Handover guide

This page is for the team taking over Drybench without the founder: what the asset consists of, which records bind it, which outside accounts and secrets it depends on, how to stand it up and check it, and what to do in the first thirty days. Figures were taken from the checkout at 17e455b on 10 October 2026; where a fact could not be checked from the repository, the page says so.

What the asset consists of

Drybench is one Next.js application in one Git repository (BiotechMat/drybench on GitHub, from git remote -v). It serves nine scientific apps, fourteen Education tools, a literature workspace, a shared research home called Bench, the public site and a small set of server routes from the root of its own origin. The code was carried over from the mbio.tech consultancy repository on 5 October 2026 (CLAUDE.md, D-0004, D-0005). The stack, layout and request flow are in Architecture.

There is no confirmed hosted deployment. docs/HANDOVER.md section 8 states that no hosted deployment or full-roadmap completion is implied, and every app in the registry has status preview. Account mode, Supabase and Stripe are built but switched off (WORKSPACE_ACCESS_MODE defaults to browser; D-0030, D-0032).

Repository at a glance

Measure	Value	How it was measured
Tracked files	3,604	git ls-files | wc -l
Tracked bytes	about 159 MB	git ls-files -z | du -cb --files0-from=-
Of which docs/	about 83.6 MB, of which about 70.9 MB are 335 PNG, JPEG and WebP images (review screenshots)	same, per directory
Of which public/	about 46.8 MB (shipped data and published verification files)	same
.git in this checkout	91 MB	du -sh .git
History	This checkout is a shallow clone (git rev-parse --is-shallow-repository prints true), so the full commit count is not known here; the complete history is on GitHub
Runtime dependencies	16 in dependencies, 10 in devDependencies	package.json

Generated files that are not tracked: public/vendor/ (the Mol*, RDKit.js and 3Dmol.js builds copied by scripts/vendor.mjs), public/third-party-notices.txt, .next/ and test output (.gitignore). See Dependencies and licences.

Lines of code by area

Counts are lines in tracked .ts, .tsx, .mts, .mjs, .js, .css, .py and .R files, test files included.

Area	Lines	What it holds
src/components/suite/	61,472	Shared shell, primitives, store, network layer, export writers, tokens
src/apps/	44,629	Each app's definition and workspace views; Education workspaces
src/components/tools/	43,970	Each app's domain code and panels
src/lib/	41,242	Shared scientific and workspace libraries (fit/, seq/, hosts/, workspace/, literature/, search/ and others)
content/	22,217	Registry, names, copy, route map, CSP generator, redirects
pipeline/	16,857	Data snapshot, build and verification scripts; independent oracles (Python, R, TypeScript)
e2e/	15,520	Playwright specs and support helpers
src/app/	10,338	App Router routes and API route handlers
scripts/	3,949	Build hooks, generators and repository checks
src/proxy.ts	33	The /technical guard

Across the repository, outside docs/ and public/, the total is 270,742 lines: TypeScript 162,593 (.ts), TSX 85,851, Python 12,104, MJS 4,239, MTS 2,798, CSS 2,038 and R 1,119. Test and spec files account for 51,796 of those lines. Some .ts files are data rather than logic (for example src/components/tools/molecule-workbench/pains-data.ts, src/lib/seq/codes-data.ts and the generated content/apps/app-index.generated.ts). The largest hand-written files are workspace views of 50 to 93 KB, led by src/apps/assay-analyser/views/assay-workspace.tsx.

The apps in the registry

The registry (content/apps.ts, one entry per app in content/apps/<slug>.ts) is the single record of every app. The values below were read from it on 10 October 2026; plannedApps is empty.

