61 things that have to pass before handover.
This is the gate every engagement passes before handover, published in full and in advance, so you can hold us to a list rather than to the phrase “we test thoroughly”.
One list, with every group labelled by what it covers: performance, accessibility and whether every form actually submits on any site; retries, blast radius and an off switch once it is doing work on its own. Then a person looks at it, because the list below can tell you a site is correct and cannot tell you it is any good.
We sell measurement, so we publish our own.
This is the gate above, run against this site. It is the cheapest way to find out whether a studio means what it says about quality — and the rows that miss their target stay on the table.
| Page | Performance | Accessibility | Best practices | SEO | LCP |
|---|---|---|---|---|---|
| Home | 97 | 100 | 100 | 100 | 2.5s |
| Migration | 99 | 100 | 100 | 100 | 2.0s |
| Work | 99 | 100 | 100 | 100 | 2.1s |
| Services | 99 | 100 | 100 | 100 | 2.1s |
| Build | 99 | 100 | 100 | 100 | 2.0s |
| This page | 99 | 100 | 100 | 100 | 2.1s |
| Assessment | 99 | 100 | 100 | 100 | 2.1s |
| Writing | 100 | 100 | 100 | 100 | 1.6s |
| About | 99 | 100 | 100 | 100 | 2.0s |
Lighthouse 13.4.1, mobile with simulated throttling, three runs per page against production, medians here. Medians, not best runs — the first version of this table published single runs, and re-measuring the same pages minutes later came back seven to ten points lower. Run it yourself; your network and device will give you different numbers again.
9 of the 9 clear the 2.5s LCP we hold client work to. All of them, this time — which makes this the least interesting version of this table and the one you should take least on trust. Earlier measurements have missed, those rows stayed up, and when the next change puts one back it will stay up too. The home page is on the line rather than clear of it. Accessibility, best practices and SEO sat at 100 on every page and every run of that measurement.
Fails here, and it does not get handed over.
These run before anything reaches production and again before handover. A failure sends the work back rather than forward, which is what keeps a short timeline from turning into a system nobody trusts.
It survives failure
Automation & applicationsIntegrations break — a CRM renames a field, an API rate-limits. The standard is about what happens next.
- Every automated action is idempotent — a retry never sends two of anything
- A failed delivery is retried, and alerts a named person when it keeps failing
- A form never reports a success it cannot back up
- A third-party outage degrades to something the visitor can still act on
- Every automated run logged with its trigger and its inputs
Access is deliberate
Automation & applicationsFor anything with accounts. Decided once and enforced, rather than granted per request and never reviewed.
- Role-based access, with the roles agreed in writing before build
- Personal data identified, and reachable only by the roles that need it
- Retention and deletion handled rather than left to accumulate by default
- No client's data reachable from another client's environment
- Admin actions attributable to a person
Automation is safe to run
Automation & applicationsThe checks that separate an automation from an unattended liability.
- Every action is reversible, or gated behind a person
- Blast radius bounded — no workflow can act on every record at once
- Exercised against real data in a dry run before anything writes or sends
- Nothing reaches a real customer from a staging environment, ever
- An off switch a non-engineer can find and use
An assistant knows its limits
Automation & applicationsApplied only when an AI feature ships. Most of the time the honest answer is a better FAQ.
- Grounded in your own content, with the sources it used inspectable
- The boundary of what it will attempt agreed in writing before build
- A clear route to a person for anything outside that boundary
- Tested against the questions it will actually be asked, not a demo script
- It never invents a price, a policy or a commitment
Nothing left half-done
EverythingEvery placeholder is a small message that says nobody checked.
- Production build succeeds, zero type errors, zero lint errors
- No lorem ipsum, no TODO, no framework defaults left anywhere
- No placeholder images, greyboxes or sample rows
- No dead links, and no staging or localhost URLs in source or output
- Favicon replaced, real 404 page present
It is fast enough
Every siteA floor, not an aspiration. Below this it does not ship.
- Lighthouse mobile performance at or above 70
- Largest Contentful Paint under 2.5s
- Cumulative Layout Shift under 0.1
- Interaction to Next Paint under 200ms
- Images sized, modern formats, lazy-loaded below the fold
Everyone can use it
Every siteNot a compliance checkbox — roughly one in five of your visitors.
- Zero axe-core violations at critical or serious
- Text contrast at least 4.5:1, and 3:1 for large text
- Every interactive element reachable by keyboard, with a visible focus indicator
- Labels on form inputs, alt text on images
- One h1 per page, heading levels never skipped
- prefers-reduced-motion respected
It works on a phone
Every siteChecked at real widths, not by dragging a browser window.
