Handover permissions and states

Handover is an authenticated, rollout-gated organization workspace. This reference describes its current behavior at the canonical Handover host.

Hosts and routes

Route	Behavior
https://handover.infra.one	Shows the mandatory organization selector. With no selection, the page shows No organization selected and Select an organization to open its handovers.
/:organization-slug	Redirects to /:organization-slug/handovers.
/:organization-slug/handovers	Lists the organization’s Handover runs.
/:organization-slug/handovers/new	Validates a shared Drive folder and creates a run.
/:organization-slug/handovers/:run-id	Shows run progress, files, integrity, review states, and the checklist.
/:organization-slug/handovers/:run-id/request-list?format=csv	Downloads the current request list as CSV.
/:organization-slug/handovers/:run-id/request-list?format=md	Downloads the current request list as Markdown.

Handover has no separate sign-in routes. An unauthenticated deep link goes through Venture sign-in with a validated, service-allowlisted return target that preserves the exact Handover host, path, and raw query. The shared authentication pipeline can require a complete profile, confirmed email, and completion of pending two-factor authentication before returning.

For an already authenticated user, a legacy Venture route under /app/orgs/:organization-slug/handovers returns a permanent redirect to the matching canonical Handover route. The raw query is preserved, including repeated parameters. The legacy redirect does not pre-validate rollout access, organization access, run identity, or Handover capability; the canonical destination applies those checks.

If a legacy Venture route requires sign-in, the current browser redirect chain can leave you on Venture after authentication. Open the approved canonical handover.infra.one link instead. Do not repeat sign-in.

Handover is hard-hidden from the shared Venture sidebar, app switcher, and command palette. After organization selection, the canonical Handover shell shows its own Handovers navigation item. A direct approved link is required while the wider launch decision remains open.

Rollout and permissions

Access to an organization’s Handover workspace requires all of the following:

1. an authenticated current user;
2. membership in the organization;
3. the organization’s fund_handovers rollout flag or a fund_handovers rollout exception on the current user;
4. the manage_fund_handovers capability, which is assigned to organization admins.

The root organization selector applies the membership and rollout checks. Without a user-level exception it lists flagged organizations the user belongs to. With the user-level exception it can list all of the user’s organizations, including a newly created organization that has no organization-level flag. It does not prefilter by manage_fund_handovers, so selection can succeed before the destination denies a non-admin member.

Condition	Result
Rollout off on a list, new, or show page	Redirect to the caller’s Venture organization home.
Rollout off on a request-list download	Return not found rather than an export.
Missing manage_fund_handovers	Deny the management action.
Unknown run	Return not found.
Run owned by an organization the caller cannot manage	Deny the canonical run page with a not-authorized message and return the caller to their Venture organization home. A request-list download for a run the caller cannot manage is denied rather than exported.
Organization slug does not match the run	Authorization uses the run’s owning organization, not the slug alone.

Run states

UI label	Meaning
Queued	The run exists and is waiting for background work.
Walking folder…	Handover is recursively discovering Drive content.
Fetching files…	Discovered files are being downloaded or exported, stored, classified, and checked.
Evaluating checklist…	Declared label for checklist evaluation. The current finalizer does not write this state.
Completed	Discovery settled and the final checklist was committed.
Failed	A run-level failure prevented normal completion.
Canceled	An administrator canceled nonterminal work.

Evaluating checklist… is a declared run label, but the current finalizer never writes the evaluating state; a normal run can move directly from Fetching files… to Completed.

Completed does not promise that every file was stored or healthy, or that every checklist requirement was satisfied. Item failures and skips can coexist with a completed run.

File, integrity, PDF, and review states

File status

UI label	Meaning
Queued	Discovered and waiting to be fetched.
Fetching…	A file worker is processing the item.
Stored	A copy was written to Infra One storage.
Failed	Processing exhausted or encountered a terminal file-level failure. This alone does not require the run to fail.
Skipped	Handover deliberately did not store the content, for example because of a size or safety rule.

Integrity

UI label	Meaning
Not checked yet	No final integrity result has been recorded.
Readable	The stored content passed the applicable probe.
Empty file	The source contained zero bytes and otherwise passed storage safety rules. It is stored rather than skipped and classified as Note (filename is the message); it neither satisfies nor degrades a checklist requirement.
Corrupt at source	The source content could not be read as a valid instance of its format.
Password-protected	The content could not be inspected without a password.