Slug	Product name	Route segment	Version	Status	Updated	Kind	On landing	Sources / excluded	Verification sets
protein-explorer	Drybench Protein	/protein	0.2.0	preview	2026-10-07	tool	yes	8 / 5	0
molecule-workbench	Drybench Molecule	/molecule	0.2.0	preview	2026-10-08	tool	yes	11 / 3	0
drug-pipeline-explorer	Drybench Pipeline	/pipeline	0.1.0	preview	2026-10-05	tool	yes	8 / 8	0
patent-exclusivity	Drybench Patent	/patent	0.1.0	alpha	2026-10-13	tool	no	3 / 4	1
inside-a-cell	Drybench Cell	/cell	0.1.0	preview	2026-10-05	educational	no (D-0021)	10 / 2	0
lab-calculators	Drybench Calc	/calculators	0.2.0	preview	2026-10-08	tool	yes	7 / 6	4
sequence-toolkit	Drybench Sequence	/sequence	0.4.0	preview	2026-10-10	tool	yes	12 / 9	11
assay-analyser	Drybench Assay	/assay	0.2.0	preview	2026-10-10	tool	yes	10 / 7	6
plasmid-map	Drybench Plasmid	/plasmid	0.7.0	preview	2026-10-10	tool	yes	8 / 8	11
bioreactor-simulator	Drybench Bioreactor	/bioreactor	0.2.0	preview	2026-10-07	tool	yes	7 / 6	4

Only Molecule sets flags.shareAlikeData (ChEMBL, CC BY-SA 3.0). "Preview" means every feature is available to everyone with no licence key and nothing on sale (AppStatus in content/apps.ts). Per-app detail is in Protein, Molecule, Pipeline, Patent, Cell, Calc, Sequence, Assay, Plasmid and Bioreactor; the registry itself is described in Registry and content.

Other product surfaces

Surface	Address	Where	Notes
Bench, Studies, Objects	/o, /o#studies, /o#objects, /o/..., /study/...	src/app/(workspace)/o/, src/app/(workspace)/study/, src/components/suite/objects/, src/lib/workspace/	Browser-local by default (IndexedDB); see Storage and state
Education tools	/<tool>/app for 14 tools: mutation, replication, splicing, pcr, atp-synthase, gene-switches, crispr, rna-shape, protein-structure, binding-inhibition, dose-response, dilutions-buffers, molecule-properties, growth-oxygen	content/education-tools.ts, src/apps/education/	Not registry apps; served with Cell's policy. See Education
Literature workspace	/literature	src/app/(workspace)/literature/, src/lib/literature/, src/app/api/literature/	Uses Europe PMC, OpenAlex and (optionally) the Anthropic API from the server. See Literature
Account page	/workspace	src/app/(workspace)/workspace/	Sign-in, backups and billing when account mode is on. See Server, accounts and billing
Public site	/, product pages, /docs, /pricing, /security, /regulatory, /changelog	src/app/(marketing)/	Hidden from search engines until launch (D-0026)
Landing export	/landing.json	src/app/landing.json/route.ts, src/app/(marketing)/landing-data.ts	Read by mbio.tech/apps; LANDING_EXPORT_VERSION is 5
Technical documentation	/technical	docs/technical/, src/proxy.ts, src/lib/technical-docs/	This set; no password since D-0081, not indexed; sole public link is the homepage MCP setup (18 October 2026 CEO request)
Developer kit	/dev-kit	src/app/(workspace)/dev-kit/	Only in builds with SUITE_KIT=1; never deployed

Shipped data and published verification files

Nothing is fetched at build time from scientific sources; the data the apps ship is committed under public/. Sizes are tracked bytes.

Directory	Files	Size	Content
public/data/search/	7	7.0 MB	Offline search catalogues (Disease Ontology, UniProt reviewed human entries, ChEMBL 37 names) with sources.json
public/data/education/	41	2.5 MB	Education scenes, posters and videos
public/data/inside-a-cell/	17	1.8 MB	Cell structures and scene data
public/data/molecule-workbench/	3	1.7 MB	ChEMBL library and precomputed example
public/data/drug-pipeline-explorer/	13	1.6 MB	Seven ClinicalTrials.gov/openFDA example snapshots plus index, five FDA precedent snapshots
public/data/bioreactor-simulator/	1	0.2 MB	preset-runs.json, rewritten by the prebuild step
public/data/plasmid-map/	5	0.15 MB	Versioned enzyme, feature, primer and example data
public/data/patent-exclusivity/	2	0.01 MB	The Patent app's store and change log, content-hashed, named by src/lib/exclusivity/store-manifest.ts; synthetic until the first capture (DAT-16)
public/data/lab-calculators/	1	0.04 MB	Reagent table
public/verification/	200	31.7 MB	Published oracle fixtures per app and version (Assay, Bioreactor, Calc, Plasmid, Sequence); write-once

