# What you receive — deliverables

> **Audience.** Procurement, CTO, IT admin. The exhaustive list of what
> lands in your hands at the end of any Bilbs engagement.
> ⟵ [back to docs index](../README.md)

This page describes what a **Build engagement** (6-week fixed-price)
delivers. An **Audit** engagement delivers a subset (items marked 🅐).
An **Embedded** retainer produces a rolling subset over time.

## 01 · Physical goods (if a Box is in scope)

- [ ] The Bilbs Box, configured to the tier you ordered —
      [Mini](../tiers/box-mini.md) / [Box](../tiers/box.md) /
      [Pro](../tiers/box-pro.md) / [Cluster](../tiers/box-cluster.md).
- [ ] Spare hardware kit as listed in
      [whats-in-the-box.md](../setup/whats-in-the-box.md).
- [ ] Flight case (yours to keep; also the RMA-return vessel).
- [ ] All cabling for first-boot operation.
- [ ] Printed wallet card with serial + support PIN + first-boot
      password.
- [ ] OEM warranty cards passed through to you.

## 02 · Software artefacts

All artefacts are delivered in a **private Git repository** hosted on
your GitHub/GitLab/Bitbucket (your choice), with full history. You own
the repo and its contents on final payment.

- [ ] **Model weights** — fine-tuned on your corpus. Safetensors format.
      One committed version per base model; older versions tagged by
      release.
- [ ] **Dockerfile** — pinned to exact dependency versions, reproducible
      build.
- [ ] **Helm chart** (if cloud deployment) or full image bundle
      (if Box).
- [ ] **Terraform module** (if cloud) or Ansible playbooks (if
      datacenter) 🅐.
- [ ] **Runtime code** — inference server, orchestration, admin API,
      admin UI. All under the MSA IP assignment, becomes yours on final
      payment.
- [ ] **Eval harness repo** — your acceptance suite, your drift-detection
      tests, your golden traces. Runnable via `make eval`. 🅐
- [ ] **Load-test harness** — k6 / Locust scripts that reproduce your
      target concurrency.

## 03 · Documentation

- [ ] **Printed runbook** (~60 pages, laminated) 🅐.
- [ ] **PDF copy of the runbook** in the Git repo at `/docs/runbook.pdf`.
- [ ] **Architecture document** 🅐 — data-flow diagram, component
      boundaries, trust boundaries, decision log.
- [ ] **Video walkthroughs** (Loom-style recordings) — one per
      subsystem. Typical count: 8 videos of ~12 min each.
- [ ] **This doc tree** (the one you're reading) customised with your
      Box's serial and URLs.
- [ ] **Admin onboarding checklist** — what a new IT admin needs to
      know in their first 60 minutes. Printable.
- [ ] **Incident-response playbook** — paged from the runbook — "box
      down" / "model regressed" / "hardware RMA" with exact commands.
- [ ] **Cost model spreadsheet** 🅐 — comparing the Box's TCO against
      cloud-API pricing at your measured token volume.

## 04 · Access & credentials

On handover day, you receive:

- [ ] **Admin credentials** — rotated at the end of UAT; printed on a
      wallet card and deleted from our side once you confirm rotation.
- [ ] **SSO app registration** — completed in your IdP during install.
- [ ] **Repo access** — commits transferred to your org; our
      engagement engineer retains read-only for 30 days.
- [ ] **Cloud IAM roles** (if cloud) — scoped to the exact workload;
      revocable at any time from your console.
- [ ] **GPG signing keys** — for signed releases on the Updates plan
      (if subscribed).
- [ ] **Wallet card + support PIN** for the Box.

## 05 · Compliance artefacts

- [ ] **Signed SOW + MSA + DPA** in a durable PDF bundle. 🅐
- [ ] **SBOM (CycloneDX format)** — every dependency with version,
      licence, and CVE scan.
- [ ] **Dependency licences** — full listing, grouped by licence type
      (MIT / Apache / etc.), with attribution notices.
- [ ] **Third-party disclosures** — any sub-processor used.
- [ ] **SOC 2 Type I attestation letter** (under NDA). 🅐
- [ ] **Cryptographic module manifest** — what's used, where, with
      validations if applicable.
- [ ] **Data-residency map** — where every byte of your data lived
      during the engagement.

## 06 · Metrics & measurements

Baseline numbers captured during the engagement for you to compare
against later:

- [ ] **Latency histogram** at target concurrency.
- [ ] **Eval-suite pass rate** at go-live (typically 98%+).
- [ ] **GPU utilisation curve** across the load-test envelope.
- [ ] **Cost per 1M tokens** measured from real inference.
- [ ] **Cold-start time** from power-up to first-token-served.
- [ ] **Failover time** (HA configurations) under simulated failure.

All captured in a single `baselines.md` at the repo root; referenced
later by the drift-detection alerts if you subscribe to Updates.

## 07 · The 30-day post-launch window

For 30 days after handover:

- [ ] Your engagement engineer answers questions directly in Slack.
- [ ] Bug fixes to anything delivered under the SOW are free.
- [ ] One "stabilisation sprint" — up to 3 developer-days of patching
      anything surfaced during the first weeks of real use.
- [ ] A 30-day wrap-up call with retrospective, lessons learned, and
      a recommendation on whether to subscribe to Support / Updates.

After 30 days, contact moves to `admin@groupebilbs.com` or your private
Slack channel (if on Support plan).

## 08 · What you do *not* receive

Not included — ask us for a separate SOW if you want any of these:

- **Ongoing feature development** — that's Embedded.
- **New integrations / tools added post-launch** — scoped individually.
- **Regulatory audits** (e.g., HITRUST-certified assessor work) — we
  can refer but we are not the assessor.
- **User-facing product copy / brand** for your internal chat UI — we
  deliver a skinnable admin UI; brand treatment is yours.
- **Training-data annotation labour** — if your corpus needs labelling,
  we scope an annotation partner separately.
- **Bilbs's own trademark usage** in your product — you keep the trade
  name out of customer-facing surfaces.

## 09 · Ownership summary

| Item | Who owns it on final payment |
|------|------------------------------|
| Hardware | You |
| Fine-tuned weights | You |
| Base-model rights | Upstream author (governed by their licence) |
| Runtime code (Bilbs-authored) | You, under the MSA assignment |
| Third-party dependencies | Their respective authors, under their licences |
| Your corpus / data | You (we never had it) |
| The flight case | You |
| The `Bilbs` trademark | Groupe Bilbs inc. (you use it only in the agreed marketing footer, if any) |

## 10 · If something's missing

Check the SOW first. If the SOW clearly promised a deliverable and
handover day passed without it:

1. Raise it in the handover call.
2. We credit it, fix it, and ship within the 30-day window at no
   extra charge.
3. If the missing item is ambiguous in the SOW, we'll err on the side
   of delivering it and update the SOW template for future
   engagements.

---

See also: [process.md](./process.md) · [msa-dpa.md](./msa-dpa.md).
