42 tokens/sec on an A10G.” “Our pipeline is exactly-once.” “We do not send prompts to third parties.” We build a reproducible harness, run it, seal the numbers, and hand it to whoever needs to trust them.
- What you get
- A written verdict on the claim as stated, and a harness anyone can run to reproduce the numbers. If the claim, as stated, cannot be verified with available access, we say so and refund.
- Turnaround
- 10–14 days depending on infra access. The harness itself is usually ready by day 5.
- Receipt contains
- The claim, verbatim · verdict · full harness repo · run logs · environment lock (Nix / Docker digest) · raw output files · report hash · signature.
- Refusal criteria
- We will not verify a claim we cannot rerun. We will not verify a claim we cannot state as a falsifiable proposition. Vague claims are returned to sender for rewriting, at no charge.
- Price
- $7,500 intro rate, first engagement
$12,500 standard, thereafter
§04Pre-Funding Review
For investors, before a wire goes out. Is the demo real? Is the codebase what the deck says it is? Are the numbers on slide 14 numbers or vibes? Fast, focused, boring on purpose.
- What you get
- A one-to-three page verdict letter. Three sections: Represented, Observed, Delta. If the delta is short, so is the letter.
- Turnaround
- 3–5 business days. We can do 48h at a 40% premium; we will still refuse to hurry a refusal.
- Receipt contains
- Verdict letter · pitch deck vs. observation ledger · repo audit (if code was provided) · list of unverifiable claims. Findings-only; not a valuation.
- Discretion
- Founder is not notified. Result goes to the investor of record only. Standard for the practice.
- Price
- $1,900 + · scales with claim count
§05M&A Diligence
The full dossier. Everything above, applied to a whole company, over weeks not days. We work under NDA with the acquirer and coordinate with counsel. This is the engagement where we go slowly on purpose.
- What you get
- A bound dossier: code inventory, license & IP provenance, key-person concentration analysis, deferred-work register, security posture, claim-by-claim verification of every representation in the LOI.
- Turnaround
- 3–6 weeks, typically parallel with legal & financial diligence. Interim updates weekly.
- Receipt contains
- Executive verdict page · findings ledger (usually 40–200 items) · reproducer scripts · SBOMs for every shipped artifact · signed hash of the whole dossier.
- Team
- Two ASSAY engineers, one JourdanLabs principal, one outside licensed reviewer as needed. Named on the cover page.
- Price
- $14,900 + · scoped in writing before start; no hourly billing
Send it over.