Two data sets expire on a calendar: the Pipeline example snapshots (60 days, retrieved 5 October 2026) and the FDA precedent snapshots (90 days, retrieved 5 October 2026). Their dates, and when CI and npm test start failing because of them, are in Known issues and risks. How snapshots are made, refreshed and protected is in Data pipeline; sources and licences in Data sources; oracles in Oracles and verification.

Design, decision and evidence records

Location	Count	What it is
docs/design/	45 entries	Design system, shared contracts, PRDs, build specifications, feature plans. Code comments cite them by section ("DS §11.1", "contracts §2.4")
docs/board/decisions/	49 decision files plus README.md and TEMPLATE.md	The decision register, D-0001 to D-0052
docs/board/memos/	34	Dated officer memos
docs/reviews/	36 entries	Dated reviews with screenshots and verification evidence
docs/science/	4 audit records plus evidence/	Scientific audits of 7 and 10 October 2026 and their implementation records
docs/progress/		Historical build records
pipeline/*/README.md		Commands, sources, retrieval dates and licences per data set

docs/README.md is the index. docs/HANDOVER.md and docs/NEXT.md hold current status and open work; docs/drybench-brief.md and docs/research.md are the original brief and research of 5 October 2026.

Tests

Kind	Files	Location	Runner
Unit, TypeScript	308	src/**/*.test.ts	npm test (Node's built-in test runner with type stripping)
Unit, TypeScript	14	content/**/*.test.ts	npm test
Unit, TypeScript	3	pipeline/**/*.test.ts	npm test
Unit, scripts	15	scripts/**/*.test.mjs	npm test
Browser specs	91	e2e/**/*.spec.ts outside e2e/perf/	npm run test:e2e (Playwright, Chromium)
Timing gates	3	e2e/perf/	npm run test:perf, npm run test:perf:worker

That is 340 unit test files and 94 Playwright spec files. The most recent recorded unit run is "2,691 of 2,691 pass" on the UX audit integration tree (docs/reviews/2026-10-10-ux-audit/README.md, "Verification"); the same record lists 70 desktop browser-test failures, 58 of which also failed on main at 1ff7ca6, and later commits repaired specs. Neither result was rerun for this page. How the harnesses work is in Build, test and CI.

Governance and how decisions bind the product

The records

The founder acts as CEO. Six officer seats (CTO, CSO, CFO, General Counsel, CPO, CMO) are Claude Code agents defined in .claude/agents/ with job descriptions in docs/board/seats/; .claude/agents/ also holds two working agents (bench-app-builder, suite-improver), and .claude/skills/board/SKILL.md convenes the board. The charter is docs/board/charter.md. The General Counsel seat is paused until v1 is ready to go live (D-0010); items that would need it are listed under "Held for the General Counsel" in docs/board/open-questions.md.

Rules for the register: one file per decision; a decision is never edited, only superseded; the decision register and the design specifications take precedence over this documentation set and over the research (docs/board/decisions/README.md, CLAUDE.md). The register has two files numbered D-0028 (Assay reporting policies; Research sidebar) and no D-0031; both are recorded in the register's own notes and in Known issues and risks.