The Integrity problems counter includes corrupt and password-protected files. It excludes scanned PDFs without a text layer even though they can degrade checklist matches. It also excludes empty files that otherwise pass storage safety rules; those files are classified as Note (filename is the message) and do not match checklist requirements.

Stored-file viewing

An available Stored item exposes Download. Its row also exposes View when Handover can build the File Viewer specification. Supported stored PDFs, images, and videos render in #handover-file-viewer. Office documents, archives, messages, active HTML, SVG, XML, text, and unknown formats use the unsupported-preview state and retain Download instead of an inline renderer.

File Viewer chooses the renderer from the canonical storage response type, not from the item’s displayed MIME type or extension. Preview and download use separate authorized URLs. Browser credentials are sent only to the configured first-party storage origin. Closing the viewer preserves the run’s current search, folder, filters, focus, and URL and returns focus to the row action.

Checklist PDF-text assessment

The current file table and File Viewer do not expose this assessment as a field or filter. Handover uses it internally when evaluating checklist matches; investigate a suspected scan with View or Download, or ask support to confirm the stored assessment.

Internal result	Meaning
Not a PDF	PDF-specific assessment does not apply.
Not determined	The first-three-page text assessment could not produce a result, for example because its probe was unavailable, failed, or timed out. This state alone does not degrade a checklist match; inspect the PDF manually.
Text present	The first three pages yielded at least 50 characters after trimming leading and trailing whitespace. The checklist treats the match as healthy, but this is not proof that the complete PDF is searchable.
Scanned — no text layer	The first three pages yielded fewer than 50 characters after trimming leading and trailing whitespace. This can degrade a matching requirement.

Manual review

UI label	Meaning
Untriaged	No manual review decision has been recorded.
Reviewed	An administrator marked the file reviewed.
Needed	An administrator marked the file as needed for follow-up.
Ignored	An administrator chose to ignore the file during manual review.

Manual review is independent of checklist evaluation. Mark needed does not add a request-list row, and Ignore does not remove one. Handover records exact duplicates internally but does not currently show a duplicate label in the file inventory.

Drive intake and storage behavior

• The dedicated service account uses Drive read-only scope, without domain-wide delegation or user impersonation.
• The submitted root can be a Drive folder URL, a scheme-less folder URL, an open?id= URL, a bare folder ID, or a one-hop shortcut to a folder.
• A root file or a root shortcut to a file is rejected. Inside a walked folder, file shortcuts are supported and processed through their targets. Folder shortcuts are also followed, with cycle protection.
• Handover lists all Drive result pages and recursively walks reachable folders.
• Google Docs, Sheets, Slides, and Drawings are exported to PDF. Ordinary files are downloaded in their source format.
• Active HTML, SVG, and XML content is retained as an inert attachment with a generic binary content type. Executable and script-like extensions are blocked from storage.
• ZIP, XLSM, and DOCM content can be stored and probed. Handover does not recursively unpack nested archives for classification or checklist coverage.
• Starting a run writes Handover records and copies to Infra One storage. It does not modify Drive or migrate documents into fund data.
• The run name is the Drive folder name, truncated to 255 Unicode code points.

Requirements checklist

The checklist evaluates the complete run corpus. It is not partitioned by fund or vehicle.

Severity	Requirement	Expansion or match rule
Required	Limited partnership agreement	One corpus-level requirement.
Required	General ledger	One corpus-level requirement.
Required	Bank details	A bank-details or bank-statement match can satisfy it.
Required	Fund administration agreement	One corpus-level requirement.
Required	Subscription agreement	One row per inferred investor.
Required	KYC pack	One row per inferred investor. A KYC/AML, passport, proof-of-address, or source-of-wealth category can match; the row does not require every component.
Required	Capital account statements	One row per quarter in the inferred continuous reporting range.
Required	Quarterly report	One row per quarter in the inferred continuous reporting range.
Required	Annual accounts	One row per observed reporting year.
Required	FATCA / AEOI filing	One row per observed reporting year.
Required	Drawdown notices	Consecutive rows from 1 through the highest inferred drawdown number.
Nice to have	Side letters	One corpus-level requirement.
Nice to have	Valuations	One corpus-level requirement.
Nice to have	Tax filings	One row per observed reporting year.
Nice to have	Partner transfers	One corpus-level requirement.