- No horizontal overflow at 320, 375, 768, 1024 and 1440px
- No text clipping or overlap at any of them
- Tap targets at least 44×44px
- Navigation works on mobile, not only on the desktop layout
Every path actually works
Every siteThe ones that decide whether an enquiry reaches you at all.
- Every form submits end to end, against the real delivery path
- Validation and error states readable, and never a false success
- Success states confirm that something happened
- Named conversion events firing, and evidenced at handover
- Every call to action goes where it claims to
It can be found and shared
Every siteThe half of SEO that is just not getting the basics wrong.
- Unique title and meta description per page
- Open Graph and Twitter tags present — and the preview image actually renders
- sitemap.xml and robots.txt correct, canonical URLs set
- Structured data that validates and matches what is on the page
- Semantic HTML, not div soup
Secrets and integrity
Everything- No credentials, keys or tokens in code or in a repository
- Credentials in the client's own secret manager, in their name
- Data encrypted in transit and at rest
- No known critical vulnerabilities in dependencies
It can be operated without us
EverythingThe check that decides whether you bought a system or a dependency.
- Runbook for every scheduled job, including how to fix a failure
- Architecture and data model documented as it was actually built
- The client's own team has run a recovery once, with us watching
- All infrastructure in the client's accounts, billed in their name
Scope conformance
EverythingThe check that catches confident work on the wrong thing.
- The business metric agreed at scoping is measured and reported against
- Every deliverable agreed is present
- Nothing outside the agreed scope was invented and added
A stack your next developer can take over on a Monday.
Every row answers the same question: what happens to this if we stop working together? That is the only thing about a stack a non-technical buyer should have to care about, and it is the question an agency’s choices usually answer badly.
- Next.js, static-first
- Conventional and widely hired for. No proprietary runtime to be stuck inside, and no vendor whose pricing decides whether your site stays up.
- TypeScript
- Types ship with the handover. Your next developer reads the codebase without a tour from us.
- Tailwind and brand tokens
- Your identity lives in tokens, so a colour or type change is one file rather than a hunt through a stylesheet.
- Markdown, or a CMS when earned
- A CMS arrives when somebody non-technical actually has to publish — not automatically, and never as a way to keep you on a platform.
- Server actions, direct delivery
- No third-party form host between you and your own enquiries, and a failure tells the visitor rather than swallowing the lead.
- Event-driven, idempotent
- Triggered by something real happening, and safe to retry — so a double submission never sends two invoices or two emails.
- Named events, wired at build
- Conversion events instrumented on day one and evidenced at handover. Included, never an upsell.
- Vercel, your account
- Billing and access in your name from day one. We are removable, deliberately.
- Brand identity from zero, illustration systems, or video production
- Ads management, or SEO retainers beyond the Growth plan
- Native mobile applications
- Unlimited revision rounds — the proposal names the number
- Final copy, unless copywriting is on the quote
- Rebuilding you into another platform you cannot leave
A boundary discovered halfway through a build costs both sides more than an awkward sentence in a proposal. Scope, exclusions, the number of revision rounds and who owns what are agreed in writing on day one — including which reusable components stay ours and which deliverables become entirely yours.
A machine can tell you the pipeline is correct. It can’t tell you it was worth building.
Everything above raises the floor. This is the ceiling, and it stays with a person — which is the entire reason the company is shaped the way it is.
The template test
Could someone look at this and name the template it came from? If yes, it fails, regardless of how well it scores everywhere else. This is the check that separates a site built for you from a site that merely fits you.
Typography, space and hierarchy
A consistent scale with no one-off sizes, spacing from a system rather than magic numbers, and one clear focal point per screen. Accent colour used rarely enough to still mean something.
The first screen earns the second
A stranger should be able to say what you do and who it is for without scrolling. Everything below that is only read by people the first screen convinced.
Copy that sounds like you
Specific rather than generic, and not interchangeable with a competitor's. Calls to action that say what actually happens next, rather than 'Learn more'.
Motion that is not in the way
Present, restrained, consistent, and never delaying an interaction. Degrades cleanly when someone has asked the operating system for less of it.
The automation is trusted
If the team keeps checking it by hand afterwards, it has not removed the work — it has added a system on top of the work. Adoption is the measure, not deployment.
The honest 'no'
Some of what gets asked for should not be built: the page nobody will read, the feature that adds a maintenance burden for one visitor a month, the AI answer that should be a phone number. Saying so is part of the standard.
The handover test
Could their team run this if we disappeared tomorrow? If the honest answer is no, it is not finished — regardless of how well it performs.
Hold us to it.
If something we hand over fails a check on this page, that’s a defect and it gets fixed free — inside the 30-day warranty and after it.