Decisions that constrain engineering

Decision	Constraint	Where it shows in code or process
D-0008	The suite serves from the root of its origin; old /apps/... and /tools/... addresses redirect	content/redirects.ts, content/apps/routes.ts
D-0010, D-0014	Compliance checks are advisory during development; a pre-live pass must get them clean, with the General Counsel's review	Forbidden-phrase scan, licence test, --release modes
D-0011	The BIO/Informa/QLS success-rate tables are removed; FDA precedent replaces them	scripts/removed-sources.mjs in CI
D-0015	Protein and Molecule keep two layouts with a toggle	App definitions under src/apps/
D-0016	Desktop renders at 110 per cent scale; text is never cramped	Tokens; the desktop Playwright project at 1408 × 880
D-0017, D-0030, D-0032	Accounts and a server are allowed; apps stay free; a paid Workspace on Supabase and Stripe is built but kept off while the browser Workspace is open	WORKSPACE_ACCESS_MODE, src/lib/workspace/, supabase/migrations/
D-0021, D-0027	Which apps appear on the landing page	landing field in the registry
D-0023, D-0024	The guided walk runs on real published data (PRISM, erlotinib hydrochloride)	src/lib/walk/, content/walks/
D-0025, D-0043	An input not yet read against its source may ship labelled "Unverified" while in preview	For example VAN_T_RIET in src/lib/hosts/transfer.ts
D-0026	Every response carries X-Robots-Tag: noindex until SUITE_INDEXABLE=1 at launch	noindexRules in content/apps/next-config.ts
D-0028 (Assay reporting)	IC50/EC50/C50 from assay intent; the within-plate permutation test at p < 0.05 gates a reported midpoint; relative weighting gives point estimates only; old fits are refitted, never deleted	Assay engines and copy; see Assay
D-0028 (sidebar), D-0029, D-0035 to D-0040, D-0044 to D-0046	Shared Research sidebar, one theme preference (Light default), visual hierarchy, Bench, object-first layouts, Molecule's shared start, library records only explicit saves, working Study per tab	Shared shell; see Shared shell
D-0041	The v0 roadmap: every new method ships with an independent reference fixture and a methods entry, or it does not ship; changes on branches merged only with green CI; scientific changes through the CSO	docs/roadmap.md; write-once fixtures
D-0042	Molecule accepts by name only small molecules or records carrying a structure	Molecule search and canonical catalogue
D-0047, D-0048	Size budgets are the CTO's to set; 14 budgets hold interim ceilings with release targets (releaseKB) checked at the pre-live pass	scripts/size-budgets/, scripts/size-check.mjs --release
D-0052, D-0081	Technical documentation is read at /technical, not indexed, with only the homepage MCP setup linked publicly (18 October 2026 CEO request); the password D-0052 required was removed by D-0081	src/proxy.ts, content/technical-docs.ts

The project rules in CLAUDE.md also bind every change: one registry and no product name outside content/app-names.ts; copy in content files; every contacted host declared so the CSP can be generated; keyboard operability, visible focus, 375 px and reduced motion (accessibility beyond what is built waits for the pass after v1, D-0080); heavy engines loaded on demand with licence texts; no analytics in workspaces; shared state in the #s= fragment; permissive licences only in anything shipped. How these are enforced is in Build, test and CI and Security and network.

External accounts and services

This section lists names and purposes only. No credentials are recorded in the repository (the workflows use no secrets.*, and a scan of tracked source files found no key-shaped strings; only the shallow history was available to scan). Whether each account exists, and who holds it, could not be verified from the repository unless stated.

