AGENCY OWNS Source repository Container images, built from that source Data, in the agency's Postgres Runbooks and the evidence pack ALLSTON Builds, tests, hands over Removable at any contract boundary

What you keep when the contract ends

Everything. This page lists it, item by item, with the way each one is verified on a machine we have never touched. The list is delivered with the first release of every system we build, and re-tested at every release after that.

The claim

An agency that ends its contract with Allston Systems holds a complete, ordinary software project and the tools that built it. What it holds is the same thing a strong in-house team would have produced by hand, because that is what the generators emit.

The list

1. A standard codebase with no proprietary runtime. .NET and Angular on PostgreSQL. Mainstream, permissively licensed open source, and skills an agency can hire. There is no interpreter, no licensed engine, and no design-time artifact the code depends on. Remove every trace of us and the system builds, tests, and deploys as before. Leaving a low-code platform means leaving the runtime the application is. Leaving us means changing a git remote.

Verify: clone the repository on a clean machine, run the build, run the tests.

2. The generators, not just their output. Every scaffolding tool ships inside the system: full-stack feature slices, event-sourced case workflows, accessible multi-step forms from a reviewable spec file, data tables, background jobs, admin views, integrations, and demonstration scenarios. A successor team, or the agency’s own, keeps generating Section 508 conformant features at the same speed without us.

Verify: run one generator, build, and open the new feature.

3. The compliance record as a living artifact, not a binder. The control map ties NIST SP 800-53 controls to the tests that prove them. CI regenerates the evidence pack on every green run, in human-readable, machine-readable, and OSCAL forms, stamped with that run’s URL. Accessibility is enforced rather than asserted: every route is scanned in CI, forms inherit one audited error pattern, and plain-language and translation gates run on every commit. An assessor’s package regenerates from the repository at any commit, including after we are gone.

Verify: run the CI pipeline and open the evidence pack it produces.

4. The verification machinery. The same CI that gated our work gates the agency’s: build, unit, functional, and architecture tests, the accessibility crawl, dependency and SBOM gates, and evidence regeneration. None of it phones home. All of it runs on commodity runners.

Verify: make a change that breaks a control and watch the build refuse it.

5. The demonstration apparatus. Named seed scenarios and one-command capture demonstrations transfer with the system. The agency can demonstrate its own system to its own stakeholders without us in the room.

Verify: run the seeded scenario and walk a case through its states.

What you lose

Our maintenance stream: the security advisories and fixes we port from Forge into the system while under contract. After close-out, the agency’s team ports them, or a new vendor does. The tooling that does the porting is part of what the agency keeps. Retention is earned by the quality of the work and the value of that stream, never by a runtime the agency cannot leave.

Why this is credible

  • It is how we build for ourselves. Our reference system is maintained through the same sync-and-advisory flow an agency would use. The exit path is the daily path.
  • It is testable in an afternoon. Hand an evaluation team a generated system and this page. Every numbered item above is checkable without a meeting.
  • The honest caveat. Platform vendors hold FedRAMP SaaS authorizations and offer real business-user self-service configuration. We compete on ownership, auditability, and how fast accessible features ship, and we say so before being asked.