Investor expansion uses identities inferred only from investor-specific document categories. Quarter expansion creates a continuous range from the earliest through the latest quarter observed in reporting categories. Year expansion uses observed reporting years. If no investor, quarter, year, or drawdown domain can be inferred, the corresponding requirement remains as one unscoped row and is evaluated against every matching file; it is Missing only when none matches.

Checklist status	Rule
Present	At least one matching file is healthy. A healthy match overrides unusable matches.
Degraded	Matches exist, but every match is corrupt, password-protected, or a scanned PDF without text.
Missing	No file in the discovered corpus matches the requirement.

Because nested archives are not inspected recursively and evaluation is corpus-wide, use one fund or vehicle per run when fund-specific completeness matters.

Request-list exports

The request list includes only Missing and Degraded checklist rows. It rejects satisfied rows.

• CSV columns are Requirement, Scope, Severity, and Status.
• Markdown starts with Request list — run name and Documents we could not find (or could not use) in the handover folder:, then groups rows under Required and Nice to have when the corresponding severity has rows. An empty severity group has no heading.
• A degraded Markdown row ends with present but unusable, please re-send.
• format=csv selects CSV. format=md, a missing format, or an unknown format produces Markdown.
• The download filename is sanitized from the run name.

Handover renders request-list downloads in every run state. Before Completed, an initial run exports no checklist rows and a re-run continues to export the previous checklist snapshot, which can also have no rows, until final evaluation atomically replaces it. Wait for Completed before interpreting or downloading either export.

Limits and retries

Boundary	Current behavior
Ordinary file size	The storage cap is 250,000,000 bytes. A Drive-reported size above the cap is rejected before download and the item becomes Skipped. When Drive omits or understates the size, download can begin, but the storage backstop still rejects actual content above the cap and the item can ultimately become Failed.
Google-native reported size	A reported size up to and including 10,000,000 bytes passes the export precheck. A larger reported value is Skipped as export_too_large. Google-native files can omit that reported value, so this is a precheck rather than a proven export-size ceiling.
File inventory page	50 items per page. This is not a corpus limit.
Folder navigation	At most 1,000 immediate folders are exposed per level. Paths longer than 1,024 bytes are excluded from folder navigation. These are navigation limits, not documented total-corpus limits.
Discovery worker	Five retryable-failure attempts. A Drive rate limit snoozes the job for 60 seconds and preserves that failure budget, so repeated rate limits can produce more than five executions. Exhausting the failure budget fails the run.
File worker	Five retryable-failure attempts. A Drive rate limit snoozes the job for 90 seconds and preserves that failure budget, so repeated rate limits can produce more than five executions. Exhausting the failure budget fails the item; the run can still complete.
Finalizer recovery	When the run is not ready after discovery has completed, finalization repairs jobless queued or fetching items, snoozes for 10 seconds, and checks again. Snoozes preserve its retry budget, while transient execution failures have a 10-failure budget.

There is no verified total-file or total-byte corpus limit beyond the per-file and navigation boundaries above. Do not describe Handover as unlimited.

Automatic discovery retries continue from the saved folder frontier. They do not require a manual restart. If Drive access is revoked while the folder is being walked, the run can fail; restore Viewer access and use Re-run after the run settles.

Lifecycle actions and side effects

Action	Preconditions and effects
Cancel	Available for a nonterminal run. It cancels queued or executing jobs and retains file items in the states they reached. A terminal run refuses cancellation.
Re-run	Available after a run settles. It clears discovery state and walks the root again. Rediscovered regular files and direct targets are reclassified without another download when unchanged; eligible entries detected as changed, failed, or skipped are fetched again. A known shortcut-only entry is not redispatched on re-run, so use a new run or add the direct target when it must be refreshed. The previous checklist snapshot remains visible until final evaluation replaces it.
Delete	Cancels active work if needed, removes the run and its database rows, and schedules stored blobs for asynchronous deletion. A background deletion failure can leave storage cleanup requiring support intervention.

When a file detected as changed is fetched again, Handover schedules the previous stored blob for asynchronous release. If a later discovery walk does not rediscover a pre-existing item that was still queued or fetching before the walk began, Handover settles that leftover item as Skipped. By contrast, a source disappearance or access failure during an active download can exhaust retries and leave the item Failed. A terminal item whose source disappears later remains historical evidence across re-runs; re-running does not purge it. Use a separate new run when you need a current-only inventory.

Related pages

• Handover overview
• Start a handover
• Review a handover and export a request list
• Troubleshoot Handover