Accounts the owner controls

Account	Used for	Evidence in the repository	State recorded
GitHub repository BiotechMat/drybench	Source, pull requests, GitHub Actions (ci.yml, scheduled.yml, snapshots.yml)	git remote -v; .github/workflows/	Exists. Owner entity open (Q-20). snapshots.yml needs the setting that lets Actions create pull requests
Vercel project	Hosting, build, environment variables, domains	README "Deploying"; next.config.ts; no vercel.json	Plan tier open: the Hobby tier excludes commercial use (Q-15). Deployment state not established (docs/HANDOVER.md section 8)
Domain drybench.com	Future production origin	D-0004, D-0006	Secured by the CEO on 5 October 2026 and held unused until trade-mark searches are read (Q-08). Registrar, price and renewal terms are not in the record (D-0006)
Supabase (test and production projects)	Accounts, Study backups, subscription records, shared literature quotas	supabase/migrations/ (three files), src/lib/workspace/, docs/workspace-setup.md	Prepared. docs/workspace-setup.md: "No provider project, live subscription or migration was created during this implementation"
Stripe	Annual GBP Workspace subscription, customer portal, webhooks	src/lib/workspace/billing.ts, src/app/api/workspace/billing/	Prepared, not exercised against live Stripe (docs/workspace-setup.md, "Before accepting payment")
Anthropic API	Literature evidence extraction, Study summaries, search planning; default model claude-haiku-5-5 (EXTRACTION_MODEL)	src/lib/literature/anthropic.ts calls api.anthropic.com/v1/messages	Optional; off unless the key is set, and hosted use also needs account mode and LITERATURE_AI_ENABLED=1
OpenAlex API key	Larger OpenAlex allowance for literature search	src/app/api/literature/route.ts, src/lib/literature/search/providers.ts, src/lib/literature/sources.ts	Optional; described as "the paid key" in Q-26. See issue SEC-01 in Known issues and risks
The maker's personal email address	Report-an-error mailbox, the mailto privacy note's twelve-month retention commitment, and the email parameter on NCBI E-utilities requests	maker.email in content/apps/maker.ts; operatorContact() in content/apps/operator.ts; src/components/tools/plasmid-map/eutils-client.ts	Personal address in code until the operator entity is named (Q-20)
mbio.tech and the consultancy repository	The maker's site (credited and linked); mbio.tech/apps renders this site's /landing.json; old suite addresses redirect here once the host is swapped	MAKER_URL in content/apps/maker.ts; src/app/landing.json/route.ts; README "Deploying"	A separate repository and Vercel project, not part of this one. Its variable NEXT_PUBLIC_DRYBENCH_URL lives there. Adoption of landing export version 3 is unconfirmed (docs/NEXT.md)

Public services the product calls

These need no account. The browser-side hosts are declared per app in the registry and become each app's CSP; see Security and network and Data sources.

Called from	Hosts
Browser, declared in the registry	rest.uniprot.org, www.ebi.ac.uk (PDBe, Proteins API, ChEMBL), data.rcsb.org, models.rcsb.org, alphafold.ebi.ac.uk, api.platform.opentargets.org, pubchem.ncbi.nlm.nih.gov, clinicaltrials.gov, api.fda.gov, eutils.ncbi.nlm.nih.gov (Plasmid, consent each time)
Server route handlers	PubChem, ChEMBL at www.ebi.ac.uk, UniProt REST, Europe PMC (www.ebi.ac.uk/europepmc), api.openalex.org, api.anthropic.com. The last three are not declared in any registry entry (Q-26)
Build	The npm registry (npm ci) and Google Fonts: src/lib/fonts.ts loads Inter, Bricolage Grotesque and IBM Plex Mono through next/font/google, which downloads the font files at build time
Scheduled CI	The verify jobs contact UniProt, AlphaFold DB, PDBe, Open Targets, RCSB PDB, Europe PMC, openFDA, fda.gov, the WHO stem book and NCBI E-utilities; snapshots.yml contacts ClinicalTrials.gov, openFDA and fda.gov

Secrets and configuration inventory

Every environment variable the code reads is listed, with where it is read and its default, in Deployment and environment. The table below groups them by what an owner must hold and rotate. A grep of process.env.* reads across src/, content/, scripts/, pipeline/ and e2e/ agrees with that page, with the exceptions noted after the table.

Variable	Secret	Set where	Effect when missing	How to rotate
OPENALEX_API_KEY	Yes	Vercel, server-only	OpenAlex calls go without a key and get the anonymous allowance	Issue a new key with OpenAlex, replace, redeploy. Rotate on takeover because of SEC-01
ANTHROPIC_API_KEY, ANTHROPIC_WORKSPACE_ID	Key yes; workspace id no	Vercel, server-only	AI extraction, summaries and search planning report "not configured"	New key in the Anthropic console, replace, redeploy
SUPABASE_SERVICE_ROLE_KEY	Yes	Vercel, server-only	Billing and the shared literature quotas are unavailable; see Server, accounts and billing	Rotate in the Supabase project, replace, redeploy
SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY	No (publishable)	Vercel	Accounts unavailable	Change with the project
STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET	Yes	Vercel, server-only	Billing is unavailable (checkout and the webhook answer 503)	Roll the key and the webhook signing secret in Stripe, replace, redeploy
STRIPE_WORKSPACE_PRICE_ID, STRIPE_WORKSPACE_LEGACY_PRICE_IDS	No	Vercel	Checkout unavailable	See docs/workspace-setup.md before changing the price
WORKSPACE_ACCESS_MODE, WORKSPACE_SITE_URL, WORKSPACE_DEVELOPMENT	No	Vercel or .env.local	Browser mode; account mode only with account
LITERATURE_* switches and daily limits	No	Vercel	Hosted AI and shared OpenAlex search stay closed
NEXT_PUBLIC_SUITE_ORIGIN, SUITE_INDEXABLE, SUITE_KIT, NEXT_PUBLIC_BUILD_HASH, NEXT_PUBLIC_BUILD_AT	No	Vercel build environment	Origin falls back to the Vercel production address; site stays noindex

Differences found in the cross-check:

• ALLOW_DRAFT_DATA is read only by src/lib/hosts/golden.test.ts, src/lib/hosts/presets.test.ts and src/lib/seq/plasmid-data.test.ts and is documented under Tests and tooling on Deployment and environment. Exact 1 bypasses their no-draft assertions in a builder's worktree; hash and numerical checks remain. CI and merge acceptance must leave it unset, and the independent write-once gate still applies.
• GITHUB_STEP_SUMMARY is read by pipeline/drug-pipeline-explorer/precedent/verify.ts; GitHub Actions sets it.
• NEXT_PUBLIC_DRYBENCH_URL belongs to the consultancy repository; nothing here reads it.

Values live only in the Vercel project settings and in developers' .env.local files (.env and .env.* are gitignored except .env.example). The repository cannot tell which of these are currently set on any deployment.

Standing the product up from scratch

Prerequisites

• Node 22.18 or later (.nvmrc holds 22.18; engines in package.json).
• Git. A production build needs a Git checkout or NEXT_PUBLIC_BUILD_HASH, otherwise assertProductionBuildInfo fails the build.
• Outbound network access to the npm registry and to Google Fonts (see above).
• For browser tests: Chromium installed by npx playwright install --with-deps chromium, or an existing binary at PLAYWRIGHT_CHROMIUM.
• Only for rerunning data pipelines: Python 3.12 in a virtual environment with each script's pinned requirements.txt, R with drc for the Assay oracle, and Blender for the Cell and Education renders. None of these is needed to build or run the site.

Build, run and test locally

git clone https://github.com/BiotechMat/drybench.git
cd drybench
nvm use              # or any Node >= 22.18
npm ci
npm run dev          # predev copies the vendored engines; http://localhost:3000

No environment variables are needed for the apps, Bench, keyless literature search or these pages at /technical (D-0081).

The checks the project requires before a change is finished (CLAUDE.md), in order:

npm run lint
npm test
npm run build        # runs the prebuild and postbuild steps
npx tsc --noEmit     # needs the route types the build (or `npx next typegen`) generates
npx playwright install --with-deps chromium
npm run test:e2e     # starts next start on port 3210 and an account-mode server on 3211
npm run size-check   # after a build

npm run build rewrites public/data/bioreactor-simulator/preset-runs.json; the 10 October audits recorded differences around 1e-14 between machines, so expect that file to show as modified after a build (see REL-09 in Known issues and risks).

Deploy

1. Create a Vercel project with the Next.js preset and the repository root as its root. There is no vercel.json; headers, rewrites and redirects come from next.config.ts.
2. Leave SUITE_INDEXABLE unset until launch (D-0026). Set NEXT_PUBLIC_SUITE_ORIGIN once a domain is attached; until then the origin falls back to VERCEL_PROJECT_PRODUCTION_URL.
3. Leave WORKSPACE_ACCESS_MODE unset (browser mode) unless account mode has been configured and tested by docs/workspace-setup.md.
4. Set optional literature keys only after reading Literature and SEC-01.
5. When the domain moves, set NEXT_PUBLIC_DRYBENCH_URL on the consultancy site's Vercel project. Browser storage is per origin, so saved work does not move with a domain change; people need to export and import it (docs/HANDOVER.md section 9).

Check a deployment

Check	Expected
curl -sI https://<origin>/	200, X-Robots-Tag: noindex until launch, no Content-Security-Policy
curl -sI https://<origin>/protein/app	200 with the Protein Content-Security-Policy, Referrer-Policy: no-referrer, Cross-Origin-Opener-Policy: same-origin
curl -s https://<origin>/landing.json	JSON with "version": 5 and Access-Control-Allow-Origin: *
curl -sI https://<origin>/technical	404 when not configured; 401 with a Basic challenge when configured
curl -sI https://<origin>/dev-kit	404
About › Version in any app	The deployed commit's seven-character hash, not dev
Pipeline welcome and landing examples	Shown while the example snapshots are under 60 days old
Browser tests against the deployment	E2E_BASE_URL=https://<origin> npx playwright test --project=desktop runs the main specs without starting a server. Specs that depend on the test server's own settings will not pass against a real deployment, and the account projects need their own server

First thirty days for a new owner

Ownership and credentials

• Settle which entity owns the code, the GitHub organisation, the Vercel account and the domain, and record the assignment (Q-20). Transfer the GitHub repository, the Vercel project and the drybench.com registration; obtain the registrar login and renewal date, which are not in the record.
• Decide the Vercel plan; the record says Hobby excludes commercial use (Q-15).
• List every variable set on each Vercel environment and rotate every secret in the inventory above, starting with OPENALEX_API_KEY (SEC-01); delete TECH_DOCS_USER and TECH_DOCS_PASSWORD, which nothing has read since D-0081. Confirm whether Supabase, Stripe, Anthropic and OpenAlex accounts exist at all; the repository records that the Supabase and Stripe projects were not created.
• Replace the maker's personal address in content/apps/maker.ts with an operator address once Q-20 names the operator (content/apps/operator.ts). It is the error-report mailbox, the mailbox the mailto privacy note commits to keep messages in for twelve months, and the contact NCBI receives on Plasmid fetches.
• Review GitHub settings the repository cannot show: collaborators, branch protection, Actions enabled, the "Allow GitHub Actions to create and approve pull requests" setting, and whether the repository is public (scheduled workflows in a public repository stop after 60 days without activity, scheduled.yml lines 7 to 10).

Continuity of scheduled work

• Confirm that ci.yml is green on the default branch. The 10 October audit recorded every main run since 8 October as failed or cancelled; repairs were merged afterwards (58cf841), and the current state was not checked for this page.
• Confirm that scheduled.yml ran on the last Monday and that snapshots.yml will run on 1 November 2026. Merge the snapshot pull request it opens and redeploy before 20 November 2026, when the staleness alarm starts and, a day later, npm test begins to fail. The FDA precedent snapshots need a refresh before 21 December 2026. Exact dates are in Known issues and risks.
• Scheduled failures notify the person who last edited scheduled.yml; make sure that is someone on the new team.

Legal and scientific holds

• Read the "Held for the General Counsel" list and questions Q-03, Q-08, Q-09, Q-10, Q-11, Q-13 and Q-20 in docs/board/open-questions.md with counsel. They cover ChEMBL share-alike reuse, trade-mark clearance, ClinicalTrials.gov storage terms, the dependency-licence exceptions, the operator's identity, privacy notices for accounts and local storage, REBASE, PRISM and Drug Repurposing Hub terms, and public claims. None is concluded in this documentation.
• Assign the named human scientific reviewer (Q-19). No app should leave preview without it.
• Read the open items in Known issues and risks, starting with the security table.

Knowledge transfer

• Walk through the bus-factor items below with the founder and write down the answers in the decision register or in docs/HANDOVER.md.

Bus-factor items

Held outside the repository

• The Vercel project's configuration: which variables are set where, attached domains, plan, deployment protection and any firewall rules.
• GitHub repository settings and the identity of the account that owns BiotechMat.
• The drybench.com registrar account, price and renewal date (D-0006 says these are not in the record).
• Whether provider accounts exist (Supabase, Stripe, Anthropic, OpenAlex) and their billing.
• The consultancy repository that consumes /landing.json, its deployment and its snapshot of the landing export.
• The error-report mailbox and any messages kept there under the twelve-month commitment.
• The reasoning behind founder decisions beyond what the register and memos record, and the trade-mark search results if any were run (Q-08 is open).

Done by hand

Task	Where described	Notes
Review and merge the monthly snapshot pull request, then redeploy	Data pipeline	Nothing merges itself
Rerun data builds and oracles (Python, R, Blender)	pipeline/*/README.md	Some scripts refuse any upstream release other than the pinned one
Run pipeline/education/verify.py after an Education media rebuild	Data pipeline	Not in the scheduled matrix (REL-07)
Freeze draft data versions (--freeze, --bump) and publish verification sets (publish.py)	Data pipeline	Write-once once on main
Obtain a passing quiet-host Bioreactor worker report within seven days of a release	docs/NEXT.md; D-0047	Two-core CI runners give inconclusive results
Run node scripts/size-check.mjs --release and npm run check-licences -- --release at the pre-live pass	Build, test and CI	D-0048; licence pages must have been read within twelve months
Bump LANDING_EXPORT_VERSION and tell the consumer's owner when the export shape changes	CLAUDE.md; Deployment and environment	The consumer keeps its last snapshot until updated
Regenerate committed derived files (accents, client index, static method labels)	Build, test and CI	npm test fails when they are stale

How the code was produced

Most recent work was done in Claude Code sessions, with the officer agents in .claude/agents/ advising and dated records written by those sessions. The 10 October scientific audit (docs/science/2026-10-10-scientific-audit-of-the-7-to-10-october-changes.md, section 7) observed that several verification claims in earlier records were made with a Node flag CI does not use, on branch trees that differed from main, or on focused subsets. Treat a recorded result as describing the tree it names, and rerun checks on the tree you take over.

Where to find everything

Question	Page or record
How the application is put together	Architecture
The app registry, copy and how to add an app	Registry and content
The shared shell, navigation and theme	Shared shell
Browser storage, Objects, Studies, shared links	Storage and state
CSP, network layer, server-side proxies	Security and network
API routes, accounts, billing, Supabase schema	Server, accounts and billing
Each app's science and code	Protein, Molecule, Pipeline, Patent, Cell, Calc, Sequence, Assay, Plasmid, Bioreactor, Education, Literature
The scientific methods across the suite	Science overview, Engines
How results were checked against independent tools	Oracles and verification
Every data source, licence and read date	Data sources
npm dependencies, vendored engines, licence policy	Dependencies and licences
Snapshots, pipelines and their expiry	Data pipeline
Scripts, tests, CI workflows	Build, test and CI
Vercel, environment variables, redirects, landing export	Deployment and environment
Open defects, risks and dates	Known issues and risks
Decisions, open questions, held legal items	docs/board/decisions/, docs/board/open-questions.md
Current status and open work	docs/HANDOVER.md, docs/NEXT.md, docs/roadmap.md
Scientific audits and evidence	docs/science/
Account activation steps	docs/workspace-setup.md